{"text_format":"1","workbook":"xlsx","n_sheets":20,"sheets":["Introduction","Instructions","1","2","3","4","5","6","7","8","Self-assessment Summary","Self-assessment Charts","Self-assessment charts (pie)","External Assessment Summary","External Assessment Charts","Report","Definitions","Drivers","All","Migration"],"not_rendered":{"charts":163,"images":2,"macros":1,"external_links":0,"defined_names":131,"comments":2,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Introduction","index":0,"n_rows":39,"n_cols":29,"rows_kept":39,"cut":false,"hidden":false,"merged":[[1,1,1,4],[4,1,5,1],[38,1,38,4],[37,1,37,4],[13,1,16,1],[24,1,26,1],[17,1,23,1],[32,1,35,1],[27,1,28,1],[29,1,31,1],[6,1,12,1],[4,9,5,9],[13,9,16,9],[17,9,23,9],[24,9,26,9],[6,9,12,9],[27,9,28,9],[29,9,31,9],[32,9,35,9],[37,9,37,12],[38,9,38,12],[4,14,5,14],[13,14,16,14],[17,14,23,14],[24,14,26,14],[6,14,12,14],[27,14,28,14],[29,14,31,14],[32,14,35,14],[37,14,37,17],[38,14,38,17],[4,19,5,19],[13,19,16,19],[17,19,23,19],[24,19,26,19],[6,19,12,19],[27,19,28,19],[29,19,31,19],[32,19,35,19],[37,19,37,22],[38,19,38,22],[4,24,5,24],[13,24,16,24],[17,24,23,24],[24,24,26,24],[6,24,12,24],[27,24,28,24],[29,24,31,24],[32,24,35,24],[37,24,37,27],[38,24,38,27]]}
[null,null,null,null,null,null,null,null,null,null,null,null,null,"x",null,null,null,null,"x",null,null,null,null,"x",null,null,null,null,"x"]
[null,{"$f":"CHOOSE(LanguageNumber,J2,O2,T2,Y2)","v":"MOBILE MONEY CERTIFICATION TOOLKIT"},{"$f":"CHOOSE(LanguageNumber,K2,P2,U2,Z2)","v":0},{"$f":"CHOOSE(LanguageNumber,L2,Q2,V2,AA2)","v":0},{"$f":"CHOOSE(LanguageNumber,M2,R2,W2,AB2)","v":0},null,"EN",null,null,"MOBILE MONEY CERTIFICATION TOOLKIT",null,null,null,null,"CERTIFICATION MOBILE MONEY - OUTIL D'ÉVALUATION",null,null,null,null,"CERTIFICACIÓN DE DINERO MÓVIL - HERRAMIENTAS PARA EVALUACIÓN"]
[]
[null,{"$f":"CHOOSE(LanguageNumber,J4,O4,T4,Y4)","v":"Principle"},{"$f":"CHOOSE(LanguageNumber,K4,P4,U4,Z4)","v":"Sub-principle ID"},{"$f":"CHOOSE(LanguageNumber,L4,Q4,V4,AA4)","v":"Sub-principle title"},{"$f":"CHOOSE(LanguageNumber,M4,R4,W4,AB4)","v":"Sub-principle description"},null,null,null,null,"Principle","Sub-principle ID","Sub-principle title","Sub-principle description",null,"Principe","Numéro du sous-principe","Intitulé du sous-principe","Description du sous-principe",null,"Principio","Número de subprincipio","Nombre del subprincipio","Descripción del subprincipio"]
[null,{"$f":"CHOOSE(LanguageNumber,J5,O5,T5,Y5)","v":"1. Finance:  Safeguard customer funds against the risk of loss"},{"$f":"CHOOSE(LanguageNumber,K5,P5,U5,Z5)","v":"1.1"},"Protection against loss due to failure of bank, provider, or other party","Providers shall take measures to ensure that funds are protected in the case of insolvency of provider, custodial bank or other entity",null,null,null,null,"1. Finance:  Safeguard customer funds against the risk of loss","1.1","Protection against loss due to failure of bank, provider, or other party","Providers shall take measures to ensure that funds are protected in the case of insolvency of provider, custodial bank or other entity",null,"1. Finance:  Protéger les fonds des clients contre le risque de perte",{"$f":"$K5","v":"1.1"},"Protection contre les pertes résultant de la défaillance d'une banque, d'un prestataire ou d'une autre partie  ","Les prestataires doivent prendre des mesures pour s'assurer que les fonds sont protégés en cas d'insolvabilité du prestataire, d'une banque dépositaire ou d'une autre entité. ",null,"1. Financiero:  Protección de los fondos de los clientes contra el riesgo de pérdida",1.1000000000000001,"Protección contra pérdidas causadas por error de un banco, proveedor o tercero","El proveedor tomará las medidas necesarias para garantizar la protección de los fondos en caso de insolvencia del proveedor, el banco u otra entidad",null,null,{"$f":"$K5","v":"1.1"}]
[null,0,"1.2","Protection against settlement risk","Providers shall take measures to ensure that funds are not at risk due to the process of settlement with banks and other financial partners",null,null,null,null,null,"1.2","Protection against settlement risk","Providers shall take measures to ensure that funds are not at risk due to the process of settlement with banks and other financial partners",null,null,{"$f":"K6","v":"1.2"},"Protection contre le risque de règlement","Les prestataires doivent prendre des mesures pour s'assurer que les fonds ne soient pas à risque dans le cadre du processus de règlement avec des banques ou d'autres partenaires financiers.  ",null,null,1.2,"Protección contra riesgo de liquidación","El proveedor tomará las medidas necesarias para garantizar  la protección de los fondos respecto de procesos de liquidación de un banco u otro socio financiero",null,null,{"$f":"$K6","v":"1.2"}]
[null,{"$f":"CHOOSE(LanguageNumber,J7,O7,T7,Y7)","v":"2. AML/CFT/Fraud:  Combat money laundering, terrorist financing and fraud"},"2.1","Effective AML/CFT policies and procedures ","Providers shall develop effective policies and procedures for Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) compliance",null,null,null,null,"2. AML/CFT/Fraud:  Combat money laundering, terrorist financing and fraud","2.1","Effective AML/CFT policies and procedures ","Providers shall develop effective policies and procedures for Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) compliance",null,"2. AML/CFT/Fraude:  Lutter contre le blanchiment d'argent, le financement du terrorisme et la fraude","2.1","Politiques et procédures efficaces contre AML/CFT","Les prestataires doivent élaborer des politiques et procédures efficaces pour lutter contre le blanchiment de capitaux et le financement du terrorisme. ",null,"2. ALD/LFT/Fraude:  Combatir el lavado de dinero, el financiamiento del terrorismo y el fraude",2.1,"Politiques et procédures efficaces contre ALD/LFT","El proveedor establecerá políticas y procedimientos eficaces para cumplir con las normas Antilavado de Dinero y la Lucha contra el Financiamiento del Terrorismo (ALD/LFT)",null,null,"2.1"]
[null,0,"2.2","Senior management commitment to AML/CFT"," Senior management shall demonstrate their commitment to AML/CFT compliance through proper oversight",null,null,null,null,null,"2.2","Senior management commitment to AML/CFT"," Senior management shall demonstrate their commitment to AML/CFT compliance through proper oversight",null,null,"2.2","Engagement de la direction générale à AML/CFT","La direction générale doit manifester son engagement à l’égard de la lutte contre le blanchiment de capitaux et le financement du terrorisme à travers une surveillance adaptée. ",null,null,2.2000000000000002,"Compromiso del personal directivo superior con ALD/LFT","El personal directivo superior demostrará su compromiso con el cumplimiento de las normas ALD/CFT mediante la supervisión adecuada",null,null,"2.2"]
[null,0,"2.3","Appointed AML/CFT manager (money-laundering reporting officer)",{"$f":"CHOOSE(LanguageNumber,M9,R9,W9,AB9)","v":"Providers shall appoint a qualified money-laundering reporting officer (MLRO) to promote and monitor compliance with AML/CFT-related obligations"},null,null,null,null,null,"2.3","Appointed AML/CFT manager (money-laundering reporting officer)","Providers shall appoint a qualified money-laundering reporting officer (MLRO) to promote and monitor compliance with AML/CFT-related obligations",null,null,"2.3","Désignation d'un responsable AML/CFT (responsable anti-blanchiment)","Les prestataires doivent nommer un responsable anti-blanchiment (MLRO) qualifié chargé d’assurer la promotion et la surveillance du respect des obligations en matière de AML/CFT. ",null,null,2.2999999999999998,"Nombramiento del administrador de ALD/LFT (funcionario responsable de reportar actividades de lavado de dinero)","El proveedor nombrará a un funcionario responsable de reportar actividades de lavado de dinero con el objetivo de promover y monitorear el cumplimiento con las obligaciones establecidas por las normas ALD/LFT",null,null,"2.3"]
[null,0,"2.4","Software to monitor transactions","Providers shall create a system to monitor transactions for AML/CFT and anti-fraud purposes",null,null,null,null,null,"2.4","Software to monitor transactions","Providers shall create a system to monitor transactions for AML/CFT and anti-fraud purposes",null,null,"2.4","Logiciel de surveillance des transactions","Les prestataires doivent mettre en place un système de surveillance des transactions pour lutter contre le blanchiment de capitaux, le financement du terrorisme et la fraude.",null,null,2.4,"Software para monitoreo de transacciones","El proveedor debe crear un sistema de monitoreo de transacciones a los fines de ALD/LFT y detección de fraude",null,null,"2.4"]
[null,0,"2.5","Risk-based KYC and transaction / balance limits","Providers shall collect KYC and screen customers, and apply risk-based limits or blocks on transactions and account balances",null,null,null,null,null,"2.5","Risk-based KYC and transaction / balance limits","Providers shall collect KYC and screen customers, and apply risk-based limits or blocks on transactions and account balances",null,null,"2.5","Vérification de l'identité des clients (KYC) et plafonds d’opération et de solde de compte adaptés au niveau de risque","Les prestataires doivent obtenir des justificatifs d'identité, contrôler les clients et appliquer des plafonds d'opération et de solde de compte ou bloquer les opérations ou les comptes en fonction du niveau de risque. ",null,null,2.5,"Régimen de CSC basado en riesgos y límites a transacciones y saldos","El proveedor recabará información y evaluará a los clientes conforme el régimen de CSC y aplicará límites a las cuentas o saldos en función de los riesgos o los bloqueará.",null,null,"2.5"]
[null,0,2.6,"Staff and agent AML/CFT training procedures","Providers shall train staff and agents in AML/CFT procedures, monitor their compliance and take action against violations",null,null,null,null,null,2.6,"Staff and agent AML/CFT training procedures","Providers shall train staff and agents in AML/CFT procedures, monitor their compliance and take action against violations",null,null,2.6,"Procédures de formation du personnel et des agents à la lutte contre le blanchiment de capitaux et le financement du terrorisme","Les prestataires doivent former leur personnel et leurs agents aux procédures AML/CFT, veiller au respect de ces procédures et prendre des mesures appropriées en cas de non respect.",null,null,2.6,"Procedimientos de capacitación sobre ALD/LFT para personal y agentes","El proveedor capacitará a su personal y agentes sobre los procedimientos de ALD/LFT, supervisará el cumplimiento de los mismos y tomará medidas en caso de incumplimiento.",null,null,2.6]
[null,null,{"$f":"CHOOSE(LanguageNumber,K13,P13,U13,Z13)","v":2.7},"Fraud management","Providers shall develop risk-based policies and measures for fraud detection and prevention",null,null,null,null,null,2.7,"Fraud management","Providers shall develop risk-based policies and measures for fraud detection and prevention",null,null,2.7,"Gestion de la fraude","Les fournisseurs doivent développer des politiques et des mesures basées sur le risque afin de détecter et prévenir tout cas de fraude",null,null,2.7,"Gestión de fraudes","El proveedor establecerá políticas y medidas basadas en riesgos para la detección y prevención de fraudes",null,null,2.7]
[null,{"$f":"CHOOSE(LanguageNumber,J14,O14,T14,Y14)","v":"3. People:  Manage staff, agents, and third parties"},"3.1","Due diligence policies and procedures","Providers shall conduct proper due diligence on potential staff, agents and entities providing outsourced services",null,null,null,null,"3. People:  Manage staff, agents, and third parties","3.1","Due diligence policies and procedures","Providers shall conduct proper due diligence on potential staff, agents and entities providing outsourced services",null,"3. Personnes: Gérer correctement le personnel, les agents et les tiers","3.1","Politiques et procédures de vigilance","Les prestataires doivent exercer une vigilance appropriée à l'égard de leur personnel, de leurs agents et des entités offrant des services de sous-traitance.",null,"3. Personal:  Gestionar adecuadamente el personal, agentes y terceros",3.1,"Políticas y procedimientos de debida diligencia","El proveedor tomará los recaudos de debida diligencia apropiados sobre personal, agentes y entidades subcontratadas potenciales.",null,null,"3.1"]
[null,null,"3.2","Training of staﬀ and agents","Providers shall develop and implement training programmes for staff and agents",null,null,null,null,null,"3.2","Training of staﬀ and agents","Providers shall develop and implement training programmes for staff and agents",null,null,"3.2","Formation de personnel et de agents","Les prestataires doivent mettre en place des programmes de formation de leur personnel et de leurs agents.",null,null,3.2,"Capacitación para el personal y los agentes","El proveedor desarrollará e implementará programas de capacitación para el personal y los agentes",null,null,"3.2"]
[null,null,"3.3","Contractual agreements","Providers shall establish written agreements governing their relationship with agents and entities providing outsourced services",null,null,null,null,null,"3.3","Contractual agreements","Providers shall establish written agreements governing their relationship with agents and entities providing outsourced services",null,null,"3.3","Accords contractuels","Les prestataires doivent mettre en place des accords écrits régissant leurs relations avec les agents et les entités fournissant des services de sous-traitance ",null,null,3.3,"Acuerdos contractuales","El proveedor establecerá acuerdos por escrito para regir la relación con los agentes y las entidades subcontratadas",null,null,"3.3"]
[null,null,"3.4","Management of staﬀ, agents and entities providing outsourced services","Providers shall develop policies and processes for ongoing management and oversight of staff, agents and entities providing outsourced services",null,null,null,null,null,"3.4","Management of staﬀ, agents and entities providing outsourced services","Providers shall develop policies and processes for ongoing management and oversight of staff, agents and entities providing outsourced services",null,null,"3.4","Gestion et suivi du personnel, des agents et des entités fournissant des services de sous-traitance","Les prestataires doivent mettre en place des politiques et des procédures pour la gestion et la surveillance dans le temps de leur personnel, de leurs agents et des entités leur fournissant des services de sous-traitance.",null,null,3.4,"Gestión y supervisión del personal, los agentes y las entidades subcontratadas","El proveedor elaborará políticas y procedimientos para la gestión y supervisión continuas del personal, los agentes y las entidades subcontratadas.",null,null,"3.4"]
[null,"4. Operation:  Operate the service well and reliably","4.1","Board and senior management oversight of the Mobile Money service","Providers shall ensure that the Board of Directors and senior management establish effective management oversight of the Mobile Money Service",null,null,null,null,"4. Operation:  Operate the service well and reliably","4.1","Board and senior management oversight of the Mobile Money service","Providers shall ensure that the Board of Directors and senior management establish effective management oversight of the Mobile Money Service",null,"4. Opération:  Garantir la bonne opération du service et sa fiabilité","4.1","Surveillance du Service par le conseil d’administration et la direction générale","Les prestataires doivent s’assurer que leur conseil d’administration et leur direction générale mettent en place un contrôle de gestion efficace du Service.",null,"4. Operativo:  Operar el servicio de manera correcta y confiablemente",4.0999999999999996,"Supervisión del servicio de dinero móvil por parte directorio y del personal directivo superior","Los proveedores garantizarán que el Directorio y la alta gerencia puedan establecer una supervisión efectiva de la gestión del Servicio de dinero móvil.",null,null,"4.1"]
[null,0,"4.2","Business and technical operations and service level management","Providers shall manage technical and business operations according to service levels",null,null,null,null,null,"4.2","Business and technical operations and service level management","Providers shall manage technical and business operations according to service levels",null,null,"4.2","Gestion des activités commerciales et techniques et des niveaux de service","Les prestataires doivent gérer les activités commerciales et techniques en fonction des niveaux de service.",null,null,4.2,"Gestión de operaciones comerciales y técnicas y nivel de servicios","El proveedor administrará las operaciones comerciales y técnicas conforme a los niveles de servicio",null,null,"4.2"]
[null,0,"4.3","Capacity management","Providers shall ensure sufficient service capacity by forecasting, monitoring and testing",null,null,null,null,null,"4.3","Capacity management","Providers shall ensure sufficient service capacity by forecasting, monitoring and testing",null,null,"4.3","Gestion des capacités","Les prestataires doivent veiller à disposer d'une capacité de service suffisante par le biais de prévisions, de mesures de surveillance et de tests.",null,null,4.3,"Gestión de capacidad","El proveedor garantizará la disponibilidad de suficiente capacidad de servicio a través de pronósticos, monitoreo y pruebas.",null,null,"4.3"]
[null,0,"4.4","Incident and problem management","Providers shall set up an incident management process to restore the service within agreed service levels and to investigate root causes of problems",null,null,null,null,null,"4.4","Incident and problem management","Providers shall set up an incident management process to restore the service within agreed service levels and to investigate root causes of problems",null,null,"4.4","Gestion des incidents et des problèmes","Les prestataires doivent mettre en place un processus de gestion des incidents afin de restaurer le service conformément aux niveaux de service convenus et d’identifier les causes sous-jacentes des problèmes. ",null,null,4.4000000000000004,"Gestión de incidentes y problemas","El proveedor establecerá un proceso de gestión de incidentes para restablecer el servicio conforme a los niveles de servicio acordados e investigará cuál fue la causa raíz del problema",null,null,"4.4"]
[null,0,"4.5","Change and configuration management","Providers shall develop processes to ensure that systems and applications remain robust and secure following system and configuration changes",null,null,null,null,null,"4.5","Change and configuration management","Providers shall develop processes to ensure that systems and applications remain robust and secure following system and configuration changes",null,null,"4.5","Gestion du changement et de la configuration","Les prestataires doivent mettre en place des processus permettant de s’assurer que les systèmes ou les applications restent robustes et sûrs à la suite de changements de système ou de configuration.",null,null,4.5,"Gestión de cambios y configuración","El proveedor establecerá procesos para garantizar la robustez y seguridad de los sistemas y las aplicaciones, después de cualquier cambio al sistema y configuración",null,null,"4.5"]
[null,0,"4.6","Enterprise risk management","Providers shall establish a risk management framework for identifying, assessing and controlling risks",null,null,null,null,null,"4.6","Enterprise risk management","Providers shall establish a risk management framework for identifying, assessing and controlling risks",null,null,"4.6","Gestion globale des risques","Les prestataires doivent mettre en place un cadre de gestion du risque permettant la détection, l’évaluation et le contrôle des risques.",null,null,4.5999999999999996,"Gestión de riesgos empresariales","El proveedor establecerá un marco para la gestión de riesgos empresariales a fin de identificar, estimar y controlar los riesgos",null,null,"4.6"]
[null,0,"4.7","Service continuity","Providers shall develop effective business continuity and contingency plans",null,null,null,null,null,"4.7","Service continuity","Providers shall develop effective business continuity and contingency plans",null,null,"4.7","Continuité du service","Les prestataires doivent mettre en place des plans efficaces de poursuite de l’activité en cas d’urgence ou de sinistre.",null,null,4.7,"Continuidad del servicio","El proveedor establecerá planes eficaces para contingencias y la continuidad del negocio",null,null,"4.7"]
[null,"5. Security:  Ensure the security of the systems supporting the service","5.1","Security governance","Providers shall implement governance mechanisms to ensure that security policies are defined and implemented with ongoing management",null,null,null,null,"5. Security:  Ensure the security of the systems supporting the service","5.1","Security governance","Providers shall implement governance mechanisms to ensure that security policies are defined and implemented with ongoing management",null,"5. Sécurité:  Protéger la sécurité des systèmes supportant le service ","5.1","Gouvernance en matière de sécurité","Les prestataires doivent mettre en œuvre des mécanismes de gouvernance pour s’assurer que des politiques de sécurité soient définies et mises en œuvre dans le cadre d’une supervision continue.",null,"5. Seguridad:  Proteger la seguridad de los sistemas que soportan el servicio",5.0999999999999996,"Gobernanza de la seguridad","El proveedor implementará mecanismos de gobernanza para garantizar la constante gestión de la definición e implementación de las políticas de seguridad",null,null,"5.1"]
[null,0,"5.2","Designing and developing secure systems, applications and network","Providers shall ensure that the systems, applications and network that support mobile money are designed and developed securely",null,null,null,null,null,"5.2","Designing and developing secure systems, applications and network","Providers shall ensure that the systems, applications and network that support mobile money are designed and developed securely",null,null,"5.2","Conception et mise en place d’un réseau, de systèmes et d’applications sécurisés","Les prestataires doivent s’assurer que le réseau, les systèmes et les applications utilités pour l’argent mobile soient conçus et développés dans une optique de sécurité.",null,null,5.2,"Diseño y desarrollo de sistemas, aplicaciones y redes seguras","El proveedor garantizará que los sistemas, aplicaciones y redes que sustentan los servicios del dinero móvil han sido diseñados y desarrollados en forma segura",null,null,"5.2"]
[null,0,"5.3","Security operations ","Providers shall implement processes to manage all systems and operations securely ",null,null,null,null,null,"5.3","Security operations ","Providers shall implement processes to manage all systems and operations securely ",null,null,"5.3","Sécurité des opérations ","Les prestataires doivent mettre en place des processus de gestion sécurisée de l’ensemble des systèmes ",null,null,5.3,"Operaciones de seguridad ","El proveedor implementará procesos para gestionar todos los sistemas y operaciones de forma segura ",null,null,"5.3"]
[null,"6. Transparency:  Communicate fees, T&Cs and information transparently to customers","6.1","Effective disclosure and transparency","Providers shall ensure that users are provided with clear, prominent, and timely information regarding fees and terms and conditions",null,null,null,null,"6. Transparency:  Communicate fees, T&Cs and information transparently to customers","6.1","Effective disclosure and transparency","Providers shall ensure that users are provided with clear, prominent, and timely information regarding fees and terms and conditions",null,"6. Transparence:  Communiquer les frais, les conditions générales et les informations de manière transparente aux clients","6.1","Communication efficace et transparente","Les prestataires doivent s’assurer que des informations claires, visibles et opportunes soient fournies aux clients concernant la tarification et les conditions générales du service.",null,"6. Transparencia:  Comunicar las tarifas, los términos y condiciones y toda la información relevante de manera transparente a los clientes",6.1,"Divulgación y transparencia eficaces","El proveedor garantizará la provisión de información clara, visible y oportuna sobre tarifas y términos y condiciones a los clientes",null,null,"6.1"]
[null,0,"6.2","Education of customers about safety and security","Providers shall educate customers about how to use mobile money services safely and securely",null,null,null,null,null,"6.2","Education of customers about safety and security","Providers shall educate customers about how to use mobile money services safely and securely",null,null,"6.2","L'éducation des clients sur la sécurité","Les prestataires doivent éduquer les clients sur la manière d’utiliser les services d’argent mobile en toute sécurité.",null,null,6.2,"Educación de los clientes sobre la seguridad","El proveedor entrenará a los clientes sobre cómo utilizar los servicios del dinero móvil de manera segura",null,null,"6.2"]
[null,"7. Customer Service:  Effectively address customer service requests and complaints","7.1","Customer service policies and procedures","Providers shall develop and publish customer service policies and procedures",null,null,null,null,"7. Customer Service:  Effectively address customer service requests and complaints","7.1","Customer service policies and procedures","Providers shall develop and publish customer service policies and procedures",null,"7. Service à la Clientèle:  Répondre de manièe efficace aux demandes et aux plaintes des clients ","7.1","Politiques et procédures du service clientèle","Les prestataires doivent mettre en place et publier des politiques et procédures du service clientèle",null,"7. Servicio al Cliente:  Atender de manera efectiva las solicitudes y reclamos de servicio al cliente",7.1,"Políticas y procedimientos de servicio al cliente","El proveedor desarrollará y publicar políticas y procedimientos para la gestión de servicio del cliente",null,null,"7.1"]
[null,0,"7.2","Availability of customer service support","Providers shall provide an appropriate mechanism for customers to address questions and problems",null,null,null,null,null,"7.2","Availability of customer service support","Providers shall provide an appropriate mechanism for customers to address questions and problems",null,null,"7.2","Disponibilité de l’assistance à la clientèle","Les prestataires doivent mettre à la disposition de la clientèle un mécanisme approprié pour répondre aux questions et problèmes de celle-ci.",null,null,7.2,"Disponibilidad de soporte de atención al cliente","El proveedor proporcionará mecanismos adecuados para que el cliente resuelva preguntas y problemas.",null,null,"7.2"]
[null,0,"7.3","External recourse mechanisms","Providers shall specify how disputes can be resolved if internal resolution fails",null,null,null,null,null,"7.3","External recourse mechanisms","Providers shall specify how disputes can be resolved if internal resolution fails",null,null,"7.3","Mécanismes de recours extérieur","Les prestataires doivent spécifier un mode de résolution des litiges en cas d’échec des mécanismes internes.",null,null,7.3,"Mecanismos externos de resolución de controversias","El proveedor establecerá un proceso para la resolución de controversias en los casos en que no es posible resolverlas internamente",null,null,"7.3"]
[null,"8. Data Privacy:  Protect customers’ personal data",8.1,"Governance of Data Privacy","Providers shall comply with good practices and relevant regulations governing customer data privacy",null,null,null,null,"8. Data Privacy:  Protect customers’ personal data",8.1,"Governance of Data Privacy","Providers shall comply with good practices and relevant regulations governing customer data privacy",null,"8. Confidentialité des Données:  Protéger les données personnelles des clients",8.1,"Gouvernance de la protection des données","Les prestataires doivent se conformer aux bonnes pratiques et aux réglementations applicables en matière de protection des données personnelles des clients.",null,"8. Privacidad de Datos:  Proteger los datos personales de los clientes ",8.1,"Gobernanza de la privacidad de datos","El proveedor cumplirá con las buenas prácticas y la regulación pertinente que rigen la privacidad de los datos del cliente",null,null,8.1]
[null,0,8.1999999999999993,"Data Privacy transparency","Providers shall ensure that users are provided with clear, prominent, and timely information regarding their data privacy practices",null,null,null,null,null,8.1999999999999993,"Data Privacy transparency","Providers shall ensure that users are provided with clear, prominent, and timely information regarding their data privacy practices",null,null,8.1999999999999993,"Transparence de la protection des données","Les prestataires doivent veiller à ce que des informations claires, visibles et opportunes soient fournies aux clients sur les pratiques de protection de leurs données personnelles.",null,null,8.1999999999999993,"Transparencia de la privacidad de datos","El proveedor garantizará la provisión de información clara, visible y oportuna al usuario respecto de las prácticas de privacidad de datos",null,null,8.1999999999999993]
[null,0,8.3000000000000007,"Customers' control of their Personal Data","Providers shall ensure that customers are informed of their rights and have control over the use of their personal information",null,null,null,null,null,8.3000000000000007,"Customers' control of their Personal Data","Providers shall ensure that customers are informed of their rights and have control over the use of their personal information",null,null,8.3000000000000007,"Contrôle par les clients de leurs données ","Les prestataires doivent veiller à ce que les clients soient informés de leurs droits et qu’ils aient la possibilité d’exercer un véritable choix et contrôle sur les informations les concernant.",null,null,8.3000000000000007,"Control por parte de los clientes de sus datos personales","El proveedor garantizará que el cliente está informado sobre sus derechos y tiene control sobre el uso de su información personal",null,null,8.3000000000000007]
[null,0,8.4,"Minimisation of Personal Data collection and retention","Providers shall limit the personal information that is collected from customers and is retained, used, or shared",null,null,null,null,null,8.4,"Minimisation of Personal Data collection and retention","Providers shall limit the personal information that is collected from customers and is retained, used, or shared",null,null,8.4,"Minimisation de la collecte et de la conservation de données","Les prestataires doivent limiter les informations personnelles collectées auprès des clients et conservées, utilisées ou partagées.",null,null,8.4,"Minimización de recolección y retención de datos personales","El proveedor limitará la cantidad de información recabada de los clientes y la forma en que la retiene, usa o comparte",null,null,8.4]
[]
[null,{"$f":"CHOOSE(LanguageNumber,J38,O38,T38,Y38)","v":"Overview\nThis spreadsheet is a Toolkit for providers to support the assessment of Providers' mobile money operations. The Code of Conduct is split into eight Principles, and each Principle has a toolkit for assessment. Each toolkit consists of an Excel workbook with the following tabs:\n• Introduction: This tab includes this overview and provides an outline of the Principle and the relevant sub-Principles for the toolkit.\n• Instructions: This tab provides detailed instructions on how to use this toolkit.\n• Sub-Principle Worksheets: Each sub-Principle has its own worksheet. These worksheets are described in more detail in the Instructions tab.\n• Summary: This tab provides aggregated data on the responses to the Indicators through a combination of charts and tables. Data are provided both for individual sub-Principles and for the Principle as a whole. \n• Report: This tab allows users to quickly identify their level of compliance for the entire Principle or for individual sub-Principles. The user selects a compliance Status (compliant, non-compliant, partially compliant, N/A, or no response), and a list of all relevant indicators is produced. Filters can be used to further analyse results.\n• Documentation: This tab compiles all of the documents listed in Column H of the sub-Principle worksheets and provides a brief description of each document and the responsible team. \n• Definitions:  This tab provides a list of definitions for terms used in the toolkits, data sources, and the mobile money teams described in Column L of each sub-Principle worksheet. \n\nPlease refer to the Instructions tab for detailed guidance on how to use this toolkit."},null,null,null,null,null,null,null,"Overview\nThis spreadsheet is a Toolkit for providers to support the assessment of Providers' mobile money operations. The Code of Conduct is split into eight Principles, and each Principle has a toolkit for assessment. Each toolkit consists of an Excel workbook with the following tabs:\n• Introduction: This tab includes this overview and provides an outline of the Principle and the relevant sub-Principles for the toolkit.\n• Instructions: This tab provides detailed instructions on how to use this toolkit.\n• Sub-Principle Worksheets: Each sub-Principle has its own worksheet. These worksheets are described in more detail in the Instructions tab.\n• Summary: This tab provides aggregated data on the responses to the Indicators through a combination of charts and tables. Data are provided both for individual sub-Principles and for the Principle as a whole. \n• Report: This tab allows users to quickly identify their level of compliance for the entire Principle or for individual sub-Principles. The user selects a compliance Status (compliant, non-compliant, partially compliant, N/A, or no response), and a list of all relevant indicators is produced. Filters can be used to further analyse results.\n• Documentation: This tab compiles all of the documents listed in Column H of the sub-Principle worksheets and provides a brief description of each document and the responsible team. \n• Definitions:  This tab provides a list of definitions for terms used in the toolkits, data sources, and the mobile money teams described in Column L of each sub-Principle worksheet. \n\nPlease refer to the Instructions tab for detailed guidance on how to use this toolkit.",null,null,null,null,"Présentation générale\nCe document est un outil destiné aux prestataires pour leur permettre d'évaluer leur service d'argent mobile. Le Code de Conduite est divisé en huit grands Principes, qui font chacun l'objet d'un outil d'évaluation. Chaque outil d'évaluation se compose d'un fichier Excel comprenant les onglets suivants :\n• Introduction : cet onglet contient la présentation générale et la définition du Principe et des sous-principes correspondants pour l'outil.  \n• Instructions : cet onglet contient des instructions détaillées d'utilisation de l'outil.\n• Feuilles de sous-principes : chaque sous-principe a sa propre feuille de calcul. Ces feuilles sont présentées plus en détail sous l'onglet des instructions.\n• Synthèse : cet onglet fournit la synthèse des réponses aux Indicateurs, présentée sous forme de graphiques et de tableaux. Les données sont présentées à la fois par sous-principe et pour le Principe dans son ensemble. \n• Rapport : cet onglet permet aux utilisateurs de déterminer rapidement leur niveau de conformité au Principe dans son ensemble ou à chaque sous-principe. L'utilisateur sélectionne un statut de conformité (conforme, non conforme, partiellement conforme, non applicable ou pas de réponse) ce qui permet de générer une liste de tous les indicateurs concernés. Il est possible d'utiliser des filtres pour analyser les résultats de façon plus détaillée.\n• Documentation : cet onglet réunit l'ensemble des documents dont la liste figure à la colonne H des feuilles de sous-principes et fournit un bref descriptif de chaque document, en indiquant, pour chacun d'entre eux, l'équipe qui en est responsable.\n• Définitions : cet onglet fournit la définition des termes utilisés dans l’outil, les sources de données et les équipes d’argent mobile décrites dans la colonne L de chaque feuille de sous-principe. \n\nVeuillez consulter l'onglet des instructions pour un mode d'emploi plus détaillé de cet outil.",null,null,null,null,"Descripción general\nEsta planilla presenta un conjunto de herramientas para que el proveedor evalúe la calidad de las operaciones del dinero móvil. El Código de Conducta está dividido en ocho principios, cada uno de los cuales cuenta con sus propias herramientas de evaluación. Cada conjunto de herramientas está conformado por un libro de Excel con las siguientes pestañas:\n• Introducción: esta pestaña incluye la presente descripción general y una reseña de los Principios y los subprincipios pertinentes de este conjunto de herramientas.\n• Instrucciones: esta pestaña proporciona instrucciones detalladas sobre cómo utilizar esta herramienta.\n* Planillas de subprincipios: cada subprincipio cuenta con su propia planilla, cuya descripción se encuentra detallada en la pestaña de instrucciones.\n• Resumen: esta pestaña proporciona los datos agregados de las respuestas a los Indicadores mediante una combinación de gráficos y tablas. Los datos proporcionados aplican tanto a los subprincipios individuales como a los principios en conjunto. \n* Reportes: esta pestaña permite al usuario identificar rápidamente el nivel de cumplimiento de todos los Principios y cada subprincipio. Cuando el usuario selecciona un nivel de cumplimiento (cumple, no cumple, cumple parcialmente, N/A o no responde), se crea una lista con los indicadores relevantes. Para analizar los resultados en más detalle, se pueden utilizar filtros.\n* Documentación: esta pestaña contiene la compilación de todos los documentos descritos en la Columna H de las planillas de subprincipios y proporciona una breve descripción de cada documento y el equipo responsable. \n* Definiciones: esta pestaña proporciona las definiciones de los términos utilizados en estas herramientas, fuentes de datos y los equipos del dinero móvil descritos en la Columna L de cada planilla de subprincipios. \n\nPara más detalles sobre cómo utilizar esta herramienta, consultar a las instrucciones."]
[null,{"$f":"CHOOSE(LanguageNumber,J39,O39,T39,Y39)","v":"Confidentiality \nThis toolkit has been developed by the GSMA and its members to support GSMA Mobile Money Certification. Member responses to the questions in the toolkit shall be deemed “Confidential Information” for the purposes of Article 18.2 of the GSMA Articles of Association. This Confidential Information will not be disclosed to any third party.\n\nPlease send any feedback and questions about the self-assessment toolkits to mobilemoney@gsma.com."},null,null,null,null,null,null,null,"Confidentiality \nThis toolkit has been developed by the GSMA and its members to support GSMA Mobile Money Certification. Member responses to the questions in the toolkit shall be deemed “Confidential Information” for the purposes of Article 18.2 of the GSMA Articles of Association. This Confidential Information will not be disclosed to any third party.\n\nPlease send any feedback and questions about the self-assessment toolkits to mobilemoney@gsma.com.",null,null,null,null,"Confidentialité \nCet outil a été développé par la GSMA et ses membres en vue de soutenir GSMA Certification Mobile Money. Les réponses fournies par les membres aux questions contenues dans ces outils doivent être considérées comme des « informations confidentielles » aux fins de l’article 18.2 des statuts de la GSMA. Ces informations confidentielles ne seront pas communiquées à des tiers.  \n\nVeuillez adresser vos questions ou commentaires concernant ces outils d’auto-évaluation à mobilemoney@gsma.com.\n",null,null,null,null,"Confidencialidad \nEsta herramienta fue elaboradas para la GSMA y sus miembros a fin de facilitar la implementación del GSMA Certificación de Dinero Móvil. Las respuestas proporcionadas por los miembros a las preguntas contenidas en esta herramienta se consideran «Información Confidencial» a efectos del Artículo 18.2 de los Estatutos de la GSMA. Esta Información Confidencial no será divulgada a ningún tercero.\n\nPara comentarios y preguntas sobre las herramientas de autoevaluación, envíe un correo electrónico a mobilemoney@gsma.com."]

{"sheet":"Instructions","index":1,"n_rows":23,"n_cols":11,"rows_kept":23,"cut":false,"hidden":false,"merged":[]}
[]
[null,{"$f":"CHOOSE(LanguageNumber,E2,G2,I2,K2)","v":"MOBILE MONEY CERTIFICATION TOOLKIT"},null,null,{"$f":"Introduction!J2","v":"MOBILE MONEY CERTIFICATION TOOLKIT"},null,{"$f":"Introduction!O2","v":"CERTIFICATION MOBILE MONEY - OUTIL D'ÉVALUATION"},null,{"$f":"Introduction!T2","v":"CERTIFICACIÓN DE DINERO MÓVIL - HERRAMIENTAS PARA EVALUACIÓN"},null,{"$f":"Introduction!Y2","v":0}]
[]
[null,{"$f":"CHOOSE(LanguageNumber,E4,G4,I4,K4)","v":"How to use this Toolkit"},null,null,"How to use this Toolkit",null,"Mode d'emploi de l’outil",null,"Instrucciones de uso de la herramienta"]
[null,{"$f":"CHOOSE(LanguageNumber,E5,G5,I5,K5)","v":"1.  Open each sub-Principle worksheet and, for each Practice (Column G), determine compliance to the Indicators (Column J) by reviewing the Mobile Money Provider's available evidence against the evidence requirements in column K. \n2. Record the compliance by selecting a response from the drop-down list in the 'Compliance' column (Column Q - self-assessment or Column AF - external assessment), choosing from 'Yes', 'Partial', 'No', or 'N/A'. 'Yes' reflects full compliance, 'Partial' reflects partial compliance, 'No' reflects non-compliance, and 'N/A' means that the Indicator is not applicable to the mobile money service: N/A should be reserved for issues such as where the Code of Conduct conflicts with local legislation, or where the indicator refers to a product that is not offered (e.g. IMT). There should be very few such cases. \"No Response\" is never acceptable.\n3. For each Indicator, record additional details, listing the evidence provided (Column R for self-assessment or Column AG for external assessment), actions to be taken (Column S or AH), comments (Column T or AI) and the name of the reviewer (column U or AJ).\n4. There are a number of spare columns (V-AE and AK-AT) that may be used to record additional information for internal use by providers or assessors. These can be renamed in the Drivers worksheet.\n\nBelow is a detailed description of the contents of the various worksheets and how to use them."},null,null,"1.  Open each sub-Principle worksheet and, for each Practice (Column G), determine compliance to the Indicators (Column J) by reviewing the Mobile Money Provider's available evidence against the evidence requirements in column K. \n2. Record the compliance by selecting a response from the drop-down list in the 'Compliance' column (Column Q - self-assessment or Column AF - external assessment), choosing from 'Yes', 'Partial', 'No', or 'N/A'. 'Yes' reflects full compliance, 'Partial' reflects partial compliance, 'No' reflects non-compliance, and 'N/A' means that the Indicator is not applicable to the mobile money service: N/A should be reserved for issues such as where the Code of Conduct conflicts with local legislation, or where the indicator refers to a product that is not offered (e.g. IMT). There should be very few such cases. \"No Response\" is never acceptable.\n3. For each Indicator, record additional details, listing the evidence provided (Column R for self-assessment or Column AG for external assessment), actions to be taken (Column S or AH), comments (Column T or AI) and the name of the reviewer (column U or AJ).\n4. There are a number of spare columns (V-AE and AK-AT) that may be used to record additional information for internal use by providers or assessors. These can be renamed in the Drivers worksheet.\n\nBelow is a detailed description of the contents of the various worksheets and how to use them.",null,"1.  Ouvrez la feuille de calcul de chaque sous-principe et, pour chaque Pratique (colonne G), évaluez la conformité aux indicateurs (colonne J) en comparant les éléments fournis par le prestataire d'argent mobile à ceux requis dans la colonne K. \n2. Indiquez le niveau de conformité en sélectionnant une réponse depuis la liste déroulante de la colonne « Conformité » (Colonne Q - auto-évaluation ou Colonne AF - évaluation externe), soit « Oui », « En partie », « Non » ou « n/d ». « Oui » indique une conformité totale, « En partie » indique une conformité partielle, « Non » indique une absence de conformité, « n/d » implique que l’Indicateur n’est pas applicable au service d'argent mobile. N/d doit être réservé pour les problèmes, par exemple lorsque les exigences ne sont pas compatible avec la législation nationale, ou lorsque l’indicateur se réfère à un produit qui n’est pas proposé (par ex. transactions IMT). Ces cas devraient être très rares. « Sans réponse » n’est pas acceptable.\n3. Pour chaque indicateur, renseignez des détails supplémentaires, parmi lesquels les documents fournis (colonne R pour une auto-évaluation ou colonne AG pour une évaluation externe), les mesures à prendre (colonne S ou AH), les commentaires (colonne T ou AI) et le nom de l’examinateur (colonne U ou AJ).\n4. Des colonnes libres (V-AE et AK-AT) permettent de renseigner des informations supplémentaires en vue d’une utilisation en interne par les prestataires ou les examinateurs. Ces colonnes peuvent être renommées dans la feuille Drivers.\n\nCi-dessous figure une description détaillée du contenu des différentes feuilles de calcul qui explique leur utilisation.",null,"1.  Abra cada planilla de subprincipios y, para cada Práctica (Columna G), determine el tipo de cumplimiento de los Indicadores (Columna J) mediante la evaluación de la documentación del proveedor del dinero móvil respecto de los requerimientos descritos en la Columna K. \n2. Registre el tipo de cumplimiento seleccionando una respuesta de la lista desplegable que se encuentra en la columna de «Cumplimiento» (Columna Q - autoevaluación o Columna AF - evaluación externa). Seleccione «Sí», «Parcial», «No» o «N/A». «Sí» significa cumplimiento total, «Parcial» significa cumplimiento parcial, «No» significa no cumple y «N/A» significa que el Indicador no es aplicable al servicio del dinero móvil. La opción «N/A» debería utilizarse solo para los casos en que los requisitos están en conflicto con la legislación local o cuando el indicador se refiere a un producto que no está disponible (por ej., IMT). Estos casos deberían ser muy pocos. La opción «No responde» no es aceptable.\n3. Para cada Indicador, registre detalles adicionales, proporcionando una lista de la documentación provista (Columna R para autoevaluación y Columna AF para evaluación externa), las medidas que se tomarán (Columna S o AH), comentarios (Columna T o AI) y el nombre del evaluador (Columna U o AJ).\n4. Las columnas libres (de V a AE y de AK a AT) pueden utilizarse para registrar información adicional para uso interno de proveedores y asesores, a los que se les puede cambiar el nombre en la planilla de Factores.\n\nMás abajo encontrará una descripción detallada de los contenidos de las diversas planillas y las instrucciones para su uso."]
[null,"Principle worksheets (1-8): Requirements",null,null,"Principle worksheets (1-8): Requirements",null,"Feuilles de calcul des Principes (1-8) : Exigences",null,"Planillas de Principios (1-8): Requisitos:"]
[null,{"$f":"CHOOSE(LanguageNumber,E7,G7,I7,K7)","v":"Each sub-Principle worksheet includes the following columns:\n• Sub-sub-Principle Description (Column E):  The Code of Conduct for Mobile Money Providers consists of eight high-level Principles (e.g., Principle 7), each of which covers one or more topics referred to as sub-Principles (e.g., 7.1). Each sub-Principle is further divided into one or more general commitments referred to as sub-sub-Principles (e.g., 7.1.1). Each sub-sub-Principle in Column C has an ID number and a description of the commitment.\n• Practice (Column G):  For each sub-sub-Principle, one or more sets of Practices are included. The Practices provide guidance on what providers should do to implement the Code of Conduct. \n• Indicator (Column J):  Compliance with each Practice is measured through Indicators, with each Practice having one or more Indicators. The Indicators are in the form of a question. Only the \"Required\" indicators are assessed for compliance to the Code of Conduct: the \"Recommended\" indicators are included to indicate good practice that providers should aim to implement as well.\n• Evidence Required (Column K):  Details the evidence that is required determine compliance with the required Indicators.\n• Indicator Category (Column N):  All Indicators are categorized either as Required or Recommended. Providers must be compliant with all Required Indicators.\n• Function (Column O):  For each Indicator, this suggests the team or function within the mobile money provider that is most likely to assume responsibility for compliance with this Indicator. A definition for each function is included in the Definitions worksheet. It is recognized that mobile money providers may be structured differently, in which case these responsibilities may be assumed by different teams."},null,null,"Each sub-Principle worksheet includes the following columns:\n• Sub-sub-Principle Description (Column E):  The Code of Conduct for Mobile Money Providers consists of eight high-level Principles (e.g., Principle 7), each of which covers one or more topics referred to as sub-Principles (e.g., 7.1). Each sub-Principle is further divided into one or more general commitments referred to as sub-sub-Principles (e.g., 7.1.1). Each sub-sub-Principle in Column C has an ID number and a description of the commitment.\n• Practice (Column G):  For each sub-sub-Principle, one or more sets of Practices are included. The Practices provide guidance on what providers should do to implement the Code of Conduct. \n• Indicator (Column J):  Compliance with each Practice is measured through Indicators, with each Practice having one or more Indicators. The Indicators are in the form of a question. Only the \"Required\" indicators are assessed for compliance to the Code of Conduct: the \"Recommended\" indicators are included to indicate good practice that providers should aim to implement as well.\n• Evidence Required (Column K):  Details the evidence that is required determine compliance with the required Indicators.\n• Indicator Category (Column N):  All Indicators are categorized either as Required or Recommended. Providers must be compliant with all Required Indicators.\n• Function (Column O):  For each Indicator, this suggests the team or function within the mobile money provider that is most likely to assume responsibility for compliance with this Indicator. A definition for each function is included in the Definitions worksheet. It is recognized that mobile money providers may be structured differently, in which case these responsibilities may be assumed by different teams.",null,"Chaque feuille de calcul de sous-principe comprend les colonnes suivantes :\n• Description du sous-sous-principe (colonne E):  Le Code de conduite des prestataires d’argent mobile est constitué de huit grands Principes (par ex. Principe 7), qui couvrent chacun ou un plusieurs thèmes appelés sous-principes (par ex. 7.1). Chaque sous-principe est à son tour divisé en un ou plusieurs engagements appelés sous-sous-principes (par ex. 7.1.1). Chaque sous-sous-principe figurant dans la colonne C est accompagné d'un numéro d'identification et d'une description de l'engagement correspondant.\n• Pratique (Colonne G) :  Pour chaque sous-sous-principe, un ou plusieurs ensembles de Pratiques peuvent être indiqués. Les Pratiques donnent des conseils sur les mesures que les prestataires doivent prendre pour mettre en place le Code de conduite. \n• Indicateur (Colonne J) :  Le respect de chaque Pratique est mesuré par les indicateurs, chaque Pratique pouvant avoir un ou plusieurs Indicateurs. Les Indicateurs prennent la forme de question. Seuls les indicateurs considérés comme « requis » sont pris en compte pour déterminer la conformité au Code de conduite : les indicateurs « recommandés » sont présents afin d’indiquer les bonnes pratiques que les prestataires devraient chercher à mettre en place.\n• Documents requis (Colonne K) :  Cette colonne détaille les documents nécessaires pour évaluer le niveau de conformité par rapport aux indicateurs requis.\n• Catégorie de l’indicateur (Colonne N) :  Tous les indicateurs sont classés soit « requis », soit « recommandé ». Les prestataires doivent respecter tous les indicateurs classés comme « requis ».\n• Fonction (Colonne O) :  Pour chaque indicateur, cela représente l’équipe ou la fonction au sein du prestataire d’argent mobile la plus à même d’être responsable de la conformité à l’indicateur en question. Une définition de chaque fonction est disponible dans la feuille de calcul Définitions. Il est attendu que les prestataires d'argent mobile possèdent une organisation structurelle différente, auquel cas ces responsabilités peuvent être réparties entre plusieurs équipes.",null,"Cada planilla de Sub-Principio incluye las siguientes columnas:\n* Descripción del Sub-sub-principio (Columna E): el Código de Conducta para Proveedores del Dinero Móvil está conformado por ocho Principios de alto nivel (por ejemplo, el Principio 7), cada uno de los cuales cubre uno o más temas llamados Subprincipio (por ejemplo, 7.1). Cada Subprincipio está dividido en uno o más compromisos generales llamados Subsubprincipios (por ejemplo, 7.1.1). Cada Subsubprincipio en la Columna está identificado con un número y contiene una descripción del compromiso.\n* Práctica (Columna G): cada Subsubprincipio incluye un conjunto de Prácticas, o más de uno. Las Prácticas orientan al proveedor sobre las acciones que deben realizarse para implementar el Código de Conducta. \n* Indicador (Columna J): la medición del cumplimiento de cada una de las Prácticas se realiza a través de los Indicadores. Cada Práctica tiene uno o más Indicadores. Los Indicadores aparecen en forma de pregunta. Solo los indicadores «Obligatorios» son evaluados respecto del cumplimiento con el Código de Conducta. Los indicadores «Recomendados» se presentan para indicar las buenas prácticas y su implementación debería ser también objeto de los proveedores.\n* Documentación obligatoria (Columna K): describe la documentación que debe presentarse para cumplir con los Indicadores obligatorios.\n* Categoría de Indicador (Columna N): todos los Indicadores están clasificados como Obligatorios o Recomendados. El Proveedor debe cumplir con todos los Indicadores Obligatorios.\n* Función (Columna O): esta columna sugiere, para todos los Indicadores, cuál debe ser el equipo o el departamento dentro de la estructura del proveedor del dinero móvil que debería asumir la responsabilidad por el cumplimiento de cada Indicador. La definición de cada Departamento se encuentra en la planilla de Definiciones. Considerando que la estructura de un proveedor del dinero móvil puede ser diferente, entonces las responsabilidades podrán ser asumidas por un equipo distinto."]
[null,{"$f":"CHOOSE(LanguageNumber,E8,G8,I8,K8)","v":"Principle worksheets (1-8): Recording compliance"},null,null,"Principle worksheets (1-8): Recording compliance",null,"Feuilles de calcul des Principes (1-8) : Indiquer le niveau de conformité",null,"Planillas de Principios (1 al 8): Registro del cumplimiento"]
[null,{"$f":"CHOOSE(LanguageNumber,E9,G9,I9,K9)","v":"There are two sections for recording compliance: a self-assessment record (columns Q-AE) and an external assessment record (columns AF-AT). Each is designed in the same format:\n• Compliance (Columns Q and AF):  Compliance with each Indicator should be documented by selecting a response from the drop-down menu in Column M. Possible responses are 'Yes', 'No', 'Partial', or 'N/A'. 'No response' will remain if a response is not provided, but note that all Required indicators must be evaluated.\n• Evidence Provided (Columns R and AG): A description of the evidence provided should be recorded: for example the name of the appropriate document.\n• Action (Columns S and AH): Follow-up actions (e.g. remedial actions in case of non-compliance) can be recorded in this column.\n• Comments (Columns T and AI):  A brief comment can be recorded for each response. If the compliance response is 'Partial', 'No' or 'N/A', a brief explanation should be provided.\n• Reviewer Name (Columns U and AJ): The name of the assessing individual can be noted in case of future queries.\n• Spare columns (Columns V-AE and AK-AT): these hidden columns may be un-hidden and used to record additional information for local use. The columns may be renamed in the Drivers tab (Columns AJ-AM).\n"},null,null,"There are two sections for recording compliance: a self-assessment record (columns Q-AE) and an external assessment record (columns AF-AT). Each is designed in the same format:\n• Compliance (Columns Q and AF):  Compliance with each Indicator should be documented by selecting a response from the drop-down menu in Column M. Possible responses are 'Yes', 'No', 'Partial', or 'N/A'. 'No response' will remain if a response is not provided, but note that all Required indicators must be evaluated.\n• Evidence Provided (Columns R and AG): A description of the evidence provided should be recorded: for example the name of the appropriate document.\n• Action (Columns S and AH): Follow-up actions (e.g. remedial actions in case of non-compliance) can be recorded in this column.\n• Comments (Columns T and AI):  A brief comment can be recorded for each response. If the compliance response is 'Partial', 'No' or 'N/A', a brief explanation should be provided.\n• Reviewer Name (Columns U and AJ): The name of the assessing individual can be noted in case of future queries.\n• Spare columns (Columns V-AE and AK-AT): these hidden columns may be un-hidden and used to record additional information for local use. The columns may be renamed in the Drivers tab (Columns AJ-AM).\n",null,"Deux sections permettent d'évaluer la conformité : l’une pour l’auto-évaluation (colonnes Q-AE), l’autre pour l’évaluation externe (colonnes AF-AT). Ces deux sections sont disposées de façon identique :\n• Conformité (colonnes Q et AF) :  La conformité à chaque indicateur doit être renseignée en sélectionnant une réponse depuis la liste déroulante de la colonne M. Les réponses possibles sont « Oui », « Non », « En partie » et « n/d ». « Sans réponse » sera conservé si aucune autre réponse n’est choisie, mais au moins tous les Indicateurs Requis doivent être évalués.\n• Documents fournis (colonnes R et AG) : Une description des documents fournis doit être renseignée : par exemple, le nom du document approprié.\n• Mesure (colonnes S et AH) : Les mesures à prendre (par ex. mesures correctives en cas de non-conformité) peuvent être indiquées dans cette colonne.\n• Commentaires (colonnes T et AI) :  Un court commentaire peut être saisi pour chaque réponse. Si la conformité est au niveau « en partie », « non » ou « n/d », une courte explication doit être renseignée.\n• Nom de l’examinateur (colonnes U et AJ) : Le nom de la personne réalisant l'évaluation peut être noté pour des questions ultérieures.\n• Colonnes libres (colonnes V-AE et AK-AT) : ces colonnes masquées peuvent être affichées pour y renseigner des informations supplémentaires en vue d’une utilisation en local. Ces colonnes peuvent être renommées dans l'onglet Drivers (colonnes AJ-AM).\n",null,"Se incluyen dos secciones para registrar el cumplimiento: un registro de autoevaluación (Columnas Q-AE) y uno de evaluación externa (Columnas AF-AT). Ambas están diseñadas con el mismo formato.\n* Cumplimiento (Columnas Qy AF): el cumplimiento con cada Indicador debería documentarse mediante el menú desplegable que se encuentra en la Columna M. Las posibles respuestas son «Sí», «No», «Parcial» o «N/A». Si no se proporciona una respuesta, se mantendrá la opción «No responde». Sin embargo, tome en cuenta que todos los Indicadores Obligatorios deben ser evaluados.\n* Documentación Presentada (Columnas R y AG): debe registrar la descripción de la documentación presentada como, por ejemplo, el nombre del documento pertinente.\n* Acción (Columnas S y AH): las acciones de seguimiento (por ejemplo, acciones correctivas en caso de falta de cumplimiento) pueden ser registradas en esta columna.\n* Comentarios (Columnas T y AI): puede registrar un breve comentario sobre cada respuesta. Si la respuesta al cumplimiento es «Parcial», «No» o «N/A», debe incluir una breve explicación.\n* Nombre del evaluador (Columnas U y AJ): el nombre de la persona que realiza la evaluación puede registrarse, para consultas a futuro.\n* Columnas adicionales (Columnas V-AE y AK-AT): estas columnas ocultas pueden mostrarse y utilizarse para registrar información adicional para uso del equipo local. El nombre de las columnas puede cambiarse en la pestaña de Impulsores (Columnas AJ-AM)."]
[null,{"$f":"CHOOSE(LanguageNumber,E10,G10,I10,K10)","v":"Principle worksheets (1-8): Additional information"},null,null,"Principle worksheets (1-8): Additional information",null,"Feuilles de calcul des Principes (1-8) : Informations supplémentaires",null,"Planillas de Principios (1-8): Información adicional"]
[null,"Filtering:  Filters are available for the Indicator Category, Function, and Self-Assessment Compliance columns. For example, these may be used to list only Indicators that are Required, or to list only those Indicators for a particular Function, or to identify Indicators with a specific compliance status.\n\nHidden Columns:  A number of hidden columns are included in the sub-Principle worksheets. To ensure proper functioning of the toolkit, these columns should not be edited or deleted: \n• Column H (Practice Data Source) cites relevant source materials for a particular Practice, if applicable. Sources cited are referenced in greater detail in the Definitions tab. \n• Column J (Detailed Indicator Category) further sub-divides the Required Indicators into 'Urgent Required' and 'Standard Required'.\n• A number of other hidden columns contain reference data for version control and analysis.",null,null,"Filtering:  Filters are available for the Indicator Category, Function, and Self-Assessment Compliance columns. For example, these may be used to list only Indicators that are Required, or to list only those Indicators for a particular Function, or to identify Indicators with a specific compliance status.\n\nHidden Columns:  A number of hidden columns are included in the sub-Principle worksheets. To ensure proper functioning of the toolkit, these columns should not be edited or deleted: \n• Column H (Practice Data Source) cites relevant source materials for a particular Practice, if applicable. Sources cited are referenced in greater detail in the Definitions tab. \n• Column J (Detailed Indicator Category) further sub-divides the Required Indicators into 'Urgent Required' and 'Standard Required'.\n• A number of other hidden columns contain reference data for version control and analysis.",null,"Filtrage :  Des filtres peuvent être appliqués aux colonnes Catégorie d’indicateur, Fonction et Conformité après auto-évaluation. Par exemple, ces filtres permettent d'afficher seulement les Indicateurs Requis ou les indicateurs pour une fonction précise, ou encore d'afficher les indicateurs à un niveau de conformité défini.\n\nColonnes masquées :  Les feuilles de calcul des sous-principes contiennent plusieurs colonnes masquées. Afin d'assurer le bon fonctionnement de cet outil, ces colonnes ne doivent pas être modifiées ou supprimées. \n• La colonne H (Source d'information de la Pratique) indique les sources d’une Pratique particulière, lorsque celles-ci existent. Les sources citées sont détaillées dans l’onglet Définitions. \n• La colonne J (Catégorie d’indicateur détaillée) indique les sous-catégories des indicateurs requis, soit « Requis Urgent » ou « Requis Normal ».\n• Plusieurs colonnes masquées contiennent des données de référence pour le contrôle et l'analyse de version.",null,"Filtrado: las columnas de Categoría de Indicador, Función y Autoevaluación de Cumplimiento ofrecen la opción de filtrado. Por ejemplo, estos filtros pueden utilizarse para indicar los Indicadores Obligatorios, los Indicadores aplicables a una Función en particular o para identificar los Indicadores relacionados a un estado de cumplimiento específico.\n\nColumnas ocultas: En las planillas de Sub-Principios, se incluyen varias columnas ocultas. Para garantizar el adecuado funcionamiento de esta herramienta, estas columnas no deben ser editadas ni eliminadas. \n* La Columna H (Fuente de Datos de Prácticas) cita las fuentes relevantes de una Practica particular, cuando corresponde. Las fuentes citadas están descritas en mayor detalle en la pestaña de Definiciones. \n* La Columna J (Categoría de Indicador detallado) subdivide aún más los Indicadores Obligatorios en «Obligatorio Urgente» y «Obligatorio Normal».\n* Otras varias columnas ocultas contienen datos referenciales para el control y análisis de la versión."]
[null,"Summary (self-assessment and external assessment)",null,null,"Summary (self-assessment and external assessment)",null,"Synthèse (auto-évaluation et évaluation externe)",null,"Resumen (autoevaluación y evaluación externa)"]
[null,"The Self-asssessment summary and External assessment summary worksheets provide overall compliance information for all eight Principles of the Code of Conduct based on the recorded compliance data. The charts and tables present a picture of overall compliance for both Required and Recommended Indicators. The pie charts demonstrate overall compliance, while the bar charts provide information both on overall compliance and each individual Principle. The table displays the summary data.\n\nNOTE:  Print settings have been customized to allow the full Summary worksheet to be printed on a single page (preferably A3). In most cases, using these custom settings will yield the best results when printing the summary.",null,null,"The Self-asssessment summary and External assessment summary worksheets provide overall compliance information for all eight Principles of the Code of Conduct based on the recorded compliance data. The charts and tables present a picture of overall compliance for both Required and Recommended Indicators. The pie charts demonstrate overall compliance, while the bar charts provide information both on overall compliance and each individual Principle. The table displays the summary data.\n\nNOTE:  Print settings have been customized to allow the full Summary worksheet to be printed on a single page (preferably A3). In most cases, using these custom settings will yield the best results when printing the summary.",null,"Les feuilles de calcul pour le résumé de l'auto-évaluation ou de l'évaluation extérieure fournissent des informations sur la conformité générale aux huit Principes du Code de conduite, établies d’après les données de conformité enregistrées. Les graphiques et tableaux dressent une vue d’ensemble de la conformité générale pour les Indicateurs Requis et Recommandés. Les diagrammes circulaires indiquent la conformité dans son ensemble, les diagrammes en barres indiquent à la fois la conformité générale et la conformité à chaque Principe. Le tableau affiche une synthèse des données.\n\nREMARQUE :  Les paramètres d'impression ont été adaptés pour permettre une impression de la feuille de calcul entière sur une seule page (de préférence au format A3). Dans la plupart des cas, l’utilisation de ces paramètres donnera le meilleur rendu d’impression de la synthèse,",null,"Los resúmenes de las planillas de Autoevaluación y Evaluación Externa proporcionan información sobre el cumplimiento general para los ocho Principios del Código de Conducta en base a los datos registrados sobre dicho cumplimiento. Los gráficos y las tablas presentan el panorama completo del cumplimiento tanto para Indicadores Obligatorios como Recomendados. Los gráficos circulares muestran el cumplimiento total, mientras que los gráficos de barras proveen información tanto sobre el cumplimiento total como sobre cada Principio individual. La tabla exhibe el resumen de los datos.\n\nNOTA: La configuración para impresión fue adaptada para que la planilla de Resumen completa pueda ser imprimida en una sola página (preferiblemente, tamaño A3) Utilizar esta configuración adaptada imprimirá el resumen de mejor manera en la mayoría de los casos,"]
[null,{"$f":"CHOOSE(LanguageNumber,E14,G14,I14,K14)","v":"Charts (self-assessment and external assessment)"},null,null,"Charts (self-assessment and external assessment)",null,"Graphiques (auto-évaluation et évaluation externe)",null,"Gráficos (autoevaluación y evaluación externa)"]
[null,"The Self-asssessment charts and External assessment charts worksheets provide a detailed summary of Mobile Money Certification self-assessment compliance. \nPie charts give the compliance for each Principle (both required and recommended indicators) and bar charts provide details of compliance for each sub-principle. Detailed data is displayed in tables for each Principle and sub-Principle.\n\nNOTE: The pie charts and bar charts do not include N/A responses, as they focus on compliance with applicable Indicators only. \n\nPrint settings have been customized to allow the Charts worksheet to be printed (preferably A3).",null,null,"The Self-asssessment charts and External assessment charts worksheets provide a detailed summary of Mobile Money Certification self-assessment compliance. \nPie charts give the compliance for each Principle (both required and recommended indicators) and bar charts provide details of compliance for each sub-principle. Detailed data is displayed in tables for each Principle and sub-Principle.\n\nNOTE: The pie charts and bar charts do not include N/A responses, as they focus on compliance with applicable Indicators only. \n\nPrint settings have been customized to allow the Charts worksheet to be printed (preferably A3).",null,"Les feuilles de calcul contenant des graphiques pour l’auto-évaluation et l'évaluation externe offrent un résumé détaillé de la conformité au Certification Mobile Money après auto-évaluation. \nLes diagrammes circulaires indiquent la conformité à chaque Principe (indicateurs requis et recommandés) et les diagrammes en barres détaillent la conformité à chaque sous-principe. Des données détaillées figurent dans les tableaux pour chaque Principe et sous-principe\n\nREMARQUE : Les diagrammes circulaires et en bâtons n'incluent pas les réponses « n/d », car ils reflètent seulement la conformité aux Indicateurs applicables. \n\nLes paramètres d'impression ont été adaptés pour permettre une impression de la feuille de calcul Graphiques (de préférence au format A3).",null,"Las planillas de los gráficos de Autoevaluación y Evaluación Externas proporcionan un resumen detallado de la autoevaluación de cumplimiento con Certificatión de Dinero Móvil. \nLos gráficos circulares muestran el cumplimiento con cada Principio (tanto respecto de los Indicadores Obligatorios como de los Recomendados) y los gráficos de barras proveen información detallada sobre el cumplimiento con cada Sub-Principio. Los datos detallados se exhiben en las Tablas para cada Principio y Sub-Principio.\n\nNOTA: Los gráficos circulares y de barras no incluyes las respuestas «N/A», ya que solo se enfocan en el cumplimiento de los Indicadores aplicables. \n\nSe adaptó la configuración de impresión para que la planilla de Gráficos pueda imprimirse (preferiblemente en tamaño A3)."]
[null,"Report",null,null,"Report",null,"Rapport",null,"Reporte"]
[null,"The Report worksheet contains all assessment data for detailed analysis, including both self-assessment and external assessment compliance data. Filters may be applied to one or more of the columns to select required information. Columns may be hidden if not required. \n\nNOTE: Sorting the data has no effect. \n\nPrint settings have been customized to allow the full Summary worksheet to be printed on a single page (preferably A3). Only the visible columns will be printed, so unnecessary columns should be hidden before printing.",null,null,"The Report worksheet contains all assessment data for detailed analysis, including both self-assessment and external assessment compliance data. Filters may be applied to one or more of the columns to select required information. Columns may be hidden if not required. \n\nNOTE: Sorting the data has no effect. \n\nPrint settings have been customized to allow the full Summary worksheet to be printed on a single page (preferably A3). Only the visible columns will be printed, so unnecessary columns should be hidden before printing.",null,"La feuille de calcul Rapport contient toutes les données d'évaluation à des fins d'analyse détaillée, y compris les données de conformité obtenues suite à une auto-évaluation ou une évaluation externe. Il est possible de filtrer une ou plusieurs colonnes pour sélectionner les informations souhaitées. Les colonnes peuvent être masquées si nécessaire. \n\nREMARQUE : Le tri des données n’a aucun effet. \n\nLes paramètres d'impression ont été adaptés pour permettre une impression de la feuille de calcul entière sur une seule page (de préférence au format A3). Seules les colonnes affichées seront imprimées. Il est donc recommandé de masquer les colonnes inutilisées avant d'imprimer.",null,"La planilla de Reporte contiene toda la información sobre la evaluación para un análisis detallado, e incluye los datos de cumplimiento tanto para la autoevaluación como la evaluación externa. Se pueden aplicar filtros a una o más columnas para seleccionar la información requerida. Si no se necesitan, estas columnas pueden ocultarse. \n\nNOTA: La clasificación de los datos no tiene efecto. \n\nNOTA: La configuración de impresión fue adaptada para imprimir la planilla de Resumen completa en una sola hoja (preferiblemente, tamaño A3). Solo las columnas visibles se imprimirán, las columnas que no se necesiten deben ocultarse antes de imprimir."]
[null,"Definitions",null,null,"Definitions",null,"Définitions",null,"Definiciones"]
[null,"The definitions are divided into three sections:\n • Terms:  This section provides definitions for technical terms used in the Practices and/or Indicators.\n • Data Sources:  This section provides hyperlinks to data sources used in the toolkit. As noted above, the data sources are kept in a hidden column (Column H) in each of the Principle worksheets. \n • Functions:  This section provides definitions for each of the Functions listed in Column O of the Principle worksheets.",null,null,"The definitions are divided into three sections:\n • Terms:  This section provides definitions for technical terms used in the Practices and/or Indicators.\n • Data Sources:  This section provides hyperlinks to data sources used in the toolkit. As noted above, the data sources are kept in a hidden column (Column H) in each of the Principle worksheets. \n • Functions:  This section provides definitions for each of the Functions listed in Column O of the Principle worksheets.",null,"Les définitions sont divisées en trois sections :\n • Termes :  Cette section donne la définition des mots techniques utilisés pour les Pratiques et/ou les Indicateurs.\n • Sources d'information :  Cette section renvoie, au moyen de liens hypertextes,  vers les sources d’information utilisées pour cet outil. Comme remarqué ci-dessus, les sources d’informations sont conservées dans une colonne cachée (colonne H) dans chacune de feuilles de calcul des Principes. \n • Fonctions :  Cette section donne la définition de chacune des fonctions listées dans la colonne O des feuilles de calcul des Principes.",null,"Las definiciones se dividen en tres secciones:\n * Términos: esta sección define los términos técnicos utilizados en las Prácticas y/o los Indicadores.\n * Fuentes de datos: esta sección proporciona los hipervínculos a las fuentes de datos utilizadas para esta herramienta. Tal como se indica más arriba, estas fuentes de datos se encuentran en una columna oculta (Columna H) en cada una de las planillas de Principios. \n * Funciones: esta sección establece las definiciones de cada una de las Funciones que aparecen en la Columna O de las planillas de Principios."]
[null,{"$f":"CHOOSE(LanguageNumber,E20,G20,I20,K20)","v":"Migration"},null,null,"Migration",null,"Migration",null,"Migración"]
[null,"A data migration tool has been incorporated into this toolkit. This tool will copy the compliance data (scores and comments) from the previous version to the current version of the toolkit. The previous toolkit version must be the v1 (May 2016) toolkit, comprising eight spreadsheets. Scores and comments will be migrated for those indicators that directly correspond to indicators in the new toolkit. Scores and comments will be left blank where new indicators have been added to the current toolkit version. Instructions on using the migration tool are included in the Migration worksheet.\n\nNOTE: Macros must be enabled in Excel for the migration tool to work.\n",null,null,"A data migration tool has been incorporated into this toolkit. This tool will copy the compliance data (scores and comments) from the previous version to the current version of the toolkit. The previous toolkit version must be the v1 (May 2016) toolkit, comprising eight spreadsheets. Scores and comments will be migrated for those indicators that directly correspond to indicators in the new toolkit. Scores and comments will be left blank where new indicators have been added to the current toolkit version. Instructions on using the migration tool are included in the Migration worksheet.\n\nNOTE: Macros must be enabled in Excel for the migration tool to work.\n",null,"Un utilitaire de migration des données a été intégré à cet outil. Cet utilitaire va copier les données de conformité (niveaux et commentaires) renseignées dans les outils de version précédente et les coller dans la version actuelle de l’outil. La version précédente de l’outil doit être la v1 (mai 2016), qui comprend 8 feuilles de calcul. Les niveaux de conformité et commentaires seront transférés pour les indicateurs qui ont un équivalent dans le nouvel outil. Les niveaux de conformité et commentaires seront laissés vides là où de nouveaux indicateurs ont été ajoutés à la version actuelle de l’outil. Des instructions sur l’utilisation de l'utilitaire de migration sont incluses dans la feuille de calcul Migration.\n\nREMARQUE : Les macros doivent être activées dans Excel pour que l’utilitaire de migration puisse fonctionner.\n",null,"Se incluye una herramienta para la migración de datos que copiará los datos de cumplimiento (puntajes y comentarios) de la versión previa de la herramienta a la actual. La versión anterior de esta herramienta debe ser la v1 (mayo 2016) que incluía ocho planillas. Los puntajes y los comentarios correspondientes a los indicadores en la nueva herramienta se migrarán directamente. Los puntajes y comentarios correspondientes a nuevos indicadores agregados a la versión actual de la herramienta quedarán en blanco. Las instrucciones para utilizar la herramienta de migración se encuentran en la planilla de Migración.\n\nNOTA: Los macros de Excel deben estar habilitados para el funcionamiento de la herramienta de migración."]
[null,"A final note on sheet protection",null,null,"A final note on sheet protection",null,"Note finale sur la protection des feuilles",null,"Nota final sobre la protección de las planillas"]
[null,"Most of the worksheets have been protected to reduce the likelihood of accidental changes to the toolkit. Users of the toolkit should have access to all necessary functionality for each worksheet; if so, please do not unprotect the worksheets. If worksheet protection is limiting your ability to effectively use a particular worksheet, you can unprotect that sheet through the Excel menu. There is no password to protect or unprotect the toolkit.",null,null,"Most of the worksheets have been protected to reduce the likelihood of accidental changes to the toolkit. Users of the toolkit should have access to all necessary functionality for each worksheet; if so, please do not unprotect the worksheets. If worksheet protection is limiting your ability to effectively use a particular worksheet, you can unprotect that sheet through the Excel menu. There is no password to protect or unprotect the toolkit.",null,"La plupart des feuilles de calcul sont protégées afin de réduire le risque de modification de l'outil par accident. Les utilisateurs de l’outil doivent avoir accès à toutes les fonctions nécessaires de chaque feuilles de calcul. À ce titre, merci de ne pas ôter la protection des feuilles de calcul. Si la protection vous limite dans la bonne utilisation d’une feuille, vous pouvez ôter la protection à l’aide du menu Excel. Aucun mot de passe n’est requis pour protéger ou ôter la protection de l'outil.",null,"La mayoría de las planillas está protegida para minimizar la posibilidad de que se realicen cambios accidentales a la herramienta. Los usuarios de esta herramienta deben tener acceso a todas las funcionalidades necesarias en cada planilla; si ese es el caso, no deshabilite la protección de las planillas. Si la protección de planillas presenta un obstáculo para utilizar una planilla en particular en forma eficaz, puede desproteger esa planilla desde el menú de Excel. No hay una contraseña para la protección o desprotección de esta herramienta."]

{"sheet":"1","index":2,"n_rows":29,"n_cols":144,"rows_kept":29,"cut":false,"hidden":false,"merged":[[12,4,14,4],[18,52,19,52],[18,69,19,69],[20,69,22,69],[20,85,22,85],[20,4,21,4],[20,67,22,67],[20,52,22,52],[20,50,22,50],[12,83,13,83],[12,67,14,67],[6,53,10,53],[4,101,5,101],[4,85,5,85],[4,52,5,52],[4,69,5,69],[4,83,6,83],[6,69,10,69],[6,85,10,85],[4,4,6,4],[23,101,24,101],[25,85,26,85],[25,101,26,101],[25,69,26,69],[23,52,24,52],[23,85,24,85],[23,69,24,69],[25,52,26,52],[6,101,10,101],[4,50,6,50],[6,52,10,52],[20,101,22,101],[20,83,22,83],[18,101,19,101],[18,85,19,85]]}
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,"x",null,null,null,null,"x",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"x"]
[null,null,null,null,null,null,{"$f":"UPPER(Introduction!B5)","v":"1. FINANCE:  SAFEGUARD CUSTOMER FUNDS AGAINST THE RISK OF LOSS"},null,null,null,null,null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,Drivers!K18,Drivers!L18,Drivers!M18,Drivers!N18)","v":"SELF-ASSESSMENT"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,Drivers!K34,Drivers!L34,Drivers!M34,Drivers!N34)","v":"EXTERNAL ASSESSMENT"},null,null,null,null,null,"SCHEME OPERATOR REVIEW",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null," ",null,null,null,null,null,16,null,17,null,null,3,null,null,4,5,6,9,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"LANGUAGE",null,null,null,null,null,null,"Change types: NEW, MERGE, MOVE, SWAP","Don't edit the Indicator ID",null,null,null,"*** Don't edit any cell from AB and onwards *** Ignore #NAME or #REF errors; these will disappear during migration",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Counts for computed Compliance calc"]
[null,{"$f":"CHOOSE(LanguageNumber,AV3,BM3,CC3,CS3)","v":"Principle"},"Sub-principle","Sub-sub-principle","Sub-sub-principle","Practice ID","Practice","Practice data source","Indicator ID",{"$f":"CHOOSE(LanguageNumber,BE3,BU3,CK3,DA3)","v":"Indicator"},"Evidence required","[SPARE]","Detailed indicator category","Indicator category","Function","[SPARE]",{"$f":"CHOOSE(LanguageNumber,Drivers!K19,Drivers!L19,Drivers!M19,Drivers!N19)","v":"Compliance"},{"$f":"CHOOSE(LanguageNumber,Drivers!K20,Drivers!L20,Drivers!M20,Drivers!N20)","v":"Evidence document (specify document name, section number and page number)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K21,Drivers!L21,Drivers!M21,Drivers!N21)","v":"Comments \n(include notes on how the practice is implemented)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K22,Drivers!L22,Drivers!M22,Drivers!N22)","v":"Action"},{"$f":"CHOOSE(LanguageNumber,Drivers!K23,Drivers!L23,Drivers!M23,Drivers!N23)","v":"Reviewer name"},{"$f":"CHOOSE(LanguageNumber,Drivers!K24,Drivers!L24,Drivers!M24,Drivers!N24)","v":"Evidence sent to Assessor?"},{"$f":"CHOOSE(LanguageNumber,Drivers!K25,Drivers!L25,Drivers!M25,Drivers!N25)","v":"Spare 2"},{"$f":"CHOOSE(LanguageNumber,Drivers!K26,Drivers!L26,Drivers!M26,Drivers!N26)","v":"Spare 3"},{"$f":"CHOOSE(LanguageNumber,Drivers!K27,Drivers!L27,Drivers!M27,Drivers!N27)","v":"Spare 4"},{"$f":"CHOOSE(LanguageNumber,Drivers!K28,Drivers!L28,Drivers!M28,Drivers!N28)","v":"Spare 5"},{"$f":"CHOOSE(LanguageNumber,Drivers!K29,Drivers!L29,Drivers!M29,Drivers!N29)","v":"Spare 6"},{"$f":"CHOOSE(LanguageNumber,Drivers!K30,Drivers!L30,Drivers!M30,Drivers!N30)","v":"Spare 7"},{"$f":"CHOOSE(LanguageNumber,Drivers!K31,Drivers!L31,Drivers!M31,Drivers!N31)","v":"Spare 8"},{"$f":"CHOOSE(LanguageNumber,Drivers!K32,Drivers!L32,Drivers!M32,Drivers!N32)","v":"Spare 9"},{"$f":"CHOOSE(LanguageNumber,Drivers!K33,Drivers!L33,Drivers!M33,Drivers!N33)","v":"Spare 10"},{"$f":"CHOOSE(LanguageNumber,Drivers!K35,Drivers!L35,Drivers!M35,Drivers!N35)","v":"Compliance"},{"$f":"CHOOSE(LanguageNumber,Drivers!K36,Drivers!L36,Drivers!M36,Drivers!N36)","v":"Evidence document (specify document name, section number and page number)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K37,Drivers!L37,Drivers!M37,Drivers!N37)","v":"Comments \n(include notes on how the practice is implemented)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K38,Drivers!L38,Drivers!M38,Drivers!N38)","v":"Recommendation to Provider"},{"$f":"CHOOSE(LanguageNumber,Drivers!K39,Drivers!L39,Drivers!M39,Drivers!N39)","v":"Reviewer name"},{"$f":"CHOOSE(LanguageNumber,Drivers!K40,Drivers!L40,Drivers!M40,Drivers!N40)","v":"Guidance notes for Assessor"},{"$f":"CHOOSE(LanguageNumber,Drivers!K41,Drivers!L41,Drivers!M41,Drivers!N41)","v":"Scheme Operator comments"},{"$f":"CHOOSE(LanguageNumber,Drivers!K42,Drivers!L42,Drivers!M42,Drivers!N42)","v":"Assessor's response to Scheme Operator"},{"$f":"CHOOSE(LanguageNumber,Drivers!K43,Drivers!L43,Drivers!M43,Drivers!N43)","v":"Scheme Operator conclusion"},{"$f":"CHOOSE(LanguageNumber,Drivers!K44,Drivers!L44,Drivers!M44,Drivers!N44)","v":"Spare 15"},{"$f":"CHOOSE(LanguageNumber,Drivers!K45,Drivers!L45,Drivers!M45,Drivers!N45)","v":"Spare 16"},{"$f":"CHOOSE(LanguageNumber,Drivers!K46,Drivers!L46,Drivers!M46,Drivers!N46)","v":"Spare 17"},{"$f":"CHOOSE(LanguageNumber,Drivers!K47,Drivers!L47,Drivers!M47,Drivers!N47)","v":"Spare 18"},{"$f":"CHOOSE(LanguageNumber,Drivers!K48,Drivers!L48,Drivers!M48,Drivers!N48)","v":"Spare 19"},{"$f":"CHOOSE(LanguageNumber,Drivers!K49,Drivers!L49,Drivers!M49,Drivers!N49)","v":"Spare 20"},null,"Principle","Sub-principle","Sub-sub-principle","Sub-sub-principle","Practice ID","Practice","Practice data source","Indicator ID","ORIGINAL ID","Indicator","Evidence required","[SPARE]","Detailed indicator category","Indicator category","Function","[SPARE]",null,"Principe","Sous-principe","Sous-sous-principe","Description du sous-sous-principe","Pratique ID","Pratique","Source de données pratique","Indicateur ID","Indicateur","Documents généralement requis","[SPARE]","Catégorie détaillée d’indicateur","Catégorie d’indicateur","Fonction","[SPARE]",null,"Principio","Sub-principio","Sub-sub-principio","Sub-sub-principio","Nro. de Práctica","Práctica","Origen de datos de Práctica","Nro. de Indicador","Indicador","Documentación obligatoria","[SPARE]","Categoría indicador detallada","Categoría de Indicador","Función","[SPARE]",null,"Principle","Sub-principle","Sub-sub-principle","Sub-sub-principle Description","Practice","Practice","Practice data source","Indicator","Indicator","Evidence required","[SPARE]","Detailed indicator category","Indicator category","Function","[SPARE]",null,null,null,null,null,null,"Change type","Original Indicator ID","Merged indicator #1","Merged indicator #2","Merged indicator #3","v1 Compliance rating Original Indicator ID","v1 Compliance rating Merged indicator #1","v1 Compliance rating Merged indicator #2","v1 Compliance rating Merged indicator #3","v1 Comment Original Indicator ID","v1 Comment Merged indicator #1  ","v1 Comment Merged indicator #2","v1 Comment Merged indicator #3","v2 Computed change type","v2 Computed compliance rating","v2 Computed comment","rangename1","rangename2","rangename3","rangename4","Yes","No","N/A","Partial","No Response","how many","calc"]
[null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!C5,\": \",Introduction!D5))","v":"1.1: PROTECTION AGAINST LOSS DUE TO FAILURE OF BANK, PROVIDER, OR OTHER PARTY"},null,null," ",null,{"$f":"Introduction!E5","v":"Providers shall take measures to ensure that funds are protected in the case of insolvency of provider, custodial bank or other entity"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!K5,\": \",Introduction!L5))","v":"1.1: PROTECTION AGAINST LOSS DUE TO FAILURE OF BANK, PROVIDER, OR OTHER PARTY"},null,null,null,null,null,{"$f":"Introduction!$M$5","v":"Providers shall take measures to ensure that funds are protected in the case of insolvency of provider, custodial bank or other entity"},null,null,null,null,null,null,null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!$P$5,\": \",Introduction!$Q$5))","v":"1.1: PROTECTION CONTRE LES PERTES RÉSULTANT DE LA DÉFAILLANCE D'UNE BANQUE, D'UN PRESTATAIRE OU D'UNE AUTRE PARTIE  "},null,null,0,null,{"$f":"Introduction!$R$5","v":"Les prestataires doivent prendre des mesures pour s'assurer que les fonds sont protégés en cas d'insolvabilité du prestataire, d'une banque dépositaire ou d'une autre entité. "},null,null,null,null,null,null,null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!U5,\": \",Introduction!V5))","v":"1.1: PROTECCIÓN CONTRA PÉRDIDAS CAUSADAS POR ERROR DE UN BANCO, PROVEEDOR O TERCERO"},null,null,0,null,{"$f":"Introduction!W5","v":"El proveedor tomará las medidas necesarias para garantizar la protección de los fondos en caso de insolvencia del proveedor, el banco u otra entidad"},null,null,null,null,null,null,null,null,null,null,null,null,null,0]
[null,{"$f":"$AV5","v":"1"},{"$f":"$AW5","v":"1.1"},{"$f":"$AX5","v":"1.1.1"},{"$f":"CHOOSE(LanguageNumber,AY5,BP5,CF5,CV5)","v":"1.1.1: Providers shall ensure that funds equal to the total value of outstanding mobile money liabilities are held in one or more custodial accounts on behalf of the mobile money users."},{"$f":"AZ5","v":"1.1.1.1"},{"$f":"AZ5&\": \"&CHOOSE(LanguageNumber,BA5,BR5,CH5,CX5)","v":"1.1.1.1: VALUE OF E-MONEY MUST BALANCE VALUE IN CUSTODIAL ACCOUNTS\nThe value of funds held across all custodial accounts must be equal to or greater than the total value of outstanding mobile money liabilities. Depending upon the regulatory requirements in the country in question, either (1) 100% of the funds held in custodial accounts must be stored in a bank; or (2) some or all of the funds may be invested in other safe, liquid investments such as government bonds.\n\nIn case of discrepancy, the following must be implemented:\n• All discrepancies must be identified. \n• There should be an action plan for resolution which is being followed and tracked by management.\n• Discrepancies should be resolved promptly where possible. Long-term issues should have a clear plan and monitoring / management\n• The root cause of all discrepancies should be understood.\n• Any discrepancy must not be greater than 5% of the sum value of the custodial bank accounts at any time.\n\nProviders should keep records of the current and historical balances of the custodial account(s) and aggregate outstanding mobile money liabilities. "},{"$f":"BB5","v":"GSMA RMT (FIN-06)"},{"$f":"BC5","v":"1.1.1.1.1"},{"$f":"BC5&\": \"&CHOOSE(LanguageNumber,BE5,BU5,CK5,DA5)&CarriageReturn","v":"1.1.1.1.1: Are funds equal to or greater in value than the total value of outstanding mobile money liabilities held in custodial accounts on behalf of mobile money users?\n"},{"$f":"CHOOSE(LanguageNumber,BF5,BV5,CL5,DB5)","v":"1) Custodial bank reconciliation record (most recent)\n- Check the total value of mobile money users funds held in custodian accounts is greater than, or equal to, the  total value of outstanding mobile money liabilities.\n- If there is a discrepancy, check that:\n• The discrepancy is not greater than 5% of the total value of the custodial bank accounts.\n• There is an action plan for resolution which is being followed and tracked by management.\n• The root cause of the discrepancy is understood or is under investigation, with supporting documentation. "},0,{"$f":"CHOOSE(LanguageNumber,BH5,BX5,CN5,DD5)","v":"Urgent Required"},{"$f":"CHOOSE(LanguageNumber,BI5,BY5,CO5,DE5)","v":"Required"},"FinOps",{"$f":"CHOOSE(LanguageNumber,BK5,CA5,CQ5,DG5)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1","1.1","1.1.1","1.1.1: Providers shall ensure that funds equal to the total value of outstanding mobile money liabilities are held in one or more custodial accounts on behalf of the mobile money users.","1.1.1.1","VALUE OF E-MONEY MUST BALANCE VALUE IN CUSTODIAL ACCOUNTS\nThe value of funds held across all custodial accounts must be equal to or greater than the total value of outstanding mobile money liabilities. Depending upon the regulatory requirements in the country in question, either (1) 100% of the funds held in custodial accounts must be stored in a bank; or (2) some or all of the funds may be invested in other safe, liquid investments such as government bonds.\n\nIn case of discrepancy, the following must be implemented:\n• All discrepancies must be identified. \n• There should be an action plan for resolution which is being followed and tracked by management.\n• Discrepancies should be resolved promptly where possible. Long-term issues should have a clear plan and monitoring / management\n• The root cause of all discrepancies should be understood.\n• Any discrepancy must not be greater than 5% of the sum value of the custodial bank accounts at any time.\n\nProviders should keep records of the current and historical balances of the custodial account(s) and aggregate outstanding mobile money liabilities. ","GSMA RMT (FIN-06)","1.1.1.1.1",{"$f":"DO5","v":"1.1.1.1.1"},"Are funds equal to or greater in value than the total value of outstanding mobile money liabilities held in custodial accounts on behalf of mobile money users?","1) Custodial bank reconciliation record (most recent)\n- Check the total value of mobile money users funds held in custodian accounts is greater than, or equal to, the  total value of outstanding mobile money liabilities.\n- If there is a discrepancy, check that:\n• The discrepancy is not greater than 5% of the total value of the custodial bank accounts.\n• There is an action plan for resolution which is being followed and tracked by management.\n• The root cause of the discrepancy is understood or is under investigation, with supporting documentation. ",null,"Urgent Required","Required",{"$f":"$O5","v":"FinOps"},null,null,{"$f":"$AV5","v":"1"},{"$f":"$AW5","v":"1.1"},{"$f":"$AX5","v":"1.1.1"},"1.1.1: Les prestataires doivent s’assurer que des sommes égales au montant total des engagements  financiers correspondant à l’argent mobile en circulation soient conservées sur un ou plusieurs comptes de cantonnement pour le compte des utilisateurs de leur service d’argent mobile",{"$f":"$AZ5","v":"1.1.1.1"},"L'ENCOURS DE MONNAIE ÉLECTRONIQUE DOIT CORRESPONDRE AU MONTANT DES SOMMES CONSERVÉES SUR DES COMPTES DE CANTONNEMENT\nLe montant des fonds conservés sur un ou plusieurs comptes de cantonnement doit être supérieur ou égal au montant total des engagements correspondant à l’argent mobile. Selon les exigences réglementaires du pays concerné, (1) 100% des fonds détenus sur des comptes de cantonnement doivent être conservés auprès d'une banque, ou (2) tout ou partie de ces fonds peuvent être investis sous forme d'autres placements sûrs et liquides, comme par exemples des obligations d'État.  \n\nEn cas de différence, il convient d’appliquer ce qui suit :\n• Toute différence doit être identifiée. :\n• Un plan d’action visant à la résolution des différences suivi par la gestion est requis. :\n• Les différences doivent être résolues dès que possible. Des différences à long terme doivent faire l’objet d’un plan et d’une gestion efficaces. :\n• Les causes de toutes les différences doivent être identifiées. :\n• À aucun moment la valeur d’une différence ne doit être supérieure à 5 % de la valeur totale des comptes de cantonnement. \n\nLes prestataires doivent conserver un registre des soldes actuel et passés du ou des comptes de cantonnement et du montant total des engagements correspondant à l’argent mobile. ",{"$f":"$BB5","v":"GSMA RMT (FIN-06)"},{"$f":"BC5","v":"1.1.1.1.1"},"le montant total des sommes conservées sur des comptes de cantonnement pour le compte des utilisateurs de l'argent mobile est-il supérieur ou égal au montant total des engagements financiers correspondant à la monnaie électronique en circulation ?","1) Registre de rapprochement avec la banque dépositaire (le plus récent)\n- Vérifier que le montant total des sommes conservées sur des comptes de cantonnement pour le compte des utilisateurs de l’argent mobile est supérieur ou égal au montant total des engagements financiers correspondant à la monnaie électronique en circulation.\n- Si un écart est observé entre ces deux montants, vérifier :\n• que cet écart ne dépasse pas 5% du montant total des comptes de la banque dépositaire.\n• qu’un plan d’action suivi et surveillé par la direction a été mis en place pour résoudre les éventuels problèmes.\n• que la cause profonde de cet écart a été identifiée et fait l’objet d’une enquête et des documents appropriés. ",null,{"$f":"VLOOKUP($BH5,CategoryTranslationTable,2,FALSE)","v":"Requis Prioritaire"},{"$f":"VLOOKUP($BI5,CategoryTranslationTable,2,FALSE)","v":"Requis"},{"$f":"$O5","v":"FinOps"},0,null,{"$f":"$AV5","v":"1"},{"$f":"$AW5","v":"1.1"},{"$f":"$AX5","v":"1.1.1"},"1.1.1: El proveedor garantizará que mantendrá fondos equivalentes al monto total de sus obligaciones en una o más cuentas de custodia a nombre de los usuarios del dinero móvil.",{"$f":"$AZ5","v":"1.1.1.1"},"EL VALOR DEL DINERO ELECTRÓNICO DEBE SER EQUIVALENTE AL VALOR EN LAS CUENTAS DE CUSTODIA\nEl valor de los fondos en las cuentas de custodia debe ser equivalente al total del valor de las obligaciones en concepto de dinero móvil o mayor que el mismo. Según los requerimientos regulatorios del país del que se trate, (1) el 100% de los fondos deben ser guardados en una cuenta de custodia en un banco o (2)  parte o el total de los fondos deben ser invertidos en otras inversiones seguras y líquidas como los bonos del gobierno.\n\nEn caso de discrepancia, se deben seguir los siguientes pasos:\n* Identificar todas las discrepancias \n* Establecer un plan de acción para la resolución de las discrepancias. El personal directivo debe darle seguimiento y monitorear este plan.\n* Las discrepancias deben resolverse inmediatamente, siempre que sea posible. Los problemas de largo plazo deben contar con un plan claro además de supervisión y gestión.\n* La causa raíz de todas las discrepancias debe ser entendida.\n* En ningún momento podrá una discrepancia ser superior al 5% de la suma del valor de las cuentas de custodia bancarias.\n\nEl proveedor debe mantener el registro de los saldos actuales e históricos de la(s) cuenta(s) de custodia y sumar todas las obligaciones del dinero móvil pendientes.",{"$f":"$BB5","v":"GSMA RMT (FIN-06)"},{"$f":"BC5","v":"1.1.1.1.1"},"¿El valor de los fondos es igual o mayor que el valor total de las obligaciones pendientes del dinero móvil depositadas en una cuenta de custodia en nombre de los usuarios de dinero móvil?","1) Registros de conciliación del banco custodio (más reciente)\n- Verificar si el valor total de los fondos de los usuarios del dinero móvil depositados en cuentas de custodia es mayor o igual al valor total de las obligaciones pendientes del dinero móvil.\n- En caso de haber discrepancia, verificar si:\n* La discrepancia no es superior al 5% del valor total de las cuentas bancarias de custodia.\n* Si existe un plan de acción para resolución supervisado y monitoreado por el personal directivo.\n* Se entiende la causa raíz de la discrepancia o está siendo investigada, con la documentación de soporte correspondiente.",null,{"$f":"VLOOKUP($BH5,CategoryTranslationTable,3,FALSE)","v":"Obligatorio urgente"},{"$f":"VLOOKUP($BI5,CategoryTranslationTable,3,FALSE)","v":"Obligatorio"},{"$f":"$O5","v":"FinOps"},null,null,{"$f":"$AV5","v":"1"},{"$f":"$AW5","v":"1.1"},{"$f":"$AX5","v":"1.1.1"},null,{"$f":"$AZ5","v":"1.1.1.1"},null,{"$f":"$BB5","v":"GSMA RMT (FIN-06)"},{"$f":"BC5","v":"1.1.1.1.1"},null,null,null,{"$f":"VLOOKUP($BH5,CategoryTranslationTable,4,FALSE)","v":"ReqU4"},{"$f":"VLOOKUP($BI5,CategoryTranslationTable,4,FALSE)","v":"Req4"},{"$f":"$O5","v":"FinOps"},null,null,null,null,null,null,null,null,"1.1.1.1.1",null,null,null,{"$f":"IF(OR($EA5=0,$EA5=2),VLOOKUP(DO5,INDIRECT(ED5),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP5),\"\",VLOOKUP(DP5,INDIRECT(EE5),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ5),\"\",VLOOKUP(DQ5,INDIRECT(EF5),7,FALSE))","v":""},"",{"$f":"IF(OR($EA5=0,$EA5=2),VLOOKUP(DO5,INDIRECT(ED5),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP5),\"\",VLOOKUP(DP5,INDIRECT(EE5),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ5),\"\",VLOOKUP(DQ5,INDIRECT(EF5),8,FALSE))","v":""},"",{"$f":"1*AND(LEFT(DN5,3)=\"NEW\")+2*AND(LEFT(DN5,3)=\"MER\")+3*AND(LEFT(DN5,3)=\"MOV\")+4*AND(LEFT(DN5,3)=\"SWA\")","v":0},{"$f":"IF(EA5=0,DS5,EN5)","v":{"$error":"#REF!"}},{"$f":"IF(EA5=0,IF(DW5=0,\"\",DW5),CHOOSE(EA5,\"New indicator\",CONCATENATE(DW5,CarriageReturn,DX5,CarriageReturn,DY5,CarriageReturn,DZ5)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO5,1)","v":"OriginalComplianceP1"},{"$f":"\"OriginalComplianceP\"&LEFT(DP5,1)","v":"OriginalComplianceP"},"OriginalComplianceP","OriginalComplianceP",{"$f":"COUNTIF($DS5:$DV5,EH$3)","v":0},0,0,0,0,{"$f":"COUNTIF($DO5:$DR5,\"*?\")","v":1},{"$f":"IF(OR(AND(EH5>0,SUM(EI5:EL5)>0),EK5>0),\"Partial\",IF(EH5=EM5,\"Yes\",IF(EI5=EM5,\"No\",IF(EJ5=EM5,\"N/A\",IF(EK5=EM5,\"Partial\",IF(EL5=EM5,\"\",\"\"))))))","v":""}]
[null,{"$f":"$AV6","v":"1"},{"$f":"$AW6","v":"1.1"},{"$f":"$AX6","v":"1.1.1"},null,{"$f":"AZ6","v":"1.1.1.1"},null,{"$f":"BB6","v":0},{"$f":"BC6","v":"1.1.1.1.2"},"1.1.1.1.2: Are records of the current and historical balances of the custodial account(s) and aggregate outstanding mobile money liabilities readily available?\n","1) Custodial bank reconciliation records (six months)\n- Check that the completed reconciliations for all custodial accounts are easily retrievable for 3-4 chosen dates within the last six months.\n- Check the historical balances are available for those dates.\n- If historical reconciliation balances are not available, review process documentation to ensure that records will be kept available.",0,"Standard Required","Required","FinOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1","1.1","1.1.1",null,"1.1.1.1",null,null,"1.1.1.1.2",{"$f":"DO6","v":"1.1.1.1.2"},"Are records of the current and historical balances of the custodial account(s) and aggregate outstanding mobile money liabilities readily available?","1) Custodial bank reconciliation records (six months)\n- Check that the completed reconciliations for all custodial accounts are easily retrievable for 3-4 chosen dates within the last six months.\n- Check the historical balances are available for those dates.\n- If historical reconciliation balances are not available, review process documentation to ensure that records will be kept available.",null,"Standard Required","Required",{"$f":"$O6","v":"FinOps"},null,null,{"$f":"$AV6","v":"1"},{"$f":"$AW6","v":"1.1"},{"$f":"$AX6","v":"1.1.1"},0,{"$f":"$AZ6","v":"1.1.1.1"},0,{"$f":"$BB6","v":0},"1.1.1.1.2","les registres du solde actuel et passé des comptes de cantonnement et du montant total des engagements correspondant à la monnaie électronique en circulation sont-ils facilement consultables ?","1) Registre de rapprochement avec la banque dépositaire (six mois)\n- Vérifier que les processus de rapprochement effectué pour l’ensemble des comptes de cantonnement peuvent être facilement retrouvés pour 3 ou 4 dates définies dans la période des six derniers mois.\n- Vérifier que les registres d’opérations et de soldes passés sont facilement consultables pour les dates en question.\n- Si le solde passé des rapprochements n’est pas facilement consultable, examiner les documents relatifs au processus concerné afin de s’assurer que des rapports seront conservés.",null,"Requis Normal",{"$f":"VLOOKUP($BI6,CategoryTranslationTable,2,FALSE)","v":"Requis"},"FinOps",0,null,{"$f":"$AV6","v":"1"},{"$f":"$AW6","v":"1.1"},{"$f":"$AX6","v":"1.1.1"},null,{"$f":"$AZ6","v":"1.1.1.1"},null,{"$f":"$BB6","v":0},"1.1.1.1.2","¿Es fácil el acceso a los registros de los saldos actuales e históricos de la(s) cuenta(s) de custodia y el valor agregado de las obligaciones pendientes del dinero móvil?","1) Registros de conciliación del banco custodio (6 meses)\n- Verificar que las conciliaciones completadas para todas las cuentas de custodia pueden recuperarse fácilmente para 3 o 4 fechas selectas, dentro de los últimos seis meses.\n- Verificar que los saldos históricos están disponibles para esas fechas.\n- Si los saldos de las conciliaciones históricas no están disponibles, revisar la documentación de procesos para asegurar la disponibilidad del acceso a los registros.",null,"Obligatorio estándar","Obligatorio","FinOps",null,null,{"$f":"$AV6","v":"1"},{"$f":"$AW6","v":"1.1"},{"$f":"$AX6","v":"1.1.1"},null,{"$f":"$AZ6","v":"1.1.1.1"},null,{"$f":"$BB6","v":0},"1.1.1.1.2",null,null,null,"ReqS4","Req4","FinOps",null,null,null,null,null,null,null,null,"1.1.1.1.2",null,null,null,{"$f":"IF(OR($EA6=0,$EA6=2),VLOOKUP(DO6,INDIRECT(ED6),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP6),\"\",VLOOKUP(DP6,INDIRECT(EE6),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ6),\"\",VLOOKUP(DQ6,INDIRECT(EF6),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR6),\"\",VLOOKUP(DR6,INDIRECT(EG6),7,FALSE))","v":""},{"$f":"IF(OR($EA6=0,$EA6=2),VLOOKUP(DO6,INDIRECT(ED6),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP6),\"\",VLOOKUP(DP6,INDIRECT(EE6),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ6),\"\",VLOOKUP(DQ6,INDIRECT(EF6),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR6),\"\",VLOOKUP(DR6,INDIRECT(EG6),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN6,3)=\"NEW\")+2*AND(LEFT(DN6,3)=\"MER\")+3*AND(LEFT(DN6,3)=\"MOV\")+4*AND(LEFT(DN6,3)=\"SWA\")","v":0},{"$error":"#REF!"},{"$error":"#REF!"},{"$f":"\"OriginalComplianceP\"&LEFT(DO6,1)","v":"OriginalComplianceP1"},{"$f":"\"OriginalComplianceP\"&LEFT(DP6,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ6,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR6,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,{"$f":"IF(OR(AND(EH6>0,SUM(EI6:EL6)>0),EK6>0),\"Partial\",IF(EH6=EM6,\"Yes\",IF(EI6=EM6,\"No\",IF(EJ6=EM6,\"N/A\",IF(EK6=EM6,\"Partial\",IF(EL6=EM6,\"\",\"\"))))))","v":""}]
[null,"1","1.1","1.1.1",null,"1.1.1.2",{"$f":"AZ7&\": \"&CHOOSE(LanguageNumber,BA7,BR7,CH7,CX7)","v":"1.1.1.2: CUSTODIAL BANK RECONCILIATION \nResponsibility for fund safeguarding should be assigned to a Mobile Money finance operations function that is separated from the business operations function. \n\nA process should be documented for reconciling the custodial account with the e-money system to ensure that the value of e-money matches the value of funds in the custodial account. This process should include the following actions:\n• e-money creation (e-money is created when funds are added to the custodial account)\n• e-money allocation (new e-money is allocated to the appropriate account)\n• e-money deletion (e-money is deleted when funds are withdrawn from the custodial account)\n\nReconciliation with the custodial bank should be performed at least daily on weekdays. The custodial bank reconciliation process should clearly specify the start and end point of each reconciliation period, clearly defining which transactions should be included to reach the final settlement position. A procedure should be specified for resolving reconciliation discrepancies.\n\nReconciliation data should be transferred via direct data exchange between the systems of the provider and the custodial bank in order to reduce the risk of errors and fraud. The reconciliation process itself may be manual or automated.\n\n"},"GSMA RMT (FIN-05,\nFIN-11,\nFIN-13,\nFIN-14,\nFIN-15,\nFIN-16,\nFIN-17)\nISO 27002:2013 Sec. 12.1","1.1.1.2.1","1.1.1.2.1: Is responsibility for fund safeguarding assigned to a mobile money finance team that is separated from the business operations function?\n","1) Documented custodial bank reconciliation process\n- Check responsibility for managing e-money is assigned to a mobile money finance team. \n\n2) Finance team organization chart and mobile money operations organisation chart. \n- Check there is separation of the mobile money finance and operations teams\n\n3) Custodial account mandates. \n- Check that only mobile money finance function personnel and mobile money senior management are permitted to operate the custodial accounts.",0,"Standard required","Required","FinOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1","1.1","1.1.1",null,"1.1.1.2","CUSTODIAL BANK RECONCILIATION \nResponsibility for fund safeguarding should be assigned to a Mobile Money finance operations function that is separated from the business operations function. \n\nA process should be documented for reconciling the custodial account with the e-money system to ensure that the value of e-money matches the value of funds in the custodial account. This process should include the following actions:\n• e-money creation (e-money is created when funds are added to the custodial account)\n• e-money allocation (new e-money is allocated to the appropriate account)\n• e-money deletion (e-money is deleted when funds are withdrawn from the custodial account)\n\nReconciliation with the custodial bank should be performed at least daily on weekdays. The custodial bank reconciliation process should clearly specify the start and end point of each reconciliation period, clearly defining which transactions should be included to reach the final settlement position. A procedure should be specified for resolving reconciliation discrepancies.\n\nReconciliation data should be transferred via direct data exchange between the systems of the provider and the custodial bank in order to reduce the risk of errors and fraud. The reconciliation process itself may be manual or automated.\n\n","GSMA RMT (FIN-05,\nFIN-11,\nFIN-13,\nFIN-14,\nFIN-15,\nFIN-16,\nFIN-17)\nISO 27002:2013 Sec. 12.1","1.1.1.2.1",{"$f":"DO7","v":"1.1.1.2.1"},"Is responsibility for fund safeguarding assigned to a mobile money finance team that is separated from the business operations function?","1) Documented custodial bank reconciliation process\n- Check responsibility for managing e-money is assigned to a mobile money finance team. \n\n2) Finance team organization chart and mobile money operations organisation chart. \n- Check there is separation of the mobile money finance and operations teams\n\n3) Custodial account mandates. \n- Check that only mobile money finance function personnel and mobile money senior management are permitted to operate the custodial accounts.",null,"Standard required","Required","FinOps",null,null,"1","1.1","1.1.1",0,"1.1.1.2","RAPPROCHEMENT AVEC LA BANQUE DÉPOSITAIRE \nLa responsabilité de la protection des fonds doit être assignée à une équipe de gestion financière du service d’argent mobile distincte de l’équipe d’exploitation. \n\nUn processus visant au rapprochement des sommes conservées sur les comptes de cantonnement et de l’encours d’argent électronique dans le système doit être documenté afin de s’assurer que l’encours d’argent électronique correspond à la valeur des fonds détenus sur les comptes de cantonnement. Ce processus doit inclure les mesures suivantes :\n• création de monnaie électronique (la monnaie électronique est créée lorsque les fonds sont ajoutés sur le compte de cantonnement)\n• attribution de la monnaie électronique (les sommes de monnaie électronique nouvellement créée sont créditées sur le compte approprié)\n• suppression de la monnaie électronique (les sommes de monnaie électronique sont supprimées lorsque les fonds sont retirés du compte de cantonnement)\n\nLes rapprochements avec la banque dépositaire doivent être effectués chaque jour, au minimum. Le processus de rapprochement avec la banque dépositaire doit définir clairement le point de départ et la fin de chaque période de rapprochement, ainsi que les transactions à prendre en compte pour déterminer la position finale de règlement. Une procédure visant à résoudre les problèmes d’écarts observés suite aux rapprochements doit être définie.\n\nLes données relatives aux rapprochements doivent être transmises par échange direct de données entre le système du prestataire et celui de la banque dépositaire afin de réduire le risque d’erreur et de fraude. Le processus de rapprochement peut être manuel ou semi-automatisé.\n\n","GSMA RMT (FIN-05,\nFIN-11,\nFIN-13,\nFIN-14,\nFIN-15,\nFIN-16,\nFIN-17)\nISO 27002:2013 Sec. 12.1","1.1.1.2.1","la responsabilité de la protection des fonds est-elle assignée à une équipe de gestion financière du service d'argent mobile distincte de la l'équipe d'exploitation ?","1) Processus documenté de rapprochement avec la banque dépositaire\n- Vérifier que la responsabilité de la gestion de l’argent électronique est assignée à une équipe de gestion financière du service d’argent mobile \n\n2) Organigramme de l’équipe financière et des opérations du service d’argent mobile. \n- Vérifier que l’équipe de gestion financière du service d’argent mobile et l’équipe chargée des opérations sont séparées \n\n3) Mandats sur les comptes de cantonnement. \n- Vérifier que le personnel de la fonction de gestion financière du service d’argent mobile et la direction générale des services d’argent mobile sont les seuls habilités à gérer les comptes de cantonnement.",null,"Requis Normal","Requis","FinOps",0,null,"1","1.1","1.1.1",null,"1.1.1.2","CONCILIACIÓN DEL BANCO CUSTODIO \nLa responsabilidad de la salvaguarda de los fondos debe ser asignada a un departamento de operaciones financieras del dinero móvil separado del departamento de operaciones comerciales. \n\nEl proceso de conciliación de las cuentas de custodia con el sistema de dinero electrónico debe documentarse para garantizar que el valor del dinero electrónico es equivalente a los fondos en las cuentas de custodia. Este proceso debe incluir las siguientes acciones:\n▪ creación de dinero electrónico: el dinero electrónico se crea cuando se depositan los fondos en la cuenta de custodia\n▪ asignación de dinero electrónico: se asigna el nuevo dinero electrónico a la cuenta correspondiente\n▪ eliminación del dinero electrónico: se elimina el dinero electrónico cuando los fondos son retirados de la cuenta de custodia.\n\nLa conciliación con el banco custodio debe realizarse diariamente. El proceso de conciliación con el banco custodio debe especificar claramente las fechas de comienzo y fin de cada período de conciliación y definir explícitamente qué transacciones deben incluirse para obtener la posición.  Asimismo, se debe determinar el proceso para resolución de discrepancias en la conciliación.\n\nLos datos de la conciliación deben ser transferidos, mediante un intercambio directo de datos, entre los sistemas del proveedor y el banco custodio a fin de reducir el riesgo de errores y fraudes. El proceso de conciliación en sí puede ser manual o semiautomático.","GSMA RMT (FIN-05,\nFIN-11,\nFIN-13,\nFIN-14,\nFIN-15,\nFIN-16,\nFIN-17)\nISO 27002:2013 Sec. 12.1","1.1.1.2.1","La responsabilidad de la salvaguarda de los fondos debe ser asignada a un equipo financiero de dinero móvil separado del departamento de operaciones comerciales?","1) Proceso documentado de conciliación con el banco custodio\n- Verificar que la responsabilidad de la administración del dinero electrónico es asignada a un equipo financiero del dinero móvil. \n\n2) Organigramas del equipo financiero y de las operaciones del dinero móvil \n- Verificar que los equipos financieros y comerciales del dinero móvil están separados.\n\n3) Mandatos de las cuentas de custodia. \n- Verificar que solo el personal del departamento financiero del dinero móvil y el personal directivo del dinero móvil tienen permiso para operar las cuentas de custodia.",null,"Obligatorio estándar","Obligatorio","FinOps",null,null,"1","1.1","1.1.1",null,"1.1.1.2",null,"GSMA RMT (FIN-05,\nFIN-11,\nFIN-13,\nFIN-14,\nFIN-15,\nFIN-16,\nFIN-17)\nISO 27002:2013 Sec. 12.1","1.1.1.2.1",null,null,null,"ReqS4","Req4","FinOps",null,null,null,null,null,null,null,null,"1.1.1.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP1","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"1","1.1","1.1.1",null,"1.1.1.2",null,null,"1.1.1.2.2","1.1.1.2.2: Is the custodial bank reconciliation process documented in detail, including the actions of e-money creation, allocation and deletion, and a procedure for resolving reconciliation discrepancies promptly?\n","1) Documented custodial bank reconciliation process. \n- Check that the custodial bank reconciliation process is documented in detail, including the actions of:\n    • e-money creation (e-money is created when funds are added to the custodial account)\n    • e-money allocation (new e-money is allocated to the appropriate account)\n    • e-money deletion (e-money is deleted when funds are withdrawn from the custodial account)\n- Check that the process includes a procedure for resolving reconciliation discrepancies promptly, including escalation steps.",0,"Urgent Required","Required","FinOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1","1.1","1.1.1",null,"1.1.1.2",null,null,"1.1.1.2.2",{"$f":"DO8","v":"1.1.1.1.3"},"Is the custodial bank reconciliation process documented in detail, including the actions of e-money creation, allocation and deletion, and a procedure for resolving reconciliation discrepancies promptly?","1) Documented custodial bank reconciliation process. \n- Check that the custodial bank reconciliation process is documented in detail, including the actions of:\n    • e-money creation (e-money is created when funds are added to the custodial account)\n    • e-money allocation (new e-money is allocated to the appropriate account)\n    • e-money deletion (e-money is deleted when funds are withdrawn from the custodial account)\n- Check that the process includes a procedure for resolving reconciliation discrepancies promptly, including escalation steps.",null,"Urgent Required","Required","FinOps",null,null,"1","1.1","1.1.1",null,null,null,null,"1.1.1.2.2","Le processus de rapprochement avec la banque dépositaire est-il documenté en détail, et comprend-il les actions de création, d’attribution et de suppression de monnaie électronique, ainsi qu’une procédure visant à résoudre rapidement les problèmes de différence observés suite aux rapprochements ?","1) Processus documenté de rapprochement avec la banque dépositaire \n- Vérifier que le processus de rapprochement avec la banque dépositaire est documenté en détail et comprend les actions suivantes :\n• création de monnaie électronique (la monnaie électronique est créée lorsque les fonds sont ajoutés sur le compte de cantonnement)\n• attribution de la monnaie électronique (les sommes de monnaie électronique nouvellement créée sont créditées sur le compte approprié)\n• suppression de la monnaie électronique (les sommes de monnaie électronique sont supprimées lorsque les fonds sont retirés du compte de cantonnement)\n- Vérifier que le processus comprend une procédure visant à résoudre rapidement les problèmes d’écarts observés suite aux rapprochements, y compris les mesures visant à faire remonter les informations aux supérieurs hiérarchiques.",null,"Requis Prioritaire","Requis","FinOps",null,null,"1","1.1","1.1.1",null,null,null,null,"1.1.1.2.2","¿El proceso de conciliación con el banco custodio está documentado en detalle, incluidas las acciones de creación, asignación y eliminación del dinero móvil, al igual que el procedimiento para la resolución inmediata de discrepancias en la conciliación?","1) Proceso documentado de conciliación con el banco custodio \n- Verificar que el proceso de conciliación del banco custodio está documentado en detalle, incluidas las acciones de:\n    • creación de dinero electrónico (el dinero electrónico se crea cuando se agregan fondos a la cuenta de custodia)\n    • asignación de  dinero electrónico (el nuevo dinero electrónico se asigna a la cuenta correspondiente)\n    • eliminación de dinero electrónico (el dinero electrónico se elimina cuando se retiran fondos de la cuenta de custodia)\n- Verificar que el proceso incluye un procedimiento para resolver discrepancias en la conciliación de forma inmediata, incluidos los pasos para escalamiento.",null,"Obligatorio urgente","Obligatorio","FinOps",null,null,"1","1.1","1.1.1",null,null,null,null,"1.1.1.2.2",null,null,null,"ReqU4","Req4","FinOps",null,null,null,null,null,null,null,null,"1.1.1.1.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP1","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"1","1.1","1.1.1",{"$f":"CHOOSE(LanguageNumber,AY9,BP9,CF9,CV9)","v":0},"1.1.1.2",null,0,"1.1.1.2.3","1.1.1.2.3: Is reconciliation with the custodial bank performed at least daily on weekdays?\n","1) Documented custodial bank reconciliation process / custodial bank reconciliation records \n-  Check that the reconciliation with the custodial bank is performed at least daily on weekdays.\n",0,"Standard required","Required","FinOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1","1.1","1.1.1",null,"1.1.1.2",null,null,"1.1.1.2.3","1.2.2.2.2","Is reconciliation with the custodial bank performed at least daily on weekdays?","1) Documented custodial bank reconciliation process / custodial bank reconciliation records \n-  Check that the reconciliation with the custodial bank is performed at least daily on weekdays.\n",null,"Standard required","Required","FinOps",null,null,"1","1.1","1.1.1",0,"1.1.1.2",null,0,"1.1.1.2.3","Le processus de rapprochement avec la banque dépositaire a-t-il lieu au moins une fois par jour (hors week-ends) ?","1) Processus documenté de rapprochement avec la banque dépositaire/registres des rapprochements avec la banque dépositaire\n- Vérifier que ces rapprochements sont effectués quotidiennement, au minimum (hors week-ends).\n",null,"Requis Normal","Requis","FinOps",0,null,"1","1.1","1.1.1",null,"1.1.1.2",null,0,"1.1.1.2.3","¿La conciliación con el banco custodio se realiza por lo menos diariamente durante los días de semana?","1) Proceso documentado de conciliación con el banco custodio / Registros de conciliación del banco custodio\n- Verificar que la conciliación con el banco custodio se realiza, por lo menos, diariamente durante los días de semana.",null,"Obligatorio estándar","Obligatorio","FinOps",null,null,"1","1.1","1.1.1",null,"1.1.1.2",null,0,"1.1.1.2.3",null,null,null,"ReqS4","Req4","FinOps",null,null,null,null,null,null,null,"MERGE","1.2.2.2.2","1.2.2.2.1",null,null,{"$error":"#REF!"},{"$error":"#REF!"},"","",{"$error":"#REF!"},{"$error":"#REF!"},"","",2,"",{"$error":"#REF!"},"OriginalComplianceP1","OriginalComplianceP1","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,2,""]
[null,"1","1.1","1.1.1",0,"1.1.1.2",null,null,{"$f":"BC10","v":"1.1.1.2.4"},"1.1.1.2.4: Is the reconciliation process overseen by a reviewing function with separation of duty, to ensure reconciliation is accurately completed?\n",{"$f":"CHOOSE(LanguageNumber,BF10,BV10,CL10,DB10)","v":"1) Documented custodial bank reconciliation process / Custodial bank reconciliation records \n-  Check that custodial bank reconciliation is independently reviewed for accuracy and signed off by a separate team (i.e. segregation of duties).\n"},0,{"$f":"CHOOSE(LanguageNumber,BH10,BX10,CN10,DD10)","v":"Standard required"},{"$f":"CHOOSE(LanguageNumber,BI10,BY10,CO10,DE10)","v":"Required"},"FinOps",{"$f":"CHOOSE(LanguageNumber,BK10,CA10,CQ10,DG10)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1","1.1","1.1.1",null,"1.1.1.2",null,null,"1.1.1.2.4",{"$f":"DO10","v":"1.2.2.3.1"},"Is the reconciliation process overseen by a reviewing function with separation of duty, to ensure reconciliation is accurately completed?","1) Documented custodial bank reconciliation process / Custodial bank reconciliation records \n-  Check that custodial bank reconciliation is independently reviewed for accuracy and signed off by a separate team (i.e. segregation of duties).\n",null,"Standard required","Required","FinOps",null,null,"1","1.1","1.1.1",0,"1.1.1.2",null,0,{"$f":"BC10","v":"1.1.1.2.4"},"Le processus de rapprochement est-il supervisé par une fonction d'examen avec séparation des tâches, pour s'assurer que le rapprochement est effectué avec précision ?","1) Processus documenté de rapprochement avec la banque dépositaire /registres des rapprochements avec la banque dépositaire\n- Vérifier que le caractère approprié du processus de rapprochement avec la banque dépositaire est examiné et validé en toute indépendance par une équipe distincte (séparation des tâches).\n",null,"Requis Normal","Requis","FinOps","Au cours de leur réalisation, les transactions peuvent passer par différents stades, parfois désignés par les termes \"initiées\", \"autorisées\", \"en attente\" ou d'autres termes similaires. Les fonds correspondants peuvent être retenus ou non pendant ces stades de réalisation. En fin de processus, les fonds sont transférés entre les comptes concernés et la transaction est considérée conclue.\n\nDans le cadre du calcul des encours et du rapprochement des soldes avec la banque dépositaire ou les partenaires de l'écosystème financier, il est important que les parties se mettent d'accord sur la question de savoir si seules les transactions \"conclues\" doivent être comptabilisées, ou si les transactions \"initiées\" ou \"en attente\" doivent aussi être incluses.",null,"1","1.1","1.1.1",null,"1.1.1.2",null,0,{"$f":"BC10","v":"1.1.1.2.4"},"¿El proceso de conciliación es supervisado por un departamento de revisión, con separación de obligaciones, a fin de garantizar que la conciliación se realiza correctamente?","1) Proceso documentado de conciliación con el banco custodio / Registros de conciliación del banco custodio\n- Verificar si la conciliación con el banco custodio es revisada y aprobada por un equipo distinto (o sea, con segregación de funciones) de manera independiente para mayor precisión.",null,"Obligatorio estándar","Obligatorio","FinOps",null,null,"1","1.1","1.1.1",null,"1.1.1.2",null,0,{"$f":"BC10","v":"1.1.1.2.4"},null,null,null,"ReqS4","Req4","FinOps",null,null,null,null,null,null,null,null,"1.2.2.3.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP1","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"1","1.1","1.1.1",0,"1.1.1.2",null,0,"1.1.1.2.5","1.1.1.2.5: Does the custodial bank reconciliation process specify the start and end point of each reconciliation period, clearly defining which transactions should be included to reach the final settlement position?\n",0,0,"Recommended","Recommended","FinOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1","1.1","1.1.1",null,"1.1.1.2",null,null,"1.1.1.2.5","1.2.2.3.2","Does the custodial bank reconciliation process specify the start and end point of each reconciliation period, clearly defining which transactions should be included to reach the final settlement position?",null,null,"Recommended","Recommended","FinOps",null,null,"1","1.1","1.1.1",0,"1.1.1.2",null,0,"1.1.1.2.5","le processus de rapprochement avec la banque dépositaire définit-il clairement le point de départ et la fin de chaque période de rapprochement, ainsi que les transactions à prendre en compte pour déterminer la position finale de règlement?",null,null,"Recommandé","Recommandé","FinOps",0,null,"1","1.1","1.1.1",null,"1.1.1.2",null,0,"1.1.1.2.5","¿El proceso de conciliación con el banco custodio especifica claramente las fechas de comienzo y fin de cada período de conciliación y define explícitamente qué transacciones deben incluirse para obtener la posición de liquidación final?",null,null,"Recomendado","Recomendado","FinOps",null,null,"1","1.1","1.1.1",null,"1.1.1.2",null,0,"1.1.1.2.5",null,null,null,"Rec4","Rec4","FinOps",null,null,null,null,null,null,null,null,"1.2.2.3.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP1","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"1","1.1","1.1.2","1.1.2: Providers shall ensure that user funds are ring-fenced to prevent attachment from the creditors of the provider in the event of a provider’s insolvency.","1.1.2.1",{"$f":"AZ12&\": \"&CHOOSE(LanguageNumber,BA12,BR12,CH12,CX12)","v":"1.1.2.1: PROTECTION OF FUNDS AGAINST LOSS DUE TO INSOLVENCY OF MOBILE MONEY PROVIDER\nUser funds must be legally segregated from the mobile money provider's assets to ensure that these funds may not be claimed by creditors of the provider in the event of a provider's insolvency. \n\nIn most countries with a common-law legal tradition (see definition), some form of a “trust” can be set up to ensure that funds are protected from a provider’s creditors. Funds held by the trust may not be claimed by the provider's creditors or the trustee's creditors.\n\nIn countries with a civil-law legal tradition, an arrangement similar to a common-law trust (such as a fiduciary contract) may be available, although in some countries user funds are not guaranteed full protection from the creditors of the fiduciary in the event of the fiduciary's insolvency. This risk can be mitigated if the fiduciary ensures that contractual agreements with creditors acknowledge that these assets are ring-fenced and unavailable in the event of the fiduciary’s insolvency.\n"},"GSMA RMT (FIN-08)","1.1.2.1.1","1.1.2.1.1: Are user funds legally segregated - either through a trust or an arrangement that offers a similar level of protection - from the mobile money provider's assets (and the trustee's assets) to ensure that the funds may not be claimed by creditors in the event of the provider's or trustee's insolvency?\n","1) Documented custodial bank reconciliation process. \n- Check the operator has formally identified measures to ensure customer funds are protected in the event of the operator, of any other key party, becoming insolvent. \n- Check the identified measures have been implemented effectively. \n\nNote 1: measures could include trust account, agreement with the regulator, separated commercial and trust accounts, etc.\nNote 2: This can be marked as N/A if trust accounts are not legally recognised the country of operation.",0,"Urgent Required","Required","FinOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1","1.1","1.1.2","1.1.2: Providers shall ensure that user funds are ring-fenced to prevent attachment from the creditors of the provider in the event of a provider’s insolvency.","1.1.2.1","PROTECTION OF FUNDS AGAINST LOSS DUE TO INSOLVENCY OF MOBILE MONEY PROVIDER\nUser funds must be legally segregated from the mobile money provider's assets to ensure that these funds may not be claimed by creditors of the provider in the event of a provider's insolvency. \n\nIn most countries with a common-law legal tradition (see definition), some form of a “trust” can be set up to ensure that funds are protected from a provider’s creditors. Funds held by the trust may not be claimed by the provider's creditors or the trustee's creditors.\n\nIn countries with a civil-law legal tradition, an arrangement similar to a common-law trust (such as a fiduciary contract) may be available, although in some countries user funds are not guaranteed full protection from the creditors of the fiduciary in the event of the fiduciary's insolvency. This risk can be mitigated if the fiduciary ensures that contractual agreements with creditors acknowledge that these assets are ring-fenced and unavailable in the event of the fiduciary’s insolvency.\n","GSMA RMT (FIN-08)","1.1.2.1.1","1.1.2.1.1","Are user funds legally segregated - either through a trust or an arrangement that offers a similar level of protection - from the mobile money provider's assets (and the trustee's assets) to ensure that the funds may not be claimed by creditors in the event of the provider's or trustee's insolvency?","1) Documented custodial bank reconciliation process. \n- Check the operator has formally identified measures to ensure customer funds are protected in the event of the operator, of any other key party, becoming insolvent. \n- Check the identified measures have been implemented effectively. \n\nNote 1: measures could include trust account, agreement with the regulator, separated commercial and trust accounts, etc.\nNote 2: This can be marked as N/A if trust accounts are not legally recognised the country of operation.",null,"Urgent Required","Required","FinOps",null,null,"1","1.1","1.1.2","1.1.2: Les prestataires doivent régulièrement effectuer un rapprochement des transactions et régler leurs soldes auprès de leurs partenaires de l’écosystème  financier.","1.1.2.1","PROTECTION DES FONDS CONTRE LE RISQUE DE PERTE RÉSULTANT DE LA FAILLITE D'UN PRESTATAIRE DE SERVICE D'ARGENT MOBILE\nLes fonds des utilisateurs sont juridiquement séparés de l'actif du prestataire de service d'argent mobile pour s'assurer que ces fonds ne puissent pas être saisis par des créanciers du prestataire en cas de faillite de ce dernier. \n\nDans la plupart des pays de tradition juridique de common law (voir définition), une forme de \"fiducie\" peut être mise en place pour garantir que ces fonds soient protégés des créanciers du prestataire. Les fonds détenus par le fiduciaire ne peuvent pas être saisis par les créanciers du prestataire ou du fiduciaire. \n\nDans les pays de tradition juridique de droit civil, un accord similaire à une fiducie de common law (telle qu’un contrat fiduciaire) peut survenir, bien que certains pays ne garantissent pas la protection intégrale des créanciers de la fiducie en cas d’insolvabilité fiduciaire. Ce risque est réduit si la fiducie prévoit que les accords contractuels avec les créanciers reconnaissent que les actifs sont séparés et non accessibles en cas d’insolvabilité fiduciaire.\n","GSMA RMT (FIN-08)","1.1.2.1.1","Les fonds des utilisateurs sont-ils juridiquement séparés - par le biais d’une fiducie ou d’un arrangement offrant un niveau de protection similaire - de l’actif du prestataire de service d’argent mobile (et de ceux du fiduciaire) pour s’assurer que lesdits fonds ne pourront être saisis par les créanciers en cas de faillite du prestataire ou du fiduciaire ?\n","1) Processus documenté de rapprochement avec la banque dépositaire \n- Vérifier que l’opérateur a officiellement identifié les mesures qui permettront d’assurer la protection des fonds des clients en cas d’insolvabilité de l’opérateur ou de toute autre partie clé. \n- Vérifier que les mesures identifiées ont été correctement mises en œuvre. \n\nRemarque 1  : cela peut se faire par l’ouverture d’un compte fiduciaire, d’une entente avec les autorités de régulation, de comptes commerciaux et fiduciaires distincts, etc.\nRemarque 2 : indiquez la mention n/d si les comptes fiduciaires ne sont pas reconnus par le droit du pays dans lequel vous menez vos activités.",null,"Requis Prioritaire","Requis","FinOps","En règle générale, un pays relève de la tradition juridique de \"common law\" lorsque son système juridique (notamment en matière de droit commercial) est dérivé du droit anglo-américain, ou fortement inspiré par celui-ci. A l'opposé, un pays relève de la tradition juridique de \"droit civil\" lorsque son système juridique (notamment en matière de droit commercial) est dérivé du droit continental européen, ou fortement inspiré par celui-ci.\n",null,"1","1.1","1.1.2","1.1.2: El proveedor garantizará que los fondos de los usuarios están segregados a fin de protegerlos contra el embargo de acreedores del proveedor en caso de la insolvencia de este último.","1.1.2.1","PROTECCIÓN DE FONDOS CONTRA PÉRDIDA DEBIDA A INSOLVENCIA DEL PROVEEDOR DE DINERO MÓVIL\nLos fondos de usuarios deben estar legalmente segregados de los bienes del proveedor de dinero móvil \n\nEn la mayoría de los países que siguen la tradición del derecho anglosajón (common law, ver definición), se puede crear algún tipo de «fideicomiso» para garantizar la protección de los fondos contra los acreedores del proveedor. Los fondos de un fideicomiso no pueden ser exigidos por los acreedores del proveedor ni del fiduciario.\n\nEn aquellos países que siguen el derecho civil, puede existir una solución similar a la de fideicomiso del derecho anglosajón como, por ejemplo, un contrato fiduciario, aunque en algunos países no se podría garantizar la protección completa de los fondos del usuario contra los acreedores del fiduciario en caso de la insolvencia de este último. Los riesgos pueden mitigarse si el fiduciario garantiza que los acuerdos contractuales con sus acreedores reconocen que dichos bienes se encuentran segregados y no están disponible para su embargo en aso de insolvencia del fiduciario.","GSMA RMT (FIN-08)","1.1.2.1.1","¿Los fondos del usuario están segregados —ya sea en un fideicomiso o una solución que ofrece un nivel de protección similar— de los bienes del proveedor del dinero móvil (y de los bienes del fiduciario) a fin de garantizar que los fondos no podrán ser exigidos por acreedores en caso de insolvencia del proveedor o del fiduciario?","1) Proceso documentado de conciliación con el banco custodio \n- Verificar que el operador ha identificado formalmente las medidas para garantizar que los fondos del cliente están protegidos en caso de insolvencia del operador o de cualquier tercero pertinente. \n- Verificar que las medidas identificadas fueron implementadas de manera efectiva. \n\nNota 1: Las medidas podrían incluir cuenta fiduciaria, acuerdo con el regulador, cuentas fiduciarias comerciales y de fideicomiso separadas, etc.\nNota 2: Esto se puede marcar como N/A si las cuentas fiduciarias no están reconocidas legalmente en el país de operación.",null,"Obligatorio urgente","Obligatorio","FinOps",null,null,"1","1.1","1.1.2",null,"1.1.2.1",null,"GSMA RMT (FIN-08)","1.1.2.1.1",null,null,null,"ReqU4","Req4","FinOps",null,null,null,null,null,null,null,"MERGE","1.1.2.1.1","1.1.2.2.1",null,null,{"$error":"#REF!"},{"$error":"#REF!"},"","",{"$error":"#REF!"},{"$error":"#REF!"},"","",2,"",{"$error":"#REF!"},"OriginalComplianceP1","OriginalComplianceP1","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,2,""]
[null,"1","1.1","1.1.3","1.1.3: Providers shall take measures to mitigate the risk of loss of funds due to insolvency of the bank, bond issuer, or other entity in which funds are invested.","1.1.3.1",{"$f":"AZ13&\": \"&CHOOSE(LanguageNumber,BA13,BR13,CH13,CX13)","v":"1.1.3.1: PROTECTION OF FUNDS AGAINST LOSS DUE TO INSOLVENCY OF CUSTODIAL BANK\nA risk assessment must be carried on the custodial bank to determine the bank's solvency. A risk mitigation strategy should be actioned appropriately. Recommended mitigation options include:\n• Custodial bank's deposit insurance, if it enables pass-through protection of individual mobile money wallets (this is not always the case);\n• Private deposit Insurance by the mobile money provider;\n• Spread risk across multiple banks;\n• Select custodial bank with a high reputation / rating;\n• Guarantee from the custodial bank’s parent group;\n• Guarantee from mobile money provider’s parent group.\n"},0,"1.1.3.1.1","1.1.3.1.1: Has a risk assessment been carried on the custodial bank to determine the bank's solvency and a risk mitigation strategy actioned appropriately?\n","1) Documented custodial bank reconciliation process. \n- Check the operator has assessed the custodial bank to determine their solvency and their risk of insolvency.\n- Check the operator has identified and actioned an appropriate migitation stratagy for custodial bank insolvency risk (Note: refer to Practice for examples).",0,"Urgent Required","Required","FinOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1","1.1","1.1.3","1.1.3: Providers shall take measures to mitigate the risk of loss of funds due to insolvency of the bank, bond issuer, or other entity in which funds are invested.","1.1.3.1","PROTECTION OF FUNDS AGAINST LOSS DUE TO INSOLVENCY OF CUSTODIAL BANK\nA risk assessment must be carried on the custodial bank to determine the bank's solvency. A risk mitigation strategy should be actioned appropriately. Recommended mitigation options include:\n• Custodial bank's deposit insurance, if it enables pass-through protection of individual mobile money wallets (this is not always the case);\n• Private deposit Insurance by the mobile money provider;\n• Spread risk across multiple banks;\n• Select custodial bank with a high reputation / rating;\n• Guarantee from the custodial bank’s parent group;\n• Guarantee from mobile money provider’s parent group.\n",null,"1.1.3.1.1","1.1.3.1.1","Has a risk assessment been carried on the custodial bank to determine the bank's solvency and a risk mitigation strategy actioned appropriately?","1) Documented custodial bank reconciliation process. \n- Check the operator has assessed the custodial bank to determine their solvency and their risk of insolvency.\n- Check the operator has identified and actioned an appropriate migitation stratagy for custodial bank insolvency risk (Note: refer to Practice for examples).",null,"Urgent Required","Required","FinOps",null,null,"1","1.1","1.1.3","1.1.3: Les prestataires doivent veiller à ce que les fonds des utilisateurs soient isolés de tout autre actif afin d’empêcher leur saisie par les créanciers en cas d’insolvabilité du prestataire.","1.1.3.1","PROTECTION DES FONDS CONTRE LE RISQUE DE PERTE RÉSULTANT DE LA FAILLITE D'UNE BANQUE DÉPOSITAIRE OU D'UNE ENTITÉ SIMILAIRE\nUne évaluation des risques doit être réalisée afin de déterminer la solvabilité de la banque dépositaire. Une stratégie de réduction des risques appropriée doit être mise en œuvre. Parmi les options recommandées : \n• Assurance-dépôts de la banque dépositaire, si elle permet la protection des comptes d’argent mobile contre les passe-droits (ce n’est pas toujours le cas);\n• Police d’assurance-dépôts privée par le prestataire de services d’argent mobile;\n• Repartition des risques parmi plusieurs banques;\n• Choix d’une banque dépositaire bénéficiant d’une réputation / d’un classement solide;\n• Garantie de la société mère de la banque dépositaire;\n• Garantie de la société mère du prestataire de services d’argent mobile.\n ",0,"1.1.3.1.1","Une évaluation des risques a-t-elle été réalisée pour déterminer la solvabilité de la banque et mettre en œuvre une stratégie de réduction des risques appropriées ?","1) Processus documenté de rapprochement avec la banque dépositaire \n- Vérifier que l’opérateur a évalué la banque dépositaire afin de s’assurer de sa solvabilité et évaluer le risque d’insolvabilité de cette dernière.\n- Vérifier que l’opérateur a identifié et mis en œuvre une stratégie de réduction des risques appropriée en ce qui concerne le risque d’insolvabilité de la banque dépositaire (Remarque : se référer à la colonne \"Pratique\" pour les exemples).",null,"Requis Prioritaire","Requis","FinOps",null,null,"1","1.1","1.1.3","1.1.3: El proveedor tomará las medidas necesarias para mitigar el riesgo de pérdida de fondos debido a la insolvencia del banco, el emisor de bonos o de cualquier otra entidad en la cual se inviertan los fondos.","1.1.3.1","PROTECCIÓN DE FONDOS CONTRA PÉRDIDA POR INSOLVENCIA DEL BANCO CUSTODIO\nSe debe realizar una evaluación de riesgo sobre el banco custodio a fin de determinar su solvencia. Una estrategia de mitigación de riesgos debe implementarse de forma apropiada. Las recomendaciones para dicha mitigación incluyen:\n• Seguro de depósito del banco custodio, si permite la transferencia de la protección a la billetera de dinero móvil del individuo (no siempre es el caso)\n• Seguro privado de depósito del proveedor de dinero móvil,\n• Diversificación del riesgo en múltiples bancos\n• Selección de banco custodio con excelente reputación / calificación\n• Garantía de la casa matriz del banco custodio\n• Garantía del grupo la casa matriz del proveedor de dinero móvil+CH13",0,"1.1.3.1.1","¿Se realizó una evaluación de riesgos del banco custodio a fin de determinar su solvencia e implementar una estrategia de mitigación de riesgos de forma apropiada?","1) Proceso documentado de conciliación con el banco custodio \n- Verificar si el operador ha realizado la evaluación del banco custodio a fin de establecer su solvencia y los riesgos de insolvencia.\n- Verificar si el operador ha identificado y tomado las acciones para una estrategia de mitigación apropiada respecto del riesgo de insolvencia del banco custodio (Nota: ver Prácticas para ejemplos).",null,"Obligatorio urgente","Obligatorio","FinOps",null,null,"1","1.1","1.1.3",null,"1.1.3.1",null,0,"1.1.3.1.1",null,null,null,"ReqU4","Req4","FinOps",null,null,null,null,null,null,null,null,"1.1.3.1.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP1","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"1","1.1","1.1.3",0,"1.1.3.2",{"$f":"AZ14&\": \"&CHOOSE(LanguageNumber,BA14,BR14,CH14,CX14)","v":"1.1.3.2: MONITORING HEALTH OF CUSTODIAL BANK OR SIMILAR ENTITY\nMobile money providers should monitor the health of each bank, bond issuer, and/or other entity in which user funds are invested. This is particularly important in the absence of an effective public or private mechanism for insuring/guaranteeing user funds."},"GSMA RMT (FIN-02)","1.1.3.2.1","1.1.3.2.1: Has a process been established for regularly monitoring the health of each bank, bond issuer, and/or other entity in which user funds are invested?\n",0,0,"Recommended","Recommended","FinOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1","1.1","1.1.3",0,"1.1.3.2","MONITORING HEALTH OF CUSTODIAL BANK OR SIMILAR ENTITY\nMobile money providers should monitor the health of each bank, bond issuer, and/or other entity in which user funds are invested. This is particularly important in the absence of an effective public or private mechanism for insuring/guaranteeing user funds.","GSMA RMT (FIN-02)","1.1.3.2.1","1.1.3.2.1","Has a process been established for regularly monitoring the health of each bank, bond issuer, and/or other entity in which user funds are invested?",null,null,"Recommended","Recommended","FinOps",null,null,"1","1.1","1.1.3",null,"1.1.3.2","SURVEILLANCE DE LA SANTÉ FINANCIÈRE DES BANQUES DÉPOSITAIRES ET ENTITÉS ÉQUIVALENTES\nLes prestataires de services d'argent mobile devraient surveiller la santé financière de chaque banque, émetteur de titres et/ou autre entité auprès de laquelle des fonds des utilisateurs sont placés. Cette surveillance est particulièrement  importante lorsqu'il n'existe pas de mécanisme public ou privé efficace d'assurance/garantie des fonds des utilisateurs.  ","GSMA RMT (FIN-02)","1.1.3.2.1","existe-t-il un processus de surveillance régulière de la santé financière de chaque banque, émetteur de titre et/ou autre entité auprès de laquelle des fonds des utilisateurs sont placés ?",null,null,"Recommandé","Recommandé","FinOps",0,null,"1","1.1","1.1.3",null,"1.1.3.2","MONITOREO DE LA SALUD DEL BANCO CUSTODIO O ENTIDAD SIMILAR\nEl proveedor del dinero móvil debe monitorear la salud financiera de cada banco, emisor de bono y/o cualquier otra entidad en la cual haya invertido fondos. Esto es de especial importancia cuando no existe ningún mecanismo público o privado para asegurar/garantizar la protección de los fondos del usuario.","GSMA RMT (FIN-02)","1.1.3.2.1","¿Se estableció un proceso para monitorear periódicamente la salud financiera de cada banco, emisor de bonos y/o cualquier otra entidad en la que se hayan invertido fondos?",null,null,"Recomendado","Recomendado","FinOps",null,null,"1","1.1","1.1.3",null,"1.1.3.2",null,"GSMA RMT (FIN-02)","1.1.3.2.1",null,null,null,"Rec4","Rec4","FinOps",null,null,null,null,null,null,null,null,"1.1.3.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP1","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"1","1.1","1.1.3",0,"1.1.3.3",{"$f":"AZ15&\": \"&CHOOSE(LanguageNumber,BA15,BR15,CH15,CX15)","v":"1.1.3.3: DIVERSIFICATION OF FUNDS\nMobile money providers should consider diversification of funds among multiple banks (and/or other entities in which user funds are invested) to mitigate insolvency risk. At minimum, providers should begin diversification of funds once the value of user funds exceeds the value of the provider's net equity.\n\nIf an effective public or private mechanism for insuring user funds is in place, providers should still consider whether diversification of funds makes sense as a risk mitigation measure (e.g., to reduce risk of reliance on a single bank) or for commercial reasons (e.g., to facilitate cash-in and cash-out by financial ecosystem partners). \n"},"GSMA RMT (FIN-09)","1.1.3.3.1","1.1.3.3.1: If the value of user funds exceeds the value of the provider's net equity, has the provider diversified funds among multiple banks (and/or other entities in which user funds are invested)?\n",0,0,"Recommended","Recommended","FinOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1","1.1","1.1.3",null,"1.1.3.3","DIVERSIFICATION OF FUNDS\nMobile money providers should consider diversification of funds among multiple banks (and/or other entities in which user funds are invested) to mitigate insolvency risk. At minimum, providers should begin diversification of funds once the value of user funds exceeds the value of the provider's net equity.\n\nIf an effective public or private mechanism for insuring user funds is in place, providers should still consider whether diversification of funds makes sense as a risk mitigation measure (e.g., to reduce risk of reliance on a single bank) or for commercial reasons (e.g., to facilitate cash-in and cash-out by financial ecosystem partners). \n","GSMA RMT (FIN-09)","1.1.3.3.1","1.1.3.3.1","If the value of user funds exceeds the value of the provider's net equity, has the provider diversified funds among multiple banks (and/or other entities in which user funds are invested)?",null,null,"Recommended","Recommended","FinOps",null,null,"1","1.1","1.1.3",null,"1.1.3.3","DIVERSIFICATION DES FONDS\nLes prestataires de services d'argent mobile doivent prévoir de diversifier les fonds auprès de plusieurs établissement financiers (ou autres entités auprès desquelles les fonds sont placés) afin de réduire le risque de faillite. Ils devraient au minimum envisager de le faire lorsque le montant total des fonds des utilisateurs dépasse le montant de leurs capitaux propres.   \n\nS'il existe un mécanisme public ou privé efficace d'assurance des fonds des utilisateurs, les prestataires doivent malgré tout s'interroger sur l'intérêt d'une diversification des fonds à titre de mesure de prévention (pour réduire le risque de dépendance à l'égard d'une seule banque) ou pour des raisons commerciales (pour faciliter par exemple les opérations de dépôt ou retrait d'espèces par des partenaires de leur écosystème financier). \n","GSMA RMT (FIN-09)","1.1.3.3.1","si le montant des fonds des utilisateurs dépasse le montant des capitaux propres du prestataire, celui-ci a-t-il diversifié le placement de ces fonds auprès de plusieurs établissement financiers (ou autres entités auprès desquelles les fonds sont placés) ?",null,null,"Recommandé","Recommandé","FinOps",0,null,"1","1.1","1.1.3",null,"1.1.3.3","DIVERSIFICACIÓN DE FONDOS\nEl proveedor del dinero móvil debe considerar la diversificación de fondos en múltiples bancos (y/u otras entidades en las que se hayan invertido los fondos del usuario) a fin de mitigar los riesgos de insolvencia. A más tardar, una vez que el valor de los fondos de los usuarios excedan el valor del patrimonio neto del proveedor, el proveedor debe comenzar a diversificar los fondos.\n\nSi existe un mecanismo público o privado eficaz para asegurar los fondos de los usuarios, el proveedor debe considerar si la diversificación de fondos tiene sentido como medida de mitigación de riesgos, es decir, para reducir el riesgo de dependencia de un solo banco, o por razones comerciales, es decir, para facilitar el depósito y retiro de dinero por parte de socios del ecosistema financiero.","GSMA RMT (FIN-09)","1.1.3.3.1","Si el valor de los fondos de los usuarios excede el valor del patrimonio neto del proveedor, el proveedor ha diversificado los fondos en múltiples bancos (y/u otras entidades en las que se hayan invertido los fondos del usuario)?",null,null,"Recomendado","Recomendado","FinOps",null,null,"1","1.1","1.1.3",null,"1.1.3.3",null,"GSMA RMT (FIN-09)","1.1.3.3.1",null,null,null,"Rec4","Rec4","FinOps",null,null,null,null,null,null,null,null,"1.1.3.3.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP1","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"1",0,0,{"$f":"UPPER(CONCATENATE(Introduction!C6,\": \",Introduction!D6))","v":"1.2: PROTECTION AGAINST SETTLEMENT RISK"},null,null,0,0,{"$f":"CHOOSE(LanguageNumber,BE16,BU16,CK16,DA16)","v":"Providers shall take measures to ensure that funds are not at risk due to the process of settlement with banks and other financial partners"},null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,BK16,CA16,CQ16,DG16)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1",null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$6,\": \",Introduction!$L$6))","v":"1.2: PROTECTION AGAINST SETTLEMENT RISK"},null,null,null,null,0,{"$f":"Introduction!M6","v":"Providers shall take measures to ensure that funds are not at risk due to the process of settlement with banks and other financial partners"},null,null,null,null,0,null,null,"1",0,0,{"$f":"UPPER(CONCATENATE(Introduction!$P$6,\": \",Introduction!$Q$6))","v":"1.2: PROTECTION CONTRE LE RISQUE DE RÈGLEMENT"},null,null,0,null,{"$f":"Introduction!$R$6","v":"Les prestataires doivent prendre des mesures pour s'assurer que les fonds ne soient pas à risque dans le cadre du processus de règlement avec des banques ou d'autres partenaires financiers.  "},null,null,null,null,0,null,null,"1",0,0,{"$f":"UPPER(CONCATENATE(Introduction!$U$6,\": \",Introduction!$V$6))","v":"1.2: PROTECCIÓN CONTRA RIESGO DE LIQUIDACIÓN"},null,null,0,0,{"$f":"Introduction!W6","v":"El proveedor tomará las medidas necesarias para garantizar  la protección de los fondos respecto de procesos de liquidación de un banco u otro socio financiero"},null,null,null,null,0,null,null,"1",0,0,null,0,null,0,0,null,null,null,null,null,0]
[null,"1","1.2","1.2.1",{"$f":"CHOOSE(LanguageNumber,AY17,BP17,CF17,CV17)","v":"1.2.1: Where feasible, providers shall only authorize customer transactions in which the debiting and crediting of mobile money accounts is processed in real time."},"1.2.1.1",{"$f":"AZ17&\": \"&CHOOSE(LanguageNumber,BA17,BR17,CH17,CX17)","v":"1.2.1.1: REAL-TIME TRANSACTION PROCESSING\nWhenever possible, all transactions must be completed in real time. The debit party's account should be debited at the same time as the credit party's account is credited.\n\n"},{"$f":"BB17","v":0},"1.2.1.1.1",{"$f":"BC17&\": \"&CHOOSE(LanguageNumber,BE17,BU17,CK17,DA17)&CarriageReturn","v":"1.2.1.1.1: Are all transactions completed in real time (the debit party's account is debited at the same time as the credit party's account is credited), barring documented exceptions (i.e. multi-stage transactions - see 1.2.1.2)?\n"},{"$f":"CHOOSE(LanguageNumber,BF17,BV17,CL17,DB17)","v":"1) Mobile Money system functional specification \n- Check that all transactions are processed in real time (debits and credits happen on the mobile money platform at the same time)  barring documented exceptions (i.e. multi-stage transactions noted in 1.2.1.2)"},0,{"$f":"CHOOSE(LanguageNumber,BH17,BX17,CN17,DD17)","v":"Standard Required"},{"$f":"CHOOSE(LanguageNumber,BI17,BY17,CO17,DE17)","v":"Required"},"TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1","1.2","1.2.1","1.2.1: Where feasible, providers shall only authorize customer transactions in which the debiting and crediting of mobile money accounts is processed in real time.","1.2.1.1","REAL-TIME TRANSACTION PROCESSING\nWhenever possible, all transactions must be completed in real time. The debit party's account should be debited at the same time as the credit party's account is credited.\n\n",null,"1.2.1.1.1","1.2.1.1.1","Are all transactions completed in real time (the debit party's account is debited at the same time as the credit party's account is credited), barring documented exceptions (i.e. multi-stage transactions - see 1.2.1.2)?","1) Mobile Money system functional specification \n- Check that all transactions are processed in real time (debits and credits happen on the mobile money platform at the same time)  barring documented exceptions (i.e. multi-stage transactions noted in 1.2.1.2)",null,"Standard Required","Required","TechOps",null,null,"1","1.2","1.2.1","1.2.1: Dans la mesure du possible, les prestataires n’autorisent que les opérations de client pour lesquelles le débit et le crédit des comptes d’argent mobile s’effectuent en temps réel.\n","1.2.1.1","TRAITEMENT EN TEMPS RÉEL DES TRANSACTIONS\nDans la mesure du possible, les transactions doivent toutes être traitées en temps réel. Le compte du bénéficiaire d'un virement doit être crédité en même temps que le compte de l'émetteur est débité.",0,"1.2.1.1.1","Toutes les transactions sont-elles réalisées en temps réel (le compte du bénéficiaire d'un virement est crédité en même temps que le compte de l'émetteur est débité) en dehors des exceptions répertoriées (par ex. transactions en plusieurs étapes - voir 12.12) ?","1) Spécification fonctionnelle du système d’argent mobile \n- Vérifier que les transactions sont toutes traitées en temps réel (les fonds sont débités et crédités sur la plateforme d’argent mobile en même temps) en dehors des exceptions répertoriées (par ex. les transactions en plusieurs étapes indiquées au 12.12)\n",null,{"$f":"VLOOKUP($BH17,CategoryTranslationTable,2,FALSE)","v":"Requis Normal"},{"$f":"VLOOKUP($BI17,CategoryTranslationTable,2,FALSE)","v":"Requis"},"TechOps",0,null,"1","1.2","1.2.1","1.2.1: Cuando sea posible, el proveedor solo autorizará las transacciones del cliente en las cuales el débito y crédito de las cuentas del dinero móvil sea procesado en tiempo real.","1.2.1.1","PROCESAMIENTO DE TRANSACCIONES EN TIEMPO REAL\nSiempre que sea posible, todas las transacciones deben realizarse en tiempo real. Se deberá realizar el débito de la cuenta de la parte debitada al mismo tiempo en que la cuenta del beneficiario recibe el crédito.",0,"1.2.1.1.1","¿Todas las transacciones se realizan en tiempo real (el débito a la cuenta se realiza al mismo tiempo en que la cuenta del beneficiario es acreditada), sin perjuicio de las excepciones documentadas (por ej., transacciones de múltiples pasos - consultar 1.2.1.2)?","1) Especificación funcional del sistema del dinero móvil \n- Verificar si todas las transacciones son procesadas en tiempo real (los débitos y los créditos se realizan al mismo tiempo en la plataforma del dinero móvil), sin perjuicio de las excepciones documentadas (por ej., las transacciones de múltiples pasos indicadas en 1.2.1.2).",null,{"$f":"VLOOKUP($BH17,CategoryTranslationTable,3,FALSE)","v":"Obligatorio estándar"},{"$f":"VLOOKUP($BI17,CategoryTranslationTable,3,FALSE)","v":"Obligatorio"},"TechOps",null,null,"1","1.2","1.2.1",null,"1.2.1.1",null,0,"1.2.1.1.1",null,null,null,{"$f":"VLOOKUP($BH17,CategoryTranslationTable,4,FALSE)","v":"ReqS4"},{"$f":"VLOOKUP($BI17,CategoryTranslationTable,4,FALSE)","v":"Req4"},"TechOps",null,null,null,null,null,null,null,null,"1.2.1.1.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP1","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"1","1.2","1.2.1",0,"1.2.1.2",{"$f":"AZ18&\": \"&CHOOSE(LanguageNumber,BA18,BR18,CH18,CX18)","v":"1.2.1.2: FUNDS RESERVATION FOR MULTI-STAGE TRANSACTIONS\nSome transactions cannot be completed in real time, and require a confirmation step to be completed. Examples of multi-stage transactions include:\n   - transfer to an account of a financial partner, which requires time to confirm the transaction completion;\n   - P2P transfer to unregistered user (funds reserved until voucher is used)\n   - bill payment requiring biller's authorisation before completion;\n   - international money transfer requiring confirmation from the receiver's bank/hub, or requiring the recipient to provide additional KYC information. \n\nFunds should be debited or reserved from the sending party's account as soon as the transaction has been authorised by the mobile money sender. The funds will then be available for completing the transaction when it is confirmed (or released if the transaction is cancelled).\n\nThis is to mitigate the risk that the sender removes their funds before the transaction is completed, leading to a negative balance.\n"},0,"1.2.1.2.1","1.2.1.2.1: For multi-stage transactions (requiring 3rd party action before completion), are funds debited or reserved from the sending party's account as soon as the transaction has been authorised by the mobile money sender?\n","1) Mobile Money system functional specification or practical demonstration\n- Check transaction processing model for each multi-stage transaction type, including reversals and failure cases. Check that funds are debited or reserved as soon as each transaction is authorised by the sender. \nConsider the following examples:\n   - transfer to an account of a financial partner, which requires time to confirm the transaction completion;\n   - P2P transfer to unregistered user (funds reserved until voucher is used)\n   - bill payment requiring biller's authorisation before completion;\n   - international money transfer requiring confirmation from the receiver's bank/hub, or requiring the recipient to provide additional KYC information. \n",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1","1.2","1.2.1",null,"1.2.1.2","FUNDS RESERVATION FOR MULTI-STAGE TRANSACTIONS\nSome transactions cannot be completed in real time, and require a confirmation step to be completed. Examples of multi-stage transactions include:\n   - transfer to an account of a financial partner, which requires time to confirm the transaction completion;\n   - P2P transfer to unregistered user (funds reserved until voucher is used)\n   - bill payment requiring biller's authorisation before completion;\n   - international money transfer requiring confirmation from the receiver's bank/hub, or requiring the recipient to provide additional KYC information. \n\nFunds should be debited or reserved from the sending party's account as soon as the transaction has been authorised by the mobile money sender. The funds will then be available for completing the transaction when it is confirmed (or released if the transaction is cancelled).\n\nThis is to mitigate the risk that the sender removes their funds before the transaction is completed, leading to a negative balance.\n",null,"1.2.1.2.1","1.2.1.2.1","For multi-stage transactions (requiring 3rd party action before completion), are funds debited or reserved from the sending party's account as soon as the transaction has been authorised by the mobile money sender?","1) Mobile Money system functional specification or practical demonstration\n- Check transaction processing model for each multi-stage transaction type, including reversals and failure cases. Check that funds are debited or reserved as soon as each transaction is authorised by the sender. \nConsider the following examples:\n   - transfer to an account of a financial partner, which requires time to confirm the transaction completion;\n   - P2P transfer to unregistered user (funds reserved until voucher is used)\n   - bill payment requiring biller's authorisation before completion;\n   - international money transfer requiring confirmation from the receiver's bank/hub, or requiring the recipient to provide additional KYC information. \n",null,"Urgent Required","Required","TechOps",null,null,"1","1.2","1.2.1",0,"1.2.1.2","RETENUE DES FONDS POUR TRANSACTIONS EN PLUSIEURS ÉTAPES\nCertaines transactions ne peuvent pas être traitées en temps réel : leur traitement nécessite une confirmation. Les transactions en plusieurs étapes incluent par exemple :\n   -les transferts vers le compte d'un partenaire financier, pour lesquels la confirmation du traitement de la transaction prend un certain temps ;\n   -les transferts entre deux individus vers un utilisateur non enregistré (fonds réservés jusqu'à ce que le code à usage temporaire ait été utilisé) ;\n   -le paiement de factures nécessitant l'autorisation de l'entité émettrice de la facture avant son traitement  ;\n   -les transferts d’argent internationaux nécessitant la confirmation de la banque/l'entité centrale du bénéficiaire ou la transmission de renseignements d'identité supplémentaires par le destinataire.\nTous ces types de transactions doivent être définis, de même que les risques et leurs réductions.\n\nLes fonds en provenance du compte de l'émetteur doivent être débités ou réservés dès que la transaction a été autorisée par l’émetteur d’argent mobile. Les fonds sont ainsi disponibles au moment du traitement de la transaction une fois cette dernière confirmée (ou pourront être débloqués sur le compte de l'émetteur si la transaction est annulée).\n\nCe dispositif vise à empêcher l'émetteur de retirer les fonds de son compte avant le traitement de la transaction afin d'éviter que le compte soit débiteur.",0,"1.2.1.2.1","En ce qui concerne les transactions en plusieurs étapes (nécessitant l'intervention d'un tiers avant leur réalisation) ), les fonds en provenance de l'émetteur sont-ils débités ou réservés dès que la transaction a été autorisée par l'émetteur d'argent mobile ?","1) Spécification fonctionnelle du système d’argent mobile ou démonstration pratique\n- Vérifier le modèle de traitement de transaction pour chaque type de transaction en plusieurs étapes, y compris les transactions annulées ou avortées. Vérifier que les fonds sont débités ou réservés dès que la transaction a été autorisée par l’émetteur.\nExemples à prendre en compte :\n- transfert vers le compte d'un partenaire financier, pour lequel la confirmation du traitement de la transaction prend un certain temps ;\n- transfert entre deux individus vers un utilisateur non enregistré (fonds réservés jusqu'à ce que le code à usage temporaire ait été utilisé)\n- paiement d'une facture nécessitant l'autorisation de l'entité émettrice de la facture avant son traitement ;\n-transfert d'argent à l'international nécessitant la confirmation de la banque/l'entité centrale du bénéficiaire ou la transmission de renseignements d'identité supplémentaires par le destinataire ",null,"Requis Prioritaire","Requis","TechOps",0,null,"1","1.2","1.2.1",null,"1.2.1.2","RESERVA DE FONDOS PARA TRANSACCIONES DE MÚLTIPLES PASOS\nAlgunas transacciones no se pueden realizar en tiempo real y se requiere un paso de confirmación para completarlas. Los ejemplos de transacciones en múltiples pasos incluyen:\n   - transferencia a una cuenta de un socio financiero, que requiere tiempo para confirmar que la transacción se completó;\n   - transferencia P2P a un usuario no registrado (los fondos se reservan hasta que se utiliza el voucher)\n   - pago de facturas que requiere la autorización del emisor de la factura antes de completarlo;\n   - transferencia de dinero internacional que requiere confirmación del banco/hub del destinatario o que requiere que el destinatario suministre información adicional de CSC.    \n\nRESERVA DE FONDOS\nLos fondos deben debitarse de la cuenta del remitente, o reservarse en la misma, al momento en que dicho remitente del dinero móvil autoriza la transacción. Los fondos estarán disponibles para completar la transacción una vez confirmada (o liberada, si la transacción se cancela).\n\nEsto se realiza para mitigar el riesgo de que el remitente elimine los fondos antes completar la transacción, lo que redundaría en un saldo negativo. ",0,"1.2.1.2.1","Para transacciones de múltiples pasos (que requieren la acción de terceros antes de completarlas), ¿los fondos son debitados de la cuenta del remitente, o reservados en la misma, al momento en que dicho remitente del dinero móvil autoriza la transacción?","1) De mostración práctica de la especificación funcional del sistema del dinero móvil \n- Verificar el modelo de procesamiento de transacciones para cada tipo de transacción de múltiples pasos, incluyendo casos de reversiones o fallas.  Verificar si los fondos han sido debitados o reservados al momento en que el remitente autoriza la transacción. \nConsiderar los siguientes ejemplos:\n   - transferencia a la cuenta de un socio financiero, que requiere tiempo para confirmar que la transacción se completó;\n   - transferencia P2P a un usuario no registrado (los fondos se reservan hasta que se utiliza el voucher)\n   -  pago de facturas que requiere la autorización del emisor de la factura antes de completarlo;\n   -  transferencia de dinero internacional que requiere confirmación del banco/hub del destinatario o que requiere que el destinatario suministre información adicional de CSC. \n",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"1","1.2","1.2.1",null,"1.2.1.2",null,0,"1.2.1.2.1",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"1.2.1.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP1","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"1","1.2","1.2.1",0,"1.2.1.3",{"$f":"AZ19&\": \"&CHOOSE(LanguageNumber,BA19,BR19,CH19,CX19)","v":"1.2.1.3: SUSPENDED AND FAILED TRANSACTIONS\nThe system should automatically detect suspended transactions and alert staff to take appropriate action promptly (see definition).\n\nWhen transactions fail, the funds should be returned to the originator immediately, who should be notified promptly.\n"},"GSMA RMT (FIN-12)","1.2.1.3.1","1.2.1.3.1: Does the system automatically detect suspended transactions and alert staff to take appropriate action promptly (see definition)?\n",0,0,"Recommended","Recommended","FinOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1","1.2","1.2.1",null,"1.2.1.3","SUSPENDED AND FAILED TRANSACTIONS\nThe system should automatically detect suspended transactions and alert staff to take appropriate action promptly (see definition).\n\nWhen transactions fail, the funds should be returned to the originator immediately, who should be notified promptly.\n","GSMA RMT (FIN-12)","1.2.1.3.1","1.2.1.3.1","Does the system automatically detect suspended transactions and alert staff to take appropriate action promptly (see definition)?",null,null,"Recommended","Recommended","FinOps",null,null,"1","1.2","1.2.1",0,"1.2.1.3","TRANSACTIONS SUSPENDUES OU AVORTÉES\nLe système doit détecter de façon automatique les transactions suspendues et alerter le personnel du prestataire pour action dans les meilleurs délais (voir définition).\n\nEn cas d'échec d'une transaction, les fonds doivent être retournés immédiatement à l'émetteur, qui doit en être avisé rapidement.","GSMA RMT (FIN-12)","1.2.1.3.1","le système détecte-t-il de façon automatique les transactions suspendues et alerte-t-il le personnel pour action dans les meilleurs délais (cf. définition) ?",null,null,"Recommandé","Recommandé","FinOps","Une transaction suspendue est une transaction conservée dans un état inachevé avec retenue des fonds correspondants dans l'attente de recherches par le prestataire. Cela est couramment utilisé pour les transactions contestées, les annulations d'opération et à la suite de problèmes techniques lorsque le statut de la transaction n'est pas connu.",null,"1","1.2","1.2.1",null,"1.2.1.3","TRANSACCIONES SUSPENDIDAS Y FALLIDAS\nEl sistema debe detectar las transacciones suspendidas automáticamente y alertar al personal para que tome las acciones necesarias inmediatamente (ver definición).\n\nCuando una transacción falla, los fondos deben ser devueltos inmediatamente al emisor, quien debe ser notificado sin demora.","GSMA RMT (FIN-12)","1.2.1.3.1","¿El sistema detecta las transacciones suspendidas automáticamente y alerta al personal para que tome las acciones necesarias inmediatamente (ver definición)?",null,null,"Recomendado","Recomendado","FinOps",null,null,"1","1.2","1.2.1",null,"1.2.1.3",null,"GSMA RMT (FIN-12)","1.2.1.3.1",null,null,null,"Rec4","Rec4","FinOps",null,null,null,null,null,null,null,null,"1.2.1.3.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP1","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"1","1.2","1.2.1",0,"1.2.1.3",null,0,"1.2.1.3.2","1.2.1.3.2: When transactions fail, are funds returned to the originator immediately, with a prompt notification?\n",0,0,"Recommended","Recommended","FinOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1","1.2","1.2.1",null,"1.2.1.3",null,null,"1.2.1.3.2","1.2.1.4.1","When transactions fail, are funds returned to the originator immediately, with a prompt notification?",null,null,"Recommended","Recommended","FinOps",null,null,"1","1.2","1.2.1",0,"1.2.1.3",null,0,"1.2.1.3.2","en cas d'échec d'une transaction, les fonds sont-ils retournés immédiatement à l'émetteur, et celui-ci en est-il avisé rapidement ?",null,null,"Recommandé","Recommandé","FinOps",0,null,"1","1.2","1.2.1",null,"1.2.1.3",null,0,"1.2.1.3.2","Cuando una transacción falla, ¿los fondos son devueltos al emisor en forma inmediata y se lo notifica sin demora?",null,null,"Recomendado","Recomendado","FinOps",null,null,"1","1.2","1.2.1",null,"1.2.1.3",null,0,"1.2.1.3.2",null,null,null,"Rec4","Rec4","FinOps",null,null,null,null,null,null,null,null,"1.2.1.4.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP1","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"1","1.2","1.2.2","1.2.2: Providers shall regularly reconcile transactions and settle balances with financial ecosystem partners.","1.2.2.1",{"$f":"AZ21&\": \"&CHOOSE(LanguageNumber,BA21,BR21,CH21,CX21)","v":"1.2.2.1: RECONCILIATION WITH FINANCIAL ECOSYSTEM PARTNERS\nA process should be defined for reconciling transactions with each financial ecosystem partner. Reconciliation is used to agree the transactions that have been exchanged with each financial partner, ensuring that both party's records are in agreement. The process should indicate how the net financial position is established for settling the balance.\n\nThe process should define:\n  - the data exchange mechanism (see below);\n  - the steps that should be taken by each party;\n  - the frequency of reconciliation determined by a risk assessment for each financial partner (e.g. daily);\n  - actions to be taken in case of discrepancy in reconciliation.\n\nData exchange: information on completed, pending, failed and suspended transactions should be included in the data exchanged. This is important for resolving the scenario where a transaction succeeds in one party's system but has not completed in the other party's system, leading to reconciliation discrepancy. \n\nSome financial ecosystem partners simply operate a prefunded e-money account (many ATM providers follow this model) and reconciliation is the responsibility of the partner. In this case, there must be a documented process for the financial ecosystem partner to dispute the transaction records.\n\n\n"},{"$f":"BB21","v":"GSMA RMT (FIN-13)\nISO 27002:2013 Sec. 12.1"},{"$f":"BC21","v":"1.2.2.1.1"},"1.2.2.1.1: Has a process been documented for reconciliation of the net financial position with each applicable financial ecosystem partner?\n[Exclude financial ecosystem partners where the partner simply operates a prefunded e-monay account - see 1.2.2.1.2]\n","1) Reconciliation and Settlement process or policy for financial partners\nCheck that the process specifies for each applicable financial partner (e.g. bank, IMT provider, interoperability MM provider):\n     a) the steps that should be taken by each party to establish the net financial position for settling the balance;\n     b) actions to be taken in case of discrepancy in reconciliation;\n     c) the frequency of reconciliation.\n",0,"Urgent Required","Required","FinOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1","1.2","1.2.2","1.2.2: Providers shall regularly reconcile transactions and settle balances with financial ecosystem partners.","1.2.2.1","RECONCILIATION WITH FINANCIAL ECOSYSTEM PARTNERS\nA process should be defined for reconciling transactions with each financial ecosystem partner. Reconciliation is used to agree the transactions that have been exchanged with each financial partner, ensuring that both party's records are in agreement. The process should indicate how the net financial position is established for settling the balance.\n\nThe process should define:\n  - the data exchange mechanism (see below);\n  - the steps that should be taken by each party;\n  - the frequency of reconciliation determined by a risk assessment for each financial partner (e.g. daily);\n  - actions to be taken in case of discrepancy in reconciliation.\n\nData exchange: information on completed, pending, failed and suspended transactions should be included in the data exchanged. This is important for resolving the scenario where a transaction succeeds in one party's system but has not completed in the other party's system, leading to reconciliation discrepancy. \n\nSome financial ecosystem partners simply operate a prefunded e-money account (many ATM providers follow this model) and reconciliation is the responsibility of the partner. In this case, there must be a documented process for the financial ecosystem partner to dispute the transaction records.\n\n\n","GSMA RMT (FIN-13)\nISO 27002:2013 Sec. 12.1","1.2.2.1.1",{"$f":"DO21","v":"1.2.2.1.1"},"Has a process been documented for reconciliation of the net financial position with each applicable financial ecosystem partner?\n[Exclude financial ecosystem partners where the partner simply operates a prefunded e-monay account - see 1.2.2.1.2]","1) Reconciliation and Settlement process or policy for financial partners\nCheck that the process specifies for each applicable financial partner (e.g. bank, IMT provider, interoperability MM provider):\n     a) the steps that should be taken by each party to establish the net financial position for settling the balance;\n     b) actions to be taken in case of discrepancy in reconciliation;\n     c) the frequency of reconciliation.\n",null,"Urgent Required","Required","FinOps",null,null,"1","1.2","1.2.2","1.2.2: Les prestataires doivent régulièrement rapprocher les transactions et définir des équilibres avec les partenaires de l'écosystème financier","1.2.2.1","RAPPROCHEMENT AVEC LES PARTENAIRES DE L’ÉCOSYSTÈME FINANCIER\nUn processus doit être défini pour le rapprochement des transactions avec chaque partenaire de l’écosystème financier. Le rapprochement est utilisé pour valider les transactions échangées avec chaque partenaire de l’écosystème financier afin de s’assurer que les registres de chaque partie correspondent. Le processus doit indiquer la manière dont la position financière nette est définie pour le règlement des soldes .\n\nLe processus doit définir :\n - le mécanisme d'échange de données (voir ci-dessous)\n - les étapes devant être suivies par chaque partie ;\n - la fréquence de rapprochement, déterminée par une évaluation de risque réalisée pour chaque partenaire de l'écosystème financier (par ex : quotidiennement)  ;\n - les mesures devant être prises en cas de différence observée suite au rapprochement.\n\nÉchange de données : les informations relatives aux transactions traitées, en cours, avortées ou suspendues doivent être incluses dans les données échangées. Cette initiative est essentielle pour résoudre les cas dans lesquels une transaction est considérée comme conclue sur le système de l’une des parties mais n’a pas encore été conclue sur le système de l’autre partie, générant ainsi une différence de rapprochement.\n\nCertains partenaires de l'écosystème financier gèrent uniquement des comptes d'argent mobile préfinancés (de nombreux prestataires de GAB appliquent ce modèle). Dans ces cas-là, le rapprochement incombe au partenaire. Un processus documenté définissant la manière dont les partenaires de l'écosystème financier peuvent contester les informations issues du registre des transactions doit alors être mis en oeuvre.\n","GSMA RMT (FIN-13)\nISO 27002:2013 Sec. 12.1","1.2.2.1.1","un processus de rapprochement de la position financière nette avec chaque partenaire de l'écosystème financier a-t-il été documenté ? \n[Exclut les partenaires de l'écosystème financier gérant uniquement un compte d'argent mobile préfinancé  - voir 12.2.12]","1) Processus ou politique de rapprochement et de règlement pour les partenaires de l’écosystème financier\nVérifier que le processus définit pour chaque partenaire de l’écosystème financier (par ex. la banque, le prestataire de services de transfert d'argent à l'international, d'interopérabilité ou d'argent mobile)\na) les étapes devant être suivies par chaque partie dans le but d’établir la position financière nette pour le règlement des soldes ;\nb) les mesures devant être prises en cas de différence observée suite au rapprochement ;\nc) la fréquence de rapprochement.\n",null,"Requis Prioritaire","Requis","FinOps","1) Le rapprochement est le processus de vérification de la concordance de deux registres différents (généralement des registres d'opérations et de soldes). Le rapprochement permet notamment de vérifier que l'encours d'argent électronique dans le système correspond aux sommes conservées sur le(s) compte(s) de cantonnement. Il sert également à convenir des fonds échangés entre les partenaires de l'écosystème financier. Ce rapprochement est effectué périodiquement (par ex. quotidiennement), et son point de départ et de fin doit être convenu entre les parties, ainsi que les transactions devant être incluses (généralement, uniquement les transactions réalisées, et non les transactions initiées).  \n\n2) Dans le cadre du Code de conduite, les « partenaires de l’écosystème  financier » désignent les entités connectées au service d’argent mobile dans le but de fournir un service  financier. Cela comprend par exemple, sans s’y limiter, les banques (banques dépositaires et autres établissements  financiers détenteurs de comptes), les entités émettant ou recevant des paiements groupés, les agrégateurs, les commerçants utilisant des terminaux de point de vente, les prestataires de GAB et autres prestataires de services de paiement (nationaux ou internationaux). Ces entités sont généralement connectées au service d’argent mobile par le biais d’interfaces de programmation d’application (API).",null,"1","1.2","1.2.2","1.2.2: El proveedor conciliará las transacciones y liquidará los saldos con sus socios del ecosistema financiero.","1.2.2.1","CONCILIACIÓN CON SOCIOS DEL ECOSISTEMA FINANCIERO\nSe debe establecer un proceso para la conciliación de transacciones con cada socio del ecosistema financiera. La conciliación es el mecanismo por el cual las partes se ponen de acuerdo sobre las transacciones intercambiadas con cada socio financiero, garantizando que los registros de ambas partes son congruentes. El proceso debe indicar cómo se establece el estado financiero neto para la liquidación de los saldos.\n\nEl proceso debe definir los siguientes aspectos:\n  - el mecanismo de intercambio de datos (ver debajo)\n  - los pasos que cada parte debe seguir;\n  - la frecuencia de la conciliación determinada por la evaluación de los riesgos de cada socio financiero (por ej., diaria);\n  - las acciones que deben tomarse en caso de discrepancia en     la conciliación.\n\nIntercambio de datos: La información sobre transacciones completadas, pendientes, fallidas o suspendidas debe ser incluida en los datos intercambiados. Esto es importante para la resolución de situaciones en las que una transacción se realiza con éxito en el sistema de una de las partes, pero no se completó en el sistema de la otra parte, lo que conlleva una discrepancia en la conciliación.\n\nAlgunos socios del ecosistema financiero simplemente operan una cuenta de dinero electrónico pre-financiada (muchos proveedores de cajeros automáticos siguen este modelo) y la conciliación es responsabilidad del socio. En este caso, debe existir un proceso documentado para que el socio del ecosistema financiero cuestione los registros de transacciones.","GSMA RMT (FIN-13)\nISO 27002:2013 Sec. 12.1","1.2.2.1.1","¿Se ha documentado el proceso de conciliación del estado financiero neto con cada socio del ecosistema financiero correspondiente?  \n[Excluir socios del ecosistema financiero cuando el socio simplemente opera una cuenta de dinero electrónico pre-financiada - consultar 1.2.2.1.2]","1) Proceso o política de conciliación y liquidación con socios financieros\nVerificar que el proceso especifique lo siguiente para cada socio financiero correspondiente (por ej., banco, proveedor de IMT, proveedor de dinero móvil de interoperabilidad):\n     a) los pasos que cada una de las partes debe tomar a fin de establecer su estado financiero neto para fines de liquidación de saldos;\n     b) las acciones que deben tomarse en caso de discrepancias en la conciliación; \n     c) la frecuencia de la conciliación.\n",null,"Obligatorio urgente","Obligatorio","FinOps",null,null,"1","1.2","1.2.2",null,"1.2.2.1",null,"GSMA RMT (FIN-13)\nISO 27002:2013 Sec. 12.1","1.2.2.1.1",null,null,null,"ReqU4","Req4","FinOps",null,null,null,null,null,null,null,"MERGE","1.2.2.1.1","1.2.2.7.2","1.2.2.4.1",null,{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},"",{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},"",2,"",{"$error":"#REF!"},"OriginalComplianceP1","OriginalComplianceP1","OriginalComplianceP1","OriginalComplianceP",{"$f":"COUNTIF($DS21:$DV21,EH$3)","v":0},0,0,0,0,3,""]
[null,"1","1.2","1.2.2",0,"1.2.2.1",null,null,{"$f":"BC22","v":"1.2.2.1.2"},"1.2.2.1.2: For financial ecosystem partners that simply operate a prefunded e-monay account and reconciliation is the responsibility of the partner, is there a documented process for financial ecosystem partners to dispute transaction records?\n",{"$f":"CHOOSE(LanguageNumber,BF22,BV22,CL22,DB22)","v":"1) Reconciliation and Settlement process or policy for financial partners\n-  Check that the process specifies how financial ecosystem partners may dispute transaction records.\n"},0,{"$f":"CHOOSE(LanguageNumber,BH22,BX22,CN22,DD22)","v":"Urgent Required"},{"$f":"CHOOSE(LanguageNumber,BI22,BY22,CO22,DE22)","v":"Required"},"FinOps",{"$f":"CHOOSE(LanguageNumber,BK22,CA22,CQ22,DG22)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1","1.2","1.2.2",null,"1.2.2.1",null,null,"1.2.2.1.2",{"$f":"DO22","v":"1.2.2.2.1"},"For financial ecosystem partners that simply operate a prefunded e-monay account and reconciliation is the responsibility of the partner, is there a documented process for financial ecosystem partners to dispute transaction records?","1) Reconciliation and Settlement process or policy for financial partners\n-  Check that the process specifies how financial ecosystem partners may dispute transaction records.\n",null,"Urgent Required","Required","FinOps",null,null,"1","1.2","1.2.2",null,"1.2.2.1",null,0,{"$f":"BC22","v":"1.2.2.1.2"},"Lorsque les partenaires de l'écosystème financier gèrent uniquement un compte d'argent mobile préfinancé et que le rapprochement incombe au partenaire, existe-t-il un processus documenté permettant aux partenaires de l'écosystème financier de contester les informations issues du registre des transactions ?","1) Processus ou politique de rapprochement et de règlement pour les partenaires de l’écosystème financier\n- Vérifier que le processus définit la manière dont les partenaires de l'écosystème financier peuvent contester les informations issues du registre des transactions.\n",null,"Requis Prioritaire","Requis","FinOps",null,null,"1","1.2","1.2.2",null,"1.2.2.1",null,0,{"$f":"BC22","v":"1.2.2.1.2"},"En el caso de los socios del ecosistema financiero que simplemente operan una cuenta de dinero electrónico pre-financiada y la conciliación es responsabilidad del socio, ¿existe un proceso documentado para que los socios del ecosistema financiero cuestionen los registros de transacciones? ","1) Proceso o política de conciliación y liquidación con socios financieros\n- Verificar que el proceso establece cómo los socios del ecosistema financiero pueden cuestionar los registros de transacciones.",null,"Obligatorio urgente","Obligatorio","FinOps",null,null,"1","1.2","1.2.2",null,"1.2.2.1",null,0,{"$f":"BC22","v":"1.2.2.1.2"},null,null,null,"ReqU4","Req4","FinOps",null,null,null,null,null,null,null,null,"1.2.2.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP1","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"1","1.2","1.2.2",0,"1.2.2.1",null,null,{"$f":"BC23","v":"1.2.2.1.3"},"1.2.2.1.3: Is information on failed and suspended transactions included in the data exchanged to help resolve reconciliation discrepancies?\n",0,0,"Recommended","Recommended","FinOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1","1.2","1.2.2",null,"1.2.2.1",null,null,"1.2.2.1.3","1.2.2.3.3","Is information on failed and suspended transactions included in the data exchanged to help resolve reconciliation discrepancies?",0,null,"Recommended","Recommended","FinOps",null,null,"1","1.2","1.2.2",null,"1.2.2.1",null,0,"1.2.2.1.3","les renseignements relatifs aux transactions avortées ou suspendues sont-il inclus dans les données échangées et correctement pris en compte dans le cadre du rapprochement ?",null,null,"Recommandé","Recommandé","FinOps",null,null,"1","1.2","1.2.2",null,"1.2.2.1",null,0,"1.2.2.1.3","¿La información sobre transacciones fallidas o suspendidas está incluida en los datos compartidos para ayudar a resolver las discrepancias en la conciliación?",0,null,"Recomendado","Recomendado","FinOps",null,null,"1","1.2","1.2.2",null,"1.2.2.1",null,0,"1.2.2.1.3",null,null,null,"Rec4","Rec4","FinOps",null,null,null,null,null,null,null,null,"1.2.2.3.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP1","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"1","1.2","1.2.2",0,"1.2.2.2",{"$f":"AZ24&\": \"&CHOOSE(LanguageNumber,BA24,BR24,CH24,CX24)","v":"1.2.2.2: SETTLEMENT PROCESS FOR FINANCIAL ECOSYSTEM PARTNERS\nThe settlement process should specify the mechanism for exchange of funds between the provider and each financial ecosystem partner, in order to settle the balance indicated by reconciliation. \n\nSettlement accounts may be pre-funded or floating (i.e. which may go negative). A risk assessment should be done to determine whether a floating settlement account is suitable. For example, pre-funded settlement accounts may be required for some financial partners (e.g. international money transfer providers), but floating settlement accounts could be used for others (e.g. banks).\n\nFor settlement accounts that are not pre-funded and which might go negative (i.e. Provider could be a net payer):\n- the settlement process should specify for each financial partner how frequently settlement should be carried out.\n- acceptable settlement limits should be defined, together with a mechanism for enforcing the limits. There should be an escalation process to alert the head of mobile money to take action if settlement limits are exceeded.\n"},"GSMA RMT\n\nISO 27002:2013 Sec. 12.1","1.2.2.2.1","1.2.2.2.1: Is a suitable settlement mechanism implemented and documented for every ecosystem partner (either pre-funded or risk-based)?\n","1) Reconciliation and Settlement process or policy for financial partners\n- Check the process specifies a suitable settlement mechanism for each class of ecosystem partner\n- Check that pre-funded mechanisms are used for high-risk partners or where regulation prescribes it must be used.  \n\n[Note: settlement of prefunded accounts could simply mean deposit / withdrawal following the same model as master agents]",0,"Urgent Required","Required","FinOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1","1.2","1.2.2",null,"1.2.2.2","SETTLEMENT PROCESS FOR FINANCIAL ECOSYSTEM PARTNERS\nThe settlement process should specify the mechanism for exchange of funds between the provider and each financial ecosystem partner, in order to settle the balance indicated by reconciliation. \n\nSettlement accounts may be pre-funded or floating (i.e. which may go negative). A risk assessment should be done to determine whether a floating settlement account is suitable. For example, pre-funded settlement accounts may be required for some financial partners (e.g. international money transfer providers), but floating settlement accounts could be used for others (e.g. banks).\n\nFor settlement accounts that are not pre-funded and which might go negative (i.e. Provider could be a net payer):\n- the settlement process should specify for each financial partner how frequently settlement should be carried out.\n- acceptable settlement limits should be defined, together with a mechanism for enforcing the limits. There should be an escalation process to alert the head of mobile money to take action if settlement limits are exceeded.\n","GSMA RMT\n\nISO 27002:2013 Sec. 12.1","1.2.2.2.1","1.2.2.5.1","Is a suitable settlement mechanism implemented and documented for every ecosystem partner (either pre-funded or risk-based)?","1) Reconciliation and Settlement process or policy for financial partners\n- Check the process specifies a suitable settlement mechanism for each class of ecosystem partner\n- Check that pre-funded mechanisms are used for high-risk partners or where regulation prescribes it must be used.  \n\n[Note: settlement of prefunded accounts could simply mean deposit / withdrawal following the same model as master agents]",null,"Urgent Required","Required","FinOps",null,null,"1","1.2","1.2.2",0,"1.2.2.2","PROCÉDÉ DE RÈGLEMENT AVEC LES PARTENAIRES DE L’ÉCOSYSTÈME FINANCIER\nLe processus de règlement doit préciser le mécanisme de transfert des fonds entre le prestataire et chaque partenaire de l'écosystème financier pour le règlement du solde résultant du rapprochement des opérations.  \n\nLes comptes de règlement peuvent être préfinancés ou flottants (c'est à dire qu'ils peuvent atteindre un solde négatif). Une évaluation de risque doit être effectuée afin de déterminer le caractère approprié d'un compte de règlement flottant. Par exemple, des comptes de règlement préfinancés peuvent être exigés pour certains partenaires financiers (par ex. les prestataires de services de transferts internationaux) et les comptes de règlement flottants peuvent être utilisés pour d’autres partenaires (par ex. les banques).\n\nPour les comptes de règlement qui ne sont pas préfinancés et pouvant être débiteurs (le Prestataire peut être un contributeur net) :\n- le processus de règlement doit indiquer, pour chaque partenaire financier, la fréquence à laquelle il doit être procédé au règlement\n-  des plafonds de débit appropriés doivent être définis, de même qu’un mécanisme pour appliquer ces limites. Un processus de remontée des informations au responsable de l’exploitation de l’argent mobile doit être défini afin de prendre les mesures appropriées si les plafonds sont dépassés.","GSMA RMT\n\nISO 27002:2013 Sec. 12.1","1.2.2.2.1","Un mécanisme de règlement a-t-il été défini et appliqué pour chaque partenaire de l'écosystème financier (soit préfinancé ou en fonctions des risques) ?","1) Processus ou politique de rapprochement et de règlement pour les partenaires de l’écosystème financier\n- Vérifier que le processus définit un mécanisme de règlement adapté pour chaque catégorie de partenaire de l’écosystème financier\n- Vérifier que des mécanismes préfinancés sont appliqués pour les partenaires à haut risque ou lorsque les réglementations en exigent l’application. \n\n[Remarque : le règlement des comptes préfinancés peut désigner simplement une opération de dépôt/retrait selon le même modèle que celui appliqué pour les agents principaux]",null,"Requis Prioritaire","Requis","FinOps","Le \"règlement adapté au niveau de risque\" signifie que le mécanisme de règlement peut varier en fonction de différentes catégories de partenaires, telles que définies par la politique de règlement. Des comptes de règlement préfinancés peuvent ainsi être exigés pour certains partenaires financiers  (prestataires de transferts internationaux d'argent mobile par exemple) mais pas pour d'autres (banques par exemple).",null,"1","1.2","1.2.2",null,"1.2.2.2","PROCESO DE LIQUIDACIÓN CON SOCIOS DEL ECOSISTEMA FINANCIERO\nEl proceso de liquidación debe establecer el mecanismo para el intercambio de fondos entre el proveedor y cada socio del ecosistema financiero a fin de liquidar los saldos indicados en la conciliación. \n\nLas cuentas de liquidación pueden estar pre-financiadas o ser flotantes (es decir, pueden estar negativas). La evaluación del riesgo se debe realizar a fin de determinar si una cuenta de liquidación flotante es apropiada. Por ejemplo, contar con una cuenta de liquidación con financiamiento previo puede ser un requerimiento de algunos socios financieros (por ej., proveedores de transferencias internacionales de dinero), aunque otros pueden utilizar cuentas de liquidación flotantes (por ej., Bancos).\n\nEl proceso de liquidación debe establecer la frecuencia con la que se debe realizar la liquidación con cada socio financiero.\n\nPara las cuentas de liquidación que no están previamente financiadas y pueden volverse negativas (es decir, el proveedor puede ser un contribuyente neto):\n- el proceso de liquidación debe especificar la frecuencia de liquidaciíon para cada socio financiero.\n- se deben establecer límites de liquidación aceptables junto con el mecanismo para aplicarlos. Se debe contar con un proceso de escalamiento para alertar al mayor directivo del dinero móvil a fin de que tome alguna acción cuando se exceda dicho límite. \n","GSMA RMT\n\nISO 27002:2013 Sec. 12.1","1.2.2.2.1","¿Se ha implementado un mecanismo de liquidación apropiado y se lo ha documentado para cada socio del ecosistema (ya sea con financiamiento previo o basado en riesgos)?","1) Proceso o política de conciliación y liquidación con socios financieros\n- Verificar si el proceso establece un mecanismo de liquidación apropiado para cada clase de socio del ecosistema\n- Verificar si los mecanismos de financiamiento previo son utilizados por los socios de alto riesgo o porque así lo establece la regulación.  \n\n[Nota: La liquidación de cuentas pre-financiadas podría significar simplemente depósito / retiro siguiendo el mismo modelo que los agentes maestros]",null,"Obligatorio urgente","Obligatorio","FinOps",null,null,"1","1.2","1.2.2",null,"1.2.2.2",null,"GSMA RMT\n\nISO 27002:2013 Sec. 12.1","1.2.2.2.1",null,null,null,"ReqU4","Req4","FinOps",null,null,null,null,null,null,null,null,"1.2.2.5.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP1","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"1","1.2","1.2.2",0,"1.2.2.2",null,0,"1.2.2.2.2","1.2.2.2.2: If any settlement accounts are not pre-funded and which might go negative (i.e. Provider could be a net payer), does the reconciliation & settlement process define and enforce settlement account value limits?\n","1) Reconciliation and Settlement process or policy for financial partners\n- If all settlement accounts are pre-funded (where the Provider is a net payer), mark this indicator as N/A.\n- Check that limits are set for all floating (non-pre-funded) settlement accounts with financial partners.\n- Check that there is a process for enforcing settlement limits for all floating settlement accounts (e.g. escalation to head of mobile money).",0,"Standard Required","Required","FinOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1","1.2","1.2.2",null,"1.2.2.2",null,null,"1.2.2.2.2","1.2.2.6.1","If any settlement accounts are not pre-funded and which might go negative (i.e. Provider could be a net payer), does the reconciliation & settlement process define and enforce settlement account value limits?","1) Reconciliation and Settlement process or policy for financial partners\n- If all settlement accounts are pre-funded (where the Provider is a net payer), mark this indicator as N/A.\n- Check that limits are set for all floating (non-pre-funded) settlement accounts with financial partners.\n- Check that there is a process for enforcing settlement limits for all floating settlement accounts (e.g. escalation to head of mobile money).",null,"Standard Required","Required","FinOps",null,null,"1","1.2","1.2.2",0,"1.2.2.2",null,0,"1.2.2.2.2","Si les comptes de règlement ne sont pas préfinancés et sont susceptibles d'être débiteurs (le Prestataire peut être un contributeur net) , le processus de rapprochement et de règlement définit-il et applique-t-il des plafonds de règlement ?","1) Processus ou politique de rapprochement et de règlement pour les partenaires de l’écosystème financier\n- Si l’ensemble des comptes de règlement sont préfinancés (lorsque le Prestataire est un contributeur net), indiquez la mention \"n/d\" pour cet indicateur.\n- Vérifier que des plafonds ont été définis pour l’ensemble des comptes de règlement flottants (non préfinancés) avec les partenaires de l’écosystème financier .\n- Vérifier qu’un processus a été mis en place afin d’assurer le respect des plafonds de règlement pour l’ensemble des comptes de règlement flottants (par ex. remontée des informations au responsable de l’exploitation de l’argent mobile).",null,"Requis Normal","Requis","FinOps",0,null,"1","1.2","1.2.2",null,"1.2.2.2",null,0,"1.2.2.2.2","En los casos en que las cuentas de liquidación no cuentan con financiamiento previo y pueden volverse negativas (es decir, el proveedor puede ser un contribuyente neto), ¿el proceso de conciliación y liquidación determina el límite del valor de la cuenta de liquidación y obliga a su cumplimiento?","1) Proceso o política de conciliación y liquidación con socios financieros\n- Si todas las cuentas de liquidación son previamente financiadas (cuando el Proveedor es un contribuyente neto), marcar este indicador con N/A.\n- Verificar si se determinaron los límites para todas las cuentas flotantes de liquidación (sin financiamiento previo) con socios financieros.\n- Verificar si existe un proceso para aplicar estos límites de liquidación en todas las cuentas de liquidación flotantes (por ej., escalamiento al directivo encargado del dinero móvil). ",null,"Obligatorio estándar","Obligatorio","FinOps",null,null,"1","1.2","1.2.2",null,"1.2.2.2",null,0,"1.2.2.2.2",null,null,null,"ReqS4","Req4","FinOps",null,null,null,null,null,null,null,"MERGE","1.2.2.6.1","1.2.2.4.3",null,null,{"$error":"#REF!"},{"$error":"#REF!"},"","",{"$error":"#REF!"},{"$error":"#REF!"},"","",2,"",{"$error":"#REF!"},"OriginalComplianceP1","OriginalComplianceP1","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,2,""]
[null,"1","1.2","1.2.2",0,"1.2.2.3",{"$f":"AZ26&\": \"&CHOOSE(LanguageNumber,BA26,BR26,CH26,CX26)","v":"1.2.2.3: RECONCILIATION & SETTLEMENT PROCESS: SERVICE LEVEL AGREEMENTS\nService levels for completion of reconciliation & settlement and for resolution of discrepancies and disputes should be agreed with each financial ecosystem partner. A process should be agreed for resolving breaches of the agreed service levels.\n\nService levels should include:\n- Time to complete reconciliation; \n- Time for transfers of settlement funds; and\n- Time for resolving disputes and escalations."},{"$f":"BB26","v":"GSMA RMT\n\nISO 20000-1:2011 Sec. 6.1"},{"$f":"BC26","v":"1.2.2.3.1"},"1.2.2.3.1: Is there a Service Level Agreement (SLA) with each financial partner, specifying the expected performance for completing the reconciliation process?\n",0,0,"Recommended","Recommended","FinOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1","1.2","1.2.2",null,"1.2.2.3","RECONCILIATION & SETTLEMENT PROCESS: SERVICE LEVEL AGREEMENTS\nService levels for completion of reconciliation & settlement and for resolution of discrepancies and disputes should be agreed with each financial ecosystem partner. A process should be agreed for resolving breaches of the agreed service levels.\n\nService levels should include:\n- Time to complete reconciliation; \n- Time for transfers of settlement funds; and\n- Time for resolving disputes and escalations.","GSMA RMT\n\nISO 20000-1:2011 Sec. 6.1","1.2.2.3.1","1.2.2.8.1","Is there a Service Level Agreement (SLA) with each financial partner, specifying the expected performance for completing the reconciliation process?",null,null,"Recommended","Recommended","FinOps",null,null,"1","1.2","1.2.2",0,"1.2.2.3","PROCESSUS DE RAPPROCHEMENT ET RÈGLEMENT :  CONVENTIONS DE NIVEAU DE SERVICE\nDes niveaux de service doivent être convenus avec chaque partenaire de l'écosystème financier concernant le procédé de rapprochement et de réglement ainsi que pour la résolution des écarts et litiges. Une procédure doit également être convenue pour répondre aux situation de non respect des niveaux de service prévus.\n\nLes niveaux de service doivent couvrir :\n- le délai de réalisation du rapprochement;\n- le délai de transfert des montants à régler;\n- le délai de traitement des litiges et de remontée des problèmes.  ","GSMA RMT\n\nISO 20000-1:2011 Sec. 6.1","1.2.2.3.1","existe-t-il des conventions de niveau de service précisant la performance attendue du processus de rapprochement avec chaque partenaire ?",null,null,"Recommandé","Recommandé","FinOps",0,null,"1","1.2","1.2.2",null,"1.2.2.3","PROCESO DE CONCILIACIÓN Y LIQUIDACIÓN: ACUERDOS DE NIVEL DE SERVICIO (Service Level Agreement o SLA)\nLos niveles de servicio para llevar a cabo conciliaciones y liquidaciones, además de resolver discrepancias y controversias, deben acordarse con cada socio del ecosistema financiero. Asimismo, se debe acordar un proceso para la resolución de falta de cumplimiento de los acuerdos de nivel de servicios.\n\nLos niveles de servicio deben incluir:\n- período para completar la conciliación; \n- período para transferir los fondos de liquidación; y\n- período para resolver controversias y escalamientos.","GSMA RMT\n\nISO 20000-1:2011 Sec. 6.1","1.2.2.3.1","¿Existe un Acuerdo de Nivel de Servicios (Service Level Agreement o SLA) con cada socio financiero, que establezca el desempeño esperado para completar el proceso de conciliación?",null,null,"Recomendado","Recomendado","FinOps",null,null,"1","1.2","1.2.2",null,"1.2.2.3",null,"GSMA RMT\n\nISO 20000-1:2011 Sec. 6.1","1.2.2.3.1",null,null,null,"Rec4","Rec4","FinOps",null,null,null,null,null,null,null,null,"1.2.2.8.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP1","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"1","1.2","1.2.2",0,"1.2.2.3",null,{"$f":"BB27","v":0},{"$f":"BC27","v":"1.2.2.3.2"},"1.2.2.3.2: Is there a Service Level Agreement (SLA) with each financial partner, specifying the expected performance for resolving reconciliation/settlement disputes and escalations?\n",0,0,"Recommended","Recommended","FinOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1","1.2","1.2.2",null,"1.2.2.3",null,null,"1.2.2.3.2","1.2.2.8.3","Is there a Service Level Agreement (SLA) with each financial partner, specifying the expected performance for resolving reconciliation/settlement disputes and escalations?",null,null,"Recommended","Recommended","FinOps",null,null,"1","1.2","1.2.2",0,"1.2.2.3","",0,"1.2.2.3.2","existe-t-il des conventions de niveau de service précisant la performance attendue pour la résolution et la remontée des litiges liés au processus de rapprochement et de règlement avec chaque partenaire?",null,null,"Recommandé","Recommandé","FinOps",0,null,"1","1.2","1.2.2",null,"1.2.2.3",null,0,"1.2.2.3.2","¿Existe un acuerdo de nivel de servicios con cada socio financiero, que establezca el desempeño esperado para resolver controversias y escalamientos relacionados con la conciliación y/o la liquidación?",null,null,"Recomendado","Recomendado","FinOps",null,null,"1","1.2","1.2.2",null,"1.2.2.3",null,0,"1.2.2.3.2",null,null,null,"Rec4","Rec4","FinOps",null,null,null,null,null,null,null,null,"1.2.2.8.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP1","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"1","1.2","1.2.2",0,"1.2.2.4",{"$f":"AZ28&\": \"&CHOOSE(LanguageNumber,BA28,BR28,CH28,CX28)","v":"1.2.2.4: RECORD-KEEPING\nRecords of reconciliation with the custodial bank and financial ecosystem partners should be kept for a period determined by regulation or risk assessment, whichever is longer. FATF recommends that records be kept for a minimum of five years, either physically or electronically (or both)."},"GSMA RMT\n(FR.P-07)","1.2.2.4.1","1.2.2.4.1: Are records of reconciliation with the custodial bank and financial ecosystem partners kept for at least five years?\n","1) Reconciliation and Settlement process or policy for financial partners\n - Check that records will be kept for at least five years.",0,"Standard Required","Required","FinOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1","1.2","1.2.2",null,"1.2.2.4","RECORD-KEEPING\nRecords of reconciliation with the custodial bank and financial ecosystem partners should be kept for a period determined by regulation or risk assessment, whichever is longer. FATF recommends that records be kept for a minimum of five years, either physically or electronically (or both).","GSMA RMT\n(FR.P-07)","1.2.2.4.1","1.2.2.11.1","Are records of reconciliation with the custodial bank and financial ecosystem partners kept for at least five years?","1) Reconciliation and Settlement process or policy for financial partners\n - Check that records will be kept for at least five years.",null,"Standard Required","Required","FinOps",null,null,"1","1.2","1.2.2",0,"1.2.2.4","TENUE DES REGISTRES : PARTENAIRES DE L'ÉCOSYSTÈME FINANCIER\nLes registres d'opérations (réalisées et avortées) vers et en provenance des banques dépositaires et des autres partenaires de l'écosystème financier doivent être conservés aussi longtemps que l'exige la réglementation ou l'évaluation des risques. Le GAFI recommande que ces registres soient conservés pour une durée d'au moins cinq ans, que ce soit physiquement ou sous forme électronique (ou les deux). ","GSMA RMT\n(FR.P-07)","1.2.2.4.1","Des registres de rapprochement avec la banque dépositaire et les partenaires de l'écosystème financier sont-ils tenus pour une période d'au moins cinq ans ?","1) Processus ou politique de rapprochement et de règlement pour les partenaires de l’écosystème financier\n - Vérifier sur les registres sont conservés pour une période minimale de cinq ans.",null,"Requis Normal","Requis","FinOps",0,null,"1","1.2","1.2.2",null,"1.2.2.4","REGISTRO DE DOCUMENTACIÓN\nLos registros de conciliación con el banco custodio y los socios del ecosistema financiero deben mantenerse por el período determinado por la regulación o la evaluación de riesgos, aplicándose el que sea mayor. GAFI recomienda mantener los registros por un período mínimo de cinco años, ya sea en formato físico o electrónico, o ambos.","GSMA RMT\n(FR.P-07)","1.2.2.4.1","¿Los registros de conciliación con el banco custodio y los socios del ecosistema financiero se mantienen durante un período mínimo de cinco años?","1) Proceso o política de conciliación y liquidación con socios financieros\n -Verificar que los registros se mantienen por un período mínimo de cinco años.",null,"Obligatorio estándar","Obligatorio","FinOps",null,null,"1","1.2","1.2.2",null,"1.2.2.4",null,"GSMA RMT\n(FR.P-07)","1.2.2.4.1",null,null,null,"ReqS4","Req4","FinOps",null,null,null,null,null,null,null,null,"1.2.2.11.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP1","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,null,null,null,null,".",".",".",".",".",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,0,0,0,0,0,"Yes"]

{"sheet":"2","index":3,"n_rows":122,"n_cols":144,"rows_kept":122,"cut":false,"hidden":false,"merged":[[100,6,102,6],[100,7,102,7],[103,6,106,6],[103,7,106,7],[97,85,99,85],[100,85,102,85],[103,85,106,85],[100,70,102,70],[103,70,106,70],[100,69,102,69],[103,69,106,69],[97,86,99,86],[100,86,102,86],[103,86,106,86],[86,67,90,67],[86,70,88,70],[91,70,93,70],[73,52,76,52],[73,53,76,53],[70,52,72,52],[67,67,72,67],[73,67,75,67],[89,69,90,69],[70,69,72,69],[70,70,72,70],[86,69,88,69],[91,86,93,86],[86,83,90,83],[107,101,108,101],[107,85,108,85],[107,86,108,86],[117,101,119,101],[110,85,113,85],[110,86,113,86],[107,6,108,6],[107,7,108,7],[110,6,113,6],[110,7,113,7],[117,52,119,52],[117,69,119,69],[117,85,119,85],[117,6,119,6],[107,70,108,70],[110,70,113,70],[107,106,108,106],[110,102,113,102],[110,101,113,101],[97,101,99,101],[107,52,108,52],[107,53,108,53],[110,52,113,52],[110,53,113,53],[97,52,99,52],[97,53,99,53],[100,52,102,52],[100,53,102,53],[103,52,106,52],[103,53,106,53],[97,69,99,69],[107,69,108,69],[110,69,113,69],[97,70,99,70],[100,102,102,102],[103,102,106,102],[107,102,108,102],[97,102,99,102],[100,101,102,101],[103,101,106,101],[20,52,21,52],[31,52,33,52],[31,53,33,53],[23,67,25,67],[31,67,33,67],[4,52,5,52],[4,53,5,53],[6,52,9,52],[6,53,9,53],[10,52,11,52],[10,53,11,53],[20,53,21,53],[4,67,6,67],[4,50,6,50],[23,52,29,52],[23,53,29,53],[91,50,93,50],[91,52,93,52],[91,53,93,53],[12,53,14,53],[16,50,19,50],[16,52,19,52],[16,53,19,53],[34,53,37,53],[23,50,25,50],[31,50,33,50],[86,50,90,50],[67,50,72,50],[73,50,75,50],[86,52,88,52],[86,53,88,53],[89,52,90,52],[89,53,90,53],[48,52,52,52],[12,52,14,52],[77,52,78,52],[77,53,78,53],[23,4,25,4],[46,4,47,4],[73,4,75,4],[67,4,72,4],[4,4,6,4],[4,7,5,7],[6,7,9,7],[16,4,19,4],[4,6,5,6],[6,6,9,6],[91,4,93,4],[79,4,83,4],[31,4,33,4],[48,53,51,53],[57,52,62,52],[57,53,62,53],[38,52,42,52],[38,53,42,53],[46,50,47,50],[34,52,37,52],[79,50,83,50],[79,52,84,52],[79,53,84,53],[86,4,88,4],[4,69,5,69],[16,67,19,67],[6,69,9,69],[6,70,9,70],[10,69,11,69],[10,70,11,70],[12,70,14,70],[16,69,19,69],[16,70,19,70],[12,69,14,69],[46,67,47,67],[48,70,51,70],[57,69,62,69],[57,70,62,70],[65,52,66,52],[79,67,83,67],[70,53,72,53],[63,52,64,52],[63,53,64,53],[65,53,66,53],[67,52,69,52],[67,53,69,53],[73,69,76,69],[73,70,76,70],[53,52,56,52],[53,53,56,53],[53,69,56,69],[53,70,56,70],[77,70,78,70],[79,69,84,69],[79,70,84,70],[48,69,52,69],[77,69,78,69],[67,69,69,69],[23,69,29,69],[23,70,29,70],[31,69,33,69],[31,70,33,70],[34,70,37,70],[38,69,42,69],[38,70,42,70],[34,69,37,69],[65,70,66,70],[63,69,64,69],[63,70,64,70],[65,69,66,69],[6,86,9,86],[20,69,21,69],[89,70,90,70],[20,70,21,70],[91,67,94,67],[4,83,6,83],[4,85,5,85],[16,83,19,83],[16,85,19,85],[31,83,33,83],[31,85,33,85],[46,83,47,83],[67,83,72,83],[67,85,69,85],[73,83,75,83],[79,83,83,83],[91,83,93,83],[91,85,93,85],[20,85,21,85],[23,83,25,83],[23,85,29,85],[86,85,88,85],[67,70,69,70],[91,69,93,69],[16,86,19,86],[70,101,72,101],[70,102,72,102],[73,99,75,99],[91,99,93,99],[91,101,93,101],[91,102,93,102],[16,102,19,102],[20,101,21,101],[20,102,21,102],[65,86,66,86],[86,102,88,102],[86,86,88,86],[70,86,72,86],[23,86,29,86],[63,101,64,101],[63,102,64,102],[34,102,37,102],[57,86,62,86],[53,101,56,101],[73,86,76,86],[77,86,78,86],[6,102,9,102],[10,101,11,101],[10,102,11,102],[4,99,6,99],[10,85,11,85],[10,86,11,86],[12,85,14,85],[12,86,14,86],[57,85,62,85],[53,85,56,85],[53,86,56,86],[31,86,33,86],[34,85,37,85],[34,86,37,86],[38,85,42,85],[38,86,42,86],[4,101,5,101],[12,101,14,101],[34,101,37,101],[48,101,51,101],[20,86,21,86],[6,101,9,101],[38,101,42,101],[6,85,9,85],[12,102,14,102],[65,101,66,101],[65,102,66,102],[67,102,69,102],[57,101,62,101],[57,102,62,102],[77,102,78,102],[79,99,83,99],[79,101,84,101],[79,102,84,102],[16,99,19,99],[16,101,19,101],[38,102,42,102],[46,99,47,99],[48,102,51,102],[53,102,56,102],[73,101,76,101],[73,102,76,102],[67,99,72,99],[67,101,69,101],[77,101,78,101],[48,85,52,85],[89,102,90,102],[23,99,25,99],[23,101,29,101],[23,102,29,102],[31,99,33,99],[31,101,33,101],[31,102,33,102],[86,99,88,99],[86,101,88,101],[79,85,84,85],[79,86,84,86],[70,85,72,85],[63,85,64,85],[73,85,76,85],[89,85,90,85],[67,86,69,86],[89,101,90,101],[63,86,64,86],[65,85,66,85],[89,86,90,86],[77,85,78,85],[48,86,51,86]]}
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,"x",null,null,null,null,"x",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"x"]
[null,null,null,null,null,null,{"$f":"UPPER(Introduction!B7)","v":"2. AML/CFT/FRAUD:  COMBAT MONEY LAUNDERING, TERRORIST FINANCING AND FRAUD"},null,null,null,null,null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,Drivers!K18,Drivers!L18,Drivers!M18,Drivers!N18)","v":"SELF-ASSESSMENT"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,Drivers!K34,Drivers!L34,Drivers!M34,Drivers!N34)","v":"EXTERNAL ASSESSMENT"},null,null,null,null,null,"SCHEME OPERATOR REVIEW",null,null,null,null,null,null,null,null,null,null,null,null,"ENGLISH",null,null,null,null,null,null,null,null,null,null," ",null,null,null,"FRENCH",null,16,null,17,null,null,3,2,null,4,5,6,9,null,null,null,null,"SPANISH",null,null,null,null,null,null,null,null,null,null,"SPANISH",null,null,null,null,"LANGUAGE",null,null,null,null,null,null,null,null,null,null,"LANGUAGE",null,null,null,null,null,null,"Change types: NEW, MERGE, MOVE, SWAP","Don't edit the Indicator ID",null,null,null,"*** Don't edit any cell from AB and onwards *** Ignore #NAME errors; these will disappear during migration",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Counts for computed Compliance calc"]
[null,{"$f":"CHOOSE(LanguageNumber,AV3,BM3,CC3,CS3)","v":"Principle"},"Sub-principle","Sub-sub-principle","Sub-sub-principle ","Practice ID","Practice","Practice data source","Indicator ID",{"$f":"CHOOSE(LanguageNumber,BE3,BU3,CK3,DA3)","v":"Indicator"},"Evidence required","[SPARE]","Detailed indicator category","Indicator category","Function","[SPARE]",{"$f":"CHOOSE(LanguageNumber,Drivers!K19,Drivers!L19,Drivers!M19,Drivers!N19)","v":"Compliance"},{"$f":"CHOOSE(LanguageNumber,Drivers!K20,Drivers!L20,Drivers!M20,Drivers!N20)","v":"Evidence document (specify document name, section number and page number)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K21,Drivers!L21,Drivers!M21,Drivers!N21)","v":"Comments \n(include notes on how the practice is implemented)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K22,Drivers!L22,Drivers!M22,Drivers!N22)","v":"Action"},{"$f":"CHOOSE(LanguageNumber,Drivers!K23,Drivers!L23,Drivers!M23,Drivers!N23)","v":"Reviewer name"},{"$f":"CHOOSE(LanguageNumber,Drivers!K24,Drivers!L24,Drivers!M24,Drivers!N24)","v":"Evidence sent to Assessor?"},{"$f":"CHOOSE(LanguageNumber,Drivers!K25,Drivers!L25,Drivers!M25,Drivers!N25)","v":"Spare 2"},{"$f":"CHOOSE(LanguageNumber,Drivers!K26,Drivers!L26,Drivers!M26,Drivers!N26)","v":"Spare 3"},{"$f":"CHOOSE(LanguageNumber,Drivers!K27,Drivers!L27,Drivers!M27,Drivers!N27)","v":"Spare 4"},{"$f":"CHOOSE(LanguageNumber,Drivers!K28,Drivers!L28,Drivers!M28,Drivers!N28)","v":"Spare 5"},{"$f":"CHOOSE(LanguageNumber,Drivers!K29,Drivers!L29,Drivers!M29,Drivers!N29)","v":"Spare 6"},{"$f":"CHOOSE(LanguageNumber,Drivers!K30,Drivers!L30,Drivers!M30,Drivers!N30)","v":"Spare 7"},{"$f":"CHOOSE(LanguageNumber,Drivers!K31,Drivers!L31,Drivers!M31,Drivers!N31)","v":"Spare 8"},{"$f":"CHOOSE(LanguageNumber,Drivers!K32,Drivers!L32,Drivers!M32,Drivers!N32)","v":"Spare 9"},{"$f":"CHOOSE(LanguageNumber,Drivers!K33,Drivers!L33,Drivers!M33,Drivers!N33)","v":"Spare 10"},{"$f":"CHOOSE(LanguageNumber,Drivers!K35,Drivers!L35,Drivers!M35,Drivers!N35)","v":"Compliance"},{"$f":"CHOOSE(LanguageNumber,Drivers!K36,Drivers!L36,Drivers!M36,Drivers!N36)","v":"Evidence document (specify document name, section number and page number)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K37,Drivers!L37,Drivers!M37,Drivers!N37)","v":"Comments \n(include notes on how the practice is implemented)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K38,Drivers!L38,Drivers!M38,Drivers!N38)","v":"Recommendation to Provider"},{"$f":"CHOOSE(LanguageNumber,Drivers!K39,Drivers!L39,Drivers!M39,Drivers!N39)","v":"Reviewer name"},{"$f":"CHOOSE(LanguageNumber,Drivers!K40,Drivers!L40,Drivers!M40,Drivers!N40)","v":"Guidance notes for Assessor"},{"$f":"CHOOSE(LanguageNumber,Drivers!K41,Drivers!L41,Drivers!M41,Drivers!N41)","v":"Scheme Operator comments"},{"$f":"CHOOSE(LanguageNumber,Drivers!K42,Drivers!L42,Drivers!M42,Drivers!N42)","v":"Assessor's response to Scheme Operator"},{"$f":"CHOOSE(LanguageNumber,Drivers!K43,Drivers!L43,Drivers!M43,Drivers!N43)","v":"Scheme Operator conclusion"},{"$f":"CHOOSE(LanguageNumber,Drivers!K44,Drivers!L44,Drivers!M44,Drivers!N44)","v":"Spare 15"},{"$f":"CHOOSE(LanguageNumber,Drivers!K45,Drivers!L45,Drivers!M45,Drivers!N45)","v":"Spare 16"},{"$f":"CHOOSE(LanguageNumber,Drivers!K46,Drivers!L46,Drivers!M46,Drivers!N46)","v":"Spare 17"},{"$f":"CHOOSE(LanguageNumber,Drivers!K47,Drivers!L47,Drivers!M47,Drivers!N47)","v":"Spare 18"},{"$f":"CHOOSE(LanguageNumber,Drivers!K48,Drivers!L48,Drivers!M48,Drivers!N48)","v":"Spare 19"},{"$f":"CHOOSE(LanguageNumber,Drivers!K49,Drivers!L49,Drivers!M49,Drivers!N49)","v":"Spare 20"},null,"Principle","Sub-principle","Sub-sub-principle","Sub-sub-principle ","Practice ID","Practice","Practice data source","Indicator ID","ORIGINAL ID","Indicator","Evidence required","[SPARE]","Detailed indicator category","Indicator category","Function","[SPARE]",null,"Principe","Sous-principe","Sous-sous-principe","Description du sous-sous-principe","Pratique ID","Pratique","Source de données pratique","Indicateur ID","Indicateur","Documents généralement requis","[SPARE]","Catégorie détaillée d’indicateur","Catégorie d’indicateur","Fonction","[SPARE]",null,"Principio","Sub-principio","Sub-sub-principio","Sub-sub-principio","Nro. de Práctica","Práctica","Origen de datos de Práctica","Nro. de Indicador","Indicador","Documentación obligatoria","[SPARE]","Categoría indicador detallada","Categoría de Indicador","Función","[SPARE]",null,"Principle","Sub-principle","Sub-sub-principle","Sub-sub-principle Description","Practice\nID","Practice","Practice data source","Indicator\nID","Indicator","Evidence required","[SPARE]","Detailed indicator category","Indicator category","Function","[SPARE]",null,null,null,null,null,null,"Change type","Original Indicator ID","Merged indicator #1","Merged indicator #2","Merged indicator #3","v1 Compliance rating Original Indicator ID","v1 Compliance rating Merged indicator #1","v1 Compliance rating Merged indicator #2","v1 Compliance rating Merged indicator #3","v1 Comment Original Indicator ID","v1 Comment Merged indicator #1  ","v1 Comment Merged indicator #2","v1 Comment Merged indicator #3","v2 Computed change type","v2 Computed compliance rating","v2 Computed comment","rangename1","rangename2","rangename3","rangename4","Yes","No","N/A","Partial","No Response","how many","calc"]
[null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!C7,\": \",Introduction!D7))","v":"2.1: EFFECTIVE AML/CFT POLICIES AND PROCEDURES "},null,null,{"$f":"BB4","v":0},null,{"$f":"Introduction!E7","v":"Providers shall develop effective policies and procedures for Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) compliance"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$7,\": \",Introduction!$L$7))","v":"2.1: EFFECTIVE AML/CFT POLICIES AND PROCEDURES "},null,null,null,null,null,{"$f":"Introduction!$M$7","v":"Providers shall develop effective policies and procedures for Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) compliance"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null," ",null," "," ",null," ",null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!$U$7,\": \",Introduction!$V$7))","v":"2.1: POLITIQUES ET PROCÉDURES EFFICACES CONTRE ALD/LFT"},null,null,null,null,{"$f":"Introduction!W7","v":"El proveedor establecerá políticas y procedimientos eficaces para cumplir con las normas Antilavado de Dinero y la Lucha contra el Financiamiento del Terrorismo (ALD/LFT)"},null,null,null,null,null,null,null,null,null,null,null,0,0]
[null,{"$f":"AV5","v":"2"},{"$f":"AW5","v":"2.1"},{"$f":"AX5","v":"2.1.1"},{"$f":"CHOOSE(LanguageNumber,AY5,BP5,CF5,CV5)","v":"2.1.1: Providers shall develop effective policies and procedures for Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) compliance"},"2.1.1.1",{"$f":"AZ5&\": \"&CHOOSE(LanguageNumber,BA5,BR5,CH5,CX5)","v":"2.1.1.1: AML/CFT POLICY\nProviders should develop a strong AML/CFT policy. The AML/CFT policy should be  reviewed and updated as needed, such as following material changes to the service or regulation. The AML/CFT policy should include:\n\n- Raising Suspicious Activity Reports (SARs) and Suspicious Transaction Reports (STRs) with the relevant authorities in the case of suspected ML/TF (refer to 2.1.1.2).\n- Regular independent audit to evaluate compliance with and efficacy of AML/CFT procedures (refer to 2.1.1.4).\n- Ensuring that changes in business processes and systems are matched by appropriate changes to the AML/CFT controls (refer to 2.2.1).\n- Updating the sub-policies and procedures as needed - such as following changes to the service or regulation (refer to 2.2.1).\n- Logging and monitoring transactions and actions (refer to 2.4.1).\n- Identifying customers by collecting and verifying KYC information (refer to 2.5.1).\n- Implementing transaction and balance limits based on KYC tiers (refer to 2.5.2).\n- Blocking accounts when necessary (refer to 2.5.3).\n- Screening customers, agents, staff and partners (refer to Principle 3).\n- Training staff and agents in AML/CFT (refer to 2.6.1)\n- Monitoring staff and agent compliance with AML/CFT procedures (refer to 2.6.2).\n- Addressing staff and agent AML/CFT violations (refer to 2.6.3)"},"GSMA RMT",{"$f":"BC5","v":"2.1.1.1.1"},{"$f":"BC5&\": \"&CHOOSE(LanguageNumber,BE5,BU5,CK5,DA5)&CarriageReturn","v":"2.1.1.1.1: Is there documentation that describes the objectives and function of the AML function (i.e. policy or equivalent document) that is reviewed and approved by senior management?\n"},{"$f":"CHOOSE(LanguageNumber,BF5,BV5,CL5,DB5)","v":"1) Documentation that describes the objective and function of the AML programme (i.e. policy or equivalent document)\n\n- Check that the document has been approved within the last two years by the current senior manager (Director) who is responsible for the policy."},{"$f":"CHOOSE(LanguageNumber,BG5,BW5,CM5,DC5)","v":0},{"$f":"CHOOSE(LanguageNumber,BH5,BX5,CN5,DD5)","v":"Urgent Required"},{"$f":"CHOOSE(LanguageNumber,BI5,BY5,CO5,DE5)","v":"Required"},"FraudRisk",{"$f":"CHOOSE(LanguageNumber,BK5,CA5,CQ5,DG5)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.1","2.1.1","2.1.1: Providers shall develop effective policies and procedures for Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) compliance","2.1.1.1","AML/CFT POLICY\nProviders should develop a strong AML/CFT policy. The AML/CFT policy should be  reviewed and updated as needed, such as following material changes to the service or regulation. The AML/CFT policy should include:\n\n- Raising Suspicious Activity Reports (SARs) and Suspicious Transaction Reports (STRs) with the relevant authorities in the case of suspected ML/TF (refer to 2.1.1.2).\n- Regular independent audit to evaluate compliance with and efficacy of AML/CFT procedures (refer to 2.1.1.4).\n- Ensuring that changes in business processes and systems are matched by appropriate changes to the AML/CFT controls (refer to 2.2.1).\n- Updating the sub-policies and procedures as needed - such as following changes to the service or regulation (refer to 2.2.1).\n- Logging and monitoring transactions and actions (refer to 2.4.1).\n- Identifying customers by collecting and verifying KYC information (refer to 2.5.1).\n- Implementing transaction and balance limits based on KYC tiers (refer to 2.5.2).\n- Blocking accounts when necessary (refer to 2.5.3).\n- Screening customers, agents, staff and partners (refer to Principle 3).\n- Training staff and agents in AML/CFT (refer to 2.6.1)\n- Monitoring staff and agent compliance with AML/CFT procedures (refer to 2.6.2).\n- Addressing staff and agent AML/CFT violations (refer to 2.6.3)","GSMA RMT","2.1.1.1.1",{"$f":"DO5","v":"2.1.1.1.1"},"Is there documentation that describes the objectives and function of the AML function (i.e. policy or equivalent document) that is reviewed and approved by senior management?","1) Documentation that describes the objective and function of the AML programme (i.e. policy or equivalent document)\n\n- Check that the document has been approved within the last two years by the current senior manager (Director) who is responsible for the policy.",null,"Urgent Required","Required",{"$f":"$O5","v":"FraudRisk"},null,null,{"$f":"$AV5","v":"2"},{"$f":"$AW5","v":"2.1"},{"$f":"$AX5","v":"2.1.1"},"2.1.1: Les prestataires doivent élaborer des politiques et procédures efficaces pour lutter contre le blanchiment de capitaux et le financement du terrorisme (ML/FT)",{"$f":"$AZ5","v":"2.1.1.1"},"POLITIQUE DE LUTTE CONTRE LE BLANCHIMENT DE CAPITAUX ET LE FINANCEMENT DU TERRORISME (AML/CFT)\nLes prestataires doivent élaborer une solide politique de lutte contre le blanchiment de capitaux et le financement du terrorisme (AML/CFT). Cette politique AML/CFT doit être examinée et réactualisée en fonction des besoins, notamment après toute modification significative du service ou de la réglementation. Cette politique AML/CFT doit prévoir :\n\n- la transmission de Déclarations d’opérations suspectes (DOS) et de Déclarations de soupçon (DS) aux autorités concernées en cas de soupçon de blanchiment de capitaux ou de financement du terrorisme (cf. 2.1.1.2).\n- un audit indépendant périodique du respect et de l’efficacité des procédures AML/CFT (cf. 2.1.1.4).\n- l’adaptation des systèmes de contrôle AML/CFT à tout changement des processus et systèmes de l’activité d’argent mobile (cf. 2.2.1).\n- la mise à jour des sous-politiques et procédures, notamment en cas de modification du service ou de la réglementation (cf. 2.2.1).\n- l’enregistrement et la surveillance des transactions et des actions (cf. 2.4.1).\n- la vérification de l’identité des clients en obtenant et en vérifiant des justificatifs d’identité (cf. 2.5.1).\n- l’application de plafonds de solde et d’opération en fonction du niveau de vérification d’identité (cf. 2.5.2).\n- le blocage des comptes si nécessaire (cf. 2.5.3).\n- le contrôle des clients, des agents, du personnel et des partenaires par rapport aux listes de surveillance (cf. Principe 3).\n- la formation du personnel et des agents à la lutte contre le blanchiment de capitaux et le financement du terrorisme (cf. 2.6.1)\n- la surveillance du respect des procédures AML/CFT par le personnel et les agents (cf. 2.6.2).\n- la réponse aux violations des règles de lutte contre le blanchiment de capitaux et le financement du terrorisme par le personnel ou les agents (cf. 2.6.3)",{"$f":"$BB5","v":"GSMA RMT"},{"$f":"$BC5","v":"2.1.1.1.1"},"Existe-t-il une documentation qui décrit les objectifs et les responsabilités de la fonction AML (par ex. politique ou document équivalent), examinée et approuvée par la direction générale ?","1) Documentation décrivant l’objectif et la fonction du programme AML (politique ou document équivalent)\n\n- Vérifier que les documents ont été validés au cours des deux dernières années par le responsable actuel (Directeur) chargé de la politique.",null,{"$f":"VLOOKUP($BH5,CategoryTranslationTable,2,FALSE)","v":"Requis Prioritaire"},{"$f":"VLOOKUP($BI5,CategoryTranslationTable,2,FALSE)","v":"Requis"},{"$f":"$O5","v":"FraudRisk"},0,null,{"$f":"$AV5","v":"2"},{"$f":"$AW5","v":"2.1"},{"$f":"$AX5","v":"2.1.1"},"2.1.1: El proveedor debe desarrollar políticas y procedimientos a fin de cumplir con las normas de prevención del lavado de activos y Lucha contra el Financiamiento del Terrorismo (ALA/LFT).",{"$f":"$AZ5","v":"2.1.1.1"},"POLÍTICA DE ALA/LFT\nEl proveedor debe desarrollar una sólida política de ALA/LFT , la cual debe ser revisada y actualizada según sea necesario, como cuando se lleva a cabo un cambio sustancial al servicio o la regulación. La política de ALA/LFT debe incluir:\n\n- Elevar Reportes de Actividades Sospechosas (RAS) o Reportes de Transacciones Sospechosas (RTS) a las autoridades correspondientes en caso de sospecha de LD/FT (ver punto 2.1.1.2).\n- Realizar auditorías independientes regularmente a fin de evaluar el cumplimiento y la eficacia de los procedimientos de ALA/LFT (ver punto 2.1.1.4).\n- Garantizar que los cambios que se realicen en los procesos y sistemas de la empresa incluyen los cambios correspondientes a los controles de ALA/LFT (ver punto 2.2.1).\n- Actualizar las sub-políticas y procedimientos según corresponda, por ejemplo, luego de que se implementen cambios en el servicio o la regulación (ver punto 2.2.1).\n- Registro y monitoreo de transacciones y acciones (ver punto 2.4.1).\n- Identificación de clientes mediante la recolección y verificación de la información CSC (ver punto 2.5.1).\n- Implementación de límites para transacciones y saldos según las categorías de CSC (ver punto 2.5.2).\n- Bloqueo de cuentas, cuando sea necesario (ver punto 2.5.3).\n- Selección de clientes, agentes, personal y socios (ver Principio 3).\n- Capacitación sobre ALA/LFT para el personal y los agentes (ver punto 2.6.1)\n- Supervisión del cumplimiento con los procedimientos de ALA/LFT por parte del personal y los agentes (ver punto 2.6.2)\n- Resolución de contravenciones a las normas de ALA/LFT por parte del personal y los agentes (ver punto 2.6.3)",{"$f":"$BB5","v":"GSMA RMT"},{"$f":"$BC5","v":"2.1.1.1.1"},"¿Existe documentación que describe los objetivos y funciones del departamento de ALD (o sea, política o documento equivalente) revisado y aprobado por el personal directivo superior?","1) Documentación que describe los objetivos y la función del programa ALD (o sea, política o documento equivalente)\n\n- Verificar que la aprobación del documentado ha sido realizada en los últimos dos años por el director gerente sénior o director responsable de dicha política.",null,{"$f":"VLOOKUP($BH5,CategoryTranslationTable,3,FALSE)","v":"Obligatorio urgente"},{"$f":"VLOOKUP($BI5,CategoryTranslationTable,3,FALSE)","v":"Obligatorio"},{"$f":"$O5","v":"FraudRisk"},null,null,{"$f":"$AV5","v":"2"},{"$f":"$AW5","v":"2.1"},{"$f":"$AX5","v":"2.1.1"},null,{"$f":"$AZ5","v":"2.1.1.1"},null,{"$f":"$BB5","v":"GSMA RMT"},{"$f":"$BC5","v":"2.1.1.1.1"},null,null,null,{"$f":"VLOOKUP($BH5,CategoryTranslationTable,4,FALSE)","v":"ReqU4"},{"$f":"VLOOKUP($BI5,CategoryTranslationTable,4,FALSE)","v":"Req4"},{"$f":"$O5","v":"FraudRisk"},null,null,null,null,null,null,null,null,"2.1.1.1.1",null,null,null,{"$f":"IF(OR($EA5=0,$EA5=2),VLOOKUP(DO5,INDIRECT(ED5),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP5),\"\",VLOOKUP(DP5,INDIRECT(EE5),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ5),\"\",VLOOKUP(DQ5,INDIRECT(EF5),7,FALSE))","v":""},"",{"$f":"IF(OR($EA5=0,$EA5=2),VLOOKUP(DO5,INDIRECT(ED5),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP5),\"\",VLOOKUP(DP5,INDIRECT(EE5),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ5),\"\",VLOOKUP(DQ5,INDIRECT(EF5),8,FALSE))","v":""},"",{"$f":"1*AND(LEFT(DN5,3)=\"NEW\")+2*AND(LEFT(DN5,3)=\"MER\")+3*AND(LEFT(DN5,3)=\"MOV\")+4*AND(LEFT(DN5,3)=\"SWA\")","v":0},{"$f":"IF(EA5=0,DS5,EN5)","v":{"$error":"#REF!"}},{"$f":"IF(EA5=0,IF(DW5=0,\"\",DW5),CHOOSE(EA5,\"New indicator\",CONCATENATE(DW5,CarriageReturn,DX5,CarriageReturn,DY5,CarriageReturn,DZ5)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO5,1)","v":"OriginalComplianceP2"},{"$f":"\"OriginalComplianceP\"&LEFT(DP5,1)","v":"OriginalComplianceP"},"OriginalComplianceP","OriginalComplianceP",{"$f":"COUNTIF($DS5:$DV5,EH$3)","v":0},0,0,0,0,{"$f":"COUNTIF($DO5:$DR5,\"*?\")","v":1},{"$f":"IF(OR(AND(EH5>0,SUM(EI5:EL5)>0),EK5>0),\"Partial\",IF(EH5=EM5,\"Yes\",IF(EI5=EM5,\"No\",IF(EJ5=EM5,\"N/A\",IF(EK5=EM5,\"Partial\",IF(EL5=EM5,\"\",\"\"))))))","v":""}]
[null,"2","2.1","2.1.1",0,"2.1.1.1",null,0,"2.1.1.1.2","2.1.1.1.2: Is the AML/CFT policy (or equivalent document) reviewed at least every 24 months and updated if needed?\n","1) Documentation that describes the objective and function of the AML programme (i.e. policy or equivalent document)\n - Check that the document contains a revision history log and the last revision date is in the last 24 months.\n\n",0,"Standard Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.1","2.1.1",null,"2.1.1.1",null,null,"2.1.1.1.2",{"$f":"DO6","v":"2.1.1.1.2"},"Is the AML/CFT policy (or equivalent document) reviewed at least every 24 months and updated if needed?","1) Documentation that describes the objective and function of the AML programme (i.e. policy or equivalent document)\n - Check that the document contains a revision history log and the last revision date is in the last 24 months.\n\n",null,"Standard Required","Required",{"$f":"$O6","v":"FraudRisk"},null,null,{"$f":"$AV6","v":"2"},{"$f":"$AW6","v":"2.1"},{"$f":"$AX6","v":"2.1.1"},0,{"$f":"$AZ6","v":"2.1.1.1"},0,{"$f":"$BB6","v":0},{"$f":"$BC6","v":"2.1.1.1.2"},"La politique AML/CFT (ou document équivalent) est-elle examinée au moins tous les deux ans et mise à jour si nécessaire ?","1) Documentation décrivant l’objectif et la fonction du programme AML (politique ou document équivalent)\n - Vérifier que les documents contiennent un historique des révisions et que ces derniers ont fait l’objet d’une révision au cours des 24 derniers mois.\n\n",null,{"$f":"VLOOKUP(BH6,CategoryTranslationTable,2,FALSE)","v":"Requis Normal"},{"$f":"VLOOKUP(BI6,CategoryTranslationTable,2,FALSE)","v":"Requis"},{"$f":"$O6","v":"FraudRisk"},0,null,{"$f":"$AV6","v":"2"},{"$f":"$AW6","v":"2.1"},{"$f":"$AX6","v":"2.1.1"},null,{"$f":"$AZ6","v":"2.1.1.1"},null,{"$f":"$BB6","v":0},{"$f":"$BC6","v":"2.1.1.1.2"},"¿La revisión y actualización, cuando corresponda, de la política (o documento equivalente) de ALA/LFT se realiza, por lo menos, cada 24 meses?","1) Documentación que describe los objetivos y la función del programa ALD (o sea, política o documento equivalente)\n - Verificar si el documento contiene un registro histórico de las revisiones y que la fecha de la última revisión sea dentro de los últimos 24 meses.",null,"Obligatorio estándar","Obligatorio",{"$f":"$O6","v":"FraudRisk"},null,null,{"$f":"$AV6","v":"2"},{"$f":"$AW6","v":"2.1"},{"$f":"$AX6","v":"2.1.1"},null,{"$f":"$AZ6","v":"2.1.1.1"},null,{"$f":"$BB6","v":0},{"$f":"$BC6","v":"2.1.1.1.2"},null,null,null,"ReqS4","Req4",{"$f":"$O6","v":"FraudRisk"},null,null,null,null,null,null,null,null,"2.1.1.1.2",null,null,null,{"$f":"IF(OR($EA6=0,$EA6=2),VLOOKUP(DO6,INDIRECT(ED6),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP6),\"\",VLOOKUP(DP6,INDIRECT(EE6),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ6),\"\",VLOOKUP(DQ6,INDIRECT(EF6),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR6),\"\",VLOOKUP(DR6,INDIRECT(EG6),7,FALSE))","v":""},{"$f":"IF(OR($EA6=0,$EA6=2),VLOOKUP(DO6,INDIRECT(ED6),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP6),\"\",VLOOKUP(DP6,INDIRECT(EE6),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ6),\"\",VLOOKUP(DQ6,INDIRECT(EF6),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR6),\"\",VLOOKUP(DR6,INDIRECT(EG6),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN6,3)=\"NEW\")+2*AND(LEFT(DN6,3)=\"MER\")+3*AND(LEFT(DN6,3)=\"MOV\")+4*AND(LEFT(DN6,3)=\"SWA\")","v":0},{"$error":"#REF!"},{"$f":"IF(EA6=0,IF(DW6=0,\"\",DW6),CHOOSE(EA6,\"New indicator\",CONCATENATE(DW6,CarriageReturn,DX6,CarriageReturn,DY6,CarriageReturn,DZ6)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO6,1)","v":"OriginalComplianceP2"},{"$f":"\"OriginalComplianceP\"&LEFT(DP6,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ6,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR6,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,""]
[null,"2","2.1","2.1.1",0,"2.1.1.2",{"$f":"AZ7&\": \"&CHOOSE(LanguageNumber,BA7,BR7,CH7,CX7)","v":"2.1.1.2: AML/CFT PROCESS\nProviders should implement a suspicious activity management process for addressing suspected ML/TF activity. This process should provide clear guidelines about appropriate internal actions to be taken when suspicious patterns are detected, such as:\n- further investigation and monitoring;\n- account blocking.\n\nThe risk of each suspicious activity should be evaluated, and investigating higher-risk suspicious activities should be prioritised.\n\nAgents and employees should be provided with a mechanism to report suspicious activity, the details of which should be communicated to them. [This could be the same channel as used for reporting fraud, security incidents and data privacy breaches] \n\nConfirmed cases of ML/TF must be reported to the appropriate authorities via a formal Suspicious Activity Report (SAR) and/or Suspicious Transaction Report (STR). Providers should engage with relevant law enforcement agencies to facilitate reporting and/or investigation of mobile money-related criminal offences.\n"},"GSMA RMT","2.1.1.2.1","2.1.1.2.1: Has a suspicious activity management process been defined for dealing with suspected ML/TF activities?\n","1) Suspicious activity management process for identifying, investigating, actioning and reporting suspected ML/TF activity.\n- Check that the process has been documented.",0,"Urgent Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.1","2.1.1",null,"2.1.1.2","AML/CFT PROCESS\nProviders should implement a suspicious activity management process for addressing suspected ML/TF activity. This process should provide clear guidelines about appropriate internal actions to be taken when suspicious patterns are detected, such as:\n- further investigation and monitoring;\n- account blocking.\n\nThe risk of each suspicious activity should be evaluated, and investigating higher-risk suspicious activities should be prioritised.\n\nAgents and employees should be provided with a mechanism to report suspicious activity, the details of which should be communicated to them. [This could be the same channel as used for reporting fraud, security incidents and data privacy breaches] \n\nConfirmed cases of ML/TF must be reported to the appropriate authorities via a formal Suspicious Activity Report (SAR) and/or Suspicious Transaction Report (STR). Providers should engage with relevant law enforcement agencies to facilitate reporting and/or investigation of mobile money-related criminal offences.\n","GSMA RMT","2.1.1.2.1","2.1.1.2.1","Has a suspicious activity management process been defined for dealing with suspected ML/TF activities?","1) Suspicious activity management process for identifying, investigating, actioning and reporting suspected ML/TF activity.\n- Check that the process has been documented.",null,"Urgent Required","Required","FraudRisk",null,null,"2","2.1","2.1.1",0,"2.1.1.2","PROCESSUS AML/CFT\nLes prestataires doivent mettre en œuvre un processus de gestion des activités suspectes en cas de suspicion d’activité ML/TF. Ce processus doit fournir des directives précises quant aux mesures internes qu’il convient de prendre lorsque des activités suspectes sont détectées, telles que :\n- enquête et surveillance renforcée ;\n- blocage du compte.\n\nLe risque de toute activité suspecte doit être évalué. L'évaluation des activités suspectes présentant un risque plus important constitue une priorité.\n\nUn mécanisme de déclaration des activités suspectes doit être mis à la disposition des agents et du personnel et le détail de son fonctionnement doit leur être communiqué.  [Ce mécanisme peut être implémenté sur le même canal que celui utilisé pour signaler les cas de fraudes, les incidents relatifs à la sécurité et les violations de données]\n\nLes cas avérés de blanchiment de capitaux / financement du terrorisme doivent être déclarés aux autorités concernées par le biais d'une déclaration formelle d'opération suspecte (DOS), également appelée déclaration de soupçon. Les prestataires doivent coopérer avec les services compétents chargés de faire appliquer la loi pour faciliter les déclarations et/ou les enquêtes relatives aux infractions pénales liées à l’argent mobile.\n","GSMA RMT","2.1.1.2.1","un processus de gestion des activités suspectes a-t-il été défini en cas de suspicion d'activité ML/TF?","1) Processus de gestion des activités suspectes documenté pour identifier les suspicions d’activités ML/TF, enquêter, mettre en place les mesures nécessaires et établir les rapports appropriés.\n- Vérifier que le processus est documenté.",null,"Requis Prioritaire","Requis","FraudRisk",0,null,"2","2.1","2.1.1",null,"2.1.1.2","PROCESO DE ALA/LFT\nEl proveedor debe implementar un proceso para la gestión de actividades sospechosas a fin de responder ante toda actividad sospechosa de LD/FT. Este proceso debe proporcionar directrices claras sobre las acciones que deben tomarse a nivel interno cuando se detectan patrones de comportamiento sospechosos, tales como:\n- mayor investigación y monitoreo\n- bloqueo de cuentas.\n\nEl riesgo que implica cada actividad sospechosa debe ser evaluado y la investigación de actividades sospechosas de alto riesgo debe ser priorizada.\n\nSe debe proporcionar a agentes y empleados un mecanismo para reportar cualquier actividad sospechosa, comunicándoles todos los detalles pertinentes.  [Podría ser el mismo canal que el utilizado para reportar fraude, incidentes de seguridad y violaciones a la privacidad de los datos].  \n\nTodo caso confirmado de LD/FT debe ser reportado a la autoridad pertinente mediante la presentación formal de un Reporte de Actividad Sospechosa (RAS) y/o Reporte de Transacción Sospechosa (RTS). El proveedor debe colaborar con el organismo de seguridad a fin de facilitar la denuncia y/o investigación de los delitos relacionados con el dinero móvil. \n","GSMA RMT","2.1.1.2.1","?Se ha definido un proceso para la gestión de actividades sospechosas a fin de responder a actividades sospechosas de LD/FT?","1) Proceso de gestión de actividades sospechosas para la identificación, investigación, acción y reporte de actividades sospechosas de LD/FT\n- Verificar si el proceso ha sido documentado.",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,"2","2.1","2.1.1",null,"2.1.1.2",null,"GSMA RMT","2.1.1.2.1",null,null,null,"ReqU4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.1.1.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.1","2.1.1","","2.1.1.2",null,0,"2.1.1.2.2","2.1.1.2.2: Does the suspicious activity management process provide clear guidelines about appropriate actions to be taken (e.g. further investigation and monitoring, account blocking)?\n","1) Suspicious activity management process for identifying, investigating, actioning and reporting suspected ML/TF activity.\n\n- Check that this process includes:\n     1) How the report is received by the AML Unit\n     2) What additional information is obtained on the case\n     3) Who is responsible for the investigation\n     4) What actions must been taken for confirmed, not confirmed and inconclusive cases\n     5) Who approves the closure of the case\n",0,"Urgent Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.1","2.1.1","","2.1.1.2",null,null,"2.1.1.2.2","2.1.1.2.2","Does the suspicious activity management process provide clear guidelines about appropriate actions to be taken (e.g. further investigation and monitoring, account blocking)?","1) Suspicious activity management process for identifying, investigating, actioning and reporting suspected ML/TF activity.\n\n- Check that this process includes:\n     1) How the report is received by the AML Unit\n     2) What additional information is obtained on the case\n     3) Who is responsible for the investigation\n     4) What actions must been taken for confirmed, not confirmed and inconclusive cases\n     5) Who approves the closure of the case\n",null,"Urgent Required","Required","FraudRisk",null,null,"2","2.1","2.1.1","","2.1.1.2",0,0,"2.1.1.2.2","Le processus de gestion des activités suspectes fournit-il des directives claires quant aux mesures appropriées qu’il convient de prendre (par ex. enquête et surveillance renforcée, blocage du compte) ?","1) Processus de gestion des activités suspectes documenté pour identifier les suspicions d’activités ML/TF, enquêter, mettre en place les mesures nécessaires et établir les rapports appropriés.\n\n- Vérifier que ce processus définit les éléments suivants :\n1) La façon dont le rapport est reçu par la cellule AML\n2) Les informations supplémentaires obtenues en ce qui concerne le cas en question\n3) La personne chargée de l’enquête\n4) Les mesures devant être prises pour les cas avérés, non avérés ou non concluants \n5) La personne habilitée à clore le cas\n",null,"Requis Prioritaire","Requis","FraudRisk","Un \"processus adapté au niveau de risque\" signifie que le risque de chaque activité suspecte doit être évalué pour donner la priorité aux activités présentant le risque le plus élevé.",null,"2","2.1","2.1.1",null,"2.1.1.2",null,0,"2.1.1.2.2","¿El proceso de gestión de actividades sospechosas proporciona directrices claras sobre las acciones apropiadas a tomarse (por ej., más investigación y monitoreo, bloqueo de cuentas)?","1) Proceso de gestión de actividades sospechosas para la identificación, investigación, acción y reporte de actividades sospechosas de LD/FT\n\n- Verificar que el proceso incluya:\n     1) Cómo recibe el reporte la unidad de ALD\n     2) Que tipo de información adicional se obtiene sobre el caso\n     3) Quién es el responsable de la investigación\n     4) Qué acciones deben tomarse para los casos confirmados, no confirmados e inconclusos\n     5) Quién aprueba el cierre del caso",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,"2","2.1","2.1.1",null,"2.1.1.2",null,0,"2.1.1.2.2",null,null,null,"ReqU4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.1.1.2.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.1","2.1.1",0,"2.1.1.2",null,0,"2.1.1.2.3","2.1.1.2.3: Does the suspicious activity management process clearly define how Suspicious Activity Reports (SARs) and/or Suspicious Transaction Reports (STR) should be raised with the relevant authorities in the case of suspected ML/TF?\n","1) Documented suspicious activity management process for identifying, investigating, actioning and reporting suspected ML/TF activity.\n\n- Check that this process includes:\n     1) Who reports the SAR\n     2) Which organisation the SAR is sent to (local FIU)\n     3) How the report is submitted\n     4) Time lines for issuing report (if required)\n",0,"Urgent Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.1","2.1.1",null,"2.1.1.2",null,null,"2.1.1.2.3","2.1.1.2.3","Does the suspicious activity management process clearly define how Suspicious Activity Reports (SARs) and/or Suspicious Transaction Reports (STR) should be raised with the relevant authorities in the case of suspected ML/TF?","1) Documented suspicious activity management process for identifying, investigating, actioning and reporting suspected ML/TF activity.\n\n- Check that this process includes:\n     1) Who reports the SAR\n     2) Which organisation the SAR is sent to (local FIU)\n     3) How the report is submitted\n     4) Time lines for issuing report (if required)\n",null,"Urgent Required","Required","FraudRisk",null,null,"2","2.1","2.1.1",0,"2.1.1.2",0,0,"2.1.1.2.3","le processus de gestion des activités suspectes définit-il clairement les moyens de réaliser une déclaration d'opération suspecte (DOS) et/ou une déclaration de soupçon (DS) auprès des autorités concernées en cas de suspicion de blanchiment de capitaux / financement du terrorisme ?","1) Processus de gestion des activités suspectes documenté pour identifier les suspicions d’activités ML/TF, enquêter, mettre en place les mesures nécessaires et établir les rapports appropriés.\n\n-Vérifier que ce processus définit les éléments suivants :\n1) La personne à l’origine de la DOS\n2) L’organisation à laquelle la DOS est transmise (CRF locale)\n3) La façon dont le rapport est transmis\n4) Les différentes échéances pour l’émission du rapport (si nécessaire)\n",null,"Requis Prioritaire","Requis","FraudRisk","Les cas avérés de blanchiment de capitaux / financement du terrorisme doivent être déclarés aux autorités concernées par le biais d'une déclaration formelle d'opération suspecte (DOS), également appelée déclaration de soupçon. Les prestataires doivent être en contact avec les services compétents chargés de faire appliquer la loi pour faciliter les déclarations et/ou les enquêtes relatives aux infractions pénales liées à l’argent mobile.",null,"2","2.1","2.1.1",null,"2.1.1.2",null,0,"2.1.1.2.3","¿El proceso de gestión de actividades sospechosas define claramente cómo deben elevarse los Reportes de Actividades Sospechosas (RAS) o Reportes de Transacciones Sospechosas (RTS) a las autoridades correspondientes en caso de sospecha de LD/FT?","1) Proceso de gestión de actividades sospechosas para la identificación, investigación, acción y reporte de actividades sospechosas de LD/FT\n\n- Verificar que el proceso incluya:\n     1) Quién es responsable de reportar el RAS\n     2) A qué organismo se debe enviar el RAS (Unidad de Inteligencia Financiera —UIF— local).\n     3) Cómo se presentar el reporte\n     4) Periodos de tiempo para emitir el reporte (si corresponde)",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,"2","2.1","2.1.1",null,"2.1.1.2",null,0,"2.1.1.2.3",null,null,null,"ReqU4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.1.1.2.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.1","2.1.1","","2.1.1.2",null,0,"2.1.1.2.4","2.1.1.2.4: Is there a mechanism for agents and employees to report suspicious activity (ML,TF), and are they made aware of this reporting channel? \n[This could be the same channel as used for reporting fraud, security incidents and data privacy breaches]\n","1) Documented mechanism for agents and employees to report suspicious activities (e.g. phone line).\n- Check the reporting channel is available to all agents and employees by reviewing the processes.\n- Check that the suspicious activity reporting channel is practical and availed to all.\n\n2) Documentation showing how agents and staff are made aware of the suspicious activity reporting channel (e.g. training material, emails. SMS broadcasts, posters, agent handbook, awareness campaign).\n- Check the staff and agents have been made aware of the suspicious activity reporting channel and their responsibility to report suspicions.\n",0,"Urgent Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.1","2.1.1","","2.1.1.2",null,null,"2.1.1.2.4","2.1.1.2.4","Is there a mechanism for agents and employees to report suspicious activity (ML,TF), and are they made aware of this reporting channel? \n[This could be the same channel as used for reporting fraud, security incidents and data privacy breaches]","1) Documented mechanism for agents and employees to report suspicious activities (e.g. phone line).\n- Check the reporting channel is available to all agents and employees by reviewing the processes.\n- Check that the suspicious activity reporting channel is practical and availed to all.\n\n2) Documentation showing how agents and staff are made aware of the suspicious activity reporting channel (e.g. training material, emails. SMS broadcasts, posters, agent handbook, awareness campaign).\n- Check the staff and agents have been made aware of the suspicious activity reporting channel and their responsibility to report suspicions.\n",null,"Urgent Required","Required","FraudRisk",null,null,"2","2.1","2.1.1","","2.1.1.2",0,0,"2.1.1.2.4","Les agents et le personnel disposent-ils d’un mécanisme de déclaration des activités suspectes, et ont-ils été informés de l’existence de ce canal de déclaration ? [Ce mécanisme peut être implémenté sur le même canal que celui utilisé pour signaler les cas de fraudes, les incidents relatifs à la sécurité et les violations de données]","1) Mécanisme documenté pour la déclaration des activités suspectes par les agents et le personnel (par exemple, une ligne téléphonique).\n- Vérifier, par l’examen des processus, qu’un canal de déclaration est mis à la disposition de l’ensemble des agents et du personnel\n- Vérifier que le canal de déclaration des activités suspectes est facile d’utilisation et accessible à tous\n\n2) Documentation présentant la façon dont les agents et le personnel sont informés de l’existence et de l’utilisation du canal de déclaration des activités suspectes (par exemple, supports de formation, envoi groupé d’e-mails, de SMS, affiches, manuel destiné aux agents, campagne de sensibilisation).\n- Vérifier que le personnel et les agents ont été informés de l’existence du canal de déclaration des activités suspectes et de leur responsabilité en matière de déclaration de suspicion d’activités ML/TF.\n",null,"Requis Prioritaire","Requis","FraudRisk",0,null,"2","2.1","2.1.1",null,"2.1.1.2",null,0,"2.1.1.2.4","¿Existe un mecanismo para que agentes y empleados reporten cualquier actividad sospechosa (LD, FT) y se les ha informado la existencia de este canal para reportes? \n[Podría ser el mismo canal que el utilizado para reportar fraude, incidentes de seguridad y violaciones a la privacidad de los datos].","1) Mecanismo documentado para que agentes y empleados reporten actividades sospechosas (por ej., línea telefónica).\n- Verificar que el canal de reporte está disponible para todos los agentes y empleados mediante la revisión de los procesos.\n- Verificar que el canal de reporte de actividades sospechosas resulta práctico y está disponible para todos\n\n2) Documentación que demuestra que los agentes y el personal han sido informados sobre el canal de reporte de actividades sospechosas (p.e., material de capacitación, correos electrónicos, Distribución de SMS, afiches, manual de agentes, campañas de concientización).\n- Verificar si se ha informado al personal y los agentes sobre el canal de reporte de actividades sospechosas y su obligación de reportar dichas sospechas.",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,"2","2.1","2.1.1",null,"2.1.1.2",null,0,"2.1.1.2.4",null,null,null,"ReqU4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.1.1.2.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.1","2.1.1","","2.1.1.3","2.1.1.3: AUDIT OF AML/CFT FUNCTION\nProviders should carry out an independent audit every two years to evaluate efficacy of AML/CFT procedures. Auditors could be internal and/or external, provided that they are independent.\n\nThe findings of the audit should be prioritized appropriately. The AML/CFT manager should ensure that the recommendations are implemented promptly.","GSMA RMT","2.1.1.3.1","2.1.1.3.1: Is a regular independent audit carried out (at least every two years) to evaluate efficacy of AML/CFT procedures?\n","1) Most recent AML/CFT audit report (header page)\n- Check the date of the audit is within the last two years.\n- Check that the audit was carried out by either the providers own internal audit function, or a suitable external body.\n\n2) AML/CFT audit plan or process - this is suitable evidence if the provider has been operating for less than two years.\n- Check that the plan shows an AML/CFT audit planned within two years of the launch of the mobile money service.\n- Check that the audit will be carried out by either the providers own internal audit function, or a suitable external body.",0,"Urgent Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.1","2.1.1","","2.1.1.3","AUDIT OF AML/CFT FUNCTION\nProviders should carry out an independent audit every two years to evaluate efficacy of AML/CFT procedures. Auditors could be internal and/or external, provided that they are independent.\n\nThe findings of the audit should be prioritized appropriately. The AML/CFT manager should ensure that the recommendations are implemented promptly.","GSMA RMT","2.1.1.3.1","2.1.1.4.1","Is a regular independent audit carried out (at least every two years) to evaluate efficacy of AML/CFT procedures?","1) Most recent AML/CFT audit report (header page)\n- Check the date of the audit is within the last two years.\n- Check that the audit was carried out by either the providers own internal audit function, or a suitable external body.\n\n2) AML/CFT audit plan or process - this is suitable evidence if the provider has been operating for less than two years.\n- Check that the plan shows an AML/CFT audit planned within two years of the launch of the mobile money service.\n- Check that the audit will be carried out by either the providers own internal audit function, or a suitable external body.",null,"Urgent Required","Required","FraudRisk",null,null,"2","2.1","2.1.1","","2.1.1.3","AUDIT DE LA FONCTION AML/CFT\nLes prestataires doivent mettre en place un système d'audit indépendant du respect et de l'efficacité des procédures de lutte contre le blanchiment de capitaux et le financement du terrorisme. Les auditeurs peuvent être internes ou externes, à la condition qu'ils soient indépendants.\n\nLes conclusions de l'audit doivent avoir la priorité qui s'impose. Le responsable AML/CFT doit veiller à la mise en œuvre rapide des recommandations de l'audit.\nLes audits doivent être effectués au minimum une fois tous les deux ans. ","GSMA RMT","2.1.1.3.1","Un audit indépendant régulier (tous les deux ans au minimum) est-il mené afin d'évaluer l’efficacité des procédures de lutte contre le blanchiment de capitaux et le financement du terrorisme ?","1) Dernier rapport d’audit AML/CFT (page d’en-tête)\n- Vérifier que l’audit est daté de moins de deux ans.\n- Vérifier que l’audit a été réalisé par la fonction audit interne des prestataires ou par un organisme externe approprié.\n\n2) Plan ou processus d’audit AML/CFT - il s’agit là d’un justificatif approprié si le prestataire exerce ses activités depuis moins de deux ans.\n- Vérifier que le plan prévoit la réalisation d’un audit AML/CFT dans les deux ans suivant le lancement du service d’argent mobile.\n- Vérifier que le plan prévoit la réalisation d’un audit par la fonction audit interne des prestataires ou par un organisme externe approprié.",null,"Requis Prioritaire","Requis","FraudRisk",0,null,"2","2.1","2.1.1",null,"2.1.1.3","AUDITORÍA DEL DEPARTAMENTO DE ALA/LFT\nEl proveedor debe llevar a cabo una auditoría independiente cada dos años a fin de evaluar la efectividad de los procedimientos de ALA/LFT. Los auditores pueden ser internos y/o externos, siempre que sean independientes.\n\nLas conclusiones de la auditoría deben priorizarse correctamente. El gerente de ALA/LFT debe garantizar la implementación inmediata de las recomendaciones.","GSMA RMT","2.1.1.3.1","¿Se llevan a cabo auditorías periódicas (por lo menos cada dos años) e independientes a fin de evaluar la efectividad de los procedimientos de ALA/LFT?","1) Reporte de auditoría de ALA/LFT más reciente (página de encabezamientos)\n- Verificar que la fecha de la auditoría sea en los últimos dos años.\n- Verificar que la auditoría haya sido realizada por el departamento interno de auditoría del proveedor o por una entidad externa apropiada.\n\n2) El proceso o plan de auditoría de ALA/LFT – este requisito de presentación de documentación aplica si las operaciones del proveedor tienen menos de dos años.\n- Verificar que el plan incluya la planificación de una auditoría de ALA/LFT dentro de los dos años posteriores al lanzamiento del servicio del dinero móvil\n- Verificar que la auditoría sea realizada por el departamento interno de auditoría del proveedor o por una entidad externa apropiada.",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,"2","2.1","2.1.1",null,"2.1.1.3",null,"GSMA RMT","2.1.1.3.1",null,null,null,"ReqU4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.1.1.4.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.1","2.1.1","","2.1.1.3",null,0,"2.1.1.3.2","2.1.1.3.2: Are audit findings prioritized, implemented and reviewed, with supervision from AML/CFT manager?\n","1) Most recent  AML/CFT audit report\n- Check that agreed actions for audit findings have been prioritised and implemented.\n\n2) AML/CFT audit plan or process - this is suitable evidence if the provider is unwilling to share contents of audit report.\n- Check that the MLRO has access to all the reports and actions updates.\n- Check that there is a process to prioritise and implement all audit actions and findings.",0,"Urgent Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.1","2.1.1","","2.1.1.3",null,null,"2.1.1.3.2","2.1.1.4.2","Are audit findings prioritized, implemented and reviewed, with supervision from AML/CFT manager?","1) Most recent  AML/CFT audit report\n- Check that agreed actions for audit findings have been prioritised and implemented.\n\n2) AML/CFT audit plan or process - this is suitable evidence if the provider is unwilling to share contents of audit report.\n- Check that the MLRO has access to all the reports and actions updates.\n- Check that there is a process to prioritise and implement all audit actions and findings.",null,"Urgent Required","Required","FraudRisk",null,null,"2","2.1","2.1.1","","2.1.1.3",0,0,"2.1.1.3.2","les conclusions d'audit sont-elles examinées et mises en œuvre avec le niveau de priorité nécessaire, sous la supervision du responsable AML/CFT ?","1) Dernier rapport d’audit AML/CFT\n- Vérifier que les mesures convenues en ce qui concerne les conclusions d’audit ont été mises en œuvre avec le niveau de priorité nécessaire.\n\n2) Plan ou processus d’audit AML/CFT - il s’agit là d’un justificatif approprié si le prestataire ne souhaite pas divulguer le contenu du rapport d’audit\n- Vérifier que le Responsable anti-blanchiment a accès à l’ensemble des rapports et des mises à jour des mesures concernées.\n- Vérifier qu’un processus a été mis en place afin de mettre en œuvre l’ensemble des actions et des conclusions d’audit avec le niveau de priorité nécessaire.",null,"Requis Prioritaire","Requis","FraudRisk",0,null,"2","2.1","2.1.1",null,"2.1.1.3",null,0,"2.1.1.3.2","¿Las conclusiones de las auditorías son priorizadas, implementadas y revisadas con la supervisión del gerente de ALA/LFT?","1) Reporte de auditoría de ALA/LFT más reciente\n- Verificar que las acciones acordadas en las conclusiones de la auditoría se prioricen e implementen.\n\n2) El proceso o plan de auditoría de ALA/LFT - este requisito de presentación de documentación aplica si el proveedor está renuente a presentar los contenidos del Reporte de auditoría.\n- Verificar el acceso del Oficial de Reporte de lavado de activos (ORLD) a todos los reportes y actualización de acciones.\n- Verificar la existencia de un proceso que priorice e implemente todas las acciones y conclusiones de la auditoría.",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,"2","2.1","2.1.1",null,"2.1.1.3",null,0,"2.1.1.3.2",null,null,null,"ReqU4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.1.1.4.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.1","2.1.1","","2.1.1.4","2.1.1.4: AML/CFT RECORDS\nRecords relevant to AML/CFT should be kept for a period determined by regulation or risk assessment, whichever is longer. FATF recommends that records be kept for a minimum of five years, either physically or electronically (or both). The following records should be kept as a minimum:\n- Customer/agent identification records;\n- Transaction records of all successful and failed transactions (refer to 5.3.6.2 - audit trails);\n- Suspicious activity reports (internal reports and external SARs/ STRs);\n- Policies and procedures, including previous versions of documentation with dates.","GSMA RMT (FR.P-07)","2.1.1.4.1","2.1.1.4.1: Have AML/CFT record-keeping processes and system functions been implemented?\n","1) Record management process/documentation for AML/CFT records\n- Check that the processes have been implemented.\n",0,"Standard Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.1","2.1.1","","2.1.1.4","AML/CFT RECORDS\nRecords relevant to AML/CFT should be kept for a period determined by regulation or risk assessment, whichever is longer. FATF recommends that records be kept for a minimum of five years, either physically or electronically (or both). The following records should be kept as a minimum:\n- Customer/agent identification records;\n- Transaction records of all successful and failed transactions (refer to 5.3.6.2 - audit trails);\n- Suspicious activity reports (internal reports and external SARs/ STRs);\n- Policies and procedures, including previous versions of documentation with dates.","GSMA RMT (FR.P-07)","2.1.1.4.1","2.1.1.5.1","Have AML/CFT record-keeping processes and system functions been implemented?","1) Record management process/documentation for AML/CFT records\n- Check that the processes have been implemented.\n",null,"Standard Required","Required","FraudRisk",null,null,"2","2.1","2.1.1","","2.1.1.4","REGISTRES AML/CFT\nLes registres relatifs à la lutte contre le blanchiment de capitaux et le financement du terrorisme doivent être conservés pour la durée la plus longue de celles fixées par la réglementation et par l'évaluation des risques. Le GAFI recommande que les registres soient conservés pendant cinq ans au minimum, que ce soit sous forme physique ou électronique (ou les deux). Il convient de conserver au minimum les registres suivants:\n- vérification de l'identité des clients /agents ;\n- opérations réalisées et avortées (cf. 5.3.6.2 - pistes d'audit);\n- déclarations d'opérations suspectes (rapports internes et DOS/DS externes) ;\n- politiques et procédures,y compris les versions antérieures datées de ces documents.","GSMA RMT (FR.P-07)","2.1.1.4.1","Des processus et fonctionnalités de système pour la gestion des registres AML/CFT ont-ils été mis en œuvre ?","1) Processus/documentation de gestion des registres pour registres AML/CFT\n- Vérifier que les processus ont été mis en œuvre.\n",null,"Requis Normal","Requis","FraudRisk",0,null,"2","2.1","2.1.1",null,"2.1.1.4","REGISTROS ALA/LFT\nTodo documento relevante a los fines de ALA/LFT debe ser guardado por el periodo determinado por la regulación o la evaluación de riesgo, aplicándose el que sea mayor. GAFI recomienda mantener los registros por un periodo mínimo de cinco años, ya sea en formato físico o electrónico, o ambos. Como mínimo, se deben mantener los siguientes registros:\n- Registros de identificación de clientes/agentes;\n- Registros de todas las transacciones exitosas y fallidas (ver punto 5.3.6.2 - registros de auditoría);\n- Reportes de actividades sospechosas (reportes internos y RAS/RTS externos);\n- Políticas y procedimientos, incluidas versiones anteriores de la documentación con fechas.","GSMA RMT (FR.P-07)","2.1.1.4.1","¿Se han implementado procesos y funcionalidades de sistemas para el mantenimiento de registros de ALA/LFT?","1) Gestión de registros de procesos y documentación relacionados con ALA/LFT\n- Verificar la implementación de los procesos.",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,"2","2.1","2.1.1",null,"2.1.1.4",null,"GSMA RMT (FR.P-07)","2.1.1.4.1",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.1.1.5.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.1","2.1.1","","2.1.1.4",null,0,"2.1.1.4.2","2.1.1.4.2: Are all suspicious activity reports being kept for both internal and externally-reported SARs/ STRs?\n","1) Suspicious activity management record log\n- Check that internal and externally reported SARs/STRs are stored securely and accessible to the MLRO.\n(Note: there may be providers that have legitimately not received any SARs/STRs - in which case the proposed process should be checked).",0,"Urgent Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.1","2.1.1","","2.1.1.4",null,null,"2.1.1.4.2","2.1.1.5.3","Are all suspicious activity reports being kept for both internal and externally-reported SARs/ STRs?","1) Suspicious activity management record log\n- Check that internal and externally reported SARs/STRs are stored securely and accessible to the MLRO.\n(Note: there may be providers that have legitimately not received any SARs/STRs - in which case the proposed process should be checked).",null,"Urgent Required","Required","FraudRisk",null,null,"2","2.1","2.1.1","","2.1.1.4",0,0,"2.1.1.4.2","les rapports d'activités suspectes sont-ils tous conservés, que ce soit pour les DOS/DS externes ou internes ?","1) Registre de gestion des activités suspectes\n- Vérifier que les DOS/DS internes et externes sont conservées en toute sécurité et peuvent être consultées par le Responsable anti-blanchiment.\n(Remarque : certains prestataires n’ont légitimement reçu aucune DOS/DS, auquel cas le processus proposé doit faire l’objet d’une vérification).",null,"Requis Prioritaire","Requis","FraudRisk",0,null,"2","2.1","2.1.1",null,"2.1.1.4",null,0,"2.1.1.4.2","¿Todos los reportes sobre actividades sospechosas, tanto internos como externos (RAS/RTS), son guardados?","1) Registro de gestión de actividades sospechosas\n- Verificar que los reportes, tanto internos como externos (RAS/RTS), son guardados de forma segura y son accesibles para el ORLD.\n(Nota: puede suceder que haya proveedores que legítimamente no hayan recibido ningún RAS/RTS, en cuyo caso el proceso propuesto debe darse por verificado.",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,"2","2.1","2.1.1",null,"2.1.1.4",null,0,"2.1.1.4.2",null,null,null,"ReqU4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.1.1.5.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.1","2.1.1","","2.1.1.4",null,0,"2.1.1.4.3","2.1.1.4.3: Are copies of all current and prior AML/CFT-related policies and processes being kept, including dates where they were in operation?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.1","2.1.1","","2.1.1.4",null,null,"2.1.1.4.3","2.1.1.5.4","Are copies of all current and prior AML/CFT-related policies and processes being kept, including dates where they were in operation?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.1","2.1.1","","2.1.1.4",0,0,"2.1.1.4.3","un exemplaire de chaque politique et procédure relative à la lutte contre le blanchiment de capitaux et le financement du terrorisme est-il conservé avec ses dates d'application ?",null,null,"Recommandé",{"$f":"VLOOKUP(BI15,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},"FraudRisk",0,null,"2","2.1","2.1.1",null,"2.1.1.4",null,0,"2.1.1.4.3","¿Se mantienen copias de las políticas y procesos, tanto actuales como anteriores, relacionados con ALA/LFT, incluidas las fechas en las que estuvieron en funcionamiento?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.1","2.1.1",null,"2.1.1.4",null,0,"2.1.1.4.3",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.1.1.5.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,0,0,0,{"$f":"UPPER(CONCATENATE(Introduction!C8,\": \",Introduction!D8))","v":"2.2: SENIOR MANAGEMENT COMMITMENT TO AML/CFT"},null,null,0,null,{"$f":"Introduction!E8","v":" Senior management shall demonstrate their commitment to AML/CFT compliance through proper oversight"},null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,BK16,CA16,CQ16,DG16)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$8,\": \",Introduction!$L$8))","v":"2.2: SENIOR MANAGEMENT COMMITMENT TO AML/CFT"},null,null,null,null,null,{"$f":"Introduction!$M$8","v":" Senior management shall demonstrate their commitment to AML/CFT compliance through proper oversight"},null,null,null,null,0,null,null,0,0,0,null,null,null,null,null,null," ",null,null,null,0,null,null,0,0,0,{"$f":"UPPER(CONCATENATE(Introduction!$U$8,\": \",Introduction!$V$8))","v":"2.2: COMPROMISO DEL PERSONAL DIRECTIVO SUPERIOR CON ALD/LFT"},null,null,null,null,{"$f":"Introduction!W8","v":"El personal directivo superior demostrará su compromiso con el cumplimiento de las normas ALD/CFT mediante la supervisión adecuada"},null,null,{"$error":"#N/A"},{"$error":"#N/A"},0,null,null,0,0,0,null,0,0,0,0,null,null,null,null,null,0]
[null,"2","2.2","2.2.1",{"$f":"CHOOSE(LanguageNumber,AY17,BP17,CF17,CV17)","v":"2.2.1: Senior management shall demonstrate their commitment to AML/CFT compliance through proper oversight"},"2.2.1.1",{"$f":"AZ17&\": \"&CHOOSE(LanguageNumber,BA17,BR17,CH17,CX17)","v":"2.2.1.1: AML/CFT COMPLIANCE DEPARTMENT\nSenior management should establish a compliance function that should fulfil the following criteria:\n- be independent of all operational and business functions; \n- report directly to senior management; \n- have sufficient management seniority and authority to enforce AML/CFT policies (able to influence functional managers to make necessary changes);\n- be sufficiently funded to implement effective AML/CFT procedures."},"GSMA RMT (FR.O-02\nFR.O-03)",{"$f":"BC17","v":"2.2.1.1.1"},{"$f":"BC17&\": \"&CHOOSE(LanguageNumber,BE17,BU17,CK17,DA17)&CarriageReturn","v":"2.2.1.1.1: Has an AML/CFT compliance function been established?\n"},{"$f":"CHOOSE(LanguageNumber,BF17,BV17,CL17,DB17)","v":"1) AML/CFT Organisation chart \n- Check the organisation chart contains the MLRO and support staff.\n\n2) Documentation that describes the objective and function of the AML programme (i.e. policy or equivalent document)\n- Check that provison has been made for an MLRO and support staff  \n(note: this might be contained in the roles and responsibilites section)."},0,"Urgent Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.2","2.2.1","2.2.1: Senior management shall demonstrate their commitment to AML/CFT compliance through proper oversight","2.2.1.1","AML/CFT COMPLIANCE DEPARTMENT\nSenior management should establish a compliance function that should fulfil the following criteria:\n- be independent of all operational and business functions; \n- report directly to senior management; \n- have sufficient management seniority and authority to enforce AML/CFT policies (able to influence functional managers to make necessary changes);\n- be sufficiently funded to implement effective AML/CFT procedures.","GSMA RMT (FR.O-02\nFR.O-03)","2.2.1.1.1","2.2.1.1.1","Has an AML/CFT compliance function been established?","1) AML/CFT Organisation chart \n- Check the organisation chart contains the MLRO and support staff.\n\n2) Documentation that describes the objective and function of the AML programme (i.e. policy or equivalent document)\n- Check that provison has been made for an MLRO and support staff  \n(note: this might be contained in the roles and responsibilites section).",null,"Urgent Required","Required","FraudRisk",null,null,"2","2.2","2.2.1","2.2.1: La direction générale doit manifester son engagement à l’égard de la lutte contre le blanchiment de capitaux et le financement du terrorisme (AML/CFT) à travers une surveillance adaptée.","2.2.1.1","DÉPARTEMENT CONFORMITÉ AML/CFT \nLa direction générale doit mettre en place une fonction de conformité AML/CFT qui respecte les critères suivants : \n- indépendance vis-à-vis de l'ensemble des fonctions opérationnelles ou de support ; \n- rattachée directement à la direction générale ; \n- a le niveau hiérarchique et l'autorité nécessaires pour faire appliquer les politiques AML/CFT (peut influer sur les activités des responsables de chaque fonction afin d'assurer la concrétisation des changements nécessaires) ;\n- a des ressources financières suffisantes pour mettre en œuvre des procédures AML/CFT efficaces.","GSMA RMT (FR.O-02\nFR.O-03)","2.2.1.1.1","une fonction de conformité AML/CFT a-t-elle été mise en place ?","1) Organigramme AML/CFT \n- Vérifier que l’organigramme comprend un Responsable anti-blanchiment et le personnel auxiliaire\n\n2) Documentation décrivant l’objectif et la fonction du programme AML (politique ou document équivalent)\n- Vérifier que des dispositions ont été prises pour la nomination d’un Responsable anti-blanchiment et du personnel auxiliaire \n(remarque : cet élément peut être intégré au chapitre relatif aux rôles et responsabilités).",null,{"$f":"VLOOKUP(BH17,CategoryTranslationTable,2,FALSE)","v":"Requis Prioritaire"},"Requis","FraudRisk",0,null,"2","2.2","2.2.1","2.2.1: el personal directivo debe demostrar su compromiso con el cumplimiento de las normas ALA/LFT mediante la supervisión adecuada.","2.2.1.1","DEPARTAMENTO DE CUMPLIMIENTO DE LAS NORMAS ALA/LFT\nEl personal directivo debe establecer un departamento de cumplimiento que cumpla con los siguientes requisitos:\n- ser independiente de todas las funciones operativas y comerciales; \n- reportar directamente al personal directivo; \n- tener suficiente autoridad y antigüedad como gerente para aplicar las políticas de ALA/LFT (tener influencia sobre los gerentes funcionales para implementar los cambios necesarios);\n- contar con suficientes fondos para implementar procedimientos eficaces de ALA/LFT.  ","GSMA RMT (FR.O-02\nFR.O-03)","2.2.1.1.1","¿Se ha establecido la función de cumplimento de las normas de ALA/LFT?","1) Organigrama del departamento de ALA/LFT \n- Verificar que el organigrama incluya al ORLD y personal de apoyo.\n\n2) Documentación que describe los objetivos y la función del programa ALD (o sea, política o documento equivalente)\n- Verificar que se haya previsto un ORLD y su personal de apoyo  \n(nota: esto puede estar contenido en la sección de roles y responsabilidades).",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,"2","2.2","2.2.1",null,"2.2.1.1",null,"GSMA RMT (FR.O-02\nFR.O-03)","2.2.1.1.1",null,null,null,{"$f":"VLOOKUP($BH17,CategoryTranslationTable,4,FALSE)","v":"ReqU4"},{"$f":"VLOOKUP($BI17,CategoryTranslationTable,4,FALSE)","v":"Req4"},"FraudRisk",null,null,null,null,null,null,null,null,"2.2.1.1.1",null,null,null,{"$f":"IF(OR($EA17=0,$EA17=2),VLOOKUP(DO17,INDIRECT(ED17),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP17),\"\",VLOOKUP(DP17,INDIRECT(EE17),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ17),\"\",VLOOKUP(DQ17,INDIRECT(EF17),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR17),\"\",VLOOKUP(DR17,INDIRECT(EG17),7,FALSE))","v":""},{"$f":"IF(OR($EA17=0,$EA17=2),VLOOKUP(DO17,INDIRECT(ED17),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP17),\"\",VLOOKUP(DP17,INDIRECT(EE17),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ17),\"\",VLOOKUP(DQ17,INDIRECT(EF17),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR17),\"\",VLOOKUP(DR17,INDIRECT(EG17),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN17,3)=\"NEW\")+2*AND(LEFT(DN17,3)=\"MER\")+3*AND(LEFT(DN17,3)=\"MOV\")+4*AND(LEFT(DN17,3)=\"SWA\")","v":0},{"$f":"IF(EA17=0,DS17,EN17)","v":{"$error":"#REF!"}},{"$f":"IF(EA17=0,IF(DW17=0,\"\",DW17),CHOOSE(EA17,\"New indicator\",CONCATENATE(DW17,CarriageReturn,DX17,CarriageReturn,DY17,CarriageReturn,DZ17)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO17,1)","v":"OriginalComplianceP2"},{"$f":"\"OriginalComplianceP\"&LEFT(DP17,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ17,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR17,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,""]
[null,"2","2.2","2.2.1",0,"2.2.1.1",null,0,"2.2.1.1.2","2.2.1.1.2: Is the AML/CFT compliance function independent of all operational and business functions and does it report directly to senior management?\n","1)  AML/CFT Organisation chart \n- Check the organisation chart to see that the reporting line is to a suitably 'independent' directorate.\n- Check the reporting line of the MLRO/AML Officer is to a senior manager (e.g. Director level)",0,"Standard Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.2","2.2.1",null,"2.2.1.1",null,null,"2.2.1.1.2","2.2.1.1.2","Is the AML/CFT compliance function independent of all operational and business functions and does it report directly to senior management?","1)  AML/CFT Organisation chart \n- Check the organisation chart to see that the reporting line is to a suitably 'independent' directorate.\n- Check the reporting line of the MLRO/AML Officer is to a senior manager (e.g. Director level)",null,"Standard Required","Required","FraudRisk",null,null,"2","2.2","2.2.1",0,"2.2.1.1",0,0,"2.2.1.1.2","la fonction de conformité AML/CFT est-elle indépendante des autres fonctions opérationnelles ou de support de l'activité ?","1) Organigramme AML/CFT\n- Vérifier l’organigramme afin de s’assurer que les informations sont remontées vers une direction suffisamment \"indépendante\" \n- Vérifier que la remontée d’informations par le Responsable anti-blanchiment/AML se fait vers un haut responsable (par exemple, un directeur)",null,"Requis Normal","Requis","FraudRisk",0,null,"2","2.2","2.2.1",null,"2.2.1.1",null,0,"2.2.1.1.2","¿La función de cumplimiento de las normas de ALA/LFT es independiente de las funciones operativas y comerciales? ¿Reporta directamente al personal directivo?","1) Organigrama del departamento de ALA/LFT \n- Verificar el organigrama para confirmar que la línea de reporte está adecuadamente establecida en una dirección «independiente».\n- Verificar que la línea de reporte del Oficial de ORLD/ALD es a personal directivo (por ej., nivel de director).",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,"2","2.2","2.2.1",null,"2.2.1.1",null,0,"2.2.1.1.2",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,"MERGE","2.2.1.1.2","2.2.1.1.3",null,null,{"$error":"#REF!"},{"$error":"#REF!"},"","",{"$error":"#REF!"},{"$error":"#REF!"},"","",2,"",{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,2,""]
[null,"2","2.2","2.2.1",0,"2.2.1.1",null,0,"2.2.1.1.3","2.2.1.1.3: Does the Head of AML/CFT compliance have sufficient management seniority and authority to enforce AML/CFT policies (able to influence functional managers to make necessary changes)?\n","1)  Role description for Money Laundering Reporting Officer (MLRO) or equivalent\n- Check the banding/grade/rank is sufficiently senior to able to influence functional managers.\n\n2) Documentation that describes the objective and function of the AML programme (i.e. policy or equivalent document)\n- Check that the documents give the MLRO/AML officer the authority to implement effective AML/CFT policies, procedures and systems.",0,"Urgent Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.2","2.2.1",null,"2.2.1.1",null,null,"2.2.1.1.3","2.2.1.1.4","Does the Head of AML/CFT compliance have sufficient management seniority and authority to enforce AML/CFT policies (able to influence functional managers to make necessary changes)?","1)  Role description for Money Laundering Reporting Officer (MLRO) or equivalent\n- Check the banding/grade/rank is sufficiently senior to able to influence functional managers.\n\n2) Documentation that describes the objective and function of the AML programme (i.e. policy or equivalent document)\n- Check that the documents give the MLRO/AML officer the authority to implement effective AML/CFT policies, procedures and systems.",null,"Urgent Required","Required","FraudRisk",null,null,"2","2.2","2.2.1",0,"2.2.1.1",0,0,"2.2.1.1.3","le responsable de la fonction de conformité AML/CFT a-t-il le niveau hiérarchique et l'autorité nécessaires pour faire appliquer les politiques AML/CFT capacité à influer sur les activités des responsables de chaque fonction afin d'assurer la concrétisation des changements nécessaires) ?","1) Descriptif du poste de Responsable anti-blanchiment ou fonction équivalente\n- Vérifier que son niveau hiérarchique est suffisant pour influer sur les activités des responsables de chaque fonction. \n\n2) Documentation décrivant l’objectif et la fonction du programme AML (politique ou document équivalent)\n- Vérifier que les documents confèrent au Responsable anti-blanchiment/AML l’autorité de mettre en œuvre des politiques, procédures et systèmes AML/CFT efficaces.",null,"Requis Prioritaire","Requis","FraudRisk",0,null,"2","2.2","2.2.1",null,"2.2.1.1",null,0,"2.2.1.1.3","¿El director de cumplimiento de ALA/LFT tiene suficiente autoridad y antigüedad como gerente para aplicar las políticas de ALA/LFT (tener influencia sobre los gerentes funcionales para implementar los cambios necesarios)?","1) Descripción de las responsabilidades del Oficial de Reporte de lavado de activos (ORLD) o equivalente\n- Verificar que la categoría, grado o rango tenga antigüedad suficiente para tener influencia sobre los gerentes funcionales.\n\n2) Documentación que describe los objetivos y la función del programa ALA (o sea, política o documento equivalente)\n- Verificar que los documentos confieran al Oficial OLRD/ALA la autoridad necesaria para implementar políticas, procedimientos y sistemas eficaces de ALA/LFT.",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,"2","2.2","2.2.1",null,"2.2.1.1",null,0,"2.2.1.1.3",null,null,null,"ReqU4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.2.1.1.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.2","2.2.1",0,"2.2.1.1",null,0,"2.2.1.1.4","2.2.1.1.4: Is the AML/CFT compliance department sufficiently funded to implement effective AML/CFT policies, procedures and systems (as described in this toolkit)?\n","1)  AML/CFT Organisation chart \n- Check AML team head count is sufficient to carry out the operational requirements\n(Note 1: The size of the AML team should be proportionate to the size, complexity and risk profile of the business.)\n(Note 2: Head count might sit in different teams, or shared services centres - these staff should be included when assessing head count)\n(Note 3: assessment of sufficient head count might also be made by reviewing the MLRO's (or equivalent) assessment of resourcing)",0,"Urgent Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.2","2.2.1",null,"2.2.1.1",null,null,"2.2.1.1.4","2.2.1.1.5","Is the AML/CFT compliance department sufficiently funded to implement effective AML/CFT policies, procedures and systems (as described in this toolkit)?","1)  AML/CFT Organisation chart \n- Check AML team head count is sufficient to carry out the operational requirements\n(Note 1: The size of the AML team should be proportionate to the size, complexity and risk profile of the business.)\n(Note 2: Head count might sit in different teams, or shared services centres - these staff should be included when assessing head count)\n(Note 3: assessment of sufficient head count might also be made by reviewing the MLRO's (or equivalent) assessment of resourcing)",null,"Urgent Required","Required","FraudRisk",null,null,"2","2.2","2.2.1",0,"2.2.1.1",0,0,"2.2.1.1.4","le département AML/CFT dispose-t-il de ressources financières suffisantes pour mettre en œuvre des politiques, procédures et systèmes eficaces de lutte contre le blanchiment de capitaux et le financement du terrorisme (tels que décrits dans le présent outil d'évaluation) ?","1) Organigramme AML/CFT\n- Vérifier que les effectifs de l’équipe ALM sont suffisants pour satisfaire aux exigences opérationnelles\n(Remarque 1: la taille de l’équipe ALM doit être proportionnelle à l’envergure, la complexité et au profil de risque de l’activité concernée)\n(Remarque 2 : les effectifs peuvent être répartis dans plusieurs équipes ou centres de services partagés - ce personnel doit être pris en compte lors de l’évaluation des effectifs\n(Remarque 3 : pour vérifier que les membres des équipes sont en nombre suffisant, il est possible d’examiner les ressources du Responsable anti-blanchiment (ou équivalent)",null,"Requis Prioritaire","Requis","FraudRisk",0,null,"2","2.2","2.2.1",null,"2.2.1.1",null,0,"2.2.1.1.4","¿El departamento de cumplimiento de las normas de ALA/LFT cuenta con fondos suficientes para implementar políticas, procedimientos y sistemas eficaces (tal como se describe en esta herramienta)?","1) Organigrama del departamento de ALA/LFT \n- Verificar que la plantilla de empleados es suficiente para llevar a cabo las operaciones y sus requerimientos\n(Nota 1: el tamaño del equipo de ALD debe ser proporcional a la escala, complejidad y perfil de riesgo del negocio).\n(Nota 2: el personal puede estar distribuido en diferentes equipos o centros de servicios compartidos – estos empleados deben ser considerados al evaluar la plantilla)\n(Nota 3: la evaluación de suficiente personal puede también realizarse mediante la evaluación de recursos del OLRD (o equivalente))",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,"2","2.2","2.2.1",null,"2.2.1.1",null,0,"2.2.1.1.4",null,null,null,"ReqU4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.2.1.1.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.2","2.2.1","","2.2.1.2","2.2.1.2: AML/CFT COMPLIANCE DEPARTMENT REVIEWS\nSenior management should regularly review the AML/CFT compliance function to ensure its effectiveness.","HK AML","2.2.1.2.1","2.2.1.2.1: Does senior management regularly review the AML/CFT compliance function to ensure its effectiveness?\n","1) Most recent AML/CFT internal control report, annual MLRO report, or AML/CFT review process.\n- Check senior management regularly review the AML/CFT compliance function.\n\n",0,"Urgent Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.2","2.2.1","","2.2.1.2","AML/CFT COMPLIANCE DEPARTMENT REVIEWS\nSenior management should regularly review the AML/CFT compliance function to ensure its effectiveness.","HK AML","2.2.1.2.1","2.2.1.2.1","Does senior management regularly review the AML/CFT compliance function to ensure its effectiveness?","1) Most recent AML/CFT internal control report, annual MLRO report, or AML/CFT review process.\n- Check senior management regularly review the AML/CFT compliance function.\n\n",null,"Urgent Required","Required","FraudRisk",null,null,"2","2.2","2.2.1","","2.2.1.2","EXAMENS DU DÉPARTEMENT AML/CFT\nLa direction générale doit procéder à un examen régulier de la fonction AML/CFT pour s'assurer de son efficacité.","HK AML","2.2.1.2.1","la direction générale procède-t-elle à des examens réguliers de la fonction de conformité AML/CFT pour s'assurer de son efficacité ?","1) Dernier rapport d’audit AML/CFT, Rapport de contrôle interne, rapport annuel du Responsable anti-blanchiment, ou processus d’examen AML/CFT.\n- Vérifier que la direction générale examine régulièrement la fonction de conformité AML/CFT.\n\n",null,"Requis Prioritaire","Requis","FraudRisk",0,null,"2","2.2","2.2.1",null,"2.2.1.2","FISCALIZACIÓN DEL DEPARTAMENTO DE CUMPLIMIENTO DE ALA/LFT\nEl personal directivo debe periódicamente fiscalizar el departamento de cumplimiento de las normas de ALA/LFT a fin de garantizar su efectividad.","HK AML","2.2.1.2.1","¿El personal directivo fiscaliza periódicamente el departamento de cumplimiento de las normas de ALA/LFT a fin de garantizar su efectividad?","1) Reporte de control interno de ALA/LFT, reporte anual del ORLD o proceso de revisión de ALA/LFT más reciente.\n- Verificar que el personal directivo fiscalice periódicamente el departamento de cumplimiento de las normas de ALA/LFT.",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,"2","2.2","2.2.1",null,"2.2.1.2",null,"HK AML","2.2.1.2.1",null,null,null,"ReqU4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.2.1.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.2","2.2.1","","2.2.1.2",null,0,"2.2.1.2.2","2.2.1.2.2: In its most recent review, did senior management indicate satisfaction with the effectiveness of the AML/CFT function?\n","1) Most recent AML/CFT internal control report, annual MLRO report, or AML/CFT review process.\n- Check senior management have confirmed receipt of there report, approved the contents and /or given instructions to reduce the residual risks.",0,"Standard Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.2","2.2.1","","2.2.1.2",null,null,"2.2.1.2.2","2.2.1.2.2","In its most recent review, did senior management indicate satisfaction with the effectiveness of the AML/CFT function?","1) Most recent AML/CFT internal control report, annual MLRO report, or AML/CFT review process.\n- Check senior management have confirmed receipt of there report, approved the contents and /or given instructions to reduce the residual risks.",null,"Standard Required","Required","FraudRisk",null,null,"2","2.2","2.2.1","","2.2.1.2",0,0,"2.2.1.2.2","dans le cadre des derniers examen, la direction générale se montre-t-elle satisfaite de l'efficacité de la fonction AML/CFT ?","1) Dernier rapport d’audit AML/CFT, Rapport de contrôle interne, rapport annuel du Responsable anti-blanchiment, ou processus d’examen AML/CFT.\n- Vérifier que la direction générale a confirmé la réception du rapport, approuvé son contenu et/ou donné des instructions visant à réduire les risques résiduels.",null,"Requis Normal","Requis","FraudRisk",0,null,"2","2.2","2.2.1",null,"2.2.1.2",null,0,"2.2.1.2.2","En la última fiscalización, ¿el personal directivo indicó estar satisfecho con la efectividad del departamento de ALA/LFT?","1) Reporte de control interno de ALA/LFT, reporte anual del ORLD o proceso de revisión de ALA/LFT más reciente.\n- Verificar que el personal directivo ha confirmado la recepción del reporte, aprobado su contenido y/o proporcionado instrucciones para reducir riesgos residuales.",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,"2","2.2","2.2.1",null,"2.2.1.2",null,0,"2.2.1.2.2",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.2.1.2.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,0,0,0,{"$f":"UPPER(CONCATENATE(Introduction!C9,\": \",Introduction!D9))","v":"2.3: APPOINTED AML/CFT MANAGER (MONEY-LAUNDERING REPORTING OFFICER)"},null,null,0,null,{"$f":"Introduction!E9","v":"Providers shall appoint a qualified money-laundering reporting officer (MLRO) to promote and monitor compliance with AML/CFT-related obligations"},null,null,null,null,null,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$9,\": \",Introduction!$L$9))","v":"2.3: APPOINTED AML/CFT MANAGER (MONEY-LAUNDERING REPORTING OFFICER)"},null,null,null,null,null,{"$f":"Introduction!$M$9","v":"Providers shall appoint a qualified money-laundering reporting officer (MLRO) to promote and monitor compliance with AML/CFT-related obligations"},null,null,null,null,0,null,null,0,0,0,null,null,null,null,null,null,null,null,null,null,0,null,null,0,0,0,{"$f":"UPPER(CONCATENATE(Introduction!$U$9,\": \",Introduction!$V$9))","v":"2.3: NOMBRAMIENTO DEL ADMINISTRADOR DE ALD/LFT (FUNCIONARIO RESPONSABLE DE REPORTAR ACTIVIDADES DE LAVADO DE DINERO)"},null,null,null,null,{"$f":"Introduction!W9","v":"El proveedor nombrará a un funcionario responsable de reportar actividades de lavado de dinero con el objetivo de promover y monitorear el cumplimiento con las obligaciones establecidas por las normas ALD/LFT"},null,null,{"$error":"#N/A"},{"$error":"#N/A"},0,null,null,0,0,0,null,0,null,0,0,null,null,null,null,null,0]
[null,"2","2.3","2.3.1",{"$f":"CHOOSE(LanguageNumber,AY24,BP24,CF24,CV24)","v":"2.3.1: Providers shall appoint a qualified money-laundering reporting officer (MLRO) to promote and monitor compliance with AML/CFT-related obligations"},"2.3.1.1",{"$f":"AZ24&\": \"&CHOOSE(LanguageNumber,BA24,BR24,CH24,CX24)","v":"2.3.1.1: AML/CFT MANAGER: MONEY LAUNDERING REPORTING  OFFICER\nA qualified, independent and autonomous Money-Laundering Reporting Officer (MLRO) (or employee with equivalent responsibilities) should be appointed with responsibility for AML/CFT. The MLRO should report to a senior director or equivalent. A single identified person should be responsible and accountable for all MLRO functions. They may have other responsibilities, depending on the size of the mobile money operation.\n\nThe responsibilities of the MLRO should include the following:\n- Implementing procedures to comply with AML/CFT regulations;\n- Screening procedures for staff, agents, and entities providing outsourced services;\n- Monitoring compliance with AML/CFT procedures; \n- Receiving internal reports of suspicious activity and carrying out investigations and necessary actions; \n- Ensuring that changes in business processes and systems are matched by appropriate changes to AML/CFT controls; \n- Encouraging an AML/CFT culture within the Provider (with the assistance of the Directors, officers, and senior management); \n- Raising Suspicious Activity Reports (SARs) and/or Suspicious Transaction Reports (STRs) with the relevant authorities in the case of suspected ML/TF.\n- Serving as the contact person for law enforcement agencies  \n- Serving as the contact person for the Financial Intelligence Unit (or comparable government body) with respect to money laundering and terrorist financing; \n- Identifying national and international AML/CFT regulations that must be followed, and keeping up-to-date with regulations and guidance in AML/CFT practices (e.g. from FATF (Financial Action Task Force))."},"GSMA RMT (FR.O-01)",{"$f":"BC24","v":"2.3.1.1.1"},{"$f":"BC24&\": \"&CHOOSE(LanguageNumber,BE24,BU24,CK24,DA24)&CarriageReturn","v":"2.3.1.1.1: Has a qualified, independent and autonomous Money-Laundering Reporting Officer (MLRO) (or employee with equivalent responsibilities) been appointed with responsibility for AML/CFT?\n"},{"$f":"CHOOSE(LanguageNumber,BF24,BV24,CL24,DB24)","v":"1) MLRO's qualification  (or employee with equivalent responsibilities)\n- Check qualification is appropriate to AML/CFT \n- Check that the qualification/formal training is from a suitable professional body (i.e. ICA, ACAMS etc)\n(Note: 5 years of suitable relevant experience can be considered instead of a qualification)\n\n2) Role description for Money Laundering Reporting Officer (MLRO) or equivalent\n- Check the documents gives the MLRO authority to act autonomously.\n\n3) AML/CFT Organisation chart \n- Check the organisation chart to see that the reporting line is to a suitably independent directorate (same as 2.2.1.1.2.)."},0,"Urgent Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.3","2.3.1","2.3.1: Providers shall appoint a qualified money-laundering reporting officer (MLRO) to promote and monitor compliance with AML/CFT-related obligations","2.3.1.1","AML/CFT MANAGER: MONEY LAUNDERING REPORTING  OFFICER\nA qualified, independent and autonomous Money-Laundering Reporting Officer (MLRO) (or employee with equivalent responsibilities) should be appointed with responsibility for AML/CFT. The MLRO should report to a senior director or equivalent. A single identified person should be responsible and accountable for all MLRO functions. They may have other responsibilities, depending on the size of the mobile money operation.\n\nThe responsibilities of the MLRO should include the following:\n- Implementing procedures to comply with AML/CFT regulations;\n- Screening procedures for staff, agents, and entities providing outsourced services;\n- Monitoring compliance with AML/CFT procedures; \n- Receiving internal reports of suspicious activity and carrying out investigations and necessary actions; \n- Ensuring that changes in business processes and systems are matched by appropriate changes to AML/CFT controls; \n- Encouraging an AML/CFT culture within the Provider (with the assistance of the Directors, officers, and senior management); \n- Raising Suspicious Activity Reports (SARs) and/or Suspicious Transaction Reports (STRs) with the relevant authorities in the case of suspected ML/TF.\n- Serving as the contact person for law enforcement agencies  \n- Serving as the contact person for the Financial Intelligence Unit (or comparable government body) with respect to money laundering and terrorist financing; \n- Identifying national and international AML/CFT regulations that must be followed, and keeping up-to-date with regulations and guidance in AML/CFT practices (e.g. from FATF (Financial Action Task Force)).","GSMA RMT (FR.O-01)","2.3.1.1.1","2.3.1.1.1","Has a qualified, independent and autonomous Money-Laundering Reporting Officer (MLRO) (or employee with equivalent responsibilities) been appointed with responsibility for AML/CFT?","1) MLRO's qualification  (or employee with equivalent responsibilities)\n- Check qualification is appropriate to AML/CFT \n- Check that the qualification/formal training is from a suitable professional body (i.e. ICA, ACAMS etc)\n(Note: 5 years of suitable relevant experience can be considered instead of a qualification)\n\n2) Role description for Money Laundering Reporting Officer (MLRO) or equivalent\n- Check the documents gives the MLRO authority to act autonomously.\n\n3) AML/CFT Organisation chart \n- Check the organisation chart to see that the reporting line is to a suitably independent directorate (same as 2.2.1.1.2.).",null,"Urgent Required","Required","FraudRisk",null,null,"2","2.3","2.3.1","2.3.1: Les prestataires doivent nommer une personne qualifiée chargée d’assurer la promotion et la surveillance du respect des obligations de lutte contre le blanchiment de capitaux et le financement du terrorisme. ","2.3.1.1","DIRECTEUR AML/CFT : RESPONSABLE ANTI-BLANCHIMENT\nUn responsable anti-blanchiment qualifié, indépendant et autonome (ou collaborateur ayant des responsabilités équivalentes) doit être nommé en qualité de responsable AML/CFT. Il doit rapporter à un membre de la direction générale ou équivalent. Un individu unique et identifié doit être responsable de l’ensemble des fonctions liées à l'anti-blanchiment. Celui-ci peut également avoir d'autres responsabilités en fonction du volume de l’activité d'argent mobile. \n\nSes responsabilités comprennent notamment :\n- la mise en œuvre de procédures visant au respect des réglementations AML/CFT ;\n- la mise en œuvre de procédures de contrôle du personnel, des agents et des entités fournissant des services de sous-traitance ;\n- la surveillance du respect des procédures AML/CFT ; \n- la centralisation des déclarations internes d’opérations suspectes et la réalisation des enquêtes et mesures nécessaires ; \n- l’adaptation des systèmes de contrôle AML/CFT à toute modification des procédures et systèmes de l’entreprise ; \n- la promotion d’une culture AML/CFT au sein du Prestataire (avec l’appui des administrateurs et dirigeants du Prestataire) ; \n- la communication des Déclarations d’opération suspecte (DOS) et/ou Déclarations de soupçon (DS) aux autorités concernées en cas de suspicion de blanchiment de capitaux / financement du terrorisme ;\n- le rôle de point de contact pour les autorités chargées de l’application de la loi dans les situations de blanchiment de capitaux ou de financement du terrorisme ;  \n- le rôle de point de contact pour la Cellule du renseignement financier (ou entité gouvernementale équivalente) en matière de blanchiment de capitaux ou de financement du terrorisme ; \n- l’identification des réglementations nationales et internationales devant être respectées en matière de lutte contre le blanchiment de capitaux et le financement du terrorisme, et le suivi de l’évolution des réglementations et recommandations en matière de pratiques AML/CFT (par ex. celles du GAFI (groupe d’action financière).","GSMA RMT (FR.O-01)","2.3.1.1.1","un responsable anti-blanchiment qualifié, indépendant et autonome (ou collaborateur ayant des responsabilités équivalentes) est-il chargé de la lutte contre le blanchiment de capitaux et le financement du terrorisme ?","1) Qualification du Responsable anti-blanchiment (ou salarié ayant des responsabilités équivalentes)\n- Vérifier que la qualification est suffisante pour les activités AML/CFT \n- Vérifier que la personne concernée s’est qualifiée/a été formée auprès d’un organisme professionnel approprié (ICA, ACAMS etc.)\n(Remarque : une expérience de 5 ans dans le domaine considéré peut remplacer la qualification nécessaire)\n\n2) Descriptif du poste de Responsable anti-blanchiment.\n- Vérifier que les documents confèrent au Responsable anti-blanchiment l’autorité nécessaire pour agir de manière autonome.\n\n3) Organigramme AML/CFT\n- Vérifier l’organigramme afin de s’assurer que les informations sont remontées vers une direction suffisamment \"indépendante\" (identique au 2.2.1.1.2.).",null,{"$f":"VLOOKUP(BH24,CategoryTranslationTable,2,FALSE)","v":"Requis Prioritaire"},"Requis","FraudRisk",0,null,"2","2.3","2.3.1","2.3.1: El proveedor nombrará a un oficial de reporte de lavado de activos (ORLD) calificado a fin de promover y monitorear el cumplimiento de las obligaciones relacionadas con la prevención del LA/FT.","2.3.1.1","Gerente de ALA/LFT: OFICIAL DE REPORTE DE lavado de activos\nUn Oficial de Reporte de lavado de activos (ORLD) calificado, independiente y autónomo (o empleado con responsabilidades equivalentes) debe se nombrado para llevar a cabo las responsabilidades de cumplimiento de las normas de ALA/LFT. El ORLD reportará a personal directivo o equivalente. Se debe identificar una sola persona como la responsable de las funciones de ORLD. Las responsabilidades pueden ser varias, dependiendo del tamaño de las operaciones del dinero móvil.\n\nLas responsabilidades del ORLD pueden incluir las siguientes:\n- Implementación de procedimientos para el cumplimiento de la regulación de ALA/LFT\n- Procesos de selección de personal, agentes y entidades para subcontratación de servicios:\n- Supervisión del cumplimiento de los procedimientos de ALA/LFT; \n- Recibir reportes internos de actividades sospechosas, investigar el caso y tomar las acciones necesarias; \n- Garantizar que los cambios procesos y sistemas del negocio se implementan apropiadamente en los controles de ALA/LFT; \n- Fomentar una cultura ALA/LFT en el proveedor (con la asistencia de directores, funcionarios y personal directivo); \n- Elevar Reportes de Actividades Sospechosas (RAS) o Reportes de Transacciones Sospechosas (RTS) a las autoridades correspondientes en caso de sospecha de LD/FT.\n- Ser la persona de contacto para los organismos de seguridad  \n- Ser la persona de contacto para la Unidad de Inteligencia Financiera (u organismo gubernamental similar) respecto de lavado de activos y financiamiento del terrorismo. \n- Identificar las normas de ALA/LFT nacionales e internacionales que deben seguirse y mantenerse al día con las regulaciones y directrices sobre prácticas de ALA/LFT (por ej., del GAFI (Grupo de Acción Financiera Internacional).","GSMA RMT (FR.O-01)","2.3.1.1.1","¿Se ha nombrado un Oficial de Reporte de lavado de activos (ORLD) calificado, independiente y autónomo (o empleado con responsabilidades equivalentes) para llevar a cabo las responsabilidades de cumplimiento de las normas de ALA/LFT?","1) Calificaciones del ORLD (o empleado con responsabilidades equivalentes)\n- Verificar que las calificaciones sean adecuadas para ALA/LFT \n- Verificar que las calificaciones/capacitación formal provienen de una entidad profesional idónea (por ej., ICA, ACAMS etc.)\n(Nota: se puede considerar idóneo un periodo de 5 años de experiencia relevante para esta calificación)\n\n2) Descripción de las responsabilidades del Oficial de Reporte de lavado de activos (ORLD) o equivalente\n- Verificar que los documentos confieran al OLRD autoridad para actuar en forma autónoma\n\n3) Organigrama del departamento de ALA/LFT \n- Verificar que el organigrama establece la línea de reporte en una adecuada dirección independiente (igual que en el punto 2.2.1.1.2).",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,"2","2.3","2.3.1",null,"2.3.1.1",null,"GSMA RMT (FR.O-01)","2.3.1.1.1",null,null,null,{"$f":"VLOOKUP($BH24,CategoryTranslationTable,4,FALSE)","v":"ReqU4"},{"$f":"VLOOKUP($BI24,CategoryTranslationTable,4,FALSE)","v":"Req4"},"FraudRisk",null,null,null,null,null,null,null,null,"2.3.1.1.1",null,null,null,{"$f":"IF(OR($EA24=0,$EA24=2),VLOOKUP(DO24,INDIRECT(ED24),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP24),\"\",VLOOKUP(DP24,INDIRECT(EE24),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ24),\"\",VLOOKUP(DQ24,INDIRECT(EF24),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR24),\"\",VLOOKUP(DR24,INDIRECT(EG24),7,FALSE))","v":""},{"$f":"IF(OR($EA24=0,$EA24=2),VLOOKUP(DO24,INDIRECT(ED24),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP24),\"\",VLOOKUP(DP24,INDIRECT(EE24),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ24),\"\",VLOOKUP(DQ24,INDIRECT(EF24),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR24),\"\",VLOOKUP(DR24,INDIRECT(EG24),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN24,3)=\"NEW\")+2*AND(LEFT(DN24,3)=\"MER\")+3*AND(LEFT(DN24,3)=\"MOV\")+4*AND(LEFT(DN24,3)=\"SWA\")","v":0},{"$f":"IF(EA24=0,DS24,EN24)","v":{"$error":"#REF!"}},{"$f":"IF(EA24=0,IF(DW24=0,\"\",DW24),CHOOSE(EA24,\"New indicator\",CONCATENATE(DW24,CarriageReturn,DX24,CarriageReturn,DY24,CarriageReturn,DZ24)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO24,1)","v":"OriginalComplianceP2"},{"$f":"\"OriginalComplianceP\"&LEFT(DP24,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ24,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR24,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,""]
[null,"2","2.3","2.3.1",0,"2.3.1.1",null,0,"2.3.1.1.2","2.3.1.1.2: Does the MLRO identify national and international AML/CFT regulations that must be followed and keep up-to-date with regulations and developments in AML/CFT?\n","1) Risk Assessment on local legislation and regulations and providers controls\n- Check the risk assessment includes a review of local and international AML/CFT regualtions and how the organisation is meeting those requirements\n- Check the risk asessement has been refreshed within the last 18 months.",0,"Standard Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.3","2.3.1",null,"2.3.1.1",null,null,"2.3.1.1.2","2.3.1.1.2","Does the MLRO identify national and international AML/CFT regulations that must be followed and keep up-to-date with regulations and developments in AML/CFT?","1) Risk Assessment on local legislation and regulations and providers controls\n- Check the risk assessment includes a review of local and international AML/CFT regualtions and how the organisation is meeting those requirements\n- Check the risk asessement has been refreshed within the last 18 months.",null,"Standard Required","Required","FraudRisk",null,null,"2","2.3","2.3.1",0,"2.3.1.1",0,0,"2.3.1.1.2","le responsable anti-blanchiment identifie-t-il les réglementations nationales et inernationales à respecter en matière de lutte contre le blanchiment de capitaux et le financement du terrorisme et se tient-il à jour des réglementations et évolutions dans ce domaine ?","1) Évaluation des risques concernant les lois et réglementations locales et contrôles des prestataires\n- Vérifier que l’évaluation des risques inclut un examen des réglementations locales et internationales en matière d’AML/de CFT et les mesures prises par l’organisation afin de respecter ces exigences \n- Vérifier que l’évaluation des risques a été renouvelée au cours des 18 derniers mois.",null,"Requis Normal","Requis","FraudRisk",0,null,"2","2.3","2.3.1",null,"2.3.1.1",null,0,"2.3.1.1.2","¿El ORLD es responsable de identificar las normas nacionales e internacionales relacionadas con el ALA/LFT que deben cumplirse y se mantiene al día con las regulaciones y desarrollos en materia de ALA/LFT?","1) Evaluación de riesgos sobre la legislación y regulación local y los controles del proveedor\n- Verificar que la evaluación de riesgos incluya una revisión de las normas de ALA/LFT locales e internacionales y cómo la organización cumple con dichos requerimientos\n- Verificar si la evaluación de riesgos ha sido actualizada en los últimos 18 meses.",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,"2","2.3","2.3.1",null,"2.3.1.1",null,0,"2.3.1.1.2",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.3.1.1.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.3","2.3.1",0,"2.3.1.1",null,0,"2.3.1.1.3","2.3.1.1.3: Has the MLRO been given responsibility for ensuring procedures are implemented to comply with the AML/CFT laws and regulations?\n","1) Documentation that describes the objective and function of the AML programme (i.e. policy or equivalent document)\n- Check that this includes an outline of the MLRO responsibilities, including overseeing implementation of procedures that comply with AML/CFT laws.\n",0,"Urgent Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.3","2.3.1",null,"2.3.1.1",null,null,"2.3.1.1.3","2.3.1.1.3","Has the MLRO been given responsibility for ensuring procedures are implemented to comply with the AML/CFT laws and regulations?","1) Documentation that describes the objective and function of the AML programme (i.e. policy or equivalent document)\n- Check that this includes an outline of the MLRO responsibilities, including overseeing implementation of procedures that comply with AML/CFT laws.\n",null,"Urgent Required","Required","FraudRisk",null,null,"2","2.3","2.3.1",0,"2.3.1.1",0,0,"2.3.1.1.3","le responsable anti-blanchiment a-t-il la responsabilité de s’assurer que les procédures sont mises en œuvre dans le but d’être conformes aux lois et réglementations relatives à la lutte contre le blanchiment de capitaux et le financement du terrorisme ?","1) Documentation décrivant l’objectif et la fonction du programme AML (politique ou document équivalent)\n- Vérifier que cette documentation inclut une définition des responsabilités du Responsable anti-blanchiment. y compris la supervision de la mise en œuvre des procédures conformes aux lois applicables en matière d’AML/de CFT.\n",null,"Requis Prioritaire","Requis","FraudRisk",0,null,"2","2.3","2.3.1",null,"2.3.1.1",null,0,"2.3.1.1.3","¿Se ha conferido responsabilidad al ORLD para asegurar que los procedimientos son implementados a fin de cumplir con las leyes y regulaciones sobre ALA/LFT?","1) Documentación que describe los objetivos y la función del programa ALD (o sea, política o documento equivalente)\n- Verificar que incluye una descripción de las obligaciones del ORLD, incluida la supervisión de la implementación de procedimientos para el cumplimiento de las leyes de ALA/LFT.",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,"2","2.3","2.3.1",null,"2.3.1.1",null,0,"2.3.1.1.3",null,null,null,"ReqU4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.3.1.1.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.3","2.3.1","","2.3.1.1",null,0,"2.3.1.1.4","2.3.1.1.4: Does the MLRO receive internal reports of suspicious activity and investigate suspect accounts / individuals and take appropriate action?\n","1) Suspicious activity management process for identifying, investigating, actioning and reporting suspected ML/TF activity.\n-Check internal reports of suspicious activity are received by the MLRO.\n-Check there is a process for the MLRO to investigate the suspicion.",0,"Urgent Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.3","2.3.1","","2.3.1.1",null,null,"2.3.1.1.4","2.3.1.1.6","Does the MLRO receive internal reports of suspicious activity and investigate suspect accounts / individuals and take appropriate action?","1) Suspicious activity management process for identifying, investigating, actioning and reporting suspected ML/TF activity.\n-Check internal reports of suspicious activity are received by the MLRO.\n-Check there is a process for the MLRO to investigate the suspicion.",null,"Urgent Required","Required","FraudRisk",null,null,"2","2.3","2.3.1",0,"2.3.1.1",0,0,"2.3.1.1.4","le responsable anti-blanchiment reçoit-il les déclarations internes d'opérations suspectes, enquête-t-il sur les comptes / personnes à l'origine des soupçons et prend-il les mesures apppropriées?","1) Processus de gestion des activités suspectes pour identifier les suspicions d’activités ML/TF, enquêter, mettre en place les mesures nécessaires et établir les rapports appropriés.\n-Vérifier que les rapports internes relatifs aux activités suspectes sont reçus par le Responsable anti-blanchiment \n-Vérifier qu’un processus a été mis en place concernant les enquêtes réalisées par le Responsable anti-blanchiment sur les activités suspectes",null,"Requis Prioritaire","Requis","FraudRisk",0,null,"2","2.3","2.3.1",null,"2.3.1.1",null,0,"2.3.1.1.4","¿El ORLD recibe reportes internos sobre actividades sospechosas, investiga las cuentas o individuos sospechosos y toma las medidas adecuadas?","1) Proceso de gestión de actividades sospechosas para la identificación, investigación, acción y reporte de actividades sospechosas de LD/FT\n- Verificar si los reportes internos de actividades sospechosas son recibidos por el ORLD \n- Verificar si existe un proceso para la investigación de sospechas por parte del ORLD.\n",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,"2","2.3","2.3.1",null,"2.3.1.1",null,0,"2.3.1.1.4",null,null,null,"ReqU4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.3.1.1.6",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.3","2.3.1","","2.3.1.1",null,0,"2.3.1.1.5","2.3.1.1.5: Does the MLRO ensure that when changes are made to business services and processes, appropriate changes to AML/CFT controls are also made?\n","1) Mobile Money service change management process / product development process\n- Check the process includes the requirement for changes to be notified and approved by the MLRO where required \n- Check that AML controls are changed where required",0,"Standard Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.3","2.3.1","","2.3.1.1",null,null,"2.3.1.1.5","2.3.1.1.7","Does the MLRO ensure that when changes are made to business services and processes, appropriate changes to AML/CFT controls are also made?","1) Mobile Money service change management process / product development process\n- Check the process includes the requirement for changes to be notified and approved by the MLRO where required \n- Check that AML controls are changed where required",null,"Standard Required","Required","FraudRisk",null,null,"2","2.3","2.3.1",0,"2.3.1.1",0,0,"2.3.1.1.5","Le responsable anti-blanchiment s'assure-t-il que des modifications appropriées aux contrôles AML/CFT sont apportées lorsque des changements sont effectués au niveau des processus et services commerciaux ?","1) Processus de gestion des modifications apportées au service d’argent mobile / processus de développement des produits\n- Vérifier que le processus inclut une exigence stipulant que les modifications doivent être notifiées au Responsable anti-blanchiment et validées par ce dernier lorsque nécessaire \n- Vérifier que les contrôles AML/CFT sont modifiés lorsque nécessaire",null,"Requis Normal","Requis","FraudRisk",0,null,"2","2.3","2.3.1",null,"2.3.1.1",null,0,"2.3.1.1.5","¿El ORLD se asegura de que los cambios implementados en los servicios y procesos de la empresa quedan también reflejados mediante cambios apropiados en los controles de ALA/LFT?","1) Proceso de gestión de cambios / proceso de desarrollo de producto para el servicio del dinero móvil\n- Verificar si el proceso incluye el requerimiento de notificar los cambios al ORLD para su aprobación, cuando así se requiera. \n- Verificar que se cambian los controles de ALD cuando así se requiere.",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,"2","2.3","2.3.1",null,"2.3.1.1",null,0,"2.3.1.1.5",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.3.1.1.7",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.3","2.3.1","","2.3.1.1",null,0,"2.3.1.1.6","2.3.1.1.6: Does the MLRO encourage an AML/CFT culture within the Provider (with the assistance of the Directors, Officers, and senior management)?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.3","2.3.1","","2.3.1.1",null,null,"2.3.1.1.6","2.3.1.1.8","Does the MLRO encourage an AML/CFT culture within the Provider (with the assistance of the Directors, Officers, and senior management)?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.3","2.3.1",0,"2.3.1.1",0,0,"2.3.1.1.6","le responsable anti-blanchiment encourage-t-il une culture AML/CFT au sein de l'entreprise (avec l’appui des administrateurs et dirigeants du Prestataire) ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.3","2.3.1",null,"2.3.1.1",null,0,"2.3.1.1.6","¿El ORLD promueve una cultura ALA/LFT dentro del proveedor (con la asistencia de directores, funcionarios y personal directivo)?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.3","2.3.1",null,"2.3.1.1",null,0,"2.3.1.1.6",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.3.1.1.8",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.3","2.3.1","","2.3.1.1",null,0,"2.3.1.1.7","2.3.1.1.7: Does the MLRO maintain contacts with law enforcement agencies and the Financial Intelligence Unit (or comparable government body)?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.3","2.3.1","","2.3.1.1",null,null,"2.3.1.1.7","2.3.1.1.10","Does the MLRO maintain contacts with law enforcement agencies and the Financial Intelligence Unit (or comparable government body)?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.3","2.3.1",0,"2.3.1.1",0,0,"2.3.1.1.7","le responsable anti-blanchiment entretient-il des contacts avec les autoritees chargées de l'application de la loi et la cellule de renseignement financier (ou son équivalent)?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.3","2.3.1",null,"2.3.1.1",null,0,"2.3.1.1.7","¿El ORLD está en contacto con organismos de seguridad y la Unidad de Inteligencia Financiera (u organismo gubernamental similar)?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.3","2.3.1",null,"2.3.1.1",null,0,"2.3.1.1.7",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.3.1.1.10",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,0,0,0,{"$f":"UPPER(CONCATENATE(Introduction!C10,\": \",Introduction!D10))","v":"2.4: SOFTWARE TO MONITOR TRANSACTIONS"},null,null,0,null,{"$f":"Introduction!E10","v":"Providers shall create a system to monitor transactions for AML/CFT and anti-fraud purposes"},null,null,null,null,null,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$10,\": \",Introduction!$L$10))","v":"2.4: SOFTWARE TO MONITOR TRANSACTIONS"},null,null,null,null,null,{"$f":"Introduction!$M$10","v":"Providers shall create a system to monitor transactions for AML/CFT and anti-fraud purposes"},null,null,null,null,0,null,null,0,0,0,null,null,null,null,null,null,null,null,null,null,0,null,null,0,0,0,{"$f":"UPPER(CONCATENATE(Introduction!$U$10,\": \",Introduction!$V$10))","v":"2.4: SOFTWARE PARA MONITOREO DE TRANSACCIONES"},null,null,0,0,{"$f":"Introduction!W10","v":"El proveedor debe crear un sistema de monitoreo de transacciones a los fines de ALD/LFT y detección de fraude"},null,null,{"$error":"#N/A"},{"$error":"#N/A"},0,null,null,0,0,0,null,0,0,0,0,null,null,null,null,null,0]
[null,{"$f":"AV32","v":"2"},{"$f":"AW32","v":"2.4"},"2.4.1",{"$f":"CHOOSE(LanguageNumber,AY32,BP32,CF32,CV32)","v":"2.4.1: Providers shall create a system to monitor transactions for AML/CFT and anti-fraud purposes"},"2.4.1.1",{"$f":"AZ32&\": \"&CHOOSE(LanguageNumber,BA32,BR32,CH32,CX32)","v":"2.4.1.1: TRANSACTION MONITORING\nA transaction monitoring system should be deployed to automatically identify suspicious transactions and patterns based on a configured set of rules. All transactions to/from mobile money accounts should be monitored to identify suspicious patterns. Alerts should be generated for manual follow-up and intervention. \n\nIt is recommended that actions on accounts (such as opening, closure, PIN change, SIM change) also be monitored for suspicious patterns.\n\nTransaction monitoring reports should be formally submitted to the MLRO and actions taken as defined in 2.1.1.2 and stored according to the record-keeping policy (2.1.1.5).\n\nDetails of the transaction monitoring system and its rules should be documented."},"GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML",{"$f":"BC32","v":"2.4.1.1.1"},{"$f":"BC32&\": \"&CHOOSE(LanguageNumber,BE32,BU32,CK32,DA32)&CarriageReturn","v":"2.4.1.1.1: Has a transaction monitoring system been deployed to automatically identify suspicious transactions and patterns and create alerts for follow-up?\n"},{"$f":"CHOOSE(LanguageNumber,BF32,BV32,CL32,DB32)","v":"1) Transaction monitoring system functional specification (or demonstration of system)\n- Check that the specification has been implemented and is operational."},{"$f":"CHOOSE(LanguageNumber,BG32,BW32,CM32,DC32)","v":0},{"$f":"CHOOSE(LanguageNumber,BH32,BX32,CN32,DD32)","v":"Urgent Required"},{"$f":"CHOOSE(LanguageNumber,BI32,BY32,CO32,DE32)","v":"Required"},"FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.4","2.4.1","2.4.1: Providers shall create a system to monitor transactions for AML/CFT and anti-fraud purposes","2.4.1.1","TRANSACTION MONITORING\nA transaction monitoring system should be deployed to automatically identify suspicious transactions and patterns based on a configured set of rules. All transactions to/from mobile money accounts should be monitored to identify suspicious patterns. Alerts should be generated for manual follow-up and intervention. \n\nIt is recommended that actions on accounts (such as opening, closure, PIN change, SIM change) also be monitored for suspicious patterns.\n\nTransaction monitoring reports should be formally submitted to the MLRO and actions taken as defined in 2.1.1.2 and stored according to the record-keeping policy (2.1.1.5).\n\nDetails of the transaction monitoring system and its rules should be documented.","GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML","2.4.1.1.1","2.4.1.1.1","Has a transaction monitoring system been deployed to automatically identify suspicious transactions and patterns and create alerts for follow-up?","1) Transaction monitoring system functional specification (or demonstration of system)\n- Check that the specification has been implemented and is operational.",null,"Urgent Required","Required","FraudRisk",null,null,"2","2.4","2.4.1","2.4.1: Les prestataires doivent mettre en place un système de surveillance des transactions pour lutter contre le blanchiment de capitaux, le financement du terrorisme et la fraude.","2.4.1.1","SURVEILLANCE DES TRANSACTIONS\nUn système de surveillance des transactions doit être mis en place pour automatiquement identifier les opérations et comportements suspects selon un ensemble de règles déterminées. Toutes les transactions vers ou en provenance de comptes d'argent mobile doivent être surveillées pour repérer les comportements suspects. Des alertes doivent être émises pour déclencher le suivi manuel et l’intervention. \n\nIl est recommandé que les actions sur ces comptes (telles que l’ouverture, la fermeture, la modification des identifiants de sécurité ou de la carte SIM) soient également surveillées.\n\nDes rapports de surveillance des transactions doivent être formellement remis au responsable anti-blanchiment et conservés conformément à la politique de conservation des documents (cf. 2.1.1.5). Les mesures définies au 2.1.1.2 doivent être appliquées.\n\nLe détail du système de surveillance des transactions et de ses règles doit être documenté.","GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML","2.4.1.1.1","Un système de surveillance des transactions a-t-il été mis en place pour automatiquement identifier les opérations et comportements suspects et émettre des alertes déclenchant un suivi ?","1) Spécification fonctionnelle du système de surveillance des transactions (ou démonstration du système)\n- Vérifier que la spécification a été mise en œuvre et est opérationnelle.",null,{"$f":"VLOOKUP(BH32,CategoryTranslationTable,2,FALSE)","v":"Requis Prioritaire"},{"$f":"VLOOKUP(BI32,CategoryTranslationTable,2,FALSE)","v":"Requis"},"FraudRisk",0,null,"2","2.4","2.4.1","2.4.1: El proveedor debe crear un sistema de monitoreo de transacciones a los fines de ALD/LFT y detección de fraude","2.4.1.1","MONITOREO DE TRANSACCIONES\nUn sistema de monitoreo de transacciones debe ser implementado a fin de identificar automáticamente las transacciones o patrones sospechosos con base en una serie de reglas preconfiguradas. Todas las transacciones desde y hacia una cuenta del dinero móvil deben ser monitoreadas para identificar patrones sospechosos. Se deben generar alertas para seguimiento e intervención manual. \n\nSe recomienda que toda acción realizada respecto de una cuenta (como apertura, cierre, cambio de NIP, cambio de tarjeta SIM) también sea monitoreada para identificar patrones sospechosos.BA35\n\nLos reportes de monitoreo de transacciones deben presentarme formalmente al ORLD, se deben tomar las medidas definidas en el punto 2.1.1.2 y se deben guardar según lo indica la política de mantenimiento de registros (2.1.1.5).\n\nTodo detalle relacionado con el sistema de monitoreo y las reglas pertinentes debe ser documentado.","GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML","2.4.1.1.1","¿Se ha establecido un sistema de monitoreo de transacciones para identificar automáticamente transacciones o patrones sospechosos y crear alertas para seguimiento?","1) Especificación de funcionalidades del sistema de monitoreo de transacciones (o del sistema de demostración)\n- Verificar que las especificaciones hayan sido implementadas y se encuentren operativas. \n",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,"2","2.4","2.4.1",null,"2.4.1.1",null,"GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML","2.4.1.1.1",null,null,null,{"$f":"VLOOKUP($BH32,CategoryTranslationTable,4,FALSE)","v":"ReqU4"},{"$f":"VLOOKUP($BI32,CategoryTranslationTable,4,FALSE)","v":"Req4"},"FraudRisk",null,null,null,null,null,null,null,null,"2.4.1.1.1",null,null,null,{"$f":"IF(OR($EA32=0,$EA32=2),VLOOKUP(DO32,INDIRECT(ED32),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP32),\"\",VLOOKUP(DP32,INDIRECT(EE32),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ32),\"\",VLOOKUP(DQ32,INDIRECT(EF32),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR32),\"\",VLOOKUP(DR32,INDIRECT(EG32),7,FALSE))","v":""},{"$f":"IF(OR($EA32=0,$EA32=2),VLOOKUP(DO32,INDIRECT(ED32),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP32),\"\",VLOOKUP(DP32,INDIRECT(EE32),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ32),\"\",VLOOKUP(DQ32,INDIRECT(EF32),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR32),\"\",VLOOKUP(DR32,INDIRECT(EG32),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN32,3)=\"NEW\")+2*AND(LEFT(DN32,3)=\"MER\")+3*AND(LEFT(DN32,3)=\"MOV\")+4*AND(LEFT(DN32,3)=\"SWA\")","v":0},{"$f":"IF(EA32=0,DS32,EN32)","v":{"$error":"#REF!"}},{"$f":"IF(EA32=0,IF(DW32=0,\"\",DW32),CHOOSE(EA32,\"New indicator\",CONCATENATE(DW32,CarriageReturn,DX32,CarriageReturn,DY32,CarriageReturn,DZ32)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO32,1)","v":"OriginalComplianceP2"},{"$f":"\"OriginalComplianceP\"&LEFT(DP32,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ32,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR32,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,""]
[null,{"$f":"AV33","v":"2"},"2.4","2.4.1",null,{"$f":"AZ33","v":"2.4.1.1"},null,null,{"$f":"BC33","v":"2.4.1.1.2"},"2.4.1.1.2: Are details of the transaction monitoring system and its configuration documented?\n",{"$f":"CHOOSE(LanguageNumber,BF33,BV33,CL33,DB33)","v":"1) Transaction monitoring system functional specification\n- Check that transaction monitoring system and the configuration is documented.\n\n"},{"$f":"CHOOSE(LanguageNumber,BG33,BW33,CM33,DC33)","v":0},{"$f":"CHOOSE(LanguageNumber,BH33,BX33,CN33,DD33)","v":"Standard Required"},{"$f":"CHOOSE(LanguageNumber,BI33,BY33,CO33,DE33)","v":"Required"},"FraudRisk",{"$f":"CHOOSE(LanguageNumber,BK33,CA33,CQ33,DG33)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.4","2.4.1",null,"2.4.1.1",null,null,"2.4.1.1.2",{"$f":"DO33","v":"2.4.1.1.3"},"Are details of the transaction monitoring system and its configuration documented?","1) Transaction monitoring system functional specification\n- Check that transaction monitoring system and the configuration is documented.\n\n",null,"Standard Required","Required","FraudRisk",null,null,"2","2.4","2.4.1",null,"2.4.1.1",null,null,"2.4.1.1.2","Le détail du système de surveillance des transactions et de sa configuration est-il documenté ?","1) Spécification fonctionnelle du système de surveillance des transactions\n- Vérifier que le système de surveillance des transactions et la configuration sont documentés.\n\n",null,"Requis Normal","Requis","FraudRisk",0,null,"2","2.4","2.4.1",null,"2.4.1.1",null,null,"2.4.1.1.2","¿Están documentados los detalles del sistema de monitoreo de transacciones y su configuración?","1) Especificación de funcionalidades del sistema de monitoreo de transacciones\n- Verificar que el sistema de monitoreo de transacciones y su configuración están documentados.",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,"2","2.4","2.4.1",null,"2.4.1.1",null,null,"2.4.1.1.2",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.4.1.1.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,{"$f":"AV34","v":"2"},{"$f":"AW34","v":"2.4"},{"$f":"AX34","v":"2.4.1"},0,{"$f":"AZ34","v":"2.4.1.1"},null,0,"2.4.1.1.3","2.4.1.1.3: Has an automated monitoring system been deployed to identify suspicious actions on accounts (such as opening, closure, PIN change, SIM change)?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.4","2.4.1",null,"2.4.1.1",null,null,"2.4.1.1.3",0,"Has an automated monitoring system been deployed to identify suspicious actions on accounts (such as opening, closure, PIN change, SIM change)?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.4","2.4.1",{"$error":"#N/A"},"2.4.1.1",null,0,"2.4.1.1.3","Un système de surveillance automatisé a-t-il été mis en place afin d’identifier les actions suspectes sur les comptes (telles que l’ouverture, la fermeture, la modification des identifiants de sécurité ou de la carte SIM) ?",null,null,"Recommandé","Recommandé","FraudRisk",null,null,"2","2.4","2.4.1",null,"2.4.1.1",null,0,"2.4.1.1.3","¿Se ha implementado un sistema de monitoreo automatizado a fin de identificar cualquier acción sospechosa realizada respecto de una cuenta (como apertura, cierre, cambio de PIN, cambio de tarjeta SIM)?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.4","2.4.1",null,"2.4.1.1",null,0,"2.4.1.1.3",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,"NEW"]
[null,"2","2.4","2.4.1",0,"2.4.1.2","2.4.1.2: IDENTIFICATION OF SUSPICIOUS TRANSACTIONS\nThe transaction monitoring system should identify unusual or suspicious patterns of transactions. The system should be configurable so that it can be configured to respond to new types of suspicious patterns quickly and effectively.\n\nExamples of suspicious transactions that the system should be able to detect include:\n- Structuring of transactions (e.g., smurfing - multiple transactions just under the transaction limit);\n- Multiple attempted transactions exceeding allowable transaction limits; \n- Changes in velocity of transactions or transaction patterns inconsistent with customer’s prior behaviour (based on behaviour profiling);\n- Transaction requests from lost or stolen devices (e.g. using handset IMEI).","GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML","2.4.1.2.1","2.4.1.2.1: Can the transaction monitoring system be configured to respond to new types of suspicious patterns quickly and effectively?\n","1) Transaction monitoring system functional specification\n- Check that system can be reconfigured to respond to new patterns of suspicious behaviour without requiring significant changes such as a new software release.",0,"Standard Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.4","2.4.1",null,"2.4.1.2","IDENTIFICATION OF SUSPICIOUS TRANSACTIONS\nThe transaction monitoring system should identify unusual or suspicious patterns of transactions. The system should be configurable so that it can be configured to respond to new types of suspicious patterns quickly and effectively.\n\nExamples of suspicious transactions that the system should be able to detect include:\n- Structuring of transactions (e.g., smurfing - multiple transactions just under the transaction limit);\n- Multiple attempted transactions exceeding allowable transaction limits; \n- Changes in velocity of transactions or transaction patterns inconsistent with customer’s prior behaviour (based on behaviour profiling);\n- Transaction requests from lost or stolen devices (e.g. using handset IMEI).","GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML","2.4.1.2.1","2.4.1.2.1","Can the transaction monitoring system be configured to respond to new types of suspicious patterns quickly and effectively?","1) Transaction monitoring system functional specification\n- Check that system can be reconfigured to respond to new patterns of suspicious behaviour without requiring significant changes such as a new software release.",null,"Standard Required","Required","FraudRisk",null,null,"2","2.4","2.4.1",0,"2.4.1.2","IDENTIFICATION DES TRANSACTIONS SUSPECTES\nLe système de surveillance des transactions doit détecter les comportements transactionnels suspects ou anormaux. Il doit être configurable de façon à répondre rapidement et effectivement à de nouvelles formes de comportements suspects. \n\nExemples de transactions suspectes que le système doit être capable de détecter : \n- structuration des transactions (par ex. fragmentation des transactions, aussi appelée « smurfing » : transactions répétées juste en-dessous des plafonds d’opération) ; \n- tentatives répétées d’opérations excédant les plafonds autorisés ;  \n- changements dans la fréquence ou le comportement transactionnel des clients par rapport à leur comportement passé (sur la base du profilage des comportements) ;\n- demandes d'opération sur des appareils perdus ou volés (au moyen par exemple du numéro d’identification, ou IMEI, de l’appareil).","GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML","2.4.1.2.1","le système de surveillance des transactions peut-il être configuré pour répondre rapidement et effectivement à de nouvelles formes de comportements suspects ?","1) Spécification fonctionnelle du système de surveillance des transactions\n- Vérifier que le système peut être reconfiguré pour répondre à de nouveaux comportements suspects sans nécessiter de modifications importantes, comme la mise à jour des logiciels.",null,"Requis Normal","Requis","FraudRisk",0,null,"2","2.4","2.4.1",null,"2.4.1.2","IDENTIFICACIÓN DE TRANSACCIONES SOSPECHOSAS\nEl sistema de monitoreo de transacciones debe identificar toda transacción o patrón sospechoso o atípico. El sistema debe ser configurable para que pueda configurarse a fin de responder a nuevos tipos de patrones sospechosos en forma rápida y efectiva.\n\nEjemplos de transacciones sospechosas que el sistema debería detectar:\n- Estructura de transacciones (p.e., pitufeo o smurfing, la realización de múltiples transacciones por debajo del límite establecido para las transacciones);\n- Múltiples intentos de realizar una transacción que excede los límites permitidos para dicha transacción; \n- Cambios en la velocidad de las transacciones o patrones inconsistentes con el comportamiento previo del cliente (basado en perfiles de comportamiento);\n- Solicitudes de transacciones provenientes de dispositivos robados o perdidos (p.e., utilizando el IMEI del dispositivo).","GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML","2.4.1.2.1","¿Puede el sistema de monitoreo de transacciones ser configurado para responder a nuevos tipos de patrones sospechosos en forma rápida y efectiva?","1) Especificación de funcionalidades del sistema de monitoreo de transacciones\n- Verificar que el sistema pueda ser reconfigurado para responder a nuevos patrones de comportamientos sospechosos sin requerir cambios significativos, tales como una nueva versión del software.",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,"2","2.4","2.4.1",null,"2.4.1.2",null,"GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML","2.4.1.2.1",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.4.1.2.1",null,null,null,{"$f":"IF(OR($EA35=0,$EA35=2),VLOOKUP(DO35,INDIRECT(ED35),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP35),\"\",VLOOKUP(DP35,INDIRECT(EE35),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ35),\"\",VLOOKUP(DQ35,INDIRECT(EF35),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR35),\"\",VLOOKUP(DR35,INDIRECT(EG35),7,FALSE))","v":""},{"$f":"IF(OR($EA35=0,$EA35=2),VLOOKUP(DO35,INDIRECT(ED35),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP35),\"\",VLOOKUP(DP35,INDIRECT(EE35),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ35),\"\",VLOOKUP(DQ35,INDIRECT(EF35),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR35),\"\",VLOOKUP(DR35,INDIRECT(EG35),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN35,3)=\"NEW\")+2*AND(LEFT(DN35,3)=\"MER\")+3*AND(LEFT(DN35,3)=\"MOV\")+4*AND(LEFT(DN35,3)=\"SWA\")","v":0},{"$f":"IF(EA35=0,DS35,EN35)","v":{"$error":"#REF!"}},{"$f":"IF(EA35=0,IF(DW35=0,\"\",DW35),CHOOSE(EA35,\"New indicator\",CONCATENATE(DW35,CarriageReturn,DX35,CarriageReturn,DY35,CarriageReturn,DZ35)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO35,1)","v":"OriginalComplianceP2"},{"$f":"\"OriginalComplianceP\"&LEFT(DP35,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ35,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR35,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,""]
[null,"2","2.4","2.4.1",0,"2.4.1.2",null,0,"2.4.1.2.2","2.4.1.2.2: Can the transaction monitoring system detect structuring of transactions (e.g., smurfing) or multiple attempted transactions that exceed the transaction limit?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.4","2.4.1",null,"2.4.1.2",null,null,"2.4.1.2.2","2.4.1.2.2","Can the transaction monitoring system detect structuring of transactions (e.g., smurfing) or multiple attempted transactions that exceed the transaction limit?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.4","2.4.1",0,"2.4.1.2",0,0,"2.4.1.2.2","le système de surveillance des transactions est-il capable de détecter les transactions structurées (ex.fragmentation des transactions, aussi appelée « smurfing ») ou des tentatives répétées d'opérations excédant les plafonds autorisés ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.4","2.4.1",null,"2.4.1.2",null,0,"2.4.1.2.2","¿Puede el sistema de monitoreo de transacciones detectar transacciones estructuradas (por ej., pitufeo) o múltiples intentos de realizar una transacción por un monto superior al límite establecido?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.4","2.4.1",null,"2.4.1.2",null,0,"2.4.1.2.2",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.4.1.2.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.4","2.4.1",0,"2.4.1.2",null,0,"2.4.1.2.3","2.4.1.2.3: Can the transaction monitoring system promptly detect changes in velocity of transactions or transactions inconsistent with client’s prior behaviour?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.4","2.4.1",null,"2.4.1.2",null,null,"2.4.1.2.3","2.4.1.2.3","Can the transaction monitoring system promptly detect changes in velocity of transactions or transactions inconsistent with client’s prior behaviour?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.4","2.4.1",0,"2.4.1.2",0,0,"2.4.1.2.3","le système de surveillance des transactions est-il capable de détecter rapidement les changements dans la fréquence ou le comportement transactionnel des clients par rapport à leur comportement passé ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.4","2.4.1",null,"2.4.1.2",null,0,"2.4.1.2.3","¿Puede el sistema de monitoreo detectar inmediatamente un cambio en la velocidad de las transacciones o inconsistencia de las mismas respecto del comportamiento anterior del cliente?",null,null,{"$f":"VLOOKUP($BH37,CategoryTranslationTable,3,FALSE)","v":"Recomendado"},{"$f":"VLOOKUP($BI37,CategoryTranslationTable,3,FALSE)","v":"Recomendado"},"FraudRisk",null,null,"2","2.4","2.4.1",null,"2.4.1.2",null,0,"2.4.1.2.3",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.4.1.2.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",{"$f":"COUNTIF($DS37:$DV37,EH$3)","v":0},0,0,0,0,1,""]
[null,"2","2.4","2.4.1",0,"2.4.1.2",null,0,"2.4.1.2.4","2.4.1.2.4: Can the transaction monitoring system promptly detect transaction requests from lost or stolen devices (e.g. using handset IMEI)?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.4","2.4.1",null,"2.4.1.2",null,null,"2.4.1.2.4","2.4.1.2.4","Can the transaction monitoring system promptly detect transaction requests from lost or stolen devices (e.g. using handset IMEI)?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.4","2.4.1",0,"2.4.1.2",0,0,"2.4.1.2.4","le système de surveillance des transactions est-il capable de détecter rapidement les demandes d'opération émanant d'appareils perdus ou volés (au moyen par exemple de l'IMEI de l’appareil) ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.4","2.4.1",null,"2.4.1.2",null,0,"2.4.1.2.4","¿Puede el sistema de monitoreo de transacciones detectar inmediatamente solicitudes de transacciones provenientes de dispositivos robados o perdidos (por ej., utilizando el IMEI del dispositivo).",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.4","2.4.1",null,"2.4.1.2",null,0,"2.4.1.2.4",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.4.1.2.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.4","2.4.1",0,"2.4.1.3","2.4.1.3: GEOGRAPHIC VALIDATION\nIf technically feasible, location details of transaction parties should be monitored. Location details may be obtained through geo-location, cell site or other system-generated address data.\n\nLocation information can be used to identify suspicious behaviour such as:\n  - transactions to/from suspicious locations (e.g. prisons);\n  - transactions by an agent when the customer is not at the agent location;\n  - multiple transactions in different locations within a short time period (this is an indicator of SIM cloning).\n  - agents operating outside their expected area (agent SIMs that have moved location may be used for unauthorized cross-border transfers and are also more likely to be performing false registrations).\n","GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML","2.4.1.3.1","2.4.1.3.1: Does the transaction monitoring system incorporate location information of transaction parties (obtained through geo-location, cell site or other system-generated address data)?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.4","2.4.1",null,"2.4.1.3","GEOGRAPHIC VALIDATION\nIf technically feasible, location details of transaction parties should be monitored. Location details may be obtained through geo-location, cell site or other system-generated address data.\n\nLocation information can be used to identify suspicious behaviour such as:\n  - transactions to/from suspicious locations (e.g. prisons);\n  - transactions by an agent when the customer is not at the agent location;\n  - multiple transactions in different locations within a short time period (this is an indicator of SIM cloning).\n  - agents operating outside their expected area (agent SIMs that have moved location may be used for unauthorized cross-border transfers and are also more likely to be performing false registrations).\n","GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML","2.4.1.3.1","2.4.1.3.1","Does the transaction monitoring system incorporate location information of transaction parties (obtained through geo-location, cell site or other system-generated address data)?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.4","2.4.1",0,"2.4.1.3","VALIDATION GÉOGRAPHIQUE \nLorsque cela est techniquement faisable, la localisation géographique des parties aux transactions doit également être surveillée. Les coordonnées géographiques peuvent être obtenues au moyen de la géolocalisation, du site cellulaire ou d’autres données d’adresse générées par le système.\n\nLa localisation géographique peut par exemple permettre d’identifier les comportements suspects suivants :\n - transactions vers/en provenance d'endroits suspects (ex. prisons) ;\n - transactions par un agent lorsque le client n’est pas présent ;\n - multiples transactions à différents endroits en peu de temps (susceptibles de signaler un clonage de SIM).\n - agents faisant des opérations en dehors de leur territoire attendu (les cartes SIM d’agents ayant changé d’endroit peuvent être utilisées pour des transferts transfrontaliers non autorisés et sont également plus susceptibles de servir à de faux enregistrements).","GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML","2.4.1.3.1","le système de surveillance des transactions intègre-t-il les coordonnées géographique des parties aux transactions (obtenues au moyen de la géolocalisation, du site cellulaire ou d’autres données d’adresse générées par le système) ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.4","2.4.1",null,"2.4.1.3","VALIDACIÓN GEOGRÁFICA\nSiempre que sea técnicamente posible, los detalles de la ubicación de las partes de la transacción deben ser monitoreados. La información sobre ubicación puede obtenerse a través de geolocalización, sitios de celdas u otros datos sobre la dirección generados por el sistema.\n\nLa información de ubicación puede utilizarse para identificar comportamientos sospechosos, tales como:\n  - transacciones desde y hacia ubicaciones sospechosas (p.e., prisiones)\n  - transacciones realizadas por un agente cuando el cliente no se encuentre presente en el sitio del agente\n  - múltiples transacciones en distintos sitios durante un periodo de tiempo breve (una indicación de clonación de tarjetas SIM)\n  - agentes que operan fuera del área esperada (tarjetas SIM pertenecientes al agente que se han movido de sitio pueden ser utilizadas para transferencias transfronterizas y tienen una mayor probabilidad de que se realicen registros falsos).","GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML","2.4.1.3.1","¿El sistema de monitoreo de transacciones incluye la información de ubicación de las partes de la transacción (obtenida a través de geolocalización, sitios de celdas u otros datos sobre la dirección generados por el sistema)?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.4","2.4.1",null,"2.4.1.3",null,"GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML","2.4.1.3.1",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.4.1.3.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.4","2.4.1",0,"2.4.1.3",null,0,"2.4.1.3.2","2.4.1.3.2: Can the transaction monitoring system detect transactions to/from suspicious locations?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.4","2.4.1",null,"2.4.1.3",null,null,"2.4.1.3.2","2.4.1.3.2","Can the transaction monitoring system detect transactions to/from suspicious locations?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.4","2.4.1",0,"2.4.1.3",0,0,"2.4.1.3.2","le système de surveillance des transactions est-il capable de repérer les transactions vers/en provenance d'endroits suspects ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.4","2.4.1",null,"2.4.1.3",null,0,"2.4.1.3.2","¿Puede el sistema de monitoreo de transacciones detectar transacciones desde y hacia sitios sospechosos?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.4","2.4.1",null,"2.4.1.3",null,0,"2.4.1.3.2",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.4.1.3.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.4","2.4.1",0,"2.4.1.3",null,0,"2.4.1.3.3","2.4.1.3.3: Can the transaction monitoring system detect transactions by an agent when customer is not at agent location?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.4","2.4.1",null,"2.4.1.3",null,null,"2.4.1.3.3","2.4.1.3.3","Can the transaction monitoring system detect transactions by an agent when customer is not at agent location?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.4","2.4.1",0,"2.4.1.3",0,0,"2.4.1.3.3","le système de surveillance des transactions est-il capable de repérer les transactions réalisées par un agent lorsque le client n'est pas présent auprès de l'agent ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.4","2.4.1",null,"2.4.1.3",null,0,"2.4.1.3.3","¿Puede el sistema de monitoreo de transacciones detectar transacciones realizadas por un agente cuando el cliente no se encuentra presente en el sitio del agente?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.4","2.4.1",null,"2.4.1.3",null,0,"2.4.1.3.3",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.4.1.3.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.4","2.4.1",0,"2.4.1.3",null,0,"2.4.1.3.4","2.4.1.3.4: Can the transaction monitoring system detect multiple transactions in different locations within a short time period (this is an indicator of SIM cloning)?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.4","2.4.1",null,"2.4.1.3",null,null,"2.4.1.3.4","2.4.1.3.4","Can the transaction monitoring system detect multiple transactions in different locations within a short time period (this is an indicator of SIM cloning)?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.4","2.4.1",0,"2.4.1.3",0,0,"2.4.1.3.4","le système de surveillance des transactions est-il capable de repérer de multiples transactions réalisées en peu de temps à différents endroits (susceptibles de signaler un clonage de SIM) ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.4","2.4.1",null,"2.4.1.3",null,0,"2.4.1.3.4","¿Puede el sistema de monitoreo detectar múltiples transacciones en distintos sitios durante un periodo de tiempo breve (una indicación de clonación de tarjetas SIM)?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.4","2.4.1",null,"2.4.1.3",null,0,"2.4.1.3.4",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.4.1.3.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.4","2.4.1",0,"2.4.1.3",null,0,"2.4.1.3.5","2.4.1.3.5: Can the transaction monitoring system detect agents operating outside their expected area?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.4","2.4.1",null,"2.4.1.3",null,null,"2.4.1.3.5","2.4.1.3.5","Can the transaction monitoring system detect agents operating outside their expected area?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.4","2.4.1",0,"2.4.1.3",0,0,"2.4.1.3.5","le système de surveillance des transactions est-il capable de repérer les agents faisant des opérations en dehors de leur zone habituelle ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.4","2.4.1",null,"2.4.1.3",null,0,"2.4.1.3.5","¿Puede el sistema de monitoreo de transacciones detectar si el agente está operando fuera del área habitual?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.4","2.4.1",null,"2.4.1.3",null,0,"2.4.1.3.5",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.4.1.3.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.4","2.4.1",0,"2.4.1.4","2.4.1.4: ENHANCED TRANSACTION MONITORING\nEnhanced monitoring should be carried out for business transactions and transactions to/from financial ecosystem partners (e.g. banks, cross-border, interoperability), as these transactions may have higher limits and may present a higher ML / TF risk.","GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML","2.4.1.4.1","2.4.1.4.1: Is enhanced transaction monitoring implemented for business transactions and transactions to / from financial ecosystem partners (e.g. banks, cross-border, interoperability)?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.4","2.4.1",null,"2.4.1.4","ENHANCED TRANSACTION MONITORING\nEnhanced monitoring should be carried out for business transactions and transactions to/from financial ecosystem partners (e.g. banks, cross-border, interoperability), as these transactions may have higher limits and may present a higher ML / TF risk.","GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML","2.4.1.4.1","2.4.1.4.1","Is enhanced transaction monitoring implemented for business transactions and transactions to / from financial ecosystem partners (e.g. banks, cross-border, interoperability)?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.4","2.4.1",0,"2.4.1.4","SURVEILLANCE RENFORCÉE DES TRANSACTIONS\nLes transactions d’entreprises et les transactions vers/en provenance de partenaires de l’écosystème financier (ex. banques, transferts internationaux, interopérabilité) doit faire l’objet d’une surveillance renforcée, car elles ont des plafonds plus élevés et présentent un risque plus important de blanchiment de capitaux / financement du terrorisme.","GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML","2.4.1.4.1","une surveillance renforcée des transactions est-elle en place pour les transactions d’entreprises et les transactions vers/en provenance de partenaires de l’écosystème financier (ex. banques, transferts internationaux, interopérabilité) ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.4","2.4.1",null,"2.4.1.4","MONITOREO INTENSIVO DE TRANSACCIONES\nEl monitoreo intensivo debe realizarse en los casos de transacciones comerciales y entre socios del ecosistema financiero (por ej., bancos, interoperabilidad transfronteriza), ya que el límite de estas transacciones puede ser mayor y presentar un riesgo más alto de LD/FT.","GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML","2.4.1.4.1","¿Se ha implementado el monitoreo intensivo de transacciones en los casos de transacciones comerciales y entre socios del ecosistema financiero (por ej., bancos, interoperabilidad transfronteriza)?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.4","2.4.1",null,"2.4.1.4",null,"GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML","2.4.1.4.1",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.4.1.4.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.4","2.4.1",0,"2.4.1.5","2.4.1.5: MONITORING CHANGES TO ACCOUNTS\nActions on accounts should be monitored to identify unusual and suspicious activity. This should include:\n  - Unusual account opening or closing;\n  - Suspicious changes to accounts;\n  - Suspicious patterns of security credential (e.g., PIN) change;\n  - Suspicious patterns of SIM change;\n  - Duplication of accounts.",{"$f":"BB45","v":"GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML"},"2.4.1.5.1","2.4.1.5.1: Are actions on accounts monitored to identify unusual and suspicious activity, including account opening/closing/changes, suspicious PIN/SIM changes, and duplication of accounts?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.4","2.4.1",null,"2.4.1.5","MONITORING CHANGES TO ACCOUNTS\nActions on accounts should be monitored to identify unusual and suspicious activity. This should include:\n  - Unusual account opening or closing;\n  - Suspicious changes to accounts;\n  - Suspicious patterns of security credential (e.g., PIN) change;\n  - Suspicious patterns of SIM change;\n  - Duplication of accounts.","GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML","2.4.1.5.1","2.4.1.5.1","Are actions on accounts monitored to identify unusual and suspicious activity, including account opening/closing/changes, suspicious PIN/SIM changes, and duplication of accounts?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.4","2.4.1",0,"2.4.1.5","SURVEILLANCE DES MODIFICATIONS DE COMPTE\nLes actions sur les comptes doivent être surveillées pour repérer les activités suspectes ou inhabituelles, comme par exemple :\n - ouverture ou fermeture anormale de comptes ; \n - modifications de compte suspectes ;\n - comportements suspects de modification des identifiants de sécurité (ex. code confidentiel) ; \n - comportements suspects de changement de carte SIM ;\n - duplication de comptes.\n","GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML","2.4.1.5.1","les actions sur les comptes sont-elles surveillées pour repérer les activités suspectes ou inhabituelles, telles que l'ouverture/fermeture/modification de compte, les changements suspects de code confidentiel ou carte SIM ou la duplication de comptes?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.4","2.4.1",null,"2.4.1.5","MONITOREO DE CAMBIOS EN CUENTAS\nToda acción sobre una cuenta debe ser monitoreada a fin de identificar cualquier actividad atípica o sospechosa. Estas acciones deben incluir:\n  - Apertura o cierre de cuenta atípico\n  - Cambios sospechoso en la cuenta\n  - Patrón sospechoso de cambios en las credenciales de seguridad (por ej., NIP)\n  - Patrón sospechoso de cambios en la tarjeta SIM\n  - Duplicación de cuentas","GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML","2.4.1.5.1","¿Se monitorean las acciones en las cuentas para identificar toda actividad atípica o sospechosa, incluidos los cambios)",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.4","2.4.1",null,"2.4.1.5",null,"GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML","2.4.1.5.1",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.4.1.5.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,0,0,0,{"$f":"UPPER(CONCATENATE(Introduction!C11,\": \",Introduction!D11))","v":"2.5: RISK-BASED KYC AND TRANSACTION / BALANCE LIMITS"},null,null,{"$f":"BB46","v":0},null,{"$f":"Introduction!E11","v":"Providers shall collect KYC and screen customers, and apply risk-based limits or blocks on transactions and account balances"},null,null,null,null,null,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$11,\": \",Introduction!$L$11))","v":"2.5: RISK-BASED KYC AND TRANSACTION / BALANCE LIMITS"},null,null,null,null,null,{"$f":"Introduction!$M$11","v":"Providers shall collect KYC and screen customers, and apply risk-based limits or blocks on transactions and account balances"},null,null,null,null,0,null,null,0,0,0,null,null,null,null,null,null,null,null,null,null,0,null,null,0,0,0,{"$f":"UPPER(CONCATENATE(Introduction!$U$11,\": \",Introduction!$V$11))","v":"2.5: RÉGIMEN DE CSC BASADO EN RIESGOS Y LÍMITES A TRANSACCIONES Y SALDOS"},null,null,0,0,{"$f":"Introduction!W11","v":"El proveedor recabará información y evaluará a los clientes conforme el régimen de CSC y aplicará límites a las cuentas o saldos en función de los riesgos o los bloqueará."},null,null,{"$error":"#N/A"},{"$error":"#N/A"},0,null,null,0,0,0,null,0,0,0,0,null,null,null,null,null,0]
[null,"2","2.5","2.5.1",{"$f":"CHOOSE(LanguageNumber,AY47,BP47,CF47,CV47)","v":"2.5.1: Providers shall adequately identify clients"},"2.5.1.1",{"$f":"AZ47&\": \"&CHOOSE(LanguageNumber,BA47,BR47,CH47,CX47)","v":"2.5.1.1: KYC POLICY / REQUIREMENTS\nProviders should have a documented KYC policy (or doocumented KYC requirements) specifying the appropriate KYC to be collected for each type of account and the acceptable documentation.\n\nA risk-based KYC approach is recommended, which determines that higher-risk accounts or transactions (such as accounts with higher limits and/or greater functionality, transactions to/from high-risk markets, or accounts/transactions by politically exposed persons) require enhanced KYC, while simplified KYC is sufficient for lower-risk accounts (such as accounts with lower transaction and balance limits aimed at promoting financial inclusion)."},"GSMA RMT (AG-09 )",{"$f":"BC47","v":"2.5.1.1.1"},{"$f":"BC47&\": \"&CHOOSE(LanguageNumber,BE47,BU47,CK47,DA47)&CarriageReturn","v":"2.5.1.1.1: Are the KYC requirements for customers documented, specifying the appropriate KYC to be collected for each type of account and the acceptable documentation?\n(Also see definition of risk-based KYC).\n"},{"$f":"CHOOSE(LanguageNumber,BF47,BV47,CL47,DB47)","v":"1) KYC policy / KYC requirements / account registration process\n- Check that this specifies the KYC information required for each account type offered by the provider.\n- Check that the provider has assessed that the KYC information captured meets local regulatory requirements."},{"$f":"CHOOSE(LanguageNumber,BG47,BW47,CM47,DC47)","v":0},{"$f":"CHOOSE(LanguageNumber,BH47,BX47,CN47,DD47)","v":"Urgent Required"},{"$f":"CHOOSE(LanguageNumber,BI47,BY47,CO47,DE47)","v":"Required"},"FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.1","2.5.1: Providers shall adequately identify clients","2.5.1.1","KYC POLICY / REQUIREMENTS\nProviders should have a documented KYC policy (or doocumented KYC requirements) specifying the appropriate KYC to be collected for each type of account and the acceptable documentation.\n\nA risk-based KYC approach is recommended, which determines that higher-risk accounts or transactions (such as accounts with higher limits and/or greater functionality, transactions to/from high-risk markets, or accounts/transactions by politically exposed persons) require enhanced KYC, while simplified KYC is sufficient for lower-risk accounts (such as accounts with lower transaction and balance limits aimed at promoting financial inclusion).","GSMA RMT (AG-09 )","2.5.1.1.1","2.5.1.1.1","Are the KYC requirements for customers documented, specifying the appropriate KYC to be collected for each type of account and the acceptable documentation?\n(Also see definition of risk-based KYC).","1) KYC policy / KYC requirements / account registration process\n- Check that this specifies the KYC information required for each account type offered by the provider.\n- Check that the provider has assessed that the KYC information captured meets local regulatory requirements.",null,"Urgent Required","Required","FraudRisk",null,null,"2","2.5","2.5.1","2.5.1: Les prestataires doivent dûment vérifier l’identité des clients ","2.5.1.1","POLITIQUE DE VÉRIFICATION DE L'IDENTITÉ DES CLIENTS (KYC)\nLes prestataires doivent avoir une politique documentée de vérification de l'identité des clients spécifiant le niveau de vérification et les justificatifs à obtenir pour chaque type de compte ainsi que les documents jugés acceptables (cf. note explicative).","GSMA RMT (AG-09 )","2.5.1.1.1","existe-t-il une documentation sur les exigences de vérification de l'identité des clients spécifiant le niveau de vérification et les justificatifs à obtenir pour chaque type de compte ainsi que les documents jugés acceptables ?\n(Cf. Définition d'approche KYC fondée sur le niveau de risque)","1) KYC Politique / KYC exigences / Processus d’enregistrement des nouveaux clients\n- Vérifier que ces éléments incluent les informations nécessaires pour chaque type de compte proposé par le prestataire.\n- Vérifier que le prestataire a constaté que les KYC informations nécessaires à la vérification de l’identité des clients recueillies satisfont aux exigences définies par les réglementations locales.",null,{"$f":"VLOOKUP(BH47,CategoryTranslationTable,2,FALSE)","v":"Requis Prioritaire"},{"$f":"VLOOKUP(BI47,CategoryTranslationTable,2,FALSE)","v":"Requis"},"FraudRisk","La politique doit définir une \"approche fondée sur le niveau de risque\" pour la vérification de l'identité des clients, qui prévoit des vérifications d'identité plus poussées pour les comptes ou transactions présentant un risque plus important (tels que les comptes à plafonds plus élevés ou fonctionnalités plus importantes, les transactions vers/en provenance de marchés plus risqués ou les comptes ou transactions impliquant des personnes politiquement exposées), tandis que les comptes à risque plus faible (tels que les comptes à plafonds de solde et d'opération plus limités en vue de favoriser l'inclusion financière) bénéficient de formalités réduites de vérification de l'identité des clients.",null,"2","2.5","2.5.1","2.5.1: Los proveedores deben identificar adecuadamente a los clientes","2.5.1.1","POLÍTICA / REQUISITOS DE CSC \nLos proveedores deben contar con una política de CSC documentada (o requisitos de CSC documentados) que especifique el CSC adecuado que debe ser recolectado para cada tipo de cuenta y la documentación aceptable.\n\nSe recomienda un enfoque de CSC basado en riesgos, que determina que las cuentas o transacciones de alto riesgo (como las cuentas con límites más altos y/o mayores funcionalidades, transacciones hacia/desde mercados de alto riesgo, o cuentas/transacciones por personas expuestas políticamente) requieren CSC intensificado, mientras que CSC simplificado es suficiente para cuentas de menor riesgo (como cuentas con límites de transacciones y saldos más bajos destinadas a promover la inclusión financiera).","GSMA RMT (AG-09 )","2.5.1.1.1","¿Se documentaron los requisitos de CSC para el cliente, especificando el CSC adecuado que debe ser recolectado para cada tipo de cuenta y la documentación aceptable?\n(Ver también la definición de CSC basado en riesgos).","1) Política de CSC / requisitos de CSC / proceso de registro de cuentas\n- Verificar que especifique la información de CSC requerida para cada tipo de cuenta ofrecida por el proveedor.\n- Verificar que el proveedor haya evaluado que la información de CSC capturada cumpla con los requisitos regulatorios locales.",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,"2","2.5","2.5.1",null,"2.5.1.1",null,"GSMA RMT (AG-09 )","2.5.1.1.1",null,null,null,{"$f":"VLOOKUP($BH47,CategoryTranslationTable,4,FALSE)","v":"ReqU4"},{"$f":"VLOOKUP($BI47,CategoryTranslationTable,4,FALSE)","v":"Req4"},"FraudRisk",null,null,null,null,null,null,null,null,"2.5.1.1.1",null,null,null,{"$f":"IF(OR($EA47=0,$EA47=2),VLOOKUP(DO47,INDIRECT(ED47),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP47),\"\",VLOOKUP(DP47,INDIRECT(EE47),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ47),\"\",VLOOKUP(DQ47,INDIRECT(EF47),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR47),\"\",VLOOKUP(DR47,INDIRECT(EG47),7,FALSE))","v":""},{"$f":"IF(OR($EA47=0,$EA47=2),VLOOKUP(DO47,INDIRECT(ED47),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP47),\"\",VLOOKUP(DP47,INDIRECT(EE47),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ47),\"\",VLOOKUP(DQ47,INDIRECT(EF47),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR47),\"\",VLOOKUP(DR47,INDIRECT(EG47),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN47,3)=\"NEW\")+2*AND(LEFT(DN47,3)=\"MER\")+3*AND(LEFT(DN47,3)=\"MOV\")+4*AND(LEFT(DN47,3)=\"SWA\")","v":0},{"$f":"IF(EA47=0,DS47,EN47)","v":{"$error":"#REF!"}},{"$f":"IF(EA47=0,IF(DW47=0,\"\",DW47),CHOOSE(EA47,\"New indicator\",CONCATENATE(DW47,CarriageReturn,DX47,CarriageReturn,DY47,CarriageReturn,DZ47)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO47,1)","v":"OriginalComplianceP2"},{"$f":"\"OriginalComplianceP\"&LEFT(DP47,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ47,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR47,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,""]
[null,"2","2.5","2.5.1",0,"2.5.1.2",{"$f":"AZ48&\": \"&CHOOSE(LanguageNumber,BA48,BR48,CH48,CX48)","v":"2.5.1.2: MINIMUM KYC FOR BASIC ACCOUNTS AND LOW-VALUE OCCASIONAL TRANSACTIONS\nAt minimum, and subject to local law and regulation, providers should collect the following information at account opening or when conducting a low-value occasional transaction (e.g. OTC), either directly (for example, when a customer self-registers on their phone) or using agents: \n- Full name of Applicant; \n- Date of birth of Applicant; \n- Mobile telephone number of Applicant (if applicable);\n\nDepending upon domestic AML/CFT requirements, verification of information may be delayed or may not be required for low-value accounts or occasional transactions. Higher transaction/balance limits should require more KYC and stronger verification.\n\nIf permitted by local law, a basic account with limited functionality may be opened remotely using customer information already collected by the provider, government, or other party (e.g. from SIM registration or centralized electronic database). "},"GSMA RMT (AG-09 )","2.5.1.2.1","2.5.1.2.1: Is all the following minimum KYC collected from customers opening basic accounts or conducting low-value occasional transactions (e.g. OTC)?\n","1) KYC policy / KYC requirements / account registration process\n- Check that basic/low risk accounts (that only permit low value transactions) require the collection of at least the following KYC information:\n     a) Full name \n     b) Date of birth of Applicant\n     c) Mobile number or unique reference number\n\n[This indicator should be marked N/A if this type of basic account is not offered by the provider]",0,"Urgent Required","Required","FraudRisk",{"$f":"CHOOSE(LanguageNumber,BK48,CA48,CQ48,DG48)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.1",null,"2.5.1.2","MINIMUM KYC FOR BASIC ACCOUNTS AND LOW-VALUE OCCASIONAL TRANSACTIONS\nAt minimum, and subject to local law and regulation, providers should collect the following information at account opening or when conducting a low-value occasional transaction (e.g. OTC), either directly (for example, when a customer self-registers on their phone) or using agents: \n- Full name of Applicant; \n- Date of birth of Applicant; \n- Mobile telephone number of Applicant (if applicable);\n\nDepending upon domestic AML/CFT requirements, verification of information may be delayed or may not be required for low-value accounts or occasional transactions. Higher transaction/balance limits should require more KYC and stronger verification.\n\nIf permitted by local law, a basic account with limited functionality may be opened remotely using customer information already collected by the provider, government, or other party (e.g. from SIM registration or centralized electronic database). ","GSMA RMT (AG-09 )","2.5.1.2.1","2.5.1.2.1","Is all the following minimum KYC collected from customers opening basic accounts or conducting low-value occasional transactions (e.g. OTC)?","1) KYC policy / KYC requirements / account registration process\n- Check that basic/low risk accounts (that only permit low value transactions) require the collection of at least the following KYC information:\n     a) Full name \n     b) Date of birth of Applicant\n     c) Mobile number or unique reference number\n\n[This indicator should be marked N/A if this type of basic account is not offered by the provider]",null,"Urgent Required","Required","FraudRisk",null,null,"2","2.5","2.5.1",0,"2.5.1.2","VÉRIFICATION MINIMALE POUR LES COMPTES DE BASE ET LES TRANSACTIONS OCCASIONNELLES DE FAIBLE MONTANT\nAu minimum, et sous réserve des lois et réglementations locales, les prestataires doivent obtenir les renseignements suivants lors de l’ouverture des comptes ou de la réalisation d’une transaction occasionnelle de faible montant (au guichet par exemple), que ce soit directement (lorsque les clients s’enregistrent par eux-mêmes sur leur téléphone par exemple) ou par le biais des agents : \n- nom complet du demandeur ; \n- date de naissance du demandeur ; \n- numéro de téléphone portable du demandeur (le cas échéant).\n\nSelon les obligations AML/CFT locales, la vérification de ces informations peut être différée ou ne pas être exigée pour des comptes de faible montant ou des transactions occasionnelles. Les plafonds de solde ou d’opération plus élevés doivent correspondre à des exigences de renseignements supplémentaires et de vérification plus poussée.\n\nSi les lois locales le permettent, des comptes de base peuvent être ouverts à distance avec des fonctionnalités restreintes sur la base de renseignements d’identité déjà collectés par le prestataire, les pouvoirs publics ou une autre partie (par ex. lors de l’enregistrement de la carte SIM ou d’une base de données électronique centrale). ","GSMA RMT (AG-09 )","2.5.1.2.1","les renseignements d'identité suivants sont-ils au minimum demandés à tous les clients ouvrant des comptes de bases ou effectuant des transactions occasionnelles de faible montant (au guichet par exemple) ?","1) KYC Politique / KYC exigences / Processus d’enregistrement des nouveaux clients\n- Vérifier que l’ouverture de comptes ordinaires/à bas risque (ne permettant que des transactions de faible valeur) nécessite de recueillir au minimum les KYC informations suivantes :\na) Nom complet \nb) Date de naissance du demandeur \nc) Numéro de téléphone portable ou numéro de référence unique\n\nIndiquez la mention n/d pour cet indicateur si le prestataire ne propose pas ce type de comptes ordinaires]",null,"Requis Prioritaire","Requis","FraudRisk",0,null,"2","2.5","2.5.1",null,"2.5.1.2","CSC MÍNIMO PARA CUENTAS BÁSICAS Y TRANSACCIONES OCASIONALES DE BAJO MONTO\nComo mínimo, y sujeto a las leyes y regulaciones locales, los proveedores deben recolectar la siguiente información al momento de la apertura de la cuenta o cuando se realiza una transacción ocasional de bajo monto (por ej., transacciones extrabursátiles - OTC), ya sea de forma directa (por ejemplo, cuando un cliente se auto-registra en su teléfono) o mediante agentes: \n- Nombre completo del Solicitante; \n- Fecha de nacimiento del Solicitante; \n- Número de teléfono móvil del Solicitante (si corresponde);\n\nDependiendo de los requisitos ALA/CFT locales, la verificación de la información podría demorarse o podría no ser requerida para cuentas o transacciones ocasionales de bajo monto. Los límites de transacciones/saldos más altos deben requerir un mayor CSC y más verificación.\n\nSi lo permite la legislación local, una cuenta básica con funcionalidades limitadas podría abrirse de forma remota utilizando la información del cliente ya recolectada por el proveedor, el gobierno u otra parte (por ej., del registro de SIM o base de datos electrónica centralizada).","GSMA RMT (AG-09 )","2.5.1.2.1","¿Se recolecta el siguiente CSC mínimo de los clientes que abren cuentas básicas o que realizan transacciones ocasionales de bajo monto (por ej., transacciones extrabursátiles - OTC)?","1) Política de CSC / requisitos de CSC / proceso de registro de cuentas\n- Verificar que las cuentas básicas/de bajo riesgo (que solo permiten transacciones de bajo monto) requieran la recolección de, al menos, la siguiente información de CSC:\n     a) Nombre completo\n     b) Fecha de nacimiento del Solicitante\n     c) Número móvil o número único de referencia   \n\n[Este indicador se debe marcar con N/A si el proveedor no ofrece este tipo de cuenta básica].",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,"2","2.5","2.5.1",null,"2.5.1.2",null,"GSMA RMT (AG-09 )","2.5.1.2.1",null,null,null,"ReqU4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.1.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.1","","2.5.1.3",{"$f":"AZ49&\": \"&CHOOSE(LanguageNumber,BA49,BR49,CH49,CX49)","v":"2.5.1.3: KYC FOR REGULAR ACCOUNTS\nAdditional KYC Information can be collected to enable higher-limit accounts or additional functionality and this may include: \n- All information required for Basic KYC; \n- Place of birth of Applicant; \n- Photograph of Applicant; \n- Current residential address of Applicant; \n- National ID number of Applicant (if such exists in the relevant jurisdiction) or other identifying number;\n- Any other information required to comply with local AML/CFT regulations.\n\nIf widely available, a national ID document should be used to verify customer identity. If a national ID is not widely available, one or more of the following IDs may be considered, if permitted by local laws and regulations. As part of the risk-based KYC approach, providers should evaluate the reliability of different identification documents when determining requirements for different account tiers: \n- Passport  \n- Voting card \n- Driver's licence \n- Social security card\n- Employee ID \n- Student ID \n- Salary slip \n- Tax report \n- Other government-issued ID\n- Attestation letter from local government official or person of appropriate standing in the community, such as a village chief.\n"},"GSMA RMT (AG-09 )","2.5.1.3.1","2.5.1.3.1: In addition to the minimum KYC, is the National ID or other identifying number collected from customers opening regular accounts (if applicable)?\n","1) KYC policy / KYC requirements / account registration process\n- Check that regular accounts require the collection of at least the following KYC information:\n     1) Full name\n     2) Date of birth of the applicant\n     3) Mobile number or unique reference number\n     4) National ID number or other identifying number ",0,"Urgent Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.1","","2.5.1.3","KYC FOR REGULAR ACCOUNTS\nAdditional KYC Information can be collected to enable higher-limit accounts or additional functionality and this may include: \n- All information required for Basic KYC; \n- Place of birth of Applicant; \n- Photograph of Applicant; \n- Current residential address of Applicant; \n- National ID number of Applicant (if such exists in the relevant jurisdiction) or other identifying number;\n- Any other information required to comply with local AML/CFT regulations.\n\nIf widely available, a national ID document should be used to verify customer identity. If a national ID is not widely available, one or more of the following IDs may be considered, if permitted by local laws and regulations. As part of the risk-based KYC approach, providers should evaluate the reliability of different identification documents when determining requirements for different account tiers: \n- Passport  \n- Voting card \n- Driver's licence \n- Social security card\n- Employee ID \n- Student ID \n- Salary slip \n- Tax report \n- Other government-issued ID\n- Attestation letter from local government official or person of appropriate standing in the community, such as a village chief.\n","GSMA RMT (AG-09 )","2.5.1.3.1","2.5.1.3.4","In addition to the minimum KYC, is the National ID or other identifying number collected from customers opening regular accounts (if applicable)?","1) KYC policy / KYC requirements / account registration process\n- Check that regular accounts require the collection of at least the following KYC information:\n     1) Full name\n     2) Date of birth of the applicant\n     3) Mobile number or unique reference number\n     4) National ID number or other identifying number ",null,"Urgent Required","Required","FraudRisk",null,null,"2","2.5","2.5.1","","2.5.1.3","VÉRIFICATION POUR LES COMPTES ORDINAIRES\nDes renseignements supplémentaires d’identité peuvent être collectés pour autoriser des plafonds plus élevés ou des fonctionnalités supplémentaires sur les comptes, et peuvent par exemple inclure : \n- tous les renseignements exigés pour la vérification d’identité minimale ; \n- le lieu de naissance du demandeur ; \n- la photographie du demandeur ; \n- l’adresse du domicile actuel du demandeur ; \n- le numéro national d’identité du demandeur (s’il existe dans le pays concerné) ou autre numéro d’identification ;\n- tout autre renseignement requis en vertu des réglementations locales de lutte contre le blanchiment de capitaux et le financement du terrorisme.\n\nLorsqu’elle est courante, la carte nationale d’identité doit être utilisée pour vérifier l’identité des clients. Dans le cas contraire, un ou plusieurs documents d’identité parmi ceux qui suivent peuvent être utilisés, si les lois et réglementations locales le permettent. Dans le cadre d’une approche KYC fondée sur le niveau de risque, les prestataires doivent évaluer la fiabilité des différents documents d’identité lorsqu’ils définissent les exigences de vérification pour les différents niveaux de comptes : \n- passeport  \n- carte d’électeur \n- permis de conduire \n- carte de sécurité sociale\n- carte professionnelle \n- carte d’étudiant \n- feuille de paie \n- déclaration fiscale \n- autre pièce d’identité émise par les pouvoirs publics\n- attestation écrite d’un responsable officiel local ou d’une personne de statut équivalent dans la communauté, comme par exemple un chef de village.\n","GSMA RMT (AG-09 )","2.5.1.3.1","en plus des renseignements d'identité minimaux, le numéro national d'identité ou un autre numéro d'identification est-il demandé (le cas échéant) pour l'ouverture de comptes ordinaires ?","1) KYC Politique / KYC exigences / Processus d’enregistrement des nouveaux clients\n- Vérifier que l’ouverture des comptes ordinaires nécessite de recueillir au minimum les KYC informations suivantes :\n1) Nom complet\n2) Date de naissance du demandeur2\n3) Numéro de téléphone portable ou numéro de référence unique\n4) Numéro de carte d’identité ou autre numéro d’identification ",null,"Requis Prioritaire","Requis","FraudRisk",0,null,"2","2.5","2.5.1",null,"2.5.1.3","CSC PARA CUENTAS REGULARES\nSe puede recolectar información de CSC adicional para permitir cuentas con límites más altos o con funcionalidades adicionales, y esta información puede incluir: \n- Toda la información requerida para CSC Básico; \n- Lugar de nacimiento del Solicitante; \n- Fotografía del Solicitante; \n- Domicilio de residencia actual del Solicitante; \n- Número nacional de identificación del Solicitante (si existe en la jurisdicción correspondiente) u otro número de identificación;\n- Cualquier otra información requerida para cumplir con las regulaciones ALA/CFT locales.\n\nSi estuviese fácilmente disponible, se debe utilizar un documento nacional de identidad para verificar la identidad del cliente. Si un documento nacional de identidad no estuviese fácilmente disponible, se pueden considerar una o más de las siguientes identificaciones, siempre que sean permitidas por las leyes y regulaciones locales. Como parte del enfoque de CSC basado en riesgos, los proveedores deben evaluar la confiabilidad de los distintos documentos de identificación al determinar los requisitos para las diferentes capas de cuentas: \n- Pasaporte\n- Credencial de elector\n- Licencia de conducir\n- Credencial de seguridad social\n- ID de empleado\n- ID de estudiante\n- Recibo de sueldo\n- reporte fiscal\n- Otro ID emitido por el gobierno\n- Declaración del funcionario de gobierno local o persona con la adecuada autoridad en la comunidad, como el intendente municipal.","GSMA RMT (AG-09 )","2.5.1.3.1","¿Además del CSC mínimo, se recolecta el Documento Nacional de Identificación u otro número de identificación de los clientes que abren cuentas regulares (si corresponde)?","1) Política de CSC / requisitos de CSC / proceso de registro de cuentas\n- Verificar que las cuentas regulares requieran la recolección de, al menos, la siguiente información de CSC:\n     1) Nombre completo\n     2) Fecha de nacimiento del solicitante\n     3) Número móvil o número único de referencia\n     4) Número nacional de identificación u otro número de identificación",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,"2","2.5","2.5.1",null,"2.5.1.3",null,"GSMA RMT (AG-09 )","2.5.1.3.1",null,null,null,"ReqU4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.1.3.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.1","","2.5.1.3",null,0,"2.5.1.3.2","2.5.1.3.2: In addition to the minimum KYC, is a photograph of the applicant taken for customers opening regular accounts?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.1","","2.5.1.3",null,null,"2.5.1.3.2","2.5.1.3.2","In addition to the minimum KYC, is a photograph of the applicant taken for customers opening regular accounts?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.5","2.5.1","","2.5.1.3",0,0,"2.5.1.3.2","en plus des renseignements d'identité minimaux, une photographie du client est-elle prise pour l'ouverture de comptes ordinaires ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.5","2.5.1",null,"2.5.1.3",null,0,"2.5.1.3.2","¿Además del CSC mínimo, se toma una fotografía del solicitante para los clientes que abren cuentas regulares?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.5","2.5.1",null,"2.5.1.3",null,0,"2.5.1.3.2",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.1.3.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.1","","2.5.1.3",null,0,"2.5.1.3.3","2.5.1.3.3: In addition to the minimum KYC, is the current residential address collected from customers opening regular accounts?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.1","","2.5.1.3",null,null,"2.5.1.3.3","2.5.1.3.3","In addition to the minimum KYC, is the current residential address collected from customers opening regular accounts?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.5","2.5.1","","2.5.1.3",0,0,"2.5.1.3.3","en plus des renseignements d'identité minimaux, l'adresse du domcile du client est-elle demandée pour l'ouverture de comptes ordinaires ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.5","2.5.1",null,"2.5.1.3",null,0,"2.5.1.3.3","¿Además del CSC mínimo, se recolecta el domicilio de residencia actual de los clientes que abren cuentas regulares?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.5","2.5.1",null,"2.5.1.3",null,0,"2.5.1.3.3",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.1.3.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.1","","2.5.1.3",null,0,"2.5.1.3.4","2.5.1.3.4: In addition to the minimum KYC, is the place of birth collected from customers opening regular accounts?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.1","","2.5.1.3",null,null,"2.5.1.3.4","2.5.1.3.1","In addition to the minimum KYC, is the place of birth collected from customers opening regular accounts?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.5","2.5.1","","2.5.1.3",0,0,"2.5.1.3.4","en plus des renseignements d'identité minimaux, le lieu de naissance des clients est-il demandé pour l'ouverture de comptes ordinaires ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.5","2.5.1",null,"2.5.1.3",null,0,"2.5.1.3.4","¿Además del CSC mínimo, se recolecta el lugar de nacimiento de los clientes que abren cuentas regulares?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.5","2.5.1",null,"2.5.1.3",null,0,"2.5.1.3.4",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.1.3.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.1","","2.5.1.3",null,0,"2.5.1.3.5","2.5.1.3.5: Do contracts with business customers oblige them to provide updated details to the provider whenever there is a material change in the business ownership or management?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.1","","2.5.1.3",null,null,"2.5.1.3.5","2.5.1.4.4","Do contracts with business customers oblige them to provide updated details to the provider whenever there is a material change in the business ownership or management?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.5","2.5.1","","2.5.1.3",null,0,"2.5.1.3.5","les contrats avec les clients professionnels les obligent-ils à fournir des renseignements actualisés au prestataire chaque fois qu'un changement significatif se produit concernant les associés ou les dirigeants de l'entreprise ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.5","2.5.1",null,"2.5.1.3",null,0,"2.5.1.3.5","¿Los contratos con los clientes comerciales los obligan a brindar detalles actualizados al proveedor siempre que ocurra un cambio importante en la titularidad o gerencia del negocio?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.5","2.5.1",null,"2.5.1.3",null,0,"2.5.1.3.5",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.1.4.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.1",{"$f":"CHOOSE(LanguageNumber,AY54,BP54,CF54,CV54)","v":""},"2.5.1.4",{"$f":"AZ54&\": \"&CHOOSE(LanguageNumber,BA54,BR54,CH54,CX54)","v":"2.5.1.4: KYC FOR BUSINESS ACCOUNTS\nEnhanced customer information should be collected for business customers and merchants and their directors. Business accounts typically have higher transaction limits so the ML/TF risks are higher. \n\nThe minimum additional Business KYC information to be collected is:\n- Identification of owners of the business;\n- Identification of members of senior management of the business;\n\nBackground checks on the owners and senior management of the business, including a police check and bankruptcy check, should be made where possible, and the financial viability and reputation of the business should be established, taking references where necessary. Using a risk-based approach, providers should consider checking the source of a business customer's funds and, where appropriate, their income statements.\n\nData should be reviewed and updated annually and whenever there is a material change in the business ownership or management. Contracts with business customers should oblige them to provide updated details to the provider whenever there is a material change in the business ownership or management.\n\nReports should be run regularly to ensure that all business customers have complete KYC for their owners and senior managers."},"GSMA RMT (FR.P-28)","2.5.1.4.1","2.5.1.4.1: Are the KYC requirements for business accounts documented; in particular, the requirement for identification of the owners and senior management of each business?\n",{"$f":"CHOOSE(LanguageNumber,BF54,BV54,CL54,DB54)","v":"1) KYC policy / KYC requirements / account registration process\n- Check that KYC requirements are specified for business accounts (e.g. certificate of incorporation or registration, Tax registration, Business licence or permit, Bank details, ID documents for owners and directors)\n- Check that business accounts require risk-based identity checks of owners and/or directors"},0,"Standard Required","Required","FraudRisk",{"$f":"CHOOSE(LanguageNumber,BK54,CA54,CQ54,#REF!)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.1","","2.5.1.4","KYC FOR BUSINESS ACCOUNTS\nEnhanced customer information should be collected for business customers and merchants and their directors. Business accounts typically have higher transaction limits so the ML/TF risks are higher. \n\nThe minimum additional Business KYC information to be collected is:\n- Identification of owners of the business;\n- Identification of members of senior management of the business;\n\nBackground checks on the owners and senior management of the business, including a police check and bankruptcy check, should be made where possible, and the financial viability and reputation of the business should be established, taking references where necessary. Using a risk-based approach, providers should consider checking the source of a business customer's funds and, where appropriate, their income statements.\n\nData should be reviewed and updated annually and whenever there is a material change in the business ownership or management. Contracts with business customers should oblige them to provide updated details to the provider whenever there is a material change in the business ownership or management.\n\nReports should be run regularly to ensure that all business customers have complete KYC for their owners and senior managers.","GSMA RMT (FR.P-28)","2.5.1.4.1","2.5.1.4.1","Are the KYC requirements for business accounts documented; in particular, the requirement for identification of the owners and senior management of each business?","1) KYC policy / KYC requirements / account registration process\n- Check that KYC requirements are specified for business accounts (e.g. certificate of incorporation or registration, Tax registration, Business licence or permit, Bank details, ID documents for owners and directors)\n- Check that business accounts require risk-based identity checks of owners and/or directors",null,"Standard Required","Required","FraudRisk",null,null,"2","2.5","2.5.1","","2.5.1.4","VÉRIFICATION POUR LES COMPTES PROFESSIONNELS\nDes renseignements supplémentaires doivent être collectés pour les clients professionnels, les commerçants et leurs dirigeants. Les comptes professionnels ont généralement des plafonds d’opération plus élevés et présentent donc des risques plus importants de blanchiment de capitaux / financement du terrorisme. \n\nLes renseignements supplémentaires à obtenir pour les clients professionnels sont au minimum : \n- l’identité des propriétaires de l’entreprise ;\n- l’identité des dirigeants de l’entreprise. \n\nDans la mesure du possible, il convient de vérifier les antécédents des propriétaires et dirigeants de l’entreprise, avec notamment un contrôle de police (ou judiciaire) et une vérification des faillites, et de documenter la réputation et la viabilité financière de l’entreprise, au moyen de références si nécessaire. Dans le cadre d’une approche fondée sur le niveau de risque, les prestataires doivent être prêts à vérifier la source des fonds d’un client professionnel et, si nécessaire, ses déclarations de revenus.\n\nCes informations doivent être examinées et actualisées au moins une fois par an et lors de chaque changement significatif concernant les associés ou les dirigeants de l’entreprise. Les conventions de comptes professionnels doivent obliger les clients à fournir des renseignements actualisés au prestataire lors de tout changement de cette nature. \n\nDes rapports doivent être établis régulièrement pour vérifier que tous les clients professionnels se sont acquittés de leurs obligations de vérification d’identité des associés et dirigeants de l’entreprise concernée.\n","GSMA RMT (FR.P-28)","2.5.1.4.1","Existe-t-il une documentation sur les exigences de vérification de l’identité des clients de comptes d’entreprise, notamment sur les exigences de vérification des propriétaires et de la direction générale de chaque entreprise ?","1) Politique / exigences de vérification / processus d’enregistrement des nouveaux clients\n\r- Vérifier que des exigences de vérification ont été définies pour les comptes d’entreprises\r(par exemple, acte de constitution ou d’immatriculation, immatriculation auprès des autorités fiscales, permis ou licence professionnel(le), coordonnées bancaires, pièce d’identité des propriétaires et des dirigeants,)\n\r- Vérifier qu’un contrôle de l’identité des propriétaires et/ou des dirigeants basé sur les risques est requis pour les comptes d’entreprises\r\n\r\n\r",null,"Requis Normal","Requis","FraudRisk",0,null,"2","2.5","2.5.1",null,"2.5.1.4","CSC PARA CUENTAS COMERCIALES\nSe debe recolectar información intensificada del cliente para clientes comerciales, comercios y sus directores. Por lo general, las cuentas comerciales tienen límites de transacciones más altos, por ende los riesgos de LA/FT son más altos. \n\nLa información adicional mínima de CSC del Negocio que se debe recolectar es la siguiente:\n- Identificación de los titulares del negocio;\n- Identificación de los miembros de la alta gerencia del negocio;\n\nCuando sea posible se deben realizar verificaciones de antecedentes de los titulares y de la alta gerencia del negocio, incluyendo la verificación de antecedentes penales y quiebra, y se debe establecer la viabilidad financiera y la reputación del negocio, pidiendo referencias cuando sea necesario. Empleando un enfoque basado en riesgos, los proveedores deben considerar la verificación del origen de los fondos del cliente comercial y, cuando corresponda, sus declaraciones de ganancias.\n\nLos datos deben ser revisados y actualizados una vez al año y siempre que ocurra un cambio importante en la titularidad o gerencia del negocio. Los contratos con los clientes comerciales deben obligarlos a brindar detalles actualizados al proveedor siempre que ocurra un cambio importante en la titularidad o gerencia del negocio.\n\nSe deben ejecutar reportes periódicamente para garantizar que todos los clientes comerciales tengan CSC completos para sus titulares y gerentes jerárquicos.","GSMA RMT (FR.P-28)","2.5.1.4.1","¿Están documentados los requisitos de CSC para cuentas comerciales, en particular, el requisito de identificación de los titulares y la alta gerencia de cada negocio?","1) Política de CSC / requisitos de CSC / proceso de registro de cuentas\n- Verificar que se especifiquen los requisitos de CSC para cuentas comerciales (por ej., acta constitutiva o certificado de registro, registro fiscal, licencia o permiso mercantil, detalles bancarios, documentos de identificación de los titulares y directores)\n- Verificar que las cuentas comerciales requieran verificaciones de identidad basadas en riesgos para los titulares y/o directores",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,"2","2.5","2.5.1",null,"2.5.1.4",null,"GSMA RMT (FR.P-28)","2.5.1.4.1",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.1.4.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.1","","2.5.1.4",null,0,"2.5.1.4.2","2.5.1.4.2: Are suitable checks (e.g. police check, bankruptcy check, financial viability and reputation) are made on business customers, and references taken if necessary?\n",0,0,"Recommended","Recommended","FraudRisk",{"$f":"CHOOSE(LanguageNumber,BK55,CA55,CQ55,#REF!)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.1","","2.5.1.4",null,null,"2.5.1.4.2","2.5.1.4.2","Are suitable checks (e.g. police check, bankruptcy check, financial viability and reputation) are made on business customers, and references taken if necessary?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.5","2.5.1","","2.5.1.4",0,0,"2.5.1.4.2","Des vérifications appropriées sont-elles effectuées pour les clients professionnels (contrôle de police/judiciaire, vérification des faillites, solidité financière et réputation), en prenant des références si nécessaire ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.5","2.5.1",null,"2.5.1.4",null,0,"2.5.1.4.2","¿Se realizan las verificaciones correspondientes (por ej., antecedentes penales, verificación de quiebra, viabilidad financiera y reputación) sobre los clientes comerciales, y se piden referencias si fuese necesario?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.5","2.5.1",null,"2.5.1.4",null,0,"2.5.1.4.2",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.1.4.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.1",0,"2.5.1.4",null,0,"2.5.1.4.3","2.5.1.4.3: Is KYC data reviewed and updated as needed?\n",0,0,"Recommended","Recommended","FraudRisk",{"$f":"CHOOSE(LanguageNumber,BK56,CA56,CQ56,#REF!)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.1",null,"2.5.1.4",null,null,"2.5.1.4.3","2.5.1.4.3","Is KYC data reviewed and updated as needed?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.5","2.5.1",0,"2.5.1.4",0,0,"2.5.1.4.3","les données d'identité des clients sont-elles examinées et mises à jour si nécessaire ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.5","2.5.1",null,"2.5.1.4",null,0,"2.5.1.4.3","¿Los datos de CSC son revisados y actualizados según sea necesario?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.5","2.5.1",null,"2.5.1.4",null,0,"2.5.1.4.3",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.1.4.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.1","","2.5.1.4",null,0,"2.5.1.4.4","2.5.1.4.4: Do contracts with business customers oblige them to provide updated details to the provider whenever there is a material change in the business ownership or management?\n",0,0,"Recommended","Recommended","FraudRisk",{"$f":"CHOOSE(LanguageNumber,BK57,CA57,CQ57,#REF!)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.1","","2.5.1.4",null,null,"2.5.1.4.4","2.5.1.4.4","Do contracts with business customers oblige them to provide updated details to the provider whenever there is a material change in the business ownership or management?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.5","2.5.1","","2.5.1.4",0,0,"2.5.1.4.4","les contrats avec les clients professionnels les obligent-ils à fournir des renseignements actualisés au prestataire chaque fois qu'un changement significatif se produit concernant les associés ou les dirigeants de l'entreprise ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.5","2.5.1",null,"2.5.1.4",null,0,"2.5.1.4.4","¿Los contratos con los clientes comerciales los obligan a brindar detalles actualizados al proveedor siempre que ocurra un cambio importante en la titularidad o gerencia del negocio?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.5","2.5.1",null,"2.5.1.4",null,0,"2.5.1.4.4",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.1.4.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.1","","2.5.1.5",{"$f":"AZ58&\": \"&CHOOSE(LanguageNumber,BA58,BR58,CH58,CX58)","v":"2.5.1.5: VERIFYING KYC  \nUnder a risk-based approach (which must meet regulatory requirements), various levels of verification can be considered, depending upon transaction/balance limits and other risk controls. More rigorous verification procedures should be employed for higher-value and higher-risk accounts (see definition of risk-based KYC). \n\nAs a minimum, the following should be done:\n- Verification of KYC at the time of registration by viewing the appropriate ID document. Verification should confirm that document exists, that it is not an obvious forgery, that the photo (if there is one) is visible and matches the customer, and that the document confirms the supplied KYC details. \n- Basic system-enforced verification to ensure completeness and spot obvious issues (e.g. Date of Birth is a valid date, all fields completed, ID not duplicated).\n- Risk-based review of the KYC data, to confirm completeness and to look for errors such as obviously-false names. This could be automated or semi-automated in the system.\nIn some countries, providers are required to make a copy of the provided ID document.\n\nIf required, verification can be enforced by blocking accounts of customers whose ID has not been verified within a short period of registration (e.g. a week). Additional limits (e.g. cash-in only or very low transaction limit) may be placed on the accounts until the KYC ID has been verified. \n\nIf suspicious activity occurs on the account, then it may be necessary to carry out additional due diligence."},"GSMA RMT (FR.T-11\nAG-09 )","2.5.1.5.1","2.5.1.5.1: Is the KYC data verified at the time of registration, by the registering agent or by the provider, by viewing or copying suitable ID documentation?\n","1) KYC policy / KYC requirements / account registration process\n- Check that the KYC information provided by the applicant during registration is verified by viewing the customer's identification documentation.",0,"Urgent Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.1","","2.5.1.5","VERIFYING KYC  \nUnder a risk-based approach (which must meet regulatory requirements), various levels of verification can be considered, depending upon transaction/balance limits and other risk controls. More rigorous verification procedures should be employed for higher-value and higher-risk accounts (see definition of risk-based KYC). \n\nAs a minimum, the following should be done:\n- Verification of KYC at the time of registration by viewing the appropriate ID document. Verification should confirm that document exists, that it is not an obvious forgery, that the photo (if there is one) is visible and matches the customer, and that the document confirms the supplied KYC details. \n- Basic system-enforced verification to ensure completeness and spot obvious issues (e.g. Date of Birth is a valid date, all fields completed, ID not duplicated).\n- Risk-based review of the KYC data, to confirm completeness and to look for errors such as obviously-false names. This could be automated or semi-automated in the system.\nIn some countries, providers are required to make a copy of the provided ID document.\n\nIf required, verification can be enforced by blocking accounts of customers whose ID has not been verified within a short period of registration (e.g. a week). Additional limits (e.g. cash-in only or very low transaction limit) may be placed on the accounts until the KYC ID has been verified. \n\nIf suspicious activity occurs on the account, then it may be necessary to carry out additional due diligence.","GSMA RMT (FR.T-11\nAG-09 )","2.5.1.5.1","2.5.1.5.1","Is the KYC data verified at the time of registration, by the registering agent or by the provider, by viewing or copying suitable ID documentation?","1) KYC policy / KYC requirements / account registration process\n- Check that the KYC information provided by the applicant during registration is verified by viewing the customer's identification documentation.",null,"Urgent Required","Required","FraudRisk",null,null,"2","2.5","2.5.1","","2.5.1.5","PROCESSUS DE VÉRIFICATION DE L'IDENTITÉ DU CLIENT  \nDans le cadre d’une approche fondée sur le niveau de risque (qui doit respecter les exigences réglementaires), il est possible de prévoir différents niveaux de vérification en fonction des plafonds d’opération et de solde et d’autres contrôles du risque. Des procédures plus strictes de vérification doivent être appliquées pour les comptes de montant plus élevé qui présentent un risque plus important (cf. définition d'approche KYC fondée sur le niveau de risque). \n\nIl convient au minimum de procéder aux vérifications suivantes :\n- vérification de l’identité du client au moment de l’enregistrement au vu d’une pièce d’identité acceptable. Cela vise à vérifier que le document existe, qu’il ne s’agit pas d’un faux manifeste, que la photo est visible le cas échéant et correspond au client, et que le document confirme les renseignements fournis par le client. \n- vérification de base effectuée par le système pour vérifier que les renseignements fournis sont complets et détecter les problèmes manifestes (date de naissance valide, tous les champs sont renseignés, absence de double identité).\n- examen adapté au niveau de risque des renseignements d’identité afin de s’assurer qu’ils sont complets et de repérer les anomalies telles que des noms manifestement faux. Cet examen peut être entièrement ou partiellement automatisé dans le système.\nDans certains pays, les prestataires ont l’obligation de conserver une copie des pièces d’identité fournies.\n\nSi nécessaire, l’obligation de vérification peut être appliquée au moyen du blocage des comptes pour lesquels l’identité du client n’a pas pu être vérifiée dans un certain délai après l’enregistrement (une semaine par exemple). Des plafonds supplémentaires (par ex. dépôts d’espèces uniquement ou plafonds d’opération très bas) peuvent s’appliquer à ces comptes jusqu’à vérification complète de l’identité du client. \n\nEn cas d’opérations suspectes sur le compte, il pourrait être nécessaire d’effectuer des contrôles de vigilance supplémentaires.","GSMA RMT (FR.T-11\nAG-09 )","2.5.1.5.1","Les renseignements d’identité des clients sont-ils vérifiés lors de l’enregistrement par l'agent ou le prestataire en examinant ou réalisant une copie de la pièce d’identité présentée ?","1) KYC Politique / KYC exigences / Processus d’enregistrement des nouveaux clients\n- Vérifier que les informations fournies par le demandeur en vue de la vérification de son identité au cours de son enregistrement sont contrôlées par une analyse de la documentation relative à l’identification du client.",null,"Requis Prioritaire","Requis","FraudRisk","Une \"approche fondée sur le niveau de risque\" désigne une approche dans laquelle les comptes ou transactions présentant un risque plus important (tels que les comptes à plafonds plus élevés ou fonctionnalités plus importantes, les transactions vers/en provenance de marchés plus risqués ou les comptes ou transactions impliquant des personnes politiquement exposées) sont soumis à des vérifications d'identité plus poussées, tandis que les comptes à risque plus faible (tels que les comptes à plafonds de solde et d'opération plus limités en vue de favoriser l'inclusion financière) bénéficient de formalités réduites de vérification de l'identité des clients.",null,"2","2.5","2.5.1",null,"2.5.1.5","VERIFICACIÓN DE CSC \nConforme a un enfoque basado en riesgos (que debe cumplir los requisitos regulatorios), se pueden considerar diversos niveles de verificación, dependiendo de los límites de transacciones/saldos y otros controles de riesgos. Se deben emplear procedimientos de verificación más rigurosos para las cuentas con mayores montos y mayores riesgos (ver la definición de CSC basado en riesgos). \n\nSe debe realizar, como mínimo, lo siguiente:\n- Verificación de CSC al momento del registro visualizando el documento de identidad correspondiente. La verificación debe confirmar que el documento existe, que no se trata de una falsificación evidente, que la fotografía (si hubiese) sea visible y coincida con el cliente, y que el documento confirme los detalles de CSC suministrados. \n- Verificación básica exigida por el sistema para garantizar la integridad e identificar problemas evidentes (por ej., la Fecha de Nacimiento es una fecha válida, todos los campos están completados, el ID no está duplicado).\n- Revisión de los datos de CSC basada en riesgos para confirmar la integridad y buscar errores tales como nombres lógicamente falsos. Esto podría ser automático o semi-automático en el sistema.\nEn algunos países, se requiere que los proveedores realicen copias del documento de identificación suministrado.\n\nSi fuese requerido, se puede exigir la verificación bloqueando las cuentas de los clientes cuyos ID no hayan sido verificados dentro de un periodo corto después del registro (por ej., una semana). Se pueden establecer límites adicionales en las cuentas (por ej., solo ingreso de efectivo o muy bajo límite de transacciones) hasta que se haya verificado el ID de CSC. \n\nSi ocurre una actividad sospechosa en la cuenta, posiblemente sea necesario llevar a cabo una debida diligencia adicional.","GSMA RMT (FR.T-11\nAG-09 )","2.5.1.5.1","¿Los datos de CSC son verificados al momento del registro, por el agente de registro o el proveedor, mediante la visualización o copia del documento de identificación correspondiente?","1) Política de CSC / requisitos de CSC / proceso de registro de cuentas\n- Verificar que la información de CSC suministrada por el solicitante durante el registro sea verificada visualizando el documento de identificación del cliente.",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,"2","2.5","2.5.1",null,"2.5.1.5",null,"GSMA RMT (FR.T-11\nAG-09 )","2.5.1.5.1",null,null,null,"ReqU4","Req4","FraudRisk",null,null,null,null,null,null,null,"MERGE","2.5.1.5.1","2.5.1.3.6","2.5.1.5.2","2.5.1.2.2",{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},2,"",{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP2","OriginalComplianceP2","OriginalComplianceP2",0,0,0,0,0,4,""]
[null,"2","2.5","2.5.1","","2.5.1.5",null,0,"2.5.1.5.2","2.5.1.5.2: Is basic system-enforced verification performed to ensure completeness and to spot obvious issues (e.g. Date of Birth is a valid date, all fields completed)?\n","1) Configuration of the customer registration platform.\n- Check that the system rejects applications that have obvious issues (e.g. Date of Birth is a valid date, all fields completed)",0,"Standard Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.1","","2.5.1.5",null,null,"2.5.1.5.2","2.5.1.5.3","Is basic system-enforced verification performed to ensure completeness and to spot obvious issues (e.g. Date of Birth is a valid date, all fields completed)?","1) Configuration of the customer registration platform.\n- Check that the system rejects applications that have obvious issues (e.g. Date of Birth is a valid date, all fields completed)",null,"Standard Required","Required","FraudRisk",null,null,"2","2.5","2.5.1","","2.5.1.5",0,0,"2.5.1.5.2","une vérification de base est-elle effectuée par le système pour vérifier que les renseignements fournis sont complets et détecter les problèmes manifestes (date de naissance valide, tous les champs sont renseignés) ?","1) Configuration de la plateforme d’enregistrement des clients.\n- Vérifier que le système rejette les demandes pour lesquelles des problèmes manifestes ont été identifiés (date de naissance non valide, tous les champs ne sont pas renseignés)",null,"Requis Normal","Requis","FraudRisk",0,null,"2","2.5","2.5.1",null,"2.5.1.5",null,0,"2.5.1.5.2","¿Se realiza la verificación básica exigida por el sistema para garantizar la integridad e identificar problemas evidentes (por ej., la Fecha de Nacimiento es una fecha válida, todos los campos están completados)? ","1) Configuración de la plataforma de registro de clientes.\n- Verificar que el sistema rechace las solicitudes con problemas evidentes (por ej., la Fecha de Nacimiento es una fecha válida, todos los campos están completados).",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,"2","2.5","2.5.1",null,"2.5.1.5",null,0,"2.5.1.5.2",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.1.5.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.1","","2.5.1.5",null,0,"2.5.1.5.3","2.5.1.5.3: If regulation permits accounts to be opened without immediate verification of KYC data, is account functionality limited (through measures such as lower transaction and/or balance limits, limits on permitted services, etc.) to mitigate risk?\n","1)  KYC policy / KYC requirements / account registration process\n- For accounts that are opened without immediate verification, check that account functionality is limited for the period before verification is complete\n\n2) Assessment of local AML/CFT regulatory requirements\n- Check that the provider has reviewed the limited functionality (for accounts with unverified KYC) in relation to local regulatory requirements.\n\n[This indicator should be marked N/A if not offered by the provider]",0,"Standard Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.1","","2.5.1.5",null,null,"2.5.1.5.3","2.5.1.2.3","If regulation permits accounts to be opened without immediate verification of KYC data, is account functionality limited (through measures such as lower transaction and/or balance limits, limits on permitted services, etc.) to mitigate risk?","1)  KYC policy / KYC requirements / account registration process\n- For accounts that are opened without immediate verification, check that account functionality is limited for the period before verification is complete\n\n2) Assessment of local AML/CFT regulatory requirements\n- Check that the provider has reviewed the limited functionality (for accounts with unverified KYC) in relation to local regulatory requirements.\n\n[This indicator should be marked N/A if not offered by the provider]",null,"Standard Required","Required","FraudRisk",null,null,"2","2.5","2.5.1","","2.5.1.5",null,0,"2.5.1.5.3","Si la réglementation permet l’ouverture de compte sans vérification immédiate des renseignements d'identité des clients, les fonctionnalités du compte sont-elles restreintes pour limiter le risque (par le biais de plafonds plus bas de solde et/ou d'opérations, de restrictions sur les services autorisés, etc.) ?","1) KYC Politique / KYC exigences / Processus d’enregistrement des nouveaux clients\n- Lorsque des comptes sont ouverts sans vérification immédiate, vérifier que les fonctionnalités des comptes sont restreintes pour la période précédant la vérification\n\n2) Évaluation des exigences définies par les réglementations AML/CFT locales\n- Vérifier que le prestataire a examiné les fonctionnalités restreintes (pour les comptes pour lesquels l'identité du client n'a pas été vérifiée) en fonction des exigences définies par les réglementations locales \n\nIndiquez la mention n/d pour cet indicateur si ce service n'est pas proposé par le prestataire]",null,"Requis Normal","Requis","FraudRisk",null,null,"2","2.5","2.5.1",null,"2.5.1.5",null,0,"2.5.1.5.3","Si la regulación permite la apertura de cuentas sin verificación inmediata de los datos de CSC, ¿las funcionalidades de la cuenta son limitadas (con medidas tales como límites más bajos de transacciones y/o saldos, servicios permitidos limitados, etc.) para mitigar el riesgo?","1) Política de CSC / requisitos de CSC / proceso de registro de cuentas\n- Para las cuentas abiertas sin verificación inmediata, verificar que las funcionalidades de la cuenta estén limitadas hasta tanto se complete la verificación\n\n2) Evaluación de los requisitos regulatorios ALA/CFT locales\n- Verificar que el proveedor haya revisado las funcionalidades limitadas (para cuentas con CSC sin verificar) en relación con los requisitos regulatorios locales.  \n\n[Este indicador se debe marcar con N/A si el proveedor no lo ofrece].",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,"2","2.5","2.5.1",null,"2.5.1.5",null,0,"2.5.1.5.3",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.1.2.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.1","","2.5.1.5",null,0,"2.5.1.5.4","2.5.1.5.4: Are risk-based reviews (either automated or semi-automated) of customers' and businesses' KYC data performed to confirm completeness and to identify errors?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.1","","2.5.1.5",null,null,"2.5.1.5.4","2.5.1.5.4","Are risk-based reviews (either automated or semi-automated) of customers' and businesses' KYC data performed to confirm completeness and to identify errors?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.5","2.5.1","","2.5.1.5",0,0,"2.5.1.5.4","un examen fondé sur le niveau de risque des renseignements d’identité fournis par les clients particuliers et professionnels est-il effectué pour vérifier que ces renseignements sont complets et détecter les anomalies éventuelles (de façon entièrement ou partiellement automatisée) ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.5","2.5.1",null,"2.5.1.5",null,0,"2.5.1.5.4","¿Se realizan revisiones basadas en riesgos (automáticas o semi-automáticas) de los datos de CSC del cliente y los negocios del cliente para confirmar la integridad e identificar errores?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.5","2.5.1",null,"2.5.1.5",null,0,"2.5.1.5.4",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.1.5.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.1","","2.5.1.5",null,0,"2.5.1.5.5","2.5.1.5.5: For customers whose ID has not been verified within a period of time (e.g. a week), does the system automatically block their accounts to enforce verification of ID (unless an exemption to the verification requirement exists for low-value accounts)?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.1","","2.5.1.5",null,null,"2.5.1.5.5","2.5.1.2.5","For customers whose ID has not been verified within a period of time (e.g. a week), does the system automatically block their accounts to enforce verification of ID (unless an exemption to the verification requirement exists for low-value accounts)?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.5","2.5.1","","2.5.1.5",null,0,"2.5.1.5.5","pour les clients dont l'identité n'a pas été vérifiée à l'issue d'un certain délai (par ex. une semaine), le système bloque-t-il automatiquement leur compte pour faire respecter l'obligation de vérification (sauf s'il existe une dérogation pour les comptes de faible montant) ?",null,null,"Recommandé","Recommandé","FraudRisk",null,null,"2","2.5","2.5.1",null,"2.5.1.5",null,0,"2.5.1.5.5","Para los clientes cuyos ID no han sido verificados dentro de un período de tiempo (por ej., una semana), ¿el sistema bloquea automáticamente sus cuentas para exigir la verificación de los ID (salvo exista una exención a los requisitos de verificación para las cuentas de bajo monto)?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.5","2.5.1",null,"2.5.1.5",null,0,"2.5.1.5.5",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.1.2.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[" ","2","2.5","2.5.1","","2.5.1.5",null,0,"2.5.1.5.6","2.5.1.5.6: In case of suspicious activity, is additional KYC due diligence carried out?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.1","","2.5.1.5",null,null,"2.5.1.5.6","2.5.1.5.5","In case of suspicious activity, is additional KYC due diligence carried out?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.5","2.5.1","","2.5.1.5",0,0,"2.5.1.5.6","en cas d'activité suspecte, une vigilance supplémentaire à l'égard des renseignements d'identité des clients est-elle menée ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.5","2.5.1",null,"2.5.1.5",null,0,"2.5.1.5.6","En el caso de actividades sospechosas, ¿se lleva a cabo una debida diligencia de CSC adicional?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.5","2.5.1",null,"2.5.1.5",null,0,"2.5.1.5.6",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.1.5.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.1","","2.5.1.6",{"$f":"AZ64&\": \"&CHOOSE(LanguageNumber,BA64,BR64,CH64,CX64)","v":"2.5.1.6: VERIFYING KYC AGAINST MOBILE PHONE RECORDS\nProviders should regularly reconcile their mobile money system with their mobile phone CRM system to identify accounts where the customer information does not match.\n\nWhere information does not match, providers should identify whether this is expected and acceptable (e.g. because an employer or family member is paying for postpaid service). If not, the discrepancy should be investigated."},"GSMA RMT (FR.T-11)","2.5.1.6.1","2.5.1.6.1: Are customers' KYC details cross-checked against ID records held with the mobile phone CRM accounts to identify accounts where the customer information does not match?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.1","","2.5.1.6","VERIFYING KYC AGAINST MOBILE PHONE RECORDS\nProviders should regularly reconcile their mobile money system with their mobile phone CRM system to identify accounts where the customer information does not match.\n\nWhere information does not match, providers should identify whether this is expected and acceptable (e.g. because an employer or family member is paying for postpaid service). If not, the discrepancy should be investigated.","GSMA RMT (FR.T-11)","2.5.1.6.1","2.5.1.6.1","Are customers' KYC details cross-checked against ID records held with the mobile phone CRM accounts to identify accounts where the customer information does not match?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.5","2.5.1","","2.5.1.6","VÉRIFICATION DES REGISTRES DE TÉLÉPHONIE MOBILE \nLes prestataires doivent effectuer un rapprochement périodique entre leur système d’argent mobile et leur système CRM de téléphonie mobile pour identifier les comptes sur lesquels les informations des clients ne sont pas concordantes.\n\nLorsque les renseignements fournis ne concordent pas, les prestataires doivent déterminer si cela est explicable et acceptable (par ex. service prépayé par l'employeur ou un membre de la famille). Dans le cas contraire, la différence doit faire l’objet d’une enquête.","GSMA RMT (FR.T-11)","2.5.1.6.1","les renseignements d'identité des clients font-ils l'objet d'un contrôle croisé avec les renseignements des comptes CRM de téléphonie mobile afin d'identifier les comptes pour lesquels ces renseignements ne sont pas concordants ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.5","2.5.1",null,"2.5.1.6","VERIFICACIÓN DE CSC CONTRA LOS REGISTROS DE TELÉFONOS MÓVILES\nLos proveedores deben conciliar regularmente su sistema del dinero móvil con su sistema CRM de teléfonos móviles para identificar las cuentas en las que no coincide la información del cliente.\n\nCuando la información no coincide, los proveedores deben identificar si esto es esperable o aceptable (por ej., porque un empleador o familiar está abonando el servicio pospago). De lo contrario, se debe investigar la discrepancia.","GSMA RMT (FR.T-11)","2.5.1.6.1","¿Se realiza una verificación cruzada de los detalles de CSC de los clientes con los registros de ID incluidos en las cuentas del CRM de teléfonos móviles para identificar las cuentas en las que no coincide la información del cliente?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.5","2.5.1",null,"2.5.1.6",null,"GSMA RMT (FR.T-11)","2.5.1.6.1",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.1.6.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.1","","2.5.1.6",null,0,"2.5.1.6.2","2.5.1.6.2: In case a customer's KYC does not match their mobile phone CRM record, does the verification policy and process specify the appropriate action to identify whether this is expected and acceptable (e.g. because an employer or family member is paying for postpaid service) and to investigate the discrepancy if necessary?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.1","","2.5.1.6",null,null,"2.5.1.6.2","2.5.1.6.2","In case a customer's KYC does not match their mobile phone CRM record, does the verification policy and process specify the appropriate action to identify whether this is expected and acceptable (e.g. because an employer or family member is paying for postpaid service) and to investigate the discrepancy if necessary?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.5","2.5.1","","2.5.1.6",0,0,"2.5.1.6.2","lorsque les renseignements d'identité fournis par un client ne correspondent pas à ceux de leur dossier CRM de téléphonie mobile, la politique et la procédure de vérification précisent-elles les mesures à prendre pour vérifier si cela est explicable et acceptable (par ex. service prépayé par l'employeur ou un membre de la famille) ou enquêter sur la différence si nécessaire ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.5","2.5.1",null,"2.5.1.6",null,0,"2.5.1.6.2","En caso de que el CSC del cliente no coincida con el registro del CRM de teléfonos móviles, ¿la política y proceso de verificación especifica la acción adecuada para identificar si esto es esperable o aceptable (por ej., porque un empleador o familiar está pagando el servicio pospago) y para investigar la discrepancia si fuese necesario?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.5","2.5.1",null,"2.5.1.6",null,0,"2.5.1.6.2",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.1.6.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.1","","2.5.1.7",{"$f":"AZ66&\": \"&CHOOSE(LanguageNumber,BA66,BR66,CH66,CX66)","v":"2.5.1.7: CHECKING IDENTITY DURING CASH-IN/CASH-OUT TRANSACTIONS\nProviders should ensure that agents consistently perform identity checks on the customer at cash-out, as a final check point to stop fraudsters and money launderers from liquidating e-money. It is recommended also to perform identity checks at cash-in too, to reduce the risk of direct deposits (see 2.7.1).\n\nA report should be created for all cash-in/out transactions that are rejected due to authentication failure (e.g. wrong PIN or lack of ID), with a process implemented for the AML/CFT team to review the report regularly."},"GSMA RMT (FR.P-16\nFR.T-08)","2.5.1.7.1","2.5.1.7.1: Is the identity of the customer systematically checked by the agent at cash-out?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.1","","2.5.1.7","CHECKING IDENTITY DURING CASH-IN/CASH-OUT TRANSACTIONS\nProviders should ensure that agents consistently perform identity checks on the customer at cash-out, as a final check point to stop fraudsters and money launderers from liquidating e-money. It is recommended also to perform identity checks at cash-in too, to reduce the risk of direct deposits (see 2.7.1).\n\nA report should be created for all cash-in/out transactions that are rejected due to authentication failure (e.g. wrong PIN or lack of ID), with a process implemented for the AML/CFT team to review the report regularly.","GSMA RMT (FR.P-16\nFR.T-08)","2.5.1.7.1",{"$f":"DO66","v":"2.5.1.9.1"},"Is the identity of the customer systematically checked by the agent at cash-out?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.5","2.5.1","",{"$f":"$AZ66","v":"2.5.1.7"},"VÉRIFICATION D'IDENTITÉ POUR LES DÉPÔTS ET RETRAITS D'ESPÈCES\nLes prestataires doivent s’assurer que les agents réalisent de manière systématique une vérification de l’identité du client lors d’un retrait d’espèces ; cela crée un point de contrôle final empêchant les fraudeurs et blanchisseurs de liquider de la monnaie électronique. Il est recommandé d’effectuer des vérifications d’identité lors d'un dépôt d’espèces pour réduire le risque des dépôts directs (cf. 2.7.1).\n\nUn rapport de tous les dépôts et retraits d’espèces refusés pour défaut d’authentification (par ex. mauvais code confidentiel ou absence de pièce d’identité) doit être créé et examiné régulièrement par l’équipe AML/CFT selon un processus établi.",{"$f":"$BB66","v":"GSMA RMT (FR.P-16\nFR.T-08)"},{"$f":"$BC66","v":"2.5.1.7.1"},"l'identité du client est-elle systématiquement vérifiée par l'agent lors des opérations de retrait d'espèces ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.5","2.5.1",null,{"$f":"$AZ66","v":"2.5.1.7"},"VERIFICACIÓN DE IDENTIDAD DURANTE LAS TRANSACCIONES DE INGRESO/RETIRO DE EFECTIVO\nLos proveedores deben garantizar que los agentes realicen consistentemente verificaciones de identidad del cliente al momento del retiro de efectivo, como un punto de verificación final a fin de evitar que los defraudadores y blanqueadores de dinero liquiden dinero móvil. También se recomienda realizar verificaciones de identidad al momento del ingreso de efectivo, a fin de reducir el riesgo de depósitos directos (ver 2.7.1).\n\nSe debe crear un reporte para todas las transacciones de ingreso/retiro de efectivo rechazadas por falla de autenticación (por ej., PIN erróneo o ID faltante), y se debe implementar un proceso para que el equipo ALA/CFT revise el reporte con regularidad.",{"$f":"$BB66","v":"GSMA RMT (FR.P-16\nFR.T-08)"},{"$f":"$BC66","v":"2.5.1.7.1"},"¿El agente verifica sistemáticamente la identidad del cliente al momento del retiro de efectivo?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.5","2.5.1",null,{"$f":"$AZ66","v":"2.5.1.7"},null,{"$f":"$BB66","v":"GSMA RMT (FR.P-16\nFR.T-08)"},{"$f":"$BC66","v":"2.5.1.7.1"},null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.1.9.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.1","","2.5.1.7",null,0,"2.5.1.7.2","2.5.1.7.2: Does the AML/CFT team regularly review a report of all cash-in/out transactions that are rejected due to identity check failure?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.1","","2.5.1.7",null,null,"2.5.1.7.2","2.5.1.9.3","Does the AML/CFT team regularly review a report of all cash-in/out transactions that are rejected due to identity check failure?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.5","2.5.1","","2.5.1.7",0,0,"2.5.1.7.2","l'équipe AML/CFT examine-t-elle régulièrement le rapport de toutes les opérations de dépôt ou retrait d'espèces rejetées en raison d'un problème d'authentification ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.5","2.5.1",null,"2.5.1.7",null,0,"2.5.1.7.2","¿El equipo ALA/CFT revisa con regularidad el reporte de todas las transacciones de ingreso/retiro de efectivo rechazadas por falla en la verificación de identidad?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.5","2.5.1",null,"2.5.1.7",null,0,"2.5.1.7.2",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.1.9.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.2","2.5.2: Providers shall place appropriate risk-based transaction and balance limits on accounts, depending upon the strength of customer identification and verification","2.5.2.1",{"$f":"AZ68&\": \"&CHOOSE(LanguageNumber,BA68,BR68,CH68,CX68)","v":"2.5.2.1: TRANSACTION AND BALANCE LIMITS BASED ON KYC TIER\nTransaction and balance limits should be assigned to each tier and enforced by the system to limit the risk of abuse of the service (for fraud, money laundering or terrorist financing). Transactions that would breach a transaction or balance limit should be prevented.\n\nProviders should establish some or all of the following limits:\n- Maximum value of a single transaction;\n- Total value of transactions per day, week, month, 3 months, and/or year. Limits for inbound and outbound transactions could be different;\n- Total number of transactions per day, week, month, 3 months, and/or year; \n- Limit on the maximum balance that may be stored at any time.\n\nIf warranted due to risk assessments and/or required by regulation, providers may limit lower-tier customers to domestic transfers only and/or prevent them from accessing other financial ecosystem products, such as savings accounts."},"GSMA RMT (FR.T-12\nFR.P-27\nFR.P-32)","2.5.2.1.1","2.5.2.1.1: Are transaction and balance limits assigned to each KYC tier of customer accounts and enforced by the system?\n","1) MM system functional specification\n - Transaction limits: check that the system is confgured to block transactions once a threshold is met, and that this is customised to each KYC tier.",0,"Urgent Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.2","2.5.2: Providers shall place appropriate risk-based transaction and balance limits on accounts, depending upon the strength of customer identification and verification","2.5.2.1","TRANSACTION AND BALANCE LIMITS BASED ON KYC TIER\nTransaction and balance limits should be assigned to each tier and enforced by the system to limit the risk of abuse of the service (for fraud, money laundering or terrorist financing). Transactions that would breach a transaction or balance limit should be prevented.\n\nProviders should establish some or all of the following limits:\n- Maximum value of a single transaction;\n- Total value of transactions per day, week, month, 3 months, and/or year. Limits for inbound and outbound transactions could be different;\n- Total number of transactions per day, week, month, 3 months, and/or year; \n- Limit on the maximum balance that may be stored at any time.\n\nIf warranted due to risk assessments and/or required by regulation, providers may limit lower-tier customers to domestic transfers only and/or prevent them from accessing other financial ecosystem products, such as savings accounts.","GSMA RMT (FR.T-12\nFR.P-27\nFR.P-32)","2.5.2.1.1","2.5.2.1.1","Are transaction and balance limits assigned to each KYC tier of customer accounts and enforced by the system?","1) MM system functional specification\n - Transaction limits: check that the system is confgured to block transactions once a threshold is met, and that this is customised to each KYC tier.",null,"Urgent Required","Required","FraudRisk",null,null,"2","2.5","2.5.2","2.5.2: Les prestataires doivent appliquer des plafonds appropriés d’opération et de solde de compte en fonction du niveau de risque et des exigences de vérification de l’identité des clients.","2.5.2.1","PLAFONDS DE SOLDE ET D'OPÉRATIONS FONDÉS SUR LE NIVEAU DE VÉRIFICATION\nChaque niveau de vérification doit correspondre à des plafonds de solde et d’opération spécifiques que le système doit faire respecter pour limiter le risque d'abus du service (pour lutter contre la fraude, le blanchiment de capitaux ou le financement du terrorisme). Les opérations qui dépasseraient ces plafonds doivent être bloquées.\n\nLes prestataires doivent mettre en place tout ou partie des plafonds suivants :\n- montant maximum par opération ;\n- montant total maximum des opérations sur une journée, une semaine, un mois, 3 mois et/ou une année. Les plafonds peuvent être différents pour les opérations au débit ou au crédit du compte ;\n- nombre total maximum d’opérations par jour, semaine, mois, 3 mois et/ou année ; \n- solde maximum pouvant être conservé à tout moment sur le compte.\n\nSi l’évaluation du risque le justifie ou si la réglementation l’exige, les prestataires peuvent limiter les opérations que les clients faisant l'objet d'une vérification minimale peuvent effectuer, en autorisant par exemple uniquement les transferts nationaux et/ou en les empêchant d’accéder à d’autres produits de l’écosystème financier, comme par exemple les comptes d’épargne.","GSMA RMT (FR.T-12\nFR.P-27\nFR.P-32)","2.5.2.1.1","des plafonds de solde et de transaction spécifiques sont-ils assignés à chaque niveau de vérification d’identité des comptes client et leur respect est-il assuré par le système ?","1) Spécification fonctionnelle du système d’argent mobile\n- Plafonds de transaction: vérifier que le système est configuré de façon à bloquer les transactions une fois qu’un plafond a été atteint et que cette configuration est adaptée à chaque niveau de vérification d’identité.",null,"Requis Prioritaire","Requis","FraudRisk",null,null,"2","2.5","2.5.2","2.5.2: Los proveedores deben fijar los límites adecuados de transacciones y saldos basados en riesgos para las cuentas, dependiendo de la solidez de la identificación y verificación del cliente.","2.5.2.1","LÍMITES DE TRANSACCIONES Y SALDOS EN BASE A LA CAPA DE CSC\nLos límites de transacciones y saldos deben ser asignados a cada capa y exigidos por el sistema para limitar el riesgo de abuso del servicio (por fraude, lavado de activos o financiamiento del terrorismo). Se deben prevenir las transacciones que violarían un límite de transacciones o saldos.\n\nLos proveedores deben establecer todos o algunos de los siguientes límites:\n- Monto máximo de una sola transacción;\n- Monto total de las transacciones por día, semana, mes, 3 meses, y/o año. Los límites para las transacciones entrantes y salientes podrían ser diferentes;\n- Cantidad total de transacciones por día, semana, mes, 3 meses, y/o año; \n- Límite de saldo máximo que se puede almacenar en cualquier momento.\n\nSi se justifica debido a las evaluaciones de riesgos y/o lo requiere la regulación, los proveedores pueden limitar a los clientes de la capa inferior solo a la realización de transferencias nacionales y/o evitar que accedan a otros productos del ecosistema financiero, como por ejemplo cajas de ahorro.","GSMA RMT (FR.T-12\nFR.P-27\nFR.P-32)","2.5.2.1.1","¿Se asignan límites de transacciones y saldos a cada capa de CSC de cuentas de clientes y son exigidos por el sistema?","1) Especificación funcional del sistema del dinero móvil\n - Límites de transacciones: verificar que el sistema esté configurado para bloquear transacciones una vez alcanzado el umbral, y que esto esté personalizado para cada capa de CSC.",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,"2","2.5","2.5.2",null,"2.5.2.1",null,"GSMA RMT (FR.T-12\nFR.P-27\nFR.P-32)","2.5.2.1.1",null,null,null,"ReqU4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.2.1.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.2",null,"2.5.2.1",null,0,"2.5.2.1.2","2.5.2.1.2: Do higher transaction/balance limits (if applicable) require more KYC and stronger verification?\n","1) KYC policy / KYC requirements / account registration process\n- Check that more KYC and verification is required for higher transaction/balance limits.",0,"Standard Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.2",null,"2.5.2.1",null,null,"2.5.2.1.2","2.5.2.1.3","Do higher transaction/balance limits (if applicable) require more KYC and stronger verification?","1) KYC policy / KYC requirements / account registration process\n- Check that more KYC and verification is required for higher transaction/balance limits.",null,"Standard Required","Required","FraudRisk",null,null,"2","2.5","2.5.2",null,"2.5.2.1",null,0,"2.5.2.1.2","Des exigences de renseignements supplémentaires et de vérification plus poussée sont-elles appliquées lorsque les plafonds de solde ou de transaction sont plus élevés (le cas échéant) ?","1) KYC Politique / KYC exigences / Processus d’enregistrement des nouveaux clients\n- Vérifier que des exigences de renseignements supplémentaires et de vérification plus poussée sont définies pour les plafonds de solde ou d’opération plus élevés.",null,"Requis Normal","Requis","FraudRisk",null,null,"2","2.5","2.5.2",null,"2.5.2.1",null,0,"2.5.2.1.2","¿Los límites de transacciones/saldos más altos (si corresponde) requieren un mayor CSC y más verificación?","1) Política de CSC / requisitos de CSC / proceso de registro de cuentas\n- Verificar que se requiera un mayor CSC y más verificación para los límites de transacciones/saldos más altos.",null,{"$f":"VLOOKUP($BH69,CategoryTranslationTable,3,FALSE)","v":"Obligatorio estándar"},{"$f":"VLOOKUP($BI69,CategoryTranslationTable,3,FALSE)","v":"Obligatorio"},"FraudRisk",null,null,"2","2.5","2.5.2",null,"2.5.2.1",null,0,"2.5.2.1.2",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.2.1.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",{"$f":"COUNTIF($DS69:$DV69,EH$3)","v":0},0,0,0,0,{"$f":"COUNTIF($DO69:$DR69,\"*?\")","v":1},{"$f":"IF(OR(AND(EH69>0,SUM(EI69:EL69)>0),EK69>0),\"Partial\",IF(EH69=EM69,\"Yes\",IF(EI69=EM69,\"No\",IF(EJ69=EM69,\"N/A\",IF(EK69=EM69,\"Partial\",IF(EL69=EM69,\"\",\"\"))))))","v":""}]
[null,"2","2.5","2.5.2",{"$f":"CHOOSE(LanguageNumber,AY70,BP70,CF70,CV70)","v":0},"2.5.2.1",null,0,"2.5.2.1.3","2.5.2.1.3: If warranted due to risk assessments and/or required by regulation, are lower-tier customers restricted to lower-risk products only?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.2",null,"2.5.2.1",null,null,"2.5.2.1.3","2.5.2.1.4","If warranted due to risk assessments and/or required by regulation, are lower-tier customers restricted to lower-risk products only?",null,null,"Recommended","Recommended",{"$f":"$O70","v":"FraudRisk"},null,null,{"$f":"$AV70","v":"2"},{"$f":"$AW70","v":"2.5"},{"$f":"$AX70","v":"2.5.2"},0,"2.5.2.1",0,0,"2.5.2.1.3","si l’évaluation du risque le justifie ou si la réglementation l’exige, les clients faisant l'objet d'une vérification minimale n'ont-ils accès qu'à des produits moins risqués ?",null,null,"Recommandé","Recommandé",{"$f":"$O70","v":"FraudRisk"},0,null,{"$f":"$AV70","v":"2"},{"$f":"$AW70","v":"2.5"},{"$f":"$AX70","v":"2.5.2"},null,"2.5.2.1",null,0,"2.5.2.1.3","Si se justifica debido a las evaluaciones de riesgos y/o lo requiere la regulación, ¿los clientes de la capa inferior están limitados a adquirir solo productos de bajo riesgo?",null,null,"Recomendado","Recomendado",{"$f":"$O70","v":"FraudRisk"},null,null,{"$f":"$AV70","v":"2"},{"$f":"$AW70","v":"2.5"},{"$f":"$AX70","v":"2.5.2"},null,"2.5.2.1",null,0,"2.5.2.1.3",null,null,null,"Rec4","Rec4",{"$f":"$O70","v":"FraudRisk"},null,null,null,null,null,null,null,null,"2.5.2.1.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.2",0,"2.5.2.2",{"$f":"AZ71&\": \"&CHOOSE(LanguageNumber,BA71,BR71,CH71,CX71)","v":"2.5.2.2: TRANSACTION AND BALANCE LIMITS: MULTIPLE ACCOUNTS\nThe provider should set limits on the number of accounts a customer / business can hold. If more than  one account is permitted, the transaction and balance limits should be applied to the aggregate total of transactions/balances across the accounts."},"GSMA RMT (FR.P-03)","2.5.2.2.1","2.5.2.2.1: Does the AML/CFT policy specify a limit on the number of accounts that a customer / business can hold?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.2",null,"2.5.2.2","TRANSACTION AND BALANCE LIMITS: MULTIPLE ACCOUNTS\nThe provider should set limits on the number of accounts a customer / business can hold. If more than  one account is permitted, the transaction and balance limits should be applied to the aggregate total of transactions/balances across the accounts.","GSMA RMT (FR.P-03)","2.5.2.2.1","2.5.2.2.1","Does the AML/CFT policy specify a limit on the number of accounts that a customer / business can hold?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.5","2.5.2",0,"2.5.2.2","PLAFONDS DE SOLDE ET D'OPÉRATIONS : COMPTES MULTIPLES\nLe prestataire doit limiter le nombre de comptes que les clients particuliers ou professionnels peuvent détenir. Lorsqu’il est possible d’avoir plusieurs comptes, les plafonds de solde et d’opérations doivent s’appliquer au total des opérations/soldes sur ces comptes.","GSMA RMT (FR.P-03)","2.5.2.2.1","la politique AML/CFT prévoit-elle une limite concernant le nombre de comptes que les clients particuliers ou professionnels peuvent posséder ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.5","2.5.2",null,"2.5.2.2","LÍMITES DE TRANSACCIONES Y SALDOS: MÚLTIPLES CUENTAS\nEl proveedor debe establecer límites a la cantidad de cuentas que un cliente / negocio puede tener. Si se permite más de una cuenta, los límites de transacciones y saldos se deben aplicar al total agregado de transacciones/saldos entre todas las cuentas.","GSMA RMT (FR.P-03)","2.5.2.2.1","¿La política ALA/CFT especifica un límite en la cantidad de cuentas que un cliente / negocio puede tener?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.5","2.5.2",null,"2.5.2.2",null,"GSMA RMT (FR.P-03)","2.5.2.2.1",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.2.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.2",0,"2.5.2.2",null,0,"2.5.2.2.2","2.5.2.2.2: Are system and process controls in place to enforce the limit on the number of accounts that a customer / business can hold?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.2",null,"2.5.2.2",null,null,"2.5.2.2.2","2.5.2.2.2","Are system and process controls in place to enforce the limit on the number of accounts that a customer / business can hold?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.5","2.5.2",0,"2.5.2.2",0,0,"2.5.2.2.2","des contrôles sont-ils en place dans le système ou dans les processus pour faire respecter le nombre maximum de comptes qu'un client particulier ou professionnel peut détenir ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.5","2.5.2",null,"2.5.2.2",null,0,"2.5.2.2.2","¿Se implementaron controles del sistema y del proceso para exigir un límite a la cantidad de cuentas que un cliente / negocio puede tener?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.5","2.5.2",null,"2.5.2.2",null,0,"2.5.2.2.2",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.2.2.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.2",0,"2.5.2.2",null,0,"2.5.2.2.3","2.5.2.2.3: If more than one account is permitted, are transaction and balance limits correctly applied to the aggregate total of transactions/balances across the accounts, or are other controls implemented, based on risk assessment?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.2",null,"2.5.2.2",null,null,"2.5.2.2.3","2.5.2.2.3","If more than one account is permitted, are transaction and balance limits correctly applied to the aggregate total of transactions/balances across the accounts, or are other controls implemented, based on risk assessment?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.5","2.5.2",0,"2.5.2.2",0,0,"2.5.2.2.3","s'il est possible de détenir plus d'un compte, les plafonds de solde et d’opérations s’appliquent-ils correctement au total des opérations/soldes sur ces comptes, ou des contrôles supplémentaires sont en place en fonction de l'évaluation des risques ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.5","2.5.2",null,"2.5.2.2",null,0,"2.5.2.2.3","Si se permite más de una cuenta, ¿se aplican correctamente los límites de transacciones y saldos al total agregado de transacciones/saldos entre todas las cuentas, o se implementan otros controles en base a la evaluación de riesgos?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.5","2.5.2",null,"2.5.2.2",null,0,"2.5.2.2.3",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.2.2.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.3","2.5.3: Providers shall have the ability to block account transactions under certain circumstances","2.5.3.1",{"$f":"AZ74&\": \"&CHOOSE(LanguageNumber,BA74,BR74,CH74,CX74)","v":"2.5.3.1: ACCOUNT-BLOCKING\nThe account-blocking mechanism should prevent accounts from being used under carefully-defined circumstances. Some of the circumstances under which providers could decide to block accounts include:\n- Prior to completion of identification and verification (subject to any exceptions for verification of low-value accounts, as noted in 2.5.1.2); \n- If required to do so by a competent authority;\n- If an account has become compromised or when a trigger event occurs on the account which indicates ML/TF may have occurred;\n- If an account has been fraudulently created;\n- If there is doubt that the KYC information is correct or if a customer has refused to provide additional KYC information requested;\n- When it is discovered that the customer has more than the maximum number of permitted accounts;\n- When a handset known to have been used for fraudulent activities is used with the account (e.g. identified by IMEI);\n"},"GSMA RMT (FR.P-12)","2.5.3.1.1","2.5.3.1.1: Is there documentation that specifies the situations when accounts should be blocked?\n","1) AML/CFT policy or process documentation\n- Check that there is documentation that specifies when an account should be blocked.",0,"Urgent Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.3","2.5.3: Providers shall have the ability to block account transactions under certain circumstances","2.5.3.1","ACCOUNT-BLOCKING\nThe account-blocking mechanism should prevent accounts from being used under carefully-defined circumstances. Some of the circumstances under which providers could decide to block accounts include:\n- Prior to completion of identification and verification (subject to any exceptions for verification of low-value accounts, as noted in 2.5.1.2); \n- If required to do so by a competent authority;\n- If an account has become compromised or when a trigger event occurs on the account which indicates ML/TF may have occurred;\n- If an account has been fraudulently created;\n- If there is doubt that the KYC information is correct or if a customer has refused to provide additional KYC information requested;\n- When it is discovered that the customer has more than the maximum number of permitted accounts;\n- When a handset known to have been used for fraudulent activities is used with the account (e.g. identified by IMEI);\n","GSMA RMT (FR.P-12)","2.5.3.1.1","2.5.3.1.1","Is there documentation that specifies the situations when accounts should be blocked?","1) AML/CFT policy or process documentation\n- Check that there is documentation that specifies when an account should be blocked.",null,"Urgent Required","Required","FraudRisk",null,null,"2","2.5","2.5.3","2.5.3: Les prestataires doivent pouvoir bloquer les opérations des comptes dans certaines circonstances.","2.5.3.1","BLOCAGE DU COMPTE\nLe mécanisme de blocage de compte a pour but d’empêcher l’utilisation des comptes dans des circonstances soigneusement définies. Le prestataire peut être amené à bloquer des comptes dans les circonstances suivantes :\n- dans l’attente de la soumission des documents d’identité et de leur vérification (sous réserve des dérogations applicables aux comptes de faible montant, comme évoqué dans 2.5.1.2); \n- sur demande d’une autorité compétente ;\n- lorsqu’un compte devient compromis or qu’un événement susceptible d’indiquer des activités de blanchiment de capitaux / financement de capitaux se produit sur un compte ;\n- en cas d’ouverture frauduleuse d’un compte ;\n- en cas de doute quant à la véracité des renseignements d’identité fournis ou si un client refuse de fournir les renseignements supplémentaires demandés sur son identité ;\n- s’il est découvert qu’un client possède plus de compte que le nombre maximum autorisé ;\n- lorsqu’un téléphone déjà lié à des activités frauduleuses est utilisé sur un compte (identifié par exemple au moyen de l’IMEI ou numéro d’appareil).\n","GSMA RMT (FR.P-12)","2.5.3.1.1","Existe-t-il une documentation qui détaille les circonstances dans lesquelles un compte doit être bloqué ?","1) Documentation de processus ou politique AML/CFT\n- Vérifier que les cas justifiant le blocage d’un compte sont définis par la documentation.",null,"Requis Prioritaire","Requis","FraudRisk",0,null,"2","2.5","2.5.3","2.5.3: Los proveedores deben tener la capacidad de bloquear transacciones de cuentas bajo ciertas circunstancias.","2.5.3.1","BLOQUEO DE CUENTAS\nEl mecanismo de bloqueo de cuentas debe evitar el uso de las cuentas bajo circunstancias cuidadosamente definidas. Algunas circunstancias bajo las cuales los proveedores podrían decidir bloquear las cuentas incluyen:\n- Antes de completar la identificación y verificación (sujeto a cualquier excepción de verificación de cuentas de bajo monto, tal como se establece en 2.5.1.2); \n- Si fuese requerido por una autoridad competente;\n- Si una cuenta se viera comprometida o cuando ocurre un evento disparador en la cuenta que indique que podría haber ocurrido LA/FT;\n- Si una cuenta ha sido creada fraudulentamente;\n- Si existen dudas de que la información de CSC sea correcta o si un cliente se negó a suministrar la información de CSC adicional solicitada;\n- Cuando se descubre que el cliente tiene más cuentas que la cantidad máxima de cuentas permitidas;\n- Cuando se sabe que un dispositivo  utilizado para actividades fraudulentas es usado con la cuenta (por ej., identificado por el IMEI);","GSMA RMT (FR.P-12)","2.5.3.1.1","¿Existe documentación que especifique las situaciones en las que se deben bloquear las cuentas?","1) Documentación de la política o proceso ALA/CFT\n- Verificar que exista documentación que especifique cuándo una cuenta debe ser bloqueada.",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,"2","2.5","2.5.3",null,"2.5.3.1",null,"GSMA RMT (FR.P-12)","2.5.3.1.1",null,null,null,"ReqU4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.3.1.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.3",0,"2.5.3.1",null,0,"2.5.3.1.2","2.5.3.1.2: Is account-blocking enforced if required to do so by a competent authority?\n","1) AML/CFT policy or process documentation\n- Check that there is a process by which a competent authority can block an account.",0,"Standard Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.3",null,"2.5.3.1",null,null,"2.5.3.1.2","2.5.3.1.3","Is account-blocking enforced if required to do so by a competent authority?","1) AML/CFT policy or process documentation\n- Check that there is a process by which a competent authority can block an account.",null,"Standard Required","Required","FraudRisk",null,null,"2","2.5","2.5.3",0,"2.5.3.1",0,0,"2.5.3.1.2","le blocage d'un compte est-il appliqué si une autorité compétente en fait la demande ?","1) Documentation de processus ou politique AML/CFT\n- Vérifier l’existence d’un processus en vertu duquel une autorité compétente est habilitée à bloquer un compte.",null,"Requis Normal","Requis","FraudRisk",0,null,"2","2.5","2.5.3",null,"2.5.3.1",null,0,"2.5.3.1.2","¿Se bloquean las cuentas si así lo requiere una autoridad competente?","1) Documentación de la política o proceso ALA/CFT\n- Verificar que exista un proceso mediante el cual una autoridad competente pueda bloquear una cuenta.",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,"2","2.5","2.5.3",null,"2.5.3.1",null,0,"2.5.3.1.2",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.3.1.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.3",0,"2.5.3.1",null,0,"2.5.3.1.3","2.5.3.1.3: Is account-blocking enforced if an account has become compromised or when a trigger event has occurred on the account which indicates ML/TF or fraud may have occurred?\n",{"$f":"CHOOSE(LanguageNumber,BF76,BV76,CL76,DB76)","v":"1) AML/CFT policy or process documentation\n- Check that there is a process by which the system can block an account due to a trigger event that indicates fraud or ML/TF may have occurred."},0,"Standard Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.3",null,"2.5.3.1",null,null,"2.5.3.1.3","2.5.3.1.4","Is account-blocking enforced if an account has become compromised or when a trigger event has occurred on the account which indicates ML/TF or fraud may have occurred?","1) AML/CFT policy or process documentation\n- Check that there is a process by which the system can block an account due to a trigger event that indicates fraud or ML/TF may have occurred.",null,"Standard Required","Required","FraudRisk",null,null,"2","2.5","2.5.3",0,"2.5.3.1",0,0,"2.5.3.1.3","lorsqu'un compte est compromis, ou qu'un événement susceptible d’indiquer des activités de blanchiment de capitaux / financement de capitaux se produit sur le compte, le blocage du compte est-il appliqué ?","1) Documentation de processus ou politique AML/CFT\n- Vérifier l’existence d’un processus en vertu duquel le système peut bloquer un compte suite à un évènement déclencheur indiquant une possibilité de fraude ou d’activité ML/TF.",null,"Requis Normal","Requis","FraudRisk",0,null,"2","2.5","2.5.3",null,"2.5.3.1",null,0,"2.5.3.1.3","¿Se exige el bloqueo de cuentas si una cuenta se ve comprometida o cuando ocurre un evento disparador en la cuenta que indica que podría haber ocurrido LA/FT o fraude?","1) Documentación de la política o proceso ALA/CFT\n- Verificar que exista un proceso mediante el cual el sistema pueda bloquear una cuenta debido a un evento disparador que indique que podría haber ocurrido fraude o LA/FT.",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,"2","2.5","2.5.3",null,"2.5.3.1",null,0,"2.5.3.1.3",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.3.1.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,{"$f":"AV77","v":"2"},{"$f":"AW77","v":"2.5"},{"$f":"AX77","v":"2.5.3"},null,{"$f":"AZ77","v":"2.5.3.1"},null,null,{"$f":"BC77","v":"2.5.3.1.4"},"2.5.3.1.4: Is account-blocking enforced prior to completion of identification and verification (subject to any exceptions for verification of low-value accounts, as noted in 2.5.1.2)?\n",{"$f":"CHOOSE(LanguageNumber,BF77,BV77,CL77,DB77)","v":0},{"$f":"CHOOSE(LanguageNumber,BG77,BW77,CM77,DC77)","v":0},{"$f":"CHOOSE(LanguageNumber,BH77,BX77,CN77,DD77)","v":"Recommended"},{"$f":"CHOOSE(LanguageNumber,BI77,BY77,CO77,DE77)","v":"Recommended"},"FraudRisk",{"$f":"CHOOSE(LanguageNumber,BK77,CA77,CQ77,DG77)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.3",null,"2.5.3.1",null,null,"2.5.3.1.4",{"$f":"DO77","v":"2.5.3.1.2"},"Is account-blocking enforced prior to completion of identification and verification (subject to any exceptions for verification of low-value accounts, as noted in 2.5.1.2)?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.5","2.5.3",null,"2.5.3.1",null,null,"2.5.3.1.4","les comptes sont-ils bloqués tant que les formalités d'identification et de vérification ne sont pas complètes (sous réserve de tout dérogation applicable aux comptes de faible montant telle que visée dans 2.5.1.2) ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.5","2.5.3",null,"2.5.3.1",null,null,"2.5.3.1.4","¿Se exige el bloqueo de cuentas antes de completar la identificación y verificación (sujeto a cualquier excepción de verificación de cuentas de bajo monto, tal como se establece en 2.5.1.2)?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.5","2.5.3",null,"2.5.3.1",null,null,"2.5.3.1.4",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.3.1.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.3","","2.5.3.2",{"$f":"AZ78&\": \"&CHOOSE(LanguageNumber,BA78,BR78,CH78,CX78)","v":"2.5.3.2: CUSTOMER BLACKLISTS\nProviders should record blacklists of customers that have been found to be involved in fraud, and should prevent these customers from holding mobile money accounts.\n\nIt is recommended that providers block transactions to/from blacklisted accounts managed by financial ecosystem partners if financial ecosystem partners provide such information and if legally permitted. \n\nIf possible, blacklists should be exchanged with other domestic mobile money providers and financial ecosystem partners. Ideally, Mobile Money providers and financial ecosystem partners in each country should come to an agreement about sharing details of money laundering, terrorist financing, and perpetration of fraud. This will help to prevent fraudsters from moving from one operator to another in order to continue their activities.\n\nThe agreement should include which identities to include in the information exchange. For example, it should include agents, businesses, and merchants (and their directors). Whether to include customers will depend on local agreements. How to identify the individuals should also be agreed - for example, by national ID."},"GSMA RMT (FR.P-31)","2.5.3.2.1","2.5.3.2.1: Is there a process for maintaining a blacklist of customers that have been found to be involved in fraud and preventing them from holding accounts?\n",0,0,"Standard Required","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.3","","2.5.3.2","CUSTOMER BLACKLISTS\nProviders should record blacklists of customers that have been found to be involved in fraud, and should prevent these customers from holding mobile money accounts.\n\nIt is recommended that providers block transactions to/from blacklisted accounts managed by financial ecosystem partners if financial ecosystem partners provide such information and if legally permitted. \n\nIf possible, blacklists should be exchanged with other domestic mobile money providers and financial ecosystem partners. Ideally, Mobile Money providers and financial ecosystem partners in each country should come to an agreement about sharing details of money laundering, terrorist financing, and perpetration of fraud. This will help to prevent fraudsters from moving from one operator to another in order to continue their activities.\n\nThe agreement should include which identities to include in the information exchange. For example, it should include agents, businesses, and merchants (and their directors). Whether to include customers will depend on local agreements. How to identify the individuals should also be agreed - for example, by national ID.","GSMA RMT (FR.P-31)","2.5.3.2.1","2.5.3.2.1","Is there a process for maintaining a blacklist of customers that have been found to be involved in fraud and preventing them from holding accounts?",null,null,"Standard Required","Recommended","FraudRisk",null,null,"2","2.5","2.5.3","","2.5.3.2","LISTES NOIRES DE CLIENTS\nLes prestataires doivent conserver une liste noire des clients impliqués dans des activités de fraude et doivent empêcher ces clients de posséder des comptes d’argent mobile.\n\nIl est recommandé que les prestataires bloquent les opérations vers/en provenance de comptes figurant sur une liste noire des partenaires de l’écosystème financier si ces derniers fournissent cette information et que la loi l’autorise. \n\nDans la mesure du possible, les listes noires doivent être échangées avec les autres prestataires de services d’argent mobile du pays et les partenaires de l’écosystème financier. Dans l’idéal, les prestataires de services d’argent mobile et leurs partenaires de l’écosystème financier de chaque pays devraient convenir de se communiquer les renseignements relatifs aux cas de fraude, de blanchiment de capitaux et de financement du terrorisme  afin d’empêcher les fraudeurs de changer d’opérateur pour poursuivre leurs activités.\n\nCet accord devrait spécifier les identités à inclure dans l’échange d’informations, comme par exemple les agents, les entreprises et les commerçants (et leurs associés/dirigeants). L’ajout des clients dépendra des accords locaux. Le mode d’identification des personnes doit également être convenu - au moyen d’une pièce d’identité nationale par exemple.","GSMA RMT (FR.P-31)","2.5.3.2.1","y-a-t-il un processus en place pour tenir à jour une liste noire des clients impliqués dans des activités de fraude et les empêcher de détenir des comptes ?","1) Processus d’établissement d’une liste noire des comptes\n- Vérifier qu’un processus a été mis en place pour permettre au prestataire d’identifier et de bloquer les comptes ouverts par des personnes ayant déjà été impliquées dans des activités de fraude, de blanchiment de capitaux ou de financement du terrorisme.\n\n",null,"Requis Normal","Recommandé","FraudRisk",0,null,"2","2.5","2.5.3",null,"2.5.3.2","LISTAS NEGRAS DE CLIENTES\nLos proveedores deben registrar listas negras de clientes comprobados de haber estado involucrados en un fraude y deben evitar que estos clientes tengan cuentas del dinero móvil.\n\nSe recomienda que los proveedores bloqueen las transacciones desde/hacia las cuentas incluidas en las listas negras gestionadas por los socios del ecosistema financiero si estos últimos suministran dicha información y si está legalmente permitido. \n\nSi fuese posible, las listas negras deben ser intercambiadas con los demás proveedores del dinero móvil y socios del ecosistema financiero nacionales. Idealmente, los proveedores del Dinero Móvil y socios del ecosistema financiero de cada país deben celebrar un acuerdo para intercambiar detalles de lavado de activos, financiamiento del terrorismo y perpetración de fraude. Esto ayudará a evitar que los defraudadores cambien de operador para continuar con sus actividades.\n\nEl acuerdo debe contemplar qué identidades se deben incluir en el intercambio de información. Por ejemplo, debe incluir agentes, negocios y comercios (y sus directores). Incluir o no clientes dependerá de los acuerdos locales. También se debe acordar cómo identificar a las personas, por ejemplo, mediante el ID nacional.","GSMA RMT (FR.P-31)","2.5.3.2.1","¿Existe un proceso para mantener una lista negra de clientes comprobados de haber estado involucrados en un fraude y para evitar que estos tengan cuentas?",null,null,"Obligatorio estándar","Recomendado","FraudRisk",null,null,"2","2.5","2.5.3",null,"2.5.3.2",null,"GSMA RMT (FR.P-31)","2.5.3.2.1",null,null,null,"ReqS4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.3.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.3","","2.5.3.2",null,0,"2.5.3.2.2","2.5.3.2.2: If supported by financial ecosystem partners, are operator-maintained blacklists exchanged under a joint blacklisting agreement?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.3","","2.5.3.2",null,null,"2.5.3.2.2","2.5.3.2.2","If supported by financial ecosystem partners, are operator-maintained blacklists exchanged under a joint blacklisting agreement?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.5","2.5.3","","2.5.3.2",0,0,"2.5.3.2.2","en cas de soutien par des partenaires de l'écosystème financier, les listes noires sont-elles échangées en vertu d'un accord de tenue commune de ces listes ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.5","2.5.3",null,"2.5.3.2",null,0,"2.5.3.2.2","Si fuese admitido por los socios del ecosistema financiero, ¿las listas negras que mantienen los operadores son intercambiadas conforme a un acuerdo conjunto de intercambio de listas negras?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.5","2.5.3",null,"2.5.3.2",null,0,"2.5.3.2.2",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.3.2.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.4","2.5.4: Providers shall screen accounts using domestic and international money laundering, terrorist financing, and sanctions watch lists","2.5.4.1",{"$f":"AZ80&\": \"&CHOOSE(LanguageNumber,BA80,BR80,CH80,CX80)","v":"2.5.4.1: WATCHLIST SCREENING OF ACCOUNTS\nAll accounts (including customer, agent and business accounts) should be screened against watchhlists.  Watchlists should include domestic and international money laundering, terrorist financing, Politically Exposed Persons (PEP) and sanctions watch lists. \nExamples of international watch lists that may be used include:\n- The Consolidated United Nations Security Council Sanctions List\n- OFAC (US Office of Foreign Assets Control) Specially Designated Nationals List \n- The Consolidated List of Persons, Groups and Entities subject to EU Financial Sanctions.\n\nScreening should be performed within a short period of time following account opening and it is recommended that screening is repeated regularly thereafter (frequency may vary depending upon customer risk level). \nIn case a match is found against a mandatory watchlist, the account should be immediately blocked and appropriate action taken on such accounts and their owners. \n\nA number of \"possible matches\" may be found during screening. A risk-based process should be implemented to deal with such accounts (e.g. obtaining further KYC ID and temporarily blocking of account, depending upon risk level.\n\nA regular report should be generated (and reviewed by the AML/CFT management) on the number of screening matches and possible matches and the action taken on each."},"GSMA RMT (FR.P-09)","2.5.4.1.1","2.5.4.1.1: Has a documented account-screening process been implemented to ensure that all accounts (including customer, agent and business accounts) are screened against appropriate watch lists?\n","1) Watchlist screening process or AML/CFT policy / process\n- Check that the provider has a documented account screening process.\n- Check that the provider has conducted and documented an assessment of which sanction lists they are required to screen against.\n\n\n\n\n",0,"Standard Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.4","2.5.4: Providers shall screen accounts using domestic and international money laundering, terrorist financing, and sanctions watch lists","2.5.4.1","WATCHLIST SCREENING OF ACCOUNTS\nAll accounts (including customer, agent and business accounts) should be screened against watchhlists.  Watchlists should include domestic and international money laundering, terrorist financing, Politically Exposed Persons (PEP) and sanctions watch lists. \nExamples of international watch lists that may be used include:\n- The Consolidated United Nations Security Council Sanctions List\n- OFAC (US Office of Foreign Assets Control) Specially Designated Nationals List \n- The Consolidated List of Persons, Groups and Entities subject to EU Financial Sanctions.\n\nScreening should be performed within a short period of time following account opening and it is recommended that screening is repeated regularly thereafter (frequency may vary depending upon customer risk level). \nIn case a match is found against a mandatory watchlist, the account should be immediately blocked and appropriate action taken on such accounts and their owners. \n\nA number of \"possible matches\" may be found during screening. A risk-based process should be implemented to deal with such accounts (e.g. obtaining further KYC ID and temporarily blocking of account, depending upon risk level.\n\nA regular report should be generated (and reviewed by the AML/CFT management) on the number of screening matches and possible matches and the action taken on each.","GSMA RMT (FR.P-09)","2.5.4.1.1","2.5.4.1.1","Has a documented account-screening process been implemented to ensure that all accounts (including customer, agent and business accounts) are screened against appropriate watch lists?","1) Watchlist screening process or AML/CFT policy / process\n- Check that the provider has a documented account screening process.\n- Check that the provider has conducted and documented an assessment of which sanction lists they are required to screen against.\n\n\n\n\n",null,"Standard Required","Required","FraudRisk",null,null,"2","2.5","2.5.4","2.5.4: Les prestataires doivent passer tous les comptes au crible des listes nationales et internationales de sanction et de surveillance du blanchiment de capitaux et du financement du terrorisme.\n","2.5.4.1","CONTRÔLE DES LISTES DE SURVEILLANCE\nTous les comptes (de clients, d’agents et d’entreprises) doivent faire l’objet d’un contrôle des listes.  Ces dernières doivent inclurent des listes nationales et internationales de sanctions et de surveillance du blanchiment de capitaux, du financement du terrorisme et des personnes politiquement exposées (PEP). \nParmi les listes internationales susceptibles d’être utilisées figurent notamment :\n- la liste consolidée du comité des sanctions du Conseil de sécurité des Nations unies\n- la liste des ressortissants spécialement désignés du Bureau de contrôle des avoirs étrangers du Trésor américain (ou OFAC) \n- la liste consolidée des personnes, groupes et entités faisant l’objet de sanctions financières de l’Union européenne.\n\nCe contrôle doit être effectué peu de temps après l’ouverture du compte et il est recommandé que ce contrôle soit répété de façon périodique par la suite (la fréquence peut varier selon le niveau de risque des clients). \nLorsqu’il s’avère que le titulaire d’un compte figure sur une liste de surveillance obligatoire, le compte doit être immédiatement bloqué et des mesures doivent être prises à l’encontre de ces comptes et de leurs titulaires. \n\nUn certain nombre de « correspondances possibles » peut apparaître lors des contrôles. Un processus fondé sur le niveau de risque pour le traitement des comptes concernés doit alors être mis en place (par ex. obtenir des renseignements d’identité supplémentaires et bloquer le compte de façon temporaire en fonction du niveau de risque).\n\nUn rapport périodique doit être établi (et examiné par le responsable AML/CFT) concernant le nombre de correspondances avérées et possibles avec les listes de surveillance et les mesures prises dans chaque cas.","GSMA RMT (FR.P-09)","2.5.4.1.1","un processus documenté de contrôle des comptes a t-il été établi pour vérifier que tous les comptes (de clients, d’agents et d’entreprises) sont passés au crible des listes appropriées ?","1) Processus de contrôle des listes de surveillance et politiques annexes\n- Vérifier que le prestataire a mis en place un processus documenté de contrôle des comptes.\n- Vérifier que le prestataire a réalisé et documenté une évaluation permettant de définir les listes de sanctions retenues pour la surveillance des comptes.\n\n\n\n\n",null,"Requis Normal","Requis","FraudRisk",0,null,"2","2.5","2.5.4","2.5.4: Los proveedores deben analizar las cuentas utilizando las listas de control nacionales e internacionales de lavado de activos, financiamiento del terrorismo y sanciones.","2.5.4.1","ANÁLISIS DE CUENTAS CONTRA LAS LISTAS DE CONTROL\nTodas las cuentas (incluidas las cuentas de clientes, agentes y negocios) deben ser analizadas contra las listas de control.  Las listas de control deben incluir las listas de control nacionales e internacionales de lavado de activos, financiamiento del terrorismo, Personas Expuestas Políticamente (PEP) y sanciones. \nLos ejemplos de las listas de control internaciones que se pueden utilizar incluyen:\n- La Lista Consolidada de Sanciones del Consejo de Seguridad de las Naciones Unidas\n- La Lista de Nacionales Especialmente Designados de la OFAC (Oficina Estadounidense de Control de dinero Extranjeros)\n- La Lista Consolidada de Personas, Grupos y Entidades sujetas a las Sanciones Financieras de la UE.\n\nEl análisis se debe realizar dentro un período de tiempo corto después de la apertura de la cuenta y se recomienda que se repita posteriormente con regularidad (la frecuencia puede variar dependiendo del nivel de riesgo del cliente). \nEn caso de que se encuentre una coincidencia contra una lista de control obligatoria, se debe bloquear inmediatamente la cuenta y se deben tomar las medidas correspondientes sobre dichas cuentas y sus titulares. \n\nDurante el análisis se puede encontrar una cantidad de \"posibles coincidencias\". Se debe implementar un proceso basado en riesgos para tratar dichas cuentas (por ej., obtener un mayor ID de CSC y el bloqueo temporal de la cuenta, dependiendo del nivel de riesgo).\n\nSe debe generar un reporte regular (que debe ser revisado por la gerencia ALA/CFT) sobre la cantidad de coincidencias de análisis y posibles coincidencias y las medidas tomadas en cada caso.","GSMA RMT (FR.P-09)","2.5.4.1.1","¿Se implementó un proceso documentado de análisis de cuentas para garantizar que todas las cuentas (incluidas las cuentas de clientes, agentes y negocios) sean analizadas contra las listas de control correspondientes?","1) Proceso de análisis contra las listas de control o proceso / política ALA/CFT\n- Verificar que el proveedor haya documentado el proceso de análisis de cuentas.\n- Verificar que el proveedor haya llevado a cabo y documentado una evaluación de qué listas de sanciones se requieren para realizar el análisis.",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,"2","2.5","2.5.4",null,"2.5.4.1",null,"GSMA RMT (FR.P-09)","2.5.4.1.1",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.4.1.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.4",0,"2.5.4.1",null,0,"2.5.4.1.2","2.5.4.1.2: Does the account-screening process ensure that screening is performed within a short period of time following account opening?\n","1) Watchlist screening process or AML/CFT policy / process\n- Check the timing of the screening. It should before the business relationship is established or soon thereafter.\n- Check that the provider is screening newly sanctioned entities against the customer base\n- Check that the provider is receiving regular updates of both sanctions and PEP lists",0,"Standard Required","Required","FraudRisk",{"$f":"CHOOSE(LanguageNumber,BK81,CA81,CQ81,DG81)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.4",null,"2.5.4.1",null,null,"2.5.4.1.2","2.5.4.1.2","Does the account-screening process ensure that screening is performed within a short period of time following account opening?","1) Watchlist screening process or AML/CFT policy / process\n- Check the timing of the screening. It should before the business relationship is established or soon thereafter.\n- Check that the provider is screening newly sanctioned entities against the customer base\n- Check that the provider is receiving regular updates of both sanctions and PEP lists",null,"Standard Required","Required","FraudRisk",null,null,"2","2.5","2.5.4",0,"2.5.4.1",0,0,"2.5.4.1.2","est-ce que le processus de contrôle des comptes garantit que ce contrôle est effectué peu de temps après l'ouverture du compte ?","1) Processus de contrôle des listes de surveillance et politiques annexes\n- Vérifier les délais nécessaires à ce contrôle. Il doit être effectué avant l’établissement de la relation commerciale ou peu de temps après.\n- Vérifier que le prestataire effectue un rapprochement entre les entités récemment sanctionnées et sa clientèle \n- Vérifier que le prestataire reçoit régulièrement les listes de sanctions et des PEP mises à jour\n\n\n\n",null,"Requis Normal","Requis","FraudRisk",0,null,"2","2.5","2.5.4",null,"2.5.4.1",null,0,"2.5.4.1.2","¿El proceso de análisis de cuentas garantiza que el análisis se realice dentro de un período de tiempo corto después de la apertura de la cuenta?","1) Proceso de análisis contra las listas de control o proceso / política ALA/CFT\n- Verificar el plazo del análisis. Debe ser antes de que se establezca la relación comercial o inmediatamente después.\n- Verificar que el proveedor analice las entidades recientemente sancionadas contra la base de clientes\n- Verificar que el proveedor reciba actualizaciones regulares de las listas de sanciones y PEP",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,"2","2.5","2.5.4",null,"2.5.4.1",null,0,"2.5.4.1.2",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.4.1.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.4",null,"2.5.4.1",null,null,{"$f":"BC82","v":"2.5.4.1.3"},"2.5.4.1.3: Does the account-screening process ensure that in case a confirmed match is found against a mandatory watchlist, the account is blocked within one day and appropriate action taken on such accounts and their owners?\n",{"$f":"CHOOSE(LanguageNumber,BF82,BV82,CL82,DB82)","v":"1) Watchlist screening process or AML/CFT policy / process\n- Check that the process requires any accounts that are identified as being on a mandatory lists to be blocked within one day and further appropriate actions taken.\n- Check that the process includes full documentation and rationale for decisions to block accounts.\n"},{"$f":"CHOOSE(LanguageNumber,BG82,BW82,CM82,DC82)","v":0},{"$f":"CHOOSE(LanguageNumber,BH82,BX82,CN82,DD82)","v":"Standard Required"},{"$f":"CHOOSE(LanguageNumber,BI82,BY82,CO82,DE82)","v":"Required"},"FraudRisk",{"$f":"CHOOSE(LanguageNumber,BK82,CA82,CQ82,DG82)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.4",null,"2.5.4.1",null,null,"2.5.4.1.3",{"$f":"DO82","v":"2.5.4.1.4"},"Does the account-screening process ensure that in case a confirmed match is found against a mandatory watchlist, the account is blocked within one day and appropriate action taken on such accounts and their owners?","1) Watchlist screening process or AML/CFT policy / process\n- Check that the process requires any accounts that are identified as being on a mandatory lists to be blocked within one day and further appropriate actions taken.\n- Check that the process includes full documentation and rationale for decisions to block accounts.\n",null,"Standard Required","Required","FraudRisk",null,null,"2","2.5","2.5.4",null,"2.5.4.1",null,null,"2.5.4.1.3","est-ce que le processus de contrôle des comptes garantit qu'en cas d'identification d'une personne figurant sur une liste de surveillance obligatoire, le compte est bloqué dans un délai de 24h et que des mesures appropriées sont prises concernant ces comptes et leurs titulaires ?","1) Processus de contrôle des listes de surveillance ou politique/processus AML/CFT\n- Vérifier que le processus prévoit l’obligation de bloquer dans un délai de 24h les comptes des personnes figurant sur une liste de surveillance et la mise en œuvre des mesures appropriées \n- Vérifier que le processus définit l’ensemble des documents et la logique sur lesquels s’appuie la prise de décision de bloquer un compte.\n\n\n\n",null,"Requis Normal","Requis","FraudRisk",0,null,"2","2.5","2.5.4",null,"2.5.4.1",null,null,"2.5.4.1.3","¿El proceso de análisis de cuentas garantiza que en caso de que se encuentre una coincidencia confirmada contra una lista de control obligatoria la cuenta sea bloqueada en un día y se tomen las medidas correspondientes sobre dichas cuentas y sus titulares?","1) Proceso de análisis contra las listas de control o proceso / política ALA/CFT\n- Verificar que el proceso requiera que todas las cuentas identificadas en una lista obligatoria sean bloqueadas en un día y que posteriormente se tomen las medidas correspondientes.\n- Verificar que el proceso incluya la documentación y justificación completa para las decisiones de bloqueo de cuentas. \n",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,"2","2.5","2.5.4",null,"2.5.4.1",null,null,"2.5.4.1.3",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.4.1.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.4",0,"2.5.4.1",null,{"$f":"BB83","v":0},"2.5.4.1.4","2.5.4.1.4: Does the account-screening process ensure that screening is performed regularly on all customer, agent and business accounts, and following certain triggers, such as discovery of suspicious account activity or KYC issues?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.4",null,"2.5.4.1",null,null,"2.5.4.1.4","2.5.4.1.3","Does the account-screening process ensure that screening is performed regularly on all customer, agent and business accounts, and following certain triggers, such as discovery of suspicious account activity or KYC issues?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.5","2.5.4",0,"2.5.4.1",0,0,"2.5.4.1.4","est-ce que le processus de contrôle des comptes garantit que le contrôle est effectué régulièrement sur l'ensemble des comptes de clients, d'agents et d'entreprises, ainsi que dans le cas de certains événements déclencheurs, comme par exemple la découverte d'activités suspectes sur un compte ou des problèmes de vérification d'identité ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.5","2.5.4",null,"2.5.4.1",null,0,"2.5.4.1.4","¿El proceso de análisis de cuentas garantiza que se analicen con regularidad todas las cuentas de clientes, agentes y negocios, y después de ciertos disparadores, como el descubrimiento de una actividad sospechosa o problemas de CSC?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.5","2.5.4",null,"2.5.4.1",null,0,"2.5.4.1.4",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.4.1.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.4",0,"2.5.4.1",null,0,"2.5.4.1.5","2.5.4.1.5: Does the account-screening process specify how to deal with \"possible matches\", defining a risk-based process to deal with such accounts, including collection of further KYC ID and temporarily blocking of the account, depending upon risk level?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.4",null,"2.5.4.1",null,null,"2.5.4.1.5","2.5.4.1.5","Does the account-screening process specify how to deal with \"possible matches\", defining a risk-based process to deal with such accounts, including collection of further KYC ID and temporarily blocking of the account, depending upon risk level?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.5","2.5.4",0,"2.5.4.1",0,0,"2.5.4.1.5","le processus de contrôle des comptes précise-t-il comment traiter les \"correspondances possibles\" en définissant un processus fondé sur le niveau de risque pour traiter les comptes concernés, pouvant inclure la demande de renseignements d'identité supplémentaires et le blocage temporaire du compte selon le niveau de risque ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.5","2.5.4",null,"2.5.4.1",null,0,"2.5.4.1.5","¿El proceso de análisis de cuentas especifica cómo tratar las \"posibles coincidencias\", definiendo un proceso basado en riesgos para tratar dichas cuentas, que incluya la recolección de mayores ID de CSC y el bloqueo temporal de la cuenta, dependiendo del nivel de riesgo?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.5","2.5.4",null,"2.5.4.1",null,0,"2.5.4.1.5",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.4.1.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.5","2.5.4","","2.5.4.1",null,0,"2.5.4.1.6","2.5.4.1.6: Is a regular report generated (and reviewed by the AML/CFT management) on the number of screening matches and possible matches and the action taken on each?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.5","2.5.4","","2.5.4.1",null,null,"2.5.4.1.6","2.5.4.1.6","Is a regular report generated (and reviewed by the AML/CFT management) on the number of screening matches and possible matches and the action taken on each?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.5","2.5.4","","2.5.4.1",0,0,"2.5.4.1.6","un rapport périodique est-il établi (et examiné par le responsable AML/CFT) concernant le nombre de correspondances avérées et possibles avec les listes de surveillance et les mesures prises dans chaque cas ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.5","2.5.4",null,"2.5.4.1",null,0,"2.5.4.1.6","¿Se genera un reporte regular (y es revisado por la gerencia ALA/CFT) sobre la cantidad de coincidencias de análisis y posibles coincidencias y las medidas tomadas en cada caso?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.5","2.5.4",null,"2.5.4.1",null,0,"2.5.4.1.6",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.4.1.6",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,0,0,0,{"$f":"UPPER(CONCATENATE(Introduction!C12,\": \",Introduction!D12))","v":"2.6: STAFF AND AGENT AML/CFT TRAINING PROCEDURES"},null,null,{"$f":"BB86","v":0},null,{"$f":"Introduction!E12","v":"Providers shall train staff and agents in AML/CFT procedures, monitor their compliance and take action against violations"},null,null,null,null,null,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$12,\": \",Introduction!$L$12))","v":"2.6: STAFF AND AGENT AML/CFT TRAINING PROCEDURES"},null,null,null,null,null,{"$f":"Introduction!$M$12","v":"Providers shall train staff and agents in AML/CFT procedures, monitor their compliance and take action against violations"},null,null,null,null,0,null,null,0,0,0,null,null,null,null,null,null,null,null,null,null,0,null,null,0,0,0,{"$f":"UPPER(CONCATENATE(Introduction!$U$12,\": \",Introduction!$V$12))","v":"2.6: PROCEDIMIENTOS DE CAPACITACIÓN SOBRE ALD/LFT PARA PERSONAL Y AGENTES"},null,null,0,0,{"$f":"Introduction!W12","v":"El proveedor capacitará a su personal y agentes sobre los procedimientos de ALD/LFT, supervisará el cumplimiento de los mismos y tomará medidas en caso de incumplimiento."},null,null,{"$error":"#N/A"},{"$error":"#N/A"},0,null,null,0,0,0,null,0,0,0,0,null,null,null,null,null,0]
[null,"2","2.6","2.6.1",{"$f":"CHOOSE(LanguageNumber,AY87,BP87,CF87,CV87)","v":"2.6.1: Providers shall ensure that staff and agents are properly trained in AML/CFT procedures"},"2.6.1.1",{"$f":"AZ87&\": \"&CHOOSE(LanguageNumber,BA87,BR87,CH87,CX87)","v":"2.6.1.1: AGENT TRAINING IN AML/CFT\nThe AML/CFT policy should include a requirement to train agents in AML/CFT procedures before they start operating. Provider-agent contracts should require agents to implement proper processes and to train their own staff members accordingly.\n\nAgent training should include the following (as applicable):\n- How to conduct proper KYC verification when registering new customers; and\n- Responsibility of provider and individual staff for AML/CFT compliance and suspicious transaction reporting."},"GSMA RMT\n(AG-09)\n\nHK AML",{"$f":"BC87","v":"2.6.1.1.1"},{"$f":"BC87&\": \"&CHOOSE(LanguageNumber,BE87,BU87,CK87,DA87)&CarriageReturn","v":"2.6.1.1.1: Is there a policy stating that all agents must be trained in AML/CFT procedures before they start operating?\n"},{"$f":"CHOOSE(LanguageNumber,BF87,BV87,CL87,DB87)","v":"1) Agent training plan/materials or AML/CFT training plan\n- Check that all agents receive AML training prior to their starting operating.\n"},{"$f":"CHOOSE(LanguageNumber,BG87,BW87,CM87,DC87)","v":0},{"$f":"CHOOSE(LanguageNumber,BH87,BX87,CN87,DD87)","v":"Urgent Required"},{"$f":"CHOOSE(LanguageNumber,BI87,BY87,CO87,DE87)","v":"Required"},"FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.6","2.6.1","2.6.1: Providers shall ensure that staff and agents are properly trained in AML/CFT procedures","2.6.1.1","AGENT TRAINING IN AML/CFT\nThe AML/CFT policy should include a requirement to train agents in AML/CFT procedures before they start operating. Provider-agent contracts should require agents to implement proper processes and to train their own staff members accordingly.\n\nAgent training should include the following (as applicable):\n- How to conduct proper KYC verification when registering new customers; and\n- Responsibility of provider and individual staff for AML/CFT compliance and suspicious transaction reporting.","GSMA RMT\n(AG-09)\n\nHK AML","2.6.1.1.1","2.6.1.1.1","Is there a policy stating that all agents must be trained in AML/CFT procedures before they start operating?","1) Agent training plan/materials or AML/CFT training plan\n- Check that all agents receive AML training prior to their starting operating.\n",null,"Urgent Required","Required","FraudRisk",null,null,"2","2.6","2.6.1","2.6.1: Les prestataires doivent veiller à ce que leur personnel et leurs agents soient correctement formés aux procédures de lutte contre le blanchiment de capitaux et le financement du terrorisme.","2.6.1.1","FORMATION DES AGENTS À LA LUTTE CONTRE LE BLANCHIMENT DES CAPITAUX ET LE FINANCEMENT DU TERRORISME (AML/CFT)\nLa politique de lutte contre le blanchiment de capitaux et le financement du terrorisme doit inclure l'obligation de former les agents aux procédures AML/CFT avant qu'ils commencent à exercer leur activité. Les contrats entre prestataires et agents doivent exiger que les agents mettent en place des processus adaptés et qu'ils forment leur personnel en conséquence.\n\nLa formation des agents doit couvrir les aspects suivants (le cas échéant) : \n- comment effectuer la vérification en bonne et due forme de l'identité des nouveaux clients lors de leur enregistrement ; \n- responsabilités du prestataire et de chaque membre du personnel en matière de lutte contre le blanchiment de capitaux et le financement du terrorisme et d'obligation de déclaration des opérations suspectes. ","GSMA RMT\n(AG-09)\n\nHK AML","2.6.1.1.1","existe-t-il une politique statuant que les agents doivent être formés aux procédures AML/CFT avant de commencer à exercer leur activité ?","1) Plan/support de formation des agents ou plan de formation AML/CFT\n- Vérifier que l'ensemble des agents sont formés aux procédures AML avant de commencer à exercer leur activité.\n",null,{"$f":"VLOOKUP(BH87,CategoryTranslationTable,2,FALSE)","v":"Requis Prioritaire"},{"$f":"VLOOKUP(BI87,CategoryTranslationTable,2,FALSE)","v":"Requis"},"FraudRisk",0,null,"2","2.6","2.6.1","2.6.1: Los proveedores deben garantizar que el personal y los agentes reciban la capacitación adecuada sobre los procedimientos ALA/CFT.","2.6.1.1","CAPACITACIÓN DE AGENTES SOBRE ALA/CFT\nLa política ALA/CFT debe incluir un requisito para capacitar a los agentes sobre los procedimientos ALA/CFT antes de que comiencen a operar. Los contratos del proveedor-agente deben requerir que los agentes implementen los procesos adecuados y brinden la capacitación correspondiente a su propio personal.\n\nLa capacitación de los agentes debe incluir lo siguiente (según corresponda):\n- Cómo realizar una verificación de CSC adecuada al registrar nuevos clientes; y\n- Responsabilidad del proveedor y de los miembros individuales del personal de cumplir con los procedimientos ALA/CFT y reportar operaciones sospechosas.","GSMA RMT\n(AG-09)\n\nHK AML","2.6.1.1.1","¿Existe una política que establezca que todos los agentes deben recibir capacitación sobre los procedimientos ALA/CFT antes de comenzar a operar?  ","1) Plan/materiales de capacitación de los agentes o plan de capacitación sobre ALA/CFT\n- Verificar que contenga el requisito de que los agentes deben recibir capacitación sobre ALA antes de comenzar a operar\n- Verificar que todos los agentes reciban capacitación sobre ALA antes de comenzar a operar.",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,"2","2.6","2.6.1",null,"2.6.1.1",null,"GSMA RMT\n(AG-09)\n\nHK AML","2.6.1.1.1",null,null,null,{"$f":"VLOOKUP($BH87,CategoryTranslationTable,4,FALSE)","v":"ReqU4"},{"$f":"VLOOKUP($BI87,CategoryTranslationTable,4,FALSE)","v":"Req4"},"FraudRisk",null,null,null,null,null,null,null,null,"2.6.1.1.1",null,null,null,{"$f":"IF(OR($EA87=0,$EA87=2),VLOOKUP(DO87,INDIRECT(ED87),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP87),\"\",VLOOKUP(DP87,INDIRECT(EE87),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ87),\"\",VLOOKUP(DQ87,INDIRECT(EF87),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR87),\"\",VLOOKUP(DR87,INDIRECT(EG87),7,FALSE))","v":""},{"$f":"IF(OR($EA87=0,$EA87=2),VLOOKUP(DO87,INDIRECT(ED87),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP87),\"\",VLOOKUP(DP87,INDIRECT(EE87),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ87),\"\",VLOOKUP(DQ87,INDIRECT(EF87),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR87),\"\",VLOOKUP(DR87,INDIRECT(EG87),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN87,3)=\"NEW\")+2*AND(LEFT(DN87,3)=\"MER\")+3*AND(LEFT(DN87,3)=\"MOV\")+4*AND(LEFT(DN87,3)=\"SWA\")","v":0},{"$f":"IF(EA87=0,DS87,EN87)","v":{"$error":"#REF!"}},{"$f":"IF(EA87=0,IF(DW87=0,\"\",DW87),CHOOSE(EA87,\"New indicator\",CONCATENATE(DW87,CarriageReturn,DX87,CarriageReturn,DY87,CarriageReturn,DZ87)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO87,1)","v":"OriginalComplianceP2"},{"$f":"\"OriginalComplianceP\"&LEFT(DP87,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ87,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR87,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,""]
[null,"2","2.6","2.6.1",0,"2.6.1.1",null,0,"2.6.1.1.2","2.6.1.1.2: Does agent training for registering agents include how to conduct proper KYC verification when registering new customers?\n","1) Agent training plan/materials or AML/CFT training plan\n- Check that it contains details on what information is to be collected from the customer at registration, and how it is processed.\n- Check that it contains details on what documentation should be presented by the customer, and how it is verified by the agent.",0,"Urgent Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.6","2.6.1",null,"2.6.1.1",null,null,"2.6.1.1.2","2.6.1.1.2","Does agent training for registering agents include how to conduct proper KYC verification when registering new customers?","1) Agent training plan/materials or AML/CFT training plan\n- Check that it contains details on what information is to be collected from the customer at registration, and how it is processed.\n- Check that it contains details on what documentation should be presented by the customer, and how it is verified by the agent.",null,"Urgent Required","Required","FraudRisk",null,null,"2","2.6","2.6.1",0,"2.6.1.1",0,0,"2.6.1.1.2","la formation des agents pour les agents effectuant l'enregistrement des nouveaux clients explique-t-elle comment effectuer la vérification en bonne et due forme de l'identité des clients lors de l'enregistrement ?","1) Plan/supports de formation des agents ou plan de formation AML/CFT\n- Vérifier qu’il définit en détail les informations devant être recueillies lors de l’enregistrement des nouveaux clients et la façon dont ces informations sont traitées.\n- Vérifier qu’il définit en détail la documentation devant être présentée par le client et la façon dont cette documentation est contrôlée par l’agent.",null,"Requis Prioritaire","Requis","FraudRisk",0,null,"2","2.6","2.6.1",null,"2.6.1.1",null,0,"2.6.1.1.2","¿La capacitación para los agentes de registro incluye cómo realizar una verificación de CSC adecuada al registrar nuevos clientes?","1) Plan/materiales de capacitación de los agentes o plan de capacitación sobre ALA/CFT\n- Verificar que contenga detalles sobre qué información se debe recolectar del cliente al momento del registro, y cómo se procesa.\n- Verificar que contenga detalles sobre qué documentación debe presentar el cliente, y cómo es verificada por el agente.",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,"2","2.6","2.6.1",null,"2.6.1.1",null,0,"2.6.1.1.2",null,null,null,"ReqU4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.6.1.1.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.6","2.6.1",0,"2.6.1.1",null,0,"2.6.1.1.3","2.6.1.1.3: Do contractual arrangements require agents to implement appropriate AML/CFT processes and to train their staff members accordingly?\n","1) Standard / sample agent contract\n- Check that the agent contract requires agents to implement appropriate AML/CTF processes and to train their staff accordingly",0,"Standard Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.6","2.6.1",null,"2.6.1.1",null,null,"2.6.1.1.3","2.6.1.1.3","Do contractual arrangements require agents to implement appropriate AML/CFT processes and to train their staff members accordingly?","1) Standard / sample agent contract\n- Check that the agent contract requires agents to implement appropriate AML/CTF processes and to train their staff accordingly",null,"Standard Required","Required","FraudRisk",null,null,"2","2.6","2.6.1",0,"2.6.1.1",0,0,"2.6.1.1.3","les dispositions contractuelles exigent-elles que les agents mettent en œuvre des processus AML/CFT adaptés et forment leur personnel en conséquence ?","1) Modèle de contrat d’agent/contrat d’agent type\n- Vérifier que les dispositions contractuelles des agents stipulent que les agents doivent mettre en place les processus AML/CTF appropriés et former leur personnel en conséquence",null,"Requis Normal","Requis","FraudRisk",0,null,"2","2.6","2.6.1",null,"2.6.1.1",null,0,"2.6.1.1.3","¿Los acuerdos contractuales requieren que los agentes implementen procesos ALA/CFT adecuados y brinden la capacitación correspondiente a su personal?","1) Contrato estándar / modelo de contrato con los agentes\n- Verificar que el contrato con los agentes requiera que los agentes implementen los procesos ALA/CTF adecuados y brinden la capacitación correspondiente a su propio personal",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,"2","2.6","2.6.1",null,"2.6.1.1",null,0,"2.6.1.1.3",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.6.1.1.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.6","2.6.1",0,"2.6.1.2",{"$f":"AZ90&\": \"&CHOOSE(LanguageNumber,BA90,BR90,CH90,CX90)","v":"2.6.1.2: STAFF TRAINING IN AML/CFT\nThe AML/CFT policy should include a requirement to train relevant staff in AML/CFT procedures, and they should be provided with regular refresher training, and that training records must be kept.\n\nStaff training should include the following (as applicable):\n- Responsibility of provider and individual staff for AML/CFT compliance and suspicious transaction reporting; \n- Provider’s policies and procedures and the role of staff with respect with to these policies and procedures; \n- Relevant emerging risks and trends in ML/TF; \n- How to conduct proper KYC verification when registering new clients; \n- Proper record-keeping procedures; \n- How to identify and report suspicious activity without “tipping off”; \n- How to communicate with agents;\n- How to monitor agent compliance with AML/CFT requirements."},"GSMA RMT (FR.O-06)\n\nHK AML","2.6.1.2.1","2.6.1.2.1: Is there a policy stating that relevant staff must be trained in AML/CFT procedures?\n","1) Employee training plan/materials or AML/CFT training plan/materials or AML/CFT policy (or equivalent)\n- Check that there is a requirement for staff to receive AML training during the induction process. [or this could be specified in AML/CFT policy]\n",0,"Urgent Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.6","2.6.1",null,"2.6.1.2","STAFF TRAINING IN AML/CFT\nThe AML/CFT policy should include a requirement to train relevant staff in AML/CFT procedures, and they should be provided with regular refresher training, and that training records must be kept.\n\nStaff training should include the following (as applicable):\n- Responsibility of provider and individual staff for AML/CFT compliance and suspicious transaction reporting; \n- Provider’s policies and procedures and the role of staff with respect with to these policies and procedures; \n- Relevant emerging risks and trends in ML/TF; \n- How to conduct proper KYC verification when registering new clients; \n- Proper record-keeping procedures; \n- How to identify and report suspicious activity without “tipping off”; \n- How to communicate with agents;\n- How to monitor agent compliance with AML/CFT requirements.","GSMA RMT (FR.O-06)\n\nHK AML","2.6.1.2.1","2.6.1.2.1","Is there a policy stating that relevant staff must be trained in AML/CFT procedures?","1) Employee training plan/materials or AML/CFT training plan/materials or AML/CFT policy (or equivalent)\n- Check that there is a requirement for staff to receive AML training during the induction process. [or this could be specified in AML/CFT policy]\n",null,"Urgent Required","Required","FraudRisk",null,null,"2","2.6","2.6.1",null,"2.6.1.2","FORMATION DU PERSONNEL À LA LUTTE CONTRE LE BLANCHIMENT DES CAPITAUX ET LE FINANCEMENT DU TERRORISME (AML/CFT)\nLa politique de lutte contre le blanchiment de capitaux et le financement du terrorisme doit inclure l'obligation de former le personnel concerné aux procédures AML/CFT, de dispenser des formations de rappel régulières et de conserver les registres de formation. \n\nLa formation du personnel doit couvrir les aspects suivants (le cas échéant) : \n- responsabilités du prestataire et de chaque membre du personnel en matière de lutte contre le blanchiment de capitaux et le financement du terrorisme et d'obligation de déclaration des opérations suspectes ;\n- politiques et procédures du prestataire et rôle du personnel dans le cadre de ces politiques et procédures ; \n- nouveaux risques et tendances en matière de blanchiment de capitaux et de financement du terrorisme ; \n- comment effectuer la vérification en bonne et due forme de l'identité des nouveaux clients lors de leur enregistrement ; \n- procédures appropriées de conservation des dossiers ; \n- comment repérer et signaler les activités suspectes sans divulgation inappropriée (“tipping off”) ; \n- comment communiquer avec les agents;\n- comment surveiller le respect des obligations AML/CFT par les agents.\n","GSMA RMT (FR.O-06)\n\nHK AML","2.6.1.2.1","existe-t-il une politique statuant que le personnel concerné doit être formé aux procédures AML/CFT ?","1) Plan/supports de formation du personnel ou plan/supports de formation AML/CFT ou Politique AML/CFT (ou équivalent)\n- Vérifier qu’il ou elle prévoit une exigence stipulant que le personnel doit être formé aux procédures AML au cours de la procédure d’intégration\n",null,"Requis Prioritaire","Requis","FraudRisk",0,null,"2","2.6","2.6.1",null,"2.6.1.2","CAPACITACIÓN DEL PERSONAL SOBRE ALA/CFT\nLa política ALA/CFT debe incluir un requisito de capacitación del personal correspondiente sobre los procedimientos ALA/CFT, se deben brindar actualizaciones de capacitación periódicas y se deben conservar los registros de capacitación.\n\nLa capacitación del personal debe incluir lo siguiente (según corresponda):\n- Responsabilidad del proveedor y de los miembros individuales del personal de cumplir con los procedimientos ALA/CFT y reportar las operaciones sospechosas; \n- Las políticas y procedimientos del proveedor y la función del personal respecto de estas políticas y procedimientos; \n- Los riesgos relevantes emergentes y las tendencias de LA/FT; \n- Cómo llevar a cabo una adecuada verificación de CSC al registrar nuevos clientes; \n- Procedimientos adecuados de mantenimiento de registros;\n- Cómo identificar y reportar actividades sospechosas sin “alertar”; \n- Cómo comunicarse con los agentes;\n- Cómo monitorear el cumplimiento de los requisitos ALA/CFT por parte de los agentes.","GSMA RMT (FR.O-06)\n\nHK AML","2.6.1.2.1","¿Existe una política que establezca que el personal debe recibir capacitación sobre los procedimientos ALA/CFT?","1) Plan/materiales de capacitación de los empleados o política ALA/CFT (o equivalente)\n- Verificar que exista un requisito para que el personal reciba capacitación sobre ALA durante el proceso de inducción. [o esto podría estar especificado en la política ALA/CFT]",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,"2","2.6","2.6.1",null,"2.6.1.2",null,"GSMA RMT (FR.O-06)\n\nHK AML","2.6.1.2.1",null,null,null,"ReqU4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.6.1.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.6","2.6.1",0,"2.6.1.2",null,0,"2.6.1.2.2","2.6.1.2.2: Are staff tested regularly on their understanding of internal policies and procedures and legal obligations with respect to AML/CFT?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.6","2.6.1",null,"2.6.1.2",null,null,"2.6.1.2.2","2.6.1.2.2","Are staff tested regularly on their understanding of internal policies and procedures and legal obligations with respect to AML/CFT?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.6","2.6.1",null,"2.6.1.2",0,0,"2.6.1.2.2","la bonne compréhension par le personnel des politiques et procédures internes et obligations légales en matière AML/CFT est-elle vérifiée régulièrement ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.6","2.6.1",null,"2.6.1.2",null,0,"2.6.1.2.2","¿Se examina periódicamente el conocimiento del personal sobre las políticas y procedimientos internos y las obligaciones legales en materia de ALA/CFT?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.6","2.6.1",null,"2.6.1.2",null,0,"2.6.1.2.2",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.6.1.2.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.6","2.6.2","2.6.2: Providers shall monitor staff and agent compliance with AML/CFT procedures","2.6.2.1",{"$f":"AZ92&\": \"&CHOOSE(LanguageNumber,BA92,BR92,CH92,CX92)","v":"2.6.2.1: MONITORING OF AGENT AML/CFT COMPLIANCE\nMonitoring (both on-site and off-site) should be aimed at ensuring that agents (including any sub-agents) comply with all internal policies and procedures and legal obligations with respect to AML/CFT. Providers should:\n- Develop systems that allow providers to monitor agent compliance with AML/CFT requirements; \n- Ensure agents understand the AML/CFT procedures;\n- Ensure all correct KYC details and IDs are captured when registering customers;\n- Ensure identity checks are properly performed for cash-in and cash-out transactions;\n- Ensure that all required records are kept;\n- Regularly review agent compliance with AML/CFT processes; and\n- Conduct on-site reviews of agents and their AML/CFT processes."},"HK AML\nBCBS AML\nGSMA RMT","2.6.2.1.1","2.6.2.1.1: Does agent monitoring ensure that all correct KYC details and IDs are captured when registering customers (if applicable)?\n","1) AML/CFT policy or process documentation\n- Check that there is a process to monitor agents to ensure all that KYC details are captured correctly. \n",0,"Standard Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.6","2.6.2","2.6.2: Providers shall monitor staff and agent compliance with AML/CFT procedures","2.6.2.1","MONITORING OF AGENT AML/CFT COMPLIANCE\nMonitoring (both on-site and off-site) should be aimed at ensuring that agents (including any sub-agents) comply with all internal policies and procedures and legal obligations with respect to AML/CFT. Providers should:\n- Develop systems that allow providers to monitor agent compliance with AML/CFT requirements; \n- Ensure agents understand the AML/CFT procedures;\n- Ensure all correct KYC details and IDs are captured when registering customers;\n- Ensure identity checks are properly performed for cash-in and cash-out transactions;\n- Ensure that all required records are kept;\n- Regularly review agent compliance with AML/CFT processes; and\n- Conduct on-site reviews of agents and their AML/CFT processes.","HK AML\nBCBS AML\nGSMA RMT","2.6.2.1.1","2.6.2.1.2","Does agent monitoring ensure that all correct KYC details and IDs are captured when registering customers (if applicable)?","1) AML/CFT policy or process documentation\n- Check that there is a process to monitor agents to ensure all that KYC details are captured correctly. \n",null,"Standard Required","Required","FraudRisk",null,null,"2","2.6","2.6.2","2.6.2: Les prestataires doivent veiller aau respect des procédures de lutte contre le blanchiment de capitaux et le financement du terrorisme par leur personnel et leurs agents. \n\n\n","2.6.2.1","SURVEILLANCE DE LA CONFORMITÉ AML/CFT DES AGENTS\nLa surveillance (à la fois sur site et hors site) doit avoir pour but de s’assurer que les agents (y compris les éventuels agents délégués) respectent l’ensemble des politiques et procédures internes et des obligations légales en matière de lutte contre le blanchiment de capitaux et le financement du terrorisme (AML/CFT). Les prestataires doivent :\n- développer des systèmes qui leur permettent de surveiller le respect par les agents des obligations AML/CFT ; \n- s’assurer que les agents comprennent les procédures AML/CFT ;\n- s’assurer que tous les renseignements et documents d’identité requis sont obtenus lors de l’enregistrement des clients ; \n- s’assurer que l’identité des clients soit dûment vérifiée pour toutes les opérations de dépôt et retrait d’espèces ; \n- s’assurer que toutes les informations requises soient dûment conservées ; \n- effectuer des examens réguliers du respect par les agents des processus AML/CFT ; et \n- effectuer des examens sur site des agents et de leurs processus AML/CFT.","HK AML\nBCBS AML\nGSMA RMT","2.6.2.1.1","la surveillance des agents permet-elle de s'assurer que tous les renseignements et documents d’identité requis sont obtenus lors de l’enregistrement des clients ?","1) Documentation de processus ou politique AML/CFT\n- Vérifier qu’il existe un processus de surveillance des agents permettant de s’assurer que tous les renseignements et documents d’identité requis sont obtenus. \n",null,"Requis Normal","Requis","FraudRisk",0,null,"2","2.6","2.6.2","2.6.2: Los proveedores deben monitorear el cumplimiento  de los procedimientos ALA/CFT por parte del personal y los agentes.","2.6.2.1","MONITOREO DE CUMPLIMIENTO ALA/CFT POR PARTE DE LOS AGENTES\nEl monitoreo (tanto en el sitio como fuera del sitio) debe tener por objeto garantizar que los agentes (incluidos todos los sub-agentes) cumplan con todas las políticas y procedimientos internos y las obligaciones legales en materia de ALA/CFT. Los proveedores deben:\n- Desarrollar sistemas que permitan a los proveedores monitorear el cumplimiento de los requisitos ALA/CFT por parte de los agentes; \n- Garantizar que los agentes comprendan los procedimientos ALA/CFT;\n- Garantizar que se capturen todos los detalles de CSC e ID correctos al momento del registro de los clientes;\n- Garantizar que se realicen correctamente las verificaciones de identidad para las transacciones de ingreso y retiro de efectivo;\n- Garantizar que se mantengan todos los registros requeridos;\n- Revisar regularmente el cumplimiento de los procesos ALA/CFT por parte de los agentes; y\n- Realizar revisiones en el sitio de los agentes y sus procesos ALA/CFT.","HK AML\nBCBS AML\nGSMA RMT","2.6.2.1.1","¿El monitoreo de los agentes garantiza que se capturen todos los detalles de CSC e ID correctos al momento del registro de clientes (si corresponde)?","1) Documentación de la política o proceso ALA/CFT\n- Verificar que exista un proceso para monitorear a los agentes a fin de garantizar que se capturen correctamente todos los detalles de CSC.",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,"2","2.6","2.6.2",null,"2.6.2.1",null,"HK AML\nBCBS AML\nGSMA RMT","2.6.2.1.1",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.6.2.1.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.6","2.6.2",0,"2.6.2.1",null,0,"2.6.2.1.2","2.6.2.1.2: Does agent monitoring ensure that identity checks are properly performed for cash-in and cash-out transactions?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.6","2.6.2",null,"2.6.2.1",null,null,"2.6.2.1.2","2.6.2.1.3","Does agent monitoring ensure that identity checks are properly performed for cash-in and cash-out transactions?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.6","2.6.2",0,"2.6.2.1",0,0,"2.6.2.1.2","la surveillance des agents permet-elle de s'assurer que l’identité des clients soit dûment vérifiée pour toutes les opérations de dépôt et retrait d’espèces ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.6","2.6.2",null,"2.6.2.1",null,0,"2.6.2.1.2","¿El monitoreo de los agentes garantiza que se realicen correctamente las verificaciones de identidad para las transacciones de ingreso y retiro de efectivo?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.6","2.6.2",null,"2.6.2.1",null,0,"2.6.2.1.2",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.6.2.1.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.6","2.6.2",0,"2.6.2.1",null,0,"2.6.2.1.3","2.6.2.1.3: Are records kept of agent monitoring activities?\n",0,0,"Standard Required","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.6","2.6.2",null,"2.6.2.1",null,null,"2.6.2.1.3","2.6.2.1.4","Are records kept of agent monitoring activities?",null,null,"Standard Required","Recommended","FraudRisk",null,null,"2","2.6","2.6.2",0,"2.6.2.1",0,0,"2.6.2.1.3","Des informations sur la surveillance des agents sont-elles conservées ?",null,null,"Requis Normal","Recommandé","FraudRisk",0,null,"2","2.6","2.6.2",null,"2.6.2.1",null,0,"2.6.2.1.3","¿Se mantienen registros de las actividades de monitoreo de los agentes?",null,null,"Obligatorio estándar","Recomendado","FraudRisk",null,null,"2","2.6","2.6.2",null,"2.6.2.1",null,0,"2.6.2.1.3",null,null,null,"ReqS4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.6.2.1.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"2","2.6","2.6.2","","2.6.2.2",{"$f":"AZ95&\": \"&CHOOSE(LanguageNumber,BA95,BR95,CH95,CX95)","v":"2.6.2.2: MONITORING OF STAFF AML/CFT COMPLIANCE\nRelevant staff should be monitored to ensure that they comply with AML/CFT processes. This should include:\n - KYC quality assurance (to identify erroneous  or fraudulent data that is inputted by customer service staff). \n - AML analysts (e.g. transaction monitoring / watchlist screening) should also have their work dip-tested to ensure that they are following procedures correctly.  \n - Staff who carry out agent due diligence should have samples of their work subjected to review. \n\n"},"HK AML\nGSMA RMT","2.6.2.2.1","2.6.2.2.1: Are there processes to review the work of those staff who carry out KYC QA, Agent Due Diligence assurance, transaction monitoring and watchlist screening or other AML analysis?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2","2.6","2.6.2","","2.6.2.2","MONITORING OF STAFF AML/CFT COMPLIANCE\nRelevant staff should be monitored to ensure that they comply with AML/CFT processes. This should include:\n - KYC quality assurance (to identify erroneous  or fraudulent data that is inputted by customer service staff). \n - AML analysts (e.g. transaction monitoring / watchlist screening) should also have their work dip-tested to ensure that they are following procedures correctly.  \n - Staff who carry out agent due diligence should have samples of their work subjected to review. \n\n","HK AML\nGSMA RMT","2.6.2.2.1","2.6.2.2.1","Are there processes to review the work of those staff who carry out KYC QA, Agent Due Diligence assurance, transaction monitoring and watchlist screening or other AML analysis?",null,null,"Recommended","Recommended","FraudRisk",null,null,"2","2.6","2.6.2",null,"2.6.2.2","SURVEILLANCE DE LA CONFORMITÉ AML/CFT DU PERSONNEL\nLe personnel concerné doit être contrôlé afin de s'assurer qu’il respecte bien les processus AML/CFT. Ces contrôles doivent comprendre :\n - contrôle de la qualité des renseignements d’identité (pour identifier les renseignements erronés ou frauduleux enregistrés par le service client). \n - contrôle du travail des analystes AML (par ex. surveillance des transactions / vérification des listes de surveillance) pour s'assurer que les procédures sont respectées.  \n - examen d'échantillons du travail réalisé par le personnel responsable des contrôles de vigilance à l’égard des agents. \n\n","HK AML\nGSMA RMT","2.6.2.2.1","existe-t-il des processus de surveillance du travail effectué par le personnel chargé de la vérification de l'identité des clients, de l'assurance de la vigilance auprès des agents, de la surveillance des transactions et des listes de contrôles ou d'autres analyses AML ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"2","2.6","2.6.2",null,"2.6.2.2","MONITOREO DE CUMPLIMIENTO ALA/CFT POR PARTE DEL PERSONAL\nSe debe monitorear al personal correspondiente para garantizar que cumpla con los procesos ALA/CFT. Estas acciones deben incluir:\n - Aseguramiento de calidad de CSC (para identificar datos erróneos o fraudulentos ingresados por el personal de atención al cliente). \n - También se debe realizar una prueba exhaustiva de los analistas de ALA (por ej., monitoreo de transacciones / análisis de listas de control) para garantizar que estén siguiendo los procesos correctamente.  \n - El personal que lleva a cabo la debida diligencia de los agentes debe tener muestras de su trabajo sujeto a revisión.","HK AML\nGSMA RMT","2.6.2.2.1","¿Existen procesos para revisar el trabajo del personal que lleva a cabo el Aseguramiento de la Calidad de CSC, aseguramiento de la Debida Diligencia del Cliente, monitoreo de transacciones, análisis de las listas de control y otros análisis ALA?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"2","2.6","2.6.2",null,"2.6.2.2",null,"HK AML\nGSMA RMT","2.6.2.2.1",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"2.6.2.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,0,0,0,{"$f":"UPPER(CONCATENATE(Introduction!C13,\": \",Introduction!D13))","v":"2.7: FRAUD MANAGEMENT"},null,null,0,null,{"$f":"Introduction!E13","v":"Providers shall develop risk-based policies and measures for fraud detection and prevention"},null,null,null,null,null,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$13,\": \",Introduction!$L$13))","v":"2.7: FRAUD MANAGEMENT"},null,null,null,null,null,{"$f":"Introduction!$M$13","v":"Providers shall develop risk-based policies and measures for fraud detection and prevention"},null,null,null,null,0,null,null,0,0,0,null,null,null,null,null,null,null,null,null,null,0,null,null,0,0,0,{"$f":"UPPER(CONCATENATE(Introduction!$U$13,\": \",Introduction!$V$13))","v":"2.7: GESTIÓN DE FRAUDES"},null,null,0,0,{"$f":"Introduction!W13","v":"El proveedor establecerá políticas y medidas basadas en riesgos para la detección y prevención de fraudes"},null,null,{"$error":"#N/A"},{"$error":"#N/A"},0,null,null,0,0,0,null,0,0,0,0,null,null,null,null,null,0]
[null,{"$f":"AV97","v":2},{"$f":"AW97","v":2.7},{"$f":"AX97","v":"2.7.1"},{"$f":"CHOOSE(LanguageNumber,AY97,BP97,CF97,CV97)","v":"2.7.1: Providers shall develop risk-based policies and measures for fraud detection and prevention"},"2.7.1.1",{"$f":"AZ97&\": \"&CHOOSE(LanguageNumber,BA97,BR97,CH97,CX97)","v":"2.7.1.1: FRAUD MANAGEMENT POLICY\nProviders should establish a mobile money fraud management policy that defines the approach to anticipating, monitoring, assessing, managing and controlling fraud. It should address the following:\n- design and implementation of the transaction monitoring system;\n- policies governing employees, agents, customers and third parties to reduce opportunities for fraud; and\n- communication with law enforcement agencies, statutory and regulatory bodies, and other key decision-makers concerning mobile money fraud."},"ECB RSMP",{"$f":"BC97","v":"2.7.1.1.1"},{"$f":"BC97&\": \"&CHOOSE(LanguageNumber,BE97,BU97,CK97,DA97)&CarriageReturn","v":"2.7.1.1.1: Is there a fraud management policy that defines the approach to anticipating, monitoring, assessing, managing and controlling mobile money fraud?\n"},"1) Fraud management policy (or equivalent documents)\n- Check the policy includes the entire fraud management lifecycle including anticipating, monitoring, assessing, managing and controlling fraud.\n- Check the policy contains specific actions relating to mobile money fraud (important if the policy is not mobile money-specific).",{"$f":"CHOOSE(LanguageNumber,BG97,BW97,CM97,DG97)","v":0},{"$f":"CHOOSE(LanguageNumber,BH97,BX97,CN97,DD97)","v":"Standard Required"},{"$f":"CHOOSE(LanguageNumber,BI97,BY97,CO97,DE97)","v":"Required"},"FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,2,2.7,"2.7.1","2.7.1: Providers shall develop risk-based policies and measures for fraud detection and prevention","2.7.1.1","FRAUD MANAGEMENT POLICY\nProviders should establish a mobile money fraud management policy that defines the approach to anticipating, monitoring, assessing, managing and controlling fraud. It should address the following:\n- design and implementation of the transaction monitoring system;\n- policies governing employees, agents, customers and third parties to reduce opportunities for fraud; and\n- communication with law enforcement agencies, statutory and regulatory bodies, and other key decision-makers concerning mobile money fraud.","ECB RSMP","2.7.1.1.1",{"$f":"DO97","v":"5.3.10.1.1"},"Is there a fraud management policy that defines the approach to anticipating, monitoring, assessing, managing and controlling mobile money fraud?","1) Fraud management policy (or equivalent documents)\n- Check the policy includes the entire fraud management lifecycle including anticipating, monitoring, assessing, managing and controlling fraud.\n- Check the policy contains specific actions relating to mobile money fraud (important if the policy is not mobile money-specific).",null,"Standard Required","Required","FraudRisk",null,null,2,2.7,"2.7.1","2.7.1: Les prestataires doivent mettre en place des politiques et mesures de prévention/détection des fraudes adaptées au niveau de risque.",{"$f":"$AZ97","v":"2.7.1.1"},"POLITIQUE DE LUTTE CONTRE LA FRAUDE\nLes prestataires doivent mettre en place une politique de lutte contre la fraude concernant l’argent mobile pour définir leur approche de prévention, de surveillance, d’évaluation, de gestion et de contrôle de la fraude. Cette politique doit couvrir les aspects suivants : \n- conception et mise en œuvre du système de surveillance des transactions ; \n- politiques applicables aux employés, agents, clients et prestataires extérieurs pour réduire les risques de fraude ; \n- communication avec les organisations chargées du respect de la loi. \n",{"$f":"BB97","v":"ECB RSMP"},"2.7.1.1.1","existe-t-il une politique de lutte contre la fraude définissant l'approche de prévention, de surveillance, d’évaluation, de gestion et de contrôle de la fraude en matière d'argent mobile ?","1) Politique de gestion de la fraude (ou documents équivalents)\n- Vérifier que la politique inclut l’intégralité du cycle de vie de la gestion de la fraude, y compris la prévention, la surveillance, l’évaluation, la gestion et le contrôle des cas de fraude.\n- Vérifier que la politique prévoit des mesures spécifiques en ce qui concerne les cas de fraude liés à l’argent mobile (si la politique couvre d’autres domaines que l’argent mobile).",null,{"$f":"VLOOKUP($BH97,CategoryTranslationTable,2,FALSE)","v":"Requis Normal"},{"$f":"VLOOKUP($BI97,CategoryTranslationTable,2,FALSE)","v":"Requis"},"FraudRisk",0,null,2,2.7,"2.7.1","2.7.1: Los proveedores deben desarrollar políticas y medidas basadas en riesgos para la detección y prevención de fraude.",{"$f":"$AZ97","v":"2.7.1.1"},"POLÍTICA DE GESTIÓN DE FRAUDE\nLos proveedores deben establecer una política de gestión de fraude del dinero móvil que defina el alcance para anticipar, monitorear, evaluar, gestionar y controlar el fraude. Debe considerar lo siguiente:\n- diseño e implementación del sistema de monitoreo de transacciones;\n- políticas que rijan a los empleados, agentes, clientes y terceros para reducir oportunidades de fraude; y\n- comunicación con los organismos de aplicación de la ley, entidades estatutarias y regulatorias y otros órganos encargados de la toma de decisiones clave relativas al fraude del dinero móvil.",{"$f":"BB97","v":"ECB RSMP"},{"$f":"$BC97","v":"2.7.1.1.1"},"¿Existe una política de gestión de fraude que defina el alcance para anticipar, monitorear, evaluar, gestionar y controlar el fraude del dinero móvil?","1) Política de gestión de fraude (o documentos equivalentes)\n- Verificar que la política incluya todo el ciclo de vida de gestión de fraude incluida la anticipación, monitoreo, evaluación, gestión y control de fraude.\n- Verificar que la política contenga acciones específicas relacionadas con el fraude del dinero móvil (es importante si la política no es específica del dinero móvil).",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,2,2.7,"2.7.1",null,{"$f":"$AZ97","v":"2.7.1.1"},null,{"$f":"BB97","v":"ECB RSMP"},{"$f":"$BC97","v":"2.7.1.1.1"},null,null,null,{"$f":"VLOOKUP($BH97,CategoryTranslationTable,4,FALSE)","v":"ReqS4"},{"$f":"VLOOKUP($BI97,CategoryTranslationTable,4,FALSE)","v":"Req4"},"FraudRisk",null,null,null,null,null,null,null,null,"5.3.10.1.1",null,null,null,{"$f":"IF(OR($EA97=0,$EA97=2),VLOOKUP(DO97,INDIRECT(ED97),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP97),\"\",VLOOKUP(DP97,INDIRECT(EE97),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ97),\"\",VLOOKUP(DQ97,INDIRECT(EF97),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR97),\"\",VLOOKUP(DR97,INDIRECT(EG97),7,FALSE))","v":""},{"$f":"IF(OR($EA97=0,$EA97=2),VLOOKUP(DO97,INDIRECT(ED97),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP97),\"\",VLOOKUP(DP97,INDIRECT(EE97),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ97),\"\",VLOOKUP(DQ97,INDIRECT(EF97),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR97),\"\",VLOOKUP(DR97,INDIRECT(EG97),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN97,3)=\"NEW\")+2*AND(LEFT(DN97,3)=\"MER\")+3*AND(LEFT(DN97,3)=\"MOV\")+4*AND(LEFT(DN97,3)=\"SWA\")","v":0},{"$f":"IF(EA97=0,DS97,EN97)","v":{"$error":"#REF!"}},{"$f":"IF(EA97=0,IF(DW97=0,\"\",DW97),CHOOSE(EA97,\"New indicator\",CONCATENATE(DW97,CarriageReturn,DX97,CarriageReturn,DY97,CarriageReturn,DZ97)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO97,1)","v":"OriginalComplianceP5"},{"$f":"\"OriginalComplianceP\"&LEFT(DP97,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ97,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR97,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,""]
[null,2,2.7,"2.7.1","",{"$f":"AZ98","v":"2.7.1.2"},"2.7.1.2: ANTI-FRAUD TRAINING\nMuch anti-fraud training is covered by AML/CFT and KYC training (see 2.6). Additional anti-fraud training should be implemented for staff and agents, which should include:\n- awareness of common frauds, including provider risks, agent risks and customer risks (e.g. social engineering);\n- specific processes that are designed to counter fraud; and\n- how to report suspicious activity (employees and agents should be mandated to report fraud or suspected fraud);\n- how to report fraud.\n\nThe channel for reporting fraud reporting could be the same as used for reporting suspected ML/TF, security incidents and data privacy breaches.","GSMA RMT","2.7.1.2.1","2.7.1.2.1: Is there a staff training programme that addresses fraud management and fraud awareness, including provider risks, agent risks and customer risks (e.g. social engineering) and anti-fraud processes?\n","1) Employee training plan / materials\n- Check that the training plan / materials includes training staff in fraud management and fraud awareness.\n- Check that the training plan / materials includes details on provider, agent and customer risk.\n- Check that the training plan / materials includes details on anti-fraud processes.",0,"Standard Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,2,2.7,"2.7.1","","2.7.1.2","ANTI-FRAUD TRAINING\nMuch anti-fraud training is covered by AML/CFT and KYC training (see 2.6). Additional anti-fraud training should be implemented for staff and agents, which should include:\n- awareness of common frauds, including provider risks, agent risks and customer risks (e.g. social engineering);\n- specific processes that are designed to counter fraud; and\n- how to report suspicious activity (employees and agents should be mandated to report fraud or suspected fraud);\n- how to report fraud.\n\nThe channel for reporting fraud reporting could be the same as used for reporting suspected ML/TF, security incidents and data privacy breaches.","GSMA RMT","2.7.1.2.1","5.3.10.2.1","Is there a staff training programme that addresses fraud management and fraud awareness, including provider risks, agent risks and customer risks (e.g. social engineering) and anti-fraud processes?","1) Employee training plan / materials\n- Check that the training plan / materials includes training staff in fraud management and fraud awareness.\n- Check that the training plan / materials includes details on provider, agent and customer risk.\n- Check that the training plan / materials includes details on anti-fraud processes.",null,"Standard Required","Required","FraudRisk",null,null,2,2.7,"2.7.1","","2.7.1.2","FORMATION ANTI-FRAUDE\nUne grande partie de la formation sur la fraude est couverte par la formation relative à la lutte contre le blanchiment de capitaux et le financement du terrorisme et aux mesures de vigilance à l’égard des clients (cf. 2.6). Une formation supplémentaire doit être dispensée au personnel et aux agents concernant :\n- la sensibilisation aux formes de fraude courantes et aux risques existant au niveau du prestataire, des agents et des clients (ex. « manipulation sociale ») ;\n- les processus ayant pour but spécifique de lutter contre la fraude ;\n- le mode de signalement des activités suspectes (les salariés et les agents doivent avoir l’obligation de signaler les situations de fraude avérée ou soupçonnée) ;\n- le mode de signalement de la fraude.","GSMA RMT","2.7.1.2.1","existe-t-il un programme de formation du personnel couvrant la sensibilition à la fraude et les mesures de prévention, y compris les risques concernant le prestataire, les agents et les clients (ex. « manipulation sociale ») et les procédures anti-fraude?","1) Plan/supports de formation du personnel\n- Vérifier que le plan/les supports de formation incluent la formation du personnel à la gestion de la fraude et la sensibilisation à la fraude.\n- Vérifier que le plan/les supports de formation contiennent des informations détaillées relatives aux risques concernant le prestataire, les agents et les clients.\n- Vérifier que le plan/les supports de formation contiennent des informations détaillées relatives aux processus de lutte contre la fraude.",null,{"$f":"VLOOKUP($BH98,CategoryTranslationTable,2,FALSE)","v":"Requis Normal"},{"$f":"VLOOKUP($BI98,CategoryTranslationTable,2,FALSE)","v":"Requis"},"FraudRisk",0,null,2,2.7,"2.7.1",null,"2.7.1.2","CAPACITACIÓN CONTRA EL FRAUDE\nGran parte de la capacitación contra el fraude está cubierta por la capacitación ALA/CFT y de CSC (ver 2.6). Se debe implementar capacitación adicional contra el fraude para el personal y los agentes, y debe incluir:\n- concientización de los fraudes comunes, incluyendo los riesgos del proveedor, los riesgos del agente y los riesgos del cliente (por ej., ingeniería social);\n- procesos específicos diseñados para combatir el fraude; y\n- cómo reportar actividades sospechosas (los empleados y agentes tienen la obligación de reportar el fraude o sospecha de fraude);\n- cómo reportar un fraude.","GSMA RMT","2.7.1.2.1","¿Existe un programa de capacitación del personal que considere la gestión de fraude y concientización de fraude, que incluya los riesgos del proveedor, los riesgos del agente y los riesgos del cliente (por ej., ingeniería social) y procesos contra el fraude?","1) Plan / materiales de capacitación de los empleados\n- Verificar que el plan / materiales de capacitación incluyan capacitar al personal sobre la gestión de fraude y la concientización de fraude.\n- Verificar que el plan / materiales de capacitación incluyan detalles de los riesgos del proveedor, del agente y del cliente.\n- Verificar que el plan / materiales de capacitación incluyan detalles de los procesos contra el fraude.",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,2,2.7,"2.7.1",null,"2.7.1.2",null,"GSMA RMT","2.7.1.2.1",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"5.3.10.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,2,2.7,"2.7.1",0,"2.7.1.2",null,0,"2.7.1.2.2","2.7.1.2.2: Are agents trained in anti-fraud measures, such as being aware of common frauds, identity checking, and social engineering, and how to report fraud?\n[The channel for reporting fraud reporting could be the same as used for reporting suspected ML/TF, security incidents and data privacy breaches]\n","1) Agent training plan / materials\n- Check content of agent training includes fraud education. For example, details of common frauds, identity checking and social engineering, and how to report fraud.",0,"Standard Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,2,2.7,"2.7.1",null,"2.7.1.2",null,null,"2.7.1.2.2","5.3.10.2.2","Are agents trained in anti-fraud measures, such as being aware of common frauds, identity checking, and social engineering, and how to report fraud?\n[The channel for reporting fraud reporting could be the same as used for reporting suspected ML/TF, security incidents and data privacy breaches]","1) Agent training plan / materials\n- Check content of agent training includes fraud education. For example, details of common frauds, identity checking and social engineering, and how to report fraud.",null,"Standard Required","Required","FraudRisk",null,null,2,2.7,"2.7.1",0,"2.7.1.2",0,0,"2.7.1.2.2","les agents sont-ils formés aux mesures de lutte contre la fraude, telles que la connaissance des formes courantes de fraude, la vérification d’identité et la manipulation sociale, et savent-ils signaler des activités frauduleuses ?\n\n[Le canal utilisé pour signaler tout cas de fraude peut être le même que celui utilisé pour signaler les soupçons d'activités ML/TF, les incidents de sécurité et les violations de donnée].","1) Plan/supports de formation des agents\n- Vérifier que le contenu des formations dispensées auprès des agents inclut la sensibilisation à la fraude. Par exemple, des détails concernant les formes courantes de fraude, la vérification des identités, l’ingénierie sociale et la méthode à appliquer pour signaler un cas de fraude.",null,{"$f":"VLOOKUP($BH99,CategoryTranslationTable,2,FALSE)","v":"Requis Normal"},{"$f":"VLOOKUP($BI99,CategoryTranslationTable,2,FALSE)","v":"Requis"},"FraudRisk",0,null,2,2.7,"2.7.1",null,"2.7.1.2",null,0,"2.7.1.2.2","¿Se brinda capacitación a los agentes sobre las medidas contra el fraude, como tener conocimiento de los fraudes comunes, verificaciones de identidad, e ingeniería social, y cómo reportar el fraude?\n[El canal para reportar el fraude podría ser el mismo que se utiliza para reportar sospechas de LD/LT, incidentes de seguridad y violaciones a la privacidad de los datos].","1) Plan / materiales de capacitación de los empleados\n- Verificar que el contenido de la capacitación incluya educación sobre fraude. Por ejemplo, detalles de fraudes comunes, verificación de identidad e ingeniería social, y cómo reportar un fraude.",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,2,2.7,"2.7.1",null,"2.7.1.2",null,0,"2.7.1.2.2",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"5.3.10.2.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,2,2.7,"2.7.1","","2.7.1.2",null,0,"2.7.1.2.3","2.7.1.2.3: Are employees and agents mandated to report fraud or suspected fraud, and trained in how to report suspicious activity?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,2,2.7,"2.7.1","","2.7.1.2",null,null,"2.7.1.2.3","5.3.10.2.3","Are employees and agents mandated to report fraud or suspected fraud, and trained in how to report suspicious activity?",null,null,"Recommended","Recommended","FraudRisk",null,null,2,2.7,"2.7.1","","2.7.1.2",0,0,"2.7.1.2.3","les salariés et les agents ont-ils l’obligation de signaler les situations de fraude avérée ou soupçonnée et sont-ils formés aux procédures de signalement des activités suspectes ?",null,null,{"$f":"VLOOKUP($BH100,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},{"$f":"VLOOKUP($BI100,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},"FraudRisk",0,null,2,2.7,"2.7.1",null,"2.7.1.2",null,0,"2.7.1.2.3","¿Los empleados y agentes tienen la obligación de reportar el fraude o sospecha de fraude, y reciben capacitación sobre cómo reportar una actividad sospechosa?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,2,2.7,"2.7.1",null,"2.7.1.2",null,0,"2.7.1.2.3",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"5.3.10.2.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,2,2.7,"2.7.1","","2.7.1.3","2.7.1.3: NOTIFICATIONS TO CUSTOMERS AND AGENTS\nProviders should send notifications to customers and agents whenever activity occurs on their account so that the user can verify it. This should include:\n- success or failure of all transactions;\n- change of security credentials (e.g., PIN replacement); and\n- change of personal information.\n\nTransaction confirmation messages should be sent to both the customer and the agent for cash-in and cash-out transactions.\n","GSMA RMT","2.7.1.3.1","2.7.1.3.1: Are all mobile money users notified of the success or failure of all transactions?\n","1) MM system functional specification \n- Check that notifications are sent to the customer of all transactions on their account, including transactions that have failed. [Could be evidenced by a demonstration of system]",0,"Urgent Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,2,2.7,"2.7.1","","2.7.1.3","NOTIFICATIONS TO CUSTOMERS AND AGENTS\nProviders should send notifications to customers and agents whenever activity occurs on their account so that the user can verify it. This should include:\n- success or failure of all transactions;\n- change of security credentials (e.g., PIN replacement); and\n- change of personal information.\n\nTransaction confirmation messages should be sent to both the customer and the agent for cash-in and cash-out transactions.\n","GSMA RMT","2.7.1.3.1","5.3.10.3.1","Are all mobile money users notified of the success or failure of all transactions?","1) MM system functional specification \n- Check that notifications are sent to the customer of all transactions on their account, including transactions that have failed. [Could be evidenced by a demonstration of system]",null,"Urgent Required","Required","FraudRisk",null,null,2,2.7,"2.7.1","","2.7.1.3","AVIS AUX CLIENTS ET AUX AGENTS\nLes prestataires doivent envoyer des notifications aux clients et aux agents chaque fois qu’une activité se produit sur leur compte de façon à ce que l’utilisateur puisse la vérifier. Ces notifications doivent comprendre :\n- transaction réussie ou avortée ;\n- modification des identifiants de sécurité (ex. émission d’un nouveau code confidentiel) ;\n- modification des renseignements personnels.\n\nDes messages de confirmation d’opération doivent être envoyés à la fois à l’agent et au client pour les dépôts et retraits d’espèces.\n","GSMA RMT","2.7.1.3.1","Les utilisateurs de services d'argent mobile sont-ils notifiés de de la réussite ou de l'échec de chaque transaction ?","1) Spécification fonctionnelle du système d’argent mobile\r\n- Vérifier que des notifications sont envoyées aux clients chaque fois qu’une transaction est effectuée sur leur compte, y compris pour chaque transaction avortée. [Peut être établi par le biais d’une démonstration du système]",null,{"$f":"VLOOKUP($BH101,CategoryTranslationTable,2,FALSE)","v":"Requis Prioritaire"},{"$f":"VLOOKUP($BI101,CategoryTranslationTable,2,FALSE)","v":"Requis"},"FraudRisk",0,null,2,2.7,"2.7.1",null,"2.7.1.3","NOTIFICACIONES A LOS CLIENTES Y AGENTES\nLos proveedores deben enviar notificaciones a los clientes y agentes siempre que haya actividad en sus cuentas para que el usuario pueda verificarla. Estas acciones deben incluir:\n- éxito o fracaso de todas las transacciones;\n- cambio de las credenciales de seguridad (por ej., reemplazo de PIN); y \n- cambio de la información personal.\n\nLos mensajes de confirmación de las transacciones deben ser enviados tanto al cliente como al agente para transacciones de ingreso y retiro de efectivo.","GSMA RMT","2.7.1.3.1","¿Se notifica a todos los usuarios del dinero móvil el éxito o fracaso de todas las transacciones?","1) Especificación funcional del sistema del dinero móvil\n- Verificar que se envíen notificaciones al cliente de todas las transacciones en su cuenta, inclusive de las transacciones fallidas. [Se podría evidenciar mediante una demostración del sistema]",null,{"$f":"VLOOKUP($BH101,CategoryTranslationTable,3,FALSE)","v":"Obligatorio urgente"},{"$f":"VLOOKUP($BI101,CategoryTranslationTable,3,FALSE)","v":"Obligatorio"},"FraudRisk",null,null,2,2.7,"2.7.1",null,"2.7.1.3",null,"GSMA RMT","2.7.1.3.1",null,null,null,"ReqU4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"5.3.10.3.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,2,2.7,"2.7.1","","2.7.1.3",null,null,"2.7.1.3.2","2.7.1.3.2: Are transaction confirmation messages sent to both the customer and the agent for cash-in and cash-out transactions?\n","1) The MM system functional specification that relates to transactions, product description or customer journey description\n- Check that confirmation messages are sent to both customer and agent for cash-in/out transactions. [Could be evidenced by a demonstration of system]",{"$f":"CHOOSE(LanguageNumber,BG102,BW102,CM102,DC102)","v":0},"Standard Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,2,2.7,"2.7.1","","2.7.1.3",null,null,"2.7.1.3.2","2.5.1.9.2","Are transaction confirmation messages sent to both the customer and the agent for cash-in and cash-out transactions?","1) The MM system functional specification that relates to transactions, product description or customer journey description\n- Check that confirmation messages are sent to both customer and agent for cash-in/out transactions. [Could be evidenced by a demonstration of system]",null,"Standard Required","Required","FraudRisk",null,null,2,2.7,"2.7.1","","2.7.1.3",null,null,{"$f":"$BC102","v":"2.7.1.3.2"},"les messages de confirmation d’opération sont-ils envoyés à la fois à l’agent et au client pour les opérations de dépôt et retrait d'espèces ?","1) Spécification fonctionnelle du système d’argent mobile relative aux transactions, au descriptif des produits ou à la description du parcours client\n- Vérifier que des messages de confirmation d’opération sont envoyés à la fois à l’agent et au client pour les opérations de dépôt et retrait d’espèces\n\n",null,{"$f":"VLOOKUP(BH102,CategoryTranslationTable,2,FALSE)","v":"Requis Normal"},{"$f":"VLOOKUP(BI102,CategoryTranslationTable,2,FALSE)","v":"Requis"},"FraudRisk",0,null,2,2.7,"2.7.1",null,"2.7.1.3",null,null,"2.7.1.3.2","¿Se envían mensajes de confirmación de las transacciones tanto al cliente como al agente para transacciones de ingreso y retiro de efectivo?","1) La especificación funcional del sistema del dinero móvil relativa a transacciones, descripción de productos o descripción del camino del cliente\n- Verificar que se envíen mensajes de confirmación al cliente y al agente para las transacciones de ingreso/retiro de efectivo. [Se podría evidenciar mediante una demostración del sistema]",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,2,2.7,"2.7.1",null,"2.7.1.3",null,null,"2.7.1.3.2",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"2.5.1.9.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP2","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,2,2.7,"2.7.1","","2.7.1.3",null,0,"2.7.1.3.3","2.7.1.3.3: Are mobile money account holders notified of key events such as change of security credentials (e.g. PIN replacement) and change of personal information?\n","1) MM system functional specification \n- Check that notifications are sent to the customer of all changes on their account, including changes to security credentials and personal information. [Could be evidenced by a demonstration of system]",0,"Urgent Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,2,2.7,"2.7.1","","2.7.1.3",null,null,"2.7.1.3.3","5.3.10.3.2","Are mobile money account holders notified of key events such as change of security credentials (e.g. PIN replacement) and change of personal information?","1) MM system functional specification \n- Check that notifications are sent to the customer of all changes on their account, including changes to security credentials and personal information. [Could be evidenced by a demonstration of system]",null,"Urgent Required","Required","FraudRisk",null,null,2,2.7,"2.7.1","","2.7.1.3",0,0,"2.7.1.3.3","les titulaires de comptes d'argent mobile sont-ils notifiés des événements clés tels que la modification de leurs identifiants de sécurité (ex. émission d’un nouveau code confidentiel) ou de leurs renseignements personnels ?","1) Spécification fonctionnelle du système d’argent mobile\n\r- Vérifier que des notifications sont envoyées aux clients pour toute modification effectuée sur leur compte, telle que la modification de leurs identifiants de sécurité ou de leurs renseignements personnels. [Peut être établi par le biais d’une démonstration du système]",null,{"$f":"VLOOKUP($BH103,CategoryTranslationTable,2,FALSE)","v":"Requis Prioritaire"},{"$f":"VLOOKUP($BI103,CategoryTranslationTable,2,FALSE)","v":"Requis"},"FraudRisk",0,null,2,2.7,"2.7.1",null,"2.7.1.3",null,0,"2.7.1.3.3","¿Se notifican a los titulares de cuentas del dinero móvil los eventos clave tales como un cambio en las credenciales de seguridad (por ej., reemplazo de PIN) y un cambio en la información personal?","1) Especificación funcional del sistema del dinero móvil\n- Verificar que se envíen notificaciones al cliente de todos los cambios en su cuenta, incluyendo los cambios a las credenciales de seguridad e información personal. [Se podría evidenciar mediante una demostración del sistema]",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,2,2.7,"2.7.1",null,"2.7.1.3",null,0,"2.7.1.3.3",null,null,null,"ReqU4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"5.3.10.3.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,2,2.7,"2.7.1","","2.7.1.4","2.7.1.4: SECURE CHANGING OF SECURITY CREDENTIALS AND SIMS\nSIM swaps and PIN changes are particularly susceptible to fraud. Impersonation fraud and employee frauds are common.\n\nControls should be implemented to protect SIM swaps against impersonation fraud. Examples of protections include:\n - Requiring customer to present ID documentation to do SIM swap;\n - Preventing customer from using mobile money or USSD for 48 hours.\n\nAgent SIM swaps should be prohibited or strictly controlled. \n\nStrict controls shouold be enforced on staff that perform PIN changes, such as maker-checker, or restriction by roles, or monitoring of the PIN-change staff.\n\nRisk-based monitoring should be done on SIM swaps and change of PINs. High-risk accounts should be particularly monitored (e.g. airtime collection account, e-money disbursement/collection accounts, and high-value accounts).","GSMA RMT","2.7.1.4.1","2.7.1.4.1: Have controls been implemented to protect SIM swaps against impersonation fraud?\n","1) SIM swap process / fraud management policy (or equivalent documents)\n- Check that controls have been implemented to protect SIM swaps against impersonation fraud. Examples of protections include requiring customer to present ID documentation to or preventing customer from using mobile money or USSD for 48 hours. Other approaches may be acceptable.\n",0,"Urgent Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,2,2.7,"2.7.1","","2.7.1.4","SECURE CHANGING OF SECURITY CREDENTIALS AND SIMS\nSIM swaps and PIN changes are particularly susceptible to fraud. Impersonation fraud and employee frauds are common.\n\nControls should be implemented to protect SIM swaps against impersonation fraud. Examples of protections include:\n - Requiring customer to present ID documentation to do SIM swap;\n - Preventing customer from using mobile money or USSD for 48 hours.\n\nAgent SIM swaps should be prohibited or strictly controlled. \n\nStrict controls shouold be enforced on staff that perform PIN changes, such as maker-checker, or restriction by roles, or monitoring of the PIN-change staff.\n\nRisk-based monitoring should be done on SIM swaps and change of PINs. High-risk accounts should be particularly monitored (e.g. airtime collection account, e-money disbursement/collection accounts, and high-value accounts).","GSMA RMT","2.7.1.4.1","5.3.10.4.1","Have controls been implemented to protect SIM swaps against impersonation fraud?","1) SIM swap process / fraud management policy (or equivalent documents)\n- Check that controls have been implemented to protect SIM swaps against impersonation fraud. Examples of protections include requiring customer to present ID documentation to or preventing customer from using mobile money or USSD for 48 hours. Other approaches may be acceptable.\n",null,"Urgent Required","Required","FraudRisk",null,null,2,2.7,"2.7.1","","2.7.1.4","SECURITÉ LORS DES CHANGEMENTS DE CARTES SIM OU DES IDENTIFIANTS DE SÉCURITÉ\nLes changements de carte SIM ou des identifiants de sécurité sont particulièrement vulnérables à la fraude. L’usurpation d’identité et la fraude commise par le personnel sont des pratiques courantes.\n\nDes contrôles visant à protéger les changements de carte SIM contre l’usurpation d’identité doivent être mis en place. Parmi ces protections figurent :\n - demande de présentation d’une pièce d’identité lors du changement de carte SIM ;\n - blocage de l’utilisation d’argent mobile ou de service USSD pendant 48 heures.\n\nLes changements de cartes SIM d’agents doivent être interdits ou strictement contrôlés. \n\nDes contrôles stricts du personnel chargé des changements d'identifiants de sécurité doivent être réalisés, comme par exemple un processus d'exécution/validation, une restriction en fonction du poste ou la surveillance du personnel effectuant les changements d’identifiants.\n\nLa surveillance fondée sur le niveau de risque doit être menée lors de changements de carte SIM ou d’identifiants de sécurité. Les comptes à fort niveau de risque doivent être particulièrement surveillés (par ex. compte de recouvrement de crédit, comptes de recouvrement ou de décaissement de monnaie électronique, et comptes à haute valeur ajoutée).","GSMA RMT","2.7.1.4.1","Des contrôles visant à protéger les changements de carte SIM contre l’usurpation d’identité ont-ils été mis en place ?","1) Processus de changement de carte SIM/politique de gestion de la fraude (ou documents équivalents)\n- Vérifier que des contrôles ont été mis en place afin de protéger le processus de changement de carte SIM pour éviter toute usurpation d’identité. Ces mesures de protection incluent par exemple le fait de demander au client de présenter une pièce d’identité ou d’interdire l’utilisation de l’argent mobile ou de l’USSD au client pendant 48 heures. D’autres approches peuvent être appliquées.\n",null,"Requis Prioritaire","Requis","FraudRisk",0,null,2,2.7,"2.7.1",null,"2.7.1.4","CAMBIOS SEGUROS DE LAS CREDENCIALES DE SEGURIDAD Y SIM\nLos cambios de SIM y PIN son particularmente susceptibles al fraude. Son comunes el fraude de suplantación de identidad y los fraudes de empleados.\n\nSe deben implementar controles para proteger los cambios de SIM contra el fraude de suplantación de identidad. Los ejemplos de protecciones incluyen:\n - Requerir al cliente presentar el documento de identidad para el cambio de SIM;\n - Evitar que el cliente utilice el dinero móvil o USSD por 48 horas.\n\nLos cambios de SIM de los agentes deben estar prohibidos o estrictamente controlados. \n\nSe deben exigir controles estrictos al personal que realiza cambios de PIN, tal como ejecutor-verificador o restricción por roles, o monitoreo del personal que realiza cambios de PIN.\n\nSe debe realizar un monitoreo basado en riesgos sobre los cambios de SIM y cambios de PIN. Particularmente se deben monitorear las cuentas de alto riesgo (por ej., cuentas de cobro de tiempo aire, cuentas de desembolso/cobro de dinero móvil y cuentas de altos montos).","GSMA RMT","2.7.1.4.1","¿Se implementaron controles para proteger los cambios de SIM contra el fraude de suplantación de identidad?","1) Proceso de cambio de SIM / política de gestión de fraude (o documentos equivalentes)\n- Verificar que se hayan implementado controles para proteger los cambios de SIM contra el fraude de suplantación de identidad. Los ejemplos de protecciones incluyen que se requiera al cliente que presente el documento de identidad o evitar que el cliente utilice el dinero móvil o USSD por 48 horas. Otros enfoques pueden ser aceptables.",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,2,2.7,"2.7.1",null,"2.7.1.4",null,"GSMA RMT","2.7.1.4.1",null,null,null,"ReqU4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"5.3.10.4.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,2,2.7,"2.7.1","","2.7.1.4",null,0,"2.7.1.4.2","2.7.1.4.2: Are Agent SIM swaps prohibited or strictly controlled?\n","1) SIM swap process / fraud management policy (or equivalent documents)\n- Check that there are controls in place to strictly control or prohibit Agent SIM swaps.\n\n",0,"Standard Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,2,2.7,"2.7.1","","2.7.1.4",null,null,"2.7.1.4.2","5.3.10.4.3","Are Agent SIM swaps prohibited or strictly controlled?","1) SIM swap process / fraud management policy (or equivalent documents)\n- Check that there are controls in place to strictly control or prohibit Agent SIM swaps.\n\n",null,"Standard Required","Required","FraudRisk",null,null,2,2.7,"2.7.1","","2.7.1.4",null,null,{"$f":"BC105","v":"2.7.1.4.2"},"les changements de cartes SIM d’agents sont-ils interdits ou strictement contrôlés ?","1) Processus de changement de carte SIM/politique de gestion de la fraude (ou documents équivalents)\n- Vérifier que des contrôles ont été mis en place pour contrôler strictement ou interdire les changements de cartes SIM d’agents.\n\n",null,"Requis Normal","Requis","FraudRisk",0,null,2,2.7,"2.7.1",null,"2.7.1.4",null,null,"2.7.1.4.2","¿Los cambios de SIM de los agentes están prohibidos o están estrictamente controlados?","1) Proceso de cambio de SIM / política de gestión de fraude (o documentos equivalentes)\n- Verificar que se hayan implementado los controles para controlar estrictamente o prohibir los cambios de SIM de los Agentes.",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,2,2.7,"2.7.1",null,"2.7.1.4",null,null,"2.7.1.4.2",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"5.3.10.4.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,2,2.7,"2.7.1","","2.7.1.4",null,0,"2.7.1.4.3","2.7.1.4.3: Are strict controls enforced on staff that perform PIN changes \ne.g. maker-checker, or restriction by roles, or monitoring of the PIN-change staff.\n","1) PIN change process / fraud management policy (or equivalent documents)\n- Check that strict controls are enforced on staff that perform PIN changes e.g. maker-checker, or restriction by roles, or monitoring of the PIN-change staff.\n",0,"Urgent Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,2,2.7,"2.7.1","","2.7.1.4",null,null,"2.7.1.4.3","5.3.10.4.2","Are strict controls enforced on staff that perform PIN changes \ne.g. maker-checker, or restriction by roles, or monitoring of the PIN-change staff.","1) PIN change process / fraud management policy (or equivalent documents)\n- Check that strict controls are enforced on staff that perform PIN changes e.g. maker-checker, or restriction by roles, or monitoring of the PIN-change staff.\n",null,"Urgent Required","Required","FraudRisk",null,null,2,2.7,"2.7.1","","2.7.1.4",0,{"$f":"BB106","v":0},"2.7.1.4.3","Des contrôles stricts du personnel chargé des changements d’identifiants de sécurité sont-ils réalisés, \ncomme par exemple un processus d'exécution/validation, une restriction en fonction du poste ou la surveillance du personnel effectuant les changements d’identifiants ?","1) Processus de modification du code confidentiel/politique de gestion de la fraude (ou documents équivalents)\n- Vérifier que le personnel effectuant les modifications de code confidentiel est strictement contrôlé, par exemple par un processus de double signature (exécution/validation) ou par la restriction par rôles ou la surveillance du personnel effectuant les modifications de code confidentiel.\n",null,"Requis Prioritaire","Requis","FraudRisk",0,null,2,2.7,"2.7.1",null,"2.7.1.4",null,{"$f":"BB106","v":0},"2.7.1.4.3","¿Se exigen controles estrictos al personal que realiza cambios de PIN, como por ejemplo ejecutor-verificador o restricción por roles, o monitoreo del personal que realiza cambios de PIN?","1) Proceso de cambio de PIN / política de gestión de fraude (o documentos equivalentes)\n- Verificar que se exijan controles estrictos al personal que realiza cambios de PIN, por ej., ejecutor-verificador, o restricción por roles, o monitoreo del personal que realiza cambios de PIN.",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,2,2.7,"2.7.1",null,"2.7.1.4",null,{"$f":"BB106","v":0},"2.7.1.4.3",null,null,null,"ReqU4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"5.3.10.4.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,2,2.7,"2.7.1","","2.7.1.4",null,0,"2.7.1.4.4","2.7.1.4.4: Is risk-based monitoring done on SIM swaps and change of PINs, particularly on higher-risk accounts?\n","1) Monitoring / logging / audit trail specification and/or SIM swap and PIN change report \n- Check that monitoring is done on SIM swaps and change of PINs.",0,"Standard Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,2,2.7,"2.7.1","","2.7.1.4",null,null,"2.7.1.4.4","5.3.10.4.4","Is risk-based monitoring done on SIM swaps and change of PINs, particularly on higher-risk accounts?","1) Monitoring / logging / audit trail specification and/or SIM swap and PIN change report \n- Check that monitoring is done on SIM swaps and change of PINs.",null,"Standard Required","Required","FraudRisk",null,null,2,2.7,"2.7.1","","2.7.1.4",0,0,"2.7.1.4.4","Une surveillance fondée sur le niveau de risque est-elle menée lors de changements de carte SIM ou d’identifiants de sécurité ?","1) Spécification relative au suivi/à la journalisation (logging)/aux pistes d’audit et/ou rapport de changement de carte SIM et de modification du code confidentiel \n- Vérifier que les changements de carte SIM et les modifications de code confidentiel font l’objet d’un suivi.",null,"Requis Normal","Requis","FraudRisk",0,null,2,2.7,"2.7.1",null,"2.7.1.4",null,0,"2.7.1.4.4","¿Se realiza un monitoreo basado en riesgos de los cambios de SIM y cambios de PIN, particularmente en cuentas de alto riesgo?","1) Especificación de monitoreo / registro / pista de auditoría y/o reporte de cambios de SIM y cambios de PIN\n- Verificar que se realice el monitoreo de los cambios de SIM y los cambios de PIN.",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,2,2.7,"2.7.1",null,"2.7.1.4",null,0,"2.7.1.4.4",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"5.3.10.4.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,2,2.7,"2.7.1","","2.7.1.5","2.7.1.5: TRANSACTION AUTHORIZATION - BUYING GOODS AT MERCHANTS\nCustomer security credentials (e.g., PINs) should not be entered on any system that is not controlled by the provider or its trusted partners, including Point of Sale (PoS) devices and websites. Instead, the mobile money system should use another mechanism to authenticate customer transactions initiated on PoS devices or websites. If a customer-generated voucher (one-time code) is used, it should:\n- have a short validity period;\n- be specific to a merchant (or merchant chain);\n- be valid only up to a defined amount.\n\nThese controls limit the risk of the voucher being obtained by an unauthorized party and misused.","GSMA RMT","2.7.1.5.1","2.7.1.5.1: Are merchant transactions designed such that customers do not have to enter their PIN or other security credentials on Point of Sale (PoS) devices or websites that are not controlled by the provider or its trusted partners?\n","1) MM system functional specification and / or demonstration of system\n- Check the system specification to verify customers do not enter security details on any merchant point of sale device, website or any other device not controlled by the provider or its trusted partner.",0,"Standard Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,2,2.7,"2.7.1","","2.7.1.5","TRANSACTION AUTHORIZATION - BUYING GOODS AT MERCHANTS\nCustomer security credentials (e.g., PINs) should not be entered on any system that is not controlled by the provider or its trusted partners, including Point of Sale (PoS) devices and websites. Instead, the mobile money system should use another mechanism to authenticate customer transactions initiated on PoS devices or websites. If a customer-generated voucher (one-time code) is used, it should:\n- have a short validity period;\n- be specific to a merchant (or merchant chain);\n- be valid only up to a defined amount.\n\nThese controls limit the risk of the voucher being obtained by an unauthorized party and misused.","GSMA RMT","2.7.1.5.1","5.3.10.5.1","Are merchant transactions designed such that customers do not have to enter their PIN or other security credentials on Point of Sale (PoS) devices or websites that are not controlled by the provider or its trusted partners?","1) MM system functional specification and / or demonstration of system\n- Check the system specification to verify customers do not enter security details on any merchant point of sale device, website or any other device not controlled by the provider or its trusted partner.",null,"Standard Required","Required","FraudRisk",null,null,2,2.7,"2.7.1","","2.7.1.5","AUTORISATION DES TRANSACTIONS - ACHATS CHEZ LES COMMERÇANTS\nLes identifiants de sécurité des clients (ex. code confidentiel) ne doivent pas être entrés sur des systèmes non contrôlés par le prestataire ou ses partenaires agréés, terminaux de point de vente (TPV) et sites internet compris. Le système d’argent mobile doit utiliser d’autres mécanismes d’authentification des transactions des clients initiés sur des TPV ou sites internet. Si un bon émis par un client (code à usage unique) est utilisé, celui-ci doit :\n- avoir une durée de validité limitée ;\n- être propre au détaillant (ou à la chaîne de magasins) ;\n- être valide uniquement jusqu’à un certain montant.\n\nCes mesures de contrôle limitent le risque que ces bons soient détournés par des tiers non autorisés.","GSMA RMT","2.7.1.5.1","les transactions réalisées chez les commerçants sont-elles conçues de manière à ce que le client n'ait pas à entrer son code confidentiel ou d'autres identifiants de sécurité sur des terminaux de point de vente ou des sites internet non contrôlés par le prestataire ou ses partenaires agréés ?","1) Spécification fonctionnelle du système d’argent mobile et/ou démonstration du système\n- Vérifier que la spécification du système est conçue de manière à ce que le client n’ait pas à entrer ses identifiants de sécurité sur des terminaux de point de vente, des sites internet ou tous autres terminaux non contrôlés par le prestataire ou ses partenaires agréés.",null,"Requis Normal","Requis","FraudRisk",0,null,2,2.7,"2.7.1",null,"2.7.1.5","AUTORIZACIÓN DE TRANSACCIONES - COMPRA DE PRODUCTOS EN COMERCIOS\nLas credenciales de seguridad de los clientes (por ej., PIN) no deben ser ingresadas en ningún sistema que no sea controlado por el proveedor o sus socios confiables, incluyendo dispositivos del Punto de Venta (PoS) y sitios web. En cambio, el sistema del dinero móvil debe utilizar otro mecanismo para autenticar las transacciones de clientes iniciadas en dispositivos PoS o sitios web. Si se utiliza un voucher (código único) generado por el cliente, debe:\n- tener un período de validez corto;\n- ser específico para un comercio (o cadena de comercios);\n- ser válido solo hasta un monto definido.\n\nEstos controles limitan el riesgo de que el voucher sea obtenido y utilizado indebidamente por una parte no autorizada.","GSMA RMT","2.7.1.5.1","¿Las transacciones en los comercios están diseñadas de forma tal que los clientes no tengan que ingresar su PIN u otras credenciales de seguridad en los dispositivos del Punto de Venta (PoS) o sitios web no controlados por el proveedor o sus socios confiables?","1) Especificación funcional del sistema del dinero móvil y/o demostración del sistema \n- Verificar la especificación del sistema para comprobar que los clientes no ingresen detalles de seguridad en ningún dispositivo del punto de venta, sitio web o cualquier otro dispositivo no controlado por el proveedor o su socio confiable.",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,2,2.7,"2.7.1",null,"2.7.1.5",null,"GSMA RMT","2.7.1.5.1",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"5.3.10.5.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,2,2.7,"2.7.1","","2.7.1.5",null,0,"2.7.1.5.2","2.7.1.5.2: If customer-generated vouchers (one-time codes) are used for merchant payments on PoS devices or websites, are they:\n - restricted with a short validity period?\n - specific to the merchant (or merchant chain)?\n - valid only up to a defined amount?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,2,2.7,"2.7.1","","2.7.1.5",null,null,"2.7.1.5.2","5.3.10.5.2","If customer-generated vouchers (one-time codes) are used for merchant payments on PoS devices or websites, are they:\n - restricted with a short validity period?\n - specific to the merchant (or merchant chain)?\n - valid only up to a defined amount?",null,null,"Recommended","Recommended","FraudRisk",null,null,2,2.7,"2.7.1","","2.7.1.5",0,0,"2.7.1.5.2","dans le cas de l'utilisation de bons (code à usage unique) pour les paiements marchands sur des terminaux de point de vente ou des sites internet, ces bon sont-ils: \n- valables pour une durée limitée ?\n- spécifique au commerçant (ou à l'enseigne) ?\n- valables jusqu'à un certain montant ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,2,2.7,"2.7.1",null,"2.7.1.5",null,0,"2.7.1.5.2","Si se utilizan vouchers (códigos únicos) generados por el cliente para pagos en el comercio en los dispositivos PoS o sitios web:\n - ¿están restringidos con un período de validez corto?\n - ¿son específicos para el comercio (o cadena de comercios)?\n - ¿son válidos solo hasta un monto definido?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,2,2.7,"2.7.1",null,"2.7.1.5",null,0,"2.7.1.5.2",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,"MERGE","5.3.10.5.2","5.3.10.5.3","5.3.10.5.4",null,{"$f":"IF(OR($EA109=0,$EA109=2),VLOOKUP(DO109,INDIRECT(ED109),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP109),\"\",VLOOKUP(DP109,INDIRECT(EE109),7,FALSE))","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DQ109),\"\",VLOOKUP(DQ109,INDIRECT(EF109),7,FALSE))","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DR109),\"\",VLOOKUP(DR109,INDIRECT(EG109),7,FALSE))","v":""},{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},"",2,{"$f":"IF(EA109=0,DS109,EN109)","v":""},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP5","OriginalComplianceP5","OriginalComplianceP",{"$f":"COUNTIF($DS109:$DV109,EH$3)","v":0},{"$f":"COUNTIF($DS109:$DV109,EI$3)","v":0},0,0,{"$f":"COUNTIF($DS109:$DV109,EL$3)","v":0},{"$f":"COUNTIF($DO109:$DR109,\"*?\")","v":3},{"$f":"IF(OR(AND(EH109>0,SUM(EI109:EL109)>0),EK109>0),\"Partial\",IF(EH109=EM109,\"Yes\",IF(EI109=EM109,\"No\",IF(EJ109=EM109,\"N/A\",IF(EK109=EM109,\"Partial\",IF(EL109=EM109,\"\",\"\"))))))","v":""}]
[null,2,2.7,"2.7.1","","2.7.1.6","2.7.1.6: DIRECT DEPOSITS\nA direct deposit is a cash-in into a remote account to fraudulently bypass the P2P charge. This is a major source of revenue leakage for many providers. \nProviders should implement controls to prevent or reduce direct deposits, including:\n- \"soft\" controls i.e. education of agents to conduct identity checks of the customer to prevent direct deposits, and penalties for agents that fail to do so; and\n- \"hard\" controls i.e. technical changes to ensure that the sender handset is present at cash-in.","GSMA RMT","2.7.1.6.1","2.7.1.6.1: Are controls implemented to prevent or reduce direct deposit fraud, where controls could include soft controls (agent processes) or hard controls (technical changes)?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,2,2.7,"2.7.1","","2.7.1.6","DIRECT DEPOSITS\nA direct deposit is a cash-in into a remote account to fraudulently bypass the P2P charge. This is a major source of revenue leakage for many providers. \nProviders should implement controls to prevent or reduce direct deposits, including:\n- \"soft\" controls i.e. education of agents to conduct identity checks of the customer to prevent direct deposits, and penalties for agents that fail to do so; and\n- \"hard\" controls i.e. technical changes to ensure that the sender handset is present at cash-in.","GSMA RMT","2.7.1.6.1","5.3.10.7.1","Are controls implemented to prevent or reduce direct deposit fraud, where controls could include soft controls (agent processes) or hard controls (technical changes)?",null,null,"Recommended","Recommended","FraudRisk",null,null,2,2.7,"2.7.1","","2.7.1.6","DÉPÔTS DIRECTS\nLes dépôts directs sont les remises d’espèces sur un compte à distance dans le but d’éviter frauduleusement les commissions de transfert P2P. Cette pratique représente un manque à gagner conséquent pour de nombreux prestataires. \nLes prestataires doivent mettre en place des mesures de contrôle pour empêcher ou réduire les dépôts directs, comme par exemple : \n- des mesures de contrôle « indirect » : éducation des agents pour qu’ils contrôlent l’identité des clients en vue d’empêcher les dépôts directs avec sanction pour les agents qui ne le font pas ; \n- des mesures de contrôle « direct » : modifications techniques pour exiger la présence de l’appareil téléphonique du titulaire du compte au moment de la remise d’espèces. ","GSMA RMT","2.7.1.6.1","des mesures de contrôle sont-elles en place pour empêcher ou réduire la fraude aux dépôts directs, pouvant inclure des mesures indirectes (procédures des agents) ou directes (changements techniques)?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,2,2.7,"2.7.1",null,"2.7.1.6","DEPÓSITOS DIRECTOS\nUn depósito directo es un ingreso de efectivo en una cuenta remota para evadir fraudulentamente el cargo P2P. Para muchos proveedores, constituye es la principal fuente de pérdida de ingresos. \nLos proveedores deben implementar controles para prevenir o reducir los depósitos directos, incluyendo:\n-  controles \"leves\", es decir, educación de los agentes para realizar verificaciones de identidad del cliente a fin de evitar depósitos directos, y penalidades para los agentes que incumplen; y\n- controles \"severos\", es decir, cambios técnicos para garantizar que el dispositivo del remitente esté presente en el ingreso de efectivo.","GSMA RMT","2.7.1.6.1","¿Se implementan controles para prevenir o reducir el fraude de depósitos directos, que podrían incluir controles leves (procesos del agente) o controles severos (cambios técnicos)?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,2,2.7,"2.7.1",null,"2.7.1.6",null,"GSMA RMT","2.7.1.6.1",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"5.3.10.7.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$f":"IF(EA110=0,DS110,EN110)","v":{"$error":"#REF!"}},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",{"$f":"COUNTIF($DS110:$DV110,EH$3)","v":0},0,0,0,0,{"$f":"COUNTIF($DO110:$DR110,\"*?\")","v":1},{"$f":"IF(OR(AND(EH110>0,SUM(EI110:EL110)>0),EK110>0),\"Partial\",IF(EH110=EM110,\"Yes\",IF(EI110=EM110,\"No\",IF(EJ110=EM110,\"N/A\",IF(EK110=EM110,\"Partial\",IF(EL110=EM110,\"\",\"\"))))))","v":""}]
[null,2,2.7,"2.7.1","","2.7.1.7","2.7.1.7: AGENT ANTI-FRAUD MEASURES\nProviders should ensure that agents cannot provide services outside the expected geographical area of their activities, as this may indicate fraudulent activity - for example, agent SIMs have been found operating illegal international money transfer from another country or used in prisons. The following controls should be implemented:\n- Providers should use location tracking of agent SIMs to identify agents that are operating outside their normal area;\n- Providers should disable roaming on agent handsets.\n\nProviders should introduce SMS restrictions so that agent SIMs can only receive SMSs from the mobile money system. This can prevent spoof SMSs from being sent to agents for false cash-outs.\n\nProviders should reconcile transaction and commissions data to detect commissions fraud, such as agents parcelling large transactions into smaller ones to earn larger commissions.","GSMA RMT","2.7.1.7.1","2.7.1.7.1: Is the location of agents being tracked to prevent agents from operating outside their normal area?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,2,2.7,"2.7.1","","2.7.1.7","AGENT ANTI-FRAUD MEASURES\nProviders should ensure that agents cannot provide services outside the expected geographical area of their activities, as this may indicate fraudulent activity - for example, agent SIMs have been found operating illegal international money transfer from another country or used in prisons. The following controls should be implemented:\n- Providers should use location tracking of agent SIMs to identify agents that are operating outside their normal area;\n- Providers should disable roaming on agent handsets.\n\nProviders should introduce SMS restrictions so that agent SIMs can only receive SMSs from the mobile money system. This can prevent spoof SMSs from being sent to agents for false cash-outs.\n\nProviders should reconcile transaction and commissions data to detect commissions fraud, such as agents parcelling large transactions into smaller ones to earn larger commissions.","GSMA RMT","2.7.1.7.1","5.3.10.8.1","Is the location of agents being tracked to prevent agents from operating outside their normal area?",null,null,"Recommended","Recommended","FraudRisk",null,null,2,2.7,"2.7.1","","2.7.1.7","MESURES DE LUTTE CONTRE LA FRAUDE CHEZ LES AGENTS \nLes prestataires doivent s’assurer que les agents ne puissent pas offrir des services en dehors de leur zone géographique normale, ce qui pourrait signaler des activités frauduleuses. Il est ainsi arrivé que des cartes SIM d’agents soient utilisées en prison ou pour effectuer des transferts d’argent illégaux en provenance d’autres pays. Les prestataires doivent donc mettre en place les mesures de contrôle suivantes :\n- utilisation de la géolocalisation des cartes SIM d’agents pour identifier les agents faisant des opérations en dehors de leur territoire habituel ;\n- désactivation de l’itinérance (roaming) sur les téléphones des agents. \n\nLes prestataires doivent mettre en place des restrictions sur les SMS de façon à ce que les cartes SIM d’agents puissent uniquement recevoir les SMS émis par le système de l’argent mobile. Cette pratique permet d’éviter l’envoi de faux SMS aux agents pour des retraits d’espèces frauduleux. \n\nLes prestataires doivent effectuer un rapprochement des données relatives aux transactions et aux commissions de façon à identifier les agents pratiquant la fragmentation des transactions en vue de générer des commissions plus importantes. ","GSMA RMT","2.7.1.7.1","la localisation des agents est-elle surveillée pour empêcher les agents de faire des opérations en dehors de leur territoire habituel ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,2,2.7,"2.7.1",null,"2.7.1.7","MEDIDAS CONTRA EL FRAUDE POR PARTE DEL AGENTE\nLos proveedores deben garantizar que los agentes no puedan prestar servicios fuera del área geográfica esperada de sus actividades, ya que esto podría indicar una actividad fraudulenta, por ejemplo, se encontraron SIM de agentes que operaban transferencias internacionales de dinero ilegales desde otro país o utilizadas en prisiones. Se deben implementar los siguientes controles:\n- Los proveedores deben utilizar el rastreo de ubicación de SIM del agente para identificar los agentes que están operando fuera del área habitual;\n- Los proveedores deben deshabilitar el roaming en los dispositivos de los agentes.\n\nLos proveedores deben introducir restricciones de SMS para que las SIM de los agentes solo puedan recibir SMS del sistema del dinero móvil. Esto puede evitar que se envíen SMS falsos a los agentes para retiros de efectivo falsos.\n\nLos proveedores deben conciliar los datos de transacciones y comisiones para detectar el fraude de comisiones, como por ejemplo agentes que fraccionan grandes transacciones en transacciones más pequeñas para cobrar mayores comisiones.","GSMA RMT","2.7.1.7.1","¿Se rastrea la ubicación de los agentes para evitar que operen fuera de su área habitual?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,2,2.7,"2.7.1",null,"2.7.1.7",null,"GSMA RMT","2.7.1.7.1",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"5.3.10.8.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,2,2.7,"2.7.1","","2.7.1.7",null,0,"2.7.1.7.2","2.7.1.7.2: Is roaming disabled on agent handsets?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,2,2.7,"2.7.1","","2.7.1.7",null,null,"2.7.1.7.2","5.3.10.8.2","Is roaming disabled on agent handsets?",null,null,"Recommended","Recommended","FraudRisk",null,null,2,2.7,"2.7.1","","2.7.1.7",0,0,"2.7.1.7.2","l’itinérance (roaming) est-elle desactivée sur les téléphones des agents ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,2,2.7,"2.7.1",null,"2.7.1.7",null,0,"2.7.1.7.2","¿Se deshabilita el roaming en los dispositivos de los agentes?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,2,2.7,"2.7.1",null,"2.7.1.7",null,0,"2.7.1.7.2",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"5.3.10.8.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,2,2.7,"2.7.1","","2.7.1.7",null,0,"2.7.1.7.3","2.7.1.7.3: Have SMS restrictions been applied so that agent SIMs can only receive SMSs from the mobile money system in order to prevent spoof SMSs being sent to agents for false cash-outs?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,2,2.7,"2.7.1","","2.7.1.7",null,null,"2.7.1.7.3","5.3.10.8.3","Have SMS restrictions been applied so that agent SIMs can only receive SMSs from the mobile money system in order to prevent spoof SMSs being sent to agents for false cash-outs?",null,null,"Recommended","Recommended","FraudRisk",null,null,2,2.7,"2.7.1","","2.7.1.7",0,0,"2.7.1.7.3","existe-t-il des restrictions sur les SMS de façon à ce que les cartes SIM d’agents puissent uniquement recevoir les SMS émis par le système de l’argent mobile en vue d’éviter l’envoi de faux SMS aux agents pour des retraits d’espèces frauduleux ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,2,2.7,"2.7.1",null,"2.7.1.7",null,0,"2.7.1.7.3","¿Se aplicaron restricciones de SMS para que las SIM de los agentes solo puedan recibir SMS del sistema del dinero móvil a fin de evitar que se envíen SMS falsos a los agentes por retiros de efectivo falsos?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,2,2.7,"2.7.1",null,"2.7.1.7",null,0,"2.7.1.7.3",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"5.3.10.8.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,2,2.7,"2.7.1","","2.7.1.7",null,0,"2.7.1.7.4","2.7.1.7.4: Is transaction and commissions data reconciled to detect commissions fraud, such as agents parcelling large transactions into smaller ones to earn larger commissions?\n",0,0,"Recommended","Recommended","FraudRisk",{"$f":"CHOOSE(LanguageNumber,BK114,CA114,CQ114,DG114)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,2,2.7,"2.7.1","","2.7.1.7",null,null,"2.7.1.7.4","5.3.10.8.4","Is transaction and commissions data reconciled to detect commissions fraud, such as agents parcelling large transactions into smaller ones to earn larger commissions?",null,null,"Recommended","Recommended","FraudRisk",null,null,2,2.7,"2.7.1","","2.7.1.7",0,0,"2.7.1.7.4","les données relatives aux transactions et aux commissions font-elles l'objet d'un rapprochement pour détecter les fraudes sur les commissions, comme par exemple la fragmentation des transactions par les agents en vue de générer davantage de commissions ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,2,2.7,"2.7.1",null,"2.7.1.7",null,0,"2.7.1.7.4","¿Se concilian los datos de transacciones y comisiones para detectar el fraude de comisiones, como por ejemplo agentes que fraccionan grandes transacciones en transacciones más pequeñas para cobrar mayores comisiones?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,2,2.7,"2.7.1",null,"2.7.1.7",null,0,"2.7.1.7.4",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"5.3.10.8.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,2,2.7,"2.7.1","","2.7.1.8","2.7.1.8: SANCTIONS FOR AGENTS, BUSINESSES AND MERCHANTS\nSanctions should be applied to agents, businesses or merchants found to be in breach of process or involved in fraud. Examples of sanctions include:\n- Tiered sanctions, increasing in severity upon repetition of offence e.g., suspend account for 1 day/ 1 month/ permanently, or three-strikes-and-out;\n- Termination of agent or reseller status; or\n- Reporting to police for criminal activity.","GSMA RMT","2.7.1.8.1","2.7.1.8.1: Are sanctions applied to agents, businesses, or merchants found to be involved in fraud?\n","1) Fraud management policy (or equivalent documents)\n- Check there is a process to sanction agents, businesses or merchants that are found to be involved in fraud or wrongdoing.\n\n",0,"Urgent Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,2,2.7,"2.7.1","","2.7.1.8","SANCTIONS FOR AGENTS, BUSINESSES AND MERCHANTS\nSanctions should be applied to agents, businesses or merchants found to be in breach of process or involved in fraud. Examples of sanctions include:\n- Tiered sanctions, increasing in severity upon repetition of offence e.g., suspend account for 1 day/ 1 month/ permanently, or three-strikes-and-out;\n- Termination of agent or reseller status; or\n- Reporting to police for criminal activity.","GSMA RMT","2.7.1.8.1","5.3.10.9.1","Are sanctions applied to agents, businesses, or merchants found to be involved in fraud?","1) Fraud management policy (or equivalent documents)\n- Check there is a process to sanction agents, businesses or merchants that are found to be involved in fraud or wrongdoing.\n\n",null,"Urgent Required","Required","FraudRisk",null,null,2,2.7,"2.7.1","","2.7.1.8","SANCTIONS APPLICABLES AUX AGENTS, AUX ENTREPRISES ET AUX COMMERÇANTS \nLes agents, entreprises ou commerçants convaincus d’infraction aux procédures ou impliqués dans des activités frauduleuses doivent faire l’objet de sanctions pouvant inclure : \n- des sanctions progressives, avec sévérité accrue en cas de répétition de l’infraction, par exemple, suspension du compte pendant une journée, un mois puis définitivement ;\n- la résiliation du statut d’agent ou de revendeur ;\n- le signalement à la police en cas d'activités illégales.","GSMA RMT","2.7.1.8.1","des sanctions s'appliquent-elles aux agents, entreprises ou commerçants convaincus d’être impliqués dans des activités frauduleuses ?","1) Politique de gestion de la fraude (ou documents équivalents)\n- Vérifier qu’un processus a été mis en place pour sanctionner les agents, entreprises ou commerçants impliqués des activités frauduleuses ou malhonnêtes.\n\n",null,"Requis Prioritaire","Requis","FraudRisk",0,null,2,2.7,"2.7.1",null,"2.7.1.8","SANCIONES PARA AGENTES, NEGOCIOS Y COMERCIOS\nSe deben aplicar sanciones a los agentes, negocios o comercios cuando se haya comprobado que no cumplieron con el proceso o estuvieron involucrados en fraude. Los ejemplos de sanciones incluyen:\n- Sanciones escalonadas, cuya severidad aumenta con la reincidencia del delito, por ej., cuenta suspendida por 1 día / 1 mes / permanentemente, o 3 casos de reincidencia y desvinculación;\n- Terminación de la condición de agente o revendedor; o\n- Denuncia de la actividad delictiva a la policía.","GSMA RMT","2.7.1.8.1","¿Se aplican sanciones a los agentes, negocios o comercios cuando se haya comprobado que estuvieron involucrados en fraude?","1) Política de gestión de fraude (o documentos equivalentes)\n- Verificar que exista un proceso para sancionar a los agentes, negocios o comercios cuando se haya comprobado que estuvieron involucrados en fraude o delito.",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,2,2.7,"2.7.1",null,"2.7.1.8",null,"GSMA RMT","2.7.1.8.1",null,null,null,"ReqU4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"5.3.10.9.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,2,2.7,"2.7.1","","2.7.1.9","2.7.1.9: ACCOUNT-CHECKING BY AGENTS, BUSINESSES AND MERCHANTS\nProviders should communicate to agents, businesses and merchants the importance of regular checks to ensure the integrity and accuracy of their accounts. This will help detect fraud and reduce the opportunity for fraud. \n\nAgents, businesses and merchants should:\n- reconcile their mobile money account balance with a separate log of transactions to detect any variance between the actual and expected amount;\n- monitor account balances to check for unusual activity.","GSMA RMT","2.7.1.9.1","2.7.1.9.1: Do providers communicate to agents, businesses and merchants the importance of comparing the actual and expected balance of funds in their mobile money account to detect possible fraud?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,2,2.7,"2.7.1","","2.7.1.9","ACCOUNT-CHECKING BY AGENTS, BUSINESSES AND MERCHANTS\nProviders should communicate to agents, businesses and merchants the importance of regular checks to ensure the integrity and accuracy of their accounts. This will help detect fraud and reduce the opportunity for fraud. \n\nAgents, businesses and merchants should:\n- reconcile their mobile money account balance with a separate log of transactions to detect any variance between the actual and expected amount;\n- monitor account balances to check for unusual activity.","GSMA RMT","2.7.1.9.1","5.3.10.10.1","Do providers communicate to agents, businesses and merchants the importance of comparing the actual and expected balance of funds in their mobile money account to detect possible fraud?",null,null,"Recommended","Recommended","FraudRisk",null,null,2,2.7,"2.7.1","","2.7.1.9","CONTRÔLE DES COMPTES PAR LES AGENTS, LES ENTREPRISES ET LES COMMERÇANTS\nLes prestataires doivent communiquer aux agents, aux entreprises et aux commerçants l’importance d’un suivi régulier pour garantir l’intégrité et l’exactitude de leurs comptes. Ce suivi permet de repérer les fraudes et d’en réduire la possibilité. \n\nLes agents, les entreprises et les commerçants doivent :\n- procéder au rapprochement de leur compte d’argent mobile avec un journal de transactions distinct pour détecter toute différence entre les soldes constatés et les soldes attendus ; \n- surveiller les relevés de compte pour repérer toute activité anormale. ","GSMA RMT","2.7.1.9.1","le prestataire communique-t-il aux agents, aux entreprises et aux commerçants l’importance d’un rapprochement régulier des soldes comptables et réels de leur comptes d'argent mobile pour détecter les fraudes éventuelles ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,2,2.7,"2.7.1",null,"2.7.1.9","VERIFICACIÓN DE CUENTAS POR PARTE DE LOS AGENTES, NEGOCIOS Y COMERCIOS\nLos proveedores deben comunicar a los agentes, negocios y comercios la importancia de realizar verificaciones periódicas para garantizar la integridad y precisión de sus cuentas. Esto ayudará a detectar fraude y reducir las oportunidades de fraude. \n\nLos agentes, negocios y comercios deben:\n- conciliar el saldo de su cuenta del dinero móvil con una registro de transacciones por separado para detectar cualquier diferencia entre el monto real y esperado;\n- monitorear los saldos de las cuentas para verificar actividades inusuales.","GSMA RMT","2.7.1.9.1","¿Los proveedores comunican a los agentes, negocios y comercios la importancia de comparar el saldo real y esperado de los fondos en sus cuentas del dinero móvil para detectar un posible fraude?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,2,2.7,"2.7.1",null,"2.7.1.9",null,"GSMA RMT","2.7.1.9.1",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"5.3.10.10.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,2,2.7,"2.7.1","","2.7.1.10","2.7.1.10: INFORMATION-SHARING WITH OTHER PROVIDERS\nAn information-sharing process or forum should be set up to enable a country's mobile money providers to share information about known frauds and counter-measures.\n\nWhere possible, providers should share details of agents, businesses and merchants (and their directors) that have been found to have engaged in fraud.\n\nNote: GSMA also hosts a Fraud and Risk working group, where best practice is shared and discussed.","GSMA RMT","2.7.1.10.1","2.7.1.10.1: Is there an information-sharing process or forum to enable a country's mobile money providers to share information about known frauds and counter-measures?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,2,2.7,"2.7.1","","2.7.1.10","INFORMATION-SHARING WITH OTHER PROVIDERS\nAn information-sharing process or forum should be set up to enable a country's mobile money providers to share information about known frauds and counter-measures.\n\nWhere possible, providers should share details of agents, businesses and merchants (and their directors) that have been found to have engaged in fraud.\n\nNote: GSMA also hosts a Fraud and Risk working group, where best practice is shared and discussed.","GSMA RMT","2.7.1.10.1","5.3.10.11.1","Is there an information-sharing process or forum to enable a country's mobile money providers to share information about known frauds and counter-measures?",null,null,"Recommended","Recommended","FraudRisk",null,null,2,2.7,"2.7.1","","2.7.1.10","PARTAGE D’INFORMATIONS AVEC D’AUTRES PRESTATAIRES\nUn processus ou forum de partage des informations doit être mis en place pour permettre aux prestataires d’argent mobile du pays d’échanger leurs informations relatives aux fraudes connues et aux mesures de prévention. \n\nDans la mesure du possible, les prestataires doivent partager les renseignements relatifs aux agents, entreprises et commerçants (et leurs dirigeants) ayant été convaincus de participer à des activités frauduleuses.\n\nRemarque : la GSMA organise également un groupe de travail sur la fraude et le risque ayant pour but de partager et de discuter des meilleures pratiques en la matière.","GSMA RMT","2.7.1.10.1","existe-t-il un processus ou forum de partage des informations permettant aux prestataires d’argent mobile du pays d’échanger leurs informations relatives aux fraudes connues et aux mesures de prévention ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,2,2.7,"2.7.1",null,"2.7.1.10","INTERCAMBIO DE INFORMACIÓN CON OTROS PROVEEDORES\nSe debe establecer un proceso o foro de intercambio de información para permitir que los proveedores del dinero móvil de un país compartan información acerca de los fraudes conocidos y las contramedidas.\n\nCuando sea posible, los proveedores deben compartir los detalles de los agentes, negocios y comercios (y sus directores) cuando se haya comprobado que estuvieron involucrados en fraude.\n\nNota: GSMA también auspicia un grupo de trabajo sobre Fraude y Riesgos, donde se comparten y analizan las mejores prácticas.","GSMA RMT","2.7.1.10.1","¿Existe un proceso o foro de intercambio de información para permitir que los proveedores del dinero móvil de un país compartan información acerca de los fraudes conocidos y las contramedidas?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,2,2.7,"2.7.1",null,"2.7.1.10",null,"GSMA RMT","2.7.1.10.1",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"5.3.10.11.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,2,2.7,"2.7.1","","2.7.1.11","2.7.1.11: PROTECT AT-RISK ACCOUNTS AND TRANSACTIONS\nCertain types of accounts have been targeted by fraudsters (often internal fraud), and measures should be implemented to protect these accounts. Types of at-risk accounts include:\n- Provider's airtime collection account;\n- High-value accounts such as business accounts;\n- E-money collection/disbursement accounts;\n- Abandoned accounts e.g. the customer closes the mobile phone account but not the mobile money account; the customer forgets about the account; or the customer dies.\n\nIt is recommended that more secure handsets are used for higher-risk accounts, such as agent, business and merchant accounts. For example, STK-based or smartphone terminals instead of USSD-based handsets.\n\nBulk payment transactions are another source of fraud and measures should be taken to secure these transactions. For example the use of maker-checker.\n","GSMA RMT","2.7.1.11.1","2.7.1.11.1: Have measures been implemented to protect at-risk accounts from internal fraud, such as the airtime collection account, e-money disbursement/collection accounts, high-value accounts and abandoned accounts?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,2,2.7,"2.7.1","","2.7.1.11","PROTECT AT-RISK ACCOUNTS AND TRANSACTIONS\nCertain types of accounts have been targeted by fraudsters (often internal fraud), and measures should be implemented to protect these accounts. Types of at-risk accounts include:\n- Provider's airtime collection account;\n- High-value accounts such as business accounts;\n- E-money collection/disbursement accounts;\n- Abandoned accounts e.g. the customer closes the mobile phone account but not the mobile money account; the customer forgets about the account; or the customer dies.\n\nIt is recommended that more secure handsets are used for higher-risk accounts, such as agent, business and merchant accounts. For example, STK-based or smartphone terminals instead of USSD-based handsets.\n\nBulk payment transactions are another source of fraud and measures should be taken to secure these transactions. For example the use of maker-checker.\n","GSMA RMT","2.7.1.11.1","5.3.10.12.1","Have measures been implemented to protect at-risk accounts from internal fraud, such as the airtime collection account, e-money disbursement/collection accounts, high-value accounts and abandoned accounts?",null,null,"Recommended","Recommended","FraudRisk",null,null,2,2.7,"2.7.1","","2.7.1.11","PROTECTION DES COMPTES À RISQUE\nCertains types de comptes sont plus exposés au risque de fraude (souvent en interne) et doivent faire l’objet de mesures spécifiques de protection. Les comptes à risque comprennent :\n- les comptes d'accumulation de crédit des prestataires ;\n- les comptes à valeur élevée, comme par exemple les comptes d'entreprise ;\n- les comptes d'encaissement/de décaissement d'argent électronique ;\n- les comptes abandonnés, lorsque par exemple le client clôture son compte téléphonique mais pas le compte d’argent mobile, qu’il en oublie l’existence ou qu’il décède.\n \nIl est recommandé d'utiliser des téléphones plus sécurisés pour les comptes présentant un risque plus élevé, tels que les comptes agents, clients professionnels et commerçants, par exemple, des terminaux basés sur le STK ou des smartphones au lieu de téléphones basés sur l’USSD.\n\nLes transactions de paiement groupés sont une autre source de fraude et des mesures doivent être prises pour sécuriser ces transactions, par exemple, en utilisant un processus d'exécution/validation,","GSMA RMT","2.7.1.11.1","des mesures spécifiques sont-elles en place pour protéger les comptes exposés au risque de fraude interne, tels que les comptes d'accumulation de crédit des prestataires, les comptes à valeur élevée, les comptes d'encaissement/de décaissement d'argent électronique et les comptes abandonnés ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,2,2.7,"2.7.1",null,"2.7.1.11","PROTECCIÓN DE CUENTAS Y TRANSACCIONES EN RIESGO\nCiertos tipos cuentas han sido el objetivo de los defraudadores (generalmente fraude interno), y se deben implementar medidas para proteger estas cuentas. Los tipos de cuentas en riesgo incluyen:\n- La cuenta de cobro de tiempo aire del proveedor;\n- Las cuentas de alto monto, como las cuentas comerciales;\n- Las cuentas de cobro/desembolso de dinero móvil;\n- Las cuentas abandonadas, por ej., cuando el cliente cierra la cuenta del teléfono móvil pero no la cuenta del dinero móvil; cuando el cliente se olvida de la cuenta; o en caso de fallecimiento del cliente.\n\nSe recomienda la utilización de dispositivos más seguros para cuentas de alto riesgo, como las cuentas de los agentes, negocios y comercios. Por ejemplo, usar terminales basados en STK o smartphones en lugar de dispositivos basados en USSD.\n\nOtra fuente de fraude son las transacciones de pagos globales y se deben tomar medidas para asegurar estas transacciones. Por ejemplo el uso de ejecutor-verificador.","GSMA RMT","2.7.1.11.1","¿Se implementaron medidas para proteger las cuentas en riesgo contra el fraude interno, como la cuenta de cobro de tiempo aire, las cuentas de desembolso/cobro del dinero móvil, las cuentas de alto monto y las cuentas abandonadas?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,2,2.7,"2.7.1",null,"2.7.1.11",null,"GSMA RMT","2.7.1.11.1",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"5.3.10.12.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,2,2.7,"2.7.1",null,"2.7.1.11",null,null,null,"2.7.1.11.2: Are more secure handsets are used for higher-risk accounts, such as agent, business and merchant accounts? \n(For example, STK-based or smartphone terminals instead of USSD-based handsets.)\n",0,{"$f":"CHOOSE(LanguageNumber,BG119,BW119,CM119,DG119)","v":0},{"$f":"CHOOSE(LanguageNumber,BH119,BX119,CN119,DD119)","v":"Recommended"},{"$f":"CHOOSE(LanguageNumber,BI119,BY119,CO119,DE119)","v":"Recommended"},"FraudRisk",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,2,2.7,"2.7.1",null,"2.7.1.11",null,null,"2.7.1.11.2",0,"Are more secure handsets are used for higher-risk accounts, such as agent, business and merchant accounts? \n(For example, STK-based or smartphone terminals instead of USSD-based handsets.)",null,null,"Recommended","Recommended","FraudRisk",null,null,2,2.7,"2.7.1",null,"2.7.1.11",null,null,"2.7.1.11.2","Des téléphones plus sécurisés sont-ils utilisés pour les comptes présentant un risque plus élevé, tels que les comptes agents, clients professionnels et commerçants ? \n(Par exemple, des terminaux basés sur le STK ou des smartphones au lieu de téléphones basés sur l’USSD)",null,null,"Recommandé","Recommandé","FraudRisk",null,null,2,2.7,"2.7.1",null,"2.7.1.11",null,null,"2.7.1.11.2","¿Se utilizan dispositivos más seguros para cuentas de alto riesgo, como las cuentas de los agentes, negocios y comercios? \n(Por ejemplo, usar terminales basados en STK o smartphones en lugar de dispositivos basados en USSD).",null,null,"Recomendado","Recomendado","FraudRisk",null,null,2,2.7,"2.7.1",null,"2.7.1.11",null,null,"2.7.1.11.2",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,"NEW"]
[null,2,2.7,"2.7.1",null,"2.7.1.11",null,null,{"$f":"BC120","v":"2.7.1.11.3"},"2.7.1.11.3: Have measures been implemented to secure bulk payment transactions, for example with the use of maker-checker?\n",0,0,"Recommended","Recommended","FraudRisk",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,2,2.7,"2.7.1",null,"2.7.1.11",null,null,"2.7.1.11.3",0,"Have measures been implemented to secure bulk payment transactions, for example with the use of maker-checker?",null,null,"Recommended","Recommended","FraudRisk",null,null,2,2.7,"2.7.1",null,"2.7.1.11",null,null,"2.7.1.11.3","Des mesures ont-elles été mises en place pour sécuriser les transactions de paiements groupés, par exemple en utilisant un processus d’exécution/validation ?",null,null,"Recommandé","Recommandé","FraudRisk",null,null,2,2.7,"2.7.1",null,"2.7.1.11",null,null,"2.7.1.11.3","¿Se implementaron medidas para asegurar las transacciones de pagos globales, por ejemplo el uso de ejecutor-verificador?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,2,2.7,"2.7.1",null,"2.7.1.11",null,null,"2.7.1.11.3",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,"NEW"]
[null,2,2.7,"2.7.1","","2.7.1.12","2.7.1.12: IDENTITY THEFT PROTECTION\nCustomer name validation is implemented by some operators to reduce reversals by presenting the recipient's name to the sender. However, this could be abused by fraudsters to steal customers' identities.\n\nProviders should implement measures to reduce the risk of identity theft using the customer name validation functionality. For example, providers could:\n- restrict the number of times that customer name validation can be initiated and cancelled per day; or \n- restrict customer name validation only to names from the customer's list of contacts.",{"$f":"BB121","v":"GSMA RMT"},{"$f":"BC121","v":"2.7.1.12.1"},"2.7.1.12.1: Have providers implemented controls to limit the risk of customer name validation functionality being used for identity theft?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,2,2.7,"2.7.1","","2.7.1.12","IDENTITY THEFT PROTECTION\nCustomer name validation is implemented by some operators to reduce reversals by presenting the recipient's name to the sender. However, this could be abused by fraudsters to steal customers' identities.\n\nProviders should implement measures to reduce the risk of identity theft using the customer name validation functionality. For example, providers could:\n- restrict the number of times that customer name validation can be initiated and cancelled per day; or \n- restrict customer name validation only to names from the customer's list of contacts.","GSMA RMT","2.7.1.12.1","5.3.10.13.1","Have providers implemented controls to limit the risk of customer name validation functionality being used for identity theft?",null,null,"Recommended","Recommended","FraudRisk",null,null,2,2.7,"2.7.1","","2.7.1.12","PROTECTION CONTRE LE VOL D’IDENTITÉ\nLa validation du nom des clients est utilisée par certains opérateurs pour réduire le nombre d’annulations en affichant le nom du bénéficiaire au donneur d’ordre. Cette mesure peut toutefois permettre aux fraudeurs de voler l’identité des clients. \n\nLes prestataires doivent donc mettre en place des mesures visant à réduire ce risque. Ils peuvent par exemple :\n- limiter le nombre de fois que la validation du nom d’un client puisse être initiée et annulée dans une journée ; \n- limiter la fonctionnalité de validation du nom à la liste des contacts du client.","GSMA RMT","2.7.1.12.1","existe-t-il des mesures de contrôle pour réduire le risque que la fonctionnalité de validation du nom des clients soit utilisée à des fins d'usurpation d'identité ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,2,2.7,"2.7.1",null,"2.7.1.12","PROTECCIÓN CONTRA EL ROBO DE IDENTIDAD\nAlgunos operadores implementan la validación del nombre del cliente para reducir reversiones al presentar el nombre del receptor al remitente. No obstante, los defraudadores podrían usar esto para robar las identidades de los clientes.\n\nLos proveedores deben implementar medidas para reducir el riesgo de robo de identidad usando la funcionalidad de validación del nombre del cliente. Por ejemplo, los proveedores podrían:\n- restringir la cantidad de veces que se puede iniciar y cancelar cada día la validación del nombre del cliente; o \n- restringir la validación del nombre del cliente solo a los nombres de la lista de contactos del cliente.","GSMA RMT","2.7.1.12.1","¿Los proveedores implementaron controles para limitar el riesgo de que la funcionalidad de validación del nombre del cliente sea utilizada para el robo de identidad?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,2,2.7,"2.7.1",null,"2.7.1.12",null,"GSMA RMT","2.7.1.12.1",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"5.3.10.13.1",null,null,null,{"$f":"IF(OR($EA121=0,$EA121=2),VLOOKUP(DO121,INDIRECT(ED121),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP121),\"\",VLOOKUP(DP121,INDIRECT(EE121),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ121),\"\",VLOOKUP(DQ121,INDIRECT(EF121),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR121),\"\",VLOOKUP(DR121,INDIRECT(EG121),7,FALSE))","v":""},{"$f":"IF(OR($EA121=0,$EA121=2),VLOOKUP(DO121,INDIRECT(ED121),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP121),\"\",VLOOKUP(DP121,INDIRECT(EE121),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ121),\"\",VLOOKUP(DQ121,INDIRECT(EF121),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR121),\"\",VLOOKUP(DR121,INDIRECT(EG121),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN121,3)=\"NEW\")+2*AND(LEFT(DN121,3)=\"MER\")+3*AND(LEFT(DN121,3)=\"MOV\")+4*AND(LEFT(DN121,3)=\"SWA\")","v":0},{"$f":"IF(EA121=0,DS121,EN121)","v":{"$error":"#REF!"}},{"$f":"IF(EA121=0,IF(DW121=0,\"\",DW121),CHOOSE(EA121,\"New indicator\",CONCATENATE(DW121,CarriageReturn,DX121,CarriageReturn,DY121,CarriageReturn,DZ121)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO121,1)","v":"OriginalComplianceP5"},{"$f":"\"OriginalComplianceP\"&LEFT(DP121,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ121,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR121,1)","v":"OriginalComplianceP"},{"$f":"COUNTIF($DS121:$DV121,EH$3)","v":0},0,0,0,0,{"$f":"COUNTIF($DO121:$DR121,\"*?\")","v":1},{"$f":"IF(OR(AND(EH121>0,SUM(EI121:EL121)>0),EK121>0),\"Partial\",IF(EH121=EM121,\"Yes\",IF(EI121=EM121,\"No\",IF(EJ121=EM121,\"N/A\",IF(EK121=EM121,\"Partial\",IF(EL121=EM121,\"\",\"\"))))))","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,null,null,null,null,".",".",".",".",".",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,null,null,null,null,null,null,null,null,0,null,null,null,null,null,null,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0]

{"sheet":"3","index":4,"n_rows":89,"n_cols":144,"rows_kept":89,"cut":false,"hidden":false,"merged":[[77,69,79,69],[77,70,79,70],[77,85,79,85],[77,86,79,86],[77,101,79,101],[77,102,79,102],[61,70,62,70],[63,70,65,70],[43,67,47,67],[43,70,47,70],[48,70,51,70],[58,70,60,70],[55,70,56,70],[52,99,53,99],[55,99,56,99],[55,101,56,101],[55,102,56,102],[73,102,76,102],[58,101,60,101],[61,101,62,101],[61,102,62,102],[63,101,65,101],[63,102,65,102],[66,101,68,101],[4,4,8,4],[9,6,10,6],[12,6,18,6],[19,6,22,6],[9,52,10,52],[9,53,10,53],[12,52,18,52],[32,50,33,50],[19,53,22,53],[23,52,24,52],[23,53,24,53],[19,52,22,52],[32,4,33,4],[25,52,30,52],[26,53,28,53],[29,53,30,53],[4,52,8,52],[4,53,8,53],[4,6,8,6],[25,6,30,6],[23,6,24,6],[4,50,8,50],[12,53,18,53],[82,6,86,6],[70,6,72,6],[73,6,76,6],[66,6,68,6],[58,6,60,6],[61,6,62,6],[63,6,65,6],[48,6,51,6],[77,6,79,6],[43,4,47,4],[43,6,47,6],[37,4,38,4],[63,69,65,69],[70,52,72,52],[70,53,72,53],[33,6,35,6],[37,50,38,50],[52,4,53,4],[52,50,53,50],[52,67,53,67],[55,4,56,4],[55,6,56,6],[55,50,56,50],[55,52,56,52],[55,53,56,53],[55,67,56,67],[55,69,56,69],[33,52,35,52],[34,53,35,53],[38,53,39,53],[38,52,40,52],[43,50,47,50],[43,52,47,52],[82,52,86,52],[82,53,86,53],[82,69,86,69],[73,52,76,52],[73,53,76,53],[43,53,47,53],[48,52,51,52],[48,53,51,53],[61,53,62,53],[63,52,65,52],[58,68,60,68],[48,69,51,69],[63,53,65,53],[58,53,60,53],[58,69,60,69],[70,69,72,69],[73,69,76,69],[43,69,47,69],[66,52,68,52],[66,53,68,53],[58,52,60,52],[61,52,62,52],[66,69,68,69],[77,52,79,52],[82,70,86,70],[34,86,35,86],[37,83,38,83],[38,86,39,86],[43,85,47,85],[43,86,47,86],[48,85,51,85],[48,86,51,86],[61,85,62,85],[61,86,62,86],[66,86,68,86],[70,85,72,85],[43,83,47,83],[58,84,60,84],[52,83,53,83],[55,83,56,83],[55,85,56,85],[55,86,56,86],[82,85,86,85],[82,86,86,86],[73,70,76,70],[66,70,68,70],[70,70,72,70],[73,86,76,86],[66,102,68,102],[70,101,72,101],[70,102,72,102],[58,102,60,102],[73,101,76,101],[82,101,86,101],[82,102,86,102],[78,90,79,90],[73,85,76,85],[63,85,65,85],[63,86,65,86],[66,85,68,85],[70,86,72,86],[38,101,40,101],[33,101,35,101],[58,100,60,100],[32,99,33,99],[58,85,60,85],[58,86,60,86],[34,102,35,102],[43,99,47,99],[43,101,47,101],[43,102,47,102],[48,101,51,101],[48,102,51,102],[37,99,38,99],[38,102,39,102],[4,99,8,99],[5,102,8,102],[19,102,22,102],[26,102,28,102],[23,85,24,85],[23,86,24,86],[12,85,18,85],[12,86,18,86],[19,85,22,85],[19,86,22,86],[25,101,30,101],[26,86,28,86],[29,86,30,86],[9,101,10,101],[9,102,10,102],[12,101,18,101],[12,102,18,102],[29,102,30,102],[23,101,24,101],[23,102,24,102],[19,101,22,101],[4,101,8,101],[25,85,30,85],[38,6,40,6],[4,67,8,67],[12,69,18,69],[19,69,22,69],[23,69,24,69],[32,67,33,67],[9,69,10,69],[25,69,30,69],[38,69,40,69],[33,69,35,69],[37,67,38,67],[4,69,8,69],[3,88,3,90],[61,69,62,69],[4,83,8,83],[5,86,8,86],[9,85,10,85],[9,86,10,86],[32,83,33,83],[9,70,10,70],[34,70,35,70],[38,70,39,70],[33,85,35,85],[12,70,18,70],[5,70,8,70],[4,85,8,85],[19,70,22,70],[23,70,24,70],[26,70,28,70],[29,70,30,70],[38,85,40,85]]}
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,"x",null,null,null,null,"x",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"x"]
[null,null,null,null,null,null,{"$f":"UPPER(Introduction!B14)","v":"3. PEOPLE:  MANAGE STAFF, AGENTS, AND THIRD PARTIES"},null,null,null,null,null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,Drivers!K18,Drivers!L18,Drivers!M18,Drivers!N18)","v":"SELF-ASSESSMENT"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,Drivers!K34,Drivers!L34,Drivers!M34,Drivers!N34)","v":"EXTERNAL ASSESSMENT"},null,null,null,null,null,"SCHEME OPERATOR REVIEW",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null," ",null,null,null,null,null,16,null,17,null,null,3,null,null,4,5,6,9,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Change types: NEW, MERGE, MOVE, SWAP","Don't edit the Indicator ID",null,null,null,"*** Don't edit any cell from AB and onwards *** Ignore #NAME errors; these will disappear during migration",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Counts for computed Compliance calc"]
[null,{"$f":"CHOOSE(LanguageNumber,AV3,BM3,CC3,CS3)","v":"Principle"},"Sub-principle","Sub-sub-principle","Sub-sub-principle ","Practice ID","Practice","Practice data source","Indicator ID",{"$f":"CHOOSE(LanguageNumber,BE3,BU3,CK3,DA3)","v":"Indicator"},"Evidence required","[SPARE]","Detailed indicator category","Indicator category","Function","[SPARE]",{"$f":"CHOOSE(LanguageNumber,Drivers!K19,Drivers!L19,Drivers!M19,Drivers!N19)","v":"Compliance"},{"$f":"CHOOSE(LanguageNumber,Drivers!K20,Drivers!L20,Drivers!M20,Drivers!N20)","v":"Evidence document (specify document name, section number and page number)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K21,Drivers!L21,Drivers!M21,Drivers!N21)","v":"Comments \n(include notes on how the practice is implemented)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K22,Drivers!L22,Drivers!M22,Drivers!N22)","v":"Action"},{"$f":"CHOOSE(LanguageNumber,Drivers!K23,Drivers!L23,Drivers!M23,Drivers!N23)","v":"Reviewer name"},{"$f":"CHOOSE(LanguageNumber,Drivers!K24,Drivers!L24,Drivers!M24,Drivers!N24)","v":"Evidence sent to Assessor?"},{"$f":"CHOOSE(LanguageNumber,Drivers!K25,Drivers!L25,Drivers!M25,Drivers!N25)","v":"Spare 2"},{"$f":"CHOOSE(LanguageNumber,Drivers!K26,Drivers!L26,Drivers!M26,Drivers!N26)","v":"Spare 3"},{"$f":"CHOOSE(LanguageNumber,Drivers!K27,Drivers!L27,Drivers!M27,Drivers!N27)","v":"Spare 4"},{"$f":"CHOOSE(LanguageNumber,Drivers!K28,Drivers!L28,Drivers!M28,Drivers!N28)","v":"Spare 5"},{"$f":"CHOOSE(LanguageNumber,Drivers!K29,Drivers!L29,Drivers!M29,Drivers!N29)","v":"Spare 6"},{"$f":"CHOOSE(LanguageNumber,Drivers!K30,Drivers!L30,Drivers!M30,Drivers!N30)","v":"Spare 7"},{"$f":"CHOOSE(LanguageNumber,Drivers!K31,Drivers!L31,Drivers!M31,Drivers!N31)","v":"Spare 8"},{"$f":"CHOOSE(LanguageNumber,Drivers!K32,Drivers!L32,Drivers!M32,Drivers!N32)","v":"Spare 9"},{"$f":"CHOOSE(LanguageNumber,Drivers!K33,Drivers!L33,Drivers!M33,Drivers!N33)","v":"Spare 10"},{"$f":"CHOOSE(LanguageNumber,Drivers!K35,Drivers!L35,Drivers!M35,Drivers!N35)","v":"Compliance"},{"$f":"CHOOSE(LanguageNumber,Drivers!K36,Drivers!L36,Drivers!M36,Drivers!N36)","v":"Evidence document (specify document name, section number and page number)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K37,Drivers!L37,Drivers!M37,Drivers!N37)","v":"Comments \n(include notes on how the practice is implemented)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K38,Drivers!L38,Drivers!M38,Drivers!N38)","v":"Recommendation to Provider"},{"$f":"CHOOSE(LanguageNumber,Drivers!K39,Drivers!L39,Drivers!M39,Drivers!N39)","v":"Reviewer name"},{"$f":"CHOOSE(LanguageNumber,Drivers!K40,Drivers!L40,Drivers!M40,Drivers!N40)","v":"Guidance notes for Assessor"},{"$f":"CHOOSE(LanguageNumber,Drivers!K41,Drivers!L41,Drivers!M41,Drivers!N41)","v":"Scheme Operator comments"},{"$f":"CHOOSE(LanguageNumber,Drivers!K42,Drivers!L42,Drivers!M42,Drivers!N42)","v":"Assessor's response to Scheme Operator"},{"$f":"CHOOSE(LanguageNumber,Drivers!K43,Drivers!L43,Drivers!M43,Drivers!N43)","v":"Scheme Operator conclusion"},{"$f":"CHOOSE(LanguageNumber,Drivers!K44,Drivers!L44,Drivers!M44,Drivers!N44)","v":"Spare 15"},{"$f":"CHOOSE(LanguageNumber,Drivers!K45,Drivers!L45,Drivers!M45,Drivers!N45)","v":"Spare 16"},{"$f":"CHOOSE(LanguageNumber,Drivers!K46,Drivers!L46,Drivers!M46,Drivers!N46)","v":"Spare 17"},{"$f":"CHOOSE(LanguageNumber,Drivers!K47,Drivers!L47,Drivers!M47,Drivers!N47)","v":"Spare 18"},{"$f":"CHOOSE(LanguageNumber,Drivers!K48,Drivers!L48,Drivers!M48,Drivers!N48)","v":"Spare 19"},{"$f":"CHOOSE(LanguageNumber,Drivers!K49,Drivers!L49,Drivers!M49,Drivers!N49)","v":"Spare 20"},null,"Principle","Sub-principle","Sub-sub-principle","Sub-sub-principle ","Practice ID","Practice","Practice data source","Indicator ID","ORIGINAL ID","Indicator","Evidence required","[SPARE]","Detailed indicator category","Indicator category","Function","[SPARE]",null,"Principe","Sous-principe","Sous-sous-principe","Description du sous-sous-principe","Pratique ID","Pratique","Source de données pratique","Indicateur ID","Indicateur","Documents généralement requis","[SPARE]","Catégorie détaillée d’indicateur","Catégorie d’indicateur","Fonction","[SPARE]",null,"Principio","Sub-principio","Sub-sub-principio","Sub-sub-principio","Nro. de Práctica","Práctica","Origen de datos de Práctica","Nro. de Indicador","Indicador","Documentación obligatoria","[SPARE]","Categoría indicador detallada","Categoría de Indicador","Función","[SPARE]",null,"Principle","Sub-principle","Sub-sub-principle","Sub-sub-principle Description","Practice","Practice","Practice data source","Indicator","Indicator","Evidence required","[SPARE]","Detailed indicator category","Indicator category","Function","[SPARE]",null,null,null,null,null,null,"Change type","Original Indicator ID","Merged indicator #1","Merged indicator #2","Merged indicator #3","v1 Compliance rating Original Indicator ID","v1 Compliance rating Merged indicator #1","v1 Compliance rating Merged indicator #2","v1 Compliance rating Merged indicator #3","v1 Comment Original Indicator ID","v1 Comment Merged indicator #1  ","v1 Comment Merged indicator #2","v1 Comment Merged indicator #3","v2 Computed change type","v2 Computed compliance rating","v2 Computed comment","rangename1","rangename2","rangename3","rangename4","Yes","No","N/A","Partial","No Response","how many","calc"]
[null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!C14,\": \",Introduction!D14))","v":"3.1: DUE DILIGENCE POLICIES AND PROCEDURES"},null,null,null,null,{"$f":"Introduction!E14","v":"Providers shall conduct proper due diligence on potential staff, agents and entities providing outsourced services"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$14,\": \",Introduction!$L$14))","v":"3.1: DUE DILIGENCE POLICIES AND PROCEDURES"},null,null,null,null,null,{"$f":"Introduction!$M$14","v":"Providers shall conduct proper due diligence on potential staff, agents and entities providing outsourced services"},null,null,null,null,null,null,null,0,0,0,null,null,null,null,null,null,null,null,null,null,null,null,null,0,0,0,{"$f":"UPPER(CONCATENATE(Introduction!$U$14,\": \",Introduction!$V$14))","v":"3.1: POLÍTICAS Y PROCEDIMIENTOS DE DEBIDA DILIGENCIA"},null,null,0,null,{"$f":"Introduction!W14","v":"El proveedor tomará los recaudos de debida diligencia apropiados sobre personal, agentes y entidades subcontratadas potenciales."},null,null,null,null,null,null,null,0,0,0,null,0,null,0]
[null,{"$f":"$AV5","v":"3"},{"$f":"$AW5","v":"3.1"},{"$f":"$AX5","v":"3.1.1"},{"$f":"CHOOSE(LanguageNumber,AY5,BP5,CF5,CV5)","v":"3.1.1: Providers shall conduct proper due diligence on potential staff, agents and entities providing outsourced services"},{"$f":"AZ5","v":"3.1.1.1"},{"$f":"AZ5&\": \"&CHOOSE(LanguageNumber,BA5,BR5,CH5,CX5)","v":"3.1.1.1: STAFF DUE DILIGENCE PROCESS\nDue diligence should be carried out on all mobile money staff before their employment and regularly thereafter, as determined by risk assessment.\n\nIdentification data should be obtained for all staff (full name, address, date of birth). A risk assessment should determine whether further due diligence is reuqired, which could include the following, for example:\n- employment history;\n- reference checks;\n- criminal record check;\n- watchlist screening (using domestic and international money laundering, terrorist financing, and sanctions watchlists). \n\nThe risk assessment may determine that additional due diligence should be carried out on higher-risk roles; for example the following:\n- Finance team\n- AML/Fraud team\n- Privileged account holders (super users or account creation roles)\n- The head of mobile money and managers of key functions\n\nThe staff due diligence process should be regularly reviewed and updated as needed, such as when changes are made to the service or regulation. "},{"$f":"BB5","v":"GSMA RMT"},{"$f":"BC5","v":"3.1.1.1.1"},{"$f":"BC5&\": \"&CHOOSE(LanguageNumber,BE5,BU5,CK5,DA5)&CarriageReturn","v":"3.1.1.1.1: Is there a documented staff due diligence process, and is it regularly reviewed and updated as needed?\n"},{"$f":"CHOOSE(LanguageNumber,BF5,BV5,CL5,DB5)","v":"1) Staff due diligence process\n-Check that that process is documented\n-Check that the document includes a revision history\n-Check that that document has been reviewed within the last 24 months"},0,{"$f":"CHOOSE(LanguageNumber,BH5,BX5,CN5,DD5)","v":"Urgent Required"},"Required","HR",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.1","3.1.1","3.1.1: Providers shall conduct proper due diligence on potential staff, agents and entities providing outsourced services","3.1.1.1","STAFF DUE DILIGENCE PROCESS\nDue diligence should be carried out on all mobile money staff before their employment and regularly thereafter, as determined by risk assessment.\n\nIdentification data should be obtained for all staff (full name, address, date of birth). A risk assessment should determine whether further due diligence is reuqired, which could include the following, for example:\n- employment history;\n- reference checks;\n- criminal record check;\n- watchlist screening (using domestic and international money laundering, terrorist financing, and sanctions watchlists). \n\nThe risk assessment may determine that additional due diligence should be carried out on higher-risk roles; for example the following:\n- Finance team\n- AML/Fraud team\n- Privileged account holders (super users or account creation roles)\n- The head of mobile money and managers of key functions\n\nThe staff due diligence process should be regularly reviewed and updated as needed, such as when changes are made to the service or regulation. ","GSMA RMT","3.1.1.1.1",{"$f":"DO5","v":"3.1.1.1.1"},"Is there a documented staff due diligence process, and is it regularly reviewed and updated as needed?","1) Staff due diligence process\n-Check that that process is documented\n-Check that the document includes a revision history\n-Check that that document has been reviewed within the last 24 months",null,"Urgent Required","Required",{"$f":"$O5","v":"HR"},null,null,{"$f":"$AV5","v":"3"},{"$f":"$AW5","v":"3.1"},{"$f":"$AX5","v":"3.1.1"},"3.1.1: Les prestataires doivent exercer une vigilance appropriée à l'égard de leur personnel, de leurs agents et des entités assurant des services de sous-traitance.",{"$f":"$AZ5","v":"3.1.1.1"},"PROCESSUS DE VIGILANCE À L'ÉGARD DU PERSONNEL\nDes contrôles de vigilance doivent être effectués pour l’ensemble du personnel de l’activité d’argent mobile avant leur embauche et régulièrement par la suite, ce en fonction de l'évaluation des risques.\n\nCes vérifications doivent concerner au minimum les renseignements d’identité des salariés (nom complet, adresse, date de naissance). Une évaluation des risques doit déterminer si des contrôles supplémentaires sont nécessaires, pouvant inclure par exemple:\n- l'historique d’emploi ;\n- les références ;\n- le casier judiciaire.\n- les listes de surveillance (à l'aide des listes nationales et internationales de sanctions et de surveillance du blanchiment de capitaux et du financement du terrorisme), \n\nL'évaluation des risques peut déterminer que des contrôles de vigilances supplémentaires sont requis pour les postes à plus haut risque, parmi lesquels :\n-Équipe financière\n-Équipe AML/Fraude\n-Titulaires de comptes privilégiés (super-utilisateurs ou fonctions chargées de la création de compte)\n-Direction de l'argent mobile et responsables de fonctions clés\n\nCe processus de vigilance à l’égard du personnel doit être régulièrement examiné et mis à jour au besoin, notamment en cas de changement dans le service ou la réglementation. \n",{"$f":"$BB5","v":"GSMA RMT"},{"$f":"$BC5","v":"3.1.1.1.1"},"Existe-t-il un processus documenté de vérification du personnel, et est-il régulièrement revu et mis à jour au besoin ?","1) Processus de vigilance à l’égard du personnel\n-Vérifier que ce processus est documenté\n- Vérifier que le document inclut un historique des révisions\n- Vérifier que ce document a fait l’objet d’une révision au cours des 24 derniers mois",null,{"$f":"VLOOKUP($BH5,CategoryTranslationTable,2,FALSE)","v":"Requis Prioritaire"},{"$f":"VLOOKUP($BI5,CategoryTranslationTable,2,FALSE)","v":"Requis"},{"$f":"$O5","v":"HR"},0,null,{"$f":"$AV5","v":"3"},{"$f":"$AW5","v":"3.1"},{"$f":"$AX5","v":"3.1.1"},"3.1.1: Los proveedores deben llevar a cabo una debida diligencia de los posibles empleados, agentes y entidades que prestan servicios tercerizados",{"$f":"$AZ5","v":"3.1.1.1"},"PROCESO DE DEBIDA DILIGENCIA DEL PERSONAL\nSe debe llevar a cabo la debida diligencia de todo el personal del dinero móvil antes de su contratación y con regularidad posteriormente, según lo determine la evaluación de riesgos.\n\nSe deben obtener los datos de identificación de todo el personal (nombre completo, domicilio, fecha de nacimiento). Una evaluación de riesgos debe determinar si se requiere una mayor debida diligencia, que podría incluir, por ejemplo:\n- antecedentes laborales;\n- verificación de referencias;\n- verificación de antecedentes penales;\n- análisis de las listas de control (utilizando las listas de control nacionales e internacionales de lavado de activos, financiamiento del terrorismo y sanciones). \n\nLa evaluación de riesgos puede determinar si se debe llevar a cabo una debida diligencia adicional sobre los roles de alto riesgo, por ejemplo:\n- Equipo de finanzas\n- Equipo ALA/Fraude\n- Titulares de cuentas privilegiadas (súper usuarios o roles de creación de cuentas)\n- El jefe del dinero móvil y los gerentes de las funciones clave\n\nEl proceso de debida diligencia del personal debe ser revisado regularmente y actualizado, según sea necesario, por ejemplo cuando se realizan cambios al servicio o a la regulación. ",{"$f":"$BB5","v":"GSMA RMT"},{"$f":"$BC5","v":"3.1.1.1.1"},"¿Existe un proceso de debida diligencia del personal documentado, que se revisa  regularmente y se actualiza según sea necesario?","1) Proceso de debida diligencia del personal\n-Verificar que el proceso esté documentado\n-Verificar que el documento incluya un historial de revisiones \n-Verificar que el documento haya sido revisado dentro de los últimos 24 meses",null,{"$f":"VLOOKUP($BH5,CategoryTranslationTable,3,FALSE)","v":"Obligatorio urgente"},{"$f":"VLOOKUP($BI5,CategoryTranslationTable,3,FALSE)","v":"Obligatorio"},{"$f":"$O5","v":"HR"},null,null,{"$f":"$AV5","v":"3"},{"$f":"$AW5","v":"3.1"},{"$f":"$AX5","v":"3.1.1"},null,{"$f":"$AZ5","v":"3.1.1.1"},null,{"$f":"$BB5","v":"GSMA RMT"},{"$f":"$BC5","v":"3.1.1.1.1"},null,null,null,{"$f":"VLOOKUP($BH5,CategoryTranslationTable,4,FALSE)","v":"ReqU4"},{"$f":"VLOOKUP($BI5,CategoryTranslationTable,4,FALSE)","v":"Req4"},{"$f":"$O5","v":"HR"},null,null,null,null,null,null,null,null,"3.1.1.1.1",null,null,null,{"$f":"IF(OR($EA5=0,$EA5=2),VLOOKUP(DO5,INDIRECT(ED5),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP5),\"\",VLOOKUP(DP5,INDIRECT(EE5),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ5),\"\",VLOOKUP(DQ5,INDIRECT(EF5),7,FALSE))","v":""},"",{"$f":"IF(OR($EA5=0,$EA5=2),VLOOKUP(DO5,INDIRECT(ED5),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP5),\"\",VLOOKUP(DP5,INDIRECT(EE5),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ5),\"\",VLOOKUP(DQ5,INDIRECT(EF5),8,FALSE))","v":""},"",{"$f":"1*AND(LEFT(DN5,3)=\"NEW\")+2*AND(LEFT(DN5,3)=\"MER\")+3*AND(LEFT(DN5,3)=\"MOV\")+4*AND(LEFT(DN5,3)=\"SWA\")","v":0},{"$f":"IF(EA5=0,DS5,EN5)","v":{"$error":"#REF!"}},{"$f":"IF(EA5=0,IF(DW5=0,\"\",DW5),CHOOSE(EA5,\"New indicator\",CONCATENATE(DW5,CarriageReturn,DX5,CarriageReturn,DY5,CarriageReturn,DZ5)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO5,1)","v":"OriginalComplianceP3"},{"$f":"\"OriginalComplianceP\"&LEFT(DP5,1)","v":"OriginalComplianceP"},"OriginalComplianceP","OriginalComplianceP",{"$f":"COUNTIF($DS5:$DV5,EH$3)","v":0},0,0,0,0,{"$f":"COUNTIF($DO5:$DR5,\"*?\")","v":1},{"$f":"IF(OR(AND(EH5>0,SUM(EI5:EL5)>0),EK5>0),\"Partial\",IF(EH5=EM5,\"Yes\",IF(EI5=EM5,\"No\",IF(EJ5=EM5,\"N/A\",IF(EK5=EM5,\"Partial\",IF(EL5=EM5,\"\",\"\"))))))","v":""}]
[null,{"$f":"$AV6","v":"3"},{"$f":"$AW6","v":"3.1"},{"$f":"$AX6","v":"3.1.1"},0,{"$f":"AZ6","v":"3.1.1.1"},null,{"$f":"BB6","v":0},{"$f":"BC6","v":"3.1.1.1.2"},"3.1.1.1.2: Are identification data collected for staff - full name, address, date of birth?\n","1) Staff due diligence process\n- Check that there is a process for identification data to be collected from staff.\n- Check that this includes:\na) Full Names\nb) Address\nc) Date of birth",0,"Urgent Required","Required","HR",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.1","3.1.1",null,"3.1.1.1",null,null,"3.1.1.1.2","3.1.1.2.1","Are identification data collected for staff - full name, address, date of birth?","1) Staff due diligence process\n- Check that there is a process for identification data to be collected from staff.\n- Check that this includes:\na) Full Names\nb) Address\nc) Date of birth",null,"Urgent Required","Required",{"$f":"$O6","v":"HR"},null,null,{"$f":"$AV6","v":"3"},{"$f":"$AW6","v":"3.1"},{"$f":"$AX6","v":"3.1.1"},0,{"$f":"$AZ6","v":"3.1.1.1"},null,{"$f":"$BB6","v":0},{"$f":"$BC6","v":"3.1.1.1.2"},"les renseignements d'identité sont-ils collectés pour l'ensemble du personnel: nom complet, adresse, date de naissance ?","1) Processus de vigilance à l’égard du personnel\n- Vérifier qu’un processus a été mis en place afin de collecter les renseignements d’identité pour l’ensemble du personnel.\n- Vérifier que ces renseignements incluent les informations suivantes :\na) Nom complet\nb) Adresse\nc) Date de naissance",null,"Requis Prioritaire","Requis",{"$f":"$O6","v":"HR"},0,null,{"$f":"$AV6","v":"3"},{"$f":"$AW6","v":"3.1"},{"$f":"$AX6","v":"3.1.1"},null,{"$f":"$AZ6","v":"3.1.1.1"},null,{"$f":"$BB6","v":0},{"$f":"$BC6","v":"3.1.1.1.2"},"¿Se recolectan los datos de identificación del personal, nombre completo, domicilio, fecha de nacimiento?","1) Proceso de debida diligencia del personal \n- Verificar que exista un proceso para la recolección de los datos de identificación de los empleados.\n- Verificar que incluyan:\na) Nombre completo\nb) Domicilio\nc) Fecha de nacimiento",null,"Obligatorio urgente","Obligatorio",{"$f":"$O6","v":"HR"},null,null,{"$f":"$AV6","v":"3"},{"$f":"$AW6","v":"3.1"},{"$f":"$AX6","v":"3.1.1"},null,{"$f":"$AZ6","v":"3.1.1.1"},null,{"$f":"$BB6","v":0},{"$f":"$BC6","v":"3.1.1.1.2"},null,null,null,"ReqU4","Req4",{"$f":"$O6","v":"HR"},null,null,null,null,null,null,null,null,"3.1.1.2.1",null,null,null,{"$f":"IF(OR($EA6=0,$EA6=2),VLOOKUP(DO6,INDIRECT(ED6),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP6),\"\",VLOOKUP(DP6,INDIRECT(EE6),7,FALSE))","v":""},"","",{"$f":"IF(OR($EA6=0,$EA6=2),VLOOKUP(DO6,INDIRECT(ED6),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP6),\"\",VLOOKUP(DP6,INDIRECT(EE6),8,FALSE))","v":""},"","",0,{"$error":"#REF!"},{"$error":"#REF!"},{"$f":"\"OriginalComplianceP\"&LEFT(DO6,1)","v":"OriginalComplianceP3"},"OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,{"$f":"IF(OR(AND(EH6>0,SUM(EI6:EL6)>0),EK6>0),\"Partial\",IF(EH6=EM6,\"Yes\",IF(EI6=EM6,\"No\",IF(EJ6=EM6,\"N/A\",IF(EK6=EM6,\"Partial\",IF(EL6=EM6,\"\",\"\"))))))","v":""}]
[null,"3","3.1","3.1.1",null,"3.1.1.1",null,0,"3.1.1.1.3","3.1.1.1.3: Is a risk-based assessment carried out to determine whether additional due diligence is required (e.g. watchlist screening or additional KYC) for staff in sensitive roles (such as head of mobile money, Finance team, AML staff, Fraud team, and privileged staff account holders (super users or account creation roles)?\n","1) Staff due diligence process\n- Check that a risk-based assessment has been carried out to determine whether additional due diligence is required (e.g. watchlist screening or additional KYC) for staff in sensitive roles  (based on reasonable assessment of risk).",0,"Standard Required",{"$f":"CHOOSE(LanguageNumber,BI7,BY7,CO7,DE7)","v":"Required"},"HR",{"$f":"CHOOSE(LanguageNumber,BK7,CA7,CQ7,DG7)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.1","3.1.1",null,"3.1.1.1",null,null,"3.1.1.1.3",0,"Is a risk-based assessment carried out to determine whether additional due diligence is required (e.g. watchlist screening or additional KYC) for staff in sensitive roles (such as head of mobile money, Finance team, AML staff, Fraud team, and privileged staff account holders (super users or account creation roles)?","1) Staff due diligence process\n- Check that a risk-based assessment has been carried out to determine whether additional due diligence is required (e.g. watchlist screening or additional KYC) for staff in sensitive roles  (based on reasonable assessment of risk).",null,"Standard Required","Required","HR",null,null,"3","3.1","3.1.1",null,"3.1.1.1",null,0,"3.1.1.1.3","Une évaluation de risque a-t-elle été réalisée afin de déterminer si un processus de vigilance supplémentaire est nécessaire (par exemple, contrôle des listes de surveillance ou renseignements d'identité supplémentaires) à l’égard du personnel affecté à des postes sensibles (Responsable de l’exploitation de l’argent mobile, équipe financière, personnel AML, équipe de lutte contre la fraude, et salariés titulaires de comptes privilégiés (super-utilisateurs ou fonctions chargées de la création de comptes)) ?","1) Processus de vigilance à l’égard du personnel\n- Vérifier qu’une évaluation a été effectuée afin de déterminer la nécessité de mettre en œuvre un processus de diligence supplémentaire (par exemple contrôle des listes de surveillance ou renseignements d'identité supplémentaires) à l’égard du personnel affecté à des postes sensibles (sur la base d'une évaluation raisonnable des risques).",null,"Requis Normal","Requis","HR",null,null,"3","3.1","3.1.1",null,"3.1.1.1",null,0,"3.1.1.1.3","¿Se lleva a cabo una evaluación de riesgos para determinar si se requiere una debida diligencia adicional (por ej., análisis de las listas de control o CSC adicional) para el personal que ocupa roles sensibles (tales como el jefe del dinero móvil, equipo de Finanzas, personal ALA, Equipo de fraude y titulares de cuentas del personal privilegiadas (súper usuarios o roles de creación de cuentas)?","1) Proceso de debida diligencia del personal\n- Verificar que se haya llevado a cabo una evaluación de riesgos para determinar si se debe llevar a cabo una debida diligencia adicional (por ej., análisis de las listas de control o CSC adicional) del personal que ocupa roles sensibles (basado en una evaluación de riesgos razonable). ",null,"Obligatorio estándar","Obligatorio","HR",null,null,"3","3.1","3.1.1",null,"3.1.1.1",null,0,"3.1.1.1.3",null,null,null,"ReqS4","Req4","HR",null,null,null,null,null,null,null,"NEW"]
[null,"3","3.1","3.1.1",{"$f":"CHOOSE(LanguageNumber,AY8,BP8,CF8,CV8)","v":0},"3.1.1.1",null,0,"3.1.1.1.4","3.1.1.1.4: Is employment history checked and are references taken for all operational staff?\n",0,0,{"$f":"CHOOSE(LanguageNumber,BH8,BX8,CN8,DD8)","v":"Recommended"},"Recommended","HR",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.1","3.1.1",null,"3.1.1.1",null,null,"3.1.1.1.4","3.1.1.2.2","Is employment history checked and are references taken for all operational staff?",null,null,"Recommended","Recommended","HR",null,null,"3","3.1","3.1.1",0,"3.1.1.1",null,0,"3.1.1.1.4","l'historique d'emploi est-il vérifié et des références sont-elles demandées pour l'ensemble du personnel opérationnel ?",null,null,"Recommandé","Recommandé","HR",0,null,"3","3.1","3.1.1",null,"3.1.1.1",null,0,"3.1.1.1.4","¿Se verifican los antecedentes penales y se piden referencias para todo el personal de operaciones?",null,null,"Recomendado","Recomendado","HR",null,null,"3","3.1","3.1.1",null,"3.1.1.1",null,0,"3.1.1.1.4",null,null,null,"Rec4","Rec4","HR",null,null,null,null,null,null,null,null,"3.1.1.2.2",null,null,null,{"$f":"IF(OR($EA8=0,$EA8=2),VLOOKUP(DO8,INDIRECT(ED8),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP8),\"\",VLOOKUP(DP8,INDIRECT(EE8),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ8),\"\",VLOOKUP(DQ8,INDIRECT(EF8),7,FALSE))","v":""},"",{"$f":"IF(OR($EA8=0,$EA8=2),VLOOKUP(DO8,INDIRECT(ED8),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP8),\"\",VLOOKUP(DP8,INDIRECT(EE8),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ8),\"\",VLOOKUP(DQ8,INDIRECT(EF8),8,FALSE))","v":""},"",{"$f":"1*AND(LEFT(DN8,3)=\"NEW\")+2*AND(LEFT(DN8,3)=\"MER\")+3*AND(LEFT(DN8,3)=\"MOV\")+4*AND(LEFT(DN8,3)=\"SWA\")","v":0},{"$error":"#REF!"},{"$f":"IF(EA8=0,IF(DW8=0,\"\",DW8),CHOOSE(EA8,\"New indicator\",CONCATENATE(DW8,CarriageReturn,DX8,CarriageReturn,DY8,CarriageReturn,DZ8)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO8,1)","v":"OriginalComplianceP3"},{"$f":"\"OriginalComplianceP\"&LEFT(DP8,1)","v":"OriginalComplianceP"},"OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,{"$f":"IF(OR(AND(EH8>0,SUM(EI8:EL8)>0),EK8>0),\"Partial\",IF(EH8=EM8,\"Yes\",IF(EI8=EM8,\"No\",IF(EJ8=EM8,\"N/A\",IF(EK8=EM8,\"Partial\",IF(EL8=EM8,\"\",\"\"))))))","v":""}]
[null,"3","3.1","3.1.1",0,"3.1.1.1",null,0,"3.1.1.1.5","3.1.1.1.5: Are criminal record checks carried out for all operational staff?\n",0,0,"Recommended","Recommended","HR",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.1","3.1.1",null,"3.1.1.1",null,null,"3.1.1.1.5","3.1.1.2.3","Are criminal record checks carried out for all operational staff?",null,null,"Recommended","Recommended","HR",null,null,"3","3.1","3.1.1",0,"3.1.1.1",null,0,"3.1.1.1.5","une vérification du casier judiciaire est-elle effectuée pour l'ensemble du personnel opérationnel ?",null,null,"Recommandé","Recommandé","HR",0,null,"3","3.1","3.1.1",null,"3.1.1.1",null,0,"3.1.1.1.5","¿Se verifican los antecedentes para todo el personal de operaciones?",null,null,"Recomendado","Recomendado","HR",null,null,"3","3.1","3.1.1",null,"3.1.1.1",null,0,"3.1.1.1.5",null,null,null,"Rec4","Rec4","HR",null,null,null,null,null,null,null,null,"3.1.1.2.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.1","3.1.1","","3.1.1.2","3.1.1.2: STAFF DUE DILIGENCE - FREQUENCY AND RECORDS\nDue diligence checks should be performed on all staff at intervals specified in the staff due diligence policy. This should ideally be every three years at minimum, and every two years at minimum for staff that are in the sensitive roles identified by risk assessment (3.1.1.2).\n\nThe provider should maintain the following staff due diligence records:\n- Records of staff due diligence conducted\n- Copies of all documentation collected during due diligence\nRecords should be kept for a period determined by regulation or risk assessment, whichever is longer. FATF recommends that records be kept for a minimum of five years after termination, either physically or electronically (or both). ","GSMA RMT","3.1.1.2.1","3.1.1.2.1: Are due diligence checks performed on all staff every three years at minimum, and every two years at minimum for staff that are in sensitive roles?\n",0,0,"Recommended","Recommended","HR",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.1","3.1.1","","3.1.1.2","STAFF DUE DILIGENCE - FREQUENCY AND RECORDS\nDue diligence checks should be performed on all staff at intervals specified in the staff due diligence policy. This should ideally be every three years at minimum, and every two years at minimum for staff that are in the sensitive roles identified by risk assessment (3.1.1.2).\n\nThe provider should maintain the following staff due diligence records:\n- Records of staff due diligence conducted\n- Copies of all documentation collected during due diligence\nRecords should be kept for a period determined by regulation or risk assessment, whichever is longer. FATF recommends that records be kept for a minimum of five years after termination, either physically or electronically (or both). ","GSMA RMT","3.1.1.2.1","3.1.1.4.1","Are due diligence checks performed on all staff every three years at minimum, and every two years at minimum for staff that are in sensitive roles?",null,null,"Recommended","Recommended","HR",null,null,"3","3.1","3.1.1","","3.1.1.2","VIGILANCE À L'ÉGARD DU PERSONNEL - PÉRIODICITÉ ET REGISTRES\nLes contrôles de vigilance doivent concerner l’ensemble du personnel selon une périodicité définie par la politique de vigilance à l’égard du personnel. Cette périodicité doit être de trois ans au minimum, et de deux ans au minimum pour le personnel des fonctions sensibles mentionnées à 3.1.1.3.\n\nLe prestataire doit conserver les registres suivants de vigilance à l’égard du personnel :\n- dossiers des vérifications effectuées ; \n- copie de tous les documents collectés dans le cadre de ces vérifications.\nLes registres doivent être conservés aussi longtemps que l'exige la réglementation ou l'évaluation des risques. Le GAFI recommande que ces registres soient conservés pour une durée d'au moins cinq ans, que ce soit physiquement ou sous forme électronique (ou les deux). ","GSMA RMT","3.1.1.2.1","des contrôles de vigilance sont-ils effectués au moins tous les trois pour l'ensemble du personnel, et au moins tous les deux ans pour le personnel occupant des postes sensibles ?",null,null,"Recommandé","Recommandé","HR",0,null,"3","3.1","3.1.1","","3.1.1.2","DEBIDA DILIGENCIA DEL PERSONAL - FRECUENCIA Y REGISTROS\nLas verificaciones de debida diligencia se deben realizar sobre todo el personal a intervalos especificados en la política de debida diligencia del personal. Idealmente, se deben realizar, como mínimo, cada tres años y, como mínimo, cada dos años para el personal que ocupa roles sensibles identificados en la evaluación de riesgos (3.1.1.2).\n\nEl proveedor debe mantener los siguientes registros de debida diligencia del personal:\n- Registros de la debida diligencia del personal realizada\n- Copias de toda la documentación recolectada durante la debida diligencia\nSe deben conservar los registros durante el que resulte mayor entre el período que determine la regulación o la evaluación de riegos. El GAFI recomienda que se conserven los registros por un período mínimo de cinco años después de la terminación del empleo, ya sea en medios físicos o electrónicos (o ambos). ","GSMA RMT","3.1.1.2.1","¿Se realizan verificaciones de debida diligencia de todo el personal, como mínimo, cada tres años y, como mínimo, cada dos años para el personal que ocupa roles sensibles?",null,null,"Recomendado","Recomendado","HR",null,null,"3","3.1","3.1.1",null,"3.1.1.2",null,"GSMA RMT","3.1.1.2.1",null,null,null,"Rec4","Rec4","HR",null,null,null,null,null,null,null,null,"3.1.1.4.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.1","3.1.1","","3.1.1.2",null,0,"3.1.1.2.2","3.1.1.2.2: Are staff due diligence records kept for at least five years after termination, including identification records and records of due diligence conducted?\n",0,0,"Recommended","Recommended","HR",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.1","3.1.1","","3.1.1.2",null,null,"3.1.1.2.2","3.1.1.4.2","Are staff due diligence records kept for at least five years after termination, including identification records and records of due diligence conducted?",null,null,"Recommended","Recommended","HR",null,null,"3","3.1","3.1.1","","3.1.1.2",0,0,"3.1.1.2.2","les registres de contrôle de vigilance à l'égard du personnel sont-ils conservés pendant au moins cinq ans après la fin du contrat de travail, y compris les renseignements d'identité et les dossiers des vérifications effectuées ?",null,null,"Recommandé","Recommandé","HR",0,null,"3","3.1","3.1.1","","3.1.1.2",null,0,"3.1.1.2.2","¿Los registros de debida diligencia del personal se conservan durante, al menos, cinco años después de la terminación del empleo, incluidos los registros de identificación y los registros de la debida diligencia realizada?",null,null,"Recomendado","Recomendado","HR",null,null,"3","3.1","3.1.1",null,"3.1.1.2",null,0,"3.1.1.2.2",null,null,null,"Rec4","Rec4","HR",null,null,null,null,null,null,null,null,"3.1.1.4.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.1","3.1.1","","3.1.1.3","3.1.1.3: AGENT DUE DILIGENCE POLICY\nThe provider should have a policy to carry out due diligence on mobile money agents before they start operation and regularly thereafter. The agent due diligence policy should define checks to be made when contracting new master agents and individual agents, and ongoing reviews. \n\nThe agent due diligence policy should be regularly reviewed and updated as needed, such as when changes are made to the service or regulation.","GSMA RMT","3.1.1.3.1","3.1.1.3.1: Is there a policy to perform due diligence on mobile money agents before their engagement and regularly thereafter, and is the policy regularly reviewed and updated as needed, such as when changes are made to the service or regulation?\n",0,0,"Recommended","Recommended","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.1","3.1.1","","3.1.1.3","AGENT DUE DILIGENCE POLICY\nThe provider should have a policy to carry out due diligence on mobile money agents before they start operation and regularly thereafter. The agent due diligence policy should define checks to be made when contracting new master agents and individual agents, and ongoing reviews. \n\nThe agent due diligence policy should be regularly reviewed and updated as needed, such as when changes are made to the service or regulation.","GSMA RMT","3.1.1.3.1","3.1.1.5.1","Is there a policy to perform due diligence on mobile money agents before their engagement and regularly thereafter, and is the policy regularly reviewed and updated as needed, such as when changes are made to the service or regulation?",null,null,"Recommended","Recommended","Agent",null,null,"3","3.1","3.1.1","","3.1.1.3","POLITIQUE DE VIGILANCE À L'ÉGARD DES AGENTS\nLes prestataires doivent avoir une politique de contrôle préalable des agents de l’argent mobile avant le début de leur activité et de contrôle régulier par la suite. La politique de vigilance à l’égard des agents doit définir les contrôles à effectuer avant la signature des contrats avec de nouveaux master agents ou agents individuels ainsi que les contrôles périodiques ultérieurs.\n\nCette politique de vigilance à l’égard des agents doit être régulièrement examinée et mise à jour au besoin, notamment en cas de changement dans le service ou dans la réglementation.","GSMA RMT","3.1.1.3.1","existe-t-il une politique documentée de vigilance à l'égard des agents de l'argent mobile, qui spécifie les contrôles à effectuer avant leur engagement et périodiquement par la suite, et cette politique est-elle régulièrement revue et mise à jour au besoin, notamment en cas de changement dans le service ou la réglementation ?",null,null,"Recommandé","Recommandé","Agent",0,null,"3","3.1","3.1.1","","3.1.1.3","POLÍTICA DE DEBIDA DILIGENCIA DE LOS AGENTES\nEl proveedor debe contar con una política para llevar a cabo la debida diligencia de los agentes del dinero móvil antes de iniciar las operaciones y habitualmente después del inicio de las mismas. La política de debida diligencia de los agentes debe definir verificaciones que se deben realizar al contratar nuevos agentes maestros y agentes individuales, así como las revisiones continuas. \n\nLa política de debida diligencia de los agentes debe ser regularmente revisada y actualizada según sea necesario, por ejemplo cuando se realizan cambios al servicio o a la regulación.","GSMA RMT","3.1.1.3.1","¿Existe una política para realizar la debida diligencia de los agentes del dinero móvil antes de su contratación y regularmente después de la misma, y esta política es regularmente revisada y actualizada, según sea necesario, por ejemplo cuando se realizan cambios al servicio o a la regulación?",null,null,"Recomendado","Recomendado","Agent",null,null,"3","3.1","3.1.1",null,"3.1.1.3",null,"GSMA RMT","3.1.1.3.1",null,null,null,"Rec4","Rec4","Agent",null,null,null,null,null,null,null,null,"3.1.1.5.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.1","3.1.1","","3.1.1.4","3.1.1.4: AGENT DUE DILIGENCE: MASTER AGENTS\nProviders should conduct due diligence on all master agents and agent aggregators. Checks should include:\n- Identification of owners and senior management of master agents - full name, address, date of birth (validated by viewing ID);\n- Two business references;\n- Criminal record check on owners and senior management of master agents;\n- Bankruptcy check on owners and senior management of master agents;\n- A certified true copy of the business registration documents of the master agent (e.g. memorandum and articles of association);\n- An organisational chart of the agent network indicating the identity of the managers of each agent store;\n- Screening of owners and senior management of master agents using domestic and international money laundering, terrorist financing, and sanctions watchlists.","GSMA RMT (AG-02)","3.1.1.4.1","3.1.1.4.1: Has a process been implemented to carry out due diligence on all master agents and agent aggregators?\n","1) Agent Due Diligence Process\n- Check that there is a process to carry out due diligence on all master agents and agent aggregators.",0,"Urgent Required","Required","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.1","3.1.1","","3.1.1.4","AGENT DUE DILIGENCE: MASTER AGENTS\nProviders should conduct due diligence on all master agents and agent aggregators. Checks should include:\n- Identification of owners and senior management of master agents - full name, address, date of birth (validated by viewing ID);\n- Two business references;\n- Criminal record check on owners and senior management of master agents;\n- Bankruptcy check on owners and senior management of master agents;\n- A certified true copy of the business registration documents of the master agent (e.g. memorandum and articles of association);\n- An organisational chart of the agent network indicating the identity of the managers of each agent store;\n- Screening of owners and senior management of master agents using domestic and international money laundering, terrorist financing, and sanctions watchlists.","GSMA RMT (AG-02)","3.1.1.4.1","3.1.1.6.1","Has a process been implemented to carry out due diligence on all master agents and agent aggregators?","1) Agent Due Diligence Process\n- Check that there is a process to carry out due diligence on all master agents and agent aggregators.",null,"Urgent Required","Required","Agent",null,null,"3","3.1","3.1.1","","3.1.1.4","VIGILANCE À L'ÉGARD DES AGENTS : AGENTS PRINCIPAUX\nLes prestataires doivent effectuer des vérifications préalables pour l’ensemble des agents principaux (ou master agents) et des agrégateurs d’agents. Ces vérifications doivent inclure au minimum :\n- l’identification des associés et dirigeants : nom complet, adresse, date de naissance ; \n- deux références commerciales ;\n- vérification du casier judiciaire des associés et dirigeants ;\n- vérification des faillites des associés et dirigeants ;\n- copie certifiée conforme des documents d’immatriculation de l’entreprise (ex. statuts et inscription au registre du commerce) ;\n- organigramme du réseau d’agents avec identité du responsable de chaque point de service ; \n- les associés et dirigeants doivent faire l’objet d'un contrôle des listes nationales et internationales de sanctions et de surveillance du blanchiment de capitaux et du financement du terrorisme. ","GSMA RMT (AG-02)","3.1.1.4.1","un processus est-il en place pour effectuer les contrôles de vigilance à l'égard de l'ensemble des agents principaux et agrégateurs d'agents ?","1) Processus de vigilance à l’égard des agents\n- Vérifier qu’un processus a été mis en place pour effectuer les contrôles de vigilance à l’égard de l’ensemble des agents principaux et agrégateurs d’agents.",null,"Requis Prioritaire","Requis","Agent",0,null,"3","3.1","3.1.1","","3.1.1.4","DEBIDA DILIGENCIA DE LOS AGENTES: AGENTES MAESTROS\nLos proveedores deben realizar una debida diligencia de todos los agentes maestros y agregadores de agentes. Las verificaciones deben incluir, como mínimo:\n- Identificación de los titulares y de la alta gerencia de los agentes maestros - nombre completo, domicilio, fecha de nacimiento;\n- Dos referencias comerciales;\n- Verificación de antecedentes penales de los titulares y de la alta gerencia de los agentes maestros;\n- Verificación de quiebra de los titulares y de la alta gerencia de los agentes maestros;\n- Copia fiel certificada de los documentos de inscripción del negocio del agente maestro (por ej., acta constitutiva y estatutos);\n- Un organigrama de la red de agentes que indique la identidad de los gerentes de cada comercio del agente;\n- Se deben analizar los titulares y la alta gerencia de los agentes maestros utilizando las listas de control nacionales e internacionales de lavado de activos, financiamiento del terrorismo y sanciones.","GSMA RMT (AG-02)","3.1.1.4.1","¿Se implementó un proceso para llevar a cabo la debida diligencia de todos los agentes maestros y agregadores de agentes?","1) Proceso de Debida Diligencia de los Agentes\n- Verificar que exista un proceso para llevar a cabo la debida diligencia de todos los agentes maestros y agregadores de agentes.",null,"Obligatorio urgente","Obligatorio","Agent",null,null,"3","3.1","3.1.1",null,"3.1.1.4",null,"GSMA RMT (AG-02)","3.1.1.4.1",null,null,null,"ReqU4","Req4","Agent",null,null,null,null,null,null,null,null,"3.1.1.6.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.1","3.1.1","","3.1.1.4",null,0,"3.1.1.4.2","3.1.1.4.2: Is identification of owners and senior management of master agents & and agent aggregators collected, including full name, address, and date of birth (with verification of name and DoB)?\n","1) Agent Due Diligence Process\n- Check that identification of all owners (>25% ownership) and senior management of master agents/agent aggregators is collected, including:\na) Full Name      (verified by viewing ID documentation)\nb) Address\nc) Date of birth  (verified by viewing ID documentation, where available)",0,"Urgent Required","Required","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.1","3.1.1","","3.1.1.4",null,null,"3.1.1.4.2","3.1.1.6.2","Is identification of owners and senior management of master agents & and agent aggregators collected, including full name, address, and date of birth (with verification of name and DoB)?","1) Agent Due Diligence Process\n- Check that identification of all owners (>25% ownership) and senior management of master agents/agent aggregators is collected, including:\na) Full Name      (verified by viewing ID documentation)\nb) Address\nc) Date of birth  (verified by viewing ID documentation, where available)",null,"Urgent Required","Required","Agent",null,null,"3","3.1","3.1.1","","3.1.1.4",0,0,"3.1.1.4.2","des renseignements relatifs à l'identité des associés et dirigeants des agents principaux et agrégateurs d'agents, y compris leur nom complet, leur adresse et leur date de naissance sont-ils recueillis (avec vérification du nom et de la date de naissance) ?","1) Processus de vigilance à l’égard des agents\n- Vérifier que les renseignements relatifs à l'identité de l’ensemble des associés (participation >25% du capital) et des membres de la direction générale des agents principaux/agrégateurs d’agents sont recueillis, et que ces renseignements comprennent les éléments suivants :\na) Nom complet (vérifié grâce à une pièce d'identité)\nb) Adresse\nc) Date de naissance (vérifié grâce à une pièce d'identité, si possible)",null,"Requis Prioritaire","Requis","Agent",0,null,"3","3.1","3.1.1","","3.1.1.4",null,0,"3.1.1.4.2","¿Se obtiene la identificación de los titulares y de la alta gerencia de los agentes maestros y agregadores de agentes, incluido el nombre completo, domicilio y fecha de nacimiento (con verificación del nombre y fecha de nacimiento)?","1) Proceso de Debida Diligencia de los Agentes\n- Verificar que se obtiene la identificación de todos los titulares (>25% de titularidad) y de la alta gerencia de los agentes maestros/agregadores de agentes, incluyendo:\na) Nombre completo (verificado mediante visualización de documentación de identificación)\nb) Domicilio\nc) Fecha de nacimiento  (verificada mediante visualización de documentación de identificación, si corresponde)\n\n",null,"Obligatorio urgente","Obligatorio","Agent",null,null,"3","3.1","3.1.1",null,"3.1.1.4",null,0,"3.1.1.4.2",null,null,null,"ReqU4","Req4","Agent",null,null,null,null,null,null,null,null,"3.1.1.6.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.1","3.1.1","","3.1.1.4",null,{"$f":"BB15","v":0},{"$f":"BC15","v":"3.1.1.4.3"},"3.1.1.4.3: Are owners and senior management of all master agents and agent aggregators screened using watchlists?\n","1) Agent Due Diligence Process\n- Check that the process includes the screening of owners and senior managers of master agents and agent aggregators against watch lists (which should be at a minimum the lists required for customer screening).",0,"Standard Required","Required","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.1","3.1.1","","3.1.1.4",null,null,"3.1.1.4.3",{"$f":"DO15","v":"3.1.1.6.7"},"Are owners and senior management of all master agents and agent aggregators screened using watchlists?","1) Agent Due Diligence Process\n- Check that the process includes the screening of owners and senior managers of master agents and agent aggregators against watch lists (which should be at a minimum the lists required for customer screening).",null,"Standard Required","Required","Agent",null,null,"3","3.1","3.1.1","","3.1.1.4",0,0,"3.1.1.4.3","les associés et dirigeants de chaque agent principal ou agrégateur d'agents font-ils l'objet d'un contrôle des listes de surveillance ?","1) Processus de vigilance à l’égard des agents\n- Vérifier que le processus inclut le contrôle des associés et des dirigeants des agents principaux et des agrégateurs d’agents par rapprochement avec les listes de surveillance (incluant au minimum les listes nécessaires pour le contrôle des clients).",null,"Requis Normal","Requis","Agent",0,null,"3","3.1","3.1.1","","3.1.1.4",null,0,"3.1.1.4.3","¿Se analizan los titulares y la alta gerencia de todos los agentes maestros y agregadores de agentes usando listas de control?","1) Proceso de Debida Diligencia de los Agentes\n- Verificar que el proceso incluya el análisis de los titulares y de la alta gerencia de los agentes maestros y agregadores de agentes en base a las listas de control (que deben ser, como mínimo, las listas requeridas para el análisis de clientes.",null,"Obligatorio estándar","Obligatorio","Agent",null,null,"3","3.1","3.1.1",null,"3.1.1.4",null,0,"3.1.1.4.3",null,null,null,"ReqS4","Req4","Agent",null,null,null,null,null,null,null,null,"3.1.1.6.7",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.1","3.1.1","","3.1.1.4",null,0,"3.1.1.4.4","3.1.1.4.4: Are at least two business references obtained for all master agents and agent aggregators?\n",0,0,"Recommended","Recommended","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.1","3.1.1","","3.1.1.4",null,null,"3.1.1.4.4","3.1.1.6.3","Are at least two business references obtained for all master agents and agent aggregators?",null,null,"Recommended","Recommended","Agent",null,null,"3","3.1","3.1.1","","3.1.1.4",0,0,"3.1.1.4.4","deux références commerciales sont-elles demandées au minimum pour chaque agent principal ou agrégateur d'agents ?",null,null,"Recommandé","Recommandé","Agent",0,null,"3","3.1","3.1.1","","3.1.1.4",null,0,"3.1.1.4.4","¿Se obtienen, al menos, dos referencias comerciales de todos los agentes maestros y agregadores de agentes?",null,null,"Recomendado","Recomendado","Agent",null,null,"3","3.1","3.1.1",null,"3.1.1.4",null,0,"3.1.1.4.4",null,null,null,"Rec4","Rec4","Agent",null,null,null,null,null,null,null,null,"3.1.1.6.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.1","3.1.1","","3.1.1.4",null,0,"3.1.1.4.5","3.1.1.4.5: Are criminal record checks performed on owners and senior management of all master agents and agent aggregators ?\n",0,0,"Recommended","Recommended","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.1","3.1.1","","3.1.1.4",null,null,"3.1.1.4.5","3.1.1.6.4","Are criminal record checks performed on owners and senior management of all master agents and agent aggregators ?",null,null,"Recommended","Recommended","Agent",null,null,"3","3.1","3.1.1","","3.1.1.4",0,0,"3.1.1.4.5","une vérification du casier judiciaire est-elle effectuée sur les associés et dirigeants de chaque agent principal ou agrégateur d'agents ?",null,null,"Recommandé","Recommandé","Agent",0,null,"3","3.1","3.1.1","","3.1.1.4",null,0,"3.1.1.4.5","¿Se verifican los antecedentes penales de los titulares y de la alta gerencia de todos los agentes maestros y agregadores de agentes?",null,null,"Recomendado","Recomendado","Agent",null,null,"3","3.1","3.1.1",null,"3.1.1.4",null,0,"3.1.1.4.5",null,null,null,"Rec4","Rec4","Agent",null,null,null,null,null,null,null,null,"3.1.1.6.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.1","3.1.1","","3.1.1.4",null,0,"3.1.1.4.6","3.1.1.4.6: Is a bankruptcy check performed on the owners and senior management of all master agents and agent aggregators ?\n",0,0,"Recommended","Recommended","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.1","3.1.1","","3.1.1.4",null,null,"3.1.1.4.6","3.1.1.6.5","Is a bankruptcy check performed on the owners and senior management of all master agents and agent aggregators ?",null,null,"Recommended","Recommended","Agent",null,null,"3","3.1","3.1.1","","3.1.1.4",0,0,"3.1.1.4.6","une vérification des faillites est-elle effectuée sur les associés et dirigeants de chaque agent principal ou agrégateur d'agents ?",null,null,"Recommandé","Recommandé","Agent",0,null,"3","3.1","3.1.1","","3.1.1.4",null,0,"3.1.1.4.6","¿Se realiza una verificación de quiebra de los titulares y de la alta gerencia de todos los agentes maestros y agregadores de agentes?",null,null,"Recomendado","Recomendado","Agent",null,null,"3","3.1","3.1.1",null,"3.1.1.4",null,0,"3.1.1.4.6",null,null,null,"Rec4","Rec4","Agent",null,null,null,null,null,null,null,null,"3.1.1.6.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.1","3.1.1","","3.1.1.4",null,0,"3.1.1.4.7","3.1.1.4.7: Is a certified true copy of the business registration documents obtained (e.g. memorandum and articles of association) for all master agents and agent aggregators?\n",0,0,"Recommended","Recommended","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.1","3.1.1","","3.1.1.4",null,null,"3.1.1.4.7","3.1.1.6.6","Is a certified true copy of the business registration documents obtained (e.g. memorandum and articles of association) for all master agents and agent aggregators?",null,null,"Recommended","Recommended","Agent",null,null,"3","3.1","3.1.1","","3.1.1.4",0,0,"3.1.1.4.7","une copie certifiée conforme des documents d’immatriculation de l’entreprise (ex. statuts et inscription au registre du commerce) est-elle obtenue pour chaque agent principal ou agrégateur d'agents ?",null,null,"Recommandé","Recommandé","Agent",0,null,"3","3.1","3.1.1","","3.1.1.4",null,0,"3.1.1.4.7","¿Se obtiene una copia fiel certificada de los documentos de inscripción del negocio (por ej., acta constitutiva y estatuto) de todos los agentes maestros y agregadores de agentes?",null,null,"Recomendado","Recomendado","Agent",null,null,"3","3.1","3.1.1",null,"3.1.1.4",null,0,"3.1.1.4.7",null,null,null,"Rec4","Rec4","Agent",null,null,null,null,null,null,null,null,"3.1.1.6.6",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.1","3.1.1","","3.1.1.5","3.1.1.5: AGENT DUE DILIGENCE: AGENTS\nThe Agent Due Diligence policy should define procedures for vetting agents, whether they are engaged directly by the provider or via master agents. In the case that agents are engaged via master agents, the provider's contract should ensure that the master agents carry out the same level of vetting on the agents.\n\nThe following due diligence should be carried out on agents:\n- Identification of owners and managers of agents - full name, address, date of birth;\n- Certificate of trading or tax certificate or similar business entity document (if required by regulation or risk assessment).\n\nIf feasible, a good practice to consider is to take a photo of each agent location and map the GPS coordinates of the location.\n\nIf master agents are used, master agents should supply this due diligence information to the provider.\n\nAdditionally, the provider should carry out screening of the owners and managers of agents using domestic and international money laundering, terrorist financing, and sanctions watchlists. Screening should also be done against the provider's own blacklist of individuals known for fraud/ML/TF (refer to 2.5.3 and 5.3.10). Where \"possible matches\" are found, further ID should be obtained from the individual so that the match can be confirmed or discarded.","GSMA RMT (AG-02)","3.1.1.5.1","3.1.1.5.1: Is due diligence carried out on agents, including verifying the identity of their owners and managers (at minimum full name, address, and date of birth)?\n","1) Agent Due Diligence Process\n- Check that there is a process to carry out due diligence on all  agents before they are activated.\n- Check that the process includes identification of all owners (>25% ownership) and managers of agents\n-Check that information captured on owners and senior management includes:\n     a) Full Name\n     b) Address\n     c) Date of birth ",0,"Urgent Required","Required","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.1","3.1.1","","3.1.1.5","AGENT DUE DILIGENCE: AGENTS\nThe Agent Due Diligence policy should define procedures for vetting agents, whether they are engaged directly by the provider or via master agents. In the case that agents are engaged via master agents, the provider's contract should ensure that the master agents carry out the same level of vetting on the agents.\n\nThe following due diligence should be carried out on agents:\n- Identification of owners and managers of agents - full name, address, date of birth;\n- Certificate of trading or tax certificate or similar business entity document (if required by regulation or risk assessment).\n\nIf feasible, a good practice to consider is to take a photo of each agent location and map the GPS coordinates of the location.\n\nIf master agents are used, master agents should supply this due diligence information to the provider.\n\nAdditionally, the provider should carry out screening of the owners and managers of agents using domestic and international money laundering, terrorist financing, and sanctions watchlists. Screening should also be done against the provider's own blacklist of individuals known for fraud/ML/TF (refer to 2.5.3 and 5.3.10). Where \"possible matches\" are found, further ID should be obtained from the individual so that the match can be confirmed or discarded.","GSMA RMT (AG-02)","3.1.1.5.1","3.1.1.7.1","Is due diligence carried out on agents, including verifying the identity of their owners and managers (at minimum full name, address, and date of birth)?","1) Agent Due Diligence Process\n- Check that there is a process to carry out due diligence on all  agents before they are activated.\n- Check that the process includes identification of all owners (>25% ownership) and managers of agents\n-Check that information captured on owners and senior management includes:\n     a) Full Name\n     b) Address\n     c) Date of birth ",null,"Urgent Required","Required","Agent",null,null,"3","3.1","3.1.1","","3.1.1.5","VIGILANCE À L'ÉGARD DES AGENTS : AGENTS INDIVIDUELS\nLa politique de vigilance à l’égard des agents doit définir les procédures de contrôle des agents, qu’ils soient engagés directement par le prestataire ou par l’intermédiaire de master agents. Lorsque les agents sont engagés par l’intermédiaire de master agents, le contrat du prestataire doit obliger les master agents à effectuer le même niveau de contrôle sur les agents.\n\nIl convient d’effectuer au minimum les vérifications suivantes concernant chaque agent : \n- identité des associés et dirigeants de chaque agent : nom complet, adresse, date de naissance ; \n- inscription au registre du commerce, attestation fiscale ou autre justificatif d’enregistrement de l’entreprise (si la réglementation ou l’évaluation des risques l’exige).\n\nDans la mesure du possible, une bonne pratique à considérer consiste à prendre une photo de chaque site d’agent et à cartographier ses coordonnées GPS. \n\nLorsque des masters agents sont utilisés, ils doivent communiquer les renseignements collectés au prestataire.\n\nLes prestataires doivent en outre effectuer un contrôle des listes nationales et internationales de sanctions et de surveillance du blanchiment de capitaux et du financement du terrorisme concernant les associés et dirigeants de chaque agent. Un contrôle des listes noires du prestataire doit également être effectué pour identifier les personnes impliquées dans des activités de fraude / blanchiment de capitaux / financement du terrorisme (cf. 2.5.3 et 5.3.10). Si des « correspondances possibles » apparaissent, des renseignements d’identité supplémentaires doivent être demandés à la personne de façon à confirmer ou invalider la correspondance en question. ","GSMA RMT (AG-02)","3.1.1.5.1","Des vérifications des agents sont-elles réalisées, notamment la vérification de l’identité des propriétaires et des responsables (nom et prénom, adresse et date de naissance au minimum) ? ","1) Processus de vigilance à l’égard des agents\n- Vérifier qu’un processus a été mis en place pour effectuer les contrôles de vigilance à l’égard de chaque agent individuel avant leur activation.\n- Vérifier que le processus prévoit l’identification de l’ensemble des associés (participation >25% du capital) et des responsables des agents individuels\n- Vérifier que les informations recueillies concernant les associés et les membres de la direction générale incluent les informations suivantes:\na) Nom complet\nb) Adresse\nc) Date de naissance ",null,"Requis Prioritaire","Requis","Agent",0,null,"3","3.1","3.1.1","","3.1.1.5","DEBIDA DILIGENCIA DE LOS AGENTES: AGENTES\nLa política de Debida Diligencia de los Agentes debe definir procedimientos de verificación de los agentes, ya sean contratados directamente por el proveedor o a través de los agentes maestros. En caso de que los agentes sean contratados a través de los agentes maestros, el contrato del proveedor debe garantizar que los agentes maestros empleen el mismo nivel de verificación de los agentes.\n\nSe debe llevar a cabo la siguiente debida diligencia de los agentes:\n- Identificación de los titulares y gerentes de los agentes - nombre completo, domicilio, fecha de nacimiento;\n- Licencia mercantil o certificado de impuestos o documento de la entidad de comercio similar (si fuese requerido por la regulación o la evaluación de riesgos).\n\nSi es posible, una buena práctica a tener en cuenta es tomar una fotografía de la ubicación de cada agente y mapear las coordenadas de GPS de la ubicación.\n\nSi se emplean agentes maestros, estos deben suministrar esta información de debida diligencia al proveedor.\n\nAdicionalmente, el proveedor debe llevar a cabo un análisis de los titulares y gerentes de los agentes utilizando listas de control nacionales e internacionales de lavado de activos, financiamiento del terrorismo y sanciones. El análisis también se debe realizar en base a la lista negra propia del proveedor de los individuos que cometieron fraude/LA/FT (ver 2.5.3 a 5.3.10). Cuando se encuentran \"posibles coincidencias\", se debe obtener más información de identificación de la persona para poder confirmar o descartar la coincidencia.","GSMA RMT (AG-02)","3.1.1.5.1","¿Se realiza la debida diligencia de los agentes, incluyendo la verificación de la identidad de sus titulares y gerentes (como mínimo, nombre completo, domicilio y fecha de nacimiento)?","1) Proceso de Debida Diligencia de los Agentes\n- Verificar que exista un proceso para llevar a cabo la debida diligencia de todos los agentes individuales antes de ser activados.\n- Verificar que el proceso incluya la identificación de todos los titulares (>25% de titularidad) y gerentes de los agentes individuales\n-Verificar que la información capturada de los titulares y de la alta gerencia incluya:\n     a) Nombre completo\n     b) Domicilio\n     c) Fecha de nacimiento ",null,"Obligatorio urgente","Obligatorio","Agent",null,null,"3","3.1","3.1.1",null,"3.1.1.5",null,"GSMA RMT (AG-02)","3.1.1.5.1",null,null,null,"ReqU4","Req4","Agent",null,null,null,null,null,null,null,"MERGE","3.1.1.7.1","3.1.1.7.2",null,null,{"$error":"#REF!"},{"$error":"#REF!"},"","",{"$error":"#REF!"},{"$error":"#REF!"},"","",2,"",{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,2,""]
[null,"3","3.1","3.1.1",{"$f":"CHOOSE(LanguageNumber,AY21,BP21,CF21,CV21)","v":""},{"$f":"AZ21","v":"3.1.1.5"},null,{"$f":"BB21","v":0},{"$f":"BC21","v":"3.1.1.5.2"},"3.1.1.5.2: Are master agents contractually required to supply due diligence information on their agents to the provider?\n",{"$f":"CHOOSE(LanguageNumber,BF21,BV21,CL21,DB21)","v":"1) Agent due diligence process\n-Check that the process requires master agents to collect and supply due diligence information on their individual agents.\n\n2) Master agents contracts\n- Check master agents contract contains a clause requiring them to supply due diligence information on their individual agents."},0,{"$f":"CHOOSE(LanguageNumber,BH21,BX21,CN21,DD21)","v":"Standard Required"},{"$f":"CHOOSE(LanguageNumber,BI21,BY21,CO21,DE21)","v":"Required"},"Agent",{"$f":"CHOOSE(LanguageNumber,BK21,CA21,CQ21,DG21)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.1","3.1.1","","3.1.1.5",null,null,"3.1.1.5.2",{"$f":"DO21","v":"3.1.1.7.4"},"Are master agents contractually required to supply due diligence information on their agents to the provider?","1) Agent due diligence process\n-Check that the process requires master agents to collect and supply due diligence information on their individual agents.\n\n2) Master agents contracts\n- Check master agents contract contains a clause requiring them to supply due diligence information on their individual agents.",null,"Standard Required","Required","Agent",null,null,"3","3.1","3.1.1","","3.1.1.5",null,null,"3.1.1.5.2","les agents principaux ont-ils l'obligation contractuelle de fournir au prestataire les informations relatives au contrôle de vigilance de chaque agent individuel ?","1) Processus de vigilance à l’égard des agents\n- Vérifier que le processus prévoit l’obligation pour les agents principaux de recueillir et fournir les informations relatives au contrôle de vigilance de leurs agents individuels.\n\n2) Contrats des agents principaux\n- Vérifier que les contrats des agents principaux contiennent une clause stipulant qu’ils sont dans l’obligation de fournir les informations relatives au contrôle de vigilance de leurs agents individuels.",null,"Requis Normal","Requis","Agent",0,null,"3","3.1","3.1.1","","3.1.1.5",null,null,"3.1.1.5.2","¿Los agentes maestros deben, por contrato, suministrar al proveedor la información de debida diligencia de sus agentes?","1) Proceso de debida diligencia de los agentes\n-Verificar que el proceso requiera que los agentes maestros recolecten y suministren la información de debida diligencia de sus agentes individuales.\n\n2) Contratos de agentes maestros\n- Verificar que el contrato de los agentes maestros contenga una cláusula exigiéndoles que suministren la información de debida diligencia de sus agentes individuales.",null,"Obligatorio estándar","Obligatorio","Agent",null,null,"3","3.1","3.1.1",null,"3.1.1.5",null,null,"3.1.1.5.2",null,null,null,"ReqS4","Req4","Agent",null,null,null,null,null,null,null,null,"3.1.1.7.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",{"$f":"COUNTIF($DS21:$DV21,EH$3)","v":0},0,0,0,0,1,""]
[null,"3","3.1","3.1.1","","3.1.1.5",null,0,"3.1.1.5.3","3.1.1.5.3: Are owners of all agents screened using watchlists?\n","1) Agent Due Diligence Process\n- Check that the process includes the screening of owners of individual agents against watch lists.\n- Check that the selected watch list include at a minimum the lists required for customer screening.\n- Check that the process include the identification and management of politically exposed persons.",0,"Standard Required","Required","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.1","3.1.1","","3.1.1.5",null,null,"3.1.1.5.3","3.1.1.7.5","Are owners of all agents screened using watchlists?","1) Agent Due Diligence Process\n- Check that the process includes the screening of owners of individual agents against watch lists.\n- Check that the selected watch list include at a minimum the lists required for customer screening.\n- Check that the process include the identification and management of politically exposed persons.",null,"Standard Required","Required","Agent",null,null,"3","3.1","3.1.1","","3.1.1.5",null,null,"3.1.1.5.3","Les propriétaires de chaque agent sont-elles contrôlées à l’aide de listes de surveillance ?","1) Processus de vigilance à l’égard des agents\n- Vérifiez que le processus comprend le contrôle des propriétaires des agents individuels par rapprochement avec les listes de surveillance\n- Vérifier que la liste de surveillance sélectionnée inclut au minimum les listes nécessaires pour le contrôle des clients.\n- Vérifier que le processus inclut l’identification et la gestion des personnes politiquement exposées.",null,"Requis Normal","Requis","Agent",0,null,"3","3.1","3.1.1","","3.1.1.5",null,null,"3.1.1.5.3","¿Los titulares de todos los agentes son analizados utilizando listas de control?","1) Proceso de Debida Diligencia de los Agentes\n- Verificar que el proceso incluya el análisis de los titulares de los agentes individuales en base a las listas de control.\n- Verificar que la lista de control seleccionada incluya, como mínimo, las listas requeridas para el análisis de clientes.\n- Verificar que el proceso incluya la identificación y la gestión de las personas expuestas políticamente.",null,"Obligatorio estándar","Obligatorio","Agent",null,null,"3","3.1","3.1.1",null,"3.1.1.5",null,null,"3.1.1.5.3",null,null,null,"ReqS4","Req4","Agent",null,null,null,null,null,null,null,null,"3.1.1.7.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.1","3.1.1","","3.1.1.5",null,0,"3.1.1.5.4","3.1.1.5.4: Is a copy obtained of each agent's certificate of trading / tax certificate / similar business entity document (if required by regulation or risk assessment)?\n",0,0,"Recommended","Recommended","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.1","3.1.1","","3.1.1.5",null,null,"3.1.1.5.4","3.1.1.7.3","Is a copy obtained of each agent's certificate of trading / tax certificate / similar business entity document (if required by regulation or risk assessment)?",null,null,"Recommended","Recommended","Agent",null,null,"3","3.1","3.1.1","","3.1.1.5",0,0,"3.1.1.5.4","une copie de l'inscription au registre du commerce, attestation fiscale ou autre justificatif d’enregistrement de l’entreprise (si la réglementation ou l’évaluation des risques l’exige) est-elle obtenue pour chaque agent individuel ?",null,null,"Recommandé","Recommandé","Agent",0,null,"3","3.1","3.1.1","","3.1.1.5",null,0,"3.1.1.5.4","¿Se obtiene una copia del certificado mercantil / certificado de impuestos / documento de la entidad de comercio similar de cada agente (si fuese requerido por la regulación o la evaluación de riesgos)?",null,null,"Recomendado","Recomendado","Agent",null,null,"3","3.1","3.1.1",null,"3.1.1.5",null,0,"3.1.1.5.4",null,null,null,"Rec4","Rec4","Agent",null,null,null,null,null,null,null,null,"3.1.1.7.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.1","3.1.1","","3.1.1.6","3.1.1.6: AGENT DUE DILIGENCE FREQUENCY AND RECORDS\nDue diligence checks should be performed at intervals specified in the agent due diligence policy. This should be every two years at a minimum.\n\nThe provider should maintain the following agent due diligence records:\n- Records of agent due diligence conducted\n- Copies of all documentation collected during due diligence\nRecords should be kept for a period determined by regulation or risk assessment, whichever is longer. FATF recommends that records be kept for a minimum of five years, either physically or electronically (or both). ","GSMA RMT","3.1.1.6.1","3.1.1.6.1: Are due diligence checks performed on all agents every two years at a minimum?\n",0,0,"Recommended","Recommended","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.1","3.1.1","","3.1.1.6","AGENT DUE DILIGENCE FREQUENCY AND RECORDS\nDue diligence checks should be performed at intervals specified in the agent due diligence policy. This should be every two years at a minimum.\n\nThe provider should maintain the following agent due diligence records:\n- Records of agent due diligence conducted\n- Copies of all documentation collected during due diligence\nRecords should be kept for a period determined by regulation or risk assessment, whichever is longer. FATF recommends that records be kept for a minimum of five years, either physically or electronically (or both). ","GSMA RMT","3.1.1.6.1","3.1.1.8.1","Are due diligence checks performed on all agents every two years at a minimum?",null,null,"Recommended","Recommended","Agent",null,null,"3","3.1","3.1.1","","3.1.1.6","VIGILANCE À L'ÉGARD DES AGENTS - PÉRIODICITÉ ET REGISTRES\nLes contrôles de vigilance doivent être effectués selon la périodicité définie par la politique de vigilance à l’égard des agents. Cette périodicité doit être de deux ans au minimum.\n\nLe prestataire doit conserver les registres suivants de vigilance à l’égard des agents :\n- dossiers des vérifications effectuées ; \n- copie de tous les documents collectés dans le cadre de ces vérifications.\nLes registres doivent être conservés aussi longtemps que l'exige la réglementation ou l'évaluation des risques. Le GAFI recommande que ces registres soient conservés pour une durée d'au moins cinq ans, que ce soit physiquement ou sous forme électronique (ou les deux).","GSMA RMT","3.1.1.6.1","un contrôle de vigilance est-il effectué au moins tous les deux ans sur l'ensemble des agents ?",null,null,"Recommandé","Recommandé","Agent",0,null,"3","3.1","3.1.1","","3.1.1.6","FRECUENCIA Y REGISTROS DE LA DEBIDA DILIGENCIA DE LOS AGENTES\nLas verificaciones de debida diligencia se deben realizar a intervalos especificados en la política de debida diligencia de los agentes. Deben ser, como mínimo, cada dos años.\n\nEl proveedor debe mantener los siguientes registros de debida diligencia de los agentes:\n- Registros de la debida diligencia de los agentes realizada\n- Copias de toda la documentación recolectada durante la debida diligencia\nSe deben conservar los registros durante el que resulte mayor entre el período que determine la regulación o la evaluación de riegos. El GAFI recomienda que se conserven los registros por un período mínimo de cinco años, ya sea en medios físicos o electrónicos (o ambos). ","GSMA RMT","3.1.1.6.1","¿Se realizan verificaciones de debida diligencia de todos los agentes, como mínimo, cada dos años?",null,null,"Recomendado","Recomendado","Agent",null,null,"3","3.1","3.1.1",null,"3.1.1.6",null,"GSMA RMT","3.1.1.6.1",null,null,null,"Rec4","Rec4","Agent",null,null,null,null,null,null,null,null,"3.1.1.8.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.1","3.1.1","","3.1.1.6",null,0,"3.1.1.6.2","3.1.1.6.2: Are agent due diligence records kept for at least five years, including KYC records and records of due diligence conducted?\n",0,0,"Recommended","Recommended","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.1","3.1.1","","3.1.1.6",null,null,"3.1.1.6.2","3.1.1.8.2","Are agent due diligence records kept for at least five years, including KYC records and records of due diligence conducted?",null,null,"Recommended","Recommended","Agent",null,null,"3","3.1","3.1.1","","3.1.1.6",0,0,"3.1.1.6.2","les registres de contrôle de vigilance à l'égard des agents sont-ils conservés pendant au moins cinq ans, y compris les renseignements d'identité et les dossiers des vérifications effectuées ?",null,null,"Recommandé","Recommandé","Agent",0,null,"3","3.1","3.1.1","","3.1.1.6",null,0,"3.1.1.6.2","¿Los registros de debida diligencia de los agentes se conservan durante, al menos, cinco años, incluyendo los registros de conocimiento del cliente (CSC) y los registros de la debida diligencia realizada?",null,null,"Recomendado","Recomendado","Agent",null,null,"3","3.1","3.1.1",null,"3.1.1.6",null,0,"3.1.1.6.2",null,null,null,"Rec4","Rec4","Agent",null,null,null,null,null,null,null,null,"3.1.1.8.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.1","3.1.1","","3.1.1.7",{"$f":"AZ26&\": \"&CHOOSE(LanguageNumber,BA26,BR26,CH26,CX26)","v":"3.1.1.7: DUE DILIGENCE ON ENTITIES PROVIDING OUTSOURCED SERVICES\nProviders should carry out due diligence on entities providing outsourced services before they start operation and regularly thereafter (every two years at a minimum).\n\nThe due diligence requirements should be documented and regularly reviewed and updated as needed, such as when changes are made to the service or regulation. \n\nAt a minimum the following checks should be included:\n- The entity must be able to provide outsourced services effectively and reliably;\n- The entity should be qualified to provide the particular service: the provider should check appropriate documentation to confirm this;\n- The entity should have a good reputation: the provider could request client references to confirm this;\n- The entity should understand and be able to meet the provider’s objectives: this should be confirmed by written confirmation from the entity;\n- The entity should have proper risk management policies and controls in place: the provider should review the risk management documentation;\n- The entity should have the financial soundness to meet its obligations: Provider should check that the partner is financially solvent, with sufficient capital reserves to underwrite its level of operations.\n\nThe provider should maintain the following due diligence records:\n- Records of due diligence conducted on entities providing outsourced services;\n- Copies of all documentation collected during due diligence.\nRecords should be kept for a period determined by regulation or risk assessment, whichever is longer. FATF recommends that records be kept for a minimum of five years after termination, either physically or electronically (or both)."},"GSMA RMT\nBCBS OFS","3.1.1.7.1","3.1.1.7.1: Is due diligence carried out on all entities providing outsourced services for core mobile money functions before they start operation?\n","1) Outsourcing due diligence requirements, process or similar documentation \n- Check that due diligence requirements are documented for entities providing outsourced services for core mobile money functions.\n- Check that there is a process to perform due diligence on these outsourcing entities before their services become operational.\n",0,"Urgent Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.1","3.1.1","","3.1.1.7","DUE DILIGENCE ON ENTITIES PROVIDING OUTSOURCED SERVICES\nProviders should carry out due diligence on entities providing outsourced services before they start operation and regularly thereafter (every two years at a minimum).\n\nThe due diligence requirements should be documented and regularly reviewed and updated as needed, such as when changes are made to the service or regulation. \n\nAt a minimum the following checks should be included:\n- The entity must be able to provide outsourced services effectively and reliably;\n- The entity should be qualified to provide the particular service: the provider should check appropriate documentation to confirm this;\n- The entity should have a good reputation: the provider could request client references to confirm this;\n- The entity should understand and be able to meet the provider’s objectives: this should be confirmed by written confirmation from the entity;\n- The entity should have proper risk management policies and controls in place: the provider should review the risk management documentation;\n- The entity should have the financial soundness to meet its obligations: Provider should check that the partner is financially solvent, with sufficient capital reserves to underwrite its level of operations.\n\nThe provider should maintain the following due diligence records:\n- Records of due diligence conducted on entities providing outsourced services;\n- Copies of all documentation collected during due diligence.\nRecords should be kept for a period determined by regulation or risk assessment, whichever is longer. FATF recommends that records be kept for a minimum of five years after termination, either physically or electronically (or both).","GSMA RMT\nBCBS OFS","3.1.1.7.1","3.1.1.9.1","Is due diligence carried out on all entities providing outsourced services for core mobile money functions before they start operation?","1) Outsourcing due diligence requirements, process or similar documentation \n- Check that due diligence requirements are documented for entities providing outsourced services for core mobile money functions.\n- Check that there is a process to perform due diligence on these outsourcing entities before their services become operational.\n",null,"Urgent Required","Required","BizOps",null,null,"3","3.1","3.1.1","","3.1.1.7","VIGILANCE À L'ÉGARD DES ENTITÉS ASSURANT DES SERVICES DE SOUS-TRAITANCE\nLes prestataires doivent avoir une politique de vigilance à l'égard des entités assurant des services de sous-traitance avant le début de leur interventation et périodiquement par la suite (au moins tous les deux ans).\n\nLes exigences en matière de vigilence doivent être documentées, examinées régulièrement et mises à jour si besoin, notamment lorsque des modifications sont apportées au service ou à la règlementation,\n\nCes vérifications doivent au minimum confirmer que :\n- l’entité est capable de fournir les services externalisés de façon fiable et efficace ; \n- l’entité est qualifiée pour fournir le service en question – le prestataire doit vérifier la documentation appropriée pour s’en assurer ; \n- l’entité doit avoir bonne réputation – le prestataire peut demander des références commerciales pour s’en assurer ;\n- l’entité doit comprendre les objectifs du prestataire et être capable de les réaliser, et en faire fournir la confirmation écrite au prestataire ; \n- l’entité doit avoir des politiques et des systèmes appropriés de contrôle du risque – le prestataire doit examiner la documentation relative à la gestion du risque ;\n- l’entité doit avoir la solidité financière requise pour s’acquitter de ses obligations – le prestataire doit vérifier que son partenaire est solvable et dispose de capitaux suffisants pour financer son niveau d’activité.\n\nLe prestataire doit maintenir les registres de contrôle de vigilance suivants :\n- Registre des contrôles de vigilance à l'égard des entités fournissant des services de sous-traitance ;\n- Copie de tous les documents collectés dans le cadre de ces vérifications.\nLes registres doivent être conservés aussi longtemps que l'exige la réglementation ou l'évaluation des risques. Le GAFI recommande que ces registres soient conservés pour une durée d'au moins cinq ans, que ce soit physiquement ou sous forme électronique (ou les deux). \n\n","GSMA RMT\nBCBS OFS","3.1.1.7.1","existe-t-il une politique de vigilance à l'égard des entités assurant des services de sous-traitance pour les fonctions de base de l'argent mobile, mise en oeuvre avant le début de leur intervention ?","1) Exigences ou processus de vigilance relative à la sous-traitance ou documentation similaire\n- Vérifier que des exigences sont définies en ce qui concerne la vigilance à l’égard des entités assurant des services de sous-traitance pour les fonctions de base de l’argent mobile.\n- Vérifier qu’un processus a été mis en place afin de contrôler ces entités assurant des services de sous-traitance avant le début de leur intervention.\n",null,"Requis Prioritaire","Requis","BizOps",0,null,"3","3.1","3.1.1","","3.1.1.7","DEBIDA DILIGENCIA DE LAS ENTIDADES QUE PRESTAN SERVICIOS TERCERIZADOS\nLos proveedores deben llevar a cabo la debida diligencia de las entidades que prestan servicios tercerizados antes de iniciar las operaciones y regularmente después del inicio de las mismas (como mínimo, cada dos años).\n\nLos requisitos de debida diligencia deben estar documentados y deben ser regularmente revisados y actualizados, según sea necesario, por ejemplo cuando se realizan cambios al servicio o a la regulación. \n\nSe deben incluir, como mínimo, las siguientes verificaciones:\n- La entidad debe poder prestar servicios tercerizados de forma efectiva y confiable;\n- La entidad debe estar calificada para prestar el servicio en particular: el proveedor debe verificar la documentación correspondiente para confirmarlo;\n- La entidad debe tener una buena reputación: el proveedor podría solicitar referencias de clientes para confirmarlo;\n- La entidad debe comprender y poder cumplir con los objetivos del proveedor: esto debe ser confirmado por escrito por parte de la entidad;\n- La entidad debe contar con las políticas de gestión de riesgos y los controles adecuados: el proveedor debe revisar la documentación de gestión de riesgos;\n- La entidad debe tener la solidez financiera para cumplir con sus obligaciones: el proveedor debe verificar que el socio sea financieramente solvente, con suficientes reservas de capital para garantizar su nivel de operaciones.\n\nEl proveedor debe mantener los siguientes registros de debida diligencia:\n- Registros de la debida diligencia realizada sobre las entidades que prestan servicios tercerizados;\n- Copias de toda la documentación recolectada durante la debida diligencia.\nLos registros se deben conservar durante el que resulte mayor entre el período que determine la regulación o la evaluación de riesgos. El GAFI recomienda que se conserven los registros por un período mínimo de cinco años después de la terminación del empleo, ya sea en medios físicos o electrónicos (o ambos).","GSMA RMT\nBCBS OFS","3.1.1.7.1","¿Se lleva a cabo la debida diligencia de todas las entidades que prestan servicios tercerizados para las funciones centrales del dinero móvil antes de iniciar las operaciones?","1) Requisitos, proceso o documentación similar de debida diligencia para tercerización\n- Verificar que los requisitos de debida diligencia estén documentados para las entidades que prestan servicios tercerizados para las funciones centrales del dinero móvil.\n- Verificar que exista un proceso para realizar la debida diligencia sobre estas entidades de tercerización antes del inicio de sus servicios.\n",null,"Obligatorio urgente","Obligatorio","BizOps",null,null,"3","3.1","3.1.1",null,"3.1.1.7",null,"GSMA RMT\nBCBS OFS","3.1.1.7.1",null,null,null,"ReqU4","Req4","BizOps",null,null,null,null,null,null,null,null,"3.1.1.9.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.1","3.1.1","","3.1.1.7",null,0,"3.1.1.7.2","3.1.1.7.2: Are checks done (e.g. review qualifications or documentation) to ensure that each entity providing outsourced services for core mobile money functions can provide its outsourced services effectively and reliably?\n",{"$f":"CHOOSE(LanguageNumber,BF27,BV27,CL27,DB27)","v":"1) Outsourcing due diligence requirements, process or similar documentation \n- Check that there is a process to ascertain that any outsourced entity carrying out core mobile money functions has appropriate skills to carry out the function effectively and reliably.\n"},0,"Standard Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.1","3.1.1","","3.1.1.7",null,null,"3.1.1.7.2","3.1.1.10.1","Are checks done (e.g. review qualifications or documentation) to ensure that each entity providing outsourced services for core mobile money functions can provide its outsourced services effectively and reliably?","1) Outsourcing due diligence requirements, process or similar documentation \n- Check that there is a process to ascertain that any outsourced entity carrying out core mobile money functions has appropriate skills to carry out the function effectively and reliably.\n",null,"Standard Required","Required","BizOps",null,null,"3","3.1","3.1.1","","3.1.1.7",null,0,"3.1.1.7.2","des contrôles sont-ils effectués (ex. examen des qualifications ou documentation) pour s'assurer que chaque entité assurant des services de sous-traitance a la capacité de le faire de facon fiable et efficace ?","1) Exigences ou processus de vigilance relative à la sous-traitance ou documentation similaire\n- Vérifier qu’un processus a été mis en place afin de s’assurer que chaque entité assurant des services de sous-traitance pour les fonctions de base de l’argent mobile a la capacité de le faire de façon fiable et efficace.\n",null,"Requis Normal","Requis","BizOps",0,null,"3","3.1","3.1.1","","3.1.1.7",null,0,"3.1.1.7.2","¿Se realizan verificaciones (por ej., revisión de calificaciones o documentación) para garantizar que cada entidad que presta servicios tercerizados para las funciones centrales del dinero móvil pueda prestar sus servicios tercerizados de forma efectiva y confiable?","1) Requisitos, proceso o documentación similar de debida diligencia para tercerización\n- Verificar que exista un proceso para comprobar que toda entidad tercerizada que lleva a cabo funciones del dinero móvil cuente con las habilidades adecuadas para llevar a cabo la función de forma efectiva y confiable.\n",null,"Obligatorio estándar","Obligatorio","BizOps",null,null,"3","3.1","3.1.1",null,"3.1.1.7",null,0,"3.1.1.7.2",null,null,null,"ReqS4","Req4","BizOps",null,null,null,null,null,null,null,null,"3.1.1.10.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.1","3.1.1","","3.1.1.7",null,0,"3.1.1.7.3","3.1.1.7.3: Are references checked to ensure that each entity providing outsourced services has a good reputation?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.1","3.1.1","","3.1.1.7",null,null,"3.1.1.7.3","3.1.1.10.2","Are references checked to ensure that each entity providing outsourced services has a good reputation?",null,null,"Recommended","Recommended","BizOps",null,null,"3","3.1","3.1.1","","3.1.1.7",null,0,"3.1.1.7.3","les références sont-elles vérifiées pour s'assurer de la bonne réputation de chaque entité fournissant des services de sous-traitance ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"3","3.1","3.1.1","","3.1.1.7",null,0,"3.1.1.7.3","¿Se verifican las referencias para garantizar que cada entidad que presta servicios tercerizados tenga una buena reputación?",null,null,"Recomendado","Recomendado","BizOps",null,null,"3","3.1","3.1.1",null,"3.1.1.7",null,0,"3.1.1.7.3",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"3.1.1.10.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.1","3.1.1","","3.1.1.7",null,0,"3.1.1.7.4","3.1.1.7.4: Are checks done to ensure that the entity providing outsourced services is financially solvent, with sufficient capital reserves to underwrite its level of operations?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.1","3.1.1","","3.1.1.7",null,null,"3.1.1.7.4","3.1.1.10.3","Are checks done to ensure that the entity providing outsourced services is financially solvent, with sufficient capital reserves to underwrite its level of operations?",null,null,"Recommended","Recommended","BizOps",null,null,"3","3.1","3.1.1","","3.1.1.7",null,0,"3.1.1.7.4","des vérifications sont-elles effectués pour s'assurer que chaque entité assurant des services de sous-traitance est solvable et dispose de capitaux suffisants pour financer son niveau d’activité?",null,null,"Recommandé","Recommandé","BizOps",0,null,"3","3.1","3.1.1","","3.1.1.7",null,0,"3.1.1.7.4","¿Se realizan verificaciones para garantizar que la entidad que presta servicios tercerizados sea financieramente solvente, con suficientes reservas de capital para garantizar su nivel de operaciones?",null,null,"Recomendado","Recomendado","BizOps",null,null,"3","3.1","3.1.1",null,"3.1.1.7",null,0,"3.1.1.7.4",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"3.1.1.10.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.1","3.1.1","","3.1.1.7",null,0,"3.1.1.7.5","3.1.1.7.5: Are due diligence checks performed on all entities providing outsourced services for core mobile money functions every two years at a minimum?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.1","3.1.1","","3.1.1.7",null,null,"3.1.1.7.5","3.1.1.11.1","Are due diligence checks performed on all entities providing outsourced services for core mobile money functions every two years at a minimum?",null,null,"Recommended","Recommended","BizOps",null,null,"3","3.1","3.1.1","","3.1.1.7",null,0,"3.1.1.7.5","des contrôle de vigilance sont-ils effectués au moins tous les deux ans sur l'ensemble des entités assurant des services de sous-traitance pour les fonctions de base de l'argent mobile ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"3","3.1","3.1.1","","3.1.1.7",null,0,"3.1.1.7.5","¿Se realizan verificaciones de debida diligencia de todas las entidades que prestan servicios tercerizados para las funciones centrales del dinero móvil, como mínimo, cada dos años?",null,null,"Recomendado","Recomendado","BizOps",null,null,"3","3.1","3.1.1",null,"3.1.1.7",null,0,"3.1.1.7.5",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"3.1.1.11.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.1","3.1.1","","3.1.1.7",null,0,"3.1.1.7.6","3.1.1.7.6: Are due diligence records for all entities providing outsourced services kept for at least five years after termination, including copies of all documentation collected and records of due diligence conducted?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.1","3.1.1","","3.1.1.7",null,null,"3.1.1.7.6","3.1.1.11.2","Are due diligence records for all entities providing outsourced services kept for at least five years after termination, including copies of all documentation collected and records of due diligence conducted?",null,null,"Recommended","Recommended","BizOps",null,null,"3","3.1","3.1.1","","3.1.1.7",null,0,"3.1.1.7.6","les registres de contrôle de vigilance à l'égard des entités fournissant des services de sous-traitance sont-ils conservés pendant au moins cinq ans après la cessation du contrat, avec copie de tous les documents collectés et dossiers des vérifications effectuées ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"3","3.1","3.1.1","","3.1.1.7",null,0,"3.1.1.7.6","¿Los registros de debida diligencia de todas las entidades que prestan servicios tercerizados se conservan durante, al menos, cinco años después de la terminación, incluyendo las copias de toda la documentación recolectada y los registros de la debida diligencia realizada?",null,null,"Recomendado","Recomendado","BizOps",null,null,"3","3.1","3.1.1",null,"3.1.1.7",null,0,"3.1.1.7.6",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"3.1.1.11.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3",0,0,{"$f":"UPPER(CONCATENATE(Introduction!C15,\": \",Introduction!D15))","v":"3.2: TRAINING OF STAﬀ AND AGENTS"},null,null,0,0,{"$f":"Introduction!E15","v":"Providers shall develop and implement training programmes for staff and agents"},null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,BK32,CA32,CQ32,DG32)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3",null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$15,\": \",Introduction!$L$15))","v":"3.2: TRAINING OF STAﬀ AND AGENTS"},null,null,null,null,null,{"$f":"Introduction!$M$15","v":"Providers shall develop and implement training programmes for staff and agents"},null,null,null,null,0,null,null,"3",0,0,null,null,null,null,null,null,null,null,null,null,0,null,null,"3",0,0,{"$f":"UPPER(CONCATENATE(Introduction!$U$15,\": \",Introduction!$V$15))","v":"3.2: CAPACITACIÓN PARA EL PERSONAL Y LOS AGENTES"},null,null,0,0,{"$f":"Introduction!W15","v":"El proveedor desarrollará e implementará programas de capacitación para el personal y los agentes"},null,null,null,null,null,null,null,"3",0,0,null,0,null,0,0,null,null,null,null,null,0]
[null,"3","3.2","3.2.1",{"$f":"CHOOSE(LanguageNumber,AY33,BP33,CF33,CV33)","v":"3.2.1: Providers shall develop and implement training programmes for staff"},{"$f":"AZ33","v":"3.2.1.1"},{"$f":"AZ33&\": \"&CHOOSE(LanguageNumber,BA33,BR33,CH33,CX33)","v":"3.2.1.1: STAFF TRAINING: REQUIREMENTS / POLICY\nThe Provider should document training requirements for mobile money staff. Staff should receive relevant initial training and ongoing additional training as needed according to their role.\nThe training requirements should be regularly reviewed and updated as needed, such as when changes are made to the service or regulation.\n"},"GSMA RMT","3.2.1.1.1",{"$f":"BC33&\": \"&CHOOSE(LanguageNumber,BE33,BU33,CK33,DA33)&CarriageReturn","v":"3.2.1.1.1: Is there documentation that describes the training requirements for mobile money staff (including initial and ongoing training), and is it regularly reviewed and updated as needed, such as when changes are made to the service or regulation?\n"},{"$f":"CHOOSE(LanguageNumber,BF33,BV33,CL33,DB33)","v":"1) Staff training plan, training material or similar training documentation\n- Check the training requirements are documented for mobile money staff\n- Check the documents include:\n     a) Initial training \n     b) on-going training\n- Check there is a process to revise training requirements when required - for example when changes are made to the services, or to local regulations.\n"},{"$f":"CHOOSE(LanguageNumber,BG33,BW33,CM33,DC33)","v":0},{"$f":"CHOOSE(LanguageNumber,BH33,BX33,CN33,DD33)","v":"Standard Required"},{"$f":"CHOOSE(LanguageNumber,BI33,BY33,CO33,DE33)","v":"Required"},"BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.2","3.2.1","3.2.1: Providers shall develop and implement training programmes for staff","3.2.1.1","STAFF TRAINING: REQUIREMENTS / POLICY\nThe Provider should document training requirements for mobile money staff. Staff should receive relevant initial training and ongoing additional training as needed according to their role.\nThe training requirements should be regularly reviewed and updated as needed, such as when changes are made to the service or regulation.\n","GSMA RMT","3.2.1.1.1","3.2.1.1.1","Is there documentation that describes the training requirements for mobile money staff (including initial and ongoing training), and is it regularly reviewed and updated as needed, such as when changes are made to the service or regulation?","1) Staff training plan, training material or similar training documentation\n- Check the training requirements are documented for mobile money staff\n- Check the documents include:\n     a) Initial training \n     b) on-going training\n- Check there is a process to revise training requirements when required - for example when changes are made to the services, or to local regulations.\n",null,"Standard Required","Required","BizOps",null,null,"3","3.2","3.2.1","3.2.1: Les prestataires doivent développer et mettre en place des programmes de formation de leur personnel.","3.2.1.1","FORMATION DU PERSONNEL : EXIGENCES / POLITIQUE\nLe Prestataire doit établir une documentation sur les exigences de formation pour le personnel de l’activité d'argent mobile. Le personnel doit recevoir une formation initiale et une formation continue supplémentaire adaptées aux exigences du poste occupé.\nLes exigences de formation doivent être régulièrement examinées et mises à jour au besoin, notamment en cas de changement dans le service ou la réglementation.\n","GSMA RMT","3.2.1.1.1","Existe-t-il une documentation qui décrit les exigences de formation pour le personnel de l’activité d'argent mobile (y compris la formation initiale et continue), et est-elle régulièrement examinée et mise à jour au besoin, notamment en cas de changement dans le service ou la réglementation ?","1) Plan de formation du personnel, supports de formation du personnel ou documentation de formation similaire\n- Vérifier que les exigences en matière de formation du personnel de l’argent mobile sont documentées\n- Vérifier que ces documents incluent :\na) la formation initiale \nb) la formation continue\n- Vérifier qu’un processus a été mis en place pour mettre à jour les exigences de formation lorsque nécessaire - par exemple lorsque des changements sont apportés aux services ou aux réglementations locales.\n",null,{"$f":"VLOOKUP($BH33,CategoryTranslationTable,2,FALSE)","v":"Requis Normal"},{"$f":"VLOOKUP($BI33,CategoryTranslationTable,2,FALSE)","v":"Requis"},"BizOps",0,null,"3","3.2","3.2.1","3.2.1: Los proveedores deben desarrollar e implementar programas de capacitación para el personal","3.2.1.1","CAPACITACIÓN DEL PERSONAL: REQUISITOS / POLÍTICA\nEl proveedor debe documentar los requisitos de capacitación para el personal del dinero móvil. El personal debe recibir la capacitación inicial correspondiente y capacitación adicional continua según sea necesario conforme a sus roles.\nLos requisitos de capacitación deben estar documentados y deben ser regularmente revisados y actualizados, según sea necesario, por ejemplo cuando se realizan cambios al servicio o a la regulación.\n","GSMA RMT","3.2.1.1.1","¿Existe documentación que describa los requisitos de capacitación para el personal del dinero móvil (incluyendo capacitación inicial y continua), y esta documentación es regularmente revisada y actualizada, según sea necesario, por ejemplo cuando se realizan cambios al servicio o a la regulación?","1) Plan de capacitación del personal, material de capacitación o documentación de capacitación similar\n- Verificar que los requisitos de capacitación estén documentados para el personal del dinero móvil\n- Verificar que los documentos incluyan:\n     a) Capacitación inicial\n     b) capacitación continua\n- Verificar que exista un proceso para revisar los requisitos de capacitación, cuando sea requerido, por ejemplo, después de que se realicen cambios a los servicios o a las regulaciones locales.\n",null,{"$f":"VLOOKUP($BH33,CategoryTranslationTable,3,FALSE)","v":"Obligatorio estándar"},{"$f":"VLOOKUP($BI33,CategoryTranslationTable,3,FALSE)","v":"Obligatorio"},"BizOps",null,null,"3","3.2","3.2.1",null,"3.2.1.1",null,"GSMA RMT","3.2.1.1.1",null,null,null,{"$f":"VLOOKUP($BH33,CategoryTranslationTable,4,FALSE)","v":"ReqS4"},{"$f":"VLOOKUP($BI33,CategoryTranslationTable,4,FALSE)","v":"Req4"},"BizOps",null,null,null,null,null,null,null,null,"3.2.1.1.1",null,null,null,{"$f":"IF(OR($EA33=0,$EA33=2),VLOOKUP(DO33,INDIRECT(ED33),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP33),\"\",VLOOKUP(DP33,INDIRECT(EE33),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ33),\"\",VLOOKUP(DQ33,INDIRECT(EF33),7,FALSE))","v":""},"",{"$f":"IF(OR($EA33=0,$EA33=2),VLOOKUP(DO33,INDIRECT(ED33),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP33),\"\",VLOOKUP(DP33,INDIRECT(EE33),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ33),\"\",VLOOKUP(DQ33,INDIRECT(EF33),8,FALSE))","v":""},"",{"$f":"1*AND(LEFT(DN33,3)=\"NEW\")+2*AND(LEFT(DN33,3)=\"MER\")+3*AND(LEFT(DN33,3)=\"MOV\")+4*AND(LEFT(DN33,3)=\"SWA\")","v":0},{"$error":"#REF!"},{"$f":"IF(EA33=0,IF(DW33=0,\"\",DW33),CHOOSE(EA33,\"New indicator\",CONCATENATE(DW33,CarriageReturn,DX33,CarriageReturn,DY33,CarriageReturn,DZ33)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO33,1)","v":"OriginalComplianceP3"},{"$f":"\"OriginalComplianceP\"&LEFT(DP33,1)","v":"OriginalComplianceP"},"OriginalComplianceP","OriginalComplianceP",{"$f":"COUNTIF($DS33:$DV33,EH$3)","v":0},0,0,0,0,1,{"$f":"IF(OR(AND(EH33>0,SUM(EI33:EL33)>0),EK33>0),\"Partial\",IF(EH33=EM33,\"Yes\",IF(EI33=EM33,\"No\",IF(EJ33=EM33,\"N/A\",IF(EK33=EM33,\"Partial\",IF(EL33=EM33,\"\",\"\"))))))","v":""}]
[null,"3","3.2","3.2.1",0,"3.2.1.2",{"$f":"AZ34&\": \"&CHOOSE(LanguageNumber,BA34,BR34,CH34,CX34)","v":"3.2.1.2: STAFF TRAINING: PROCESS\nThe Provider should implement a process to train all new staff in mobile money and their role. The training should include, at a minimum:\n- the details of carrying out their role, the potential failure points and the implications for the business and its customers; and\n- the provider's mobile money business.\n\nRefresher training should be performed at intervals specified in the staff training policy. This should be every two years at a minimum. Training should also be conducted when staff change roles or when there are changes to the mobile money service that affect their role.\n\nWhen relevant to the role, staff should be trained in AML/CFT procedures and in anti-fraud measures (see 2.6.1)."},"GSMA RMT","3.2.1.2.1","3.2.1.2.1: Are employees trained in (i) the details of carrying out their role, and (ii) the provider's mobile money business?\n","1) Staff training plan, training material or similar training documentation\n- Check the staff training content includes:\na) details of carrying out their role\nb) the providers mobile money business\n\n\n",0,"Urgent Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.2","3.2.1",null,"3.2.1.2","STAFF TRAINING: PROCESS\nThe Provider should implement a process to train all new staff in mobile money and their role. The training should include, at a minimum:\n- the details of carrying out their role, the potential failure points and the implications for the business and its customers; and\n- the provider's mobile money business.\n\nRefresher training should be performed at intervals specified in the staff training policy. This should be every two years at a minimum. Training should also be conducted when staff change roles or when there are changes to the mobile money service that affect their role.\n\nWhen relevant to the role, staff should be trained in AML/CFT procedures and in anti-fraud measures (see 2.6.1).","GSMA RMT","3.2.1.2.1","3.2.1.2.1","Are employees trained in (i) the details of carrying out their role, and (ii) the provider's mobile money business?","1) Staff training plan, training material or similar training documentation\n- Check the staff training content includes:\na) details of carrying out their role\nb) the providers mobile money business\n\n\n",null,"Urgent Required","Required","BizOps",null,null,"3","3.2","3.2.1",0,"3.2.1.2","FORMATION DU PERSONNEL : PROCESSUS\nLe prestataire doit mettre en œuvre un processus de formation de tous les nouveaux collaborateurs. Cette formation doit couvrir au minimum :\n- le détail de leur fonction, les points de défaillance possible et les conséquences pour l’entreprise et ses clients ;\n- l’activité d’argent mobile du prestataire.\n\nDes formations de rappel doivent être dispensées selon la périodicité définie par la politique de formation du personnel, et au minimum tous les deux ans. La formation doit également avoir lieu en cas de changement de fonction des collaborateurs ou de modification du service de l’argent mobile affectant leur fonction.\n\nLorsque cela s’applique à leurs fonctions, les collaborateurs doivent être formés aux procédures de lutte contre le blanchiment de capitaux et le financement du terrorisme et aux mesures anti-fraude.","GSMA RMT","3.2.1.2.1","les collaborateurs sont-ils formés (a) au détail de leur fonction et (b) à l'activité d'argent mobile du prestataire ?","1) Plan de formation du personnel, supports de formation du personnel ou documentation de formation similaire\n- Vérifier que les formations du personnel incluent des informations sur :\na) le détail des fonctions des personnes concernées\nb) l’activité d’argent mobile du prestataire\n\n\n",null,"Requis Prioritaire","Requis","BizOps",0,null,"3","3.2","3.2.1",null,"3.2.1.2","CAPACITACIÓN DEL PERSONAL: PROCESO\nEl proveedor debe implementar un proceso para capacitar a todo el personal nuevo sobre el dinero móvil y sus roles. La capacitación debe incluir, como mínimo:\n- los detalles para desempeñar sus roles, los puntos de falla críticos y las implicancias para el negocio y sus clientes; y\n- el negocio del dinero móvil del proveedor.\n\nSe deben brindar actualizaciones de capacitación a intervalos especificados en la política de capacitación del personal. Deben ser, como mínimo, cada dos años. También se debe brindar capacitación cuando el personal cambia de roles o cuando se realizan cambios al servicio del dinero móvil que afectan sus roles.\n\nCuando corresponda según el rol, el personal debe ser capacitado sobre los procedimientos ALA/LFT y las medidas contra el fraude (ver 2.6.1).","GSMA RMT","3.2.1.2.1","¿Se brinda capacitación al personal sobre (i) los detalles para desempeñar sus roles, y (ii) el negocio del dinero móvil del proveedor?","1) Plan de capacitación del personal, material de capacitación o documentación de capacitación similar\n- Verificar que el contenido de capacitación del personal incluya:\na) detalles para desempeñar sus roles\nb) el negocio del dinero móvil del proveedor\n\n\n",null,"Obligatorio urgente","Obligatorio","BizOps",null,null,"3","3.2","3.2.1",null,"3.2.1.2",null,"GSMA RMT","3.2.1.2.1",null,null,null,"ReqU4","Req4","BizOps",null,null,null,null,null,null,null,null,"3.2.1.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.2","3.2.1","","3.2.1.2",null,0,"3.2.1.2.2","3.2.1.2.2: Is refresher training (for mobile money and their specific role) performed for staff every two years at a minimum?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.2","3.2.1","","3.2.1.2",null,null,"3.2.1.2.2",{"$f":"DO35","v":"3.2.1.3.1"},"Is refresher training (for mobile money and their specific role) performed for staff every two years at a minimum?",null,null,"Recommended","Recommended","BizOps",null,null,"3","3.2","3.2.1","","3.2.1.2",null,0,"3.2.1.2.2","une formation de rappel est-elle dispensée au minimum tous les deux ans (sur l'argent mobile et la fonction spécifique de chaque collaborateur) ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"3","3.2","3.2.1","","3.2.1.2",null,0,"3.2.1.2.2","¿Se realizan actualizaciones de capacitación (sobre el dinero móvil y sus roles específicos) para el personal, como mínimo, cada dos años?",null,null,"Recomendado","Recomendado","BizOps",null,null,"3","3.2","3.2.1",null,"3.2.1.2",null,0,"3.2.1.2.2",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"3.2.1.3.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.2","3.2.1","","3.2.1.2",null,0,"3.2.1.2.3","3.2.1.2.3: Is training conducted when staff change roles and when there are changes to the mobile money service that affect their role?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.2","3.2.1","","3.2.1.2",null,null,"3.2.1.2.3","3.2.1.3.2","Is training conducted when staff change roles and when there are changes to the mobile money service that affect their role?",null,null,"Recommended","Recommended","BizOps",null,null,"3","3.2","3.2.1","","3.2.1.2",null,0,"3.2.1.2.3","une formation est-elle effectuée en cas de changement de fonction des collaborateurs ou de modification du service d'argent mobile affectant leur fonction ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"3","3.2","3.2.1","","3.2.1.2",null,0,"3.2.1.2.3","¿Se brinda capacitación cuando el personal cambia de roles y cuando se realizan cambios al servicio del dinero móvil que afectan sus roles?",null,null,"Recomendado","Recomendado","BizOps",null,null,"3","3.2","3.2.1",null,"3.2.1.2",null,0,"3.2.1.2.3",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"3.2.1.3.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.2","3.2.1","","3.2.1.3",{"$f":"AZ37&\": \"&CHOOSE(LanguageNumber,BA37,BR37,CH37,CX37)","v":"3.2.1.3: STAFF TRAINING: RECORDS\nThe provider should maintain records of all staff training conducted. Records should be kept for a period determined by regulation or risk assessment, whichever is longer. Records should be kept physically or electronically (or both). "},"GSMA RMT","3.2.1.3.1","3.2.1.3.1: Are all employees trained and are all training records kept for a suitable period?\n","1) Training records\n- Check records kept include:\n      a) Name of employee/unique ID\n      b) Training received\n      c) Assessment score (if any test is administered)\n      d) Date training completed\n- Check there is a timeline for the storage of the records.\n- Check records are aligned with the training plan.\n",0,"Standard Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.2","3.2.1","","3.2.1.3","STAFF TRAINING: RECORDS\nThe provider should maintain records of all staff training conducted. Records should be kept for a period determined by regulation or risk assessment, whichever is longer. Records should be kept physically or electronically (or both). ","GSMA RMT","3.2.1.3.1","3.2.1.4.1","Are all employees trained and are all training records kept for a suitable period?","1) Training records\n- Check records kept include:\n      a) Name of employee/unique ID\n      b) Training received\n      c) Assessment score (if any test is administered)\n      d) Date training completed\n- Check there is a timeline for the storage of the records.\n- Check records are aligned with the training plan.\n",null,"Standard Required","Required","BizOps",null,null,"3","3.2","3.2.1","","3.2.1.3","FORMATION DU PERSONNEL : REGISTRES\nLe prestataire doit conserver un registre de l’ensemble des formations dispensées au personnel. Ce registre doit être conservé aussi longtemps que l'exige la réglementation ou l'évaluation des risques, que ce soit physiquement ou sous forme électronique (ou les deux).","GSMA RMT","3.2.1.3.1","Tous les salariés sont-ils formés et tous les registres de formation sont-ils conservés pendant une période de temps suffisante ?","1) Registres de formation\n- Vérifier que les registres conservés contiennent :\n a) Le nom du salarié/une pièce d’identité unique\n b) La formation dispensée\n c) La note d’évaluation (si les salariés formés sont évalués suite à la formation)\n d) La date de fin de la formation\n- Vérifier que des exigences ont été définies concernant le délai de conservation des registres.\n- Vérifier que les informations contenues dans les registres correspondent au plan de formation.\n",null,"Requis Normal","Requis","BizOps",0,null,"3","3.2","3.2.1","","3.2.1.3","CAPACITACIÓN DEL PERSONAL: REGISTROS\nEl proveedor debe mantener registros de todos los cursos de capacitación del personal realizados. Los registros se deben conservar durante el período que determine la regulación o la evaluación de riesgos, cualquiera sea el período más largo. Los registros se deben conservar en medios físicos o electrónicos (o ambos). ","GSMA RMT","3.2.1.3.1","¿Se capacita a todos los empleados y se conservan los registros de capacitación durante un período adecuado?","1) Registros de capacitación\n- Verificar que los registros incluyan:\n      a) Nombre del empleado/ID único\n      b) Capacitación recibida\n      c) Puntaje de la evaluación (si se tomó un examen)\n      d) Fecha de finalización de la capacitación\n- Verificar que exista un plazo para el almacenamiento de los registros.\n- Verificar que los registros estén alineados al plan de capacitación.\n",null,"Obligatorio estándar","Obligatorio","BizOps",null,null,"3","3.2","3.2.1",null,"3.2.1.3",null,"GSMA RMT","3.2.1.3.1",null,null,null,"ReqS4","Req4","BizOps",null,null,null,null,null,null,null,null,"3.2.1.4.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.2","3.2.2","3.2.2: Providers shall develop and implement training programmes for agents","3.2.2.1",{"$f":"AZ38&\": \"&CHOOSE(LanguageNumber,BA38,BR38,CH38,CX38)","v":"3.2.2.1: TRAINING FOR AGENTS: REQUIREMENTS / POLICY\nThe provider should document a policy to carry out training of mobile money agents before their engagement and regularly thereafter. The agent training policy should be regularly reviewed and updated as needed, such as when changes are made to the service or regulation. "},"GSMA RMT","3.2.2.1.1","3.2.2.1.1: Is there documentation that describes the training requirements for mobile money agents (including initial and ongoing training), and is it regularly reviewed and updated as needed, such as when changes are made to the service or regulation?\n","1) Agent training plan, training material or similar training documentation\n- Check that training requirements are documented for agents\n- Check that the document includes:\n     a) Initial training \n     b) On-going training\n- Check that there is a process to revise training requirements when required - for example when changes are main to the services, or local regulations\n",0,"Urgent Required","Required","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.2","3.2.2","3.2.2: Providers shall develop and implement training programmes for agents","3.2.2.1","TRAINING FOR AGENTS: REQUIREMENTS / POLICY\nThe provider should document a policy to carry out training of mobile money agents before their engagement and regularly thereafter. The agent training policy should be regularly reviewed and updated as needed, such as when changes are made to the service or regulation. ","GSMA RMT","3.2.2.1.1","3.2.2.1.1","Is there documentation that describes the training requirements for mobile money agents (including initial and ongoing training), and is it regularly reviewed and updated as needed, such as when changes are made to the service or regulation?","1) Agent training plan, training material or similar training documentation\n- Check that training requirements are documented for agents\n- Check that the document includes:\n     a) Initial training \n     b) On-going training\n- Check that there is a process to revise training requirements when required - for example when changes are main to the services, or local regulations\n",null,"Urgent Required","Required","Agent",null,null,"3","3.2","3.2.2","3.2.2: Les prestataires doivent développer et mettre en place des programmes de formation de leurs agents.","3.2.2.1","FORMATION DES AGENTS : EXIGENCES / POLITIQUE\nLe prestataire doit avoir une politique documentée de formation des agents de l’argent mobile au moment de leur engagement et de façon périodique par la suite. La politique de formation des agents doit être régulièrement examinée et mise à jour au besoin, notamment en cas de changement dans le service ou la réglementation. ","GSMA RMT","3.2.2.1.1","Existe-t-il une documentation qui décrit les exigences de formation des agents de l’argent mobile (y compris la formation initiale et continue), et est-elle régulièrement examinée et mise à jour au besoin, notamment en cas de changement de la service ou la réglementation ?","1) Plan de formation des agents, supports de formation des agents ou documentation de formation similaire\n-Vérifier que les exigences en matière de formation des agents sont documentées\n- Vérifier que ces documents incluent :\na) la formation initiale \nb) la formation continue\n- Vérifier qu’un processus a été mis en place pour mettre à jour les exigences de formation lorsque nécessaire - par exemple lorsque des changements sont apportés aux services ou aux réglementations locales.\n",null,"Requis Prioritaire","Requis","Agent",0,null,"3","3.2","3.2.2","3.2.2: Los proveedores deben desarrollar e implementar programas de capacitación para los agentes","3.2.2.1","CAPACITACIÓN PARA LOS AGENTES: REQUISITOS / POLÍTICA\nEl proveedor debe documentar una política para llevar a cabo la capacitación de los agentes del dinero móvil antes de su contratación y con regularidad posteriormente. La política de capacitación de los agentes debe ser regularmente revisada y actualizada, según sea necesario, por ejemplo cuando se realizan cambios al servicio o a la regulación. ","GSMA RMT","3.2.2.1.1","¿Existe documentación que describa los requisitos de capacitación para los agentes del dinero móvil (incluyendo capacitación inicial y continua), y esta documentación es regularmente revisada y actualizada, según sea necesario, por ejemplo cuando se realizan cambios al servicio o a la regulación?","1) Plan de capacitación de los agentes, material de capacitación o documentación de capacitación similar\n- Verificar que los requisitos de capacitación estén documentados para los agentes\n- Verificar que los documentos incluyan:\n     a) Capacitación inicial\n     b) capacitación continua\n- Verificar que exista un proceso para revisar los requisitos de capacitación, cuando sea requerido, por ejemplo, cuando se realizan cambios a los servicios o a las regulaciones locales\n",null,"Obligatorio urgente","Obligatorio","Agent",null,null,"3","3.2","3.2.2",null,"3.2.2.1",null,"GSMA RMT","3.2.2.1.1",null,null,null,"ReqU4","Req4","Agent",null,null,null,null,null,null,null,null,"3.2.2.1.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.2","3.2.2",0,"3.2.2.2",{"$f":"AZ39&\": \"&CHOOSE(LanguageNumber,BA39,BR39,CH39,CX39)","v":"3.2.2.2: TRAINING FOR AGENTS: PROCESS\nThe Provider should implement a process to ensure all agents are trained. The training should include, at a minimum:\n- Liquidity management (see definition);\n- How to facilitate customer transactions;\n- AML/CFT procedures (see 2.6.1.1.2);\n- Anti-fraud measures (see 5.3.10.2);\n- Disclosure of fees; and\n- How to inform customers of their rights in the event of a complaint (see 7.1.2.1).\n\nProviders should monitor agents to ensure they are properly trained and to identify areas where further support is required (refer to 3.4). Refresher training should be performed at intervals specified in the agent training policy, and every two years at a minimum.\n\nTraining of all agents should also be conducted when there are changes to the mobile money service that affect agents."},"ISO 27015:2012 Sec. 12.1\nGSMA RMT (AG-08,\nAG-10,\nAG-11,\nAG-14,\nAG-17)","3.2.2.2.1","3.2.2.2.1: Are agents trained in the important aspects of operating as a mobile money agent, such as liquidity management (see definition), carrying out customer transactions, and key security measures?\n","1) Agent training plan, training material or similar training documentation\n- Check that the training content includes important aspects of operating as a mobile money agent such as liquidity management, customer registration (if applicable), cash in/out, etc.\n",0,"Urgent Required","Required","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.2","3.2.2",null,"3.2.2.2","TRAINING FOR AGENTS: PROCESS\nThe Provider should implement a process to ensure all agents are trained. The training should include, at a minimum:\n- Liquidity management (see definition);\n- How to facilitate customer transactions;\n- AML/CFT procedures (see 2.6.1.1.2);\n- Anti-fraud measures (see 5.3.10.2);\n- Disclosure of fees; and\n- How to inform customers of their rights in the event of a complaint (see 7.1.2.1).\n\nProviders should monitor agents to ensure they are properly trained and to identify areas where further support is required (refer to 3.4). Refresher training should be performed at intervals specified in the agent training policy, and every two years at a minimum.\n\nTraining of all agents should also be conducted when there are changes to the mobile money service that affect agents.","ISO 27015:2012 Sec. 12.1\nGSMA RMT (AG-08,\nAG-10,\nAG-11,\nAG-14,\nAG-17)","3.2.2.2.1","3.2.2.2.1","Are agents trained in the important aspects of operating as a mobile money agent, such as liquidity management (see definition), carrying out customer transactions, and key security measures?","1) Agent training plan, training material or similar training documentation\n- Check that the training content includes important aspects of operating as a mobile money agent such as liquidity management, customer registration (if applicable), cash in/out, etc.\n",null,"Urgent Required","Required","Agent",null,null,"3","3.2","3.2.2",0,"3.2.2.2","FORMATION DES AGENTS : PROCESSUS\nLe prestataire doit mettre en œuvre un processus garantissant que tous les agents soient formés. La formation des agents doit au minimum couvrir :\n- la gestion de la liquidité (voir définition) ;\n- la réalisation des opérations pour les clients ;\n- les procédures de lutte contre le blanchiment de capitaux et le financement du terrorisme (cf. 2.6.1.1.2);\n- les mesures anti-fraude (cf. 5.3.10.2);\n- la communication des tarifs ;\n- l’information des clients concernant leurs droits en cas de réclamation (cf. 7.1.2.1).\n\nLes prestataires doivent vérifier que les agents sont correctement formés, et identifier les domaines dans lesquels un accompagnement supplémentaire est nécessaire (cf. 3.4). Des sessions de perfectionnement doivent être réalisées à des intervalles de temps définis par la politique de formation des agents, avec un minimum de deux ans.\n\nLa formation de tous les agents doit également être réalisée lorsque des changements dans le service d'argent mobile ont des effets sur les agents.","ISO 27015:2012 Sec. 12.1\nGSMA RMT (AG-08,\nAG-10,\nAG-11,\nAG-14,\nAG-17)","3.2.2.2.1","les agents sont-ils formés aux aspects importants de leur activité en tant qu'agents de l'argent mobile, et notamment à la gestion de la liquidité (voir définition), à la réalisation des opérations pour les clients et aux mesures clés de sécurité ?","1) Plan de formation des agents, supports de formation des agents ou documentation de formation similaire\n- Vérifier que les formations des agents incluent des informations sur les aspects importants de leur activité en tant qu’agents de l’argent mobile, notamment la gestion de la liquidité, l’enregistrement des clients (le cas échéant), les dépôts/les débits, etc.\n",null,"Requis Prioritaire","Requis","Agent","Liquidité : les agents ont besoin à la fois d’argent électronique et d’argent liquide pour servir les clients, avec des encours suffisant de chaque : avec un niveau insuffisant d’argent électronique, les agents ne peuvent pas effectuer des opérations de dépôts d’espèces, et avec un niveau insuffisant d’argent liquide, les agents ne peuvent pas effectuer des opérations de retrait d’espèces. Les agents peuvent augmenter leur encaisse d’argent électronique en déposant de l’argent liquide auprès du prestataire. Par ailleurs, lorsqu’il existe des super-agents, les agents peuvent s’en servir pour gérer leur liquidité en échangeant des sommes d’argent électronique contre de l’argent liquide ou inversement.",null,"3","3.2","3.2.2",null,"3.2.2.2","CAPACITACIÓN PARA LOS AGENTES: PROCESO\nEl proveedor debe implementar un proceso para garantizar que todos los agentes sean capacitados. La capacitación debe incluir, como mínimo:\n- Gestión de liquidez (ver definición);\n- Cómo facilitar las transacciones de los clientes;\n- Procedimientos ALA/LFT (ver 2.6.1.1.2);\n- Medidas contra el fraude (ver 5.3.10.2);\n- Divulgación de tarifas; y\n- Cómo informar a los clientes sobre sus derechos en el caso de un reclamo (ver 7.1.2.1).\n\nLos proveedores deben monitorear a los agentes para garantizar que sean correctamente capacitados y para identificar áreas donde se requiere soporte adicional (ver 3.4). Se deben brindar actualizaciones de capacitación a intervalos especificados en la política de capacitación de los agentes, y como mínimo, cada dos años.\n\nTambién se debe brindar capacitación a todos los agentes cuando se realizan cambios al servicio del dinero móvil que afectan a los agentes.","ISO 27015:2012 Sec. 12.1\nGSMA RMT (AG-08,\nAG-10,\nAG-11,\nAG-14,\nAG-17)","3.2.2.2.1","¿Se brinda capacitación a los agentes sobre los aspectos importantes para operar como agentes del dinero móvil, como por ejemplo la gestión de liquidez (ver definición), la realización de las transacciones de los clientes y las medidas de seguridad clave?","1) Plan de capacitación de los agentes, material de capacitación o documentación de capacitación similar\n- Verificar que el contenido de la capacitación incluya los aspectos importantes para operar como agentes del dinero móvil, como por ejemplo, la gestión de liquidez, el registro de clientes (si corresponde), ingreso/retiro de efectivo, etc.\n",null,"Obligatorio urgente","Obligatorio","Agent",null,null,"3","3.2","3.2.2",null,"3.2.2.2",null,"ISO 27015:2012 Sec. 12.1\nGSMA RMT (AG-08,\nAG-10,\nAG-11,\nAG-14,\nAG-17)","3.2.2.2.1",null,null,null,"ReqU4","Req4","Agent",null,null,null,null,null,null,null,null,"3.2.2.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.2","3.2.2","","3.2.2.2",null,0,"3.2.2.2.2","3.2.2.2.2: Are agents trained in disclosure of fees?\n",0,0,"Recommended","Recommended","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.2","3.2.2","","3.2.2.2",null,null,"3.2.2.2.2","3.2.2.2.2","Are agents trained in disclosure of fees?",null,null,"Recommended","Recommended","Agent",null,null,"3","3.2","3.2.2","","3.2.2.2",0,0,"3.2.2.2.2","les agents sont-ils formés à la communication des tarifs ?",null,null,"Recommandé","Recommandé","Agent",0,null,"3","3.2","3.2.2","","3.2.2.2",null,0,"3.2.2.2.2","¿Se brinda capacitación a los agentes sobre la divulgación de tarifas?",null,null,"Recomendado","Recomendado","Agent",null,null,"3","3.2","3.2.2",null,"3.2.2.2",null,0,"3.2.2.2.2",null,null,null,"Rec4","Rec4","Agent",null,null,null,null,null,null,null,null,"3.2.2.2.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.2","3.2.2","","3.2.2.2",null,0,"3.2.2.2.3","3.2.2.2.3: Is refresher training performed at least every two years and whenever there are changes to the mobile money service that affect agents?\n",0,0,"Recommended","Recommended","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.2","3.2.2","","3.2.2.2",null,null,"3.2.2.2.3","3.2.2.3.2","Is refresher training performed at least every two years and whenever there are changes to the mobile money service that affect agents?",null,null,"Recommended","Recommended","Agent",null,null,"3","3.2","3.2.2","","3.2.2.2",null,0,"3.2.2.2.3","une formation de rappel est-elle effectuée au minimum tous les deux ans et chaque fois que des modifications du service d'argent mobile affectent les agent ?",null,null,"Recommandé","Recommandé","Agent",0,null,"3","3.2","3.2.2","","3.2.2.2",null,0,"3.2.2.2.3","¿Se brindan actualizaciones de capacitación, al menos, cada dos años y siempre que se realizan cambios al servicio del dinero móvil que afectan a los agentes?",null,null,"Recomendado","Recomendado","Agent",null,null,"3","3.2","3.2.2",null,"3.2.2.2",null,0,"3.2.2.2.3",null,null,null,"Rec4","Rec4","Agent",null,null,null,null,null,null,null,null,"3.2.2.3.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.2","3.2.2","","3.2.2.3",{"$f":"AZ42&\": \"&CHOOSE(LanguageNumber,BA42,BR42,CH42,CX42)","v":"3.2.2.3: TRAINING FOR AGENTS: RECORDS\nThe provider should maintain records of all agent training conducted. Records should be kept for a period determined by regulation or risk assessment, whichever is longer. Records should be kept physically or electronically (or both). \n"},"GSMA RMT","3.2.2.3.1","3.2.2.3.1: Are all agents trained and are all training records kept for a suitable period?\n","1) Training records\n- Check records kept include:\n      a) Name of agent/unique ID\n      b) Training received\n      c) Assessment score (if any test is administered)\n      d) Date training completed\n- Check there is a timeline for the storage of the records.\n- Check records are aligned with the training plan.\n",0,"Standard Required","Required","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.2","3.2.2","","3.2.2.3","TRAINING FOR AGENTS: RECORDS\nThe provider should maintain records of all agent training conducted. Records should be kept for a period determined by regulation or risk assessment, whichever is longer. Records should be kept physically or electronically (or both). \n","GSMA RMT","3.2.2.3.1","3.2.2.4.1","Are all agents trained and are all training records kept for a suitable period?","1) Training records\n- Check records kept include:\n      a) Name of agent/unique ID\n      b) Training received\n      c) Assessment score (if any test is administered)\n      d) Date training completed\n- Check there is a timeline for the storage of the records.\n- Check records are aligned with the training plan.\n",null,"Standard Required","Required","Agent",null,null,"3","3.2","3.2.2","","3.2.2.3","FORMATION DES AGENTS : REGISTRES\nLe prestataire doit conserver des registres de l’ensemble des formations dispensées aux agents. Ces registres doivent être conservés aussi longtemps que l'exige la réglementation ou l'évaluation des risques, que ce soit physiquement ou sous forme électronique (ou les deux).\n","GSMA RMT","3.2.2.3.1","Tous les agents sont-ils formés et tous les registres de formation sont-ils conservés pendant une période de temps suffisante ?","1) Registres de formation\n- Vérifier que les registres conservés contiennent :\n a) Le nom de l’agent/une pièce d’identité unique\n b) La formation dispensée\n c) La note d’évaluation (si les agents formés sont évalués suite à la formation)\n d) La date de fin de la formation\n- Vérifier que des exigences ont été définies concernant le délai de conservation des registres.\n- Vérifier que les informations contenues dans les registres correspondent au plan de formation.\n",null,"Requis Normal","Requis","Agent",0,null,"3","3.2","3.2.2","","3.2.2.3","CAPACITACIÓN PARA LOS AGENTES: REGISTROS\nEl proveedor debe mantener registros de todos los cursos de capacitación de los agentes realizados. Los registros se deben conservar durante el período que determine la regulación o la evaluación de riesgos, cualquiera sea el período más largo. Los registros se deben conservar en medios físicos o electrónicos (o ambos). \n","GSMA RMT","3.2.2.3.1","¿Se capacita a todos los agentes y se conservan los registros de capacitación durante un período adecuado?","1) Registros de capacitación\n- Verificar que los registros incluyan:\n      a) Nombre del agente/ID único\n      b) Capacitación recibida\n      c) Puntaje de la evaluación (si se tomó un examen)\n      d) Fecha de finalización de la capacitación\n- Verificar que exista un plazo para el almacenamiento de los registros.\n- Verificar que los registros alineados con el plan de capacitación.\n",null,"Obligatorio estándar","Obligatorio","Agent",null,null,"3","3.2","3.2.2",null,"3.2.2.3",null,"GSMA RMT","3.2.2.3.1",null,null,null,"ReqS4","Req4","Agent",null,null,null,null,null,null,null,null,"3.2.2.4.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3",0,0,{"$f":"UPPER(CONCATENATE(Introduction!C16,\": \",Introduction!D16))","v":"3.3: CONTRACTUAL AGREEMENTS"},null,null,0,0,{"$f":"Introduction!E16","v":"Providers shall establish written agreements governing their relationship with agents and entities providing outsourced services"},null,null,null,null,null,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3",null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$16,\": \",Introduction!$L$16))","v":"3.3: CONTRACTUAL AGREEMENTS"},null,null,null,null,null,{"$f":"Introduction!$M$16","v":"Providers shall establish written agreements governing their relationship with agents and entities providing outsourced services"},null,null,null,null,0,null,null,"3",0,0,null,0,null,0,0,"",null,null,null,null,0,null,null,"3",0,0,{"$f":"UPPER(CONCATENATE(Introduction!$U$16,\": \",Introduction!$V$16))","v":"3.3: ACUERDOS CONTRACTUALES"},null,null,0,0,{"$f":"Introduction!W16","v":"El proveedor establecerá acuerdos por escrito para regir la relación con los agentes y las entidades subcontratadas"},null,null,null,null,null,null,null,"3",0,0,null,0,null,0,0,null,null,null,null,null,0]
[null,"3","3.3","3.3.1",{"$f":"CHOOSE(LanguageNumber,AY44,BP44,CF44,CV44)","v":"3.3.1: Providers shall establish written agreements governing their relationship with agents and entities providing outsourced services."},"3.3.1.1",{"$f":"AZ44&\": \"&CHOOSE(LanguageNumber,BA44,BR44,CH44,CX44)","v":"3.3.1.1: AGENT AGREEMENTS\nContractual agreements should be established with all agents, either directly or through master agents or agent aggregators. Agreements should ensure that the responsibilities and expectations of providers and agents are clearly established. The following topics should be included:\n- A list of the functions to be provided by agent (e.g. registration, cash-in, cash-out).\n- Expected service levels from agent and the service level of provider's system (which may include scheduled downtime) (see definition).\n- Contractual liabilities of the respective parties with respect to fraud/forgery, cash and mobile money security, physical security, customer data security, and other relevant matters.\n- Stipulation that provider must have access to all data related to the activities conducted by the agent on behalf of the provider (such as written records of transactions, customer identification data etc.), and clarification of the ownership of such data.\n- Barring of discriminatory practices - all customers should be served equally."},"ECB RSMP \nBCBS OFS\nGSMA RMT\n(CON-05, CON-06, CON-09, CON-10, CON-13, CON-14)","3.3.1.1.1",{"$f":"BC44&\": \"&CHOOSE(LanguageNumber,BE44,BU44,CK44,DA44)&CarriageReturn","v":"3.3.1.1.1: Are contractual agreements in place with all agents, either directly or through master agents or agent aggregators?\n"},{"$f":"CHOOSE(LanguageNumber,BF44,BV44,CL44,DB44)","v":"1) Sample agent contract or standard contract template.\n2) Sample master agent contract / agent aggregator contract or template contract.\n\n- Check that a suitable contract exists for agents.\n- Check that a suitable contract exists for master agents and agent aggregators (if applicable).\n"},0,{"$f":"CHOOSE(LanguageNumber,BH44,BX44,CN44,DD44)","v":"Urgent Required"},{"$f":"CHOOSE(LanguageNumber,BI44,BY44,CO44,DE44)","v":"Required"},"Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.3","3.3.1","3.3.1: Providers shall establish written agreements governing their relationship with agents and entities providing outsourced services.","3.3.1.1","AGENT AGREEMENTS\nContractual agreements should be established with all agents, either directly or through master agents or agent aggregators. Agreements should ensure that the responsibilities and expectations of providers and agents are clearly established. The following topics should be included:\n- A list of the functions to be provided by agent (e.g. registration, cash-in, cash-out).\n- Expected service levels from agent and the service level of provider's system (which may include scheduled downtime) (see definition).\n- Contractual liabilities of the respective parties with respect to fraud/forgery, cash and mobile money security, physical security, customer data security, and other relevant matters.\n- Stipulation that provider must have access to all data related to the activities conducted by the agent on behalf of the provider (such as written records of transactions, customer identification data etc.), and clarification of the ownership of such data.\n- Barring of discriminatory practices - all customers should be served equally.","ECB RSMP \nBCBS OFS\nGSMA RMT\n(CON-05, CON-06, CON-09, CON-10, CON-13, CON-14)","3.3.1.1.1","3.3.1.1.1","Are contractual agreements in place with all agents, either directly or through master agents or agent aggregators?","1) Sample agent contract or standard contract template.\n2) Sample master agent contract / agent aggregator contract or template contract.\n\n- Check that a suitable contract exists for agents.\n- Check that a suitable contract exists for master agents and agent aggregators (if applicable).\n",null,"Urgent Required","Required","Agent",null,null,"3","3.3","3.3.1","3.3.1: Les prestataires doivent mettre en place des accords écrits régissant leurs relations avec les agents et les entités fournissant des services de sous-traitance. ","3.3.1.1","CONTRATS AVEC LES AGENTS\nDes accords contractuels doivent être mis en place avec l’ensemble des agents, que ce soit directement ou par l’intermédiaire d’agents principaux (master agents) ou d’agrégateurs d’agents. Les contrats doivent définir clairement les responsabilités et les attentes du prestataire et des agents,  et couvrir les aspects suivants :\n- liste des fonctions devant être assumées par l’agent (ex. enregistrement, dépôts d’espèces, retraits d’espèces).\n- niveaux de service attendus de la part de l’agent et niveau de service du système du prestataire (en précisant éventuellement les arrêts programmés) (voir définition).\n- responsabilités contractuelles de chaque partie en matière de fraude/falsification de documents, sécurité des espèces et de l’argent mobile, sécurité physique, sécurité des données relatives aux clients et autre sujets pertinents.\n- dispositions prévoyant que le prestataire ait accès à l’ensemble des informations relatives aux activités effectuées pour son compte par l’agent (ex. registres des opérations, renseignements d’identité des clients, etc.) et précisant la propriété de ces données.\n- interdiction des pratiques discriminatoires – tous les clients doivent être servis de la même manière.\n\nLes contrats d’agent doivent également inclure les dispositions visées dans 3.3.1.3.","ECB RSMP \nBCBS OFS\nGSMA RMT\n(CON-05, CON-06, CON-09, CON-10, CON-13, CON-14)","3.3.1.1.1","des accords contractuels sont-ils en place pour l'ensemble des agents, que ce soit directement ou par l’intermédiaire d’agents principaux (master agents) ou d’agrégateurs d’agents (le cas échéant) ?","1) Modèle de contrat d’agent ou modèle de contrat type.\n2) Modèle de contrat d’agent principal/contrat ou modèle de contrat d’agrégateur d’agents.\n\n- Vérifier qu’un contrat de forme appropriée a été établi pour les agents.\n- Vérifier qu’un contrat de forme appropriée a été établi pour les agents principaux et les agrégateurs d’agents (le cas échéant).\n",null,{"$f":"VLOOKUP($BH44,CategoryTranslationTable,2,FALSE)","v":"Requis Prioritaire"},{"$f":"VLOOKUP($BI44,CategoryTranslationTable,2,FALSE)","v":"Requis"},"Agent",0,null,"3","3.3","3.3.1","3.3.1: Los proveedores deben establecer acuerdos por escrito que rijan sus relaciones con los agentes y las entidades que prestan servicios tercerizados.","3.3.1.1","ACUERDOS CON LOS AGENTES\nSe deben establecer acuerdos contractuales con todos los agentes, ya sea de forma directa o a través de agentes maestros o agregadores de agentes. Los acuerdos deben garantizar que las responsabilidades y las expectativas de los proveedores y agentes estén claramente establecidas. Se deben incluir los siguientes puntos:\n- Una lista de las funciones que deberá  realizar el agente (por ej., registro, ingresos de efectivo, retiros de efectivo).\n- Niveles de servicio esperados por parte de los agentes y el nivel de servicio del sistema del proveedor (que puede incluir el tiempo de inactividad programado) (ver definición).\n- Responsabilidades contractuales de las respectivas partes respecto de fraude/falsificación, seguridad del efectivo y del dinero móvil, seguridad física, seguridad de los datos de los clientes, y otras cuestiones relevantes.\n- Disposición de que el proveedor debe tener acceso a todos los datos relacionados con las actividades llevadas a cabo por el agente en nombre del proveedor (como por ejemplo, registros escritos de las transacciones, datos de identificación del cliente, etc.), y aclaración de la titularidad de estos datos.\n- Prohibición de prácticas discriminatorias - se debe atender a todos los clientes por igual.\n\nLos acuerdos con los agentes también deben incluir los términos que se especifican en 3.3.1.3.","ECB RSMP \nBCBS OFS\nGSMA RMT\n(CON-05, CON-06, CON-09, CON-10, CON-13, CON-14)","3.3.1.1.1","¿Se establecen acuerdos contractuales con todos los agentes, ya sea de forma directa o a través de agentes maestros o agregadores de agentes?","1) Modelo de contrato con los agentes o plantilla de contrato estándar.\n2) Modelo de contrato con los agentes maestros / contrato o plantilla de contrato con los agregadores de agentes.\n\n- Verificar que exista un contrato correspondiente para los agentes.\n- Verificar que exista un contrato correspondiente para los agentes maestros y agregadores de agentes (si corresponde).\n",null,{"$f":"VLOOKUP($BH44,CategoryTranslationTable,3,FALSE)","v":"Obligatorio urgente"},{"$f":"VLOOKUP($BI44,CategoryTranslationTable,3,FALSE)","v":"Obligatorio"},"Agent",null,null,"3","3.3","3.3.1",null,"3.3.1.1",null,"ECB RSMP \nBCBS OFS\nGSMA RMT\n(CON-05, CON-06, CON-09, CON-10, CON-13, CON-14)","3.3.1.1.1",null,null,null,{"$f":"VLOOKUP($BH44,CategoryTranslationTable,4,FALSE)","v":"ReqU4"},{"$f":"VLOOKUP($BI44,CategoryTranslationTable,4,FALSE)","v":"Req4"},"Agent",null,null,null,null,null,null,null,null,"3.3.1.1.1",null,null,null,{"$f":"IF(OR($EA44=0,$EA44=2),VLOOKUP(DO44,INDIRECT(ED44),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP44),\"\",VLOOKUP(DP44,INDIRECT(EE44),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ44),\"\",VLOOKUP(DQ44,INDIRECT(EF44),7,FALSE))","v":""},"",{"$f":"IF(OR($EA44=0,$EA44=2),VLOOKUP(DO44,INDIRECT(ED44),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP44),\"\",VLOOKUP(DP44,INDIRECT(EE44),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ44),\"\",VLOOKUP(DQ44,INDIRECT(EF44),8,FALSE))","v":""},"",{"$f":"1*AND(LEFT(DN44,3)=\"NEW\")+2*AND(LEFT(DN44,3)=\"MER\")+3*AND(LEFT(DN44,3)=\"MOV\")+4*AND(LEFT(DN44,3)=\"SWA\")","v":0},{"$error":"#REF!"},{"$f":"IF(EA44=0,IF(DW44=0,\"\",DW44),CHOOSE(EA44,\"New indicator\",CONCATENATE(DW44,CarriageReturn,DX44,CarriageReturn,DY44,CarriageReturn,DZ44)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO44,1)","v":"OriginalComplianceP3"},{"$f":"\"OriginalComplianceP\"&LEFT(DP44,1)","v":"OriginalComplianceP"},"OriginalComplianceP","OriginalComplianceP",{"$f":"COUNTIF($DS44:$DV44,EH$3)","v":0},0,0,0,0,1,{"$f":"IF(OR(AND(EH44>0,SUM(EI44:EL44)>0),EK44>0),\"Partial\",IF(EH44=EM44,\"Yes\",IF(EI44=EM44,\"No\",IF(EJ44=EM44,\"N/A\",IF(EK44=EM44,\"Partial\",IF(EL44=EM44,\"\",\"\"))))))","v":""}]
[null,"3","3.3","3.3.1",0,"3.3.1.1",null,0,"3.3.1.1.2",{"$f":"BC45&\": \"&CHOOSE(LanguageNumber,BE45,BU45,CK45,DA45)&CarriageReturn","v":"3.3.1.1.2: Do agent agreements include (i) a list of the functions to be provided by the agent and (ii) the expected service levels from the agent and provider (see definition)?\n"},0,0,"Recommended","Recommended","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.3","3.3.1",null,"3.3.1.1",null,null,"3.3.1.1.2","3.3.1.1.2","Do agent agreements include (i) a list of the functions to be provided by the agent and (ii) the expected service levels from the agent and provider (see definition)?",null,null,"Recommended","Recommended","Agent",null,null,"3","3.3","3.3.1",0,"3.3.1.1",0,0,"3.3.1.1.2","les contrats d'agent précisent-ils (a) la liste des fonctions devant être assumées par l’agent et (b) les niveaux de service attendus de la part de l’agent et du prestataire (cf. définition) ?",null,null,"Recommandé","Recommandé","Agent","Les niveaux de service doivent concerner à la fois les fonctions techniques et les fonctions commerciales. Parmi les exemples de niveau de service technique figurent la « disponibilité du système » et le « temps de réponse ». Parmi les exemples de niveaux de service commercial figurent le « temps d’attente des appels » pour les appels de clients ou le « délai de réalisation d’une remise d’espèces » pour les agents.\n",null,"3","3.3","3.3.1",null,"3.3.1.1",null,0,"3.3.1.1.2","¿Los acuerdos con los agentes incluyen (i) una lista de las funciones que deben ser realizadas por el agente y (ii) los niveles de servicio esperados por parte del agente y el proveedor (ver definición)?",null,null,"Recomendado","Recomendado","Agent",null,null,"3","3.3","3.3.1",null,"3.3.1.1",null,0,"3.3.1.1.2",null,null,null,"Rec4","Rec4","Agent",null,null,null,null,null,null,null,null,"3.3.1.1.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.3","3.3.1",0,"3.3.1.1",null,0,"3.3.1.1.3","3.3.1.1.3: Do agent agreements specify contractual liabilities with respect to fraud/forgery, cash and mobile money security, physical security, and customer data security?\n",0,0,"Recommended","Recommended","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.3","3.3.1",null,"3.3.1.1",null,null,"3.3.1.1.3","3.3.1.1.3","Do agent agreements specify contractual liabilities with respect to fraud/forgery, cash and mobile money security, physical security, and customer data security?",null,null,"Recommended","Recommended","Agent",null,null,"3","3.3","3.3.1",0,"3.3.1.1",0,0,"3.3.1.1.3","les contrats d'agent précisent-ils les responsabilités contractuelles de chaque partie en matière de fraude/falsification de documents, sécurité des espèces et de l’argent mobile, sécurité physique et sécurité des données relatives aux clients ?",null,null,"Recommandé","Recommandé","Agent",0,null,"3","3.3","3.3.1",null,"3.3.1.1",null,0,"3.3.1.1.3","¿Los acuerdos con los agentes especifican las responsabilidades contractuales respecto de fraude/falsificación, la seguridad del efectivo y del dinero móvil, la seguridad física y la seguridad de los datos del cliente?",null,null,"Recomendado","Recomendado","Agent",null,null,"3","3.3","3.3.1",null,"3.3.1.1",null,0,"3.3.1.1.3",null,null,null,"Rec4","Rec4","Agent",null,null,null,null,null,null,null,null,"3.3.1.1.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.3","3.3.1",0,"3.3.1.1",null,0,"3.3.1.1.4","3.3.1.1.4: Do agent agreements stipulate that provider must have access to all data related to the activities conducted by the agent on behalf of the provider (such as written records of transactions, customer identification data etc.) and clarify the ownership of such data?\n",0,0,"Recommended","Recommended","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.3","3.3.1",null,"3.3.1.1",null,null,"3.3.1.1.4","3.3.1.1.4","Do agent agreements stipulate that provider must have access to all data related to the activities conducted by the agent on behalf of the provider (such as written records of transactions, customer identification data etc.) and clarify the ownership of such data?",null,null,"Recommended","Recommended","Agent",null,null,"3","3.3","3.3.1",0,"3.3.1.1",0,0,"3.3.1.1.4","les contrats d'agent stipulent-ils que le prestataire doit avoir accès à l’ensemble des informations relatives aux activités effectuées pour son compte par l’agent (ex. registres des opérations, renseignements d’identité des clients, etc.) et précisent-ils la propriété de ces informations ?",null,null,"Recommandé","Recommandé","Agent",0,null,"3","3.3","3.3.1",null,"3.3.1.1",null,0,"3.3.1.1.4","¿Los acuerdos con los agentes estipulan que el proveedor debe tener acceso a todos los datos relacionados con las actividades llevadas a cabo por el agente en nombre del proveedor (como por ejemplo, registros escritos de las transacciones, datos de identificación del cliente, etc.) y aclaran la titularidad de estos datos?",null,null,"Recomendado","Recomendado","Agent",null,null,"3","3.3","3.3.1",null,"3.3.1.1",null,0,"3.3.1.1.4",null,null,null,"Rec4","Rec4","Agent",null,null,null,null,null,null,null,null,"3.3.1.1.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.3","3.3.1",0,"3.3.1.1",null,0,"3.3.1.1.5","3.3.1.1.5: Do agent agreements bar discriminatory practices, meaning that all customers should be served equally?\n",0,0,"Recommended","Recommended","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.3","3.3.1",null,"3.3.1.1",null,null,"3.3.1.1.5","3.3.1.1.5","Do agent agreements bar discriminatory practices, meaning that all customers should be served equally?",null,null,"Recommended","Recommended","Agent",null,null,"3","3.3","3.3.1",0,"3.3.1.1",0,0,"3.3.1.1.5","les contrats d'agent interdisent-ils les pratiques discriminatoires, ce qui signifie que tous les clients doivent être servis de la même manière ?",null,null,"Recommandé","Recommandé","Agent",0,null,"3","3.3","3.3.1",null,"3.3.1.1",null,0,"3.3.1.1.5","¿Los acuerdos con los agentes prohíben las prácticas discriminatorias, es decir, que se debe atender a todos los clientes por igual?",null,null,"Recomendado","Recomendado","Agent",null,null,"3","3.3","3.3.1",null,"3.3.1.1",null,0,"3.3.1.1.5",null,null,null,"Rec4","Rec4","Agent",null,null,null,null,null,null,null,null,"3.3.1.1.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.3","3.3.1",{"$f":"CHOOSE(LanguageNumber,AY49,BP49,CF49,CV49)","v":""},"3.3.1.2",{"$f":"AZ49&\": \"&CHOOSE(LanguageNumber,BA49,BR49,CH49,CX49)","v":"3.3.1.2: AGREEMENTS WITH ENTITIES PROVIDING OUTSOURCED SERVICES\nContractual agreements should be established with all entities providing outsourced services. Agreements should ensure that the responsibilities and expectations of providers and entities providing outsourced services are clearly established. \n\nThe following topics should be included:\n- Expected service levels from the entity providing outsourced services. Note that the SLA published to customers should take account of the operational SLA agreed with entities providing outsourced services (see 4.2).\n- Where appropriate, a requirement for entities providing outsourced services to conduct appropriate due diligence on their own staff.\n- Business continuity requirements (when appropriate - for example, if the mobile money system is outsourced);\n- Stipulation that provider must have access to all data related to the activities conducted by the entity providing outsourced services on behalf of the provider and clarification of the ownership of such data.\n"},0,"3.3.1.2.1","3.3.1.2.1: Are the expected service levels defined for each entity providing material outsourced services?\n",{"$f":"CHOOSE(LanguageNumber,BF49,BV49,CL49,DB49)","v":"1) Contract document for each material outsourced service suppliers (e.g. MM platform provider)\n- Check that expected service levels are defined for all entities providing material outsourced services.\n"},0,{"$f":"CHOOSE(LanguageNumber,BH49,BX49,CN49,DD49)","v":"Urgent Required"},"Required","BizOps",{"$f":"CHOOSE(LanguageNumber,BK49,CA49,CQ49,#REF!)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.3","3.3.1","","3.3.1.2","AGREEMENTS WITH ENTITIES PROVIDING OUTSOURCED SERVICES\nContractual agreements should be established with all entities providing outsourced services. Agreements should ensure that the responsibilities and expectations of providers and entities providing outsourced services are clearly established. \n\nThe following topics should be included:\n- Expected service levels from the entity providing outsourced services. Note that the SLA published to customers should take account of the operational SLA agreed with entities providing outsourced services (see 4.2).\n- Where appropriate, a requirement for entities providing outsourced services to conduct appropriate due diligence on their own staff.\n- Business continuity requirements (when appropriate - for example, if the mobile money system is outsourced);\n- Stipulation that provider must have access to all data related to the activities conducted by the entity providing outsourced services on behalf of the provider and clarification of the ownership of such data.\n",null,"3.3.1.2.1",{"$f":"DO49","v":"3.3.1.2.1"},"Are the expected service levels defined for each entity providing material outsourced services?","1) Contract document for each material outsourced service suppliers (e.g. MM platform provider)\n- Check that expected service levels are defined for all entities providing material outsourced services.\n",null,"Urgent Required","Required","BizOps",null,null,"3","3.3","3.3.1","","3.3.1.2","CONTRATS AVEC LES ENTITÉS FOURNISSANT DES SERVICES DE SOUS-TRAITANCE\nDes accords contractuels doivent être mis en place avec l’ensemble des entités fournissant des services de sous-traitance. Ces contrats doivent définir clairement les responsabilités et les attentes du prestataire et de l’entité concernée,  \n\net couvrir les aspects suivants :\n- niveaux de services attendus de la part de l’entité concernée. Remarque : les conventions de niveau de service (SLA) communiquées aux clients doivent tenir compte des SLA opérationnelles éventuellement convenues avec les sous-traitants (cf. 4.2).\n- exigence pour les entités concernées de réaliser des vérifications sur leur personnel, si nécessaire.\n- exigences de continuité des opérations (si nécessaire, par exemple lorsque le système d'argent mobile est externalisé) ;\n- dispositions prévoyant que le prestataire ait accès à l’ensemble des informations relatives aux activités effectuées pour son compte par l’entité fournissant des services de sous-traitance et précisant la propriété de ces informations.\n",0,"3.3.1.2.1","Les niveaux de services attendus définis pour chaque entité fournissent-ils des services matériel externalisés ?","1) Document contractuel pour chaque entité fournissant des services de sous-traitance essentiels (par exemple, fournisseur de la plateforme d’argent mobile)\n- Vérifier que les niveaux de services attendus sont définis pour chaque entité fournissant des services de sous-traitance essentiels.\n\n\n\n",null,"Requis Prioritaire","Requis","BizOps",0,null,"3","3.3","3.3.1","","3.3.1.2","ACUERDOS CON LAS ENTIDADES QUE PRESTAN SERVICIOS TERCERIZADOS\nSe deben establecer acuerdos contractuales con todas las entidades que prestan servicios tercerizados. Los acuerdos deben garantizar que las responsabilidades y las expectativas de los proveedores y las entidades que prestan servicios tercerizados estén claramente establecidas. \n\nSe deben incluir los siguientes puntos:\n- Niveles de servicio esperados por parte de la entidad que presta servicios tercerizados. Nótese que los SLA publicados para los clientes deben tener en cuenta los SLA operativos acordados con las entidades que prestan servicios tercerizados (ver 4.2).\n- Cuando corresponda, una requisito para que las entidades que prestan servicios tercerizados lleven a cabo la debida diligencia sobre su propio personal.\n- Requisitos de continuidad del negocio (cuando corresponda, por ejemplo, si el sistema del dinero móvil es tercerizado);\n- Disposición de que el proveedor debe tener acceso a todos los datos relacionados con las actividades llevadas a cabo por la entidad que presta servicios tercerizados en nombre del proveedor y aclaración de la titularidad de estos datos.\n",0,"3.3.1.2.1","¿Se definen los niveles de servicio esperados para cada entidad que presta importantes servicios tercerizados?","1) Documento de contrato para cada proveedor de importantes servicios tercerizados (por ej., proveedor de la plataforma del dinero móvil)\n- Verificar que se definan los niveles de servicio esperados para todas las entidades que prestan importantes servicios tercerizados.\n\n\n\n",null,"Obligatorio urgente","Obligatorio","BizOps",null,null,"3","3.3","3.3.1",null,"3.3.1.2",null,0,"3.3.1.2.1",null,null,null,"ReqU4","Req4","BizOps",null,null,null,null,null,null,null,null,"3.3.1.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.3","3.3.1","","3.3.1.2",null,0,"3.3.1.2.2","3.3.1.2.2: Where appropriate, do agreements with entities providing outsourced services require them to conduct appropriate due diligence on their staff?\n",0,0,"Recommended","Recommended","BizOps",{"$f":"CHOOSE(LanguageNumber,BK50,CA50,CQ50,#REF!)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.3","3.3.1","","3.3.1.2",null,null,"3.3.1.2.2","3.3.1.3.2","Where appropriate, do agreements with entities providing outsourced services require them to conduct appropriate due diligence on their staff?",null,null,"Recommended","Recommended","BizOps",null,null,"3","3.3","3.3.1","","3.3.1.2",null,0,"3.3.1.2.2","est-ce que tous les contrats avec des agents ou des entités fournissant des services de sous-traitance couvrent les politiques et procédures de vigilance ?",null,null,"Recommandé","Recommandé","BizOps","Ces contrats peuvent par exemple imposer l'obligation aux agents et/ou aux entités fournissant des services de sous-traitance d'effectuer des contrôles de vigilance appropriés concernant leur propre personnel (ou d'autres parties fournissant des services pour leur compte). ",null,"3","3.3","3.3.1","","3.3.1.2",null,0,"3.3.1.2.2","Cuando corresponda, ¿los acuerdos con las entidades que prestan servicios tercerizados les exigen que lleven a cabo la debida diligencia sobre su propio personal?",null,null,"Recomendado","Recomendado","BizOps",null,null,"3","3.3","3.3.1",null,"3.3.1.2",null,0,"3.3.1.2.2",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"3.3.1.3.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.3","3.3.1","","3.3.1.2",null,0,"3.3.1.2.3","3.3.1.2.3: Where appropriate, do agreements with entities providing outsourced services address business continuity requirements?\n",0,0,"Recommended","Recommended","BizOps",{"$f":"CHOOSE(LanguageNumber,BK51,CA51,CQ51,#REF!)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.3","3.3.1","","3.3.1.2",null,null,"3.3.1.2.3","3.3.1.3.3","Where appropriate, do agreements with entities providing outsourced services address business continuity requirements?",null,null,"Recommended","Recommended","BizOps",null,null,"3","3.3","3.3.1","","3.3.1.2",null,0,"3.3.1.2.3","est-ce que tous les contrats avec des agents ou des entités fournissant des services de sous-traitance couvrent les exigences de continuité de l’activité ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"3","3.3","3.3.1","","3.3.1.2",null,0,"3.3.1.2.3","Cuando corresponda, ¿los acuerdos con las entidades que prestan servicios tercerizados abordan los requisitos de continuidad del negocio?",null,null,"Recomendado","Recomendado","BizOps",null,null,"3","3.3","3.3.1",null,"3.3.1.2",null,0,"3.3.1.2.3",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"3.3.1.3.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.3","3.3.1","","3.3.1.2",null,0,"3.3.1.2.4","3.3.1.2.4: Do agreements with entities providing outsourced services (i) stipulate that the provider must have access to all data related to the activities conducted by the entity providing outsourced services on behalf of the provider and (ii) clarify the ownership of such data?\n",0,0,"Recommended","Recommended","BizOps",{"$f":"CHOOSE(LanguageNumber,BK52,CA52,CQ52,#REF!)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.3","3.3.1","","3.3.1.2",null,null,"3.3.1.2.4","3.3.1.2.2","Do agreements with entities providing outsourced services (i) stipulate that the provider must have access to all data related to the activities conducted by the entity providing outsourced services on behalf of the provider and (ii) clarify the ownership of such data?",null,null,"Recommended","Recommended","BizOps",null,null,"3","3.3","3.3.1","","3.3.1.2",0,0,"3.3.1.2.4","les contrats avec les entités fournissant des services de sous-traitance (a) stipulent-ils que le prestataire doit avoir accès à l’ensemble des informations relatives aux activités effectuées pour son compte par l'entité concernée et (b) précisent-ils la propriété de ces informations ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"3","3.3","3.3.1","","3.3.1.2",null,0,"3.3.1.2.4","¿Los acuerdos con las entidades que prestan servicios tercerizados (i) estipulan que el proveedor debe tener acceso a todos los datos relacionados con las actividades llevadas a cabo por la entidad que presta servicios tercerizados en nombre del proveedor y (ii) aclaran la titularidad de estos datos?",null,null,"Recomendado","Recomendado","BizOps",null,null,"3","3.3","3.3.1",null,"3.3.1.2",null,0,"3.3.1.2.4",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"3.3.1.2.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.3","3.3.2","3.3.2: Providers shall assume responsibility for actions taken on their behalf by their agents (and any sub-agents) under the provider-agent contract.\n","3.3.2.1","3.3.2.1: AGENT AGREEMENTS AND PROVIDER RESPONSIBILITY\nProviders shall assume responsibility for actions taken by their agents when acting on behalf of the provider. This includes all cases where the agents had actual (express or implied) or apparent authority to take the action in question on behalf of the provider.\n\nThis should be made clear in the provider's agreement with agents and customers.\n",0,"3.3.2.1.1","3.3.2.1.1: Does the provider's agreement with agents and customers make it clear that the provider assumes responsibility for actions taken by their agents when acting on behalf of the provider?\n","1) Sample agent contract\n- Check that there is a clause that states the provider assumes responsibility for actions taken by the agent on behalf of the provider\n\n2) Sample of customer contract\n- Check that there is a clause that states the provider assumes responsibility for actions taken by an agent on behalf of the provider.",0,"Recommended","Recommended","Agent",{"$f":"CHOOSE(LanguageNumber,BK53,CA53,CQ53,#REF!)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.3","3.3.2","3.3.2: Providers shall assume responsibility for actions taken on their behalf by their agents (and any sub-agents) under the provider-agent contract.\n","3.3.2.1","AGENT AGREEMENTS AND PROVIDER RESPONSIBILITY\nProviders shall assume responsibility for actions taken by their agents when acting on behalf of the provider. This includes all cases where the agents had actual (express or implied) or apparent authority to take the action in question on behalf of the provider.\n\nThis should be made clear in the provider's agreement with agents and customers.\n",null,"3.3.2.1.1","3.3.2.1.1","Does the provider's agreement with agents and customers make it clear that the provider assumes responsibility for actions taken by their agents when acting on behalf of the provider?","1) Sample agent contract\n- Check that there is a clause that states the provider assumes responsibility for actions taken by the agent on behalf of the provider\n\n2) Sample of customer contract\n- Check that there is a clause that states the provider assumes responsibility for actions taken by an agent on behalf of the provider.",null,"Recommended","Recommended","Agent",null,null,"3","3.3","3.3.2","3.3.2: Les prestataires doivent assumer la responsabilité des actions effectuées en leur nom par leurs agents (ou agents délégués) dans le cadre du contrat prestataire-agent.","3.3.2.1","CONTRATS D'AGENT ET RESPONSABILITÉS DU PRESTATAIRE\nLes prestataires doivent assumer la responsabilité des actions effectuées en leur nom par leurs agents. Cela comprend les situations dans lesquelles les agents auraient le pouvoir effectif (explicite ou implicite) ou apparent d’agir pour le compte du prestataire.\n\nCeci doit être clairement indiqué dans l'accord du prestataire avec les agents et les clients.\n",0,"3.3.2.1.1","L'accord du prestataire avec les clients et les agents indique-t-il clairement que le prestataire assume la responsabilité des actions effectuées en son nom par ses agents ?","1) Modèle de contrat d’agent\n- Vérifier que le contrat contient une clause stipulant que le prestataire assume la responsabilité des actions effectuées en son nom par l’agent\n\n2) Modèle de contrat client\n- Vérifier que le contrat contient une clause stipulant que le prestataire assume la responsabilité des actions effectuées en son nom par un agent",null,"Recommandé","Recommandé","Agent",0,null,"3","3.3","3.3.2","3.3.2: Los proveedores asumirán la responsabilidad por las acciones que realizan los agentes (y cualquier subagente) en su nombre conforme al contrato del proveedor-agente.\n","3.3.2.1","ACUERDOS CON LOS AGENTES Y RESPONSABILIDAD DEL PROVEEDOR\nLos proveedores asumirán la responsabilidad por las acciones realizadas por sus agentes cuando actúan en nombre del proveedor. Esto incluye todos los casos en los que los agentes tienen autoridad real (expresa o implícita) o supuesta para realizar la acción en cuestión en nombre del proveedor.\n\nEsto se debe expresar claramente en el acuerdo del proveedor con los agentes y clientes.\n",0,"3.3.2.1.1","¿El acuerdo del proveedor con los agentes y clientes expresa claramente que el proveedor asume la responsabilidad por todas las acciones realizadas por sus agentes cuando actúan en su nombre?","1) Modelo de contrato con los agentes\n- Verificar que exista una cláusula que establezca que el proveedor asume la responsabilidad por las acciones realizadas por el agente en su nombre\n\n2) Modelo de contrato con los clientes\n- Verificar que exista una cláusula que establezca que el proveedor asume la responsabilidad por las acciones realizadas por un agente en su nombre.",null,"Recomendado","Recomendado","Agent",null,null,"3","3.3","3.3.2",null,"3.3.2.1",null,0,"3.3.2.1.1",null,null,null,"Rec4","Rec4","Agent",null,null,null,null,null,null,null,null,"3.3.2.1.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.3","3.3.2",0,"3.3.2.2","3.3.2.2: AGENT AGREEMENTS AND PROVIDER RESPONSIBILITY\nProvider-agent contracts (see 3.3.1) should include provisions granting providers the right to seek restitution for damages incurred by the provider due to agent (or sub-agent) conduct.\n",0,"3.3.2.2.1","3.3.2.2.1: Does the provider-agent contract include provisions granting providers the right to seek restitution for damages incurred by the provider due to agent (or sub-agent) conduct?\n",0,0,"Recommended","Recommended","Agent",{"$f":"CHOOSE(LanguageNumber,BK54,CA54,CQ54,#REF!)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.3","3.3.2",null,"3.3.2.2","AGENT AGREEMENTS AND PROVIDER RESPONSIBILITY\nProvider-agent contracts (see 3.3.1) should include provisions granting providers the right to seek restitution for damages incurred by the provider due to agent (or sub-agent) conduct.\n",null,"3.3.2.2.1","3.3.2.2.1","Does the provider-agent contract include provisions granting providers the right to seek restitution for damages incurred by the provider due to agent (or sub-agent) conduct?",null,null,"Recommended","Recommended","Agent",null,null,"3","3.3","3.3.2",0,"3.3.2.2","CONTRATS D'AGENT ET RESPONSABILITÉS DU PRESTATAIRE\nLes contrats prestataire-agent (cf. 3.3.1) doivent inclure des dispositions donnant le droit au prestataire de demander dédommagement pour tout préjudice subi en raison de la conduite d’un agent (ou agent délégué). ",0,"3.3.2.2.1","les contrats prestataire-agent contiennent-ils des dispositions donnant le droit au prestataire de demander dédommagement pour tout préjudice subi en raison de la conduite d’un agent (ou agent délégué) ?",null,null,"Recommandé","Recommandé","Agent",0,null,"3","3.3","3.3.2",null,"3.3.2.2","ACUERDOS CON LOS AGENTES Y RESPONSABILIDAD DEL PROVEEDOR\nLos contratos del proveedor-agente (ver 3.3.1) deben incluir disposiciones que otorguen a los proveedores el derecho a procurar resarcimiento por los daños ocasionados por el proveedor debido a las conductas del agente (o subagente).\n",0,"3.3.2.2.1","¿El contrato del proveedor-agente incluye disposiciones que otorguen a los proveedores el derecho a procurar resarcimiento por los daños ocasionados por el proveedor debido a las conductas del agente (o subagente)?",null,null,"Recomendado","Recomendado","Agent",null,null,"3","3.3","3.3.2",null,"3.3.2.2",null,0,"3.3.2.2.1",null,null,null,"Rec4","Rec4","Agent",null,null,null,null,null,null,null,null,"3.3.2.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3",0,0,{"$f":"UPPER(CONCATENATE(Introduction!C17,\": \",Introduction!D17))","v":"3.4: MANAGEMENT OF STAﬀ, AGENTS AND ENTITIES PROVIDING OUTSOURCED SERVICES"},null,null,0,0,{"$f":"Introduction!E17","v":"Providers shall develop policies and processes for ongoing management and oversight of staff, agents and entities providing outsourced services"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3",null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$17,\": \",Introduction!$L$17))","v":"3.4: MANAGEMENT OF STAﬀ, AGENTS AND ENTITIES PROVIDING OUTSOURCED SERVICES"},null,null,null,null,null,{"$f":"Introduction!$M$17","v":"Providers shall develop policies and processes for ongoing management and oversight of staff, agents and entities providing outsourced services"},null,null,null,null,0,null,null,"3",0,0,null,null,null,null,null,null,null,null,null,null,0,null,null,"3",0,0,{"$f":"UPPER(CONCATENATE(Introduction!$U$17,\": \",Introduction!$V$17))","v":"3.4: GESTIÓN Y SUPERVISIÓN DEL PERSONAL, LOS AGENTES Y LAS ENTIDADES SUBCONTRATADAS"},null,null,null,null,{"$f":"Introduction!W17","v":"El proveedor elaborará políticas y procedimientos para la gestión y supervisión continuas del personal, los agentes y las entidades subcontratadas."},null,null,null,null,null,null,null,"3",0,0,null,null,null,null,null,null,null,null,null,null,0]
[null,"3","3.4","3.4.1",{"$f":"CHOOSE(LanguageNumber,AY56,BP56,CF56,CV56)","v":"3.4.1: Providers shall develop policies and processes for ongoing management and oversight of staff, agents and entities providing outsourced services"},"3.4.1.1",{"$f":"AZ56&\": \"&CHOOSE(LanguageNumber,BA56,BR56,CH56,CX56)","v":"3.4.1.1: STAFF MANAGEMENT POLICY\nProviders should implement a human resources policy for their mobile money staff. The policy should determine how the provider will ensure it has the human resources needed to implement and maintain the mobile money service.\n\nA human resources management process should be implemented to do the following:\n- Determine the necessary competence for staff for each role within the mobile money organization.\n- Provide training or take other actions (e.g. recruitment) to achieve the necessary competence in each role.\n- Provide training on other key processes, particularly those relating to AML/CFT, anti-fraud, regulatory compliance, data privacy, security, and business continuity.\n- Ensure that staff are aware of their roles and responsibilities, and how their role contributes to the mobile money service.\n- Ensure changes of responsibility, including initiation or termination of a responsibility, are managed appropriately, including through suitable training and monitoring.\n- Maintain appropriate records of staff training, skills and experience.\n"},"ISO 20000-1:2018 Sec. 5.2,\nGSMA RMT","3.4.1.1.1",{"$f":"BC56&\": \"&CHOOSE(LanguageNumber,BE56,BU56,CK56,DA56)&CarriageReturn","v":"3.4.1.1.1: Has a human resources policy been implemented that determines how the provider will ensure it has appropriate human resources needed to implement and maintain the mobile money service, and is the policy kept up to date?\n"},{"$f":"CHOOSE(LanguageNumber,BF56,BV56,CL56,DB56)","v":"1) Human resources policy (or equivalent documentation)\n- Check provider has appropriate human resources to operate the mobile money service.\n- Check the revision date on the policy/equivalent document is within the last 24 months."},0,{"$f":"CHOOSE(LanguageNumber,BH56,BX56,CN56,DD56)","v":"Standard Required"},"Required","HR",{"$f":"CHOOSE(LanguageNumber,BK56,CA56,CQ56,#REF!)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","3.4.1: Providers shall develop policies and processes for ongoing management and oversight of staff, agents and entities providing outsourced services","3.4.1.1","STAFF MANAGEMENT POLICY\nProviders should implement a human resources policy for their mobile money staff. The policy should determine how the provider will ensure it has the human resources needed to implement and maintain the mobile money service.\n\nA human resources management process should be implemented to do the following:\n- Determine the necessary competence for staff for each role within the mobile money organization.\n- Provide training or take other actions (e.g. recruitment) to achieve the necessary competence in each role.\n- Provide training on other key processes, particularly those relating to AML/CFT, anti-fraud, regulatory compliance, data privacy, security, and business continuity.\n- Ensure that staff are aware of their roles and responsibilities, and how their role contributes to the mobile money service.\n- Ensure changes of responsibility, including initiation or termination of a responsibility, are managed appropriately, including through suitable training and monitoring.\n- Maintain appropriate records of staff training, skills and experience.\n","ISO 20000-1:2018 Sec. 5.2,\nGSMA RMT","3.4.1.1.1",{"$f":"DO56","v":"3.4.1.1.1"},"Has a human resources policy been implemented that determines how the provider will ensure it has appropriate human resources needed to implement and maintain the mobile money service, and is the policy kept up to date?","1) Human resources policy (or equivalent documentation)\n- Check provider has appropriate human resources to operate the mobile money service.\n- Check the revision date on the policy/equivalent document is within the last 24 months.",null,"Standard Required","Required","HR",null,null,"3","3.4","3.4.1","3.4.1: Les prestataires doivent mettre en place des politiques et des procédures pour la gestion et la surveillance dans le temps de leur personnel, de leurs agents et des entités assurant des services de sous-traitance.","3.4.1.1","POLITIQUE DE GESTION DU PERSONNEL\nLes prestataires doivent mettre en œuvre une politique de gestion des ressources humaines pour le personnel de l’argent mobile. Cette politique doit définir la manière dont le prestataire s’assurera d’avoir les ressources humaines nécessaires à la mise en place et à la gestion du service d’argent mobile. \n\nUn processus de gestion des ressources humaines doit être mis en place pour : \n- déterminer les compétences nécessaires à chaque fonction au sein de l’organisation de l’argent mobile ;\n- dispenser de la formation ou prendre d’autres mesures (ex. embauche) pour obtenir les compétences nécessaires dans chaque fonction ;\n- dispenser de la formation sur les autres processus clés, en matière notamment de lutte contre le blanchiment de capitaux et le financement du terrorisme, de lutte contre la fraude, de conformité réglementaire, de confidentialité des données, de sécurité et de continuité de l’activité ; \n- s’assurer que le personnel connaît ses fonctions et ses responsabilités, et la manière dont celles-ci contribuent au service de l’argent mobile \n- s’assurer que les changements de responsabilité, y compris le début ou la fin d’une responsabilité, sont correctement gérés, avec une formation et une surveillance suffisantes ; \n- conserver des registres adéquats de la formation, des compétences et de l’expérience du personnel.\n","ISO 20000-1:2018 Sec. 5.2,\nGSMA RMT","3.4.1.1.1","une politique de gestion des ressources humaines est-elle en place pour définir la manière dont le prestataire s’assurera d’avoir les ressources humaines nécessaires à la mise en place et à la gestion du service d’argent mobile, et cette politique est-elle tenue à jour ?","1) Politique de gestion des ressources humaines (ou documentation équivalente)\n- Vérifier que le prestataire dispose des ressources humaines nécessaires à la gestion du service d’argent mobile.\n- Vérifier que la politique/le document équivalent a été révisé au cours des 24 derniers mois.",null,{"$f":"VLOOKUP($BH56,CategoryTranslationTable,2,FALSE)","v":"Requis Normal"},{"$f":"VLOOKUP($BI56,CategoryTranslationTable,2,FALSE)","v":"Requis"},"HR",0,null,"3","3.4","3.4.1","3.4.1: Los proveedores deben desarrollar políticas y procesos para la gestión y supervisión continua del personal, los agentes y las entidades que prestan servicios tercerizados","3.4.1.1","POLÍTICA DE GESTIÓN DEL PERSONAL\nLos proveedores deben implementar una política de recursos humanos para su personal del dinero móvil. La política debe determinar cómo el proveedor garantizará que cuenta con los recursos humanos necesarios para implementar y mantener el servicio del dinero móvil.\n\nSe debe implementar un proceso de gestión de los recursos humanos para realizar lo siguiente:\n- Determinar las aptitudes necesarias del personal para cada rol dentro de la organización del dinero móvil.\n- Brindar capacitación o emprender otras acciones (por ej., selección de personal) para alcanzar las aptitudes necesarias en cada rol.\n- Brindar capacitación sobre otros procesos clave, en especial aquellos relacionados con ALA/LFT, contra fraude, cumplimiento regulatorio, privacidad de los datos, seguridad y continuidad del negocio.\n- Garantizar que el personal conozca sus roles y responsabilidades, y cómo sus roles contribuyen al servicio del dinero móvil.\n- Garantizar que los cambios de responsabilidad, incluyendo el inicio o terminación de una responsabilidad, sean gestionados adecuadamente, incluso mediante la correcta capacitación y monitoreo.\n- Mantener los registros adecuados de capacitación, habilidades y experiencia del personal.\n","ISO 20000-1:2018 Sec. 5.2,\nGSMA RMT","3.4.1.1.1","¿Se implementó una política de recursos humanos que determine cómo el proveedor garantizará que cuenta con los recursos humanos necesarios para implementar y mantener el servicio del dinero móvil, y esta política se mantiene actualizada?","1) Política de recursos humanos (o documentación equivalente)\n- Verificar que el proveedor cuente con los recursos humanos adecuados para operar el servicio del dinero móvil.\n- Verificar que la fecha de revisión de la política/documento equivalente sea dentro de los últimos 24 meses.",null,{"$f":"VLOOKUP($BH56,CategoryTranslationTable,3,FALSE)","v":"Obligatorio estándar"},{"$f":"VLOOKUP($BI56,CategoryTranslationTable,3,FALSE)","v":"Obligatorio"},"HR",null,null,"3","3.4","3.4.1",null,"3.4.1.1",null,"ISO 20000-1:2018 Sec. 5.2,\nGSMA RMT","3.4.1.1.1",null,null,null,{"$f":"VLOOKUP($BH56,CategoryTranslationTable,4,FALSE)","v":"ReqS4"},{"$f":"VLOOKUP($BI56,CategoryTranslationTable,4,FALSE)","v":"Req4"},"HR",null,null,null,null,null,null,null,null,"3.4.1.1.1",null,null,null,{"$f":"IF(OR($EA56=0,$EA56=2),VLOOKUP(DO56,INDIRECT(ED56),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP56),\"\",VLOOKUP(DP56,INDIRECT(EE56),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ56),\"\",VLOOKUP(DQ56,INDIRECT(EF56),7,FALSE))","v":""},"",{"$f":"IF(OR($EA56=0,$EA56=2),VLOOKUP(DO56,INDIRECT(ED56),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP56),\"\",VLOOKUP(DP56,INDIRECT(EE56),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ56),\"\",VLOOKUP(DQ56,INDIRECT(EF56),8,FALSE))","v":""},"",{"$f":"1*AND(LEFT(DN56,3)=\"NEW\")+2*AND(LEFT(DN56,3)=\"MER\")+3*AND(LEFT(DN56,3)=\"MOV\")+4*AND(LEFT(DN56,3)=\"SWA\")","v":0},{"$error":"#REF!"},{"$f":"IF(EA56=0,IF(DW56=0,\"\",DW56),CHOOSE(EA56,\"New indicator\",CONCATENATE(DW56,CarriageReturn,DX56,CarriageReturn,DY56,CarriageReturn,DZ56)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO56,1)","v":"OriginalComplianceP3"},{"$f":"\"OriginalComplianceP\"&LEFT(DP56,1)","v":"OriginalComplianceP"},"OriginalComplianceP","OriginalComplianceP",{"$f":"COUNTIF($DS56:$DV56,EH$3)","v":0},0,0,0,0,1,{"$f":"IF(OR(AND(EH56>0,SUM(EI56:EL56)>0),EK56>0),\"Partial\",IF(EH56=EM56,\"Yes\",IF(EI56=EM56,\"No\",IF(EJ56=EM56,\"N/A\",IF(EK56=EM56,\"Partial\",IF(EL56=EM56,\"\",\"\"))))))","v":""}]
[null,"3","3.4","3.4.1",0,"3.4.1.1",null,"00:00:00","3.4.1.1.2","3.4.1.1.2: Are the competencies required for each role being identified, and are competency gaps being filled through training or recruitment?\n",{"$f":"CHOOSE(LanguageNumber,BF57,BV57,CL57,DB57)","v":0},0,"Recommended","Recommended","HR",{"$f":"CHOOSE(LanguageNumber,BK57,CA57,CQ57,#REF!)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1",null,"3.4.1.1",null,null,"3.4.1.1.2",{"$f":"DO57","v":"3.4.1.1.2"},"Are the competencies required for each role being identified, and are competency gaps being filled through training or recruitment?",null,null,"Recommended","Recommended","HR",null,null,"3","3.4","3.4.1",0,"3.4.1.1",0,"00:00:00","3.4.1.1.2","les compétences requises pour chaque fonction sont-elles dûment identifiées, et les lacunes de compétence sont-elles comblées au moyen d'une formation ou d'un recutement ?",null,null,"Recommandé","Recommandé","HR",0,null,"3","3.4","3.4.1",null,"3.4.1.1",null,"00:00:00","3.4.1.1.2","¿Se identifican las aptitudes requeridas para cada rol, y las deficiencias de aptitudes se compensan con capacitación o selección de personal?",null,null,"Recomendado","Recomendado","HR",null,null,"3","3.4","3.4.1",null,"3.4.1.1",null,"00:00:00","3.4.1.1.2",null,null,null,"Rec4","Rec4","HR",null,null,null,null,null,null,null,null,"3.4.1.1.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1","","3.4.1.2",{"$f":"AZ58&\": \"&CHOOSE(LanguageNumber,BA58,BR58,CH58,CX58)","v":"3.4.1.2: STAFF MANAGEMENT PROCESS\nA process should be defined for dealing with unsatisfactory performance from staff. The process should determine how to respond to unsatisfactory performance or breaches of process / policy. The process should include the following:\n- Assisting staff to improve through coaching, training or other mechanisms;\n- Disciplinary procedure to address continued poor performance or more substantial issues;\n- Termination for serious failings - including specification of the circumstances under which staff can be terminated and the procedures to be followed;\n- Procedure for managing disputes with staff."},"ECB RSMP, ISO 27015:2012 Sec. 7.4","3.4.1.2.1","3.4.1.2.1: Has a process been defined for dealing with unsatisfactory performance from staff and breaches of process / policy?\n",0,0,"Recommended","Recommended","HR",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.2","STAFF MANAGEMENT PROCESS\nA process should be defined for dealing with unsatisfactory performance from staff. The process should determine how to respond to unsatisfactory performance or breaches of process / policy. The process should include the following:\n- Assisting staff to improve through coaching, training or other mechanisms;\n- Disciplinary procedure to address continued poor performance or more substantial issues;\n- Termination for serious failings - including specification of the circumstances under which staff can be terminated and the procedures to be followed;\n- Procedure for managing disputes with staff.","ECB RSMP, ISO 27015:2012 Sec. 7.4","3.4.1.2.1","3.4.1.2.1","Has a process been defined for dealing with unsatisfactory performance from staff and breaches of process / policy?",null,null,"Recommended","Recommended","HR",null,null,"3","3.4","3.4.1","","3.4.1.2","PROCESSUS DE GESTION DU PERSONNEL\nUn processus doit être défini pour répondre aux situations de performance non satisfaisante du personnel. Ce processus doit préciser le mode de réponse à une insuffisance de performance ou à des violations de procédure / politique et prévoir les éléments suivants : \n- assistance au personnel pour améliorer la situation au moyen d’un accompagnement, d’une formation ou d’autres mécanismes ;\n- procédure disciplinaire en réponse à une mauvaise performance persistante ou à des problèmes plus graves ; \n- licenciement en cas de faute grave, en précisant les circonstances justifiant le licenciement d'un collaborateur et les procédures à suivre ; \n- procédure de gestion des litiges avec le personnel.","ECB RSMP, ISO 27015:2012 Sec. 7.4","3.4.1.2.1","existe-t-il un processus défini de réponse à une insuffisance de performance d'un collaborateur ou à des violations de procédure ou de politique ?",null,null,"Recommandé","Recommandé","HR",0,null,"3","3.4","3.4.1","","3.4.1.2","PROCESO DE GESTIÓN DEL PERSONAL\nSe debe definir un proceso para tratar el desempeño insatisfactorio del personal. El proceso debe determinar cómo responder ante el desempeño insatisfactorio o los incumplimientos del proceso / política. El proceso debe incluir lo siguiente:\n- Ayudar al personal a progresar mediante entrenamiento, capacitación u otros mecanismos;\n- Procedimiento disciplinario para abordar el continuo desempeño insatisfactorio  o problemas más sustanciales;\n- Desvinculación por fallas graves - que incluya la especificación de circunstancias bajo las cuales el personal puede ser desvinculado y los procedimientos a seguir;\n- Procedimiento de gestión de controversias con el personal.","ECB RSMP, ISO 27015:2012 Sec. 7.4","3.4.1.2.1","¿Se definió un proceso para tratar el desempeño insatisfactorio del personal y los incumplimientos del proceso / política?",null,null,"Recomendado","Recomendado","HR",null,null,"3","3.4","3.4.1",null,"3.4.1.2",null,"ECB RSMP, ISO 27015:2012 Sec. 7.4","3.4.1.2.1",null,null,null,"Rec4","Rec4","HR",null,null,null,null,null,null,null,null,"3.4.1.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1","","3.4.1.3","3.4.1.3: AGENT MANAGEMENT POLICY\nProviders should set a policy for managing their agent network, including:\n- Definition of an agent management function within the provider;\n- The level of direct contracting with individual agents that the provider can support and the proportion of agents that should be engaged via master agents or aggregators;\n- Selection criteria for appropriate agents / master agents / agent aggregators;\n- Acceptable level of agent management concentration risk associated with agents (i.e. number/percentage of agents managed by a single master agent / agent aggregator).",0,"3.4.1.3.1","3.4.1.3.1: Does the agent management policy define the level of direct contracting with individual agents that the provider can support and the proportion of agents that should be engaged via master agents or aggregators?\n",0,0,"Recommended","Recommended","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.3","AGENT MANAGEMENT POLICY\nProviders should set a policy for managing their agent network, including:\n- Definition of an agent management function within the provider;\n- The level of direct contracting with individual agents that the provider can support and the proportion of agents that should be engaged via master agents or aggregators;\n- Selection criteria for appropriate agents / master agents / agent aggregators;\n- Acceptable level of agent management concentration risk associated with agents (i.e. number/percentage of agents managed by a single master agent / agent aggregator).",null,"3.4.1.3.1","3.4.1.3.3","Does the agent management policy define the level of direct contracting with individual agents that the provider can support and the proportion of agents that should be engaged via master agents or aggregators?",null,null,"Recommended","Recommended","Agent",null,null,"3","3.4","3.4.1","","3.4.1.3","POLITIQUE DE GESTION DES AGENTS\nLes prestataires doivent définir une politique de gestion de leur réseau d’agents couvrant les aspects suivants :\n- définition d’une fonction de responsable des agents du prestataire ;\n- niveau de relations contractuelles directes avec des agents individuels que le prestataire peut gérer et proportion d’agents devant être engagés par l’intermédiaire d’agents principaux ou d'agrégateurs d’agents ;\n- critères de sélection des agents / agents principaux / agrégateurs d'agents compétents\n- niveau acceptable de risque de concentration de la gestion des agents (à savoir nombre / pourcentage d’agents gérés par un seul agent principal ou agrégateur d’agents).",0,"3.4.1.3.1","la politique de gestion des agents définit-elle le niveau de relations contractuelles directes avec des agents individuels que le prestataire peut gérer et la proportion d’agents devant être engagés par l’intermédiaire d’agents principaux ou d'agrégateurs d’agents ?",null,null,"Recommandé","Recommandé","Agent",0,null,"3","3.4","3.4.1","","3.4.1.3","POLÍTICA DE GESTIÓN DE AGENTES\nLos proveedores deben establecer una política para gestionar su red de agentes, que incluya:\n- Definición de una función de gestión de agentes dentro del proveedor;\n- El nivel de contratación directa con agentes individuales que el proveedor puede asumir y la proporción de agentes que deben ser contratados a través de agentes maestros o agregadores;\n- Criterios de selección de los agentes / agentes maestros / agregadores de agentes adecuados;\n- Nivel aceptable del riesgo de concentración de gestión de agentes asociado a los agentes (es decir, cantidad/porcentaje de agentes gestionados por un solo agente maestro / agregador de agentes).",0,"3.4.1.3.1","¿La política de gestión de agentes define el nivel de contratación directa con agentes individuales que el proveedor puede asumir y la proporción de agentes que deben ser contratados a través de agentes maestros o agregadores?",null,null,"Recomendado","Recomendado","Agent",null,null,"3","3.4","3.4.1",null,"3.4.1.3",null,0,"3.4.1.3.1",null,null,null,"Rec4","Rec4","Agent",null,null,null,null,null,null,null,null,"3.4.1.3.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1","","3.4.1.3",null,0,"3.4.1.3.2","3.4.1.3.2: Does the agent management policy define selection criteria for appropriate agents / master agents / agent aggregators?\n",0,0,"Recommended","Recommended","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.3",null,null,"3.4.1.3.2","3.4.1.3.4","Does the agent management policy define selection criteria for appropriate agents / master agents / agent aggregators?",null,null,"Recommended","Recommended","Agent",null,null,"3","3.4","3.4.1","","3.4.1.3",null,0,"3.4.1.3.2","la politique de gestion des agents définit-elle le mode de sélection des agents / agents principaux / agrégateurs d’agents ?",null,null,"Recommandé","Recommandé","Agent",0,null,"3","3.4","3.4.1","","3.4.1.3",null,0,"3.4.1.3.2","¿La política de gestión de agentes define los criterios de selección para los agentes / agentes maestros / agregadores de agentes correspondientes?",null,null,"Recomendado","Recomendado","Agent",null,null,"3","3.4","3.4.1",null,"3.4.1.3",null,0,"3.4.1.3.2",null,null,null,"Rec4","Rec4","Agent",null,null,null,null,null,null,null,null,"3.4.1.3.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1","","3.4.1.3",null,0,"3.4.1.3.3","3.4.1.3.3: Does the agent management policy define an acceptable level of agent management concentration risk (i.e. number/percentage of agents managed by a single master agent / agent aggregator)?\n",0,0,"Recommended","Recommended","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.3",null,null,"3.4.1.3.3",{"$f":"DO61","v":"3.4.1.3.5"},"Does the agent management policy define an acceptable level of agent management concentration risk (i.e. number/percentage of agents managed by a single master agent / agent aggregator)?",null,null,"Recommended","Recommended","Agent",null,null,"3","3.4","3.4.1","","3.4.1.3",null,0,"3.4.1.3.3","la politique de gestion des agents définit-elle le niveau acceptable de risque de concentration de la gestion des agents (à savoir nombre / pourcentage d’agents gérés par un seul agent principal ou agrégateur d’agents) ?",null,null,"Recommandé","Recommandé","Agent",0,null,"3","3.4","3.4.1","","3.4.1.3",null,0,"3.4.1.3.3","¿La política de gestión de agentes define un nivel aceptable de riesgo de concentración de gestión de agentes (es decir, cantidad/porcentaje de agentes gestionados por un solo agente maestro / agregador de agentes)?",null,null,"Recomendado","Recomendado","Agent",null,null,"3","3.4","3.4.1",null,"3.4.1.3",null,0,"3.4.1.3.3",null,null,null,"Rec4","Rec4","Agent",null,null,null,null,null,null,null,null,"3.4.1.3.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1","","3.4.1.4","3.4.1.4: AGENT MANAGEMENT PROCESS\nThe roles and responsibilities of the provider's agent management function should be clearly defined to carry out management of agents. Business processes for agent management should be specified, and monitored to ensure that they are working efficiently.\n\nProviders should ensure that there are clear lines of communication for information exchange with master agents and agent aggregators, so that relevant information is shared promptly by both parties.  Routes for escalation of issues should be made available to agents (e.g. through regular contact with the agent manager).",0,"3.4.1.4.1","3.4.1.4.1: Have roles and responsibilities been defined to carry out management of agents?\n","1) Agent management process or RACI or sample agent contract or similar document\n- Check that roles and responsibilities for agent management have been defined.",0,"Standard Required","Required","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.4","AGENT MANAGEMENT PROCESS\nThe roles and responsibilities of the provider's agent management function should be clearly defined to carry out management of agents. Business processes for agent management should be specified, and monitored to ensure that they are working efficiently.\n\nProviders should ensure that there are clear lines of communication for information exchange with master agents and agent aggregators, so that relevant information is shared promptly by both parties.  Routes for escalation of issues should be made available to agents (e.g. through regular contact with the agent manager).",null,"3.4.1.4.1","3.4.1.4.1","Have roles and responsibilities been defined to carry out management of agents?","1) Agent management process or RACI or sample agent contract or similar document\n- Check that roles and responsibilities for agent management have been defined.",null,"Standard Required","Required","Agent",null,null,"3","3.4","3.4.1","","3.4.1.4","PROCESSUS DE GESTION DES AGENTS\nLes rôles et les responsabilités de la fonction de responsable des agents du prestataire doivent être clairement définis afin de réaliser la gestion des agents. Les processus commerciaux pour la gestion des agents doivent être spécifiés et surveillés pour s’assurer de leur bon fonctionnement.\n\nLes prestataires doivent veiller à ce qu’il existe des lignes claires de communication pour l’échange d’informations avec les agents principaux / agrégateurs d’agents afin que les informations utiles circulent rapidement entre les parties concernées.  Des procédures de remontée des problèmes des deux côtés de la relation doivent également être mises en place.",0,"3.4.1.4.1","Les rôles et responsabilités pour réaliser la gestion des agents ont-ils été clairement définis ?","1) Processus de gestion des agents ou RACI ou modèle de contrat d’agent ou document similaire\n- Vérifier que les rôles et les responsabilités en matière de gestion des agents ont été définis.",null,"Requis Normal","Requis","Agent",0,null,"3","3.4","3.4.1","","3.4.1.4","PROCESO DE GESTIÓN DE AGENTES\nSe deben definir con claridad los roles y responsabilidades de la función de gestión de agentes del proveedor para llevar a cabo la gestión de los agentes. Se deben especificar los procesos del negocio para la gestión de agentes, y se deben monitorear para garantizar que funcionen eficientemente.\n\nLos proveedores deben garantizar que existan líneas de comunicación claras para el intercambio de información con los agentes maestros y agregadores de agentes, a fin de que la información relevante sea intercambiada de inmediato entre ambas partes.  Se deben implementar procedimientos para el escalamiento de problemas en ambos lados de la relación.",0,"3.4.1.4.1","¿Se definieron roles y responsabilidades para llevar a cabo la gestión de agentes?","1) Proceso de gestión de agentes, matriz de asignación de responsabilidades (RACI), modelo de contrato con los agentes o documento similar\n- Verificar que se hayan definido los roles y responsabilidades para la gestión de agentes.",null,"Obligatorio estándar","Obligatorio","Agent",null,null,"3","3.4","3.4.1",null,"3.4.1.4",null,0,"3.4.1.4.1",null,null,null,"ReqS4","Req4","Agent",null,null,null,null,null,null,null,null,"3.4.1.4.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1","","3.4.1.4",null,0,"3.4.1.4.2","3.4.1.4.2: Are agents provided with a route to escalate issues?\n","1) Agent management process or RACI or sample agent contract or similar document\n- Check there is a process for agents to escalate issues (e.g. through regular contact with the agent manager).\n",0,"Standard Required","Required","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.4",null,null,"3.4.1.4.2","3.4.1.4.3","Are agents provided with a route to escalate issues?","1) Agent management process or RACI or sample agent contract or similar document\n- Check there is a process for agents to escalate issues (e.g. through regular contact with the agent manager).\n",null,"Standard Required","Required","Agent",null,null,"3","3.4","3.4.1","","3.4.1.4",null,0,"3.4.1.4.2","Les agents bénéficient-ils d'une procédure de remontée des problèmes ?","1) Processus de gestion des agents ou RACI ou modèle de contrat d’agent ou document similaire\n- Vérifier qu’un processus a été mis en place afin de permettre aux agents de signaler tout problème (en s'assurant par exemple qu'ils puissent établir un contact régulier avec leur responsable)\n",null,"Requis Normal","Requis","Agent",0,null,"3","3.4","3.4.1","","3.4.1.4",null,0,"3.4.1.4.2","¿Se entrega a los agentes un procedimiento para el escalamiento de problemas?","1) Proceso de gestión de agentes, matriz de asignación de responsabilidades (RACI), modelo de contrato con los agentes o documento similar\n- Verificar que exista un proceso para que los agentes escalen los problemas (por ej., a través de contacto regular con el gerente de agentes).\n",null,"Obligatorio estándar","Obligatorio","Agent",null,null,"3","3.4","3.4.1",null,"3.4.1.4",null,0,"3.4.1.4.2",null,null,null,"ReqS4","Req4","Agent",null,null,null,null,null,null,null,null,"3.4.1.4.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1","","3.4.1.5","3.4.1.5: AGENT MONITORING\nProcesses should be implemented to monitor agents and to notify agents (and their master agents / agent aggregators) of unsatisfactory performance. Relevant information should also be provided to internal management. \nProviders should use a combination of on-site visits (e.g. mystery shoppers) and off-site monitoring (e.g. transaction / location monitoring). Monitoring should address at least the following:\n- Ensuring personal details (KYC) are correctly obtained and verified when registering customers (see 2.6.2 - AML Compliance); \n- Ensuring identity checks are done correctly for cash-in/out;\n- Ensuring processes are followed;\n- Following-up customer complaints.\n\nNote: Contractual agreements should specify that providers may monitor and audit agent to ensure that the provider’s obligations to customers and regulators are being met. Contractual agreements should also specify that providers have access to all relevant records and other information held by agents (see 3.3.1 - Contractual agreements). ","GSMA RMT\n(AG-03, \nAG-04,\nAG-05)","3.4.1.5.1","3.4.1.5.1: Have processes been implemented to monitor agents and to notify agents (and their master agents / agent aggregators) of unsatisfactory performance?\n","1) Agent management process or RACI or sample agent contract or similar document\n- Check there is a process to monitor agents\n- Check there is a process for agents, master agents and agent aggregators to be informed of unsatisfactory performance\n",0,"Urgent Required","Required","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.5","AGENT MONITORING\nProcesses should be implemented to monitor agents and to notify agents (and their master agents / agent aggregators) of unsatisfactory performance. Relevant information should also be provided to internal management. \nProviders should use a combination of on-site visits (e.g. mystery shoppers) and off-site monitoring (e.g. transaction / location monitoring). Monitoring should address at least the following:\n- Ensuring personal details (KYC) are correctly obtained and verified when registering customers (see 2.6.2 - AML Compliance); \n- Ensuring identity checks are done correctly for cash-in/out;\n- Ensuring processes are followed;\n- Following-up customer complaints.\n\nNote: Contractual agreements should specify that providers may monitor and audit agent to ensure that the provider’s obligations to customers and regulators are being met. Contractual agreements should also specify that providers have access to all relevant records and other information held by agents (see 3.3.1 - Contractual agreements). ","GSMA RMT\n(AG-03, \nAG-04,\nAG-05)","3.4.1.5.1","3.4.1.5.1","Have processes been implemented to monitor agents and to notify agents (and their master agents / agent aggregators) of unsatisfactory performance?","1) Agent management process or RACI or sample agent contract or similar document\n- Check there is a process to monitor agents\n- Check there is a process for agents, master agents and agent aggregators to be informed of unsatisfactory performance\n",null,"Urgent Required","Required","Agent",null,null,"3","3.4","3.4.1","","3.4.1.5","SURVEILLANCE DES AGENTS\nDes processus doivent être mis en place pour surveiller les agents et les notifier (ainsi que leur agent principal / agrégateur d’agents) de toute insuffisance de performance. Des informations appropriées doivent également être communiquées à la direction interne. \nLes prestataires doivent utiliser une combinaison de visites sur place (ex. visites mystères) et de surveillance à distance (ex. surveillance des opérations et de leur localisation). La surveillance doit au minimum couvrir les aspects suivants :\n- vérifier que les renseignements d’identité (KYC) sont dûment collectés et vérifiés lors de l’enregistrement des clients (c.f. 2.6.2 - Conformité AML) ; \n- vérifier que les contrôles d’identité sont faits correctement lors des opérations de dépôt et retrait d’espèces ;\n- vérifier que les processus sont respectés ;\n- le suivi des réclamations de clients.\n\nRemarque :  les accords contractuels doivent spécifier que le prestataire peut surveiller les agents et effectuer des audits afin de s’assurer du respect de ses obligations à l’égard des clients et des régulateurs. Ils doivent également spécifier que le prestataire a un droit d’accès à tous les registres et autres informations pertinentes détenues par les agents (cf. 3.3.1 - Accord contractuels). ","GSMA RMT\n(AG-03, \nAG-04,\nAG-05)","3.4.1.5.1","existe-t-il des processus de surveillance et de notification des agents (et de leur agent principal/ agrégateur) en cas de performance insuffisante ?","1) Processus de gestion des agents ou RACI ou modèle de contrat d’agent ou document similaire\n- Vérifier qu’un processus de surveillance des agents a été mis en place\n- Vérifier qu’un processus a été mis en place afin de notifier les agents, les agents principaux et les agrégateurs d’agents en cas de performance insuffisante\n",null,"Requis Prioritaire","Requis","Agent",0,null,"3","3.4","3.4.1","","3.4.1.5","MONITOREO DE AGENTES\nSe deben implementar procesos para monitorear a los agentes y notificar el desempeño insatisfactorio a los agentes (y sus agentes maestros / agregadores de agentes). También se debe proporcionar información relevante a la gestión interna. \nLos proveedores deben emplear una combinación de visitas en el lugar (por ej., clientes incógnitos) y monitoreo fuera del lugar (por ej., monitoreo de transacciones / ubicaciones). El monitoreo debe abordar, al menos, lo siguiente:\n- Garantizar que los detalles de los clientes (registros de conocimiento del cliente - CSC) sean correctamente obtenidos y verificados al registrar a los clientes (ver 2.6.2 - Cumplimiento ALA); \n- Garantizar que se realicen correctamente las verificaciones para el ingreso/retiro de efectivo;\n- Garantizar que se sigan los procesos;\n- Realizar un seguimiento de los reclamos de los clientes.\n\nNota: Los acuerdos contractuales deben especificar que los proveedores pueden monitorear y auditar al agente para garantizar que se cumplan las obligaciones del proveedor frente a los clientes y a los reguladores. Los acuerdos contractuales también deben especificar que los proveedores tienen acceso a todos los registros y demás información pertinente en posesión de los agentes (ver 3.3.1 - Acuerdos contractuales). ","GSMA RMT\n(AG-03, \nAG-04,\nAG-05)","3.4.1.5.1","¿Se implementaron procesos para monitorear a los agentes y notificar el desempeño insatisfactorio a los agentes (y sus agentes maestros / agregadores de agentes)?","1) Proceso de gestión de agentes, matriz de asignación de responsabilidades (RACI), modelo de contrato con los agentes o documento similar\n- Verificar que exista un proceso para monitorear a los agentes\n- Verificar que exista un proceso para notificar el desempeño insatisfactorio a los agentes, agentes maestros y agregadores de agentes\n",null,"Obligatorio urgente","Obligatorio","Agent",null,null,"3","3.4","3.4.1",null,"3.4.1.5",null,"GSMA RMT\n(AG-03, \nAG-04,\nAG-05)","3.4.1.5.1",null,null,null,"ReqU4","Req4","Agent",null,null,null,null,null,null,null,null,"3.4.1.5.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1","","3.4.1.5",null,0,"3.4.1.5.2","3.4.1.5.2: Are both on-site visits (e.g. mystery shoppers) and off-site monitoring (e.g. transaction/ location monitoring) used to monitor/ audit agents?\n","1) Agent management process or RACI or sample agent contract or similar document\n- Check the process for monitoring agents includes:\n        a) onsite visits (e.g. mystery shopping)\n        b) off-site monitoring (e.g. transaction / complaints monitoring)\n\n2) Agent monitoring records\n- Check that the process is active by reviewing records or schedules of site-visits\n",0,"Urgent Required","Required","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.5",null,null,"3.4.1.5.2","3.4.1.5.2","Are both on-site visits (e.g. mystery shoppers) and off-site monitoring (e.g. transaction/ location monitoring) used to monitor/ audit agents?","1) Agent management process or RACI or sample agent contract or similar document\n- Check the process for monitoring agents includes:\n        a) onsite visits (e.g. mystery shopping)\n        b) off-site monitoring (e.g. transaction / complaints monitoring)\n\n2) Agent monitoring records\n- Check that the process is active by reviewing records or schedules of site-visits\n",null,"Urgent Required","Required","Agent",null,null,"3","3.4","3.4.1","","3.4.1.5",0,0,"3.4.1.5.2","la surveillance et l'audit des agents comprennent-ils à la fois des visites sur site (ex. visites mystère) et une surveillance à distance (ex. surveillance des opérations et de leur localisation) ?","1) Processus de gestion des agents ou RACI ou modèle de contrat d’agent ou document similaire\n- Vérifier que le processus de surveillance des agents comprend :\n a) des visites sur site (par exemple, des visites mystère)\n b) une surveillance à distance (par exemple, une surveillance des transactions/des réclamations)\n\n2) Registres de surveillance des agents\n- Vérifier que le processus est actif en examinant les registres ou les plannings de visites sur site\n",null,"Requis Prioritaire","Requis","Agent",0,null,"3","3.4","3.4.1","","3.4.1.5",null,0,"3.4.1.5.2","¿Para monitorear/auditar a los agentes se utilizan las visitas en el lugar (por ej., clientes incógnitos) y monitoreo fuera del lugar (por ej., monitoreo de transacciones / ubicaciones)?","1) Proceso de gestión de agentes, matriz de asignación de responsabilidades (RACI), modelo de contrato con los agentes o documento similar\n- Verificar que el proceso para monitorear a los agentes incluya:\n        a) visitas en el lugar (por ej., clientes incógnitos)\n        b) monitoreo fuera del lugar (por ej., monitoreo de transacciones / ubicaciones)\n\n2) Registros de monitoreo de agentes\n- Verificar que el proceso esté activo mediante la revisión de registros o cronogramas de visitas en el sitio\n",null,"Obligatorio urgente","Obligatorio","Agent",null,null,"3","3.4","3.4.1",null,"3.4.1.5",null,0,"3.4.1.5.2",null,null,null,"ReqU4","Req4","Agent",null,null,null,null,null,null,null,null,"3.4.1.5.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1","","3.4.1.5",null,0,"3.4.1.5.3","3.4.1.5.3: Are customer complaints about agents tracked and action taken on regularly-offending agents?\n","1) Sample records of complaints about agents\n- Look at a sample of customer complaints about agents to ensure the process is being followed, complaints are being recored and actions taken.\n",0,"Urgent Required","Required","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.5",null,null,"3.4.1.5.3","3.4.1.5.5","Are customer complaints about agents tracked and action taken on regularly-offending agents?","1) Sample records of complaints about agents\n- Look at a sample of customer complaints about agents to ensure the process is being followed, complaints are being recored and actions taken.\n",null,"Urgent Required","Required","Agent",null,null,"3","3.4","3.4.1","","3.4.1.5",0,0,"3.4.1.5.3","Les réclamations des clients à l’égard des agents sont-elles enregistrées et des sanctions sont-elles prises à l’encontre des agents commettant régulièrement des fautes ?","1) Extrait des registres de réclamations relatives aux agents \n- Examiner un extrait des registres de réclamations des clients concernant les agents afin de s’assurer que le processus est appliqué, que les réclamations sont consignées et que les mesures appropriées sont prises.\n",null,"Requis Prioritaire","Requis","Agent",0,null,"3","3.4","3.4.1","","3.4.1.5",null,0,"3.4.1.5.3","¿Se rastrean los reclamos sobre los agentes y se toman medidas con los agentes contra los cuales se presentan reclamos de forma regular?","1) Muestra de registros de reclamos sobre agentes\n- Revisar una muestra de los reclamos sobre los agentes para garantizar que se siga el proceso, que se registren los reclamos y se tomen medidas.\n",null,"Obligatorio urgente","Obligatorio","Agent",null,null,"3","3.4","3.4.1",null,"3.4.1.5",null,0,"3.4.1.5.3",null,null,null,"ReqU4","Req4","Agent",null,null,null,null,null,null,null,"MERGE","3.4.1.5.5","7.1.1.7.1",null,null,{"$error":"#REF!"},{"$error":"#REF!"},"","",{"$error":"#REF!"},{"$error":"#REF!"},"","",2,"",{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,2,""]
[null,"3","3.4","3.4.1","","3.4.1.6","3.4.1.6: AGENT SANCTIONS AND TERMINATION\nA sanctions and termination process should be defined and agreed with each agent / master agent / agent aggregator (as applicable) for escalation and resolution of unsatisfactory performance or breaches of process / policy. The process should clearly describe the circumstances under which agents can be terminated and the procedures to be followed.\n\nThe process should include escalating levels of sanctions up to termination of an individual agent / master agent / agent aggregator. Examples of sanctions that could be considered include:\n\n- 3 strikes and out for minor offences;\n- Financial sanctions;\n- Tiered penalties – increasing severity upon repetition of offence. e.g. suspend agent for 1 day / 1 week / 1 month;\n- Termination of mobile money status (which will cut off this part of their revenue stream);\n- Termination of mobile reseller status, if applicable (which will cut off further revenue stream).\n\nNote: Agents should be reported to the police if criminal activity is discovered.",0,"3.4.1.6.1","3.4.1.6.1: Has a sanctions and termination process been agreed with each agent / master agent / agent aggregator (as applicable) for escalation and resolution of unsatisfactory performance or breaches of process / policy?\n","1) Agent management process or RACI or sample agent contract or record of agent sanctions or similar document\n- Check that the there is a process to sanction and/or terminate agents / master agents / agent aggregators (as applicable) of unsatisfactory performance or breaches of process / policy. \n- Check that the process includes escalation and resolution measures.",0,"Standard Required","Required","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.6","AGENT SANCTIONS AND TERMINATION\nA sanctions and termination process should be defined and agreed with each agent / master agent / agent aggregator (as applicable) for escalation and resolution of unsatisfactory performance or breaches of process / policy. The process should clearly describe the circumstances under which agents can be terminated and the procedures to be followed.\n\nThe process should include escalating levels of sanctions up to termination of an individual agent / master agent / agent aggregator. Examples of sanctions that could be considered include:\n\n- 3 strikes and out for minor offences;\n- Financial sanctions;\n- Tiered penalties – increasing severity upon repetition of offence. e.g. suspend agent for 1 day / 1 week / 1 month;\n- Termination of mobile money status (which will cut off this part of their revenue stream);\n- Termination of mobile reseller status, if applicable (which will cut off further revenue stream).\n\nNote: Agents should be reported to the police if criminal activity is discovered.",null,"3.4.1.6.1","3.4.1.6.1","Has a sanctions and termination process been agreed with each agent / master agent / agent aggregator (as applicable) for escalation and resolution of unsatisfactory performance or breaches of process / policy?","1) Agent management process or RACI or sample agent contract or record of agent sanctions or similar document\n- Check that the there is a process to sanction and/or terminate agents / master agents / agent aggregators (as applicable) of unsatisfactory performance or breaches of process / policy. \n- Check that the process includes escalation and resolution measures.",null,"Standard Required","Required","Agent",null,null,"3","3.4","3.4.1","","3.4.1.6","SANCTIONS ET RÉSILIATION DU CONTRAT DES AGENTS\nUn processus de sanctions et de résiliation du contrat doit être défini et convenu avec chaque agent / agent principal / agrégateur d’agents (selon le cas) pour la remontée et la résolution des situations de performance non satisfaisante ou de violation des procédures / politiques. Ce processus doit clairement définir les circonstances dans lesquelles le contrat des agents peut être résilié et les procédures devant être suivies.\n\nIl doit prévoir des sanctions progressives allant jusqu’à la résiliation du contrat d’un agent individuel / agent principal / agrégateur d’agents. Les exemples de sanctions à envisager comprennent :\n\n- sanctions au-delà de trois instances pour des infractions mineures ;\n- sanctions financières ;\n- sanctions progressives, avec sévérité accrue en cas de répétition de l’infraction (par exemple, suspension de l’agent pendant une journée / un mois / définitivement) ;\n- résiliation du statut d’agent de l’argent mobile (ce qui réduira la part correspondante de ses revenus) ;\n- résiliation de son statut de revendeur téléphonique, le cas échéant (ce qui réduira encore plus ses revenus).\n\nRemarque : les agents doivent être signalés à la police en cas d’activités illégales. ",0,"3.4.1.6.1","un processus de sanctions et de résiliation du contrat est-il convenu avec chaque agent / agent principal / agrégateur d’agents (selon le cas) pour la remontée et la résolution des situations de performance non satisfaisante ou de violation des procédures / politiques ?","1) Processus de gestion des agents ou RACI ou modèle de contrat d’agent ou document similaire\n- Vérifier qu’un processus de sanctions et /ou de résiliation du contrat des agents/agents principaux/agrégateurs d’agents (selon le cas) en cas de performance non satisfaisante ou de violation des procédures/politiques a été mis en place \n- Vérifier que le processus inclut des mesures visant à remonter les informations et à résoudre ces situations.",null,"Requis Normal","Requis","Agent",0,null,"3","3.4","3.4.1","","3.4.1.6","SANCIONES Y DESVINCULACIÓN DE LOS AGENTES\nSe debe definir y acordar con cada agente / agente maestro / agregador de agentes (según corresponda) un proceso de sanciones y desvinculación para el escalamiento y la resolución del desempeño insatisfactorio o los incumplimientos del proceso / política. El proceso debe describir con claridad las circunstancias bajo las cuales los agentes pueden ser desvinculados y los procedimientos a seguir.\n\nEl proceso debe incluir los niveles de escalamiento de sanciones hasta la desvinculación de un agente individual / agente maestro / agregador de agentes. Los ejemplos de sanciones que se podrían considerar incluyen:\n\n- 3 casos de reincidencia y desvinculación para faltas leves;\n- Sanciones financieras;\n- Penalidades escalonadas – aumentando la severidad en caso de reincidencia de la falta. Por ej., suspender al agente por 1 día / 1 semana / 1 mes;\n- Terminación de la condición del dinero móvil (implica un recorte a su flujo de ingresos);\n- Terminación de la condición de revendedor móvil, si corresponde (implica un mayor recorte a su flujo de ingresos).\n\nNota: Si se descubren actividades criminales, se debe denunciar a los agentes a la policía.",0,"3.4.1.6.1","¿Se acordó un proceso de sanciones y desvinculación con cada agente / agente maestro / agregador de agentes (según corresponda) para el escalamiento y la resolución del desempeño insatisfactorio o los incumplimientos del proceso / política?","1) Proceso de gestión de agentes, matriz de asignación de responsabilidades (RACI), modelo de contrato con los agentes, registro de sanciones a agentes o documento similar\n- Verificar que exista un proceso de sanción y/o terminación de agentes / agentes maestros / agregadores de agentes (según corresponda) por el desempeño insatisfactorio o el incumplimiento del proceso / política. \n- Verificar que el proceso incluya escalamiento y medidas de resolución.  ",null,"Obligatorio estándar","Obligatorio","Agent",null,null,"3","3.4","3.4.1",null,"3.4.1.6",null,0,"3.4.1.6.1",null,null,null,"ReqS4","Req4","Agent",null,null,null,null,null,null,null,null,"3.4.1.6.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1","","3.4.1.6",null,{"$f":"BB68","v":0},{"$f":"BC68","v":"3.4.1.6.2"},"3.4.1.6.2: Does the sanctions process include escalating levels of sanctions, such as 3 strikes and out / financial sanctions / tiered penalties / termination of mobile money status / termination of mobile reseller status?\n",0,0,"Recommended","Recommended","Agent",{"$f":"CHOOSE(LanguageNumber,BK68,CA68,CQ68,DG68)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.6",null,null,"3.4.1.6.2","3.4.1.6.2","Does the sanctions process include escalating levels of sanctions, such as 3 strikes and out / financial sanctions / tiered penalties / termination of mobile money status / termination of mobile reseller status?",null,null,"Recommended","Recommended","Agent",null,null,"3","3.4","3.4.1","",{"$f":"$AZ68","v":"3.4.1.6"},0,{"$f":"$BB68","v":0},"3.4.1.6.2","le processus de sanctions prévoit-il des niveaux progressifs de sanctions, comme par exemple sanctions au-delà de trois instances pour des infractions mineures / sanctions financières / sanctions progressives / résiliation du statut d'agent de l'argent mobile / résiliation du statut de revendeur téléphonique ?",null,null,"Recommandé","Recommandé","Agent",0,null,"3","3.4","3.4.1","","3.4.1.6",null,{"$f":"$BB68","v":0},"3.4.1.6.2","¿El proceso de sanciones incluye niveles de escalamiento de sanciones, como por ejemplo, 3 casos de reincidencia y desvinculación / sanciones financieras / penalidades escalonadas / terminación de la condición del dinero móvil / terminación de la condición de revendedor móvil?",null,null,"Recomendado","Recomendado","Agent",null,null,"3","3.4","3.4.1",null,{"$f":"$AZ68","v":"3.4.1.6"},null,{"$f":"$BB68","v":0},"3.4.1.6.2",null,null,null,"Rec4","Rec4","Agent",null,null,null,null,null,null,null,null,"3.4.1.6.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1","","3.4.1.6",null,0,"3.4.1.6.3","3.4.1.6.3: Does the sanctions process clearly describe the circumstances under which agents can be terminated and the procedures to be followed?\n",0,0,"Recommended","Recommended","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.6",null,null,"3.4.1.6.3","3.4.1.6.3","Does the sanctions process clearly describe the circumstances under which agents can be terminated and the procedures to be followed?",null,null,"Recommended","Recommended","Agent",null,null,"3","3.4","3.4.1","","3.4.1.6",0,0,"3.4.1.6.3","le processus de sanctions décrit-il clairement les circonstances dans lesquelles le contrat des agents peut être résilié et les procédures devant être suivies ?",null,null,"Recommandé","Recommandé","Agent",0,null,"3","3.4","3.4.1","","3.4.1.6",null,0,"3.4.1.6.3","¿El proceso de sanciones describe con claridad las circunstancias bajo las cuales los agentes pueden ser desvinculados y los procedimientos a seguir?",null,null,"Recomendado","Recomendado","Agent",null,null,"3","3.4","3.4.1",null,"3.4.1.6",null,0,"3.4.1.6.3",null,null,null,"Rec4","Rec4","Agent",null,null,null,null,null,null,null,null,"3.4.1.6.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$f":"IF(EA69=0,DS69,EN69)","v":{"$error":"#REF!"}},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,{"$f":"COUNTIF($DO69:$DR69,\"*?\")","v":1},""]
[null,{"$f":"$AV70","v":"3"},{"$f":"$AW70","v":"3.4"},{"$f":"$AX70","v":"3.4.1"},"","3.4.1.7","3.4.1.7: AGENT DISPUTE MANAGEMENT\nA dispute-management process should be implemented with each agent / master agent / agent aggregator (as applicable) to resolve major issues, disagreements and contractual disputes, with the final escalation being court resolution.",0,"3.4.1.7.1","3.4.1.7.1: Has an agent dispute-management process been implemented to resolve major issues, disagreements and contractual disputes with agents?\n","1) Agent dispute management process / agent contract\n- Check that there is a process documented for agent dispute management\n",0,"Standard Required","Required","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.7","AGENT DISPUTE MANAGEMENT\nA dispute-management process should be implemented with each agent / master agent / agent aggregator (as applicable) to resolve major issues, disagreements and contractual disputes, with the final escalation being court resolution.",null,"3.4.1.7.1","3.4.1.7.1","Has an agent dispute-management process been implemented to resolve major issues, disagreements and contractual disputes with agents?","1) Agent dispute management process / agent contract\n- Check that there is a process documented for agent dispute management\n",null,"Standard Required","Required",{"$f":"$O70","v":"Agent"},null,null,{"$f":"$AV70","v":"3"},{"$f":"$AW70","v":"3.4"},{"$f":"$AX70","v":"3.4.1"},"","3.4.1.7","GESTION DES LITIGES AVEC LES AGENTS\nUn processus de gestion des litiges doit être mis en place avec chaque agent / agent principal / agrégateur d’agents (le cas échéant) pour la résolution des problèmes majeurs, des différends et des litiges contractuels, le stade ultime d’escalade étant la voie judiciaire. ",0,{"$f":"$BC70","v":"3.4.1.7.1"},"un processus de gestion des litiges avec les agents est-il en place pour la résolution des problèmes majeurs, des différends et des litiges contractuels avec les agents ?","1) Processus de gestion des litiges avec les agents/contrat d’agent\n- Vérifier qu’un processus de gestion des litiges avec les agents documenté a été mis en place\n",null,"Requis Normal","Requis",{"$f":"$O70","v":"Agent"},0,null,{"$f":"$AV70","v":"3"},{"$f":"$AW70","v":"3.4"},{"$f":"$AX70","v":"3.4.1"},"",{"$f":"$AZ70","v":"3.4.1.7"},"GESTIÓN DE CONTROVERSIAS CON LOS AGENTES\nSe debe implementar un proceso de gestión de controversias con cada agente / agente maestro / agregador de agentes (según corresponda) para resolver cuestiones importantes, desacuerdos y controversias contractuales, siendo el escalamiento final la resolución judicial.",0,{"$f":"$BC70","v":"3.4.1.7.1"},"¿Se implementó un proceso de gestión de controversias para resolver cuestiones importantes, desacuerdos y controversias contractuales con los agentes?","1) Proceso de gestión de controversias con los agentes / contrato con los agentes \n- Verificar que exista un proceso documentado de gestión de controversias con los agentes\n",null,"Obligatorio estándar","Obligatorio",{"$f":"$O70","v":"Agent"},null,null,{"$f":"$AV70","v":"3"},{"$f":"$AW70","v":"3.4"},{"$f":"$AX70","v":"3.4.1"},null,"3.4.1.7",null,0,{"$f":"$BC70","v":"3.4.1.7.1"},null,null,null,"ReqS4","Req4",{"$f":"$O70","v":"Agent"},null,null,null,null,null,null,null,null,"3.4.1.7.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1","","3.4.1.8","3.4.1.8: AGENT AVAILABILITY AND LIQUIDITY\nProviders should monitor customers' usage patterns and their agent network to ensure sufficient coverage of agents, given current and anticipated usage patterns.\n\nAgent liquidity should be monitored. If necessary, providers should establish super-agents to assist agents in maintaining liquidity and should continue to optimize liquidity management. ","GSMA RMT\n(AG-18,\nAG-19)","3.4.1.8.1","3.4.1.8.1: Are customers' usage patterns and the agent network monitored to ensure sufficient coverage of agents, given current and anticipated usage patterns?\n",0,0,"Recommended","Recommended","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.8","AGENT AVAILABILITY AND LIQUIDITY\nProviders should monitor customers' usage patterns and their agent network to ensure sufficient coverage of agents, given current and anticipated usage patterns.\n\nAgent liquidity should be monitored. If necessary, providers should establish super-agents to assist agents in maintaining liquidity and should continue to optimize liquidity management. ","GSMA RMT\n(AG-18,\nAG-19)","3.4.1.8.1","3.4.1.8.1","Are customers' usage patterns and the agent network monitored to ensure sufficient coverage of agents, given current and anticipated usage patterns?",null,null,"Recommended","Recommended","Agent",null,null,"3","3.4","3.4.1","","3.4.1.8","DISPONIBILITÉ ET LIQUIDITÉ DES AGENTS\nLes prestataires doivent surveiller les comportements d’utilisation des clients et de leur réseau d’agents pour garantir une couverture suffisante d’agents sur la base des comportements d’utilisation existants et prévus.\n\nLa liquidité des agents doit être surveillée. Si nécessaire, les prestataires doivent mettre en place des super-agents pour aider les agents à maintenir un niveau suffisant de liquidité et continuer à optimiser la gestion de la liquidité. ","GSMA RMT\n(AG-18,\nAG-19)","3.4.1.8.1","les comportements d’utilisation des clients et le réseau des agents sont-ils surveillés pour garantir une couverture suffisante d’agents sur la base des comportements d’utilisation existants et prévus?",null,null,"Recommandé","Recommandé","Agent",0,null,"3","3.4","3.4.1","","3.4.1.8","DISPONIBILIDAD Y LIQUIDEZ DE LOS AGENTES\nLos proveedores deben monitorear los patrones de uso de los clientes y la red de agentes para garantizar que exista una cobertura suficiente de agentes, en base a los patrones de uso actuales y anticipados.\n\nSe debe monitorear la liquidez de los agentes. Si fuese necesario, los proveedores deben establecer súper agentes para que ayuden a los agentes a mantener la liquidez y deben continuar optimizando la gestión de liquidez. ","GSMA RMT\n(AG-18,\nAG-19)","3.4.1.8.1","¿Se monitorean los patrones de uso de los clientes y la red de agentes para garantizar que exista una cobertura suficiente de agentes, en base a los patrones de uso actuales y anticipados?",null,null,"Recomendado","Recomendado","Agent",null,null,"3","3.4","3.4.1",null,"3.4.1.8",null,"GSMA RMT\n(AG-18,\nAG-19)","3.4.1.8.1",null,null,null,"Rec4","Rec4","Agent",null,null,null,null,null,null,null,null,"3.4.1.8.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1","","3.4.1.8",null,0,"3.4.1.8.2","3.4.1.8.2: Is the liquidity of agents monitored?\n",0,0,"Recommended","Recommended","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.8",null,null,"3.4.1.8.2","3.4.1.8.2","Is the liquidity of agents monitored?",null,null,"Recommended","Recommended","Agent",null,null,"3","3.4","3.4.1","","3.4.1.8",0,0,"3.4.1.8.2","la liquidité des agents est-elle surveillée ?",null,null,"Recommandé","Recommandé","Agent",0,null,"3","3.4","3.4.1","","3.4.1.8",null,0,"3.4.1.8.2","¿Se monitorea la liquidez de los agentes?",null,null,"Recomendado","Recomendado","Agent",null,null,"3","3.4","3.4.1",null,"3.4.1.8",null,0,"3.4.1.8.2",null,null,null,"Rec4","Rec4","Agent",null,null,null,null,null,null,null,null,"3.4.1.8.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1","","3.4.1.8",null,0,"3.4.1.8.3","3.4.1.8.3: If necessary, have super-agents been established to assist agents in maintaining liquidity, with ongoing optimization?\n",0,0,"Recommended","Recommended","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.8",null,null,"3.4.1.8.3","3.4.1.8.3","If necessary, have super-agents been established to assist agents in maintaining liquidity, with ongoing optimization?",null,null,"Recommended","Recommended","Agent",null,null,"3","3.4","3.4.1","","3.4.1.8",0,0,"3.4.1.8.3","des super-agents sont-ils en place si nécessaire pour aider les agents à maintenir un niveau suffisant de liquidité et continuer à optimiser la gestion de la liquidité ?",null,null,"Recommandé","Recommandé","Agent",0,null,"3","3.4","3.4.1","","3.4.1.8",null,0,"3.4.1.8.3","¿Si es necesario, se establecen súper agentes para ayudar a los agentes a mantener la liquidez y contar  con una optimización continua?",null,null,"Recomendado","Recomendado","Agent",null,null,"3","3.4","3.4.1",null,"3.4.1.8",null,0,"3.4.1.8.3",null,null,null,"Rec4","Rec4","Agent",null,null,null,null,null,null,null,null,"3.4.1.8.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1","","3.4.1.9","3.4.1.9: AGENT RISK MANAGEMENT\nProviders should conduct risk management for each of their master agents and agent aggregators. Risk management should be carried out when agents are appointed and thereafter when required. When assessing risk, all of the following factors should be considered:\n- Performance of each master agent / agent aggregator in managing its agents and implementing the provider's policies and processes;\n- Relationship between provider and each master agent/ agent aggregator;\n- Relationship between master agent/ agent aggregator and agents;\n- Regulatory status of each master agent / agent aggregator;\n- Financial, reputational, and operational impact on provider of performance failure by each master agent / agent aggregator;\n- Potential losses to provider’s customers due to performance failure by master agent / agent aggregator; and\n- Concentration risk (number/percentage of agents managed by a single master agent / agent aggregator).","BCBS OFS","3.4.1.9.1","3.4.1.9.1: Is risk management carried out on agents when each master agent and agent aggregator is appointed and when required?\n","1) Agent risk register\n- Check that there is a risk register that records risks of each master agent and agent aggregator.\n- Check that actions have been assigned a severity and an owner and followed up.",0,"Urgent Required","Required","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.9","AGENT RISK MANAGEMENT\nProviders should conduct risk management for each of their master agents and agent aggregators. Risk management should be carried out when agents are appointed and thereafter when required. When assessing risk, all of the following factors should be considered:\n- Performance of each master agent / agent aggregator in managing its agents and implementing the provider's policies and processes;\n- Relationship between provider and each master agent/ agent aggregator;\n- Relationship between master agent/ agent aggregator and agents;\n- Regulatory status of each master agent / agent aggregator;\n- Financial, reputational, and operational impact on provider of performance failure by each master agent / agent aggregator;\n- Potential losses to provider’s customers due to performance failure by master agent / agent aggregator; and\n- Concentration risk (number/percentage of agents managed by a single master agent / agent aggregator).","BCBS OFS","3.4.1.9.1","3.4.1.9.1","Is risk management carried out on agents when each master agent and agent aggregator is appointed and when required?","1) Agent risk register\n- Check that there is a risk register that records risks of each master agent and agent aggregator.\n- Check that actions have been assigned a severity and an owner and followed up.",null,"Urgent Required","Required","Agent",null,null,"3","3.4","3.4.1","","3.4.1.9","GESTION DES RISQUES LIÉS AUX AGENTS\nLes prestataires doivent effectuer une gestion du risque pour chacun de leurs agents principaux et agrégateurs d’agents, au moment du recrutement de l’agent et si nécessaire par la suite. Lors de l’évaluation du risque, il convient de prendre en compte l’ensemble des facteurs suivants :\n- performance de l’agent principal / agrégateur d’agents considéré dans la gestion de ses agents et l’application des politiques et procédures du prestataire ; \n- liens entre le prestataire et l’agent principal / agrégateur d’agents considéré ;\n- liens entre l’agent principal / l’agrégateur d’agents et les agents ;\n- statut réglementaire de l’agent principal / agrégateur d’agents considéré ;\n- impact financier, opérationnel et de réputation pour le prestataire d’une défaillance de l’agent principal / agrégateur d’agents considéré ;\n- pertes potentielles pour les clients du prestataire résultant d’une défaillance de l’agent principal / agrégateur d’agents considéré ;\n- risque de concentration (nombre / pourcentage d’agents gérés par un seul agent principal ou agrégateur d’agents).","BCBS OFS","3.4.1.9.1","une gestion du risque est-elle effectuée pour tous les agents lors du recrutement de chaque agent principal ou agrégateur d'agents, et si nécessaire par la suite ?","1) Registre des risques liés aux agents\n- Vérifier qu’un registre des risques liés à chaque agent principal et agrégateur d’agents a été mis en place.\n- Vérifier qu’une note de gravité et un propriétaire ont été assignés à chaque action que et ces actions font l’objet d’un suivi.",null,"Requis Prioritaire","Requis","Agent",0,null,"3","3.4","3.4.1","","3.4.1.9","GESTIÓN DE RIESGOS DE LOS AGENTES\nLos proveedores deben llevar a cabo una gestión de riesgos para cada uno de sus agentes maestros o agregadores de agentes. Se debe llevar a cabo la gestión de riesgos cuando se designan los agentes y posteriormente cuando sea requerido. Cuando se evalúan los riesgos, se deben considerar todos los siguientes factores:\n- Desempeño de cada agente maestro / agregador de agentes en la gestión de sus agentes y en la implementación de las políticas y procedimientos del proveedor;\n- Relación entre el proveedor y cada agente maestro / agregador de agentes;\n- Relación entre el agente maestro / agregador de agentes y los agentes;\n- Condición regulatoria de cada agente maestro / agregador de agentes;\n- Impacto financiero, operativo y en la reputación del proveedor por los incumplimientos en el desempeño de cada agente maestro / agregador de agentes;\n- Pérdidas potenciales de clientes del proveedor debido a los incumplimientos en el desempeño del agente maestro / agregador de agentes; y\n- Riesgo de concentración (cantidad/porcentaje de agentes gestionados por un solo agente maestro / agregador de agentes).","BCBS OFS","3.4.1.9.1","¿Se lleva a cabo una gestión de riesgos de los agentes cuando se designa a cada agente maestro y agregador de agentes y cuando es requerido?","1) Registro de riesgos de los agentes\n- Verificar que exista un registro de riesgos para registrar los riesgos de cada agente maestro y agregador de agentes.\n- Verificar que se haya asignado una severidad y un titular a las acciones y que se realice el seguimiento de las mismas.",null,"Obligatorio urgente","Obligatorio","Agent",null,null,"3","3.4","3.4.1",null,"3.4.1.9",null,"BCBS OFS","3.4.1.9.1",null,null,null,"ReqU4","Req4","Agent",null,null,null,null,null,null,null,null,"3.4.1.9.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1","","3.4.1.9",null,0,"3.4.1.9.2","3.4.1.9.2: Does agent risk management review the relationship between provider and each master agent/ agent aggregator, as well as that between the master agent and their individual agents?\n",0,0,"Recommended","Recommended","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.9",null,null,"3.4.1.9.2","3.4.1.9.2","Does agent risk management review the relationship between provider and each master agent/ agent aggregator, as well as that between the master agent and their individual agents?",null,null,"Recommended","Recommended","Agent",null,null,"3","3.4","3.4.1","","3.4.1.9",0,0,"3.4.1.9.2","l'évaluation des risques examine-t-elle les liens entre le prestataire et chaque agent principal ou agrégateur d’agents, ainsi que les liens entre ce dernier et les agents qui lui sont rattachés ?",null,null,"Recommandé","Recommandé","Agent",0,null,"3","3.4","3.4.1","","3.4.1.9",null,0,"3.4.1.9.2","¿La gestión de riesgos de los agentes revisa la relación entre el proveedor y cada agente maestro / agregador de agentes, así como también entre el agente maestro y sus agentes individuales?",null,null,"Recomendado","Recomendado","Agent",null,null,"3","3.4","3.4.1",null,"3.4.1.9",null,0,"3.4.1.9.2",null,null,null,"Rec4","Rec4","Agent",null,null,null,null,null,null,null,null,"3.4.1.9.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1","","3.4.1.9",null,0,"3.4.1.9.3","3.4.1.9.3: Is the risk and impact of failure of each master agent / agent aggregator assessed?\n",0,0,"Recommended","Recommended","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.9",null,null,"3.4.1.9.3","3.4.1.9.3","Is the risk and impact of failure of each master agent / agent aggregator assessed?",null,null,"Recommended","Recommended","Agent",null,null,"3","3.4","3.4.1","","3.4.1.9",0,0,"3.4.1.9.3","le risque et l'impact d'une défaillance éventuelle sont-ils évalués pour chaque agent principal / agrégateur d’agents ?",null,null,"Recommandé","Recommandé","Agent",0,null,"3","3.4","3.4.1","","3.4.1.9",null,0,"3.4.1.9.3","¿Se evalúa el riesgo y el impacto del incumplimiento de cada agente maestro / agregador de agentes?",null,null,"Recomendado","Recomendado","Agent",null,null,"3","3.4","3.4.1",null,"3.4.1.9",null,0,"3.4.1.9.3",null,null,null,"Rec4","Rec4","Agent",null,null,null,null,null,null,null,null,"3.4.1.9.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1","","3.4.1.9",null,0,"3.4.1.9.4","3.4.1.9.4: Does agent risk management address the concentration risk associated with use of master agents / agent aggregators?\n",0,0,"Recommended","Recommended","Agent",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.9",null,null,"3.4.1.9.4","3.4.1.9.4","Does agent risk management address the concentration risk associated with use of master agents / agent aggregators?",null,null,"Recommended","Recommended","Agent",null,null,"3","3.4","3.4.1","","3.4.1.9",0,0,"3.4.1.9.4","la gestion du risque lié aux agents tient-elle compte du risque de concentration lié à l'utilisation d'agents principaux / agrégateurs d’agents ?",null,null,"Recommandé","Recommandé","Agent",0,null,"3","3.4","3.4.1","","3.4.1.9",null,0,"3.4.1.9.4","¿La gestión de riesgos aborda el riesgo de concentración asociado al uso de agentes maestros / agregadores de agentes?",null,null,"Recomendado","Recomendado","Agent",null,null,"3","3.4","3.4.1",null,"3.4.1.9",null,0,"3.4.1.9.4",null,null,null,"Rec4","Rec4","Agent",null,null,null,null,null,null,null,null,"3.4.1.9.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1",{"$f":"CHOOSE(LanguageNumber,AY78,BP78,CF78,CV78)","v":""},{"$f":"AZ78","v":"3.4.1.10"},"3.4.1.10: OUTSOURCING POLICY\nIf material elements of the mobile money service are outsourced, the provider should define an outsourcing policy or similar document to specify principles for governance of outsourcing. This should include:\n- How to determine whether (and the extent to which) a function is appropriate for outsourcing;\n- Ensuring that all entities providing material services are compliant with relevant regulations [relevant regulations could differ by country and role of supplier. e.g. MM platform supplier may have to comply with data processor regulations];\n- Concentration risk - i.e. risk of outsourcing multiple activities to a single entity providing outsourced services; and\n- Limits on acceptable overall levels of outsourcing.\n\nAlso refer to the definitions of \"outsourcing\" and \"entities providing outsourced services\".",{"$f":"BB78","v":0},{"$f":"BC78","v":"3.4.1.10.1"},"3.4.1.10.1: Does the provider request all entities providing material services to state that they are compliant with relevant regulations?\n",{"$f":"CHOOSE(LanguageNumber,BF78,BV78,CL78,DB78)","v":"1) Contract document for each material outsourced service suppliers (e.g. MM platform provider)\n- Check that relevant regulations have been identified for all material outsourced suppliers.\n- Check that all material outsourced suppliers have stated that they are compliant with relevant regulations.\n"},0,{"$f":"CHOOSE(LanguageNumber,BH78,BX78,CN78,DD78)","v":"Standard Required"},{"$f":"CHOOSE(LanguageNumber,BI78,BY78,CO78,DE78)","v":"Required"},"FraudRisk",{"$f":"CHOOSE(LanguageNumber,BK78,CA78,CQ78,DG78)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.10","OUTSOURCING POLICY\nIf material elements of the mobile money service are outsourced, the provider should define an outsourcing policy or similar document to specify principles for governance of outsourcing. This should include:\n- How to determine whether (and the extent to which) a function is appropriate for outsourcing;\n- Ensuring that all entities providing material services are compliant with relevant regulations [relevant regulations could differ by country and role of supplier. e.g. MM platform supplier may have to comply with data processor regulations];\n- Concentration risk - i.e. risk of outsourcing multiple activities to a single entity providing outsourced services; and\n- Limits on acceptable overall levels of outsourcing.\n\nAlso refer to the definitions of \"outsourcing\" and \"entities providing outsourced services\".",null,"3.4.1.10.1",{"$f":"DO78","v":"3.4.1.13.3"},"Does the provider request all entities providing material services to state that they are compliant with relevant regulations?","1) Contract document for each material outsourced service suppliers (e.g. MM platform provider)\n- Check that relevant regulations have been identified for all material outsourced suppliers.\n- Check that all material outsourced suppliers have stated that they are compliant with relevant regulations.\n",null,"Standard Required","Required","BizOps",null,null,"3","3.4","3.4.1","","3.4.1.10","POLITIQUE DE SOUS-TRAITANCE\nSi des activités essentielles au service d’argent mobile font l’objet d’une sous-traitance, le prestataire doit définir une politique de sous-traitance ou un document similaire afin de définir les principes encadrant la sous-traitance. Cette politique ou ce document doit inclure :\n- La manière de déterminer si (et dans quelle mesure) il est approprié de sous-traiter une fonction ;\n- Les mesures devant être prises afin de s’assurer que chaque entité fournissant des services essentiels respecte les réglementations applicables [les réglementations concernées peuvent différer en fonction du pays ou de la fonction du fournisseur ; par exemple, le fournisseur d'une plateforme d'agent mobile peut être soumis à des réglementations relatives au traitement de données] ;\n- Le risque de concentration - à savoir le risque lié à la sous-traitance de plusieurs activités à une seule entité assurant des services de sous-traitance ; et\n- Les plafonds globaux de niveau de sous-traitance acceptable.\n\nVoir également les définitions des termes \"sous-traitance\" et \"entités assurant des services de sous-traitance\".",{"$f":"BB78","v":0},"3.4.1.10.1","Le prestataire demande-t-il à toutes les entités fournissant des services matériel de déclarer leur conformité avec la réglementation concernée ?","1) Document contractuel pour chaque prestataire fournissant des services essentiels (par ex. fournisseur de plateforme d'argent mobile)\n- Vérifier que l'ensemble des réglementations applicables aux prestataires fournissant des services essentiels ont été identifiées.\n- Vérifier que l'ensemble des prestataires fournissant des services essentiels ont déclaré respecter l'ensemble des réglementations auxquelles ils sont soumis.",null,"Requis Normal","Requis","FraudRisk","Le statut réglementaire est important pour vérifier que l’entité assurant des services de sous-traitance respecte les exigences réglementaires applicables (ex. obligation d’enregistrement et/ou d’agrément) et a le droit de fournir le service en question.",null,"3","3.4","3.4.1","","3.4.1.10","POLÍTICA DE TERCERIZACIÓN\nSi se tercerizan elementos importantes del servicio del dinero móvil, el proveedor debe definir una política de tercerización o documento similar para especificar los principios de gobernanza de la tercerización. Esta política debe incluir:\n- Cómo determinar si es adecuado tercerizar una función (y en qué medida);\n- Garantizar que todas las entidades que prestan importantes servicios cumplan con las regulaciones correspondientes las regulaciones correspondientes pueden diferir según el país y el rol del proveedor. Por ej., el proveedor de la plataforma de dinero móvil quizás deba cumplir con regulaciones de procesador de datos];\n- Riesgo de concentración, es decir, el riesgo de tercerizar múltiples actividades a una sola entidad que presta servicios tercerizados; y\n- Límites de niveles generales de tercerización aceptables.\n\nConsultar también las definiciones de \"tercerización\" y \"entidades que prestan servicios tercerizados\".",{"$f":"BB78","v":0},"3.4.1.10.1","¿El proveedor solicita a todas las entidades que prestan importantes servicios que declaren que cumplen con las regulaciones correspondientes?","1) Documento de contrato para cada proveedor de importantes servicios tercerizados (por ej., proveedor de plataforma de dinero móvil)\n- Verificar que se hayan identificado las regulaciones correspondientes para todos los proveedores de importantes servicios.\n- Verificar que todos los proveedores de importantes servicios declaren que cumplen con las regulaciones correspondientes.   ",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,"3","3.4","3.4.1",null,"3.4.1.10",null,{"$f":"#REF!","v":{"$error":"#REF!"}},"3.4.1.10.1",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"3.4.1.13.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1",{"$f":"CHOOSE(LanguageNumber,AY79,BP79,CF79,CV79)","v":""},{"$f":"AZ79","v":"3.4.1.10"},null,{"$f":"BB79","v":0},{"$f":"BC79","v":"3.4.1.10.2"},"3.4.1.10.2: Does the outsourcing policy indicate how to determine whether (and the extent to which) a mobile money function is appropriate for outsourcing?\n",{"$f":"CHOOSE(LanguageNumber,BF79,BV79,CL79,DB79)","v":0},0,{"$f":"CHOOSE(LanguageNumber,BH79,BX79,CN79,DD79)","v":"Recommended"},{"$f":"CHOOSE(LanguageNumber,BI79,BY79,CO79,DE79)","v":"Recommended"},"BizOps",{"$f":"CHOOSE(LanguageNumber,BK79,CA79,CQ79,DG79)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.10",null,null,"3.4.1.10.2",{"$f":"DO79","v":"3.4.1.10.3"},"Does the outsourcing policy indicate how to determine whether (and the extent to which) a mobile money function is appropriate for outsourcing?",null,null,"Recommended","Recommended","BizOps",null,null,"3","3.4","3.4.1","","3.4.1.10",null,null,"3.4.1.10.2","la politique de sous-traitance indique-t-elle comment comment déterminer si (et dans quelle mesure) il est approprié de sous-traiter une fonction ?",null,null,"Recommandé","Recommandé","BizOps","La sous-traitance (ou externalisation) fait référence à la décision d'un prestataire de recourir à une tierce partie (affiliée ou non) pour la réalisation d'activités qui seraient sinon effectuées directement par le prestataire (cf. Comité de Bâle sur le contrôle bancaire (2005), L'externalisation dans le secteur financier). Les prestataires peuvent décider de sous-traiter différents aspects de leur activité d'argent mobile, y compris (1) la fourniture etle fonctionnement de tout ou partie de leur système technique et/ou (2) des fonctions commerciales telles que le service aux clients ou le recrutement et la formation des agents.",null,"3","3.4","3.4.1","","3.4.1.10",null,null,"3.4.1.10.2","¿La política de tercerización indica cómo determinar si es adecuada la tercerización de una función del dinero móvil (y en qué medida)?",null,null,"Recomendado","Recomendado","BizOps",null,null,"3","3.4","3.4.1",null,"3.4.1.10",null,null,"3.4.1.10.2",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"3.4.1.10.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1","","3.4.1.10",null,0,"3.4.1.10.3","3.4.1.10.3: Does the outsourcing policy address concentration risk associated with a single entity providing outsourced services and limits on acceptable overall levels of outsourcing?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.10",null,null,"3.4.1.10.3","3.4.1.10.4","Does the outsourcing policy address concentration risk associated with a single entity providing outsourced services and limits on acceptable overall levels of outsourcing?",null,null,"Recommended","Recommended","BizOps",null,null,"3","3.4","3.4.1","","3.4.1.10",null,null,"3.4.1.10.3","la politique de sous-traitance tient-elle compte du risque de concentration lié à la sous-traitance de plusieurs activités à un seul sous-traitant et définit-elle des plafonds globaux de niveau de sous-traitance acceptable ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"3","3.4","3.4.1","","3.4.1.10",null,null,"3.4.1.10.3","¿La política de tercerización aborda los riesgos de concentración asociados a una sola entidad que presta servicios tercerizados y los límites de niveles generales de tercerización?",null,null,"Recomendado","Recomendado","BizOps",null,null,"3","3.4","3.4.1",null,"3.4.1.10",null,null,"3.4.1.10.3",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"3.4.1.10.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1","","3.4.1.11","3.4.1.11: OUTSOURCING MANAGEMENT\nProviders should monitor entities providing material outsourced services (see definition) against agreed service levels (see 3.3) and notify entities of exceptions and unsatisfactory performance. Procedures for escalation of issues on both sides of the relationship should be implemented. \n\nThe provider should manage the relationship with each entity providing outsourced services to ensure that there are lines of communication for information exchange so that relevant information is shared promptly by both parties.",0,"3.4.1.11.1","3.4.1.11.1: Are entities providing material outsourced services (see see definition) monitored against agreed service levels and notified of exceptions and unsatisfactory performance?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.11","OUTSOURCING MANAGEMENT\nProviders should monitor entities providing material outsourced services (see definition) against agreed service levels (see 3.3) and notify entities of exceptions and unsatisfactory performance. Procedures for escalation of issues on both sides of the relationship should be implemented. \n\nThe provider should manage the relationship with each entity providing outsourced services to ensure that there are lines of communication for information exchange so that relevant information is shared promptly by both parties.",null,"3.4.1.11.1","3.4.1.11.3","Are entities providing material outsourced services (see see definition) monitored against agreed service levels and notified of exceptions and unsatisfactory performance?",null,null,"Recommended","Recommended","BizOps",null,null,"3","3.4","3.4.1","","3.4.1.11","GESTION DES SOUS-TRAITANTS\nLes rôles, responsabilités et attentes en matière de prestation de services de la part des entités fournissant des services de sous-traitance doivent être clairement définis.\n\nLe prestataire doit gérer la relation avec chaque sous-traitant en veillant à ce qu’il existe des lignes de communication claires pour l’échange d’informations afin que les informations utiles circulent rapidement entre les deux parties. \n\nLes prestataires doivent surveiller les entités assurant des services de sous-traitance critiques (cf. note explicative) en termes de niveaux de service convenus et les notifier en cas d'anomalie ou de performance non satisfaisante. Des procédures de remontée des problèmes des deux côtés de la relation doivent également être mises en place.",0,"3.4.1.11.1","les entités assurant des services de sous-traitance critiques (cf. note explicative) sont-elles surveillées en termes en termes de niveaux de service convenus et sont-elle notifiées en cas d'anomalie ou de performance non satisfaisante ?",null,null,"Recommandé","Recommandé","BizOps","En général, les « services de sous-traitance critiques » sont les services susceptibles d’avoir un impact significatif sur l’activité, la réputation, la rentabilité et/ou la conformité réglementaire du prestataire en cas de défaillance ou de performance non satisfaisante.",null,"3","3.4","3.4.1","","3.4.1.11","GESTIÓN DE TERCERIZACIONES\nLos proveedores deben monitorear a las entidades que prestan importantes servicios tercerizados (ver la definición) en base a los niveles de servicio acordados (ver 3.3) y notificar a las entidades acerca de las excepciones y el desempeño insatisfactorio. Se deben implementar procedimientos para el escalamiento de problemas en ambos lados de la relación. \n\nEl proveedor debe gestionar la relación con cada entidad que presta servicios tercerizados para garantizar que existan líneas de comunicación para el intercambio de información a fin de que la información relevante sea intercambiada de inmediato entre ambas partes.",0,"3.4.1.11.1","¿Las entidades que prestan importantes servicios tercerizados (ver la definición) son monitoreadas en base a los niveles de servicio acordados y notificadas acerca de las excepciones y el desempeño insatisfactorio?",null,null,"Recomendado","Recomendado","BizOps",null,null,"3","3.4","3.4.1",null,"3.4.1.11",null,0,"3.4.1.11.1",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"3.4.1.11.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1","","3.4.1.12","3.4.1.12: OUTSOURCING MANAGEMENT - DISPUTE MANAGEMENT\nA dispute management process should be implemented with each entity providing outsourced services to resolve major issues and contractual disputes that cannot be resolved by the normal issue management and escalation process.",0,"3.4.1.12.1","3.4.1.12.1: Has a dispute management process been implemented with each entity providing outsourced services to resolve major issues and contractual disputes?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.12","OUTSOURCING MANAGEMENT - DISPUTE MANAGEMENT\nA dispute management process should be implemented with each entity providing outsourced services to resolve major issues and contractual disputes that cannot be resolved by the normal issue management and escalation process.",null,"3.4.1.12.1","3.4.1.12.1","Has a dispute management process been implemented with each entity providing outsourced services to resolve major issues and contractual disputes?",null,null,"Recommended","Recommended","BizOps",null,null,"3","3.4","3.4.1","","3.4.1.12","GESTION DES LITIGES AVEC DES SOUS-TRAITANTS\nUn processus de gestion des litiges doit être mis en place avec chaque entité assurant des services de sous-traitance pour résoudre les problèmes majeurs et les litiges contractuels qui ne peuvent pas être résolus dans le cadre du processus normal de gestion et de remontée des problèmes.",0,"3.4.1.12.1","un processus de gestion des litiges est-il en place avec chaque entité assurant des services de sous-traitance pour la résolution des problèmes majeurs et des litiges contractuels ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"3","3.4","3.4.1","","3.4.1.12","GESTIÓN DE TERCERIZACIONES - GESTIÓN DE CONTROVERSIAS\nSe debe implementar un proceso de gestión de controversias con cada entidad que presta servicios tercerizados para resolver cuestiones importantes y controversias contractuales que no pueden ser resultas mediante la gestión de problemas y el proceso de escalamiento habitual.",0,"3.4.1.12.1","¿Se implementó un proceso de gestión de controversias con cada entidad que presta servicios tercerizados para resolver cuestiones importantes y controversias contractuales?",null,null,"Recomendado","Recomendado","BizOps",null,null,"3","3.4","3.4.1",null,"3.4.1.12",null,0,"3.4.1.12.1",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"3.4.1.12.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1","","3.4.1.13","3.4.1.13: OUTSOURCING RISK MANAGEMENT\nThe provider should conduct risk management for outsourced services. When assessing outsourcing risk, all of the following factors should be considered:\n- Performance of entity providing outsourced services in managing and controlling their own risks;\n- Relationship between provider and entity providing outsourced services;\n- Financial, reputational, and operational impact on provider of performance failure by entity providing outsourced services;\n- Potential losses to provider’s customers due to performance failure by entity providing outsourced services;\n- Effects of outsourcing on the ability of provider to comply with legal/regulatory requirements (and adapt to changes in regulatory requirements);\n- Effort/time required to switch to alternate entity providing outsourced services or to bring activity in-house, if necessary;\n- Complexity of each outsourcing arrangement and the overall level of outsourcing complexity;\n- Impact of outsourcing on the provider's ability to supervise its business;\n- Ability of each entity providing outsourced services to adhere to the provider's security policy.","BCBS OFS","3.4.1.13.1","3.4.1.13.1: Is risk management conducted for each mobile money function that is outsourced?\n","1) Outsourcing risk management process / policy\n- Check that there is a process/method to identify mobile money functions that are outsourced\n- Check that there is risk management process for identified functions\n- Check that there is a process for dealing with outsourced functions that fail the risk management process. ",0,"Standard Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.13","OUTSOURCING RISK MANAGEMENT\nThe provider should conduct risk management for outsourced services. When assessing outsourcing risk, all of the following factors should be considered:\n- Performance of entity providing outsourced services in managing and controlling their own risks;\n- Relationship between provider and entity providing outsourced services;\n- Financial, reputational, and operational impact on provider of performance failure by entity providing outsourced services;\n- Potential losses to provider’s customers due to performance failure by entity providing outsourced services;\n- Effects of outsourcing on the ability of provider to comply with legal/regulatory requirements (and adapt to changes in regulatory requirements);\n- Effort/time required to switch to alternate entity providing outsourced services or to bring activity in-house, if necessary;\n- Complexity of each outsourcing arrangement and the overall level of outsourcing complexity;\n- Impact of outsourcing on the provider's ability to supervise its business;\n- Ability of each entity providing outsourced services to adhere to the provider's security policy.","BCBS OFS","3.4.1.13.1","3.4.1.13.1","Is risk management conducted for each mobile money function that is outsourced?","1) Outsourcing risk management process / policy\n- Check that there is a process/method to identify mobile money functions that are outsourced\n- Check that there is risk management process for identified functions\n- Check that there is a process for dealing with outsourced functions that fail the risk management process. ",null,"Standard Required","Required","FraudRisk",null,null,"3","3.4","3.4.1","","3.4.1.13","GESTION DES RISQUES LIÉS À LA SOUS-TRAITANCE\nLe prestataire doit effectuer une gestion du risque pour les services sous-traités. Lors de l’évaluation du risque, il convient de prendre en compte l’ensemble des facteurs suivants :\n- performance de l’entité assurant des services de sous-traitance en matière de gestion et de contrôle de ses propres risques ;\n- liens entre le prestataire et l’entité assurant des services de sous-traitance ;\n- impact financier, opérationnel et de réputation pour le prestataire d’une défaillance de l’entité assurant des services de sous-traitance ;\n- pertes potentielles pour les clients du prestataire résultant d’une défaillance de l’entité assurant des services de sous-traitance ;\n- impact de la sous-traitance sur la capacité du prestataire à se conformer à ses obligations légales/réglementaires (et à s’adapter à l’évolution de celles-ci) ;\n- efforts/délais requis pour changer de sous-traitant ou ramener l’activité en interne si nécessaire ;\n- complexité du contrat de sous-traitance et du niveau global de sous-traitance ;\n- impact de la sous-traitance sur la capacité de prestataire à assurer la supervision de son activité ;\n- capacité de chaque entité assurant des services de sous-traitance à respecter la politique de sécurité du prestataire.","BCBS OFS","3.4.1.13.1","Une évaluation des risques est-elle réalisée pour chaque fonction de l’activité d'argent mobile qui est externalisée ?","1) Processus / politique de gestion des risques liés à la sous-traitance\n- Vérifier qu’un processus/une méthode visant à identifier les fonctions de l’argent mobile sous-traitées a été mis(e) en place\n- Vérifier qu’un processus de gestion des risques a été mis en place pour chaque fonction identifiée\n- Vérifier qu’un processus a été mis en place pour gérer les fonctions sous-traitées qui ne satisfont pas aux exigences définies par le processus de gestion des risques. ",null,"Requis Normal","Requis","FraudRisk",0,null,"3","3.4","3.4.1","","3.4.1.13","GESTIÓN DE RIESGOS DE TERCERIZACIÓN\nEl proveedor debe llevar a cabo una gestión de riesgos de los servicios tercerizados. Cuando se evalúan los riesgos de tercerización, se deben considerar todos los siguientes factores:\n- Desempeño de la entidad que presta los servicios tercerizados en la gestión y el control de sus propios riesgos;\n- Relación entre el proveedor y la entidad que presta servicios tercerizados;\n- Impacto financiero, operativo y en la reputación del proveedor por el incumplimiento en el desempeño de la entidad que presta servicios tercerizados;\n- Pérdidas potenciales de clientes del proveedor debido a los incumplimientos en el desempeño de la entidad que presta servicios tercerizados;\n- Efectos de la tercerización en la capacidad del proveedor para cumplir con los requisitos legales/regulatorios (y adaptarse a los cambios en los requisitos regulatorios);\n- Esfuerzo/tiempo requerido para cambiar a una entidad alternativa que preste servicios tercerizados o para realizar la actividad internamente, si fuese necesario;\n- Complejidad de cada arreglo de tercerización y el nivel general de complejidad de la tercerización;\n- Impacto de la tercerización en la capacidad del proveedor para supervisar su negocio;\n- Capacidad de cada entidad que presta servicios tercerizados para cumplir con la política de seguridad del proveedor.","BCBS OFS","3.4.1.13.1","¿Se lleva a cabo una evaluación de riesgos para cada función del dinero móvil tercerizada?","1) Proceso / política de gestión de riesgos de tercerización\n- Verificar que exista un proceso/método para identificar las funciones del dinero móvil tercerizadas \n- Verificar que exista un proceso de gestión de riesgos para las funciones identificadas\n- Verificar que exista un proceso para tratar las funciones tercerizadas que no superan el proceso de gestión de riesgos. ",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,"3","3.4","3.4.1",null,"3.4.1.13",null,"BCBS OFS","3.4.1.13.1",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"3.4.1.13.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1","","3.4.1.13",null,0,"3.4.1.13.2","3.4.1.13.2: Does risk management for outsourcing analyse the relationship between the provider and each entity providing outsourced services?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.13",null,null,"3.4.1.13.2","3.4.1.13.2","Does risk management for outsourcing analyse the relationship between the provider and each entity providing outsourced services?",null,null,"Recommended","Recommended","FraudRisk",null,null,"3","3.4","3.4.1","","3.4.1.13",0,0,"3.4.1.13.2","l'évaluation du risque lié à la sous-traitance analyse-t-elle les liens entre le prestataire et chaque entité assurant des services de sous-traitance ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"3","3.4","3.4.1","","3.4.1.13",null,0,"3.4.1.13.2","¿La gestión de riesgos de tercerización analiza la relación entre el proveedor y cada entidad que presta servicios tercerizados?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"3","3.4","3.4.1",null,"3.4.1.13",null,0,"3.4.1.13.2",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"3.4.1.13.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1","","3.4.1.13",null,0,"3.4.1.13.3","3.4.1.13.3: Does risk management for outsourcing evaluate the financial, reputational, and operational impact on provider of performance failure by each entity providing outsourced services?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.13",null,null,"3.4.1.13.3","3.4.1.13.4","Does risk management for outsourcing evaluate the financial, reputational, and operational impact on provider of performance failure by each entity providing outsourced services?",null,null,"Recommended","Recommended","FraudRisk",null,null,"3","3.4","3.4.1","","3.4.1.13",0,0,"3.4.1.13.3","la gestion du risque lié à la sous-traitance évalue-t-elle pour chaque entité assurant des services de sous-traitance l'impact pour le prestataire d'une défaillance de cette entité en termes financiers, opérationnels et de réputation ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"3","3.4","3.4.1","","3.4.1.13",null,0,"3.4.1.13.3","¿La gestión de riesgos de tercerización evalúa el impacto financiero, operativo y en la reputación del proveedor debido a los incumplimiento en el desempeño de cada entidad que presta servicios tercerizados?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"3","3.4","3.4.1",null,"3.4.1.13",null,0,"3.4.1.13.3",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"3.4.1.13.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1",0,"3.4.1.13",null,0,"3.4.1.13.4","3.4.1.13.4: Does risk management for outsourcing consider the effects of outsourcing on the ability of the provider to comply with legal/regulatory requirements (and adapt to changes in regulatory requirements)?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1",null,"3.4.1.13",null,null,"3.4.1.13.4","3.4.1.13.5","Does risk management for outsourcing consider the effects of outsourcing on the ability of the provider to comply with legal/regulatory requirements (and adapt to changes in regulatory requirements)?",null,null,"Recommended","Recommended","FraudRisk",null,null,"3","3.4","3.4.1",0,"3.4.1.13",0,0,"3.4.1.13.4","la gestion du risque lié à la sous-traitance examine-t-elle l'impact de la sous-traitance sur la capacité du prestataire à se conformer à ses obligations légales/réglementaires (et à s’adapter à l’évolution de celles-ci) ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"3","3.4","3.4.1",null,"3.4.1.13",null,0,"3.4.1.13.4","¿La gestión de riesgos de tercerización considera los efectos de la tercerización en la capacidad del proveedor para cumplir con los requisitos legales/regulatorios (y adaptarse a los cambios en los requisitos regulatorios)?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"3","3.4","3.4.1",null,"3.4.1.13",null,0,"3.4.1.13.4",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"3.4.1.13.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1","","3.4.1.13",null,0,"3.4.1.13.5","3.4.1.13.5: Does risk management for outsourcing assess the effort/time required to switch to an alternate entity providing outsourced services or to bring activity in-house, if necessary?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.13",null,null,"3.4.1.13.5","3.4.1.13.6","Does risk management for outsourcing assess the effort/time required to switch to an alternate entity providing outsourced services or to bring activity in-house, if necessary?",null,null,"Recommended","Recommended","FraudRisk",null,null,"3","3.4","3.4.1","","3.4.1.13",0,0,"3.4.1.13.5","la gestion du risque lié à la sous-traitance évalue-t-elle les efforts/délais requis pour changer de sous-traitant ou ramener l’activité en interne si nécessaire ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"3","3.4","3.4.1","","3.4.1.13",null,0,"3.4.1.13.5","¿La gestión de riesgos de tercerización evalúa el esfuerzo/tiempo requerido para cambiar a una entidad que preste servicios tercerizados alternativa o para realizar la actividad internamente, si fuese necesario?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"3","3.4","3.4.1",null,"3.4.1.13",null,0,"3.4.1.13.5",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"3.4.1.13.6",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"3","3.4","3.4.1","","3.4.1.14",{"$f":"AZ88&\": \"&CHOOSE(LanguageNumber,BA88,BR88,CH88,CX88)","v":"3.4.1.14: OUTSOURCING MANAGEMENT - REVIEW OF OUTSOURCED SYSTEMS\nIf the mobile money system (or components of it) are outsourced, providers should review the technical capability of the supplier(s) at regular intervals - at least every two years or following a significant change to the services outsourced - including the following aspects:\n- System high-availability design;\n- Capacity management;\n- Technical operations;\n- Change management;\n- Disaster recovery and contingency plans;\n- IT security."},"BCBS OFS","3.4.1.14.1","3.4.1.14.1: If the mobile money system (or components of it) are outsourced, is the technical capability of the supplier(s) being reviewed at regular intervals and following any significant changes?\n","1) Outsourced risk management process / policy\n- Check that there is a process to review the technical capability of an outsourced function\n- Check that the outsource review plan include regular reviews and details for triggers for review (e.g. following significant changes)\n\n2) Outsourced function contract\n- Check that the contract or agreement includes the right for provider to review the technical capabilities of the outsource supplier.",0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3","3.4","3.4.1","","3.4.1.14","OUTSOURCING MANAGEMENT - REVIEW OF OUTSOURCED SYSTEMS\nIf the mobile money system (or components of it) are outsourced, providers should review the technical capability of the supplier(s) at regular intervals - at least every two years or following a significant change to the services outsourced - including the following aspects:\n- System high-availability design;\n- Capacity management;\n- Technical operations;\n- Change management;\n- Disaster recovery and contingency plans;\n- IT security.","BCBS OFS","3.4.1.14.1","3.4.1.14.1","If the mobile money system (or components of it) are outsourced, is the technical capability of the supplier(s) being reviewed at regular intervals and following any significant changes?","1) Outsourced risk management process / policy\n- Check that there is a process to review the technical capability of an outsourced function\n- Check that the outsource review plan include regular reviews and details for triggers for review (e.g. following significant changes)\n\n2) Outsourced function contract\n- Check that the contract or agreement includes the right for provider to review the technical capabilities of the outsource supplier.",null,"Recommended","Recommended","TechOps",null,null,"3","3.4","3.4.1","","3.4.1.14","GESTION DES SOUS-TRAITANTS - VÉRIFICATION DES SYSTÈMES EXTERNALISÉS\nSi le système d'argent mobile ou certains de ses composantes sont externalisés, les prestataires doivent procéder à un examen périodique des capacités techniques de chaque fournisseur assurant des services de sous-traitance, au moins tous les deux ans ou après tout changement important apporté aux services sous-traités. Cet examen doit couvrir les aspects suivants :\n- niveau de disponibilité des systèmes ;\n- gestion des capacités ;\n- opérations techniques ;\n- gestion du changement ;\n- plans de continuité et de reprise de l’activité après un sinistre ;\n- sécurité informatique.","BCBS OFS","3.4.1.14.1","Si le système d'argent mobile ou certains de ses composantes sont externalisés, les capacités techniques de chaque fournisseur sont-elles examinées périodiquement et après tout changement important ?","1) Processus / politique de gestion des risques liés à la sous-traitance\n- Vérifier qu’un processus a été mis en place pour examiner les capacités techniques de chaque fonction sous-traitée\n- Vérifier qu’un plan d’examen de la sous-traitance a été mis en place et inclut les détails relatifs aux évènements déclenchant la nécessité de procéder à un examen (par exemple des changements significatifs)\n\n2) Contrat de fonction sous-traitée\n- Vérifier que le contrat ou l’accord inclut le droit pour le prestataire d’examiner les capacités techniques du fournisseur assurant des services de sous-traitance ",null,"Recommandé","Recommandé","TechOps",0,null,"3","3.4","3.4.1","","3.4.1.14","GESTIÓN DE TERCERIZACIONES - REVISIÓN DE SISTEMAS TERCERIZADOS\nSi se terceriza el sistema del dinero móvil (o sus componentes), los proveedores deben revisar la capacidad técnica del(de los) proveedor(es) a intervalos regulares - al menos, cada dos años y después de un cambio significativo a los servicios tercerizados - incluidos los siguientes aspectos:\n- Diseño de alta disponibilidad del sistema;\n- Gestión de capacidad;\n- Operaciones técnicas;\n- Gestión de cambios;\n- Planes de recuperación ante desastres y contingencias;\n- Seguridad IT.","BCBS OFS","3.4.1.14.1","¿Si se terceriza el sistema del dinero móvil (o sus componentes), se revisa la capacidad técnica del(de los) proveedor(es) a intervalos regulares y después de cualquier cambio significativo?","1) Proceso / política de gestión de riesgos de tercerización\n- Verificar que exista un proceso para revisar la capacidad técnica de una función tercerizada\n- Verificar que el plan de revisión de tercerizaciones incluya revisiones regulares y detalle de los disparadores de revisiones (por ej., después de cambios significativos)\n\n2) Contrato de funciones tercerizadas\n- Verificar que el contrato o acuerdo incluya el derecho del proveedor a revisar las capacidades técnicas del proveedor de servicios tercerizados.",null,"Recomendado","Recomendado","TechOps",null,null,"3","3.4","3.4.1",null,"3.4.1.14",null,"BCBS OFS","3.4.1.14.1",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"3.4.1.14.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP3","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,null,null,null,null,".",".",".",".","."]

{"sheet":"4","index":5,"n_rows":143,"n_cols":144,"rows_kept":143,"cut":false,"hidden":false,"merged":[[54,52,55,52],[54,53,55,53],[54,102,55,102],[54,101,55,101],[54,86,55,86],[43,102,45,102],[46,101,51,101],[46,102,51,102],[43,99,45,99],[54,70,55,70],[54,69,55,69],[52,52,53,52],[52,53,53,53],[52,69,53,69],[52,70,53,70],[52,85,53,85],[52,86,53,86],[39,69,41,69],[39,70,41,70],[46,52,51,52],[46,53,51,53],[43,69,45,69],[46,69,51,69],[43,101,45,101],[52,101,53,101],[52,102,53,102],[4,4,6,4],[4,6,7,6],[4,7,7,7],[15,4,16,4],[40,7,41,7],[24,6,29,6],[24,7,29,7],[32,7,33,7],[8,6,9,6],[8,7,9,7],[10,6,12,6],[10,7,12,7],[15,6,19,6],[15,7,19,7],[20,6,23,6],[32,6,34,6],[32,4,34,4],[39,6,41,6],[35,6,38,6],[35,7,38,7],[56,6,58,6],[56,7,58,7],[59,6,61,6],[59,7,61,7],[43,4,45,4],[43,6,45,6],[43,7,45,7],[46,6,51,6],[46,7,51,7],[52,6,53,6],[52,7,53,7],[54,6,55,6],[70,6,73,6],[70,7,73,7],[63,4,66,4],[63,6,66,6],[63,7,66,7],[67,6,69,6],[67,7,69,7],[94,6,96,6],[94,7,96,7],[97,6,98,6],[97,7,98,7],[90,6,93,6],[90,7,93,7],[75,4,77,4],[75,6,83,6],[75,7,83,7],[84,6,89,6],[84,7,89,7],[110,6,113,6],[110,7,113,7],[114,6,116,6],[114,7,116,7],[105,6,108,6],[105,7,108,7],[100,4,101,4],[100,6,101,6],[100,7,101,7],[102,6,104,6],[102,7,104,7],[134,6,137,6],[134,7,137,7],[138,6,141,6],[138,7,141,7],[126,6,133,6],[126,7,133,7],[118,6,121,6],[118,7,121,7],[122,6,125,6],[122,7,125,7],[10,52,12,52],[10,53,12,53],[4,50,6,50],[4,52,7,52],[4,53,7,53],[8,52,9,52],[8,53,9,53],[15,52,19,52],[15,53,19,53],[24,52,29,52],[24,53,29,53],[20,52,23,52],[20,53,23,53],[15,50,17,50],[32,50,33,50],[32,53,34,53],[32,52,34,52],[43,50,45,50],[43,52,45,52],[43,53,45,53],[35,52,38,52],[35,53,38,53],[39,52,41,52],[39,53,41,53],[56,52,58,52],[56,53,58,53],[59,52,61,52],[59,53,61,53],[75,50,77,50],[75,52,83,52],[75,53,83,53],[63,50,66,50],[63,52,66,52],[63,53,66,53],[67,52,69,52],[67,53,69,53],[97,52,98,52],[97,53,98,53],[70,52,73,52],[70,53,73,53],[100,50,101,50],[100,52,101,52],[100,53,101,53],[90,52,93,52],[90,53,93,53],[94,52,96,52],[94,53,96,53],[118,52,121,52],[118,53,121,53],[102,52,104,52],[102,53,104,53],[105,52,108,52],[105,53,108,53],[4,70,7,70],[8,70,9,70],[15,70,19,70],[24,70,29,70],[20,70,23,70],[32,70,34,70],[10,70,12,70],[4,67,6,67],[8,69,9,69],[10,69,12,69],[15,67,16,67],[15,69,19,69],[24,69,29,69],[35,69,38,69],[4,69,7,69],[20,69,23,69],[32,69,34,69],[43,67,45,67],[138,52,141,52],[138,53,141,53],[35,70,38,70],[122,52,125,52],[122,53,125,53],[126,52,133,52],[126,53,133,53],[134,52,137,52],[134,53,137,53],[110,52,113,52],[110,53,113,53],[43,70,45,70],[46,70,51,70],[114,52,116,52],[114,53,116,53],[84,52,89,52],[84,53,89,53],[138,69,141,69],[110,70,113,70],[97,70,98,70],[67,70,69,70],[118,69,121,69],[122,69,125,69],[122,70,125,70],[138,70,141,70],[94,69,96,69],[97,69,98,69],[100,69,101,69],[105,70,108,70],[94,70,96,70],[114,70,116,70],[118,70,121,70],[105,69,108,69],[126,70,133,70],[134,70,137,70],[126,69,133,69],[134,69,137,69],[114,69,116,69],[110,69,113,69],[56,70,58,70],[63,67,66,67],[63,69,66,69],[67,69,69,69],[70,69,73,69],[75,67,77,67],[75,69,83,69],[84,69,89,69],[90,69,93,69],[59,70,61,70],[56,69,58,69],[59,69,61,69],[100,67,101,67],[75,70,83,70],[84,70,89,70],[90,70,93,70],[100,70,101,70],[102,70,104,70],[70,70,73,70],[63,70,66,70],[102,69,104,69],[4,83,6,83],[4,85,7,85],[4,86,7,86],[8,85,9,85],[8,86,9,86],[15,85,19,85],[15,86,19,86],[63,83,66,83],[63,85,66,85],[63,86,66,86],[43,83,45,83],[43,85,45,85],[43,86,45,86],[46,85,51,85],[46,86,51,86],[10,85,12,85],[10,86,12,86],[24,85,29,85],[39,86,41,86],[39,85,41,85],[70,85,73,85],[70,86,73,86],[56,86,58,86],[54,85,55,85],[56,85,58,85],[59,86,61,86],[59,85,61,85],[75,83,77,83],[75,85,83,85],[75,86,83,86],[67,85,69,85],[67,86,69,86],[118,86,121,86],[75,99,77,99],[63,99,66,99],[63,101,66,101],[90,86,93,86],[100,86,101,86],[70,102,73,102],[84,86,89,86],[100,102,101,102],[94,86,96,86],[97,86,98,86],[100,99,101,99],[100,101,101,101],[94,101,96,101],[94,102,96,102],[97,101,98,101],[97,102,98,102],[110,86,113,86],[75,102,83,102],[4,99,6,99],[4,101,7,101],[4,102,7,102],[8,101,9,101],[8,102,9,102],[15,99,16,99],[15,101,19,101],[15,102,19,102],[56,101,58,101],[56,102,58,102],[10,101,12,101],[10,102,12,102],[24,101,29,101],[24,102,29,102],[35,101,38,101],[35,102,38,102],[20,101,23,101],[20,102,23,102],[32,102,34,102],[32,101,34,101],[39,101,41,101],[134,102,137,102],[138,101,141,101],[138,102,141,102],[110,101,113,101],[110,102,113,102],[114,101,116,101],[122,101,125,101],[122,102,125,102],[114,102,116,102],[118,101,121,101],[118,102,121,102],[134,101,137,101],[126,101,133,101],[102,85,104,85],[102,86,104,86],[118,85,121,85],[122,85,125,85],[15,83,17,83],[32,83,33,83],[100,83,101,83],[126,102,133,102],[90,101,93,101],[90,102,93,102],[75,101,83,101],[105,101,108,101],[105,102,108,102],[84,101,89,101],[102,102,104,102],[102,101,104,101],[59,101,61,101],[59,102,61,102],[70,101,73,101],[63,102,66,102],[84,102,89,102],[67,101,69,101],[67,102,69,102],[122,86,125,86],[3,88,3,89],[138,85,141,85],[138,86,141,86],[126,85,133,85],[126,86,133,86],[134,85,137,85],[134,86,137,86],[114,85,116,85],[114,86,116,86],[84,85,89,85],[90,85,93,85],[94,85,96,85],[97,85,98,85],[100,85,101,85],[24,86,29,86],[35,85,38,85],[35,86,38,86],[20,85,23,85],[20,86,23,86],[32,86,34,86],[32,85,34,85],[105,85,108,85],[105,86,108,86],[110,85,113,85]]}
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,"x",null,null,null,null,"x",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"x"]
[null,null,null,null,null,null,{"$f":"UPPER(Introduction!B18)","v":"4. OPERATION:  OPERATE THE SERVICE WELL AND RELIABLY"},null,null,null,null,null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,Drivers!K18,Drivers!L18,Drivers!M18,Drivers!N18)","v":"SELF-ASSESSMENT"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,Drivers!K34,Drivers!L34,Drivers!M34,Drivers!N34)","v":"EXTERNAL ASSESSMENT"},null,null,null,null,null,"SCHEME OPERATOR REVIEW",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,16,null,17,null,null,3,null,null,4,5,6,9,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Change types: NEW, MERGE, MOVE, SWAP","Don't edit the Indicator ID",null,null,null,"*** Don't edit any cell from AB and onwards *** Ignore #NAME errors; these will disappear during migration",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Counts for computed Compliance calc"]
[null,{"$f":"CHOOSE(LanguageNumber,AV3,BM3,CC3,CS3)","v":"Principle"},"Sub-principle","Sub-sub-principle","Sub-sub-principle ","Practice ID","Practice","Practice data source","Indicator ID",{"$f":"CHOOSE(LanguageNumber,BE3,BU3,CK3,DA3)","v":"Indicator"},"Evidence required","[SPARE]","Detailed indicator category","Indicator category","Function","[SPARE]",{"$f":"CHOOSE(LanguageNumber,Drivers!K19,Drivers!L19,Drivers!M19,Drivers!N19)","v":"Compliance"},{"$f":"CHOOSE(LanguageNumber,Drivers!K20,Drivers!L20,Drivers!M20,Drivers!N20)","v":"Evidence document (specify document name, section number and page number)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K21,Drivers!L21,Drivers!M21,Drivers!N21)","v":"Comments \n(include notes on how the practice is implemented)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K22,Drivers!L22,Drivers!M22,Drivers!N22)","v":"Action"},{"$f":"CHOOSE(LanguageNumber,Drivers!K23,Drivers!L23,Drivers!M23,Drivers!N23)","v":"Reviewer name"},{"$f":"CHOOSE(LanguageNumber,Drivers!K24,Drivers!L24,Drivers!M24,Drivers!N24)","v":"Evidence sent to Assessor?"},{"$f":"CHOOSE(LanguageNumber,Drivers!K25,Drivers!L25,Drivers!M25,Drivers!N25)","v":"Spare 2"},{"$f":"CHOOSE(LanguageNumber,Drivers!K26,Drivers!L26,Drivers!M26,Drivers!N26)","v":"Spare 3"},{"$f":"CHOOSE(LanguageNumber,Drivers!K27,Drivers!L27,Drivers!M27,Drivers!N27)","v":"Spare 4"},{"$f":"CHOOSE(LanguageNumber,Drivers!K28,Drivers!L28,Drivers!M28,Drivers!N28)","v":"Spare 5"},{"$f":"CHOOSE(LanguageNumber,Drivers!K29,Drivers!L29,Drivers!M29,Drivers!N29)","v":"Spare 6"},{"$f":"CHOOSE(LanguageNumber,Drivers!K30,Drivers!L30,Drivers!M30,Drivers!N30)","v":"Spare 7"},{"$f":"CHOOSE(LanguageNumber,Drivers!K31,Drivers!L31,Drivers!M31,Drivers!N31)","v":"Spare 8"},{"$f":"CHOOSE(LanguageNumber,Drivers!K32,Drivers!L32,Drivers!M32,Drivers!N32)","v":"Spare 9"},{"$f":"CHOOSE(LanguageNumber,Drivers!K33,Drivers!L33,Drivers!M33,Drivers!N33)","v":"Spare 10"},{"$f":"CHOOSE(LanguageNumber,Drivers!K35,Drivers!L35,Drivers!M35,Drivers!N35)","v":"Compliance"},{"$f":"CHOOSE(LanguageNumber,Drivers!K36,Drivers!L36,Drivers!M36,Drivers!N36)","v":"Evidence document (specify document name, section number and page number)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K37,Drivers!L37,Drivers!M37,Drivers!N37)","v":"Comments \n(include notes on how the practice is implemented)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K38,Drivers!L38,Drivers!M38,Drivers!N38)","v":"Recommendation to Provider"},{"$f":"CHOOSE(LanguageNumber,Drivers!K39,Drivers!L39,Drivers!M39,Drivers!N39)","v":"Reviewer name"},{"$f":"CHOOSE(LanguageNumber,Drivers!K40,Drivers!L40,Drivers!M40,Drivers!N40)","v":"Guidance notes for Assessor"},{"$f":"CHOOSE(LanguageNumber,Drivers!K41,Drivers!L41,Drivers!M41,Drivers!N41)","v":"Scheme Operator comments"},{"$f":"CHOOSE(LanguageNumber,Drivers!K42,Drivers!L42,Drivers!M42,Drivers!N42)","v":"Assessor's response to Scheme Operator"},{"$f":"CHOOSE(LanguageNumber,Drivers!K43,Drivers!L43,Drivers!M43,Drivers!N43)","v":"Scheme Operator conclusion"},{"$f":"CHOOSE(LanguageNumber,Drivers!K44,Drivers!L44,Drivers!M44,Drivers!N44)","v":"Spare 15"},{"$f":"CHOOSE(LanguageNumber,Drivers!K45,Drivers!L45,Drivers!M45,Drivers!N45)","v":"Spare 16"},{"$f":"CHOOSE(LanguageNumber,Drivers!K46,Drivers!L46,Drivers!M46,Drivers!N46)","v":"Spare 17"},{"$f":"CHOOSE(LanguageNumber,Drivers!K47,Drivers!L47,Drivers!M47,Drivers!N47)","v":"Spare 18"},{"$f":"CHOOSE(LanguageNumber,Drivers!K48,Drivers!L48,Drivers!M48,Drivers!N48)","v":"Spare 19"},{"$f":"CHOOSE(LanguageNumber,Drivers!K49,Drivers!L49,Drivers!M49,Drivers!N49)","v":"Spare 20"},null,"Principle","Sub-principle","Sub-sub-principle","Sub-sub-principle ","Practice ID","Practice","Practice data source","Indicator ID","ORIGINAL ID","Indicator","Evidence required","[SPARE]","Detailed indicator category","Indicator category","Function","[SPARE]",null,"Principe","Sous-principe","Sous-sous-principe","Description du sous-sous-principe","Pratique ID","Pratique","Source de données pratique","Indicateur ID","Indicateur","Documents généralement requis","[SPARE]","Catégorie détaillée d’indicateur","Catégorie d’indicateur","Fonction","[SPARE]",null,"Principio","Sub-principio","Sub-sub-principio","Sub-sub-principio","Nro. de Práctica","Práctica","Origen de datos de Práctica","Nro. de Indicador","Indicador","Documentación obligatoria","[SPARE]","Categoría indicador detallada","Categoría de Indicador","Función","[SPARE]",null,"Principle","Sub-principle","Sub-sub-principle","Sub-sub-principle Description","Practice","Practice","Practice data source","Indicator","Indicator","Evidence required","[SPARE]","Detailed indicator category","Indicator category","Function","[SPARE]",null,null,null,null,null,null,"Change type","Original Indicator ID","Merged indicator #1","Merged indicator #2","Merged indicator #3","v1 Compliance rating Original Indicator ID","v1 Compliance rating Merged indicator #1","v1 Compliance rating Merged indicator #2","v1 Compliance rating Merged indicator #3","v1 Comment Original Indicator ID","v1 Comment Merged indicator #1  ","v1 Comment Merged indicator #2","v1 Comment Merged indicator #3","v2 Computed change type","v2 Computed compliance rating","v2 Computed comment","rangename1","rangename2","rangename3","rangename4","Yes","No","N/A","Partial","No Response","how many","calc"]
[null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!C18,\": \",Introduction!D18))","v":"4.1: BOARD AND SENIOR MANAGEMENT OVERSIGHT OF THE MOBILE MONEY SERVICE"},null,null,null,null,{"$f":"Introduction!E18","v":"Providers shall ensure that the Board of Directors and senior management establish effective management oversight of the Mobile Money Service"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$18,\": \",Introduction!$L$18))","v":"4.1: BOARD AND SENIOR MANAGEMENT OVERSIGHT OF THE MOBILE MONEY SERVICE"},null,null,null,null,null,{"$f":"Introduction!$M$18","v":"Providers shall ensure that the Board of Directors and senior management establish effective management oversight of the Mobile Money Service"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!$U$18,\": \",Introduction!$V$18))","v":"4.1: SUPERVISIÓN DEL SERVICIO DE DINERO MÓVIL POR PARTE DIRECTORIO Y DEL PERSONAL DIRECTIVO SUPERIOR"},null,null,0,null,{"$f":"Introduction!W18","v":"Los proveedores garantizarán que el Directorio y la alta gerencia puedan establecer una supervisión efectiva de la gestión del Servicio de dinero móvil."},null,null,null,null,null,null,null,null,null,null,null,0,null,0]
[null,{"$f":"$AV5","v":"4"},{"$f":"$AW5","v":"4.1"},{"$f":"$AX5","v":"4.1.1"},{"$f":"CHOOSE(LanguageNumber,AY5,BP5,CF5,CV5)","v":"4.1.1: Providers shall ensure that the Board of Directors and senior management establish effective management oversight"},{"$f":"AZ5","v":"4.1.1.1"},{"$f":"AZ5&\": \"&CHOOSE(LanguageNumber,BA5,BR5,CH5,CX5)","v":"4.1.1.1: GOVERNANCE OF MOBILE MONEY BUSINESS\nSenior management should develop a strategy and governance model for the mobile money business. This should:\n\n- define the governance structure and senior roles to manage the mobile money business;\n- define the scope of business that is addressed by mobile money;\n- communicate the importance of fulfilling regulatory requirements;\n- set measurable goals for the operation of the mobile money service (see 4.2);\n- specify management reviews and audits at planned intervals (see 4.2 and 4.1.1.3); and\n- ensure that risks to services are assessed and managed (see 4.6).\n\nThe strategy should be communicated to mobile money staff and should be regularly updated and reviewed for continued suitability.\n\nSenior management should ensure the provision of sufficient resources to fulfil the objectives of the mobile money business."},{"$f":"BB5","v":"ISO 20000-1:2018 Sec. 5.1"},{"$f":"BC5","v":"4.1.1.1.1"},{"$f":"BC5&\": \"&CHOOSE(LanguageNumber,BE5,BU5,CK5,DA5)&CarriageReturn","v":"4.1.1.1.1: Has senior management defined the governance and organization to manage the mobile money business?\n"},{"$f":"CHOOSE(LanguageNumber,BF5,BV5,CL5,DB5)","v":"1) Mobile Money organization chart and/or governance documentation\n- Check the the governance structure of the mobile money business is documented.\n- Check the organisation of the mobile money business is documented."},0,{"$f":"CHOOSE(LanguageNumber,BH5,BX5,CN5,DD5)","v":"Urgent Required"},{"$f":"CHOOSE(LanguageNumber,BI5,BY5,CO5,DE5)","v":"Required"},"BizOps",{"$f":"CHOOSE(LanguageNumber,BK5,CA5,CQ5,DG5)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.1","4.1.1","4.1.1: Providers shall ensure that the Board of Directors and senior management establish effective management oversight","4.1.1.1","GOVERNANCE OF MOBILE MONEY BUSINESS\nSenior management should develop a strategy and governance model for the mobile money business. This should:\n\n- define the governance structure and senior roles to manage the mobile money business;\n- define the scope of business that is addressed by mobile money;\n- communicate the importance of fulfilling regulatory requirements;\n- set measurable goals for the operation of the mobile money service (see 4.2);\n- specify management reviews and audits at planned intervals (see 4.2 and 4.1.1.3); and\n- ensure that risks to services are assessed and managed (see 4.6).\n\nThe strategy should be communicated to mobile money staff and should be regularly updated and reviewed for continued suitability.\n\nSenior management should ensure the provision of sufficient resources to fulfil the objectives of the mobile money business.","ISO 20000-1:2018 Sec. 5.1","4.1.1.1.1",{"$f":"DO5","v":"4.1.1.1.1"},"Has senior management defined the governance and organization to manage the mobile money business?","1) Mobile Money organization chart and/or governance documentation\n- Check the the governance structure of the mobile money business is documented.\n- Check the organisation of the mobile money business is documented.",null,"Urgent Required","Required",{"$f":"$O5","v":"BizOps"},null,null,{"$f":"$AV5","v":"4"},{"$f":"$AW5","v":"4.1"},{"$f":"$AX5","v":"4.1.1"},"4.1.1: Les prestataires doivent s’assurer que leur conseil d’administration et leur direction générale mettent en place un contrôle de gestion efficace.",{"$f":"$AZ5","v":"4.1.1.1"},"GOUVERNANCE DE L’ACTIVITÉ D’ARGENT MOBILE\nLa direction générale doit établir une stratégie et un modèle de gouvernance pour l’activité d'argent mobile. Ceux-ci doivent :\n\n- définir la structure de gouvernance et les fonctions de direction de l’activité d’argent mobile ;\n- définir le périmètre d'activité couvert par l’argent mobile ;\n- communiquer l’importance du respect des obligations réglementaires ;\n- fixer des objectifs quantifiables concernant l’exploitation du service d’argent mobile (cf. 4.2) ;\n- prévoir des examens et audits de gestion à des intervalles programmés (cf. 4.2 et 4.1.1.3) ;\n- garantir que les risques pesant sur les services soient évalués et gérés (cf. 4.6).\n\nCette stratégie doit être communiquée au personnel de l’argent mobile et être régulièrement examinée et mise à jour pour rester adaptée.\n\nLa direction générale doit s’assurer de disposer de moyens suffisants pour réaliser les objectifs de l’activité d’argent mobile.",{"$f":"$BB5","v":"ISO 20000-1:2018 Sec. 5.1"},{"$f":"$BC5","v":"4.1.1.1.1"},"La direction générale a-t-elle défini la gouvernance et l’organisation pour la gestion de l’activité d'argent mobile ?","1) Organigramme de l’argent mobile et/ou et documentation relative à la gouvernance\n- Vérifier que la structure de la gouvernance de l'activité argent mobile est documentée\n- Vérifier que l'organisation de l'activité argent mobile est documentée.",null,{"$f":"VLOOKUP($BH5,CategoryTranslationTable,2,FALSE)","v":"Requis Prioritaire"},{"$f":"VLOOKUP($BI5,CategoryTranslationTable,2,FALSE)","v":"Requis"},{"$f":"$O5","v":"BizOps"},0,null,{"$f":"$AV5","v":"4"},{"$f":"$AW5","v":"4.1"},{"$f":"$AX5","v":"4.1.1"},"4.1.1: Los proveedores garantizarán que el Directorio y la alta gerencia puedan establecer una supervisión  efectiva de la gestión",{"$f":"$AZ5","v":"4.1.1.1"},"GOBERNANZA DEL NEGOCIO DEL DINERO MÓVIL\nLa alta gerencia debe desarrollar una estrategia y un modelo de gobernanza para el negocio del dinero móvil. Se deberá:\n\n- definir la estructura de gobernanza y las funciones de alto rango para la gestión del negocio del dinero móvil;\n- definir el alcance del negocio del dinero móvil;\n- comunicar la importancia de cumplir con los requisitos regulatorios;\n- establecer objetivos mensurables para la operación del servicio de dinero móvil (ver 4.2);\n- especificar revisiones y auditorías de gestión a intervalos planificados (ver 4.2 y 4.1.1.3); y\n- garantizar la evaluación y gestión de riesgos de los servicios (ver 4.6).\n\nLa estructura debe ser comunicada al personal de dinero móvil y debe ser actualizada y revisada de forma periódica para que resulte continuamente adecuada.\n\nLa alta gerencia debe garantizar el suministro de recursos suficientes para cumplir con los objetivos del negocio del dinero móvil.",{"$f":"$BB5","v":"ISO 20000-1:2018 Sec. 5.1"},{"$f":"$BC5","v":"4.1.1.1.1"},"¿La alta gerencia ha definido la gobernanza y organización para gestionar el negocio del dinero móvil?","1) Organigrama y/o documentación de gobernanza del Dinero Móvil\n- Verificar que la estructura de gobernanza del negocio del dinero móvil esté documentada.\n- Verificar que la organización del negocio del dinero móvil esté documentada.",null,{"$f":"VLOOKUP($BH5,CategoryTranslationTable,3,FALSE)","v":"Obligatorio urgente"},{"$f":"VLOOKUP($BI5,CategoryTranslationTable,3,FALSE)","v":"Obligatorio"},{"$f":"$O5","v":"BizOps"},null,null,{"$f":"$AV5","v":"4"},{"$f":"$AW5","v":"4.1"},{"$f":"$AX5","v":"4.1.1"},null,{"$f":"$AZ5","v":"4.1.1.1"},null,{"$f":"$BB5","v":"ISO 20000-1:2018 Sec. 5.1"},{"$f":"$BC5","v":"4.1.1.1.1"},null,null,null,{"$f":"VLOOKUP($BH5,CategoryTranslationTable,4,FALSE)","v":"ReqU4"},{"$f":"VLOOKUP($BI5,CategoryTranslationTable,4,FALSE)","v":"Req4"},{"$f":"$O5","v":"BizOps"},null,null,null,null,null,null,null,null,"4.1.1.1.1",null,null,null,{"$f":"IF(OR($EA5=0,$EA5=2),VLOOKUP(DO5,INDIRECT(ED5),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP5),\"\",VLOOKUP(DP5,INDIRECT(EE5),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ5),\"\",VLOOKUP(DQ5,INDIRECT(EF5),7,FALSE))","v":""},"",{"$f":"IF(OR($EA5=0,$EA5=2),VLOOKUP(DO5,INDIRECT(ED5),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP5),\"\",VLOOKUP(DP5,INDIRECT(EE5),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ5),\"\",VLOOKUP(DQ5,INDIRECT(EF5),8,FALSE))","v":""},"",{"$f":"1*AND(LEFT(DN5,3)=\"NEW\")+2*AND(LEFT(DN5,3)=\"MER\")+3*AND(LEFT(DN5,3)=\"MOV\")+4*AND(LEFT(DN5,3)=\"SWA\")","v":0},{"$f":"IF(EA5=0,DS5,EN5)","v":{"$error":"#REF!"}},{"$f":"IF(EA5=0,IF(DW5=0,\"\",DW5),CHOOSE(EA5,\"New indicator\",CONCATENATE(DW5,CarriageReturn,DX5,CarriageReturn,DY5,CarriageReturn,DZ5)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO5,1)","v":"OriginalComplianceP4"},{"$f":"\"OriginalComplianceP\"&LEFT(DP5,1)","v":"OriginalComplianceP"},"OriginalComplianceP","OriginalComplianceP",{"$f":"COUNTIF($DS5:$DV5,EH$3)","v":0},0,0,0,0,{"$f":"COUNTIF($DO5:$DR5,\"*?\")","v":1},{"$f":"IF(OR(AND(EH5>0,SUM(EI5:EL5)>0),EK5>0),\"Partial\",IF(EH5=EM5,\"Yes\",IF(EI5=EM5,\"No\",IF(EJ5=EM5,\"N/A\",IF(EK5=EM5,\"Partial\",IF(EL5=EM5,\"\",\"\"))))))","v":""}]
[null,{"$f":"$AV6","v":"4"},{"$f":"$AW6","v":"4.1"},{"$f":"$AX6","v":"4.1.1"},null,{"$f":"AZ6","v":"4.1.1.1"},null,null,{"$f":"BC6","v":"4.1.1.1.2"},"4.1.1.1.2: Is the governance and organization regularly updated and reviewed for continued suitability?\n",{"$f":"CHOOSE(LanguageNumber,BF6,BV6,CL6,DB6)","v":"1) Mobile Money organization chart and/or governance documentation\n- Check the governance and organization model has been reviewed and approved in the last 24 months.\n"},0,{"$f":"CHOOSE(LanguageNumber,BH6,BX6,CN6,DD6)","v":"Standard Required"},{"$f":"CHOOSE(LanguageNumber,BI6,BY6,CO6,DE6)","v":"Required"},"BizOps",{"$f":"CHOOSE(LanguageNumber,BK6,CA6,CQ6,DG6)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.1","4.1.1",null,"4.1.1.1",null,null,"4.1.1.1.2",{"$f":"DO6","v":"4.1.1.1.5"},"Is the governance and organization regularly updated and reviewed for continued suitability?","1) Mobile Money organization chart and/or governance documentation\n- Check the governance and organization model has been reviewed and approved in the last 24 months.\n",null,"Standard Required","Required",{"$f":"$O6","v":"BizOps"},null,null,{"$f":"$AV6","v":"4"},{"$f":"$AW6","v":"4.1"},{"$f":"$AX6","v":"4.1.1"},null,{"$f":"$AZ6","v":"4.1.1.1"},null,null,{"$f":"$BC6","v":"4.1.1.1.2"},"La gouvernance et l’organisation sont-elles régulièrement examinées et mises à jour pour rester adaptées ?","1) Organigramme de l’argent mobile et/ou et documentation relative à la gouvernance\n- Vérifier que le modèle de gouvernance et d’organisation a été examiné et approuvé au cours des 24 derniers mois \n",null,"Requis Normal","Requis",{"$f":"$O6","v":"BizOps"},0,null,{"$f":"$AV6","v":"4"},{"$f":"$AW6","v":"4.1"},{"$f":"$AX6","v":"4.1.1"},null,"4.1.1.1",null,null,{"$f":"$BC6","v":"4.1.1.1.2"},"¿La gobernanza y organización son actualizadas y revisadas de forma periódica para que sean continuamente adecuadas?","1) Organigrama y/o documentación de gobernanza del Dinero Móvil\n- Verificar que el modelo de gobernanza y organización haya sido revisado y aprobado en los últimos 24 meses.",null,"Obligatorio estándar","Obligatorio",{"$f":"$O6","v":"BizOps"},null,null,{"$f":"$AV6","v":"4"},{"$f":"$AW6","v":"4.1"},{"$f":"$AX6","v":"4.1.1"},null,{"$f":"$AZ6","v":"4.1.1.1"},null,null,{"$f":"$BC6","v":"4.1.1.1.2"},null,null,null,"ReqS4","Req4",{"$f":"$O6","v":"BizOps"},null,null,null,null,null,null,null,null,"4.1.1.1.5",null,null,null,{"$f":"IF(OR($EA6=0,$EA6=2),VLOOKUP(DO6,INDIRECT(ED6),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP6),\"\",VLOOKUP(DP6,INDIRECT(EE6),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ6),\"\",VLOOKUP(DQ6,INDIRECT(EF6),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR6),\"\",VLOOKUP(DR6,INDIRECT(EG6),7,FALSE))","v":""},{"$f":"IF(OR($EA6=0,$EA6=2),VLOOKUP(DO6,INDIRECT(ED6),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP6),\"\",VLOOKUP(DP6,INDIRECT(EE6),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ6),\"\",VLOOKUP(DQ6,INDIRECT(EF6),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR6),\"\",VLOOKUP(DR6,INDIRECT(EG6),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN6,3)=\"NEW\")+2*AND(LEFT(DN6,3)=\"MER\")+3*AND(LEFT(DN6,3)=\"MOV\")+4*AND(LEFT(DN6,3)=\"SWA\")","v":0},{"$error":"#REF!"},{"$f":"IF(EA6=0,IF(DW6=0,\"\",DW6),CHOOSE(EA6,\"New indicator\",CONCATENATE(DW6,CarriageReturn,DX6,CarriageReturn,DY6,CarriageReturn,DZ6)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO6,1)","v":"OriginalComplianceP4"},{"$f":"\"OriginalComplianceP\"&LEFT(DP6,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ6,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR6,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,{"$f":"IF(OR(AND(EH6>0,SUM(EI6:EL6)>0),EK6>0),\"Partial\",IF(EH6=EM6,\"Yes\",IF(EI6=EM6,\"No\",IF(EJ6=EM6,\"N/A\",IF(EK6=EM6,\"Partial\",IF(EL6=EM6,\"\",\"\"))))))","v":""}]
[null,"4","4.1","4.1.1",0,{"$f":"AZ7","v":"4.1.1.1"},null,{"$f":"CHOOSE(LanguageNumber,BB7,BS7,CI7,CY7)","v":0},{"$f":"BC7","v":"4.1.1.1.3"},"4.1.1.1.3: Has the scope of the mobile money business been formally identified and documented?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.1","4.1.1",null,"4.1.1.1",null,null,"4.1.1.1.3","4.1.1.1.2","Has the scope of the mobile money business been formally identified and documented?",null,null,"Recommended","Recommended","BizOps",null,null,"4","4.1","4.1.1",0,"4.1.1.1",0,null,"4.1.1.1.3","le périmètre d'activité couvert par l'argent mobile a-t-il été formellement identifié et documenté ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"4","4.1","4.1.1",null,"4.1.1.1",null,null,"4.1.1.1.3","¿El alcance del negocio del dinero móvil ha sido identificado y documentado formalmente?",null,null,"Recomendado","Recomendado","BizOps",null,null,"4","4.1","4.1.1",null,"4.1.1.1",null,null,"4.1.1.1.3",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"4.1.1.1.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.1","4.1.1","","4.1.1.1",null,{"$f":"CHOOSE(LanguageNumber,BB8,BS8,CI8,CY8)","v":0},"4.1.1.1.4","4.1.1.1.4: Does senior management ensure the provision of sufficient resources to fulfil the objectives of the mobile money business?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.1","4.1.1","","4.1.1.1",null,null,"4.1.1.1.4","4.1.1.1.6","Does senior management ensure the provision of sufficient resources to fulfil the objectives of the mobile money business?",null,null,"Recommended","Recommended","BizOps",null,null,"4","4.1","4.1.1","","4.1.1.1",0,null,"4.1.1.1.4","Le conseil d’administration et la direction générales s'assurent-ils de disposer de moyens suffisants pour réaliser les objectifs de l’activité d’argent mobile ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"4","4.1","4.1.1","","4.1.1.1",null,null,"4.1.1.1.4","¿La alta gerencia garantiza el suministro de los recursos suficientes para cumplir con los objetivos del negocio del dinero móvil?",null,null,"Recomendado","Recomendado","BizOps",null,null,"4","4.1","4.1.1",null,"4.1.1.1",null,null,"4.1.1.1.4",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"4.1.1.1.6",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.1","4.1.1","","4.1.1.2",{"$f":"AZ9&\": \"&CHOOSE(LanguageNumber,BA9,BR9,CH9,CX9)","v":"4.1.1.2: HEAD OF MOBILE MONEY\nThe mobile money provider should appoint a head of mobile money, who is responsible for operating the mobile money service. The manager should:\n\n- ensure that managers are assigned for each function of service operation;\n- ensure appropriate documentation is produced for each area of service operation;\n- ensure that all operations (internal and via third parties) are managed to meet the goals of the service;\n- regularly report to senior management in service management reviews."},{"$f":"BB9","v":"ISO 20000-1:2018 Sec. 5.1"},"4.1.1.2.1","4.1.1.2.1: Has a head of mobile money been assigned, who is responsible for operating the mobile money service?\n","1) Mobile Money organization chart and/or governance documentation\n- Check a position exists for the Head of mobile money, and \n- Check responsibility for managing the mobile money business has been assigned to that position.  \n- Check that the position is currently filled.\n",0,"Urgent Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.1","4.1.1","","4.1.1.2","HEAD OF MOBILE MONEY\nThe mobile money provider should appoint a head of mobile money, who is responsible for operating the mobile money service. The manager should:\n\n- ensure that managers are assigned for each function of service operation;\n- ensure appropriate documentation is produced for each area of service operation;\n- ensure that all operations (internal and via third parties) are managed to meet the goals of the service;\n- regularly report to senior management in service management reviews.","ISO 20000-1:2018 Sec. 5.1","4.1.1.2.1","4.1.1.2.1","Has a head of mobile money been assigned, who is responsible for operating the mobile money service?","1) Mobile Money organization chart and/or governance documentation\n- Check a position exists for the Head of mobile money, and \n- Check responsibility for managing the mobile money business has been assigned to that position.  \n- Check that the position is currently filled.\n",null,"Urgent Required","Required","BizOps",null,null,"4","4.1","4.1.1","","4.1.1.2","DIRECTION DE L’ARGENT MOBILE\nLe prestataire de service d’argent mobile doit nommer un directeur de l’argent mobile, chargé de l’exploitation du service d’argent mobile. Le directeur doit :\n\n- s’assurer que des responsables soient assignés à chaque fonction d’exploitation du service ;\n- s’assurer que des documentations soient établies pour chaque domaine de l’exploitation du service ;\n- s’assurer que l’ensemble des opérations (internes et par le biais de tiers) soit géré de façon à répondre aux objectifs du service ;\n- communiquer périodiquement des rapports à la direction générale pour examen de la gestion du service.",{"$f":"$BB9","v":"ISO 20000-1:2018 Sec. 5.1"},"4.1.1.2.1","Un directeur de l’argent mobile, chargé de l’exploitation du service d'argent mobile, a-t-il été nommé ?","1) Organigramme de l’argent mobile et/ou et documentation relative à la gouvernance\n- Vérifier que le poste de Responsable de l’exploitation de l’argent mobile existe et \n- Vérifier que la responsabilité de la gestion de l’activité d’argent mobile a été assignée à la personne occupant ce poste. \n- Vérifier qu’un responsable de l’exploitation de l’argent mobile a été nommé.\n",null,"Requis Prioritaire","Requis","BizOps",0,null,"4","4.1","4.1.1","","4.1.1.2","JEFE DEL DINERO MÓVIL\nEl proveedor del dinero móvil deberá designar a un jefe del dinero móvil, que será responsable de la operación del servicio del dinero móvil. El gerente deberá:\n\n- garantizar la asignación de gerentes para cada función de operación del servicio;\n- garantizar la elaboración de la documentación correspondiente para cada área de operación del servicio;\n- garantizar que todas las operaciones (internas y a través de terceros) sean gestionadas para cumplir con los objetivos del servicio;\n- informar periódicamente a la alta gerencia las revisiones de gestión del servicio.",{"$f":"$BB9","v":"ISO 20000-1:2018 Sec. 5.1"},"4.1.1.2.1","¿Se ha asignado un jefe del dinero móvil responsable de la operación del servicio del dinero móvil?","1) Organigrama y/o documentación de gobernanza del Dinero Móvil\n- Verificar que exista el cargo de Jefe del dinero móvil, y \n- Verificar que se haya asignado la responsabilidad de gestión del negocio del dinero móvil a ese cargo.  \n- Verificar que el cargo esté actualmente cubierto.\n",null,"Obligatorio urgente","Obligatorio","BizOps",null,null,"4","4.1","4.1.1",null,"4.1.1.2",null,{"$f":"$BB9","v":"ISO 20000-1:2018 Sec. 5.1"},"4.1.1.2.1",null,null,null,"ReqU4","Req4","BizOps",null,null,null,null,null,null,null,null,"4.1.1.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.1","4.1.1","","4.1.1.2",null,0,"4.1.1.2.2","4.1.1.2.2: Does the head of mobile money report regularly to senior management on the performance of the mobile money service?\n","1) Mobile money performance reports / service review report\n- Check that a mobile money performance report or service review report has been produced in the last six months.\n- Check that the report was sent to senior management.",0,"Urgent Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.1","4.1.1","","4.1.1.2",null,null,"4.1.1.2.2","4.1.1.2.3","Does the head of mobile money report regularly to senior management on the performance of the mobile money service?","1) Mobile money performance reports / service review report\n- Check that a mobile money performance report or service review report has been produced in the last six months.\n- Check that the report was sent to senior management.",null,"Urgent Required","Required","BizOps",null,null,"4","4.1","4.1.1","","4.1.1.2",0,0,"4.1.1.2.2","le directeur de l’argent mobile communique-t-il régulièrement des rapports à la direction générale sur la performance du service d'argent mobile ?","1) Rapports sur la performance du service d’argent mobile/rapport d’examen du service\n- Vérifier qu’un rapport sur la performance du service d’argent mobile ou un rapport d’examen du service a été établi au cours des six derniers mois.\n- Vérifier que ce rapport a été transmis à la direction générale.",null,"Requis Prioritaire","Requis","BizOps",0,null,"4","4.1","4.1.1","","4.1.1.2",null,0,"4.1.1.2.2","¿El jefe del dinero móvil informa periódicamente a la alta gerencia sobre el rendimiento del servicio del dinero móvil?","1) Informes de rendimiento del dinero móvil / informe de revisión del servicio\n- Verificar que en los últimos seis meses se haya generado un informe de rendimiento del dinero móvil o un informe de revisión del servicio.\n- Verificar que el informe haya sido enviado a la alta gerencia.",null,"Obligatorio urgente","Obligatorio","BizOps",null,null,"4","4.1","4.1.1",null,"4.1.1.2",null,0,"4.1.1.2.2",null,null,null,"ReqU4","Req4","BizOps",null,null,null,null,null,null,null,null,"4.1.1.2.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.1","4.1.1","","4.1.1.3","4.1.1.3: MOBILE MONEY AUDIT\nRegular audits or compliance reviews of the mobile money service should be carried out on behalf of senior management. In setting up the review, the following should be adhered to:\n- The scope and purpose should be defined - typically to evaluate whether the MM governance, internal control and risk management processes are operating effectively;\n- Reviewers could be internal and/or external, provided that they are independent - for example, the compliance function could do the review;\n- Planning of the audit / review should take into account the importance of the services, processes and areas to be audited and the results of previous reviews.\n- An Internal Audit function is created that reports directly to the Head of Mobile Money and its report is distributed to relevant management.\n","ISO 20000-2:2019 Sec. 9.2","4.1.1.3.1","4.1.1.3.1: is an audit or compliance review of the mobile money service (or high-risk activities of mobile money) done to evaluate the MM governance, internal control and risk management processes - at least every two years and reporting to senior management?\n","1. Header page of last audit, or audit policy/process/plan, or compliance framework\n- Check that an audit or compliance review of mobile money is performed at least every 2 years by an independent function (e.g. internal audit or compliance team).\n",0,"Urgent Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.1","4.1.1","","4.1.1.3","MOBILE MONEY AUDIT\nRegular audits or compliance reviews of the mobile money service should be carried out on behalf of senior management. In setting up the review, the following should be adhered to:\n- The scope and purpose should be defined - typically to evaluate whether the MM governance, internal control and risk management processes are operating effectively;\n- Reviewers could be internal and/or external, provided that they are independent - for example, the compliance function could do the review;\n- Planning of the audit / review should take into account the importance of the services, processes and areas to be audited and the results of previous reviews.\n- An Internal Audit function is created that reports directly to the Head of Mobile Money and its report is distributed to relevant management.\n","ISO 20000-2:2019 Sec. 9.2","4.1.1.3.1","4.1.1.3.1","is an audit or compliance review of the mobile money service (or high-risk activities of mobile money) done to evaluate the MM governance, internal control and risk management processes - at least every two years and reporting to senior management?","1. Header page of last audit, or audit policy/process/plan, or compliance framework\n- Check that an audit or compliance review of mobile money is performed at least every 2 years by an independent function (e.g. internal audit or compliance team).\n",null,"Urgent Required","Required","BizOps",null,null,"4","4.1","4.1.1","","4.1.1.3","AUDIT DU SERVICE D'ARGENT MOBILE\nDes audits réguliers du service d'argent mobile ou un examen de la conformité de ce dernier doivent être réalisés pour le compte de la direction générale. Dans le cadre de la préparation des examens, il convient de respecter les éléments suivants :\n- la portée et l’objectif de chaque examen doivent être définis ; ces examens visent de manière générale à évaluer l'efficacité des processus de gestion de la gouvernance de l'argent mobile, des contrôles internes et des risques ;\n- les examinateurs peuvent être internes et/ou externes, pourvu qu’ils soient indépendants - par exemple, la fonction conformité peut réaliser l’examen ;\n- la planification de l'audit/examen doit tenir compte de l’importance des services, des processus et des domaines à examiner ainsi que des résultats des examens précédents.","ISO 20000-2:2019 Sec. 9.2","4.1.1.3.1","un audit du service d'argent mobile ou un examen de la conformité de ce dernier (ou des activités à haut risque de l'argent mobile) est-il réalisé afin d'évaluer les processus de gestion de la gouvernance de l'argent mobile, des contrôles internes et des risques, au minimum tous les deux ans ? Les informations relatives à cet audit ou cet examen sont-elles remontées à la direction générale ?","1. Page d'en-tête du dernier audit ou politique/processus/plan d’audit ou directives relatives à la conformité\n- Vérifier qu'un audit du service de l'argent mobile ou un examen de la conformité de ce dernier est réalisé au minimum tous les 2 ans par une fonction indépendante (par ex. l'équipe d'audit interne ou l'équipe de conformité).\n",null,"Requis Prioritaire","Requis","BizOps","Un audit est un examen de haut niveau de l'activité d'argent mobile avec rapport à l'équipe dirigeante chargée de la supervision du service d'argent mobile.",null,"4","4.1","4.1.1","","4.1.1.3","AUDITORÍA DEL SERVICIO DEL DINERO MÓVIL\nSe deben realizar auditorías o revisiones de cumplimiento periódicas del servicio del dinero móvil en nombre de la alta gerencia. Al establecer la revisión, se deberá respetar lo siguiente:\n- Se debe definir el alcance y el propósito de cada revisión, en general, para evaluar si los procesos de gobernanza, control interno y gestión de riesgos del dinero móvil están operando con efectividad;\n- Los revisores podrían ser internos y/o externos, siempre que sean independientes - por ejemplo, la función de cumplimiento podría realizar la revisión;\n- La planificación de la revisión debe considerar la importancia de los servicios, los procesos y las áreas a auditar, así como también los resultados de revisiones anteriores.","ISO 20000-2:2019 Sec. 9.2","4.1.1.3.1","¿La auditoría o revisión de cumplimiento del servicio del dinero móvil (o de actividades de dinero móvil de alto riesgo) se realiza, al menos, cada dos años para evaluar los procesos de gobernanza, control interno y gestión de riesgos del dinero móvil e informar a la alta gerencia?","1. Página de encabezado de la última auditoría, política / proceso / planificación de auditorías o marco de cumplimiento.\n- Verificar que una función independiente (por ej., el equipo de cumplimiento o auditoría interna) lleve a cabo una auditoría o revisión de cumplimiento del dinero móvil, al menos, cada 2 años.\n",null,"Obligatorio urgente","Obligatorio","BizOps",null,null,"4","4.1","4.1.1",null,"4.1.1.3",null,"ISO 20000-2:2019 Sec. 9.2","4.1.1.3.1",null,null,null,"ReqU4","Req4","BizOps",null,null,null,null,null,null,null,null,"4.1.1.3.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.1","4.1.1",{"$f":"CHOOSE(LanguageNumber,AY12,BP12,CF12,CV12)","v":""},{"$f":"AZ12","v":"4.1.1.3"},null,null,{"$f":"BC12","v":"4.1.1.3.2"},"4.1.1.3.2: Are issues raised by audits / compliance reviews being followed up by senior management to ensure they are addressed promptly?\n",{"$f":"CHOOSE(LanguageNumber,BF12,BV12,CL12,DB12)","v":"1) Records of last audit, or audit policy/process/plan, or compliance framework\n- Check that issues raised by audits/compliance reviews are being followed up by senior management to ensure they are addressed promptly\n(Note: Records of the last audit / review could be redacted to remove sensitive contents but to show that actions are being followed up. Alternatively, the process documentation could be used as evidence)"},0,{"$f":"CHOOSE(LanguageNumber,BH12,BX12,CN12,DD12)","v":"Standard Required"},{"$f":"CHOOSE(LanguageNumber,BI12,BY12,CO12,DE12)","v":"Required"},"BizOps",{"$f":"CHOOSE(LanguageNumber,BK12,CA12,CQ12,DG12)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.1","4.1.1","","4.1.1.3",null,null,"4.1.1.3.2",{"$f":"DO12","v":"4.1.1.3.4"},"Are issues raised by audits / compliance reviews being followed up by senior management to ensure they are addressed promptly?","1) Records of last audit, or audit policy/process/plan, or compliance framework\n- Check that issues raised by audits/compliance reviews are being followed up by senior management to ensure they are addressed promptly\n(Note: Records of the last audit / review could be redacted to remove sensitive contents but to show that actions are being followed up. Alternatively, the process documentation could be used as evidence)",null,"Standard Required","Required","BizOps",null,null,"4","4.1","4.1.1","","4.1.1.3",null,null,"4.1.1.3.2","Les problèmes identifiés dans le cadre des audits/des examens de conformité font-ils l'objet d'un suivi par la direction générale afin de s'assurer qu'ils sont résolus rapidement ?","1) Registres du dernier audit ou politique/processus/plan d’audit ou directives relatives à la conformité\n- Vérifier que les problèmes identifiés dans le cadre des audits/des examens de conformité font l'objet d'un suivi par la direction générale afin de s'assurer qu'ils sont résolus rapidement\n(Remarque : Les registres du dernier audit/examen peuvent être altérés de façon à supprimer tout contenu sensible mais doivent démontrer que des actions sont prises. La documentation relative au processus peut également être utilisée comme preuve).",null,"Requis Normal","Requis",{"$f":"$O12","v":"BizOps"},0,null,"4","4.1","4.1.1","","4.1.1.3",null,null,"4.1.1.3.2","¿La alta gerencia realiza un seguimiento de los problemas identificados por las auditorías / revisiones de cumplimimento para garantizar que sean rápidamente resueltos?","1) Registros de la última auditoría, política / proceso / planificación de auditorías o marco de cumplimiento\n- Verificar que la alta gerencia realiza un seguimiento de los problemas identificados por las auditorías / revisiones de cumplimimento para garantizar que sean rápidamente resueltos. \n\n(Nota: Los registros de la última auditoría / revisión se pueden redactar de forma tal que se elimine el contenido confidencial, pero describiendo el seguimiento de las acciones. Como alternativa, la documentación del proceso se puede utilizar como prueba).",null,"Obligatorio estándar","Obligatorio","BizOps",null,null,"4","4.1","4.1.1",null,"4.1.1.3",null,null,"4.1.1.3.2",null,null,null,"ReqS4","Req4","BizOps",null,null,null,null,null,null,null,null,"4.1.1.3.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.1","4.1.1","","4.1.1.3",null,0,"4.1.1.3.3","4.1.1.3.3: Does the planning of the review take into account the importance of the services, processes and areas to be reviewed and the results of previous reviews?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.1","4.1.1","","4.1.1.3",null,null,"4.1.1.3.3","4.1.1.3.3","Does the planning of the review take into account the importance of the services, processes and areas to be reviewed and the results of previous reviews?",null,null,"Recommended","Recommended","BizOps",null,null,"4","4.1","4.1.1","","4.1.1.3",0,0,"4.1.1.3.3","la planification de l'audit tient-elle compte de l’importance des services, des processus et des domaines à auditer ainsi que des résultats des audits précédents ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"4","4.1","4.1.1","","4.1.1.3",null,0,"4.1.1.3.3","¿La planificación de la revisión considera la importancia de los servicios, los procesos, las áreas a revisar y los resultados de revisiones previas?",null,null,"Recomendado","Recomendado","BizOps",null,null,"4","4.1","4.1.1",null,"4.1.1.3",null,0,"4.1.1.3.3",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"4.1.1.3.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.1","4.1.1","","4.1.1.4","4.1.1.4: DOCUMENT MANAGEMENT POLICY\nA policy for document management should be documented and implemented. The policy should ensure that all business activities are properly documented. The document management policy should specify the following:\n- Each business function should be governed by its own documented policy.\n- All business processes should be documented.\n- Agreements with customers and suppliers should be documented and include service levels.\n- All documents should be reviewed and updated regularly.\n- Change controls should be implemented to manage changes to documents, with new versions of documents recorded using a proper change log.\n- Document retention should be specified, including old versions of documents.","ISO 20000-1:2011 Sec. 4.3","4.1.1.4.1","4.1.1.4.1: Has a document management policy, that requires all business activities to be properly documented, been specified and implemented?\n","1. A Document management policy is in place which requires that all business activities are documented. Check that the policy requires:\n - all business units have documented policies;\n - all business processes are documented;\n - all customer and supplier contracts are documented and contain an SLA.\nCheck that the document management policy specifies document review periods, change control processes, version control and storage and retrieval processes.\nCheck that the policy has been signed by the current senior management team in the last 2 years.",0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.1","4.1.1","","4.1.1.4","DOCUMENT MANAGEMENT POLICY\nA policy for document management should be documented and implemented. The policy should ensure that all business activities are properly documented. The document management policy should specify the following:\n- Each business function should be governed by its own documented policy.\n- All business processes should be documented.\n- Agreements with customers and suppliers should be documented and include service levels.\n- All documents should be reviewed and updated regularly.\n- Change controls should be implemented to manage changes to documents, with new versions of documents recorded using a proper change log.\n- Document retention should be specified, including old versions of documents.","ISO 20000-1:2011 Sec. 4.3","4.1.1.4.1","4.1.1.4.1","Has a document management policy, that requires all business activities to be properly documented, been specified and implemented?","1. A Document management policy is in place which requires that all business activities are documented. Check that the policy requires:\n - all business units have documented policies;\n - all business processes are documented;\n - all customer and supplier contracts are documented and contain an SLA.\nCheck that the document management policy specifies document review periods, change control processes, version control and storage and retrieval processes.\nCheck that the policy has been signed by the current senior management team in the last 2 years.",null,"Recommended","Recommended","BizOps",null,null,"4","4.1","4.1.1","","4.1.1.4","POLITIQUE DE GESTION DES DOCUMENTS\nUne politique de gestion des documents doit être documentée et mise en œuvre. Elle doit garantir que toutes les activités de l’entreprise soient correctement documentées et spécifier les éléments suivants :   \n- chaque fonction de l’entreprise doit être régie par sa propre politique documentée ; \n- tous les processus de l’entreprise doivent être documentés ;\n- les accords avec les clients et les fournisseurs doivent être documentés et prévoir des niveaux de service ; \n- tous les documents doivent être examinés et mis à jour régulièrement ; \n- des dispositifs de contrôle des modifications doivent être mis en place pour gérer les changements apportés aux documents, chaque nouvelle version des documents devant être enregistrée au moyen d’un registre adapté de modification ;  \n- la durée de conservation des documents doit être précisée, y compris pour les anciennes versions.\n","ISO 20000-1:2011 Sec. 4.3","4.1.1.4.1","une politique de gestion des documents a-t-elle été définie et mise en place pour garantir que toutes les activités de l'entreprise soient correctement documentées ?","1. Une politique de gestion des documents a été mise en place pour garantir que toutes les activités de l’entreprise sont correctement documentées. Vérifier que la politique garantit que :\n - chaque fonction de l’entreprise est régie par sa propre politique documentée ;\n - tous les processus de l’entreprise sont documentés ;\n - les accords avec les clients et les fournisseurs sont documentés et prévoient un accord de niveau de service.\nVérifier que la politique de gestion des documents précise les périodes d’examen des documents, les processus de contrôle des modifications ainsi que les processus de contrôle des versions et de récupération.\nVérifier que la politique a été signée par l’équipe de direction générale actuelle au cours des deux dernières années.",null,"Recommandé","Recommandé","BizOps",0,null,"4","4.1","4.1.1","","4.1.1.4","POLÍTICA DE ADMINISTRACIÓN DE DOCUMENTOS\nSe debe documentar e implementar una política de administración de documentos. Esta política debe garantizar la adecuada documentación de todas las actividades comerciales. La política de administración de documentos debe especificar lo siguiente:\n- Cada función del negocio se regirá por su propia política documentada.\n- Se deben documentar todos los procesos del negocio.\n- Se deben documentar todos los acuerdos con clientes y proveedores, incluidos los niveles de servicio.\n- Todos los documentos deben ser revisados y actualizados de forma periódica.\n- Se debe implementar el control de cambios para realizar cambios a los documentos y las nuevas versiones de los documentos se deben registrar usando un registro de cambios adecuado.\n- Se debe especificar la retención de documentos, incluyendo las versiones anteriores de los documentos.","ISO 20000-1:2011 Sec. 4.3","4.1.1.4.1","¿Se especificó e implementó una política de administración de documentos que requiera la adecuada documentación de todas las actividades del negocio?","1. Se implementó una política de administración de documentos que exija la documentación de todas las actividades del negocio. Verificar que la política exija lo siguiente:\n - que todas las unidades de negocios cuenten con políticas documentadas;\n - que todos los procesos del negocio sean documentados;\n - que todos los contratos con clientes y proveedores sean documentados y contengan un SLA.\nVerificar que la política de administración de documentos especifique los períodos de revisión de los documentos, los procesos de control de cambios, los procesos de control, almacenamiento y recuperación de versiones.\nVerificar que la política haya sido firmada por el equipo de alta gerencia actual en los últimos 2 años.",null,"Recomendado","Recomendado","BizOps",null,null,"4","4.1","4.1.1",null,"4.1.1.4",null,"ISO 20000-1:2011 Sec. 4.3","4.1.1.4.1",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"4.1.1.4.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4",0,0,{"$f":"UPPER(CONCATENATE(Introduction!C19,\": \",Introduction!D19))","v":"4.2: BUSINESS AND TECHNICAL OPERATIONS AND SERVICE LEVEL MANAGEMENT"},null,null,null,0,{"$f":"Introduction!E19","v":"Providers shall manage technical and business operations according to service levels"},null,0,null,null,null,{"$f":"CHOOSE(LanguageNumber,BK15,CA15,CQ15,DG15)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4",null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$19,\": \",Introduction!$L$19))","v":"4.2: BUSINESS AND TECHNICAL OPERATIONS AND SERVICE LEVEL MANAGEMENT"},null,null,null,null,null,{"$f":"Introduction!$M$19","v":"Providers shall manage technical and business operations according to service levels"},null,null,null,null,0,null,null,"4",0,0,null,null,null,0,0,"",null,null,null,null,0,null,null,"4",0,0,{"$f":"UPPER(CONCATENATE(Introduction!$U$19,\": \",Introduction!$V$19))","v":"4.2: GESTIÓN DE OPERACIONES COMERCIALES Y TÉCNICAS Y NIVEL DE SERVICIOS"},null,null,0,0,{"$f":"Introduction!W19","v":"El proveedor administrará las operaciones comerciales y técnicas conforme a los niveles de servicio"},null,null,null,null,0,null,null,"4",0,0,null,0,null,0,0,null,null,null,null,null,0]
[null,"4","4.2","4.2.1",{"$f":"CHOOSE(LanguageNumber,AY16,BP16,CF16,CV16)","v":"4.2.1: Providers and partners should operate technical systems properly and manage service levels"},"4.2.1.1",{"$f":"AZ16&\": \"&CHOOSE(LanguageNumber,BA16,BR16,CH16,CX16)","v":"4.2.1.1: TECHNICAL OPERATIONS\nThe provider should create, implement and maintain technical operations documentation, which should include:\n1. Functional architecture and infrastructure architecture;\n2. Scheduled operational activities and dependencies. Include:;\n     - manual processes for manipulating systems or files (e.g. log file maintenance, renewing certificates);\n     - scheduling of regular jobs;\n     - instructions for handling errors or other exceptional conditions that might arise;\n     - system or component restart and recovery procedures for use in the event of errors or failures;\n     - backup of data and storage of backup material (see 5.3.5.2);\n     - management of system logs and system monitoring (see 5.3.6).\n\nOther technical operations documentation should include:\n - Effort and resources definition, including an organizational chart;\n - Compliance (e.g. ISO, PCI DSS, ITIL);\n - Operational management tools;\n - Risks to technical operations;\n - Planned activities (e.g. upgrades);\n - Governance, communication and reporting plan;\n - Service levels (see elsewhere in 4.2.1);\n - Incident support and escalation (see 4.4).\n\nRegular reviews and improvements should be part of the process."},{"$f":"BB16","v":"ISO 20000-1:2018 Sec 6.3"},"4.2.1.1.1",{"$f":"BC16&\": \"&CHOOSE(LanguageNumber,BE16,BU16,CK16,DA16)&CarriageReturn","v":"4.2.1.1.1: Is documentation in place to define all technical operations activities of the mobile money system, including regular and scheduled technical operations tasks?\n"},{"$f":"CHOOSE(LanguageNumber,BF16,BV16,CL16,DB16)","v":"1) Operational process documentation\n- Check this appears complete\n- Check this includes a process for regular / scheduled operational activities\n- Check the plan has been implemented \n"},0,{"$f":"CHOOSE(LanguageNumber,BH16,BX16,CN16,DD16)","v":"Urgent Required"},{"$f":"CHOOSE(LanguageNumber,BI16,BY16,CO16,DE16)","v":"Required"},"TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.2","4.2.1","4.2.1: Providers and partners should operate technical systems properly and manage service levels","4.2.1.1","TECHNICAL OPERATIONS\nThe provider should create, implement and maintain technical operations documentation, which should include:\n1. Functional architecture and infrastructure architecture;\n2. Scheduled operational activities and dependencies. Include:;\n     - manual processes for manipulating systems or files (e.g. log file maintenance, renewing certificates);\n     - scheduling of regular jobs;\n     - instructions for handling errors or other exceptional conditions that might arise;\n     - system or component restart and recovery procedures for use in the event of errors or failures;\n     - backup of data and storage of backup material (see 5.3.5.2);\n     - management of system logs and system monitoring (see 5.3.6).\n\nOther technical operations documentation should include:\n - Effort and resources definition, including an organizational chart;\n - Compliance (e.g. ISO, PCI DSS, ITIL);\n - Operational management tools;\n - Risks to technical operations;\n - Planned activities (e.g. upgrades);\n - Governance, communication and reporting plan;\n - Service levels (see elsewhere in 4.2.1);\n - Incident support and escalation (see 4.4).\n\nRegular reviews and improvements should be part of the process.","ISO 20000-1:2018 Sec 6.3","4.2.1.1.1","4.2.1.1.1","Is documentation in place to define all technical operations activities of the mobile money system, including regular and scheduled technical operations tasks?","1) Operational process documentation\n- Check this appears complete\n- Check this includes a process for regular / scheduled operational activities\n- Check the plan has been implemented \n",null,"Urgent Required","Required","TechOps",null,null,"4","4.2","4.2.1","4.2.1: Les prestataires et leurs partenaires doivent se doter de systèmes de surveillance et de suivi des niveaux de service.","4.2.1.1","OPÉRATIONS TECHNIQUES\nLe prestataire doit établir, mettre en œuvre et tenir à jour une documentation sur les opérations techniques, qui doit comprendre :\n1. Architecture fonctionnelle et architecture d'infrastructure\n2. Activités opérationnelles programmées et liens de dépendance. Inclus :\n     - procédés manuels pour la manipulation de systèmes ou de fichiers (par ex. maintenance de fichiers journaux, renouvellement de certificats) ;\n     - planification des tâches récurrentes ;\n     - instructions sur le traitement des erreurs et d'autres situations exceptionnelles qui peuvent se présenter ;\n     - redémarrage du système ou d’un composant, procédures de récupération à effectuer en cas d’erreur ou de défaillance ;\n     - sauvegarde de données et stockage des éléments sauvegardés (cf. 5.3.5.2) ;\n     - gestion des fichiers journaux du système et surveillance du système (cf. 5.3.6).\n\nParmi les autres documents sur les opérations techniques doivent figurer :\n - définition des efforts et ressources, avec notamment un organigramme  ;\n - conformité (ex. ISO, PCI DSS, ITIL);\n - outils de gestion opérationnelle ;\n - risques pesant sur les opérations techniques ;\n - activités programmées (ex. mises à niveau) ;\n - gouvernance, communication et rapports prévus ;\n - niveaux de service (cf. 4.2.1) ;\n - support en cas d’incident et remontée des problèmes (cf. 4.4).\n\nLe processus doit prévoir des bilans réguliers pour amélioration.","ISO 20000-1:2018 Sec 6.3","4.2.1.1.1","Existe-t-il une documentation qui définit toutes les activités relatives aux opérations techniques du système de l’argent mobile, y compris les tâches des opérations techniques récurrentes et planifiées ?","1) Documentation du processus opérationnel\n- Vérifier l’exhaustivité de cette documentation\n- Vérifier que cette documentation inclut un processus pour les activités opérationnelles régulières/programmées\n- Vérifier que le plan a été mis en œuvre\n",null,{"$f":"VLOOKUP($BH16,CategoryTranslationTable,2,FALSE)","v":"Requis Prioritaire"},{"$f":"VLOOKUP($BI16,CategoryTranslationTable,2,FALSE)","v":"Requis"},"TechOps","Les activités opérationnelles programmées comprennent les sauvegardes périodiques, la maintenance des fichiers journaux, etc. Elles se distinguent des activités de support opérationnel non programmées, qui résultent des incidents, des demandes d’assistance et des nouvelles versions (répertoriées sous « autres éléments » dans le plan de gestion du service).",null,"4","4.2","4.2.1","4.2.1: Los proveedores y los socios deben operar adecuadamente los sistemas técnicos y gestionar los niveles de servicio","4.2.1.1","OPERACIONES TÉCNICAS\nEl proveedor debe crear, implementar y mantener documentación de operaciones técnicas, que debe incluir:\n1. Arquitectura funcional y arquitectura de la infraestructura;\n2. Actividades operativas programadas y dependencias. Incluir:\n     - procesos manuales para manejar sistemas o archivos (por ej., mantenimiento de archivos de registro, certificados de renovación);\n     - programación de trabajos regulares;\n     - instrucciones para el manejo de errores u otras condiciones excepcionales que podrían suscitarse;\n     - reinicio del sistema o componente y procedimientos de recuperación en caso de errores o fallas;\n     - copias de respaldo de datos y almacenamiento del material de respaldo (ver 5.3.5.2);\n     - gestión de registros del sistema y monitoreo del sistema (ver 5.3.6).\n\nOtras documentaciones de operaciones técnicas podrían incluir:\n - Definición de esfuerzos y recursos, incluido un organigrama;\n - Cumplimiento (por ej., ISO, PCI DSS, ITIL);\n - Herramientas de gestión operativa;\n - Riesgos de las operaciones técnicas;\n - Actividades planificadas (por ej., actualizaciones);\n - Planificación de gobernanza, comunicaciones y generación de informes;\n - Niveles de servicio (ver 4.2.1);\n - Soporte y escalamiento de incidentes (ver 4.4).\n\nLas revisiones y las mejoras periódicas deben formar parte del proceso.","ISO 20000-1:2018 Sec 6.3","4.2.1.1.1","¿Existe documentación que defina todas las actividades de operaciones técnicas del sistema del dinero móvil, incluyendo tareas de operaciones técnicas habituales y programadas?","1) Documentación de procesos operativos\n- Verificar que esté completa\n- Verificar que incluya un proceso para actividades operativas habituales / programadas\n- Verificar que se haya implementado la planificación \n",null,{"$f":"VLOOKUP($BH16,CategoryTranslationTable,3,FALSE)","v":"Obligatorio urgente"},{"$f":"VLOOKUP($BI16,CategoryTranslationTable,3,FALSE)","v":"Obligatorio"},"TechOps",null,null,"4","4.2","4.2.1","4.2.1:","4.2.1.1",null,"ISO 20000-1:2018 Sec 6.3","4.2.1.1.1",null,null,null,{"$f":"VLOOKUP($BH16,CategoryTranslationTable,4,FALSE)","v":"ReqU4"},{"$f":"VLOOKUP($BI16,CategoryTranslationTable,4,FALSE)","v":"Req4"},"TechOps",null,null,null,null,null,null,null,"MERGE","4.2.1.1.1","4.2.1.1.4","5.3.5.1.1",null,{"$f":"IF(OR($EA16=0,$EA16=2),VLOOKUP(DO16,INDIRECT(ED16),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP16),\"\",VLOOKUP(DP16,INDIRECT(EE16),7,FALSE))","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DQ16),\"\",VLOOKUP(DQ16,INDIRECT(EF16),7,FALSE))","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DR16),\"\",VLOOKUP(DR16,INDIRECT(EG16),7,FALSE))","v":""},{"$f":"IF(OR($EA16=0,$EA16=2),VLOOKUP(DO16,INDIRECT(ED16),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP16),\"\",VLOOKUP(DP16,INDIRECT(EE16),8,FALSE))","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DQ16),\"\",VLOOKUP(DQ16,INDIRECT(EF16),8,FALSE))","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DR16),\"\",VLOOKUP(DR16,INDIRECT(EG16),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN16,3)=\"NEW\")+2*AND(LEFT(DN16,3)=\"MER\")+3*AND(LEFT(DN16,3)=\"MOV\")+4*AND(LEFT(DN16,3)=\"SWA\")","v":2},"",{"$f":"IF(EA16=0,IF(DW16=0,\"\",DW16),CHOOSE(EA16,\"New indicator\",CONCATENATE(DW16,CarriageReturn,DX16,CarriageReturn,DY16,CarriageReturn,DZ16)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO16,1)","v":"OriginalComplianceP4"},{"$f":"\"OriginalComplianceP\"&LEFT(DP16,1)","v":"OriginalComplianceP4"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ16,1)","v":"OriginalComplianceP5"},{"$f":"\"OriginalComplianceP\"&LEFT(DR16,1)","v":"OriginalComplianceP"},0,0,0,0,0,3,{"$f":"IF(OR(AND(EH16>0,SUM(EI16:EL16)>0),EK16>0),\"Partial\",IF(EH16=EM16,\"Yes\",IF(EI16=EM16,\"No\",IF(EJ16=EM16,\"N/A\",IF(EK16=EM16,\"Partial\",IF(EL16=EM16,\"\",\"\"))))))","v":""}]
[null,"4","4.2","4.2.1",0,"4.2.1.1",null,0,"4.2.1.1.2","4.2.1.1.2: Are the functional architecture and infrastructure architecture of the mobile money system documented?\n","1) System architecture specification\n- Check both the functional and technical architecture has been documented",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.2","4.2.1",null,"4.2.1.1",null,null,"4.2.1.1.2","4.2.1.1.3","Are the functional architecture and infrastructure architecture of the mobile money system documented?","1) System architecture specification\n- Check both the functional and technical architecture has been documented",null,"Urgent Required","Required","TechOps",null,null,"4","4.2","4.2.1",0,"4.2.1.1",null,0,"4.2.1.1.2","l'architecture fonctionnelle et d'infrastructure du système de l’argent mobile sont-elles documentées ?","1) Spécification de l’architecture du système\n- Vérifier que l’architecture fonctionnelle et l’architecture technique sont documentées\n",null,"Requis Prioritaire","Requis","TechOps",0,null,"4","4.2","4.2.1",null,"4.2.1.1",null,0,"4.2.1.1.2","¿Está documentada la arquitectura funcional y la arquitectura de la infraestructura del sistema del dinero móvil?","1) Especificación de la arquitectura del sistema\n- Verificar que la arquitectura funcional y la arquitectura técnica hayan sido documentadas",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"4","4.2","4.2.1",null,"4.2.1.1",null,0,"4.2.1.1.2",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"4.2.1.1.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.2","4.2.1",0,"4.2.1.1",null,0,"4.2.1.1.3","4.2.1.1.3: Are the required resources documented, including an organizational chart and/or responsibility assignment matrix (RACI)?\n","1) Organizational chart and/or responsibility assignment matrix (RACI) for all organizations supporting the platform (both internal and external, if applicable).\n- Check that the plan includes identification of required resources either by Technical operations organization chart and/or responsibility matrix.\n\n",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.2","4.2.1",null,"4.2.1.1",null,null,"4.2.1.1.3","4.2.1.1.5","Are the required resources documented, including an organizational chart and/or responsibility assignment matrix (RACI)?","1) Organizational chart and/or responsibility assignment matrix (RACI) for all organizations supporting the platform (both internal and external, if applicable).\n- Check that the plan includes identification of required resources either by Technical operations organization chart and/or responsibility matrix.\n\n",null,"Standard Required","Required","TechOps",null,null,"4","4.2","4.2.1","","4.2.1.1",null,0,"4.2.1.1.3","les ressources nécessaires sont-elles documentées, au moyen notamment d’un organigramme et/ou d’une matrice précisant la répartition des rôles et des responsabilités (RACI) ?","1) Organigramme et/ou matrice de répartition des rôles et des responsabilités (RACI) pour l’ensemble des organisations (internes et externes, le cas échéant) soutenant la plateforme.\n- Vérifier que le plan inclut l’identification des ressources nécessaires au moyen d’un organigramme des opérations techniques et/ou d’une matrice de répartition des rôles et des responsabilités .\n\n",null,"Requis Normal","Requis","TechOps",0,null,"4","4.2","4.2.1",null,"4.2.1.1",null,0,"4.2.1.1.3","¿Están documentados los recursos necesarios, incluyendo un organigrama y/o matriz de asignación de responsabilidades (RACI)?","1) Organigrama y/o matriz de asignación de responsabilidades (RACI) para todas las organizaciones que soportan la plataforma (tanto internas como externas, si corresponde).\n- Verificar que la planificación incluya la identificación de los recursos necesarios mediante el organigrama y/o matriz de responsabilidades de operaciones Técnicas.",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"4","4.2","4.2.1",null,"4.2.1.1",null,0,"4.2.1.1.3",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"4.2.1.1.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.2","4.2.1","","4.2.1.1",null,0,"4.2.1.1.4","4.2.1.1.4: Is the process for planned activities (e.g. upgrades) specified in the technical operations documentation so that they can be managed appropriately?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.2","4.2.1","","4.2.1.1",null,null,"4.2.1.1.4","4.2.1.1.6","Is the process for planned activities (e.g. upgrades) specified in the technical operations documentation so that they can be managed appropriately?",null,null,"Recommended","Recommended","TechOps",null,null,"4","4.2","4.2.1","","4.2.1.1",null,0,"4.2.1.1.4","les activités programmées (ex. mises à niveau) sont-elles spécifiées dans le plan de gestion du service de façon à être correctement gérées ?",null,null,"Recommandé","Recommandé","TechOps",0,null,"4","4.2","4.2.1","","4.2.1.1",null,0,"4.2.1.1.4","¿El proceso de actividades planificadas (por ej., actualizaciones) está especificado en la documentación de operaciones técnicas para que éstas puedan ser gestionadas adecuadamente?",null,null,"Recomendado","Recomendado","TechOps",null,null,"4","4.2","4.2.1",null,"4.2.1.1",null,0,"4.2.1.1.4",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.2.1.1.6",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.2","4.2.1","","4.2.1.1",null,0,"4.2.1.1.5","4.2.1.1.5: Is the technical operations documentation reviewed at planned intervals to ensure its continued suitability and effectiveness and to make improvements as necessary?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.2","4.2.1","","4.2.1.1",null,null,"4.2.1.1.5","4.2.1.1.7","Is the technical operations documentation reviewed at planned intervals to ensure its continued suitability and effectiveness and to make improvements as necessary?",null,null,"Recommended","Recommended","TechOps",null,null,"4","4.2","4.2.1","","4.2.1.1",null,0,"4.2.1.1.5","le plan de gestion du service est-il périodiquement revu pour vérifier qu’il reste adapté et efficace et l’améliorer au besoin ?",null,null,"Recommandé","Recommandé","TechOps",0,null,"4","4.2","4.2.1","","4.2.1.1",null,0,"4.2.1.1.5","¿La documentación de operaciones técnicas es revisada a intervalos planificados para garantizar que sea continuamente adecuada y efectiva y para realizar las mejoras necesarias?",null,null,"Recomendado","Recomendado","TechOps",null,null,"4","4.2","4.2.1",null,"4.2.1.1",null,0,"4.2.1.1.5",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.2.1.1.7",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.2","4.2.1","","4.2.1.2","4.2.1.2: BACKUPS\nProviders should implement a process for backups of the mobile money system, which determines: \n- the data that should be backed up;\n- the frequency of backups;\n- the mechanism for making backups;\n- the storage of backups;\n- the data retention period.\n\nBackups of the mobile money system and all financial data should be implemented according to the policy and carried out at least daily. Financial data should be backed up by replication to the Disaster Recovery site.\n\nBackups should be stored securely offsite (e.g. at a second data centre or a commercial storage facility) and securely disposed of when the retention period is passed. \n\nA process for restoring backed-up data should be implemented and tested.","PCI DSS, ISO 27002:2013 Sec. 12.3 ","4.2.1.2.1","4.2.1.2.1: Has a process for mobile money system backups been documented that determines the data that is backed up, the frequency of backups and the data retention period?\n","1) Backup process documentation\n- Check that the backup process has been documented\n- Check that the document includes details on:\n     a) The data that should be backed up;\n     b) The frequency of backups;\n     c) The data retention period.",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.2","4.2.1","","4.2.1.2","BACKUPS\nProviders should implement a process for backups of the mobile money system, which determines: \n- the data that should be backed up;\n- the frequency of backups;\n- the mechanism for making backups;\n- the storage of backups;\n- the data retention period.\n\nBackups of the mobile money system and all financial data should be implemented according to the policy and carried out at least daily. Financial data should be backed up by replication to the Disaster Recovery site.\n\nBackups should be stored securely offsite (e.g. at a second data centre or a commercial storage facility) and securely disposed of when the retention period is passed. \n\nA process for restoring backed-up data should be implemented and tested.","PCI DSS, ISO 27002:2013 Sec. 12.3 ","4.2.1.2.1",{"$f":"DO21","v":"5.3.5.2.1"},"Has a process for mobile money system backups been documented that determines the data that is backed up, the frequency of backups and the data retention period?","1) Backup process documentation\n- Check that the backup process has been documented\n- Check that the document includes details on:\n     a) The data that should be backed up;\n     b) The frequency of backups;\n     c) The data retention period.",null,"Standard Required","Required","TechOps",null,null,"4","4.2","4.2.1","",{"$f":"$AZ21","v":"4.2.1.2"},"SAUVEGARDES\nLes prestataires doivent mettre en place un processus de sauvegarde des données du système de l’argent mobile définissant : \n- les données devant être sauvegardées ;\n- la fréquence des sauvegardes ;\n- les mécanismes de sauvegarde ;\n- le stockage des sauvegardes ;\n- la durée de conservation des données.\n\nLes sauvegardes du système de l’argent mobile et de toutes les données financières doivent être mises en œuvre conformément à la politique définie et effectuées au moins une fois par jour. Les données financières doivent faire l'objet d'une réplication des données vers le site de Reprise d'activité après sinistre.\n \nLes sauvegardes doivent être stockées hors site de manière sécurisée (par exemple dans un autre centre de données ou sur un site de stockage commercial) et supprimées de façon sécurisée à l’issue de leur délai de conservation. \n\nUn processus de récupération des données sauvegardées doit être mis en place et testé. ",{"$f":"BB21","v":"PCI DSS, ISO 27002:2013 Sec. 12.3 "},"4.2.1.2.1","existe-t-il un processus documenté de sauvegarde des données du système de l’argent mobile définissant les données devant être sauvegardées, la fréquence des sauvegardes et la durée de conservation des données ?","1) Documentation du processus de sauvegarde\n- Vérifier que le processus de sauvegarde est documenté\n- Vérifier que le document inclut des détails concernant :\na) Les données devant être sauvegardées;\nc) La fréquence des sauvegardes;\nd) La durée de conservation des données.",null,"Requis Normal","Requis","TechOps",0,null,"4","4.2","4.2.1","","4.2.1.2","COPIAS DE RESPALDO\nLos proveedores deben implementar un proceso de copias de respaldo del sistema del dinero móvil, que determine: \n- el tipo de datos que se debe respaldar;\n- la frecuencia de las copias de respaldo;\n- el mecanismo para realizar las copias de respaldo;\n- el almacenamiento de las copias de respaldo;\n- el período de retención de datos.\n\nLas copias de respaldo del sistema del dinero móvil y de todos los datos financieros se deben realizar de acuerdo con la política, al menos, una vez al día. \nLas copias de respaldo de los datos financieros se deben replicar en el sitio de Recuperación ante Desastres.\n\nLas copias de respaldo deben ser almacenadas de forma segura fuera del sitio (por ej., en un centro de datos secundario o en una instalación de almacenamiento comercial) y deben ser eliminadas de forma segura una vez transcurrido el período de retención. \n\nSe debe implementar y probar un proceso de recuperación de datos respaldados.",{"$f":"BB21","v":"PCI DSS, ISO 27002:2013 Sec. 12.3 "},{"$f":"$BC21","v":"4.2.1.2.1"},"¿Se ha documentado un proceso de copias de respaldo del sistema del dinero móvil que determine el tipo de datos que se debe respaldar, la frecuencia de las copias de respaldo y el período de retención de datos?","1) Documentación del proceso de copias de respaldo\n- Verificar que el proceso de copias de respaldo haya sido documentado\n- Verificar que el documento detalle lo siguiente:\n     a) El tipo de datos que se debe respaldar,\n     b) La frecuencia de las copias de respaldo, \n     c) El período de retención de datos.",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"4","4.2","4.2.1",null,{"$f":"$AZ21","v":"4.2.1.2"},null,{"$f":"BB21","v":"PCI DSS, ISO 27002:2013 Sec. 12.3 "},{"$f":"$BC21","v":"4.2.1.2.1"},null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.5.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",{"$f":"COUNTIF($DS21:$DV21,EH$3)","v":0},0,0,0,0,1,""]
[null,"4","4.2","4.2.1","","4.2.1.2",null,0,"4.2.1.2.2","4.2.1.2.2: Is the mobile money system and all financial data backed up at least daily?\n","1) Backup process documentation or backup logs\n- Check that the frequency of backup of the mobile money system is at least daily\n- Check that the backup includes all financial data",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.2","4.2.1","","4.2.1.2",null,null,"4.2.1.2.2",{"$f":"DO22","v":"5.3.5.2.2"},"Is the mobile money system and all financial data backed up at least daily?","1) Backup process documentation or backup logs\n- Check that the frequency of backup of the mobile money system is at least daily\n- Check that the backup includes all financial data",null,"Urgent Required","Required","TechOps",null,null,"4","4.2","4.2.1","",{"$f":"$AZ22","v":"4.2.1.2"},0,0,"4.2.1.2.2","le système de l’argent mobile et l'ensemble des données financières font-ils l'objet d'une sauvegarde au minimum journalière ?","1) Documentation du processus de sauvegarde ou registres de sauvegarde\n- Vérifier que le système de l’argent mobile fait l’objet d’une sauvegarde au minimum journalière\n- Vérifier que la sauvegarde inclut l’ensemble des données financières",null,"Requis Prioritaire","Requis","TechOps",0,null,"4","4.2","4.2.1","","4.2.1.2",null,{"$f":"BB22","v":0},{"$f":"$BC22","v":"4.2.1.2.2"},"¿Se realiza una copia de respaldo del sistema del dinero móvil y de todos los datos financieros al menos una vez al día?","1) Documentación del proceso de copias de respaldo o registros de copias de respaldo\n- Verificar que la frecuencia de las copias de respaldo del sistema del dinero móvil sea, al menos, una vez al día\n- Verificar que la copia de respaldo incluya todos los datos financieros  \n",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"4","4.2","4.2.1",null,{"$f":"$AZ22","v":"4.2.1.2"},null,{"$f":"BB22","v":0},{"$f":"$BC22","v":"4.2.1.2.2"},null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.5.2.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.2","4.2.1","","4.2.1.2",null,0,"4.2.1.2.3","4.2.1.2.3: Are backups stored securely offsite (e.g. at a second data centre or a commercial storage facility)?\n","1) Backup process documentation\n- Check that the storage of backup data for the mobile money system is secure and offsite.",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.2","4.2.1","","4.2.1.2",null,null,"4.2.1.2.3",{"$f":"DO23","v":"5.3.5.2.3"},"Are backups stored securely offsite (e.g. at a second data centre or a commercial storage facility)?","1) Backup process documentation\n- Check that the storage of backup data for the mobile money system is secure and offsite.",null,"Urgent Required","Required","TechOps",null,null,"4","4.2","4.2.1","",{"$f":"$AZ23","v":"4.2.1.2"},0,0,"4.2.1.2.3","les sauvegardes sont-elles conservées hors site de manière sécurisée (par exemple dans un autre centre de données ou sur un site de stockage commercial) ?","1) Documentation du processus de sauvegarde\n- Vérifier que les données de sauvegarde pour le système d’argent mobile sont conservées hors site en toute sécurité.",null,"Requis Prioritaire","Requis","TechOps",0,null,"4","4.2","4.2.1","","4.2.1.2",null,{"$f":"BB23","v":0},{"$f":"$BC23","v":"4.2.1.2.3"},"¿Las copias de respaldo son almacenadas de forma segura fuera del sitio (por ej., en un centro de datos secundario o en una instalación de almacenamiento comercial)? ","1) Documentación del proceso de copias de respaldo\n- Verificar que el almacenamiento de los datos de respaldo del sistema del dinero móvil sea seguro y fuera del sitio ",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"4","4.2","4.2.1",null,{"$f":"$AZ23","v":"4.2.1.2"},null,{"$f":"BB23","v":0},{"$f":"$BC23","v":"4.2.1.2.3"},null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.5.2.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.2","4.2.1","","4.2.1.2",null,0,"4.2.1.2.4","4.2.1.2.4: Has a process for restoring backed-up data been implemented and tested?\n","1) Backup process documentation\n- Check there is process to restore backed-up data\n\n2) Backup test logs\n- Check that the restoration process has been tested\n",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.2","4.2.1","","4.2.1.2",null,null,"4.2.1.2.4",{"$f":"DO24","v":"5.3.5.2.4"},"Has a process for restoring backed-up data been implemented and tested?","1) Backup process documentation\n- Check there is process to restore backed-up data\n\n2) Backup test logs\n- Check that the restoration process has been tested\n",null,"Standard Required","Required","TechOps",null,null,"4","4.2","4.2.1","",{"$f":"$AZ24","v":"4.2.1.2"},0,0,"4.2.1.2.4","un processus de récupération des données sauvegardées a-t-il été mis en place et testé ?","1) Documentation du processus de sauvegarde\n- Vérifier qu’un processus de récupération des données sauvegardées a été mis en place \n\n2) Registres de test de sauvegarde\n- Vérifier que le processus de récupération été testé\n\n",null,"Requis Normal","Requis","TechOps",0,null,"4","4.2","4.2.1","","4.2.1.2",null,{"$f":"BB24","v":0},{"$f":"$BC24","v":"4.2.1.2.4"},"¿Se implementó y probó un proceso de recuperación de datos respaldados?","1) Documentación del proceso de copias de respaldo\n- Verificar si existe un proceso para recuperar datos respaldados\n\n2) Registros de prueba de copias de respaldo\n- Verificar que se haya probado el proceso de recuperación",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"4","4.2","4.2.1",null,{"$f":"$AZ24","v":"4.2.1.2"},null,{"$f":"BB24","v":0},{"$f":"$BC24","v":"4.2.1.2.4"},null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.5.2.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.2","4.2.1","","4.2.1.3",null,"ISO 20000-1:2018 Sec 6.3","4.2.1.3.1","4.2.1.3.1: Are service levels defined for the mobile money system for availability and incident response/resolution times?\n","1) Service level definition for technical functions\n- Check there are clearly defined service levels for the mobile money system\n- Check the service levels include:\na) Availability \nb) Incident response/resolution times\n",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.2","4.2.1","","4.2.1.3","TECHNICAL SERVICE LEVEL MANAGEMENT\nService levels should be defined for the mobile money system. Service levels should specify:\n - Performance (such transations/second, response time by channel,  and batch processing speed);\n - Availability of the system/service;\n - Incident response / resolution times, including the period of operational support (see 4.4 for incident management). \n\nTechnical service level targets should be updated when changes are made to the mobile money service / system.\n\nEnd-to-end monitoring should be implemented to monitor the system against its service level targets for availabilitiy and performance. Service level reports should be produced for the technical operations manager and the head of mobile money.\n\nA catalogue should be maintained of technical components within the mobile money system and their dependencies. Service level targets should be set for each component. The overall mobile money system SLA should be aligned with the SLAs for the individual technical components, as it is dependent upon them. Monitoring of the service levels should be implemented on each component.  ","ISO 20000-1:2018 Sec 6.3","4.2.1.3.1","4.2.1.3.1","Are service levels defined for the mobile money system for availability and incident response/resolution times?","1) Service level definition for technical functions\n- Check there are clearly defined service levels for the mobile money system\n- Check the service levels include:\na) Availability \nb) Incident response/resolution times\n",null,"Urgent Required","Required","TechOps",null,null,"4","4.2","4.2.1","","4.2.1.3","GESTION DU NIVEAU DE SERVICE TECHNIQUE\nDes niveaux de service doivent être définis pour le système de l’argent mobile. Ces niveaux de service doivent spécifier :\n - performance (par ex. transactions/seconde, temps de réponse par canal, vitesse de traitement par lot) ;\n - disponibilité du système/service ;\n - délais de réponse aux incidents/résolution, y compris les horaires de support opérationnel (cf. 4.4 pour la gestion des incidents). \n\nLes niveaux de service techniques visés doivent être actualisés en cas de changement dans le service / système de l’argent mobile.\n\nUne surveillance de bout en bout doit être mise en place pour s'assurer que le système respecte les niveaux de service visés en matière de disponibilité et de performance. Des rapports sur les niveaux de service doivent être rédigés à l'attention du responsable des opérations techniques et du directeur de l’argent mobile.\n\nUn catalogue des composantes techniques du système de l’argent mobile et de leurs liens de dépendance doit être tenu à jour. Des objectifs de niveau de service doivent être définis pour chacune d’elles. La convention de niveau service global du système de l’argent mobile doit être alignée sur les conventions de niveau de service de chaque composante technique du système, car elle dépend de ces dernières. Chaque composante du système doit faire l’objet d’une surveillance des niveaux de service.  ","ISO 20000-1:2018 Sec 6.3","4.2.1.3.1","des niveaux de service sont-ils définis pour le système de l’argent mobile en matière de disponibilité et de délais de réponse et résolution des incidents ?","1) Rapports de niveaux de service pour les fonctions techniques\n- Vérifier que des niveaux de service sont clairement définis pour le système d’argent mobile\n- Vérifier que les niveaux de service incluent :\n    a) La disponibilité;\n    b) Les délais de réponse/de résolution des incidents\n",null,"Requis Prioritaire","Requis","TechOps",0,null,"4","4.2","4.2.1","","4.2.1.3","GESTIÓN DE NIVELES DE SERVICIO TÉCNICO\nSe deben definir niveles de servicio para el sistema del dinero móvil. Los niveles de servicio deben especificar:\n - Rendimiento (tal como, transacciones/segundo, tiempo de respuesta por canal y velocidad de procesamiento por lotes);\n - Disponibilidad del sistema/servicio;\n - Respuesta ante incidentes / tiempos de resolución, incluyendo el período de soporte operativo (ver 4.4 para gestión de incidentes). \n\nSe deben actualizar los objetivos de nivel de servicio técnico cuando se realizan cambios al servicio / sistema del dinero móvil.\n\nSe debe implementar el monitoreo punta a punta para monitorear el sistema en base a los objetivos de nivel de servicio para disponibilidad y rendimiento. Se deben generar informes de nivel de servicio para el gerente de operaciones técnicas y el jefe del dinero móvil.\n\nSe debe mantener un catálogo de componentes técnicos dentro del sistema del dinero móvil y sus dependencias. Se deben establecer objetivos de nivel de servicio para cada componente. El SLA del sistema del dinero móvil en general debe estar alineado con los SLA para los componentes técnicos individuales, ya que depende de ellos. Se debe implementar el monitoreo de los niveles de servicio de cada componente.  ","ISO 20000-1:2018 Sec 6.3","4.2.1.3.1","¿Se definieron niveles de servicio para el sistema del dinero móvil en lo que respecta a su disponibilidad y respuesta ante incidentes/tiempos de resolución?","1) Definición de informes de nivel de servicio para las funciones técnicas\n- Verificar que existan niveles de servicio claramente definidos para el sistema del dinero móvil\n- Verificar que los niveles de servicio incluyan:\na) Disponibilidad \nb) Respuesta ante incidentes/tiempos de resolución    \n",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"4","4.2","4.2.1",null,"4.2.1.3",null,"ISO 20000-1:2018 Sec 6.3","4.2.1.3.1",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"4.2.1.3.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.2","4.2.1","","4.2.1.3",null,0,"4.2.1.3.2","4.2.1.3.2: Is the availability of the mobile money system being monitored and reported against the service level?\n","1) Service level reports for technical functions\n- Check that the availability of the mobile money system is monitored against the service level and reports generated.",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.2","4.2.1","","4.2.1.3",null,null,"4.2.1.3.2","4.2.1.3.2","Is the availability of the mobile money system being monitored and reported against the service level?","1) Service level reports for technical functions\n- Check that the availability of the mobile money system is monitored against the service level and reports generated.",null,"Urgent Required","Required","TechOps",null,null,"4","4.2","4.2.1","","4.2.1.3",0,0,"4.2.1.3.2","la disponibilité du système de l’argent mobile fait-elle l’objet d’une surveillance et de rapports afin de s'assurer de sa conformité avec le niveau de service défini ?","1) Rapports de niveaux de service pour les fonctions techniques\n- Vérifier que la disponibilité du système de l'argent mobile fait l'objet d'une surveillance afin de s'assurer de sa conformité avec le niveau de service défini et que des rapports sont générés à cet effet.",null,"Requis Prioritaire","Requis","TechOps",0,null,"4","4.2","4.2.1","","4.2.1.3",null,0,"4.2.1.3.2","¿Se monitorea e informa la disponibilidad del sistema del dinero móvil respecto del nivel de servicio?","1) Informes de nivel de servicio para las funciones técnicas\n- Verificar que se monitorea la disponibilidad del sistema del dinero móvil respecto del nivel de servicio y se generan informes.",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"4","4.2","4.2.1",null,"4.2.1.3",null,0,"4.2.1.3.2",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"4.2.1.3.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.2","4.2.1","","4.2.1.3",null,null,"4.2.1.3.3","4.2.1.3.3: Are incident management reports being produced regularly to indicate whether service level targets are being met?\n","1) Service level reports for technical functions\n- Check that incident management reports are being produced regularly to indicate whether service level targets are being met.",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.2","4.2.1","","4.2.1.3",null,null,"4.2.1.3.3",{"$f":"DO27","v":"4.2.1.5.1"},"Are incident management reports being produced regularly to indicate whether service level targets are being met?","1) Service level reports for technical functions\n- Check that incident management reports are being produced regularly to indicate whether service level targets are being met.",null,"Urgent Required","Required","TechOps",null,null,"4","4.2","4.2.1","","4.2.1.3",null,null,"4.2.1.3.3","des rapports de service relatifs à la gestion des incidents sont-ils établis à intervalles réguliers pour vérifier que les niveaux de service visés sont respectés ?","1) Rapports de niveaux de service pour les fonctions techniques\n- Vérifier que des rapports de service relatifs à la gestion des incidents sont établis à intervalles réguliers pour vérifier que les niveaux de service visés sont respectés.",null,"Requis Prioritaire","Requis","TechOps",0,null,"4","4.2","4.2.1","","4.2.1.3",null,null,"4.2.1.3.3","¿Se generan periódicamente informes de servicio para los niveles de servicio técnico relativos a la gestión de incidentes para indicar si se cumplen los objetivos de nivel de servicio? ","1) Informes de nivel de servicio para las funciones técnicas\n- Verificar que se generan periódicamente informes de servicio relativos a la gestión de incidentes para indicar si se cumplen los objetivos de nivel de servicio.",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"4","4.2","4.2.1",null,"4.2.1.3",null,null,"4.2.1.3.3",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"4.2.1.5.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.2","4.2.1","","4.2.1.3",null,{"$f":"BB28","v":0},"4.2.1.3.4","4.2.1.3.4: Is the performance of the mobile money system being monitored against its service levels (via end-to-end monitoring) and reported?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.2","4.2.1","","4.2.1.3",null,null,"4.2.1.3.4","4.2.1.3.3","Is the performance of the mobile money system being monitored against its service levels (via end-to-end monitoring) and reported?",null,null,"Recommended","Recommended","TechOps",null,null,"4","4.2","4.2.1","","4.2.1.3",0,0,"4.2.1.3.4","une surveillance de bout en bout est-elle mise en œuvre pour surveiller la performance du système de l’argent mobile par rapport à ses objectifs de niveau de service ?",null,null,"Recommandé","Recommandé","TechOps",0,null,"4","4.2","4.2.1","","4.2.1.3",null,0,"4.2.1.3.4","¿El rendimiento del sistema del dinero móvil está siendo monitoreado en base a los niveles de servicio (mediante monitoreo punta a punta) e informado?",null,null,"Recomendado","Recomendado","TechOps",null,null,"4","4.2","4.2.1",null,"4.2.1.3",null,0,"4.2.1.3.4",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.2.1.3.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.2","4.2.1","","4.2.1.3",null,0,"4.2.1.3.5","4.2.1.3.5: Are service levels set and monitored for each technical component of the mobile money system?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.2","4.2.1","","4.2.1.3",null,null,"4.2.1.3.5","4.2.1.3.4","Are service levels set and monitored for each technical component of the mobile money system?",null,null,"Recommended","Recommended","TechOps",null,null,"4","4.2","4.2.1","","4.2.1.3",0,0,"4.2.1.3.5","des niveaux de services sont-ils définis et surveillés pour chaque composante technique du système de l’argent mobile ?",null,null,"Recommandé","Recommandé","TechOps",0,null,"4","4.2","4.2.1","","4.2.1.3",null,0,"4.2.1.3.5","¿Se establecieron y se monitorean los niveles de servicio para cada componente técnico del sistema del dinero móvil?",null,null,"Recomendado","Recomendado","TechOps",null,null,"4","4.2","4.2.1",null,"4.2.1.3",null,0,"4.2.1.3.5",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.2.1.3.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.2","4.2.1","","4.2.1.3",null,0,"4.2.1.3.6","4.2.1.3.6: Are technical service level targets updated when changes are made to the mobile money service / system?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.2","4.2.1","","4.2.1.3",null,null,"4.2.1.3.6","4.2.1.3.5","Are technical service level targets updated when changes are made to the mobile money service / system?",null,null,"Recommended","Recommended","TechOps",null,null,"4","4.2","4.2.1","","4.2.1.3",0,0,"4.2.1.3.6","les niveaux de service techniques visés sont-ils actualisés lorsque des changements sont effectués dans le service / système de l’argent mobile ?",null,null,"Recommandé","Recommandé","TechOps",0,null,"4","4.2","4.2.1","","4.2.1.3",null,0,"4.2.1.3.6","¿Se actualizan los objetivos de nivel de servicio técnico cuando se realizan cambios al servicio / sistema del dinero móvil?",null,null,"Recomendado","Recomendado","TechOps",null,null,"4","4.2","4.2.1",null,"4.2.1.3",null,0,"4.2.1.3.6",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.2.1.3.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.2","4.2.1","","4.2.1.4",{"$f":"AZ31&\": \"&CHOOSE(LanguageNumber,BA31,BR31,CH31,CX31)","v":"4.2.1.4: SYSTEM MONITORING\nThe mobile money system components should be monitored using a centralized monitoring system, and alerts should be raised in case of problems or failures. Alerts should result in incidents or problems being raised (see 4.4).\n"},"PCI DSS, ISO 27002: 2013 Sec. 12.4 ","4.2.1.4.1","4.2.1.4.1: Are all mobile money system components monitored, and are alerts raised in case of problems or failures?\n","1) Monitoring and alerting system logs or specification\n- Check that there is a monitoring / alerting system to monitor log files of all components of the mobile money system.\n- Check that the monitoring system raises alerts in case of problems or failures.",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.2","4.2.1","","4.2.1.4","SYSTEM MONITORING\nThe mobile money system components should be monitored using a centralized monitoring system, and alerts should be raised in case of problems or failures. Alerts should result in incidents or problems being raised (see 4.4).\n","PCI DSS, ISO 27002: 2013 Sec. 12.4 ","4.2.1.4.1",{"$f":"DO31","v":"5.3.6.5.1"},"Are all mobile money system components monitored, and are alerts raised in case of problems or failures?","1) Monitoring and alerting system logs or specification\n- Check that there is a monitoring / alerting system to monitor log files of all components of the mobile money system.\n- Check that the monitoring system raises alerts in case of problems or failures.",null,"Urgent Required","Required","TechOps",null,null,"4","4.2","4.2.1","",{"$f":"$AZ31","v":"4.2.1.4"},"SURVEILLANCE DU SYSTÈME\nLes journaux de chaque composant du système de l’argent mobile doivent être surveillés et des signaux d’alerte doivent être activés en cas de problème ou de défaillance. Ces signaux d’alerte doivent donner lieu à des incidents ou problèmes à traiter (cf. 4.4).",{"$f":"BB31","v":"PCI DSS, ISO 27002: 2013 Sec. 12.4 "},{"$f":"BC31","v":"4.2.1.4.1"},"Toutes les composantes du système de l’argent mobile sont-elles surveillées, et des alertes sont-elles émises en cas de problème ou de défaillance ?","1) Registres ou spécification du système relatifs au suivi et aux alertes\n- Vérifier qu'un système de suivi/d'alerte a été mis en place afin d'assurer le suivi des registres de l'ensemble des composants du système de l'argent mobile.\n- Vérifier que des signaux d’alerte sont transmis par le système de suivi en cas de problème ou de défaillance.\n\n\n\n\n",null,"Requis Prioritaire","Requis","TechOps",0,null,"4","4.2","4.2.1","","4.2.1.4","MONITOREO DEL SISTEMA\nLos componentes del sistema del dinero móvil se deben monitorear utilizando un sistema de monitoreo centralizado y se deben disparar alertas en caso de problemas o fallas. Las alertas deben resultar en la generación de incidentes o problemas (ver 4.4).\n",{"$f":"BB31","v":"PCI DSS, ISO 27002: 2013 Sec. 12.4 "},{"$f":"$BC31","v":"4.2.1.4.1"},"¿Se monitorean los componentes del sistema del dinero móvil y se disparan alertas en caso de problemas o fallas?","1) Registros del sistema de monitoreo y alertas \n- Verificar que exista un sistema de monitoreo / alertas  para monitorear los archivos de registro de todos los componentes del sistema del dinero móvil\n- Verificar que el sistema de monitoreo dispare alertas en caso de problemas o fallas.\n\n\n\n\n",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"4","4.2","4.2.1",null,{"$f":"$AZ31","v":"4.2.1.4"},null,{"$f":"BB31","v":"PCI DSS, ISO 27002: 2013 Sec. 12.4 "},{"$f":"$BC31","v":"4.2.1.4.1"},null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.6.5.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.2","4.2.1","","4.2.1.5","4.2.1.5: TIME SYNCHRONIZATION\nProviders should use up-to-date time-synchronization technology to synchronize all mobile money system clocks.","PCI DSS, ISO 27002: 2013 Sec. 12.4 ","4.2.1.5.1","4.2.1.5.1: Is up-to-date time-synchronization technology used to synchronize all mobile money system clocks?\n","1) System architecture specification \n- Check that there is a system for synchronisation of all mobile money system clocks (e.g. NTP server).",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.2","4.2.1","","4.2.1.5","TIME SYNCHRONIZATION\nProviders should use up-to-date time-synchronization technology to synchronize all mobile money system clocks.","PCI DSS, ISO 27002: 2013 Sec. 12.4 ","4.2.1.5.1",{"$f":"DO32","v":"5.3.6.4.1"},"Is up-to-date time-synchronization technology used to synchronize all mobile money system clocks?","1) System architecture specification \n- Check that there is a system for synchronisation of all mobile money system clocks (e.g. NTP server).",null,"Standard Required","Required","TechOps",null,null,"4","4.2","4.2.1","",{"$f":"$AZ32","v":"4.2.1.5"},"SYNCHRONISATION TEMPORELLE\nLes prestataires doivent utiliser une technologie de synchronisation temporelle moderne et à jour pour la synchronisation de l’ensemble des horloges du système de l’argent mobile. ",{"$f":"BB32","v":"PCI DSS, ISO 27002: 2013 Sec. 12.4 "},{"$f":"BC32","v":"4.2.1.5.1"},"une technologie de synchronisation temporelle moderne et à jour est-elle utilisé pour la synchronisation de l’ensemble des horloges du système de l’argent mobile ?","1) Spécification de l'architecture du système\n- Vérifier qu’un système a été mis en place pour synchroniser l’ensemble des horloges du système de l’argent mobile (par exemple serveur NTP).",null,"Requis Normal","Requis","TechOps",0,null,"4","4.2","4.2.1","","4.2.1.5","SINCRONIZACIÓN HORARIA\nLos proveedores deben utilizar tecnología de sincronización horaria actualizada para sincronizar todos los relojes del sistema del dinero móvil.",{"$f":"BB32","v":"PCI DSS, ISO 27002: 2013 Sec. 12.4 "},{"$f":"$BC32","v":"4.2.1.5.1"},"¿Se utiliza tecnología de sincronización horaria actualizada para sincronizar todos los relojes del sistema de dinero móvil?","1) Especificación de la arquitectura del sistema \n- Verificar que exista un sistema para la sincronización de todos los relojes del sistema de dinero móvil (por ej., servidor NTP).",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"4","4.2","4.2.1",null,{"$f":"$AZ32","v":"4.2.1.5"},null,{"$f":"BB32","v":"PCI DSS, ISO 27002: 2013 Sec. 12.4 "},{"$f":"$BC32","v":"4.2.1.5.1"},null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.6.4.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.2","4.2.1","4.2.2: Providers and partners should manage business operations and service levels","4.2.2.1","4.2.2.1: BUSINESS OPERATIONS\nThe business operations of mobile money should be organized and documented. Documentation of the business operations should include:\n -  Product definition documentation – describing mobile money features, functions, fees, customer transactions, etc.;\n -  Business function chart – which defines the roles of all the business functions (customer support, back-office operations, technical operations, financial operations, product management, etc.);\n -  Organization chart for the mobile money business.\n -  Business process definitions (i.e. standard operating procedures) for each back-office business function shown on the business function chart (i.e. functions such as agent / partner management, and product / service / channel management).","ISO 20000-1:2018 Sec 6.3","4.2.2.1.1","4.2.2.1.1: Has product definition documentation been developed that describes mobile money services, features and fees?\n","1) Commercial product catalogue\n- Check the commercial product catalogue describes the following aspects of the mobile money service:\n     a) Details of services and functions\n     b) Fees for each service",0,"Urgent Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.2","4.2.1","4.2.2: Providers and partners should manage business operations and service levels","4.2.2.1","BUSINESS OPERATIONS\nThe business operations of mobile money should be organized and documented. Documentation of the business operations should include:\n -  Product definition documentation – describing mobile money features, functions, fees, customer transactions, etc.;\n -  Business function chart – which defines the roles of all the business functions (customer support, back-office operations, technical operations, financial operations, product management, etc.);\n -  Organization chart for the mobile money business.\n -  Business process definitions (i.e. standard operating procedures) for each back-office business function shown on the business function chart (i.e. functions such as agent / partner management, and product / service / channel management).","ISO 20000-1:2018 Sec 6.3","4.2.2.1.1",{"$f":"DO33","v":"4.2.1.2.1"},"Has product definition documentation been developed that describes mobile money services, features and fees?","1) Commercial product catalogue\n- Check the commercial product catalogue describes the following aspects of the mobile money service:\n     a) Details of services and functions\n     b) Fees for each service",null,"Urgent Required","Required","BizOps",null,null,"4","4.2","4.2.1","4.2.2: Prestataires et partenaires doivent gérer les opérations commerciales et les niveaux de service",{"$f":"$AZ33","v":"4.2.2.1"},"EXPLOITATION\nLe fonctionnement de l’activité d’argent mobile doit être organisé et documenté. Cette documentation doit couvrir :\n -  la définition des produits, décrivant entre autres les caractéristiques, fonctionnalités, tarifs, transactions de l’argent mobile ;\n -  tableau des fonctions opérationnelles, définissant le rôle de chaque fonction de l’activité (support client, opérations de back-office, opérations techniques, opérations financières, gestion des produits, etc.) ;\n -  organigramme de l’activité d’argent mobile.\n - définition de processus d’entreprise (c.a.d. procédures d’exploitation normalisées) pour chaque fonction de back-office figurant sur le tableau des fonctions opérationnelles (c.a.d. fonctions telles que responsable des agents / des partenaires, et responsable produit / service / canal).",{"$f":"$BB33","v":"ISO 20000-1:2018 Sec 6.3"},{"$f":"$BC33","v":"4.2.2.1.1"},"la définition des produits est-elle documentée pour décrire entre autres les caractéristiques, fonctionnalités, tarifs, transactions de l’argent mobile ?","1) Catalogue des produits commerciaux\n- Vérifier que le catalogue des produits commerciaux définit les éléments suivants en ce qui concerne l’argent mobile :\na) Fonctionnalités\nb) Fonctions\nc) Tarifs\n",null,"Requis Prioritaire","Requis","BizOps",0,null,"4","4.2","4.2.1","4.2.2: Los proveedores y los socios deben gestionar las operaciones del negocio y los niveles de servicio","4.2.2.1","OPERACIONES DEL NEGOCIO\nSe deben organizar y documentar las operaciones del negocio del dinero móvil. La documentación de las operaciones del negocio debe incluir:\n -  Documentación de definición del producto – que describa las prestaciones del dinero móvil, sus funciones, tarifas y transacciones del cliente, etc.;\n -  Cuadro de funciones del negocio – que defina los roles de todas las funciones del negocio (soporte al cliente, operaciones del back-office, operaciones técnicas, operaciones financieras, administración de productos, etc.);\n -  Organigrama del negocio del dinero móvil.\n -  Definiciones de los procesos del negocio (es decir, procedimientos operativos estándar) para cada función del back-office del negocio incluida en el cuadro de funciones del negocio (es decir, funciones tales como gestión de agentes / socios, y gestión de productos / servicios / canales).",{"$f":"$BB33","v":"ISO 20000-1:2018 Sec 6.3"},{"$f":"$BC33","v":"4.2.2.1.1"},"¿Se desarrolló la documentación de definición del producto que describa las prestaciones del dinero móvil, sus funciones, tarifas y transacciones del cliente, etc.?","1) Catálogo comercial del producto\n- Verificar que el catálogo comercial del producto describa los siguientes aspectos del servicio del dinero móvil:\n     a) Prestaciones\n     b) Funciones\n     c) Tarifas",null,"Obligatorio urgente","Obligatorio","BizOps",null,null,"4","4.2","4.2.1","4.2.2:",{"$f":"$AZ33","v":"4.2.2.1"},null,{"$f":"$BB33","v":"ISO 20000-1:2018 Sec 6.3"},{"$f":"$BC33","v":"4.2.2.1.1"},null,null,null,"ReqU4","Req4","BizOps",null,null,null,null,null,null,null,null,"4.2.1.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.2","4.2.1",null,"4.2.2.1",null,0,"4.2.2.1.2","4.2.2.1.2: Have business processes (standard operating procedures) been documented for each back-office business function?\n(i.e. functions such as agent / partner management, and product / service / channel management)\n\n[Note that this indicator is requesting process documentation for functions other than customer operations (principle 7), financial operations (principle 1), AML/CFT (principle 2), and technical operations (4.2.1.1).]\n","1) Business processes (standard operating procedures) and Business function chart\n- Check that there are business processes for each back-office business function shown on the business function chart (i.e. functions such as agent / partner management, and product / service / channel management).",0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.2","4.2.1",null,"4.2.2.1",null,null,"4.2.2.1.2",{"$f":"DO34","v":"4.2.1.2.3"},"Have business processes (standard operating procedures) been documented for each back-office business function?\n(i.e. functions such as agent / partner management, and product / service / channel management)\n\n[Note that this indicator is requesting process documentation for functions other than customer operations (principle 7), financial operations (principle 1), AML/CFT (principle 2), and technical operations (4.2.1.1).]","1) Business processes (standard operating procedures) and Business function chart\n- Check that there are business processes for each back-office business function shown on the business function chart (i.e. functions such as agent / partner management, and product / service / channel management).",null,"Recommended","Recommended","BizOps",null,null,"4","4.2","4.2.1","",{"$f":"$AZ34","v":"4.2.2.1"},0,{"$f":"$BB34","v":0},{"$f":"$BC34","v":"4.2.2.1.2"},"les processus d’entreprise (également appelés procédures d'exploitation normalisées) sont-ils documentés pour chaque fonction de back-office ?\n(par ex. fonctions telles que responsable des agents / des partenaires, et responsable produit / service / canal)\n\n[Note : cet indicateur nécessite une documentation des processus pour les fonctions autres que les opérations client (principe 7), les opérations financières (principe 1), les opérations AML/CFT (principe 2) et les opérations techniques (4.2.1.1).]","1) Processus d’entreprise (procédures d’exploitation normalisées) et tableau des fonctions opérationnelles\n- Vérifier que des processus d’entreprise ont été mis en place pour chaque fonction d’entreprise de back-office apparaissant sur le tableau des fonctions opérationnelles (à savoir les fonctions telles que les fonctions de gestion des agents/des partenaires et de gestion des produits/services/canaux).",null,"Recommandé","Recommandé","BizOps",0,null,"4","4.2","4.2.1",null,"4.2.2.1",null,{"$f":"$BB34","v":0},{"$f":"$BC34","v":"4.2.2.1.2"},"¿Se documentaron los procesos del negocio (procedimientos operativos estándar) para cada función del back-office del negocio?\n(es decir, funciones tales como gestión de agentes / socios, y gestión de productos / servicios / canales)\n\n[Nótese que este indicador solicita la documentación de procesos para funciones distintas de las operaciones de clientes (principio 7), operaciones financieras (principio 1), ALA/CFT (principio 2) y operaciones técnicas (4.2.1.1).]","1) Procesos del negocio (procedimientos operativos estándar) y cuadro de funciones del negocio\n- Verificar que existan procesos del negocio para cada función del back-office del negocio incluida en el cuadro de funciones del negocio (es decir, funciones tales como gestión de agentes / socios, y gestión de productos / servicios / canales).",null,"Recomendado","Recomendado","BizOps",null,null,"4","4.2","4.2.1",null,{"$f":"$AZ34","v":"4.2.2.1"},null,{"$f":"$BB34","v":0},{"$f":"$BC34","v":"4.2.2.1.2"},null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"4.2.1.2.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.2","4.2.1",null,"4.2.2.1",null,null,"4.2.2.1.3","4.2.2.1.3: Has a business function chart (or similar document) been developed that defines the roles of all the business functions (customer support, back-office operations, technical operations, financial operations, product management, etc.)?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.2","4.2.1",null,"4.2.2.1",null,null,"4.2.2.1.3",{"$f":"DO35","v":"4.2.1.2.2"},"Has a business function chart (or similar document) been developed that defines the roles of all the business functions (customer support, back-office operations, technical operations, financial operations, product management, etc.)?",null,null,"Recommended","Recommended","BizOps",null,null,"4","4.2","4.2.1","",{"$f":"$AZ35","v":"4.2.2.1"},null,null,{"$f":"$BC35","v":"4.2.2.1.3"},"existe-t-il un tableau des fonctions opérationnelles (ou document équivalent), définissant le rôle de chaque fonction de l’activité (support client, opérations de back-office, opérations techniques, opérations financières, gestion des produits, etc.) ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"4","4.2","4.2.1",null,"4.2.2.1",null,null,{"$f":"$BC35","v":"4.2.2.1.3"},"¿Se desarrolló un cuadro de funciones del negocio (o documento similar) que defina los roles de todas las funciones del negocio (soporte al cliente, operaciones del back-office, operaciones técnicas, operaciones financieras, administración de productos, etc.)?",null,null,"Recomendado","Recomendado","BizOps",null,null,"4","4.2","4.2.1",null,{"$f":"$AZ35","v":"4.2.2.1"},null,null,{"$f":"$BC35","v":"4.2.2.1.3"},null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"4.2.1.2.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.2","4.2.1",{"$f":"CHOOSE(LanguageNumber,AY36,BP36,CF36,CV36)","v":""},"4.2.2.2",{"$f":"AZ36&\": \"&CHOOSE(LanguageNumber,BA36,BR36,CH36,CX36)","v":"4.2.2.2: BUSINESS SERVICE LEVEL MANAGEMENT\nService levels should be defined for customer-facing business processes. Examples of such processes include:\n- Calls to customer service (response time);\n- Processing reversals (time to complete the reversal); \n- Registration (time to activate account);\n- Reconciliation and settlement (time to complete).\n\nMonitoring should be implemented for each customer-facing business process against their service level targets, and reports generated for the relevant functional managers and the head of mobile money.\n\nBusiness process service level targets should be updated when changes are made to the mobile money service."},{"$f":"BB36","v":"ISO 20000-1:2011 Sec. 6.1"},"4.2.2.2.1","4.2.2.2.1: Have service levels been defined for all customer-facing business processes (e.g. response time for calls to customer service, completion time for reversals, and time to complete account activation)?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.2","4.2.1","","4.2.2.2","BUSINESS SERVICE LEVEL MANAGEMENT\nService levels should be defined for customer-facing business processes. Examples of such processes include:\n- Calls to customer service (response time);\n- Processing reversals (time to complete the reversal); \n- Registration (time to activate account);\n- Reconciliation and settlement (time to complete).\n\nMonitoring should be implemented for each customer-facing business process against their service level targets, and reports generated for the relevant functional managers and the head of mobile money.\n\nBusiness process service level targets should be updated when changes are made to the mobile money service.","ISO 20000-1:2011 Sec. 6.1","4.2.2.2.1","4.2.1.4.1","Have service levels been defined for all customer-facing business processes (e.g. response time for calls to customer service, completion time for reversals, and time to complete account activation)?",null,null,"Recommended","Recommended","BizOps",null,null,"4","4.2","4.2.1","","4.2.2.2","GESTION DES NIVEAUX DE SERVICE - FONCTIONS COMMERCIALES\nDes niveaux de service doivent être définis pour les processus commerciaux concernant les clients. Ces processus comprennent par exemple : \n- les appels à destination du service client (temps du réponse) ;\n- l’annulation d’opérations (délai de réalisation de l’annulation) ;  \n- l’enregistrement (délai d’activation du compte) ;\n- le rapprochement et le règlement (délai de réalisation).\n\nUne surveillance doit être mise en place pour chaque processus commercial de façon à veiller à ce que les processus respectent les niveaux de service visés. \n\nLes objectifs de niveau de service commercial doivent être actualisés lorsque des changements sont apportés au service d’argent mobile.","ISO 20000-1:2011 Sec. 6.1","4.2.2.2.1","des niveaux de service sont-ils définis pour tous les processus commerciaux concernant les clients (ex. temps de réponse aux appels destinés au service client, délai de réalisation des annulations ou délai d’activation des comptes) ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"4","4.2","4.2.1","","4.2.2.2","GESTIÓN DE NIVELES DE SERVICIO DEL NEGOCIO\nSe deben definir niveles de servicio de los procesos del negocio de cara al cliente. Entre los ejemplos de estos procesos se incluyen:\n- Llamadas a atención al cliente (tiempo de respuesta);\n- Procesamiento de reversiones (tiempo para completar la reversión); \n- Registro (tiempo para activar la cuenta);\n- Conciliación y liquidación (tiempo para completar).\n\nSe debe implementar un monitoreo para cada proceso del negocio de cara al cliente en base a sus objetivos de nivel de servicio, y se deben generar informes para los gerentes de las funciones correspondientes y el jefe del dinero móvil.\n\nSe deben actualizar los objetivos de nivel de servicio de los procesos del negocio cuando se realizan cambios al servicio del dinero móvil.","ISO 20000-1:2011 Sec. 6.1","4.2.2.2.1","¿Se definieron niveles de servicio para todos los procesos del negocio de cara al cliente (por ej., tiempo de respuesta para llamadas a atención al cliente, tiempo para completar reversiones y tiempo para completar la activación de cuentas)?",null,null,"Recomendado","Recomendado","BizOps",null,null,"4","4.2","4.2.1",null,"4.2.2.2",null,"ISO 20000-1:2011 Sec. 6.1","4.2.2.2.1",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"4.2.1.4.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.2","4.2.1","","4.2.2.2",null,{"$f":"BB37","v":0},"4.2.2.2.2","4.2.2.2.2: Are customer-facing business processes monitored to track performance of the processes against the service level targets?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.2","4.2.1","","4.2.2.2",null,null,"4.2.2.2.2","4.2.1.4.2","Are customer-facing business processes monitored to track performance of the processes against the service level targets?",null,null,"Recommended","Recommended","BizOps",null,null,"4","4.2","4.2.1","","4.2.2.2",0,0,"4.2.2.2.2","les processus commerciaux liés aux clients sont-ils surveillés pour suivre la performance par rapport aux niveaux de service visés ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"4","4.2","4.2.1","","4.2.2.2",null,0,"4.2.2.2.2","¿Se monitorean los procesos del negocio de cara al cliente para realizar un seguimiento del rendimiento de los procesos en base a los objetivos de nivel de servicio?",null,null,"Recomendado","Recomendado","BizOps",null,null,"4","4.2","4.2.1",null,"4.2.2.2",null,0,"4.2.2.2.2",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"4.2.1.4.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.2","4.2.1","","4.2.2.2",null,null,"4.2.2.2.3","4.2.2.2.3: Are service reports being produced regularly for business process service levels to assess whether customer-facing business processes are meeting their service level targets?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.2","4.2.1","","4.2.2.2",null,null,"4.2.2.2.3","4.2.1.5.2","Are service reports being produced regularly for business process service levels to assess whether customer-facing business processes are meeting their service level targets?",null,null,"Recommended","Recommended","BizOps",null,null,"4","4.2","4.2.1","","4.2.2.2",null,null,"4.2.2.2.3","des rapports sur les niveaux de service commerciaux liés auc clients sont-ils établis à intervalles réguliers pour vérifier que les niveaux de service visés sont respectés ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"4","4.2","4.2.1","","4.2.2.2",null,null,"4.2.2.2.3","¿Se generan informes de los niveles de servicio de los procesos del negocio de forma periódica para evaluar si los procesos del negocio de cara al cliente cumplen sus objetivos de nivel de servicio?",null,null,"Recomendado","Recomendado","BizOps",null,null,"4","4.2","4.2.1",null,"4.2.2.2",null,null,"4.2.2.2.3",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"4.2.1.5.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.2","4.2.1","","4.2.2.2",null,{"$f":"BB39","v":0},"4.2.2.2.4","4.2.2.2.4: Are business process service level targets updated when changes are made to the mobile money service?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.2","4.2.1","","4.2.2.2",null,null,"4.2.2.2.4","4.2.1.4.3","Are business process service level targets updated when changes are made to the mobile money service?",null,null,"Recommended","Recommended","BizOps",null,null,"4","4.2","4.2.1","","4.2.2.2",0,0,"4.2.2.2.4","les objectifs de niveau de service commercial sont-ils actualisés lorsque des changements sont apportés au service d’argent mobile ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"4","4.2","4.2.1","","4.2.2.2",null,0,"4.2.2.2.4","¿Se actualizan los objetivos de nivel de servicio de los procesos del negocio cuando se realizan cambios al servicio del dinero móvil?",null,null,"Recomendado","Recomendado","BizOps",null,null,"4","4.2","4.2.1",null,"4.2.2.2",null,0,"4.2.2.2.4",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"4.2.1.4.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.2","4.2.1","","4.2.2.3",{"$f":"AZ40&\": \"&CHOOSE(LanguageNumber,BA40,BR40,CH40,CX40)","v":"4.2.2.3: MANAGEMENT REPORTING\nManagement reports should be produced regularly to report on the performance of the mobile money service. This should include volume-based reports and event-based reports.\n\nEvent-based service reports should contain relevant information about significant events including at least:\na) Incidents involving service disruption \nb) SLA breaches\nc) Deployment or new or changed services \n\nVolume-based service reports should include at least:\n- volume of mobile money customers (registered and active);\n- volume of transactions (by transaction type);\n- customer satisfaction measurements such as customer complaints.\n\nManagement reports should be communicated to all mobile money managers and the head of mobile money.\n"},null,{"$f":"BC40","v":"4.2.2.3.1"},"4.2.2.3.1: Are event-based management reports produced that contain relevant information about significant events, including (at minimum):\na) Incidents involving service disruption \nb) SLA breaches\nc) Deployment or new or changed services?\n","1) Management operational reports \n- Check that management operational reports are being produced and contain relevant information on service events:\na) Incidents involving service disruption \nb) SLA breaches\nc) Deployment or new or changed services \n\n",0,"Standard Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.2","4.2.1","","4.2.2.3","MANAGEMENT REPORTING\nManagement reports should be produced regularly to report on the performance of the mobile money service. This should include volume-based reports and event-based reports.\n\nEvent-based service reports should contain relevant information about significant events including at least:\na) Incidents involving service disruption \nb) SLA breaches\nc) Deployment or new or changed services \n\nVolume-based service reports should include at least:\n- volume of mobile money customers (registered and active);\n- volume of transactions (by transaction type);\n- customer satisfaction measurements such as customer complaints.\n\nManagement reports should be communicated to all mobile money managers and the head of mobile money.\n","ISO 20000-1:2018 Sec 9.3","4.2.2.3.1","4.2.1.6.2","Are event-based management reports produced that contain relevant information about significant events, including (at minimum):\na) Incidents involving service disruption \nb) SLA breaches\nc) Deployment or new or changed services?","1) Management operational reports \n- Check that management operational reports are being produced and contain relevant information on service events:\na) Incidents involving service disruption \nb) SLA breaches\nc) Deployment or new or changed services \n\n",null,"Standard Required","Required","BizOps",null,null,"4","4.2","4.2.1","","4.2.2.3","RAPPORTS DE GESTION\nDes rapports de gestion doivent être produits à intervalles réguliers pour mesurer la performance du service de l’argent mobile. Ils doivent comprendre des rapports sur les volumes et des rapports sur les événements.\n\nLes rapports de service sur les événements doivent contenir des informations utiles sur les événements significatifs, et notamment, au minimum :\na) les incidents ayant entraîné une interruption du service\nb) les cas de manquement aux stipulations des conventions de niveau de service\nc) le lancement de nouveaux services ou de services modifiés \n\nLes rapports de service sur les volumes doivent au minimum inclure :\n- le nombre de clients de l’argent mobile (enregistrés et actifs) ;\n- le nombre de transactions (par type de transaction) ;\n- des indicateurs de mesure de la satisfaction des clients (ex. nb de réclamation).\n\nCes rapports de gestion doivent être communiqués à tous les responsables de l’argent mobile ainsi qu’à la direction de l’argent mobile.\n",{"$f":"$BB40","v":"ISO 20000-1:2018 Sec 9.3"},"4.2.2.3.1","des rapports de gestion concernant les événements sont-ils établis avec des informations utiles sur les événements significatifs, répertoriant (au minimum) a) les incidents ayant entraîné une interruption du service\nb) les cas de manquement aux stipulations des conventions de niveau de service\nc) le lancement de nouveaux services ou de services modifiés ?","1) Rapports opérationnels de gestion \n- Vérifier que des rapports opérationnels de gestion sont établis et contiennent des informations utiles sur des évènements tels que :\na) les incidents ayant entraîné une interruption du service\nb) les cas de manquement aux stipulations des conventions de niveau de service\nc) le lancement de nouveaux services ou de services modifiés\n\n",null,"Requis Normal","Requis","BizOps",0,null,"4","4.2","4.2.1","","4.2.2.3","GENERACIÓN DE INFORMES DE GESTIÓN\nPeriódicamente se deben generar  informes de gestión para informar acerca del rendimiento del servicio del dinero móvil. Estos deben incluir informes basados en volúmenes e informes basados en eventos.\n\nLos informes del servicio basados en eventos deben contener información relevante sobre eventos significativos, incluyendo, como mínimo:\na) incidentes importantes que involucren la interrupción del servicio;\nb) violaciones a los SLA;\nc) implantación de servicios nuevos o modificados.\n\nLos informes del servicio basados en volúmenes deben incluir, al menos:\n- el volumen de clientes del dinero móvil (registrados y activos);\n- el volumen de transacciones (por tipo de transacción);\n- las mediciones de satisfacción del cliente, tales como reclamos de clientes.\n\nLos informes de gestión deben ser comunicados a todos los gerentes del dinero móvil y al jefe del dinero móvil.",{"$f":"$BB40","v":"ISO 20000-1:2018 Sec 9.3"},"4.2.2.3.1","¿Se generan informes de gestión basados en eventos con información relevante sobre eventos significativos, incluyendo (como mínimo)    \na)  incidentes que involucren la interrupción del servicio \nb) violaciones a los SLA\nc) implantación de servicios nuevos o modificados?","1) Informes operativos de gestión \n- Verificar que se generen los informes operativos de gestión que contengan información relevante sobre eventos del servicio:\na) Incidentes que involucren la interrupción del servicio\nb) Violaciones a los SLA\nc) Implantación de servicios nuevos o modificados\n",null,"Obligatorio estándar","Obligatorio","BizOps",null,null,"4","4.2","4.2.1",null,"4.2.2.3",null,{"$f":"$BB40","v":"ISO 20000-1:2018 Sec 9.3"},"4.2.2.3.1",null,null,null,"ReqS4","Req4","BizOps",null,null,null,null,null,null,null,null,"4.2.1.6.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.2","4.2.1","","4.2.2.3",null,{"$f":"BB40","v":"ISO 20000-1:2018 Sec 9.3"},{"$f":"BC41","v":"4.2.2.3.2"},"4.2.2.3.2: Are volume-based management reports produced regularly that detail (at minimum) the volume of mobile money customers (registered and active), transactions (by transaction type), and customer complaints?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.2","4.2.1","","4.2.2.3",null,null,"4.2.2.3.2",{"$f":"DO41","v":"4.2.1.6.1"},"Are volume-based management reports produced regularly that detail (at minimum) the volume of mobile money customers (registered and active), transactions (by transaction type), and customer complaints?",null,null,"Recommended","Recommended","BizOps",null,null,"4","4.2","4.2.1","","4.2.2.3",null,null,"4.2.2.3.2","des rapports de gestion concernant les volumes sont-ils produits à intervalles réguliers pour détailler (au minimum) le nombre de clients de l’argent mobile (enregistrés et actifs), le nombre de transactions (par type de transaction) et les réclamations de clients ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"4","4.2","4.2.1","","4.2.2.3",null,null,"4.2.2.3.2","¿Se generan periódicamente informes de gestión basados en volúmenes que detallan (como mínimo) el volumen de clientes del dinero móvil (registrados y activos), de transacciones (por tipo de transacción), y de reclamos de clientes?",null,null,"Recomendado","Recomendado","BizOps",null,null,"4","4.2","4.2.1",null,"4.2.2.3",null,null,"4.2.2.3.2",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"4.2.1.6.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.2","4.2.1","","4.2.2.3",null,{"$f":"BB42","v":0},"4.2.2.3.3","4.2.2.3.3: Are management reports being communicated to all mobile money managers and the head of mobile money?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.2","4.2.1","","4.2.2.3",null,null,"4.2.2.3.3","4.2.1.6.3","Are management reports being communicated to all mobile money managers and the head of mobile money?",null,null,"Recommended","Recommended","BizOps",null,null,"4","4.2","4.2.1","","4.2.2.3",null,null,"4.2.2.3.3","ces rapports de gestion sont-ils communiqués à tous les responsables de l’argent mobile ainsi qu’à la direction de l’argent mobile ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"4","4.2","4.2.1","","4.2.2.3",null,null,"4.2.2.3.3","¿Los informes de gestión son comunicados a todos los gerentes del dinero móvil y al jefe del dinero móvil?",null,null,"Recomendado","Recomendado","BizOps",null,null,"4","4.2","4.2.1",null,"4.2.2.3",null,0,"4.2.2.3.3",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"4.2.1.6.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4",0,0,{"$f":"UPPER(CONCATENATE(Introduction!C20,\": \",Introduction!D20))","v":"4.3: CAPACITY MANAGEMENT"},null,null,0,0,{"$f":"Introduction!E20","v":"Providers shall ensure sufficient service capacity by forecasting, monitoring and testing"},null,null,null,null,null,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4",null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$20,\": \",Introduction!$L$20))","v":"4.3: CAPACITY MANAGEMENT"},null,null,null,null,0,{"$f":"Introduction!$M$20","v":"Providers shall ensure sufficient service capacity by forecasting, monitoring and testing"},null,null,null,null,0,null,null,"4",0,0,null,0,null,0,0,"",null,null,null,null,0,null,null,"4",0,0,{"$f":"UPPER(CONCATENATE(Introduction!$U$20,\": \",Introduction!$V$20))","v":"4.3: GESTIÓN DE CAPACIDAD"},null,null,0,0,{"$f":"Introduction!W20","v":"El proveedor garantizará la disponibilidad de suficiente capacidad de servicio a través de pronósticos, monitoreo y pruebas."},null,null,null,null,0,null,null,"4",0,0,null,0,null,0,0,null,null,null,null,null,0]
[null,"4","4.3","4.3.1",{"$f":"CHOOSE(LanguageNumber,AY44,BP44,CF44,CV44)","v":"4.3.1: Providers shall take steps to ensure sufficient service capacity through forecasting, monitoring and testing"},"4.3.1.1",{"$f":"AZ44&\": \"&CHOOSE(LanguageNumber,BA44,BR44,CH44,CX44)","v":"4.3.1.1: BUSINESS FORECASTING\nBusiness forecasts provide the key information for capacity planning. Realistic business forecasts for the mobile money business should be generated based on:\n- Current performance of mobile money business;\n- Current growth trends;\n- Analysis of mobile money and financial market;\n- Competitor analysis;\n- Growth from new activities - new products, additional marketing, sales/distribution activities, etc. \n\nFor capacity planning purposes, it is helpful to split forecasts as Low forecast / On-target forecast / High forecast. Of these, the on-target forecast is the most important. \n\nQuarterly forecasts over the coming 1-3 year period are recommended, but forecasts should be at least annual.\n\nForecasts should include the following parameters:\n- Number of subscribers (registered/active);\n- Number of transactions (by transaction type);\n- Volume of other functions, such as web access;\n- Number of calls (or other communication) to customer service."},"ISO 20000-1:2019 Sec 6.2","4.3.1.1.1",{"$f":"BC44&\": \"&CHOOSE(LanguageNumber,BE44,BU44,CK44,DA44)&CarriageReturn","v":"4.3.1.1.1: Are business forecasts generated at least annually to provide a realistic prediction of the mobile money business over the coming 1-3 year period?\n"},{"$f":"CHOOSE(LanguageNumber,BF44,BV44,CL44,DB44)","v":"1) Business forecasts \n- Check that business forecasts are produced at least annually and forecast over a 1-3 year horizon\n"},{"$f":"CHOOSE(LanguageNumber,BG44,BW44,CM44,DC44)","v":0},{"$f":"CHOOSE(LanguageNumber,BH44,BX44,CN44,DD44)","v":"Urgent Required"},{"$f":"CHOOSE(LanguageNumber,BI44,BY44,CO44,DE44)","v":"Required"},"BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.3","4.3.1","4.3.1: Providers shall take steps to ensure sufficient service capacity through forecasting, monitoring and testing","4.3.1.1","BUSINESS FORECASTING\nBusiness forecasts provide the key information for capacity planning. Realistic business forecasts for the mobile money business should be generated based on:\n- Current performance of mobile money business;\n- Current growth trends;\n- Analysis of mobile money and financial market;\n- Competitor analysis;\n- Growth from new activities - new products, additional marketing, sales/distribution activities, etc. \n\nFor capacity planning purposes, it is helpful to split forecasts as Low forecast / On-target forecast / High forecast. Of these, the on-target forecast is the most important. \n\nQuarterly forecasts over the coming 1-3 year period are recommended, but forecasts should be at least annual.\n\nForecasts should include the following parameters:\n- Number of subscribers (registered/active);\n- Number of transactions (by transaction type);\n- Volume of other functions, such as web access;\n- Number of calls (or other communication) to customer service.","ISO 20000-1:2019 Sec 6.2","4.3.1.1.1","4.3.1.1.1","Are business forecasts generated at least annually to provide a realistic prediction of the mobile money business over the coming 1-3 year period?","1) Business forecasts \n- Check that business forecasts are produced at least annually and forecast over a 1-3 year horizon\n",null,"Urgent Required","Required","BizOps",null,null,"4","4.3","4.3.1","4.3.1: Les prestataires doivent veiller à disposer d'une capacité de service suffisante par le biais de prévisions, de mesures de surveillance et de tests.","4.3.1.1","PRÉVISIONS D'ACTIVITÉ\nLes prévisions d’activité fournissent des informations essentielles pour la planification des capacités. Des prévisions d’activité réalistes doivent être établies pour l’activité d’argent mobile sur la base de : \n-  la performance actuelle de l’activité d’argent mobile ; \n-  les tendances de croissance actuelles ;\n-  l’analyse du marché de l’argent mobile et du marché financier ;  \n-  l’analyse concurrentielle ; \n-  la croissance attendue des nouvelles activités : nouveaux produits, marketing supplémentaire, activités de vente/distribution, etc. \n\nPour la planification des capacités, il est utile de diviser les prévisions entre prévisions basses / prévisions à l’objectif / prévisions hautes. Parmi celles-ci, les prévisions à l’objectif sont les plus importantes. \n\nIl est recommandé d’établir des prévisions mensuelles ou trimestrielles sur la période de 1 à 3 ans à venir. \n\nLes prévisions doivent au minimum couvrir les paramètres suivants :\n- nombre d'inscrits (clients enregistrés/actifs) ;\n- nombre de transactions (par type de transaction) ;\n- volumes liés aux autres fonctionnalités, telles que l’accès internet ; \n- nombre d’appels (ou autres communications) à destination du service client ; \n- nombre d’agents.","ISO 20000-1:2019 Sec 6.2","4.3.1.1.1","des prévisions d’activité sont-elles établies au moins une fois par an afin de disposer d’une prédiction réaliste de l’activité d’argent mobile sur un horizon de 1 à 3 ans ?","1) Prévisions d’activité \n- Vérifier que des prévisions d’activité sont établies au moins une fois par an sur un horizon de 1 à 3 ans\n",null,{"$f":"VLOOKUP($BH44,CategoryTranslationTable,2,FALSE)","v":"Requis Prioritaire"},{"$f":"VLOOKUP($BI44,CategoryTranslationTable,2,FALSE)","v":"Requis"},"BizOps",0,null,"4","4.3","4.3.1","4.3.1: El proveedor garantizará la disponibilidad de suficiente capacidad de servicio a través de pronósticos, monitoreo y pruebas.","4.3.1.1","GENERACIÓN DE PRONÓSTICOS DEL NEGOCIO\nLos pronósticos del negocio brindan información clave para la planificación de capacidad. Se deben generar pronósticos realistas del negocio para el negocio del dinero móvil en base a lo siguiente:\n- Rendimiento actual del negocio del dinero móvil;\n- Tendencias de crecimiento actuales;\n- Análisis del mercado del dinero móvil y financiero;\n- Análisis de los competidores;\n- Crecimiento a partir de nuevas actividades - nuevos productos, actividades adicionales de marketing, ventas/distribución, etc. \n\nPara los fines de planificación de capacidad, resulta útil dividir los pronósticos en Pronóstico bajo / Pronóstico acorde al objetivo / Pronóstico alto. El Pronóstico acorde al objetivo es el más importante. \n\nSi bien se recomienda la generación de pronósticos trimestrales para el próximo período de 1-3 años, los pronósticos se deben generar, al menos, una vez al año.\n\nLos pronósticos deben incluir los siguientes parámetros:\n- Cantidad de suscriptores (registrados/activos);\n- Cantidad de transacciones (por tipo de transacción);\n- Volumen de otras funciones, tales como acceso web;\n- Cantidad de llamadas (u otras comunicaciones) a atención al cliente.","ISO 20000-1:2019 Sec 6.2","4.3.1.1.1","¿Se generaron pronósticos del negocio, al menos, una vez al año para tener una predicción realista del negocio del dinero móvil para el próximo período de 1-3 años?","1) Pronósticos del negocio \n- Verificar que sean generados, al menos, una vez al año y con un horizonte de pronóstico de 1-3 años\n",null,{"$f":"VLOOKUP($BH44,CategoryTranslationTable,3,FALSE)","v":"Obligatorio urgente"},{"$f":"VLOOKUP($BI44,CategoryTranslationTable,3,FALSE)","v":"Obligatorio"},"BizOps",null,null,"4","4.3","4.3.1",null,"4.3.1.1",null,"ISO 20000-1:2019 Sec 6.2","4.3.1.1.1",null,null,null,{"$f":"VLOOKUP($BH44,CategoryTranslationTable,4,FALSE)","v":"ReqU4"},{"$f":"VLOOKUP($BI44,CategoryTranslationTable,4,FALSE)","v":"Req4"},"BizOps",null,null,null,null,null,null,null,null,"4.3.1.1.1",null,null,null,{"$f":"IF(OR($EA44=0,$EA44=2),VLOOKUP(DO44,INDIRECT(ED44),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP44),\"\",VLOOKUP(DP44,INDIRECT(EE44),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ44),\"\",VLOOKUP(DQ44,INDIRECT(EF44),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR44),\"\",VLOOKUP(DR44,INDIRECT(EG44),7,FALSE))","v":""},{"$f":"IF(OR($EA44=0,$EA44=2),VLOOKUP(DO44,INDIRECT(ED44),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP44),\"\",VLOOKUP(DP44,INDIRECT(EE44),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ44),\"\",VLOOKUP(DQ44,INDIRECT(EF44),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR44),\"\",VLOOKUP(DR44,INDIRECT(EG44),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN44,3)=\"NEW\")+2*AND(LEFT(DN44,3)=\"MER\")+3*AND(LEFT(DN44,3)=\"MOV\")+4*AND(LEFT(DN44,3)=\"SWA\")","v":0},{"$error":"#REF!"},{"$f":"IF(EA44=0,IF(DW44=0,\"\",DW44),CHOOSE(EA44,\"New indicator\",CONCATENATE(DW44,CarriageReturn,DX44,CarriageReturn,DY44,CarriageReturn,DZ44)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO44,1)","v":"OriginalComplianceP4"},{"$f":"\"OriginalComplianceP\"&LEFT(DP44,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ44,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR44,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,""]
[null,"4","4.3","4.3.1",0,"4.3.1.1",null,0,"4.3.1.1.2","4.3.1.1.2: Do business forecasts include number of subscribers (registered and active) and number of transactions (by transaction type)?\n","1) Business forecasts \n- Check business forecasts include number of subscribers (registered and active) and number of transactions by transaction type.",0,"Standard Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.3","4.3.1",null,"4.3.1.1",null,null,"4.3.1.1.2","4.3.1.1.2","Do business forecasts include number of subscribers (registered and active) and number of transactions (by transaction type)?","1) Business forecasts \n- Check business forecasts include number of subscribers (registered and active) and number of transactions by transaction type.",null,"Standard Required","Required","BizOps",null,null,"4","4.3","4.3.1",0,"4.3.1.1",0,0,"4.3.1.1.2","les prévisions d’activité couvrent-elles le nombre d'abonnés (clients enregistrés et actifs) et le nombre de transactions (par type de transaction) ?","1) Prévisions d’activité \n- Vérifier que les prévisions d’activité incluent le nombre d’inscrits (clients enregistrés et actifs) et le nombre de transactions par type de transaction.",null,"Requis Normal","Requis","BizOps",0,null,"4","4.3","4.3.1",null,"4.3.1.1",null,0,"4.3.1.1.2","¿Los pronósticos del negocio incluyen la cantidad de suscriptores (registrados y activos) y la cantidad de transacciones (por tipo de transacción)?   ","1) Pronósticos del negocio\n- Verificar que los pronósticos del negocio incluyan la cantidad de suscriptores (registrados y activos) y la cantidad de transacciones por tipo.",null,"Obligatorio estándar","Obligatorio","BizOps",null,null,"4","4.3","4.3.1",null,"4.3.1.1",null,0,"4.3.1.1.2",null,null,null,"ReqS4","Req4","BizOps",null,null,null,null,null,null,null,null,"4.3.1.1.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.3","4.3.1",0,"4.3.1.1",null,0,"4.3.1.1.3","4.3.1.1.3: Do business forecasts include number of calls (or other communication) to customer service and number of agents?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.3","4.3.1",null,"4.3.1.1",null,null,"4.3.1.1.3","4.3.1.1.3","Do business forecasts include number of calls (or other communication) to customer service and number of agents?",null,null,"Recommended","Recommended","BizOps",null,null,"4","4.3","4.3.1",0,"4.3.1.1",0,0,"4.3.1.1.3","les prévisions d’activité couvrent-elles le nombre d’appels (ou autres communications) à destination du service client ainsi que le nombre d’agents ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"4","4.3","4.3.1",null,"4.3.1.1",null,0,"4.3.1.1.3","¿Los pronósticos del negocio incluyen la cantidad de llamadas (u otras comunicaciones) a atención al cliente, así como también la cantidad de agentes?",null,null,"Recomendado","Recomendado","BizOps",null,null,"4","4.3","4.3.1",null,"4.3.1.1",null,0,"4.3.1.1.3",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"4.3.1.1.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.3","4.3.1","","4.3.1.2","4.3.1.2: CAPACITY PLAN - TECHNICAL\nThe technical capacity plan should determine how the technical system will support the forecast business volumes and performance (see 4.3.1.1). It should be a forward-looking projection with anticipated technial hardware upgrades. Providers should produce a technical capacity plan at least annually or more frequently if required due to rates of change to services and service volumes. \n\n The capacity plan should include the following analysis:\n- analysis of the business forecast of mobile money service usage;\n- analysis of past, current and forecast technical component usage and performance, including an understanding of which resources support which services and the potential impact of new technologies (system modelling and trend analysis can be used to analyse performance);\n- analysis of the impact on capacity from changes to requirements for availability, service continuity and performance service levels;\n\nThe capacity plan should determine the following technical requirements:\n- Horizontal scaling of system infrastructure\n- Vertical scaling of system infrastructure\n- Changes to system architecture to support the forecast business volumes.\n- Performance tuning of the system.\n\nThe capacity plan should determine the following business requirements:\n- Human resource and cost requirements to deliver the required technical performance;\n- The time and planning required to implement the technical changes.\n","ISO 20000-1:2019 Sec 8.4.3","4.3.1.2.1","4.3.1.2.1: Is a technical capacity plan produced at least annually - i.e. a forward-looking projection with anticipated technial hardware upgrades?\n","1) Technical capacity plan \n-  Check the technical capacity plan (a forward-looking projection with anticipated technial hardware upgrades) is produced at least annually.",0,"Urgent Required","Required","TechOps",{"$f":"CHOOSE(LanguageNumber,BK47,CA47,CQ47,DG47)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.3","4.3.1","","4.3.1.2","CAPACITY PLAN - TECHNICAL\nThe technical capacity plan should determine how the technical system will support the forecast business volumes and performance (see 4.3.1.1). It should be a forward-looking projection with anticipated technial hardware upgrades. Providers should produce a technical capacity plan at least annually or more frequently if required due to rates of change to services and service volumes. \n\n The capacity plan should include the following analysis:\n- analysis of the business forecast of mobile money service usage;\n- analysis of past, current and forecast technical component usage and performance, including an understanding of which resources support which services and the potential impact of new technologies (system modelling and trend analysis can be used to analyse performance);\n- analysis of the impact on capacity from changes to requirements for availability, service continuity and performance service levels;\n\nThe capacity plan should determine the following technical requirements:\n- Horizontal scaling of system infrastructure\n- Vertical scaling of system infrastructure\n- Changes to system architecture to support the forecast business volumes.\n- Performance tuning of the system.\n\nThe capacity plan should determine the following business requirements:\n- Human resource and cost requirements to deliver the required technical performance;\n- The time and planning required to implement the technical changes.\n","ISO 20000-1:2019 Sec 8.4.3","4.3.1.2.1","4.3.1.2.1","Is a technical capacity plan produced at least annually - i.e. a forward-looking projection with anticipated technial hardware upgrades?","1) Technical capacity plan \n-  Check the technical capacity plan (a forward-looking projection with anticipated technial hardware upgrades) is produced at least annually.",null,"Urgent Required","Required","TechOps",null,null,"4","4.3","4.3.1","","4.3.1.2","PLAN DE CAPACITÉ - FONCTIONS TECHNIQUES\nLe plan de capacité des fonctions techniques doit permettre de déterminer la manière dont le système technique soutiendra la performance et les volumes prévus de l’activité (cf. 4.3.1.1). Les prestataires doivent établir un plan de capacité technique au moins une fois par an ou plus fréquemment si nécessaire en fonction du rythme de changement dans les services ou les volumes d’activité.  \n\n Le plan d’activité doit inclure les analyses suivantes : \n- analyse des prévisions d’activité relatives à l’utilisation du service d’argent mobile ;  \n- analyse de la performance et du taux d’utilisation passés, actuels et prévus des composantes techniques du système, en identifiant les ressources qui soutiennent chaque service et l’impact potentiel des nouvelles technologies (la modélisation des systèmes et l’analyse des tendances peuvent être utilisées dans le cadre de l’analyse de la performance) ;\n- analyse de l’impact sur les capacités des changements d’exigence en matière de niveaux de service pour la disponibilité, la continuité du service et la performance ;\n\nLe plan de capacité doit déterminer les exigences techniques suivantes :  \n- expansion horizontale de l’infrastructure du système ; \n- expansion verticale de l’infrastructure du système ;\n- évolution de l’architecture système pour soutenir les volumes prévus d’activité.  \n- adaptation de la performance du système.\n\nLe plan de capacité doit déterminer les exigences de gestion suivantes :  \n- coûts et ressources humaines nécessaires pour fournir les performances techniques exigées ;  \n- planification et délais nécessaires à la mise en œuvre des changements techniques. \n","ISO 20000-1:2019 Sec 8.4.3","4.3.1.2.1","un plan de capacité technique (à savoir une projection incluant les projets de mise à jour technique du matériel informatique) est-il établi au moins une fois par an ?","1) Plan de capacité technique \n- Vérifier que le plan de capacité technique (projection incluant les projets de mise à jour technique du matériel informatique) est établi au moins une fois par an.",null,"Requis Prioritaire","Requis","TechOps",0,null,"4","4.3","4.3.1","","4.3.1.2","PLAN DE CAPACIDAD - TÉCNICA\nEl plan de capacidad técnica debe determinar cómo el sistema técnico soportará los volúmenes y el rendimiento del negocio pronosticados (ver 4.3.1.1). Los proveedores deben generar un plan de capacidad técnica, al menos una vez al año, o con mayor frecuencia si fuese requerido en virtud de las tasas de cambio a los servicios y los volúmenes del servicio. \n\n El plan de capacidad debe incluir el siguiente análisis:\n- análisis del pronóstico del negocio del uso del servicio del dinero móvil;\n- análisis del uso y rendimiento pasado, actual y pronosticado de los componentes técnicos, incluyendo una comprensión de qué recursos soportarán determinados servicios y el impacto potencial de las nuevas tecnologías (modelado del sistema y análisis de tendencias para analizar el rendimiento);\n- análisis del impacto de los cambios a los requisitos de disponibilidad en la capacidad, continuidad del servicio y niveles de rendimiento del servicio;\n\nEl plan de capacidad debe determinar los siguientes requisitos técnicos:\n- Escalabilidad horizontal de la infraestructura del sistema\n- Escalabilidad vertical de la infraestructura del sistema\n- Cambios a la arquitectura del sistema para soportar los volúmenes del negocio pronosticados.\n- Ajuste de rendimiento del sistema.\n\nEl plan de capacidad debe determinar los siguientes requisitos del negocio:\n- Requisitos de recursos humanos y costos para alcanzar el rendimiento técnico requerido;\n- El tiempo y la planificación requerida para implementar los cambios técnicos.\n","ISO 20000-1:2019 Sec 8.4.3","4.3.1.2.1","¿Se genera un plan de capacidad técnica, al menos una vez al año, es decir, una proyección con actualizaciones técnicas de hardware anticipadas?","1) Plan de capacidad técnica \n-  Verificar que el plan de capacidad técnica, es decir, una proyección con actualizaciones técnicas de hardware, anticipadas sea generado, al menos, una vez al año.",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"4","4.3","4.3.1",null,"4.3.1.2",null,"ISO 20000-1:2019 Sec 8.4.3","4.3.1.2.1",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"4.3.1.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.3","4.3.1","","4.3.1.2",null,0,"4.3.1.2.2","4.3.1.2.2: Is the capacity plan based on the business forecast of transactions, subscribers and other functional usage?\n","1) Technical capacity plan \n2) Business forecasts\n-  Check the technical capacity plan is based on the business forecasts of subscribers, volumes and other functional usage to meet projected growth requirements.",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.3","4.3.1","","4.3.1.2",null,null,"4.3.1.2.2","4.3.1.2.2","Is the capacity plan based on the business forecast of transactions, subscribers and other functional usage?","1) Technical capacity plan \n2) Business forecasts\n-  Check the technical capacity plan is based on the business forecasts of subscribers, volumes and other functional usage to meet projected growth requirements.",null,"Urgent Required","Required","TechOps",null,null,"4","4.3","4.3.1","","4.3.1.2",0,0,"4.3.1.2.2","le plan de capacité repose-t-il sur les prévisions d’activité relatives aux transactions, aux abonnés et au niveau d’utilisation des fonctionnalités ?","1) Plan de capacité technique \n2) Prévisions d’activité\n- Vérifier que le plan de capacité technique repose sur les prévisions d’activité relatives aux abonnés aux volumes et au niveau d’utilisation d’autres fonctionnalités afin de respecter les exigences définies pour suivre la trajectoire de croissance projetée.",null,"Requis Prioritaire","Requis","TechOps",0,null,"4","4.3","4.3.1","","4.3.1.2",null,0,"4.3.1.2.2","¿El plan de capacidad técnica se basa en el pronóstico de transacciones, suscriptores y otros usos funcionales?","1) Plan de capacidad técnica\n2) Pronósticos del negocio \n-  Verificar que el plan de capacidad técnica se base en los pronósticos de suscriptores, volúmenes y otros usos funcionales del negocio para cumplir los requisitos de crecimiento proyectado.",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"4","4.3","4.3.1",null,"4.3.1.2",null,0,"4.3.1.2.2",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"4.3.1.2.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.3","4.3.1","","4.3.1.2",null,0,"4.3.1.2.3","4.3.1.2.3: Is the capacity plan based on an analysis of usage and performance of all the components of the mobile money system?\n","1) Technical capacity plan \n-  Check the technical capacity plan is based on analysis and usage of all the components of the mobile money system environment\n",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.3","4.3.1","","4.3.1.2",null,null,"4.3.1.2.3","4.3.1.2.3","Is the capacity plan based on an analysis of usage and performance of all the components of the mobile money system?","1) Technical capacity plan \n-  Check the technical capacity plan is based on analysis and usage of all the components of the mobile money system environment\n",null,"Urgent Required","Required","TechOps",null,null,"4","4.3","4.3.1","","4.3.1.2",0,0,"4.3.1.2.3","le plan de capacité repose-t-il sur une analyse de la performance et du taux d’utilisation de l’ensemble des composantes techniques du système de l’argent mobile ?","1) Plan de capacité technique \n- Vérifier que le plan de capacité technique repose sur une analyse et les taux d’utilisation de l’ensemble des composants de l’environnement du système d’argent mobile\n",null,"Requis Prioritaire","Requis","TechOps",0,null,"4","4.3","4.3.1","","4.3.1.2",null,0,"4.3.1.2.3","¿El plan de capacidad se basa en un análisis del uso y rendimiento de todos los componentes del sistema del dinero móvil?","1) Plan de capacidad técnica\n-  Verificar que el plan de capacidad técnica se base en el análisis y uso de todos los componentes del entorno del sistema del dinero móvil\n",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"4","4.3","4.3.1",null,"4.3.1.2",null,0,"4.3.1.2.3",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"4.3.1.2.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.3","4.3.1","","4.3.1.2",null,0,"4.3.1.2.4","4.3.1.2.4: Does the capacity plan analyse changes to requirements for availability, service continuity and performance and the impact this has on system capacity?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.3","4.3.1","","4.3.1.2",null,null,"4.3.1.2.4","4.3.1.2.4","Does the capacity plan analyse changes to requirements for availability, service continuity and performance and the impact this has on system capacity?",null,null,"Recommended","Recommended","TechOps",null,null,"4","4.3","4.3.1","","4.3.1.2",0,0,"4.3.1.2.4","le plan de capacité analyse-t-il les changements d’exigences en termes de disponibilité, de continuité du service et de performance et leur impact en termes de capacité du système ?",null,null,"Recommandé","Recommandé","TechOps",0,null,"4","4.3","4.3.1","","4.3.1.2",null,0,"4.3.1.2.4","¿El plan de capacidad analiza los requisitos de disponibilidad, continuidad del servicio y rendimiento y su impacto en la capacidad del sistema?",null,null,"Recomendado","Recomendado","TechOps",null,null,"4","4.3","4.3.1",null,"4.3.1.2",null,0,"4.3.1.2.4",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.3.1.2.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.3","4.3.1","","4.3.1.2",null,0,"4.3.1.2.5","4.3.1.2.5: Does the capacity plan determine all the technical changes to meet future capacity and performance needs, including horizontal and vertical scaling, changes to system architecture and performance tuning?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.3","4.3.1","","4.3.1.2",null,null,"4.3.1.2.5","4.3.1.2.5","Does the capacity plan determine all the technical changes to meet future capacity and performance needs, including horizontal and vertical scaling, changes to system architecture and performance tuning?",null,null,"Recommended","Recommended","TechOps",null,null,"4","4.3","4.3.1","","4.3.1.2",0,0,"4.3.1.2.5","le plan de capacité détermine-t-il tous les changements techniques nécessaires pour répondre aux besoins futurs de capacité et de performance, notamment en termes d’expansion horizontale et verticale, d’évolution de l’architecture du système et d’adaptation de la performance ?",null,null,"Recommandé","Recommandé","TechOps",0,null,"4","4.3","4.3.1","","4.3.1.2",null,0,"4.3.1.2.5","¿El plan de capacidad determina todos los cambios técnicos necesarios para cumplir con las necesidades de capacidad y rendimiento futuras, incluyendo escalabilidad horizontal y vertical, cambios a la arquitectura del sistema y ajustes de rendimiento?",null,null,"Recomendado","Recomendado","TechOps",null,null,"4","4.3","4.3.1",null,"4.3.1.2",null,0,"4.3.1.2.5",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.3.1.2.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.3","4.3.1","","4.3.1.2",null,0,"4.3.1.2.6","4.3.1.2.6: Does the capacity plan determine business requirements such as resources, time and planning to implement technical capacity changes?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.3","4.3.1","","4.3.1.2",null,null,"4.3.1.2.6","4.3.1.2.6","Does the capacity plan determine business requirements such as resources, time and planning to implement technical capacity changes?",null,null,"Recommended","Recommended","TechOps",null,null,"4","4.3","4.3.1","","4.3.1.2",0,0,"4.3.1.2.6","le plan de capacité détermine-t-il les besoins en termes de ressources, de délai et de planification pour la mise en œuvre des changements de capacités techniques ?",null,null,"Recommandé","Recommandé","TechOps",0,null,"4","4.3","4.3.1","","4.3.1.2",null,0,"4.3.1.2.6","¿El plan de capacidad determina los requisitos del negocio, tales como recursos, tiempo y planificación para implementar cambios a la capacidad técnica?",null,null,"Recomendado","Recomendado","TechOps",null,null,"4","4.3","4.3.1",null,"4.3.1.2",null,0,"4.3.1.2.6",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.3.1.2.6",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.3","4.3.1",{"$f":"CHOOSE(LanguageNumber,AY53,BP53,CF53,CV53)","v":""},"4.3.1.3",{"$f":"AZ53&\": \"&CHOOSE(LanguageNumber,BA53,BR53,CH53,CX53)","v":"4.3.1.3: CAPACITY PLAN - BUSINESS\nThe business capacity plan should determine how the mobile money business team will be scaled to support the forecast business volumes (see 4.3.1.1). Providers should produce a business capacity plan at least annually or more frequently if required due to rates of change to services or service volumes. \n\nThe business capacity plan should address human resource requirements by function, including:\n- Customer service;\n- Agent management;\n- Financial operations;\n- Business operations;\n- AML/CFT;\n- Fraud management.\n"},"ISO 20000-2:2012 Sec. 6.5.3.1-2","4.3.1.3.1","4.3.1.3.1: Is a business capacity plan produced at least annually or more frequently if required due to rates of change to services or service volumes?\n",{"$f":"CHOOSE(LanguageNumber,BF53,BV53,CL53,DB53)","v":"Business capacity (human resource) plan"},0,{"$f":"CHOOSE(LanguageNumber,BH53,BX53,CN53,DD53)","v":"Recommended"},"Recommended","BizOps",{"$f":"CHOOSE(LanguageNumber,BK53,CA53,CQ53,#REF!)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.3","4.3.1","","4.3.1.3","CAPACITY PLAN - BUSINESS\nThe business capacity plan should determine how the mobile money business team will be scaled to support the forecast business volumes (see 4.3.1.1). Providers should produce a business capacity plan at least annually or more frequently if required due to rates of change to services or service volumes. \n\nThe business capacity plan should address human resource requirements by function, including:\n- Customer service;\n- Agent management;\n- Financial operations;\n- Business operations;\n- AML/CFT;\n- Fraud management.\n","ISO 20000-2:2012 Sec. 6.5.3.1-2","4.3.1.3.1","4.3.1.3.1","Is a business capacity plan produced at least annually or more frequently if required due to rates of change to services or service volumes?","Business capacity (human resource) plan",null,"Recommended","Recommended","BizOps",null,null,"4","4.3","4.3.1","","4.3.1.3","PLAN DE CAPACITÉ - FONCTIONS COMMERCIALES\nLe plan de capacité des fonctions commerciales doit permettre de déterminer comment dimensionner les équipes commerciales de l’argent mobile pour soutenir les volumes prévus de l’activité (cf. 4.3.1.1). Les prestataires doivent établir un plan de capacité commerciale au moins une fois par an et plus fréquemment si nécessaire en raison du rythme de changement dans les services ou les volumes d’activité. \n\nLe plan de capacité des fonctions commerciales doit examiner les besoins en ressources humaines par fonction, notamment pour :\n- le service client ;\n- la gestion des agents ;\n- les opérations financières ;\n- l’exploitation ;\n- la lutte contre le blanchiment de capitaux et le financement du terrorisme (AML/CFT)\n- la lutte contre la fraude.\n\n","ISO 20000-2:2012 Sec. 6.5.3.1-2","4.3.1.3.1","un plan de capacité commerciale est-il établi au moins une fois par an ou plus souvent si nécessaire en fonction du rythme des changements apportés aux services et de l’évolution des volumes ?","Plan de capacité commerciale (ressources humaines)",null,"Recommandé","Recommandé","BizOps",0,null,"4","4.3","4.3.1","","4.3.1.3","PLAN DE CAPACIDAD - DEL NEGOCIO \nEl plan de capacidad del negocio debe determinar cómo se escalará el equipo del negocio del dinero móvil para soportar los volúmenes pronosticados del negocio (ver 4.3.1.1). Los proveedores deben generar un plan de capacidad del negocio, al menos una vez al año, o con mayor frecuencia si fuese requerido en virtud de las tasas de cambio a los servicios o volúmenes del servicio. \n\nEl plan de capacidad del negocio debe abordar los requisitos de recursos humanos por función, incluyendo:\n- Atención al cliente;\n- Gestión de agentes;\n- Operaciones financieras;\n- Operaciones del negocio;\n- ALA/CFT;\n- Gestión de fraude.\n","ISO 20000-2:2012 Sec. 6.5.3.1-2","4.3.1.3.1","¿Se genera un plan de capacidad del negocio, al menos una vez al año, o con mayor frecuencia si fuese requerido en virtud de las tasas de cambio a los servicios o volúmenes del servicio?","Plan de capacidad del negocio (recursos humanos)",null,"Recomendado","Recomendado","BizOps",null,null,"4","4.3","4.3.1",null,"4.3.1.3",null,"ISO 20000-2:2012 Sec. 6.5.3.1-2","4.3.1.3.1",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"4.3.1.3.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.3","4.3.1","","4.3.1.3",null,0,"4.3.1.3.2","4.3.1.3.2: Does the business capacity plan address human resource requirements by function, including Customer service, Agent management, Financial operations, Business operations, AML/CFT, and Fraud management?\n",{"$f":"CHOOSE(LanguageNumber,BF54,BV54,CL54,DB54)","v":0},0,"Recommended","Recommended","BizOps",{"$f":"CHOOSE(LanguageNumber,BK54,CA54,CQ54,#REF!)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.3","4.3.1","","4.3.1.3",null,null,"4.3.1.3.2","4.3.1.3.2","Does the business capacity plan address human resource requirements by function, including Customer service, Agent management, Financial operations, Business operations, AML/CFT, and Fraud management?",null,null,"Recommended","Recommended","BizOps",null,null,"4","4.3","4.3.1","","4.3.1.3",0,0,"4.3.1.3.2","le plan de capacité commerciale évalue-t-il les besoins en ressources humaines par fonction, notamment pour le service client, la gestion des agents, les opérations financières, l’exploitation, la fonction AML/CFT et la lutte contre la fraude ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"4","4.3","4.3.1","","4.3.1.3",null,0,"4.3.1.3.2","¿El plan de capacidad del negocio aborda los requisitos de recursos humanos por función, incluyendo Atención al cliente, Gestión de agentes, Operaciones financieras, Operaciones del negocio, ALA/CFT y Gestión de fraude?",null,null,"Recomendado","Recomendado","BizOps",null,null,"4","4.3","4.3.1",null,"4.3.1.3",null,0,"4.3.1.3.2",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"4.3.1.3.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.3","4.3.1",{"$f":"CHOOSE(LanguageNumber,AY55,BP55,CF55,CV55)","v":""},{"$f":"AZ55","v":"4.3.1.4"},{"$f":"AZ55&\": \"&CHOOSE(LanguageNumber,BA55,BR55,CH55,CX55)","v":"4.3.1.4: CAPACITY AND PERFORMANCE ALERTS AND REPORTS\nOperational alerts should be raised when the capacity and/or performance of a particular component has become unacceptable.\n\nProviders should produce technical capacity and performance reports. Reports should be generated on the resource utilization of each system component, along with the corresponding transaction response times, transaction rates, and workload volumes. These reports can be used to compare current utilization against forecasts and are important in capacity planning."},null,{"$f":"BC55","v":"4.3.1.4.1"},"4.3.1.4.1: Are operational alerts raised when the capacity and/or performance of a particular component has become unacceptable?\n",{"$f":"CHOOSE(LanguageNumber,BF55,BV55,CL55,DB55)","v":"1) Monitoring and alerting system logs or specification\n- Check there is a process for operational alerts to be raised when the capacity or performance of a particular component has become unacceptable in terms of planned thresholds.  \n"},0,{"$f":"CHOOSE(LanguageNumber,BH55,BX55,CN55,DD55)","v":"Standard Required"},{"$f":"CHOOSE(LanguageNumber,BI55,BY55,CO55,DE55)","v":"Required"},"TechOps",{"$f":"CHOOSE(LanguageNumber,BK55,CA55,CQ55,#REF!)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.3","4.3.1","","4.3.1.4","CAPACITY AND PERFORMANCE ALERTS AND REPORTS\nOperational alerts should be raised when the capacity and/or performance of a particular component has become unacceptable.\n\nProviders should produce technical capacity and performance reports. Reports should be generated on the resource utilization of each system component, along with the corresponding transaction response times, transaction rates, and workload volumes. These reports can be used to compare current utilization against forecasts and are important in capacity planning.","ISO 20000-1:2019 Sec 8.6.1","4.3.1.4.1",{"$f":"DO55","v":"4.3.1.4.2"},"Are operational alerts raised when the capacity and/or performance of a particular component has become unacceptable?","1) Monitoring and alerting system logs or specification\n- Check there is a process for operational alerts to be raised when the capacity or performance of a particular component has become unacceptable in terms of planned thresholds.  \n",null,"Standard Required","Required","TechOps",null,null,"4","4.3","4.3.1","","4.3.1.4","ALERTES ET RAPPORTS DE CAPACITÉ ET DE PERFORMANCE\nDes signaux d’alerte opérationnels doivent être activés lorsque la capacité et/ou la performance d’un composant particulier devient inacceptable.  \n\nLes prestataires doivent produire des rapports de capacité et de performance techniques portant notamment sur le taux d’utilisation des ressources pour chaque composant du système, les délais de réponse correspondants pour les transactions, les taux de transaction et les volumes de charge. Ces rapports permettent de comparer le taux d’utilisation actuel par rapport aux prévisions et sont importants pour la planification des capacités.\n",{"$f":"$BB55","v":"ISO 20000-1:2019 Sec 8.6.1"},"4.3.1.4.1","des signaux d’alerte opérationnels sont-ils activés lorsque la capacité et/ou la performance d’un composant particulier devient inacceptable ?","1) Registres ou spécification du système relatifs au suivi et aux alertes\n- Vérifier qu’un processus a été mis en place pour l’activation de signaux d’alerte opérationnels lorsque la capacité ou la performance d’un composant particulier, comparée aux limites préalablement définies, devient inacceptable. \n",null,"Requis Normal","Requis","TechOps",0,null,"4","4.3","4.3.1","","4.3.1.4","ALERTAS E INFORMES DE CAPACIDAD Y RENDIMIENTO\nSe deben generar alertas cuando la capacidad y/o el rendimiento de un componente en particular se tornó inaceptable.\n\nLos proveedores deben generar informes de capacidad técnica y rendimiento. Se deben generar informes sobre la utilización de recursos de cada componente del sistema, junto con los tiempos de respuesta de las transacciones, las tasas de transacciones y los volúmenes de carga de trabajo correspondientes. Estos informes pueden ser utilizados para comparar la utilización actual con los pronósticos y son importantes para la planificación de la capacidad.",{"$f":"$BB55","v":"ISO 20000-1:2019 Sec 8.6.1"},"4.3.1.4.1","¿Se generan alertas operativas cuando la capacidad y/o el rendimiento de un componente en particular se tornó inaceptable?","1) Especificación de monitoreo / registro / pista de auditoría \n- Verificar que exista un proceso de generación de alertas operativas cuando la capacidad o el rendimiento de un componente en particular se tornó inaceptable en razón de los umbrales planificados.  \n",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"4","4.3","4.3.1",null,"4.3.1.4",null,{"$f":"$BB55","v":"ISO 20000-1:2019 Sec 8.6.1"},"4.3.1.4.1",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"4.3.1.4.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.3","4.3.1","","4.3.1.4",null,{"$f":"BB55","v":"ISO 20000-1:2019 Sec 8.6.1"},"4.3.1.4.2","4.3.1.4.2: Are component-based capacity and performance reports that illustrate system component performance and capacity utilisation regularly produced?\n",{"$f":"CHOOSE(LanguageNumber,BF56,BV56,CL56,DB56)","v":0},0,"Recommended","Recommended","TechOps",{"$f":"CHOOSE(LanguageNumber,BK56,CA56,CQ56,#REF!)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.3","4.3.1","","4.3.1.4",null,null,"4.3.1.4.2","4.3.1.4.1","Are component-based capacity and performance reports that illustrate system component performance and capacity utilisation regularly produced?",null,null,"Recommended","Recommended","TechOps",null,null,"4","4.3","4.3.1","","4.3.1.4",null,null,"4.3.1.4.2","des rapports de capacité et de performance techniques sont-ils régulièrement produits pour documenter la performance des composantes du système et les taux d’utilisation des capacités ?",null,null,"Recommandé","Recommandé","TechOps",0,null,"4","4.3","4.3.1","","4.3.1.4",null,null,"4.3.1.4.2","¿Se generan periódicamente informes de capacidad y rendimiento basados en componentes que ilustren el rendimiento y la utilización de la capacidad de los componentes?",null,null,"Recomendado","Recomendado","TechOps",null,null,"4","4.3","4.3.1",null,"4.3.1.4",null,null,"4.3.1.4.2",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.3.1.4.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.3","4.3.1","","4.3.1.5","4.3.1.5: CAPACITY TESTING\nCapacity testing of the mobile money system should be performed whenever significant changes are made to the system, including application, architecture or infrastructure changes. \n\nTesting should be done on a test system that is scaled to be representative of the live system.\n\nDifferent configurations and transaction mixes can significantly impact system performance. Capacity testing should test a number of configurations and transaction mixes so that all realistically-expected scenarios are tested.\n\n","ISO 20000-2:2012 Sec.6.5.3.1","4.3.1.5.1","4.3.1.5.1: Is capacity testing of the mobile money system performed whenever significant changes are made to the system, including application, architecture or infrastructure changes?\n","Capacity testing plan",0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.3","4.3.1","","4.3.1.5","CAPACITY TESTING\nCapacity testing of the mobile money system should be performed whenever significant changes are made to the system, including application, architecture or infrastructure changes. \n\nTesting should be done on a test system that is scaled to be representative of the live system.\n\nDifferent configurations and transaction mixes can significantly impact system performance. Capacity testing should test a number of configurations and transaction mixes so that all realistically-expected scenarios are tested.\n\n","ISO 20000-2:2012 Sec.6.5.3.1","4.3.1.5.1","4.3.1.5.1","Is capacity testing of the mobile money system performed whenever significant changes are made to the system, including application, architecture or infrastructure changes?","Capacity testing plan",null,"Recommended","Recommended","TechOps",null,null,"4","4.3","4.3.1","","4.3.1.5","CONTRÔLE DES CAPACITÉS\nLa capacité du système de l’argent mobile doit être testée chaque fois que des changements significatifs sont apportés au système, et notamment en cas de changement dans les applications, l’architecture ou l’infrastructure. \n\nCe contrôle doit être effectué sur un système d'essai dimensionné pour être représentatif du système opérationnel. \n\nLa performance des systèmes peut varier de façon significative en fonction des configurations ou des combinaisons de transaction. Les contrôles de capacité doivent couvrir un certain nombre de configurations et de combinaisons de transactions pour tester tous les scénarios pouvant raisonnablement se produire. \n\n","ISO 20000-2:2012 Sec.6.5.3.1","4.3.1.5.1","un contrôle de capacité du système de l’argent mobile est-il effectué chaque fois que des changements significatifs sont apportés au système, et notamment en cas de changement dans les applications, l’architecture ou l’infrastructure.","Plan de contrôle des capacités",null,"Recommandé","Recommandé","TechOps",0,null,"4","4.3","4.3.1","","4.3.1.5","REALIZACIÓN DE PRUEBAS DE CAPACIDAD\nSe deben realizar pruebas de capacidad del sistema del dinero móvil siempre que se realicen cambios significativos al sistema, incluyendo cambios de aplicaciones, arquitectura o infraestructura. \n\nLas pruebas deben realizarse en un sistema de pruebas a escala que represente el sistema en producción.\n\nLas distintas combinaciones de configuraciones y transacciones pueden afectar significativamente el rendimiento del sistema. Las pruebas de capacidad deben probar numerosas combinaciones de configuraciones y transacciones a fin de probar todos los escenarios realistas esperados.\n\n","ISO 20000-2:2012 Sec.6.5.3.1","4.3.1.5.1","¿Se realizan pruebas de capacidad del sistema del dinero móvil siempre que se realizan cambios significativos al sistema, incluyendo cambios de aplicaciones, arquitectura o infraestructura?","Plan de realización de pruebas de capacidad",null,"Recomendado","Recomendado","TechOps",null,null,"4","4.3","4.3.1",null,"4.3.1.5",null,"ISO 20000-2:2012 Sec.6.5.3.1","4.3.1.5.1",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.3.1.5.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.3","4.3.1","","4.3.1.5",null,0,"4.3.1.5.2","4.3.1.5.2: Is capacity testing done on a test system that is scaled to be representative of the live system?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.3","4.3.1","","4.3.1.5",null,null,"4.3.1.5.2","4.3.1.5.2","Is capacity testing done on a test system that is scaled to be representative of the live system?",null,null,"Recommended","Recommended","TechOps",null,null,"4","4.3","4.3.1","","4.3.1.5",0,0,"4.3.1.5.2","le contrôle de capacité est-il effectué sur un système d’essai dimensionné pour être représentatif du système opérationnel ?",null,null,"Recommandé","Recommandé","TechOps",0,null,"4","4.3","4.3.1","","4.3.1.5",null,0,"4.3.1.5.2","¿Las pruebas de capacidad se realizan en un sistema de pruebas a escala que represente el sistema en producción?",null,null,"Recomendado","Recomendado","TechOps",null,null,"4","4.3","4.3.1",null,"4.3.1.5",null,0,"4.3.1.5.2",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.3.1.5.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.3","4.3.1","","4.3.1.5",null,0,"4.3.1.5.3","4.3.1.5.3: Does capacity testing test a number of configurations and transaction mixes so that all realistically-expected scenarios are tested?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.3","4.3.1","","4.3.1.5",null,null,"4.3.1.5.3","4.3.1.5.3","Does capacity testing test a number of configurations and transaction mixes so that all realistically-expected scenarios are tested?",null,null,"Recommended","Recommended","TechOps",null,null,"4","4.3","4.3.1","","4.3.1.5",0,0,"4.3.1.5.3","le contrôle de capacité couvre-t-il un certain nombre de configurations et de combinaisons de transactions en vue de tester tous les scénarios pouvant raisonnablement se produire ?",null,null,"Recommandé","Recommandé","TechOps",0,null,"4","4.3","4.3.1","","4.3.1.5",null,0,"4.3.1.5.3","¿Las pruebas de capacidad prueban numerosas combinaciones de configuraciones y transacciones a fin de probar todos los escenarios realistas esperados?",null,null,"Recomendado","Recomendado","TechOps",null,null,"4","4.3","4.3.1",null,"4.3.1.5",null,0,"4.3.1.5.3",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.3.1.5.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.3","4.3.1","","4.3.1.6","4.3.1.6: TECHNICAL CAPACITY ANALYSIS\nCapacity limitations of all system components should be assessed and the maximum recommended utilization level should be documented, beyond which the resource will be over-utilised and the performance of the services using the resource will be impaired.\n\nArchitectural bottlenecks and other known weaknesses should be identified, along with redundancy and spare capacity.\n\nCurrent and past throughput and performance should be recorded and analysed, including comparisons of actual achievements against forecasts. This will give a picture of the system capacity and expected resource utilization.\n\nModelling can be used to predict resource utilization as volumes increase. Trend analysis (using the business forecast) should be applied to a baseline model. Analytical system modelling can also be used to analyse performance – for example modelling transaction rates against a given system configuration.\n","ISO 20000-1:2011 Sec. 6.5","4.3.1.6.1","4.3.1.6.1: Is the maximum recommended utilization level of each system component documented?\n","Current system capacity report (disk, memory, CPU by system component)",0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.3","4.3.1","","4.3.1.6","TECHNICAL CAPACITY ANALYSIS\nCapacity limitations of all system components should be assessed and the maximum recommended utilization level should be documented, beyond which the resource will be over-utilised and the performance of the services using the resource will be impaired.\n\nArchitectural bottlenecks and other known weaknesses should be identified, along with redundancy and spare capacity.\n\nCurrent and past throughput and performance should be recorded and analysed, including comparisons of actual achievements against forecasts. This will give a picture of the system capacity and expected resource utilization.\n\nModelling can be used to predict resource utilization as volumes increase. Trend analysis (using the business forecast) should be applied to a baseline model. Analytical system modelling can also be used to analyse performance – for example modelling transaction rates against a given system configuration.\n","ISO 20000-1:2011 Sec. 6.5","4.3.1.6.1","4.3.1.6.1","Is the maximum recommended utilization level of each system component documented?","Current system capacity report (disk, memory, CPU by system component)",null,"Recommended","Recommended","TechOps",null,null,"4","4.3","4.3.1","","4.3.1.6","ANALYSE DES CAPACITÉS TECHNIQUES\nIl est nécessaire d’évaluer les limites de capacité de l’ensemble des composantes du système et de documenter le niveau maximal recommandé d’utilisation au-delà duquel la ressource serait surexploité et risquerait d’affecter la performance des  services qui l’utilisent.\n\nLes goulets d’étranglement liés à l’architecture du système et les autres points de faiblesse connus doivent être recensés ainsi que les redondances et réserves de capacité.\n\nLes débits de traitement et performances passés et actuels doivent être enregistrés et analysés, avec comparaison des résultats effectifs par rapport aux prévisions, afin d’avoir une bonne vision des capacités du système et du taux d’utilisation attendu des ressources.\n\nIl est possible de recourir à la modélisation pour prévoir le taux d’utilisation des ressources en fonction de l’augmentation des volumes. Une analyse des tendances (sur la base des prévisions d’activité) soit être effectuée sur la base d’un modèle de référence. La modélisation analytique des systèmes peut également être utilisée pour analyser la performance, en modélisant par exemple les taux de transaction par rapport à une configuration donnée du système. \n","ISO 20000-1:2011 Sec. 6.5","4.3.1.6.1","le niveau maximal recommandé d’utilisation de chaque composante du système est-il documenté ?","Rapport d’analyse des capacités actuelles du système (disque, mémoire, CPU par composante du système)",null,"Recommandé","Recommandé","TechOps",0,null,"4","4.3","4.3.1","","4.3.1.6","ANÁLISIS DE CAPACIDAD TÉCNICA\nSe deben evaluar las limitaciones de capacidad de todos los componentes del sistema y se debe documentar el nivel máximo de utilización recomendado, más allá del cual el recurso estará sobreutilizado y se verá afectado el rendimiento de los servicios que utilizan ese recurso.\n\nSe deben identificar los cuellos de botella de la arquitectura y otras debilidades conocidas, junto con la redundancia y capacidad libre.\n\nSe debe registrar y analizar el rendimiento y desempeño actual y pasado, incluyendo comparaciones de logros reales en función de los pronósticos. Esto brindará un panorama de la capacidad del sistema y de la utilización de recursos esperada.\n\nSe puede utilizar el modelado para predecir la utilización de recursos a medida que aumentan los volúmenes. También se debe aplicar el análisis de tendencias (usando el pronóstico del negocio) a un modelo base. También se puede utilizar el modelado del sistema analítico para analizar el rendimiento – por ejemplo, el modelado de los índices de transacciones en base a una configuración determinada del sistema.\n","ISO 20000-1:2011 Sec. 6.5","4.3.1.6.1","¿Está documentado el nivel máximo de utilización recomendado de cada componente?","Informe de capacidad del sistema actual (disco, memoria, CPU por cada componente del sistema)",null,"Recomendado","Recomendado","TechOps",null,null,"4","4.3","4.3.1",null,"4.3.1.6",null,"ISO 20000-1:2011 Sec. 6.5","4.3.1.6.1",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.3.1.6.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.3","4.3.1","","4.3.1.6",null,0,"4.3.1.6.2","4.3.1.6.2: Are architectural bottlenecks and other known weaknesses identified, along with redundancy and spare capacity?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.3","4.3.1","","4.3.1.6",null,null,"4.3.1.6.2","4.3.1.6.2","Are architectural bottlenecks and other known weaknesses identified, along with redundancy and spare capacity?",null,null,"Recommended","Recommended","TechOps",null,null,"4","4.3","4.3.1","","4.3.1.6",0,0,"4.3.1.6.2","les goulets d’étranglement liés à l’architecture du système et les autres points de faiblesse connus sont-ils recensés, ainsi que les redondances et réserves de capacité ?",null,null,"Recommandé","Recommandé","TechOps",0,null,"4","4.3","4.3.1","","4.3.1.6",null,0,"4.3.1.6.2","¿Se identifican los cuellos de botella de la arquitectura y otras debilidades conocidas, junto con la redundancia y capacidad libre?",null,null,"Recomendado","Recomendado","TechOps",null,null,"4","4.3","4.3.1",null,"4.3.1.6",null,0,"4.3.1.6.2",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.3.1.6.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.3","4.3.1","","4.3.1.6",null,0,"4.3.1.6.3","4.3.1.6.3: Is current and past throughput and performance recorded and analysed, including comparisons of actual achievements against forecasts?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.3","4.3.1","","4.3.1.6",null,null,"4.3.1.6.3","4.3.1.6.3","Is current and past throughput and performance recorded and analysed, including comparisons of actual achievements against forecasts?",null,null,"Recommended","Recommended","TechOps",null,null,"4","4.3","4.3.1","","4.3.1.6",0,0,"4.3.1.6.3","Les débits de traitement et performances passés et actuels sont-ils enregistrés et analysés, avec comparaison des résultats effectifs par rapport aux prévisions ?",null,null,"Recommandé","Recommandé","TechOps",0,null,"4","4.3","4.3.1","","4.3.1.6",null,0,"4.3.1.6.3","¿Se registra y analiza el rendimiento y desempeño actual y pasado, incluyendo comparaciones de logros reales en función de los pronósticos?",null,null,"Recomendado","Recomendado","TechOps",null,null,"4","4.3","4.3.1",null,"4.3.1.6",null,0,"4.3.1.6.3",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.3.1.6.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4",0,0,{"$f":"UPPER(CONCATENATE(Introduction!C21,\": \",Introduction!D21))","v":"4.4: INCIDENT AND PROBLEM MANAGEMENT"},null,null,null,null,{"$f":"Introduction!E21","v":"Providers shall set up an incident management process to restore the service within agreed service levels and to investigate root causes of problems"},null,null,null,null,null,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4",null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$21,\": \",Introduction!$L$21))","v":"4.4: INCIDENT AND PROBLEM MANAGEMENT"},null,null,null,null,0,{"$f":"Introduction!$M$21","v":"Providers shall set up an incident management process to restore the service within agreed service levels and to investigate root causes of problems"},null,null,null,null,0,null,null,"4",0,0,null,0,null,0,0,"",null,null,null,null,0,null,null,"4",0,0,{"$f":"UPPER(CONCATENATE(Introduction!$U$21,\": \",Introduction!$V$21))","v":"4.4: GESTIÓN DE INCIDENTES Y PROBLEMAS"},null,null,0,0,{"$f":"Introduction!W21","v":"El proveedor establecerá un proceso de gestión de incidentes para restablecer el servicio conforme a los niveles de servicio acordados e investigará cuál fue la causa raíz del problema"},null,null,null,null,0,null,null,"4",0,0,null,0,null,0,0,null,null,null,null,null,0]
[null,"4","4.4","4.4.1",{"$f":"CHOOSE(LanguageNumber,AY64,BP64,CF64,CV64)","v":"4.4.1: Providers shall set up an incident management process to restore the service within agreed service levels and to investigate root causes of problems"},"4.4.1.1",{"$f":"AZ64&\": \"&CHOOSE(LanguageNumber,BA64,BR64,CH64,CX64)","v":"4.4.1.1: INCIDENT MANAGEMENT\nAn incident management process should be established that can:\n- record and classify incidents (see defnition);\n- analyse and prioritize incidents;\n- resolve and close incidents according to agreed service levels;\n- escalate incidents that have not progressed according to agreed service levels;\n- report to technical and business management on the status and progress of incidents.\n- Establish if there are any patterns in incidents.\n\nThe focus of incident management is on reducing the duration and limiting the consequences of the service issue (e.g. by implementing a workaround) and not on addressing the root cause of the incident.\n\nIncident management will be subject to an operational support period and an SLA - see 4.2.1.3."},{"$f":"BB64","v":"ISO 20000-1:2019 Sec 8.6.1"},{"$f":"BC64","v":"4.4.1.1.1"},{"$f":"BC64&\": \"&CHOOSE(LanguageNumber,BE64,BU64,CK64,DA64)&CarriageReturn","v":"4.4.1.1.1: Are incidents being recorded, analysed, and prioritised?\n"},{"$f":"CHOOSE(LanguageNumber,BF64,BV64,CL64,DB64)","v":"1) Incident management process \n- Check incidents are being recorded, analysed and prioritised.  "},0,{"$f":"CHOOSE(LanguageNumber,BH64,BX64,CN64,DD64)","v":"Urgent Required"},{"$f":"CHOOSE(LanguageNumber,BI64,BY64,CO64,DE64)","v":"Required"},"TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.4","4.4.1","4.4.1: Providers shall set up an incident management process to restore the service within agreed service levels and to investigate root causes of problems","4.4.1.1","INCIDENT MANAGEMENT\nAn incident management process should be established that can:\n- record and classify incidents (see defnition);\n- analyse and prioritize incidents;\n- resolve and close incidents according to agreed service levels;\n- escalate incidents that have not progressed according to agreed service levels;\n- report to technical and business management on the status and progress of incidents.\n- Establish if there are any patterns in incidents.\n\nThe focus of incident management is on reducing the duration and limiting the consequences of the service issue (e.g. by implementing a workaround) and not on addressing the root cause of the incident.\n\nIncident management will be subject to an operational support period and an SLA - see 4.2.1.3.","ISO 20000-1:2019 Sec 8.6.1","4.4.1.1.1","4.4.1.1.1","Are incidents being recorded, analysed, and prioritised?","1) Incident management process \n- Check incidents are being recorded, analysed and prioritised.  ",null,"Urgent Required","Required","TechOps",null,null,"4","4.4","4.4.1","4.4.1: Les prestataires doivent mettre en place un processus de gestion des incidents afin de restaurer le service conformément aux niveaux de service convenus et d’identifier les causes sous-jacentes des problèmes.","4.4.1.1","GESTION DES INCIDENTS\nUne procédure de gestion des incidents doit être mise en place pour :\n- enregistrer et catégoriser les incidents (voir définition) ;\n- analyser et classer les incidents par ordre de priorité ;\n- résoudre et clore les incidents conformément aux niveaux de service convenus;\n- faire remonter les incidents n’ayant pas avancé conformément aux niveaux de service convenus ;\n- communiquer le statut et l'état d'avancement des incidents aux responsables techniques et opérationnels.\n\nLa gestion des incidents a pour but de réduire la durée et les conséquences des problèmes de service (grâce par exemple à la mise en œuvre d’une solution de rechange) et non de résoudre la cause sous-jacente de l’incident.\n\nLa gestion des incidents sera soumise aux horaires de support opérationnel et à une convention de niveau de service – cf. 4.2.1.3.","ISO 20000-1:2019 Sec 8.6.1","4.4.1.1.1","les incidents sont-ils enregistrés, analysés et classés par ordre de priorité ?","1) Processus de gestion des incidents \n- Vérifier que les incidents sont enregistrés, analysés et classés par ordre de priorité. ",null,{"$f":"VLOOKUP($BH64,CategoryTranslationTable,2,FALSE)","v":"Requis Prioritaire"},{"$f":"VLOOKUP($BI64,CategoryTranslationTable,2,FALSE)","v":"Requis"},"TechOps","Selon ITIL 3, un incident est un événement (1) imprévu, (2) qui entraîne une interruption du service ou une détérioration de sa qualité. ITIL définit les principes de base de la gestion des incidents en vue de répondre rapidement aux incidents et de restaurer le service à sa pleine capacité dans les meilleurs délais. Ce qui est important de noter en matière d’incidents est que les interruptions ou réductions programmées du service ne sont pas des incidents. Par exemple, si le service est interrompu pour cause de mise à niveau, sauvegarde ou maintenance, cela ne constitue pas un incident, parce que cette interruption était prévue. En outre, un problème peut être un problème sans être un incident, parce que tant que le problème n’entraîne pas une interruption du service ou une détérioration de sa qualité, il ne forme pas un incident. En d’autres termes, si un problème est découvert avant de causer des perturbations, par définition il ne constitue pas un incident.",null,"4","4.4","4.4.1","4.4.1: Los proveedores deben establecer un proceso de gestión de incidentes para reestablecer el servicio dentro de los niveles de servicio acordados e investigar las principales causas de los problemas","4.4.1.1","GESTIÓN DE INCIDENTES\nSe debe establecer un proceso de gestión de incidentes para:\n- registrar y clasificar los incidentes (ver la definición);\n- analizar y priorizar incidentes;\n- resolver y cerrar incidentes conforme a los niveles de servicio acordados;\n- escalar los incidentes que no hayan progresado conforme a los niveles de servicio acordados;\n- informar a la gerencia técnica y comercial el estado y avance de los incidentes.\n\nEl foco de la gestión de incidentes está puesto en reducir la duración y limitar las consecuencias del problema del servicio (por ej., implementando una solución temporal) y no en resolver la causa principal del incidente.\n\nLa gestión de incidentes estará sujeta a un período de soporte operativo y a un SLA - ver 4.2.1.3.","ISO 20000-1:2019 Sec 8.6.1","4.4.1.1.1","¿Se registran, analizan y priorizan los incidentes?","1) Proceso de gestión de incidentes\n- Verificar que los incidentes sean registrados, analizados y priorizados.  ",null,{"$f":"VLOOKUP($BH64,CategoryTranslationTable,3,FALSE)","v":"Obligatorio urgente"},{"$f":"VLOOKUP($BI64,CategoryTranslationTable,3,FALSE)","v":"Obligatorio"},"TechOps",null,null,"4","4.4","4.4.1",null,"4.4.1.1",null,"ISO 20000-1:2019 Sec 8.6.1","4.4.1.1.1",null,null,null,{"$f":"VLOOKUP($BH64,CategoryTranslationTable,4,FALSE)","v":"ReqU4"},{"$f":"VLOOKUP($BI64,CategoryTranslationTable,4,FALSE)","v":"Req4"},"TechOps",null,null,null,null,null,null,null,null,"4.4.1.1.1",null,null,null,{"$f":"IF(OR($EA64=0,$EA64=2),VLOOKUP(DO64,INDIRECT(ED64),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP64),\"\",VLOOKUP(DP64,INDIRECT(EE64),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ64),\"\",VLOOKUP(DQ64,INDIRECT(EF64),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR64),\"\",VLOOKUP(DR64,INDIRECT(EG64),7,FALSE))","v":""},{"$f":"IF(OR($EA64=0,$EA64=2),VLOOKUP(DO64,INDIRECT(ED64),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP64),\"\",VLOOKUP(DP64,INDIRECT(EE64),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ64),\"\",VLOOKUP(DQ64,INDIRECT(EF64),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR64),\"\",VLOOKUP(DR64,INDIRECT(EG64),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN64,3)=\"NEW\")+2*AND(LEFT(DN64,3)=\"MER\")+3*AND(LEFT(DN64,3)=\"MOV\")+4*AND(LEFT(DN64,3)=\"SWA\")","v":0},{"$error":"#REF!"},{"$f":"IF(EA64=0,IF(DW64=0,\"\",DW64),CHOOSE(EA64,\"New indicator\",CONCATENATE(DW64,CarriageReturn,DX64,CarriageReturn,DY64,CarriageReturn,DZ64)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO64,1)","v":"OriginalComplianceP4"},{"$f":"\"OriginalComplianceP\"&LEFT(DP64,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ64,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR64,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,""]
[null,"4","4.4","4.4.1",null,"4.4.1.1",null,null,{"$f":"BC65","v":"4.4.1.1.2"},"4.4.1.1.2: Are incidents which have not progressed according to agreed service levels being escalated?\n",{"$f":"CHOOSE(LanguageNumber,BF65,BV65,CL65,DB65)","v":"1) Incident management process\n- Check that incidents which are not closed within SLA have been escalated according to the incident management process."},0,{"$f":"CHOOSE(LanguageNumber,BH65,BX65,CN65,DD65)","v":"Urgent Required"},{"$f":"CHOOSE(LanguageNumber,BI65,BY65,CO65,DE65)","v":"Required"},"TechOps",{"$f":"CHOOSE(LanguageNumber,BK65,CA65,CQ65,DG65)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.4","4.4.1",null,"4.4.1.1",null,null,"4.4.1.1.2",{"$f":"DO65","v":"4.4.1.1.3"},"Are incidents which have not progressed according to agreed service levels being escalated?","1) Incident management process\n- Check that incidents which are not closed within SLA have been escalated according to the incident management process.",null,"Urgent Required","Required","TechOps",null,null,"4","4.4","4.4.1",null,"4.4.1.1",null,null,"4.4.1.1.2","les incidents ne progressant pas conformément aux niveaux de service convenus sont-ils remontés ?","1) Processus de gestion des incidents\n- Vérifier que les incidents ne progressant pas conformément aux niveaux de service convenus sont remontés selon les exigences du processus de gestion des incidents. ",null,"Requis Prioritaire","Requis","TechOps",0,null,"4","4.4","4.4.1",null,"4.4.1.1",null,null,"4.4.1.1.2","¿Se escalan los incidentes que no avanzan conforme al nivel de servicio acordado?","1) Proceso de gestión de incidentes\n- Verificar que los incidentes que no hayan sido cerrados dentro del SLA hayan sido escalados conforme al proceso de gestión de incidentes.",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"4","4.4","4.4.1",null,"4.4.1.1",null,null,"4.4.1.1.2",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"4.4.1.1.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.4","4.4.1",0,"4.4.1.1",null,{"$f":"BB66","v":0},{"$f":"BC66","v":"4.4.1.1.3"},"4.4.1.1.3: Are incidents being resolved and closed according to agreed service levels?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.4","4.4.1",null,"4.4.1.1",null,null,"4.4.1.1.3","4.4.1.1.2","Are incidents being resolved and closed according to agreed service levels?",null,null,"Recommended","Recommended","TechOps",null,null,"4","4.4","4.4.1",0,"4.4.1.1",0,0,"4.4.1.1.3","les incidents sont-ils résolus et clos conformément aux niveaux de service convenus ?",null,null,"Recommandé","Recommandé","TechOps",0,null,"4","4.4","4.4.1",null,"4.4.1.1",null,0,"4.4.1.1.3","¿Los incidentes son resueltos y cerrados conforme a los niveles de servicio acordados?",null,null,"Recomendado","Recomendado","TechOps",null,null,"4","4.4","4.4.1",null,"4.4.1.1",null,0,"4.4.1.1.3",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.4.1.1.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.4","4.4.1",0,"4.4.1.1",null,0,"4.4.1.1.4","4.4.1.1.4: Are reports generated on the status and progress of incidents and provided regularly to technical and business management?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.4","4.4.1",null,"4.4.1.1",null,null,"4.4.1.1.4","4.4.1.1.4","Are reports generated on the status and progress of incidents and provided regularly to technical and business management?",null,null,"Recommended","Recommended","TechOps",null,null,"4","4.4","4.4.1",0,"4.4.1.1",0,0,"4.4.1.1.4","des rapports sur le statut et l'état d'avancement des incidents sont-ils établis et communiqués régulièrement aux responsables techniques et opérationnels ?",null,null,"Recommandé","Recommandé","TechOps",0,null,"4","4.4","4.4.1",null,"4.4.1.1",null,0,"4.4.1.1.4","¿Se generan periódicamente informes sobre el estado y avance de los incidentes a la gerencia técnica y comercial?",null,null,"Recomendado","Recomendado","TechOps",null,null,"4","4.4","4.4.1",null,"4.4.1.1",null,0,"4.4.1.1.4",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.4.1.1.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.4","4.4.1","","4.4.1.2","4.4.1.2: SERVICE REQUEST MANAGEMENT\nService requests (see definition) are routine requests that require action by the technical operations team. \n\nThe service request management process should:\n- record and classify service requests;\n- implement and close service requests according to agreed service levels;\n- escalate service requests which have not progressed according to agreed service levels;\n- report to technical and business management on the status and progress of service requests.","ISO 20000-1:2011 Sec. 8.1\nITIL 3","4.4.1.2.1","4.4.1.2.1: Has a service request process been implemented (see definition)?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.4","4.4.1","","4.4.1.2","SERVICE REQUEST MANAGEMENT\nService requests (see definition) are routine requests that require action by the technical operations team. \n\nThe service request management process should:\n- record and classify service requests;\n- implement and close service requests according to agreed service levels;\n- escalate service requests which have not progressed according to agreed service levels;\n- report to technical and business management on the status and progress of service requests.","ISO 20000-1:2011 Sec. 8.1\nITIL 3","4.4.1.2.1","4.4.1.2.1","Has a service request process been implemented (see definition)?",null,null,"Recommended","Recommended","TechOps",null,null,"4","4.4","4.4.1","","4.4.1.2","GESTION DES DEMANDES DE MODIFICATION\nLes demandes de modification (voir définition) sont des demandes de routine nécessitant l’intervention de l’équipe technique. \n\nLe processus de gestion des demandes de modification doit :\n- enregistrer et catégoriser les demandes de modification ;\n- traiter et clore les demandes de modification conformément aux niveaux de service convenus ;\n- faire remonter les demandes de modification qui n’ont pas progressé conformément aux niveaux de service convenus ;\n- communiquer le statut et l'état d’avancement des demandes de modification aux responsables techniques et opérationnels.","ISO 20000-1:2011 Sec. 8.1\nITIL 3","4.4.1.2.1","existe-t-il un processus de demande de service (cf. définition) ?",null,null,"Recommandé","Recommandé","TechOps","Les demandes de modification sont des demandes formelles soumises par des utilisateurs pour cetains type de changement de service ou de configuration.",null,"4","4.4","4.4.1","","4.4.1.2","GESTIÓN DE SOLICITUDES DE SERVICIO\nLas solicitudes de servicio (ver definición) son solicitudes de rutina que requieren una acción por parte del equipo de operaciones técnicas. \n\nEl proceso de gestión de solicitudes de servicio debe:\n- registrar y clasificar solicitudes de servicio;\n- implementar y cerrar solicitudes de servicio conforme a los niveles de servicio acordados;\n- escalar las solicitudes de servicio que no hayan avanzado conforme a los niveles de servicio acordados;\n- informar a la gerencia técnica y comercial el estado y avance de las solicitudes de servicio.","ISO 20000-1:2011 Sec. 8.1\nITIL 3","4.4.1.2.1","¿Se implementó un proceso de solicitudes de servicio (ver definición)?",null,null,"Recomendado","Recomendado","TechOps",null,null,"4","4.4","4.4.1",null,"4.4.1.2",null,"ISO 20000-1:2011 Sec. 8.1\nITIL 3","4.4.1.2.1",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.4.1.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.4","4.4.1","","4.4.1.2",null,0,"4.4.1.2.2","4.4.1.2.2: Are service requests being implemented and closed according to agreed service levels (and escalated if necessary)?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.4","4.4.1","","4.4.1.2",null,null,"4.4.1.2.2",{"$f":"DO69","v":"4.4.1.2.2"},"Are service requests being implemented and closed according to agreed service levels (and escalated if necessary)?",null,null,"Recommended","Recommended","TechOps",null,null,"4","4.4","4.4.1","","4.4.1.2",0,0,"4.4.1.2.2","les demandes de modification sont-elles traitées et closes conformément aux niveaux de service convenus (et remontées si nécessaire) ?",null,null,"Recommandé","Recommandé","TechOps",0,null,"4","4.4","4.4.1","",{"$f":"$AZ69","v":"4.4.1.2"},null,0,"4.4.1.2.2","¿Las solicitudes de servicio son implementadas y cerradas conforme a los niveles de servicio acordados (y escaladas si fuese necesario)?",null,null,"Recomendado","Recomendado","TechOps",null,null,"4","4.4","4.4.1",null,"4.4.1.2",null,0,"4.4.1.2.2",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.4.1.2.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$f":"IF(EA69=0,DS69,EN69)","v":{"$error":"#REF!"}},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,{"$f":"COUNTIF($DO69:$DR69,\"*?\")","v":1},""]
[null,{"$f":"$AV70","v":"4"},{"$f":"$AW70","v":"4.4"},{"$f":"$AX70","v":"4.4.1"},"",{"$f":"AZ70","v":"4.4.1.2"},null,0,"4.4.1.2.3","4.4.1.2.3: Are reports generated on the status and progress of service requests and provided regularly to technical and business management?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.4","4.4.1","","4.4.1.2",null,null,"4.4.1.2.3","4.4.1.2.3","Are reports generated on the status and progress of service requests and provided regularly to technical and business management?",null,null,"Recommended","Recommended",{"$f":"$O70","v":"TechOps"},null,null,{"$f":"$AV70","v":"4"},{"$f":"$AW70","v":"4.4"},{"$f":"$AX70","v":"4.4.1"},"",{"$f":"$AZ70","v":"4.4.1.2"},0,{"$f":"$BB70","v":0},{"$f":"$BC70","v":"4.4.1.2.3"},"des rapports sur le statut et l'état d'avancement des demandes de modification sont-ils établis et communiqués régulièrement aux responsables techniques et opérationnels ?",null,null,"Recommandé","Recommandé",{"$f":"$O70","v":"TechOps"},0,null,{"$f":"$AV70","v":"4"},{"$f":"$AW70","v":"4.4"},{"$f":"$AX70","v":"4.4.1"},"","4.4.1.2",null,0,{"$f":"$BC70","v":"4.4.1.2.3"},"¿Se generan periódicamente informes sobre el estado y avance de las solicitudes de servicio a la gerencia técnica y comercial?",null,null,"Recomendado","Recomendado",{"$f":"$O70","v":"TechOps"},null,null,{"$f":"$AV70","v":"4"},{"$f":"$AW70","v":"4.4"},{"$f":"$AX70","v":"4.4.1"},null,{"$f":"$AZ70","v":"4.4.1.2"},null,0,{"$f":"$BC70","v":"4.4.1.2.3"},null,null,null,"Rec4","Rec4",{"$f":"$O70","v":"TechOps"},null,null,null,null,null,null,null,null,"4.4.1.2.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.4","4.4.1","","4.4.1.3","4.4.1.3: PROBLEM MANAGEMENT\nProblem management differs from incident management in that it deals with underlying issues that may or may not directly affect the user (see definition). The aim of incident management is to restore the service to the user as quickly as possible, often through a workaround, while the aim of problem management is to try to find a permanent solution to the problem.\n\nProviders should establish a problem management process to minimize service disruption by:\n- identifying, recording, and classifying problems proactively and reactively;\n- analysing and prioritizing problems;\n- resolving and closing problems according to agreed service levels;\n- escalating problems which have not progressed according to agreed service levels;\n- minimizing the effect of unresolved problems through workarounds and other solutions; and\n- communicating the status and progress of problem resolution to technical and business management.\n\nThe service level for resolving problems is often stated as a \"number of outstanding problems\" rather than a resolution time, as some problems can take a long time to solve. The number of outstanding problems should not grow over time.","ISO 20000-1:2019 Sec 8.6.3\nITIL","4.4.1.3.1","4.4.1.3.1: Are problems (see definition) being identified, recorded and prioritised?\n","1) Documented problem management process \n- Check the process requires problems to be:\na) Identified\nb) Recorded \nc) Prioritised\n- Check the log to see if the process implemented\n\n\n",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.4","4.4.1","","4.4.1.3","PROBLEM MANAGEMENT\nProblem management differs from incident management in that it deals with underlying issues that may or may not directly affect the user (see definition). The aim of incident management is to restore the service to the user as quickly as possible, often through a workaround, while the aim of problem management is to try to find a permanent solution to the problem.\n\nProviders should establish a problem management process to minimize service disruption by:\n- identifying, recording, and classifying problems proactively and reactively;\n- analysing and prioritizing problems;\n- resolving and closing problems according to agreed service levels;\n- escalating problems which have not progressed according to agreed service levels;\n- minimizing the effect of unresolved problems through workarounds and other solutions; and\n- communicating the status and progress of problem resolution to technical and business management.\n\nThe service level for resolving problems is often stated as a \"number of outstanding problems\" rather than a resolution time, as some problems can take a long time to solve. The number of outstanding problems should not grow over time.","ISO 20000-1:2019 Sec 8.6.3\nITIL","4.4.1.3.1","4.4.1.3.1","Are problems (see definition) being identified, recorded and prioritised?","1) Documented problem management process \n- Check the process requires problems to be:\na) Identified\nb) Recorded \nc) Prioritised\n- Check the log to see if the process implemented\n\n\n",null,"Standard Required","Required","TechOps",null,null,"4","4.4","4.4.1","","4.4.1.3","GESTION DES PROBLÈMES\nLa gestion des problèmes diffère de la gestion des incidents au sens où elle concerne les problèmes sous-jacents susceptibles ou non d’affecter directement les utilisateurs (voir définition). La gestion des incidents a pour but de restaurer le plus rapidement possible le service aux utilisateurs, souvent grâce à une solution de rechange, tandis que la gestion des problèmes a pour but de trouver une solution permanente aux problèmes.\n\nLes prestataires doivent mettre en place un processus de gestion des problèmes en vue de minimiser les perturbations du service :\n- en identifiant, enregistrant et catégorisant les problèmes de façon proactive et réactive ;\n- en analysant et en classant les problèmes par ordre de priorité ;\n- en résolvant et clôturant les problèmes conformément aux niveaux de service convenus ;\n- en faisant remonter les problèmes n’ayant pas avancé conformément aux niveaux de service convenus ;\n- en minimisant l’impact des problèmes non résolus à travers des solutions de rechange ;\n- en communiquant le statut et l’avancement des problèmes aux responsables techniques et opérationnels.\n\nLe niveau de service en matière de résolution de problèmes est souvent exprimé sous forme du « nombre de problèmes en cours de résolution » plutôt qu’en termes de délai de résolution, car certains problèmes peuvent être longs à résoudre. Le nombre de problèmes en instance ne doit pas augmenter dans le temps.","ISO 20000-1:2019 Sec 8.6.3\nITIL","4.4.1.3.1","les problèmes (voir définition) sont-ils identifiés, enregistrés et classés par ordre de priorité  ?","1) Processus documenté de gestion des incidents \n- Vérifier que le processus inclut l’obligation :\na) D’identifier\nb) D’enregistrer \nc) De classer par ordre de priorité\nles problèmes - Vérifier les registres afin de s’assurer que le processus est mis en place\n\n\n",null,"Requis Normal","Requis","TechOps","La gestion des problèmes diffère de la gestion des incidents au sens où elle concerne les problèmes sous-jacents susceptibles ou non d’affecter  les utilisateurs. À la différence de la gestion des incidents, qui a pour but de restaurer le plus rapidement possible le service aux utilisateurs (souvent par le biais d'une solution de rechange), la gestion des problèmes a pour but de trouver des solutions permanentes.",null,"4","4.4","4.4.1","","4.4.1.3","GESTIÓN DE PROBLEMAS\nLa gestión de problemas difiere de la gestión de incidentes en que trata los problemas subyacentes que podrían, o no, afectar directamente al usuario (ver definición). El objetivo de la gestión de incidentes es reestablecer el servicio al usuario lo más rápido posible, generalmente mediante una solución temporal, mientras que el objetivo de la gestión de problemas es intentar encontrar una solución permanente al problema.\n\nLos proveedores deben establecer un proceso de gestión de problemas para minimizar la interrupción del servicio al:\n- identificar, registrar y clasificar los problemas en forma proactiva y reactiva;\n- analizar y priorizar los problemas;\n- resolver y cerrar problemas conforme a los niveles de servicio acordados;\n- escalar los problemas que no hayan avanzado conforme a los niveles de servicio acordados;\n- minimizar el efecto de los problemas sin resolver mediante soluciones temporales y otras soluciones; y\n- comunicar el estado y avance de la resolución del problema a la gerencia técnica y comercial.\n\nPor lo general, el nivel de servicio para la resolución de problemas se establece como una \"cantidad de problemas pendientes\" en lugar del tiempo de resolución, ya que algunos problemas pueden tardar mucho tiempo en ser resueltos. La cantidad de problemas pendientes no debe aumentar con el tiempo.","ISO 20000-1:2019 Sec 8.6.3\nITIL","4.4.1.3.1","¿Se identifican, registran y priorizan los problemas (ver definición)?","1) Proceso de gestión de problemas documentado\n- Verificar que el proceso requiera que los problemas sean:\na) Identificados\nb) Registrados\nc) Priorizados\n- Verificar el registro para ver si se implementó el proceso\n\n\n",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"4","4.4","4.4.1",null,"4.4.1.3",null,"ISO 20000-1:2019 Sec 8.6.3\nITIL","4.4.1.3.1",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"4.4.1.3.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.4","4.4.1","","4.4.1.3",null,0,"4.4.1.3.2","4.4.1.3.2: Are problems being resolved and closed according to agreed service levels?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.4","4.4.1","","4.4.1.3",null,null,"4.4.1.3.2","4.4.1.3.2","Are problems being resolved and closed according to agreed service levels?",null,null,"Recommended","Recommended","TechOps",null,null,"4","4.4","4.4.1","","4.4.1.3",0,0,"4.4.1.3.2","les problèmes sont-ils résolus et clos conformément aux niveaux de service convenus ?",null,null,"Recommandé","Recommandé","TechOps",0,null,"4","4.4","4.4.1","","4.4.1.3",null,0,"4.4.1.3.2","¿Los problemas son resueltos y cerrados conforme a los niveles de servicio acordados?",null,null,"Recomendado","Recomendado","TechOps",null,null,"4","4.4","4.4.1",null,"4.4.1.3",null,0,"4.4.1.3.2",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.4.1.3.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",{"$f":"COUNTIF($DS72:$DV72,EH$3)","v":0},0,0,0,0,1,""]
[null,"4","4.4","4.4.1","","4.4.1.3",null,0,"4.4.1.3.3","4.4.1.3.3: Are problems which have not progressed according to agreed service levels being escalated?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.4","4.4.1","","4.4.1.3",null,null,"4.4.1.3.3","4.4.1.3.3","Are problems which have not progressed according to agreed service levels being escalated?",null,null,"Recommended","Recommended","TechOps",null,null,"4","4.4","4.4.1","","4.4.1.3",0,0,"4.4.1.3.3","les problèmes ne progressant pas conformément aux niveaux de service convenus sont-ils remontés ?",null,null,"Recommandé","Recommandé","TechOps",0,null,"4","4.4","4.4.1","","4.4.1.3",null,0,"4.4.1.3.3","¿Se escalan los problemas que no avanzan conforme a los niveles de servicio acordados?",null,null,"Recomendado","Recomendado","TechOps",null,null,"4","4.4","4.4.1",null,"4.4.1.3",null,0,"4.4.1.3.3",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.4.1.3.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.4","4.4.1","","4.4.1.3",null,0,"4.4.1.3.4","4.4.1.3.4: Is the status and progress of problem resolution being communicated to technical and business management?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.4","4.4.1","","4.4.1.3",null,null,"4.4.1.3.4","4.4.1.3.4","Is the status and progress of problem resolution being communicated to technical and business management?",null,null,"Recommended","Recommended","TechOps",null,null,"4","4.4","4.4.1","","4.4.1.3",0,0,"4.4.1.3.4","le statut et l'état d'avancement de la résolution des problèmes sont-ils communiqués aux responsables techniques et opérationnels ?",null,null,"Recommandé","Recommandé","TechOps",0,null,"4","4.4","4.4.1","","4.4.1.3",null,0,"4.4.1.3.4","¿Se comunica el estado y avance de la resolución de los problemas a la gerencia técnica y comercial?",null,null,"Recomendado","Recomendado","TechOps",null,null,"4","4.4","4.4.1",null,"4.4.1.3",null,0,"4.4.1.3.4",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.4.1.3.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4",0,0,{"$f":"UPPER(CONCATENATE(Introduction!C22,\": \",Introduction!D22))","v":"4.5: CHANGE AND CONFIGURATION MANAGEMENT"},null,null,null,null,{"$f":"Introduction!E22","v":"Providers shall develop processes to ensure that systems and applications remain robust and secure following system and configuration changes"},null,null,null,null,null,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4",null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$22,\": \",Introduction!$L$22))","v":"4.5: CHANGE AND CONFIGURATION MANAGEMENT"},null,null,null,null,0,{"$f":"Introduction!$M$22","v":"Providers shall develop processes to ensure that systems and applications remain robust and secure following system and configuration changes"},null,null,null,null,0,null,null,"4",0,0,null,0,null,0,0,"",null,null,null,null,0,null,null,"4",0,0,{"$f":"UPPER(CONCATENATE(Introduction!$U$22,\": \",Introduction!$V$22))","v":"4.5: GESTIÓN DE CAMBIOS Y CONFIGURACIÓN"},null,null,{"$f":"$BB75","v":0},0,{"$f":"Introduction!W22","v":"El proveedor establecerá procesos para garantizar la robustez y seguridad de los sistemas y las aplicaciones, después de cualquier cambio al sistema y configuración"},null,null,null,null,0,null,null,"4",0,0,null,0,null,{"$f":"$BB75","v":0},0,null,null,null,null,null,0]
[null,"4","4.5","4.5.1",{"$f":"CHOOSE(LanguageNumber,AY76,BP76,CF76,CV76)","v":"4.5.1: Providers shall develop processes to ensure that systems and applications remain robust and secure following system and configuration changes"},"4.5.1.1",{"$f":"AZ76&\": \"&CHOOSE(LanguageNumber,BA76,BR76,CH76,CX76)","v":"4.5.1.1: GATED PROJECT MANAGEMENT PROCESS\nProposed changes to the mobile money service should be managed by a gated project management process to ensure that requirements, design and implementation of the service change are fully considered and documented and approved. The process should cover both technical system changes and business process changes. \n\nThe gated project management process should include:\n- Requirements definition, including expected outcomes from the changed service, expressed in measurable terms;\n- Impact assessment, which should seek inputs from some or all of the following functions: Technical development, Business operations, Technical operations, Customer service, Agent management, Financial operations, AML/CFT/Fraud management;\n- Planning - timescales, risks and dependencies for the project;\n- Design - changes to processes, training, technical systems, reporting, SLAs and third party arrangements;\n- Costing - financial and human resources (including training);\n- Development and implementation (change release management for technical changes - see 4.5.1.3);\n- Testing and acceptance criteria (see 4.5.1.4);\n- Internal and external communication of the service changes;\n- Approval from management and all relevant functions."},{"$f":"BB76","v":"ISO 20000-1:2019 Sec 8.5"},{"$f":"BC76","v":"4.5.1.1.1"},{"$f":"BC76&\": \"&CHOOSE(LanguageNumber,BE76,BU76,CK76,DA76)&CarriageReturn","v":"4.5.1.1.1: Is there a formal gated project management process for managing changes to the mobile money service (both technical and commercial changes)?\n"},{"$f":"CHOOSE(LanguageNumber,BF76,BV76,CL76,DB76)","v":"1) Project management process/plan or product development process\n-  Check there is a documented gated project management process for making changes to the mobile money service.\n- Check the process covers both technical and business changes."},0,{"$f":"CHOOSE(LanguageNumber,BH76,BX76,CN76,DD76)","v":"Urgent Required"},{"$f":"CHOOSE(LanguageNumber,BI76,BY76,CO76,DE76)","v":"Required"},"BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.5","4.5.1","4.5.1: Providers shall develop processes to ensure that systems and applications remain robust and secure following system and configuration changes","4.5.1.1","GATED PROJECT MANAGEMENT PROCESS\nProposed changes to the mobile money service should be managed by a gated project management process to ensure that requirements, design and implementation of the service change are fully considered and documented and approved. The process should cover both technical system changes and business process changes. \n\nThe gated project management process should include:\n- Requirements definition, including expected outcomes from the changed service, expressed in measurable terms;\n- Impact assessment, which should seek inputs from some or all of the following functions: Technical development, Business operations, Technical operations, Customer service, Agent management, Financial operations, AML/CFT/Fraud management;\n- Planning - timescales, risks and dependencies for the project;\n- Design - changes to processes, training, technical systems, reporting, SLAs and third party arrangements;\n- Costing - financial and human resources (including training);\n- Development and implementation (change release management for technical changes - see 4.5.1.3);\n- Testing and acceptance criteria (see 4.5.1.4);\n- Internal and external communication of the service changes;\n- Approval from management and all relevant functions.","ISO 20000-1:2019 Sec 8.5","4.5.1.1.1","4.5.1.1.1","Is there a formal gated project management process for managing changes to the mobile money service (both technical and commercial changes)?","1) Project management process/plan or product development process\n-  Check there is a documented gated project management process for making changes to the mobile money service.\n- Check the process covers both technical and business changes.",null,"Urgent Required","Required","BizOps",null,null,"4","4.5","4.5.1","4.5.1: Les prestataires doivent mettre en place des processus permettant de s’assurer que les systèmes ou les applications restent robustes et sûrs à la suite de changements de système ou de configuration.","4.5.1.1","PROCESSUS FORMEL DE GESTION DE PROJET\nLes changements prévus du service d’argent mobile doivent être gérés dans le cadre d’un processus formel de gestion de projet garantissant que le cahier des charges, la conception et la mise en œuvre de la modification du service sont dûment étudiés, documentés et approuvés. Ce processus doit couvrir à la fois les changements apportés au système technique et ceux concernant les processus commerciaux.\n\nLe processus formel de gestion de projet doit couvrir :\n- la définition du cahier des charges, y compris les résultats attendus de la modification du service, exprimés sous une forme quantifiable ;\n- l’étude d'impact, qui doit collecter les informations auprès de tout ou partie des fonctions suivantes : développement technique, exploitation, opérations techniques, service client, gestion des agents, opérations financières, gestion AML/CFT et lutte contre la fraude ;\n- le calendrier - délais, risques et dépendances du projet ;\n- la conception - modification des processus, formations, systèmes techniques, rapports, conventions de niveau de service et accords avec des tiers ;\n- les coûts - ressources financières et humaines (formation comprise) ;\n- le développement et la mise en œuvre (gestion de la mise en production des changements pour les modifications techniques – cf. 4.5.1.3) ;\n- les tests et critères d’acceptation (cf. 4.5.1.4);\n- la communication interne et externe des changements dans le service ;\n- l'approbation de la direction et de l'ensemble des fonctions concernées.","ISO 20000-1:2019 Sec 8.5","4.5.1.1.1","existe-t-il un processus formel de gestion de projet pour la gestion des changements apportés au service d'argent mobile (qu’ils soient de nature commerciale ou technique) ?","1) Processus/plan de gestion de projet ou processus de développement des produits\n- Vérifier qu’un processus formel documenté de gestion de projet a été mis en place pour apporter des changements au service d’argent mobile \n- Vérifier que le processus concerne à la fois les changements techniques et opérationnels.",null,{"$f":"VLOOKUP($BH76,CategoryTranslationTable,2,FALSE)","v":"Requis Prioritaire"},{"$f":"VLOOKUP($BI76,CategoryTranslationTable,2,FALSE)","v":"Requis"},"BizOps",0,null,"4","4.5","4.5.1","4.5.1: Los proveedores deben desarrollar procesos para garantizar que los sistemas y las aplicaciones sigan siendo robustas y seguras después de la realización de cambios al sistema y a las configuraciones","4.5.1.1","PROCESO DE GESTIÓN DE PROYECTOS POR ETAPAS\nLos cambios propuestos al servicio del dinero móvil deben ser gestionados mediante un proceso de gestión de proyectos por etapas para garantizar la completa consideración, documentación y aprobación de los requisitos, el diseño y la implementación del cambio del servicio. El proceso debe cubrir cambios a los sistemas técnicos y cambios a los procesos comerciales.\n\nEl proceso de gestión de proyectos por etapas debe incluir:\n- Definición de requisitos, incluyendo los resultados esperados del servicio modificado, expresados en términos mensurables;\n- Evaluación de impactos, que debe recabar aportes de todas o algunas de las siguientes funciones: Desarrollo técnico, Operaciones comerciales, Operaciones técnicas, Atención al cliente, Gestión de agentes, Operaciones financieras, ALA/CFT/Gestión de fraude;\n- Planificación, plazos, riesgos y dependencias para el proyecto;\n- Diseño - cambios a los procesos, capacitación, sistemas técnicos, generación de informes, SLA y acuerdos con terceros;\n- Costos - recursos financieros y humanos (incluyendo capacitación);\n- Desarrollo e implementación (gestión de cambio de versiones para cambios técnicos - ver 4.5.1.3);\n- Realización de pruebas y criterios de aceptación (ver 4.5.1.4);\n- Comunicación interna y externa de los cambios al servicio;\n- Aprobación de la gerencia y de todas las funciones relevantes.","ISO 20000-1:2019 Sec 8.5","4.5.1.1.1","¿Existe un proceso de gestión de proyectos por etapas formal para gestionar los cambios al servicio del dinero móvil (cambios técnicos y comerciales)?","1) Proceso/plan de gestión de proyectos o proceso de desarrollo de productos \n-  Verificar que exista un proceso de gestión de proyectos por etapas documentado para realizar cambios al servicio del dinero móvil.\n- Verificar que el proceso cubra cambios técnicos y comerciales",null,{"$f":"VLOOKUP($BH76,CategoryTranslationTable,3,FALSE)","v":"Obligatorio urgente"},{"$f":"VLOOKUP($BI76,CategoryTranslationTable,3,FALSE)","v":"Obligatorio"},"BizOps",null,null,"4","4.5","4.5.1",null,"4.5.1.1",null,"ISO 20000-1:2019 Sec 8.5","4.5.1.1.1",null,null,null,{"$f":"VLOOKUP($BH76,CategoryTranslationTable,4,FALSE)","v":"ReqU4"},{"$f":"VLOOKUP($BI76,CategoryTranslationTable,4,FALSE)","v":"Req4"},"BizOps",null,null,null,null,null,null,null,"MERGE","4.5.1.1.1","4.5.1.1.3",null,null,{"$f":"IF(OR($EA76=0,$EA76=2),VLOOKUP(DO76,INDIRECT(ED76),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP76),\"\",VLOOKUP(DP76,INDIRECT(EE76),7,FALSE))","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DQ76),\"\",VLOOKUP(DQ76,INDIRECT(EF76),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR76),\"\",VLOOKUP(DR76,INDIRECT(EG76),7,FALSE))","v":""},{"$f":"IF(OR($EA76=0,$EA76=2),VLOOKUP(DO76,INDIRECT(ED76),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP76),\"\",VLOOKUP(DP76,INDIRECT(EE76),8,FALSE))","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DQ76),\"\",VLOOKUP(DQ76,INDIRECT(EF76),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR76),\"\",VLOOKUP(DR76,INDIRECT(EG76),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN76,3)=\"NEW\")+2*AND(LEFT(DN76,3)=\"MER\")+3*AND(LEFT(DN76,3)=\"MOV\")+4*AND(LEFT(DN76,3)=\"SWA\")","v":2},{"$f":"IF(EA76=0,DS76,EN76)","v":""},{"$f":"IF(EA76=0,IF(DW76=0,\"\",DW76),CHOOSE(EA76,\"New indicator\",CONCATENATE(DW76,CarriageReturn,DX76,CarriageReturn,DY76,CarriageReturn,DZ76)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO76,1)","v":"OriginalComplianceP4"},{"$f":"\"OriginalComplianceP\"&LEFT(DP76,1)","v":"OriginalComplianceP4"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ76,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR76,1)","v":"OriginalComplianceP"},0,0,0,0,0,2,""]
[null,"4","4.5","4.5.1",0,"4.5.1.1",null,0,"4.5.1.1.2","4.5.1.1.2: Does the gated project management process ensure that all changes are clearly defined, planned & documented in advance?\n","1) Project management process/plan or product development process\n-  Check that the gated project management process ensures that all changes are clearly defined, planned & documented in advance.\n- Check that the next update to the service is documented and planned.",0,"Standard Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.5","4.5.1",null,"4.5.1.1",null,null,"4.5.1.1.2","4.5.1.1.4","Does the gated project management process ensure that all changes are clearly defined, planned & documented in advance?","1) Project management process/plan or product development process\n-  Check that the gated project management process ensures that all changes are clearly defined, planned & documented in advance.\n- Check that the next update to the service is documented and planned.",null,"Standard Required","Required","BizOps",null,null,"4","4.5","4.5.1",0,"4.5.1.1",0,0,"4.5.1.1.2","Le processus formel de gestion de projet permet-il de s'assurer que tous les changements sont clairement définis, planifiés et documentés à l’avance ?","1) Processus/plan de gestion de projet ou processus de développement des produits\n- Vérifier que le processus formel de gestion de projet permet de s'assurer que tous les changements sont clairement définis, planifiés et documentés à l’avance \n- Vérifier que la prochaine mise à jour du service est documentée et planifiée.",null,"Requis Normal","Requis","BizOps",0,null,"4","4.5","4.5.1",null,"4.5.1.1",null,0,"4.5.1.1.2","¿El proceso de gestión de proyectos por etapas garantiza que todos los cambios estén claramente definidos, planificados y documentados de antemano?","1) Proceso/plan de gestión de proyectos o proceso de desarrollo de productos \n-  Verificar que el proceso de gestión de proyectos por etapas garantice que todos los cambios estén claramente definidos, planificados y documentados de antemano.\n- Verificar que se documente y planifique la próxima actualización del servicio.",null,"Obligatorio estándar","Obligatorio","BizOps",null,null,"4","4.5","4.5.1",null,"4.5.1.1",null,0,"4.5.1.1.2",null,null,null,"ReqS4","Req4","BizOps",null,null,null,null,null,null,null,null,"4.5.1.1.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.5","4.5.1",0,"4.5.1.1",null,0,"4.5.1.1.3","4.5.1.1.3: Does the gated project management process require input and approval from all relevant mobile money functions?\n","1) Project management process/plan or product development process\n-  Check the gated project management process includes input and approval from all relevant mobile money functions.",0,"Standard Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.5","4.5.1",null,"4.5.1.1",null,null,"4.5.1.1.3","4.5.1.1.5","Does the gated project management process require input and approval from all relevant mobile money functions?","1) Project management process/plan or product development process\n-  Check the gated project management process includes input and approval from all relevant mobile money functions.",null,"Standard Required","Required","BizOps",null,null,"4","4.5","4.5.1",0,"4.5.1.1",0,0,"4.5.1.1.3","le processus formel de gestion de projet prévoit-il la participation et l’accord de toutes les fonctions concernées au sein de l’activité d’argent mobile ?","1) Processus/plan de gestion de projet ou processus de développement des produits\n- Vérifier que le processus formel de gestion de projet prévoit la participation et l’accord de toutes les fonctions concernées au sein de l’activité d’argent mobile",null,"Requis Normal","Requis","BizOps",0,null,"4","4.5","4.5.1",null,"4.5.1.1",null,0,"4.5.1.1.3","¿El proceso de gestión de proyectos por etapas requiere aportes y aprobación de todas las funciones relevantes del dinero móvil?","1) Proceso/plan de gestión de proyectos o proceso de desarrollo de productos\n-  Verificar que el proceso de gestión de proyectos por etapas incluya aportes y aprobación de todas las funciones relevantes del dinero móvil",null,"Obligatorio estándar","Obligatorio","BizOps",null,null,"4","4.5","4.5.1",null,"4.5.1.1",null,0,"4.5.1.1.3",null,null,null,"ReqS4","Req4","BizOps",null,null,null,null,null,null,null,null,"4.5.1.1.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.5","4.5.1","","4.5.1.1",null,0,"4.5.1.1.4","4.5.1.1.4: When designing and planning changes to the mobile money service, are changes to processes considered for all functions?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.5","4.5.1","","4.5.1.1",null,null,"4.5.1.1.4","4.5.1.1.6","When designing and planning changes to the mobile money service, are changes to processes considered for all functions?",null,null,"Recommended","Recommended","BizOps",null,null,"4","4.5","4.5.1","","4.5.1.1",0,0,"4.5.1.1.4","lors de la conception et de la planification des changements apportés au service d’argent mobile, la modification des processus et politiques est-elle prise en compte pour l’ensemble des fonctions ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"4","4.5","4.5.1","","4.5.1.1",null,0,"4.5.1.1.4","Al diseñar y planificar los cambios al servicio del dinero móvil, ¿se tienen en cuenta los cambios a los procesos para todas las funciones?",null,null,"Recomendado","Recomendado","BizOps",null,null,"4","4.5","4.5.1",null,"4.5.1.1",null,0,"4.5.1.1.4",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"4.5.1.1.6",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.5","4.5.1","","4.5.1.1",null,0,"4.5.1.1.5","4.5.1.1.5: When designing and planning changes to the mobile money service, are changes to reporting requirements considered for all functions?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.5","4.5.1","","4.5.1.1",null,null,"4.5.1.1.5","4.5.1.1.7","When designing and planning changes to the mobile money service, are changes to reporting requirements considered for all functions?",null,null,"Recommended","Recommended","BizOps",null,null,"4","4.5","4.5.1","","4.5.1.1",0,0,"4.5.1.1.5","lors de la conception et de la planification des changements apportés au service d’argent mobile, la modification des rapports nécessaires est-elle prise en compte pour l’ensemble des fonctions ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"4","4.5","4.5.1","","4.5.1.1",null,0,"4.5.1.1.5","Al diseñar y planificar los cambios al servicio del dinero móvil, ¿se tienen en cuenta los cambios a los requisitos de generación de informes para todas las funciones?",null,null,"Recomendado","Recomendado","BizOps",null,null,"4","4.5","4.5.1",null,"4.5.1.1",null,0,"4.5.1.1.5",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"4.5.1.1.7",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,{"$f":"IF(OR(AND(EH80>0,SUM(EI80:EL80)>0),EK80>0),\"Partial\",IF(EH80=EM80,\"Yes\",IF(EI80=EM80,\"No\",IF(EJ80=EM80,\"N/A\",IF(EK80=EM80,\"Partial\",IF(EL80=EM80,\"\",\"\"))))))","v":""}]
[null,"4","4.5","4.5.1","","4.5.1.1",null,0,"4.5.1.1.6","4.5.1.1.6: When designing and planning changes to the mobile money service, are changes to SLAs considered for all functions?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.5","4.5.1","","4.5.1.1",null,null,"4.5.1.1.6","4.5.1.1.8","When designing and planning changes to the mobile money service, are changes to SLAs considered for all functions?",null,null,"Recommended","Recommended","BizOps",null,null,"4","4.5","4.5.1","","4.5.1.1",0,0,"4.5.1.1.6","lors de la conception et de la planification des changements apportés au service d’argent mobile, la modification des conventions de niveau de service est-elle prise en compte pour l’ensemble des fonctions ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"4","4.5","4.5.1","","4.5.1.1",null,0,"4.5.1.1.6","Al diseñar y planificar los cambios al servicio del dinero móvil, ¿se tienen en cuenta los cambios a los SLA para todas las funciones?",null,null,"Recomendado","Recomendado","BizOps",null,null,"4","4.5","4.5.1",null,"4.5.1.1",null,0,"4.5.1.1.6",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"4.5.1.1.8",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
["`","4","4.5","4.5.1","","4.5.1.1",null,0,"4.5.1.1.7","4.5.1.1.7: When designing and planning changes to the mobile money service, are changes to third party arrangements considered for all functions?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.5","4.5.1","","4.5.1.1",null,null,"4.5.1.1.7","4.5.1.1.9","When designing and planning changes to the mobile money service, are changes to third party arrangements considered for all functions?",null,null,"Recommended","Recommended","BizOps",null,null,"4","4.5","4.5.1","","4.5.1.1",0,0,"4.5.1.1.7","lors de la conception et de la planification des changements apportés au service d’argent mobile, la modification des accords avec des tiers est-elle prise en compte pour l’ensemble des fonctions ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"4","4.5","4.5.1","","4.5.1.1",null,0,"4.5.1.1.7","Al diseñar y planificar los cambios al servicio del dinero móvil, ¿se tienen en cuenta los cambios a los acuerdos con terceros para todas las funciones?",null,null,"Recomendado","Recomendado","BizOps",null,null,"4","4.5","4.5.1",null,"4.5.1.1",null,0,"4.5.1.1.7",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"4.5.1.1.9",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
["`","4","4.5","4.5.1","","4.5.1.1",null,0,"4.5.1.1.8","4.5.1.1.8: When designing and planning changes to the mobile money service, are human resource requirements (including training) considered for all functions?\n",0,0,"Recommended","Recommended","BizOps",{"$f":"CHOOSE(LanguageNumber,BK83,CA83,CQ83,DG83)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.5","4.5.1","","4.5.1.1",null,null,"4.5.1.1.8","4.5.1.1.10","When designing and planning changes to the mobile money service, are human resource requirements (including training) considered for all functions?",null,null,"Recommended","Recommended","BizOps",null,null,"4","4.5","4.5.1","","4.5.1.1",0,0,"4.5.1.1.8","lors de la conception et de la planification des changements apportés au service d’argent mobile, les besoins financiers et humains (formation comprise) sont-ils pris en compte pour l’ensemble des fonctions ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"4","4.5","4.5.1","","4.5.1.1",null,0,"4.5.1.1.8","Al diseñar y planificar los cambios al servicio del dinero móvil, ¿se tienen en cuenta los cambios a los requisitos de recursos financieros y humanos (incluyendo capacitación) para todas las funciones?",null,null,"Recomendado","Recomendado","BizOps",null,null,"4","4.5","4.5.1",null,"4.5.1.1",null,0,"4.5.1.1.8",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"4.5.1.1.10",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.5","4.5.1","","4.5.1.1",null,0,"4.5.1.1.9","4.5.1.1.9: When changes are made to the mobile money service does the planning include internal and external communication of the changes?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.5","4.5.1","","4.5.1.1",null,null,"4.5.1.1.9","4.5.1.1.11","When changes are made to the mobile money service does the planning include internal and external communication of the changes?",null,null,"Recommended","Recommended","BizOps",null,null,"4","4.5","4.5.1","","4.5.1.1",0,0,"4.5.1.1.9","les changements apportés au service d’argent mobile sont-ils gérés dans le cadre d'un plan de communication interne et externe concernant les changements?",null,null,"Recommandé","Recommandé","BizOps",0,null,"4","4.5","4.5.1","","4.5.1.1",null,0,"4.5.1.1.9","Cuando se realizan cambios al servicio del dinero móvil, ¿la planificación incluye la comunicación interna y externa de los cambios?",null,null,"Recomendado","Recomendado","BizOps",null,null,"4","4.5","4.5.1",null,"4.5.1.1",null,0,"4.5.1.1.9",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"4.5.1.1.11",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.5","4.5.1","","4.5.1.2","4.5.1.2: CHANGES TO THE MOBILE MONEY SYSTEM (CHANGE ADVISORY BOARD)\nAll technical changes to the mobile money system should be subject to a technical change management process (e.g. Change Advisory Board) to review and approve proposed changes to the mobile money system. The process should include:\n- Definition of the proposed change;\n- Impact assessment;\n- Testing - user acceptance testing, operational acceptance testing (see 4.5.1.3);\n- Deployment process, including go/no-go and roll-back (see 4.5.1.4);\n- Communication plan;\n- Review and approval by all relevant technical areas.\n\nA schedule for deployment of releases should be planned and communicated to technical and business managers.\n\nRelease notes should document the changes that are being made with each system change, including  all changes, bug fixes, known issues, and deployment/roll-back procedures.\n\nFollowing deployment, there should be a period or observation on the live environment to validate the deployment and a post-implementation review.\n\nFollowing each update to the system a report of the testing and deployment should be sent to business and technical managers.\n\nEmergency releases (fixes to resolve an incident) should be managed and deployed according to a documented procedure that is part of the incident management process.\n","ISO 20000-1:2019 Sec 8.5.2\nISO 27002: 2013 Sec. 12.5","4.5.1.2.1","4.5.1.2.1: Is there a formal technical change management process (e.g. Change Advisory Board) to manage all changes to the live technical environment (including patches, minor changes and major releases)?\n","1) Technical change management process or example change management documentation\n- Check that there is a documented formal technical change management process (e.g. Change Advisory Board) to manage all changes to the live technical environment (including patches, minor changes and major releases).\n- Check that evidence exists for approval by the technical operations manager for all releases.  \n        a) Review sign-off of release documentation for examples of technical changes in the last year.\n        b) Review process documentation if no releases have been made in the last year.\n        c) If previous technical changes did not have approval, review process documentation and look for evidence that future releases will have approval (e.g. revised process)\n",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.5","4.5.1","","4.5.1.2","CHANGES TO THE MOBILE MONEY SYSTEM (CHANGE ADVISORY BOARD)\nAll technical changes to the mobile money system should be subject to a technical change management process (e.g. Change Advisory Board) to review and approve proposed changes to the mobile money system. The process should include:\n- Definition of the proposed change;\n- Impact assessment;\n- Testing - user acceptance testing, operational acceptance testing (see 4.5.1.3);\n- Deployment process, including go/no-go and roll-back (see 4.5.1.4);\n- Communication plan;\n- Review and approval by all relevant technical areas.\n\nA schedule for deployment of releases should be planned and communicated to technical and business managers.\n\nRelease notes should document the changes that are being made with each system change, including  all changes, bug fixes, known issues, and deployment/roll-back procedures.\n\nFollowing deployment, there should be a period or observation on the live environment to validate the deployment and a post-implementation review.\n\nFollowing each update to the system a report of the testing and deployment should be sent to business and technical managers.\n\nEmergency releases (fixes to resolve an incident) should be managed and deployed according to a documented procedure that is part of the incident management process.\n","ISO 20000-1:2019 Sec 8.5.2\nISO 27002: 2013 Sec. 12.5","4.5.1.2.1","4.5.1.2.1","Is there a formal technical change management process (e.g. Change Advisory Board) to manage all changes to the live technical environment (including patches, minor changes and major releases)?","1) Technical change management process or example change management documentation\n- Check that there is a documented formal technical change management process (e.g. Change Advisory Board) to manage all changes to the live technical environment (including patches, minor changes and major releases).\n- Check that evidence exists for approval by the technical operations manager for all releases.  \n        a) Review sign-off of release documentation for examples of technical changes in the last year.\n        b) Review process documentation if no releases have been made in the last year.\n        c) If previous technical changes did not have approval, review process documentation and look for evidence that future releases will have approval (e.g. revised process)\n",null,"Urgent Required","Required","TechOps",null,null,"4","4.5","4.5.1","","4.5.1.2","CHANGEMENTS DU SYSTÈME DE L’ARGENT MOBILE (COMITÉ CONSULTATIF DES CHANGEMENTS)\nChaque modification technique du système de l’argent mobile doit suivre un processus de gestion des changements techniques (par exemple par le biais d'un Comité consultatif des changements), qui a pour but d’examiner et de valider les changements envisagés du système de l'argent mobile. Ce processus doit couvrir :\n- la définition du changement envisagé ;\n- l'étude d'impact ;\n- les tests : test d’acceptation par les utilisateurs, test d’acceptation opérationnelle (cf. 4.5.1.3) ;\n- la procédure de mise en production, y compris go/no-go et roll-back (cf. 4.5.1.4) ;\n- le plan de communication ;\n- le processus d'examen et de validation par l'ensemble des fonctions techniques concernées.\n\nUn calendrier de déploiement des nouvelles versions doit être défini et communiqué aux responsables techniques et opérationnels.\n\nLes notes de version doivent documenter les changements contenus dans chaque version, et notamment les modifications, les correctifs, les problèmes connus et les procédures de déploiement/roll-back.\n\nÀ la suite du déploiement, une période d’observation de l’environnement opérationnel est requise pour valider le déploiement. Un examen doit être effectué suite à la mise en oeuvre des changements.\n\nÀ la suite de chaque mise à jour du système, un rapport de test et de déploiement doit être envoyé aux responsables techniques et opérationnels.\n\nLes versions d’urgence (correctifs visant à résoudre un incident) doivent être gérées et déployées dans le cadre d’une procédure documentée faisant partie du processus de gestion des incidents.\n","ISO 20000-1:2019 Sec 8.5.2\nISO 27002: 2013 Sec. 12.5","4.5.1.2.1","existe-t-il un processus formel de gestion des changements techniques (par exemple par le biais d'un Comité consultatif des changements) pour la gestion de l'ensemble des changements apportés à l’environnement technique opérationnel (y compris les correctifs, les changements mineurs et les versions majeures) ?","1) Processus de gestion des changements techniques ou documentation relative à la gestion de changements types \n- Vérifier qu’un processus formel et documenté de gestion des changements techniques (par exemple par le biais d'un Comité consultatif des changements) a été mis en place pour gérer l’ensemble des changements apportés à l’environnement technique opérationnel (y compris les correctifs, les changements mineurs et les versions majeures).\n- Vérifier l’existence de preuves justifiant de l’approbation de l’ensemble des versions par le responsable des opérations techniques. \n a) Examiner l’approbation de la documentation de version pour des changements techniques types mis en oeuvre au cours de l’année passée.\n b) Examiner la documentation du processus si aucune version n’a été déployée au cours de l’année passée.\n c) Si les précédents changements techniques n’ont pas été approuvés, examiner la documentation du processus et rechercher des preuves justifiant que les futures versions seront approuvées (par exemple, un processus ayant fait l’objet de changements) \n",null,"Requis Prioritaire","Requis","TechOps",0,null,"4","4.5","4.5.1","","4.5.1.2","CAMBIOS AL SISTEMA DEL DINERO MÓVIL (CAMBIAR CONSEJO ASESOR)\nTodos los cambios técnicos al sistema del dinero móvil deben estar sujetos a un proceso de gestión de cambios técnicos (por ej., Cambiar Consejo Asesor) para revisar y aprobar los cambios propuestos al sistema del dinero móvil. El proceso debe incluir:\n- Definición del cambio propuesto;\n- Evaluación de impactos;\n- Realización de pruebas - pruebas de aceptación del usuario, pruebas de aceptación operativa (ver 4.5.1.3);\n- Proceso de implantación, incluyendo avance/no avance y retroceso (ver 4.5.1.4);\n- Plan de comunicación;\n- Revisión y aprobación por parte de todas las áreas técnicas relevantes.\n\nSe debe planificar y comunicar a los gerentes técnicos y comerciales el cronograma de implantación de las versiones.\n\nLas notas de la versión deben documentar los cambios que se están realizando con cada cambio del sistema, incluyendo todos los cambios, correcciones de fallas, problemas conocidos y procedimientos de implantación/retroceso.\n\nLuego de la implantación, debe haber un período de observación en el entorno de producción para validar la implantación y la revisión posterior a la implementación. \n\nLuego de cada actualización al sistema, se debe enviar un informe de las pruebas y la implantación a los gerentes comerciales y técnicos.\n\nLas versiones de emergencia (correcciones para resolver un incidente) se deben gestionar e implantar de conformidad con un procedimiento documentado que forme parte del proceso de gestión de incidentes.","ISO 20000-1:2019 Sec 8.5.2\nISO 27002: 2013 Sec. 12.5","4.5.1.2.1","¿Existe un proceso formal de gestión de cambios técnicos (por ej., Cambiar Consejo Asesor) para gestionar todos los cambios al entorno técnico en producción (inclusive parches, cambios menores y versiones importantes)?  ","1) Proceso de gestión de cambios técnicos o ejemplo de documentación de gestión de cambios\n- Verificar que exista un proceso formal de gestión de cambios técnicos documentado (por ej., Cambiar Consejo Asesor) para gestionar todos los cambios al entorno técnico en producción (inclusive parches, cambios menores y versiones importantes).\n- Verificar que exista evidencia para que los gerentes de operaciones técnicas puedan aprobar todas las versiones.  \n        a) Revisar la aprobación de la documentación de versiones para ejemplos de cambios técnicos en el último año.\n        b) Si no hubo versiones en el último año, revisar la documentación del proceso.\n        c) Si los cambios técnicos anteriores no fueron aprobados, revisar la documentación del proceso y buscar evidencia de que las versiones futuras serán aprobadas (por ej., proceso revisado).",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"4","4.5","4.5.1",null,"4.5.1.2",null,"ISO 20000-1:2019 Sec 8.5.2\nISO 27002: 2013 Sec. 12.5","4.5.1.2.1",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,"MERGE","4.5.1.2.1","4.5.1.4.1",null,null,{"$error":"#REF!"},{"$error":"#REF!"},"","",{"$error":"#REF!"},{"$error":"#REF!"},"","",2,"",{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,2,""]
[null,"4","4.5","4.5.1","","4.5.1.2",null,0,"4.5.1.2.2","4.5.1.2.2: Are planned system changes documented in a change calendar and communicated to technical and business managers?\n","1) Mobile money system deployment plan\n- Check that technical changes to the MM system have been documented in a change calendar.\n- Check that previous technical changes have been communicated to technical and business managers in advance.\n",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.5","4.5.1","","4.5.1.2",null,null,"4.5.1.2.2","4.5.1.2.2","Are planned system changes documented in a change calendar and communicated to technical and business managers?","1) Mobile money system deployment plan\n- Check that technical changes to the MM system have been documented in a change calendar.\n- Check that previous technical changes have been communicated to technical and business managers in advance.\n",null,"Standard Required","Required","TechOps",null,null,"4","4.5","4.5.1","","4.5.1.2",0,0,"4.5.1.2.2","Les changements envisagés du système sont-ils documentés dans un calendrier des changements et communiqués aux responsables techniques et opérationnels ?","1) Plan de déploiement du système de l’argent mobile\n- Vérifier que les changements techniques apportés au système de l'argent mobile ont été documentés dans un calendrier des changements.\n- Vérifier que les changements techniques précédents ont été au préalable communiqués aux responsables techniques et opérationnels.",null,"Requis Normal","Requis","TechOps",0,null,"4","4.5","4.5.1","","4.5.1.2",null,0,"4.5.1.2.2","¿Se documentaron en un calendario de cambios y se comunicaron a los gerentes técnicos y comerciales los cambios del sistema planificados?","1) Plan de implantación del sistema del dinero móvil\n- Verificar que los cambios técnicos en el  sistema del dinero móvil se documenten en un calendario de cambios.\n- Verificar que los cambios técnicos anteriores se hayan comunicado a los gerentes técnicos y comerciales con anticipación.\n",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"4","4.5","4.5.1",null,"4.5.1.2",null,0,"4.5.1.2.2",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"4.5.1.2.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.5","4.5.1","","4.5.1.2",null,null,{"$f":"BC87","v":"4.5.1.2.3"},"4.5.1.2.3: Are release notes produced for each change, documenting the changes that are being made, including all changes, bug fixes, known issues, and deployment/roll-back procedures?\n","1) Technical change management process or example change management documentation\n- Check that suitable release notes are produced for all changes. \n        a) Review release notes for example changes in the last year. \n        b) Review release notes template if no changes have been made in the last year.\n        c) If previous changes did not have release notes, review process documentation and look for evidence that future changes will have release notes (e.g. revised process)",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.5","4.5.1","","4.5.1.2",null,null,"4.5.1.2.3","4.5.1.2.3","Are release notes produced for each change, documenting the changes that are being made, including all changes, bug fixes, known issues, and deployment/roll-back procedures?","1) Technical change management process or example change management documentation\n- Check that suitable release notes are produced for all changes. \n        a) Review release notes for example changes in the last year. \n        b) Review release notes template if no changes have been made in the last year.\n        c) If previous changes did not have release notes, review process documentation and look for evidence that future changes will have release notes (e.g. revised process)",null,"Standard Required","Required","TechOps",null,null,"4","4.5","4.5.1","","4.5.1.2",null,null,"4.5.1.2.3","Des notes de version sont-elles préparées pour chaque changement afin de documenter les changements effectués, notamment tous les changements, correctifs, problèmes connus, et procédures de déploiement/roll-back ?","1) Processus de gestion des changements techniques ou documentation relative à la gestion de changements types \n- Vérifier que des notes de version appropriées sont préparées pour l'ensemble des changements. \n a) Examiner les notes de version pour les changements types mis en oeuvre au cours de l’année passée. \n b) Examiner le modèle de note de version si aucun changement n’a été mis en oeuvre au cours de l’année passée.\n c) Si des notes de version n’ont pas été préparées pour les changements précédents, examiner la documentation du processus et rechercher des preuves justifiant que des notes de version seront préparées pour les futurs changements (par exemple, un processus ayant fait l’objet de changements)",null,"Requis Normal","Requis","TechOps",0,null,"4","4.5","4.5.1","","4.5.1.2",null,null,"4.5.1.2.3","¿Se generan notas de las versiones para cada cambio, que documenten los cambios que se están realizando, incluyendo todos los cambios, correcciones de fallas, problemas conocidos, y procedimientos de implantación/retroceso? ","1) Proceso de gestión de cambios técnicos o ejemplo de documentación de gestión de cambios\n- Verificar que se generen las notas de versiones correspondientes para todos los cambios. \n        a) Revisar las notas de versiones para los ejemplos de cambios en el último año. \n        b) Si no se implementaron cambios en el último año, revisar la plantilla de notas de versiones.\n        c) Si los cambios anteriores no tenían notas de versiones, revisar la documentación del proceso y buscar evidencia de que los cambios futuros tendrán notas de versiones (por ej., proceso revisado).  \n ",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"4","4.5","4.5.1",null,"4.5.1.2",null,null,"4.5.1.2.3",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,"MERGE","4.5.1.2.3","4.5.1.2.4",null,null,{"$error":"#REF!"},{"$error":"#REF!"},"","",{"$error":"#REF!"},{"$error":"#REF!"},"","",2,"",{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,2,""]
[null,"4","4.5","4.5.1","","4.5.1.2",null,null,"4.5.1.2.4","4.5.1.2.4: Following deployment, is final testing performed on the live environment to validate the deployment?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.5","4.5.1","","4.5.1.2",null,null,"4.5.1.2.4",{"$f":"DO88","v":"4.5.1.4.2"},"Following deployment, is final testing performed on the live environment to validate the deployment?",null,null,"Recommended","Recommended","TechOps",null,null,"4","4.5","4.5.1","","4.5.1.2",null,null,"4.5.1.2.4","à la suite du déploiement, des tests finaux sont-ils effectués dans l’environnement opérationnel afin de valider la mise en production?",null,null,"Recommandé","Recommandé","TechOps",0,null,"4","4.5","4.5.1","","4.5.1.2",null,null,"4.5.1.2.4","Después de la implantación, ¿se realizan las pruebas finales en el entorno de producción para validar la implantación?",null,null,"Recomendado","Recomendado","TechOps",null,null,"4","4.5","4.5.1",null,"4.5.1.2",null,null,"4.5.1.2.4",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.5.1.4.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.5","4.5.1","","4.5.1.2",null,null,"4.5.1.2.5","4.5.1.2.5: Following each release, is a report of the testing and deployment sent to business and technical managers, comparing the outcomes achieved against the expected outcomes?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.5","4.5.1","","4.5.1.2",null,null,"4.5.1.2.5",{"$f":"DO89","v":"4.5.1.4.3"},"Following each release, is a report of the testing and deployment sent to business and technical managers, comparing the outcomes achieved against the expected outcomes?",null,null,"Recommended","Recommended","TechOps",null,null,"4","4.5","4.5.1","","4.5.1.2",null,null,"4.5.1.2.5","après chaque version, un rapport sur les tests et le déploiement est-il remis aux responsables techniques et opérationnels pour comparer les résultats obtenus par rapport aux résultats attendus ?",null,null,"Recommandé","Recommandé","TechOps",0,null,"4","4.5","4.5.1","","4.5.1.2",null,null,"4.5.1.2.5","Después de cada versión, ¿se envía un informe de las pruebas y la implantación a los gerentes comerciales y técnicos comparando los resultados alcanzados con los resultados esperados?",null,null,"Recomendado","Recomendado","TechOps",null,null,"4","4.5","4.5.1",null,"4.5.1.2",null,null,"4.5.1.2.5",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.5.1.4.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.5","4.5.1","","4.5.1.2",null,{"$f":"BB90","v":0},"4.5.1.2.6","4.5.1.2.6: Are emergency changes managed and deployed according to a documented procedure that is part of the incident management process (e.g. Emergency Change Advisory Board)?\n","1) Incident management process\n- Check the incident management procedure includes a process for emergency changes with suitable approval (e.g. Emergency Change Advisory Board).",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.5","4.5.1","","4.5.1.2",null,null,"4.5.1.2.6","4.5.1.2.5","Are emergency changes managed and deployed according to a documented procedure that is part of the incident management process (e.g. Emergency Change Advisory Board)?","1) Incident management process\n- Check the incident management procedure includes a process for emergency changes with suitable approval (e.g. Emergency Change Advisory Board).",null,"Standard Required","Required","TechOps",null,null,"4","4.5","4.5.1","","4.5.1.2",0,0,"4.5.1.2.6","les versions d’urgence (correctifs visant à résoudre un incident) sont-elles gérées dans le cadre d’une procédure documentée faisant partie du processus de gestion des incidents ?","1) Processus de gestion des incidents\n- Vérifier que la procédure de gestion des incidents inclut un processus pour les versions d’urgence.\n",null,"Requis Normal","Requis","TechOps",0,null,"4","4.5","4.5.1","","4.5.1.2",null,0,"4.5.1.2.6","¿Las versiones de emergencia se implantan de conformidad con un procedimiento documentado que forma parte del proceso de gestión de incidentes?","1) Proceso de gestión de incidentes\n- Verificar que el procedimiento de gestión de incidentes incluya un proceso para versiones de emergencia.\n",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"4","4.5","4.5.1",null,"4.5.1.2",null,0,"4.5.1.2.6",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"4.5.1.2.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.5","4.5.1","","4.5.1.3",{"$f":"AZ91&\": \"&CHOOSE(LanguageNumber,BA91,BR91,CH91,CX91)","v":"4.5.1.3: RELEASE MANAGEMENT - TESTING\nReleases should be built and tested in a separate testing environment prior to deployment to the live system. The testing environment should be a valid representation of the production environment. All releases should be tested before being released to production.\n\nUser Acceptance Testing (functional testing) should be done to ensure that the release fulfils the functional requirements and design. The release should be verified against service acceptance criteria agreed in advance by the mobile money business operations manager.\n\nOperational Acceptance Testing (non-functional testing) should be done to ensure that the release meets technical acceptance criteria, which should be agreed in advance of testing. At minimum, the following should be tested in every major release:\n- failover capability;\n- system security;\n- system performance;\n- operational requirements (e.g. logging, alerting).\n"},"ISO 20000-1:2019 Sec. 8.5.3\nISO 27002: 2013 Sec. 12.5","4.5.1.3.1","4.5.1.3.1: is there a separate testing environment, which is a valid representation of the production environment?\n","1) System architecture specification\n- Check that the testing environment is a valid representation of the live environment (i.e. comparable architecture, and the same version and configuration as the live system). If the test environment has a scaled-down architecture then there should be a documented risk assessment or reasoning.",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.5","4.5.1","","4.5.1.3","RELEASE MANAGEMENT - TESTING\nReleases should be built and tested in a separate testing environment prior to deployment to the live system. The testing environment should be a valid representation of the production environment. All releases should be tested before being released to production.\n\nUser Acceptance Testing (functional testing) should be done to ensure that the release fulfils the functional requirements and design. The release should be verified against service acceptance criteria agreed in advance by the mobile money business operations manager.\n\nOperational Acceptance Testing (non-functional testing) should be done to ensure that the release meets technical acceptance criteria, which should be agreed in advance of testing. At minimum, the following should be tested in every major release:\n- failover capability;\n- system security;\n- system performance;\n- operational requirements (e.g. logging, alerting).\n","ISO 20000-1:2019 Sec. 8.5.3\nISO 27002: 2013 Sec. 12.5","4.5.1.3.1","4.5.1.3.1","is there a separate testing environment, which is a valid representation of the production environment?","1) System architecture specification\n- Check that the testing environment is a valid representation of the live environment (i.e. comparable architecture, and the same version and configuration as the live system). If the test environment has a scaled-down architecture then there should be a documented risk assessment or reasoning.",null,"Urgent Required","Required","TechOps",null,null,"4","4.5","4.5.1","","4.5.1.3","GESTION DES VERSIONS - TESTS\nLes nouvelles versions doivent être développées et testées dans un environnement distinct de test avant leur déploiement sur le système opérationnel. L’environnement de test doit être une reproduction valable de l’environnement de production. Les nouvelles versions doivent systématiquement être testées avant d’être mises en production.\n\nDes tests d’acceptation par les utilisateurs (UAT / test fonctionnels) doivent être effectués pour s’assurer que la nouvelle version respecte le cahier des charges fonctionnel. Elle doit être comparée aux critères d’acceptation du service convenus à l’avance avec le responsable de l’exploitation de l’activité d’argent mobile.\n\nDes tests d’acceptation opérationnelle (tests non fonctionnels) doivent être effectués pour s’assurer que la nouvelle version respecte les critères d’acceptation techniques convenus avant la phase de test. Il est nécessaire de tester au minimum les aspects suivants pour chaque version majeure :\n- fonctions de reprise après échec ;\n- sécurité du système ;\n- performance du système ;\n- exigences opérationnelles (ex. mise à jour des journaux, signaux d’alerte)\n","ISO 20000-1:2019 Sec. 8.5.3\nISO 27002: 2013 Sec. 12.5","4.5.1.3.1","L'environnement distinct de test utilisé est-il une reproduction valable de l'environnement de production ?","1) Spécification de l'architecture du système\n- Vérifier que l’environnement de test est une reproduction valable de l’environnement opérationnel (architecture comparable et version et configuration identiques à celles du système opérationnel). Si l’échelle de l’architecture de l’environnement de test a été réduite, une évaluation ou une logique de risque documentée doit être effectuée ou établie.",null,"Requis Prioritaire","Requis","TechOps",0,null,"4","4.5","4.5.1","","4.5.1.3","GESTIÓN DE VERSIONES - REALIZACIÓN DE PRUEBAS\nLas versiones deben ser desarrolladas y probadas en un entorno de pruebas por separado antes de la implantación al sistema en producción. El entorno de pruebas debe ser una representación válida del entorno de producción. Todas las versiones deben ser probadas antes de ser implantadas en producción.\n\nSe deben realizar Pruebas de Aceptación del Usuario (pruebas funcionales) para garantizar que la versión cumpla con los requisitos funcionales y el diseño. La versión debe ser verificada en base a los criterios de aceptación previamente acordados por el gerente de operaciones del negocio del dinero móvil.\n\nSe deben realizar Pruebas de Aceptación Operativa (pruebas no funcionales) para garantizar que la versión cumpla con los criterios de aceptación técnica, que deben ser acordados con anterioridad a la realización de las pruebas. En cada versión principal se debe probar, como mínimo, lo siguiente:\n- capacidad de recuperación ante fallas;\n- seguridad del sistema;\n- rendimiento del sistema;\n- requisitos operativos (por ej., registros, alertas).\n","ISO 20000-1:2019 Sec. 8.5.3\nISO 27002: 2013 Sec. 12.5","4.5.1.3.1","¿Existe un entorno de pruebas por separado, que es una representación válida del entorno de producción?","1) Especificación de la arquitectura del sistema\n- Verificar que el entorno de pruebas sea una representación válida del entorno de producción (es decir, arquitectura comparable, y la misma versión y configuración que el sistema en producción). Si el entorno de pruebas tiene una arquitectura a escala reducida, entonces debe existir una evaluación o fundamentación documentada de los riesgos.",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"4","4.5","4.5.1",null,"4.5.1.3",null,"ISO 20000-1:2019 Sec. 8.5.3\nISO 27002: 2013 Sec. 12.5","4.5.1.3.1",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,"MERGE","4.5.1.3.1","4.5.1.3.2",null,null,{"$error":"#REF!"},{"$error":"#REF!"},"","",{"$error":"#REF!"},{"$error":"#REF!"},"","",2,"",{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,2,""]
[null,"4","4.5","4.5.1","","4.5.1.3",null,0,"4.5.1.3.2","4.5.1.3.2: Is User Acceptance Testing (functional testing) done to verify each release against acceptance criteria agreed in advance by the mobile money business operations manager?\n","1) Release Management Process or testing specifications \n- Check there is a process to verify each release against agreed acceptance criteria (i.e. functional / user acceptance testing). \n- Check the process requires that all releases are built and tested in a separate testing environment prior to being deployed on the live system. \n",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.5","4.5.1","","4.5.1.3",null,null,"4.5.1.3.2","4.5.1.3.3","Is User Acceptance Testing (functional testing) done to verify each release against acceptance criteria agreed in advance by the mobile money business operations manager?","1) Release Management Process or testing specifications \n- Check there is a process to verify each release against agreed acceptance criteria (i.e. functional / user acceptance testing). \n- Check the process requires that all releases are built and tested in a separate testing environment prior to being deployed on the live system. \n",null,"Urgent Required","Required","TechOps",null,null,"4","4.5","4.5.1","","4.5.1.3",0,0,"4.5.1.3.2","des tests d’acceptation par les utilisateurs (UAT / test fonctionnels) sont-ils effectués pour s’assurer que chaque version respecte les critères d’acceptation du service convenus à l’avance avec le responsable de l’exploitation de l’activité d’argent mobile ?","1) Processus de gestion des versions ou spécifications des tests\n- Vérifier qu’un processus a été mis en place afin de s’assurer que chaque version respecte les critères d’acceptation convenus à l’avance (UAT/tests fonctionnels/UAT). \n- Vérifier que le processus prévoit l'obligation de concevoir et de tester l'ensemble des versions dans un environnement distinct de test avant de les déployer sur le système opérationnel.",null,"Requis Prioritaire","Requis","TechOps",0,null,"4","4.5","4.5.1","","4.5.1.3",null,0,"4.5.1.3.2","¿Se realizan Pruebas de Aceptación del Usuario (pruebas funcionales) para verificar cada versión en base a los criterios de aceptación del servicio previamente acordados por el gerente de operaciones del negocio del dinero móvil?","1) Especificaciones de pruebas o del Proceso de Gestión de Versiones\n- Verificar que exista un proceso para verificar cada versión en base a los criterios de aceptación acordados (es decir, pruebas funcionales / de aceptación del usuario). \n- Verificar que el proceso requiera que todas las versiones se desarrollen y prueben en un entorno de pruebas por separado antes de su implantación en el sistema en producción. \n",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"4","4.5","4.5.1",null,"4.5.1.3",null,0,"4.5.1.3.2",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"4.5.1.3.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.5","4.5.1","","4.5.1.3",null,0,"4.5.1.3.3","4.5.1.3.3: Is Operational Acceptance Testing (non-functional testing) done on each major release?\n","1) Release Management Process or testing specifications \n- Check there is a process to verify each major release against agreed operational acceptance criteria (i.e. non-functional / operational acceptance testing). ",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.5","4.5.1","","4.5.1.3",null,null,"4.5.1.3.3","4.5.1.3.4","Is Operational Acceptance Testing (non-functional testing) done on each major release?","1) Release Management Process or testing specifications \n- Check there is a process to verify each major release against agreed operational acceptance criteria (i.e. non-functional / operational acceptance testing). ",null,"Standard Required","Required","TechOps",null,null,"4","4.5","4.5.1","","4.5.1.3",0,0,"4.5.1.3.3","Des tests d'acception opérationnelle (tests non fonctionnels) sont-ils effectués pour chaque version majeure ?","1) Processus de gestion des versions ou spécifications de tests\n- Vérifier qu’un processus a été mis en place pour s’assurer que chaque version majeure respecte les critères d'acceptation opérationnels convenus à l’avance (tests non fonctionnels/test d'acceptation opérationnelle). ",null,"Requis Normal","Requis","TechOps",0,null,"4","4.5","4.5.1","","4.5.1.3",null,0,"4.5.1.3.3","¿Se realizan Pruebas de Aceptación Operativa (pruebas no funcionales) en cada versión principal?","1) Especificaciones de pruebas o del Proceso de Gestión de Versiones\n- Verificar que exista un proceso para verificar cada versión principal en base a los criterios de aceptación operativa acordados (es decir, pruebas de aceptación no funcionales / operativas). ",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"4","4.5","4.5.1",null,"4.5.1.3",null,0,"4.5.1.3.3",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"4.5.1.3.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.5","4.5.1","","4.5.1.3",null,0,"4.5.1.3.4","4.5.1.3.4: Does operational acceptance testing test failover capability, system security, system performance, and operational requirements in every major release?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.5","4.5.1","","4.5.1.3",null,null,"4.5.1.3.4","4.5.1.3.5","Does operational acceptance testing test failover capability, system security, system performance, and operational requirements in every major release?",null,null,"Recommended","Recommended","TechOps",null,null,"4","4.5","4.5.1","","4.5.1.3",0,0,"4.5.1.3.4","les tests d’acceptation opérationnelle vérifient-ils les capacités de reprise après échec, la sécurité et la performance du système et les exigences opérationnelles pour chaque version majeure ?",null,null,"Recommandé","Recommandé","TechOps",0,null,"4","4.5","4.5.1","","4.5.1.3",null,0,"4.5.1.3.4","¿Las pruebas de aceptación operativa prueban la capacidad de recuperación ante fallas, la seguridad del sistema, el rendimiento del sistema y los requisitos operativos en cada versión principal?",null,null,"Recomendado","Recomendado","TechOps",null,null,"4","4.5","4.5.1",null,"4.5.1.3",null,0,"4.5.1.3.4",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.5.1.3.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.5","4.5.1","","4.5.1.4","4.5.1.4: CONFIGURATION MANAGEMENT\nConfiguration management is used to maintain a detailed record of the mobile money system's hardware and software and their configuration and documentation.\n\nProviders should record all software and hardware components in a configuration management database. All system documentation should also be stored.\n\nPrevious versions of application software and configurations should be retained as a contingency measure: old versions of software and their configuration should be archived for as long as the data are retained in archive.\n\nThe configuration management database should be updated as part of the release management process when changes are made to the system.\n","PCI DSS, ISO 20000-1:2011 Sec. 9.1\nISO 27002: 2013 Sec. 12.5 ","4.5.1.4.1","4.5.1.4.1: Is a configuration management database used to maintain a detailed record of the mobile money system's hardware and software and their configuration and documentation?\n","Configuration management specification",0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.5","4.5.1","","4.5.1.4","CONFIGURATION MANAGEMENT\nConfiguration management is used to maintain a detailed record of the mobile money system's hardware and software and their configuration and documentation.\n\nProviders should record all software and hardware components in a configuration management database. All system documentation should also be stored.\n\nPrevious versions of application software and configurations should be retained as a contingency measure: old versions of software and their configuration should be archived for as long as the data are retained in archive.\n\nThe configuration management database should be updated as part of the release management process when changes are made to the system.\n","PCI DSS, ISO 20000-1:2011 Sec. 9.1\nISO 27002: 2013 Sec. 12.5 ","4.5.1.4.1","4.5.1.5.1","Is a configuration management database used to maintain a detailed record of the mobile money system's hardware and software and their configuration and documentation?","Configuration management specification",null,"Recommended","Recommended","TechOps",null,null,"4","4.5","4.5.1","","4.5.1.4","GESTION DE LA CONFIGURATION\nLa gestion de la configuration permet de conserver un registre détaillé des équipements et logiciels composant le système de l’argent mobile, ainsi que de leur configuration et documentation.\n\nLes prestataires doivent enregistrer tous leurs logiciels et équipements informatiques  dans une base de données de gestion de la  configuration, contenant également toute la documentation relative au système. \n\nLes versions antérieures des logiciels d’application et configurations doivent être conservées à titre de mesure de secours ; les anciennes versions des logiciels et leur configuration doivent être archivées aussi longtemps que les données sont archivées.\n\nLa base de donnée de gestion de la configuration doit être actualisée dans le cadre du processus de gestion des versions lorsque des changements sont effectués dans le système.\n\n","PCI DSS, ISO 20000-1:2011 Sec. 9.1\nISO 27002: 2013 Sec. 12.5 ","4.5.1.4.1","existe-t-il une base de données de gestion de la configuration pour conserver un registre détaillé des équipements et logiciels composant le système de l’argent mobile, ainsi que de leur configuration et documentation ?","Spécification de gestion de la configuration",null,"Recommandé","Recommandé","TechOps",0,null,"4","4.5","4.5.1","","4.5.1.4","GESTIÓN DE CONFIGURACIONES\nLa gestión de configuraciones se utiliza para mantener un registro detallado del hardware y software del sistema del dinero móvil y su configuración y documentación.\n\nLos proveedores deben registrar todos los componentes del software y hardware en una base de datos de gestión de configuraciones. También se debe almacenar toda la documentación del sistema.\n\nSe deben retener las versiones anteriores del software de aplicaciones y sus configuraciones como una medida de contingencia: las versiones de software anteriores y sus configuraciones se deben archivar durante todo el tiempo de retención de datos en un archivo.\n\nLa base de datos de gestión de configuraciones debe ser actualizada como parte del proceso de gestión de versiones cuando se realizan cambios al sistema.\n","PCI DSS, ISO 20000-1:2011 Sec. 9.1\nISO 27002: 2013 Sec. 12.5 ","4.5.1.4.1","¿Se utiliza una base de datos de gestión de configuraciones para mantener un registro detallado del hardware y software del sistema del dinero móvil y su configuración y documentación?","Especificación de gestión de configuraciones",null,"Recomendado","Recomendado","TechOps",null,null,"4","4.5","4.5.1",null,"4.5.1.4",null,"PCI DSS, ISO 20000-1:2011 Sec. 9.1\nISO 27002: 2013 Sec. 12.5 ","4.5.1.4.1",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.5.1.5.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.5","4.5.1","","4.5.1.4",null,0,"4.5.1.4.2","4.5.1.4.2: Are previous versions of application software and configurations retained as a contingency measure for as long as the data are retained in archive?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.5","4.5.1","","4.5.1.4",null,null,"4.5.1.4.2","4.5.1.5.2","Are previous versions of application software and configurations retained as a contingency measure for as long as the data are retained in archive?",null,null,"Recommended","Recommended","TechOps",null,null,"4","4.5","4.5.1","","4.5.1.4",0,0,"4.5.1.4.2","les versions antérieures des logiciels d’application et configurations sont-elles conservées à titre de mesure de secours pendant aussi longtemps que les données sont archivées ?",null,null,"Recommandé","Recommandé","TechOps",0,null,"4","4.5","4.5.1","","4.5.1.4",null,0,"4.5.1.4.2","¿Se retienen las versiones anteriores del software de aplicaciones y sus configuraciones como una medida de contingencia durante todo el tiempo de retención de datos en un archivo?",null,null,"Recomendado","Recomendado","TechOps",null,null,"4","4.5","4.5.1",null,"4.5.1.4",null,0,"4.5.1.4.2",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.5.1.5.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.5","4.5.1","","4.5.1.4",null,0,"4.5.1.4.3","4.5.1.4.3: Is the configuration management database updated as part of the release management process when changes are made to the system?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.5","4.5.1","","4.5.1.4",null,null,"4.5.1.4.3",{"$f":"DO97","v":"4.5.1.5.3"},"Is the configuration management database updated as part of the release management process when changes are made to the system?",null,null,"Recommended","Recommended","TechOps",null,null,"4","4.5","4.5.1","","4.5.1.4",0,0,"4.5.1.4.3","la base de donnée de gestion de la configuration est-elle actualisée dans le cadre du processus de gestion des versions lorsque des changements sont effectués dans le système ?",null,null,"Recommandé","Recommandé","TechOps",0,null,"4","4.5","4.5.1","","4.5.1.4",null,0,"4.5.1.4.3","¿La base de datos de gestión de configuraciones es actualizada como parte del proceso de gestión de versiones cuando se realizan cambios al sistema?",null,null,"Recomendado","Recomendado","TechOps",null,null,"4","4.5","4.5.1",null,"4.5.1.4",null,0,"4.5.1.4.3",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.5.1.5.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.5","4.5.1","","4.5.1.5","4.5.1.5: REMOVAL OF SERVICES\nWhen services are to be removed, the removal should be performed under a formal process. \n\nCustomer data related to the removed service should be archived in a form that is retrievable. Archived data should be kept according to the data retention policy.","ISO 20000-1:2011 Sec. 5.2","4.5.1.5.1","4.5.1.5.1: When services are to be removed, is the removal performed under a formal process?\n","1) Release management process \n- Check there is a documented process for the removal of services e.g. a formal project-management process for all changes to services.\n",0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.5","4.5.1","","4.5.1.5","REMOVAL OF SERVICES\nWhen services are to be removed, the removal should be performed under a formal process. \n\nCustomer data related to the removed service should be archived in a form that is retrievable. Archived data should be kept according to the data retention policy.","ISO 20000-1:2011 Sec. 5.2","4.5.1.5.1","4.5.1.6.1","When services are to be removed, is the removal performed under a formal process?","1) Release management process \n- Check there is a documented process for the removal of services e.g. a formal project-management process for all changes to services.\n",null,"Recommended","Recommended","BizOps",null,null,"4","4.5","4.5.1","","4.5.1.5","SUPPRESSION DE SERVICE\nLorsque des services doivent être supprimés, la suppression doit être effectuée dans le respect d’un processus formel. \n\nLes données relatives aux clients du service supprimé doivent être archivées de façon à pouvoir être récupérées si nécessaire. Les données archivées doivent être conservées conformément à la politique de conservation des données.","ISO 20000-1:2011 Sec. 5.2","4.5.1.5.1","lorsque des services doivent être supprimés, la suppression est-elle effectuée dans le respect du processus formel ?","1) Processus de gestion des versions \n- Vérifier qu’un processus documenté a été mis en place pour la suppression des services, par exemple un processus formel de gestion de projet pour l’ensemble des changements apportés aux services.\n",null,"Recommandé","Recommandé","BizOps",0,null,"4","4.5","4.5.1","","4.5.1.5","ELIMINACIÓN DE SERVICIOS\nCuando se deben eliminar servicios, la eliminación se debe realizar conforme a un proceso formal. \n\nLos datos de clientes relacionados con el servicio eliminado deben ser archivados en un formato recuperable. Los datos archivados deben ser conservados de acuerdo con la política de retención de datos.","ISO 20000-1:2011 Sec. 5.2","4.5.1.5.1","Cuando se deben eliminar servicios, ¿la eliminación se realiza conforme a un proceso formal?","1) Proceso de gestión de versiones\n- Verificar que exista un proceso documentado para la eliminación de servicios, por ej., un proceso formal de gestión de proyectos para todos los cambios a los servicios.\n",null,"Recomendado","Recomendado","BizOps",null,null,"4","4.5","4.5.1",null,"4.5.1.5",null,"ISO 20000-1:2011 Sec. 5.2","4.5.1.5.1",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"4.5.1.6.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.5","4.5.1","","4.5.1.5",null,0,"4.5.1.5.2","4.5.1.5.2: Is customer data related to the removed service archived in a form that is retrievable?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.5","4.5.1","","4.5.1.5",null,null,"4.5.1.5.2","4.5.1.6.2","Is customer data related to the removed service archived in a form that is retrievable?",null,null,"Recommended","Recommended","TechOps",null,null,"4","4.5","4.5.1","","4.5.1.5",0,0,"4.5.1.5.2","les données relatives aux clients du service supprimé sont-elles archivées de façon à pouvoir être récupérées si nécessaire ?",null,null,"Recommandé","Recommandé","TechOps",0,null,"4","4.5","4.5.1","","4.5.1.5",null,0,"4.5.1.5.2","¿Los datos de clientes relacionados con el servicio eliminado son archivados en un formato recuperable?",null,null,"Recomendado","Recomendado","TechOps",null,null,"4","4.5","4.5.1",null,"4.5.1.5",null,0,"4.5.1.5.2",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.5.1.6.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4",0,0,{"$f":"UPPER(CONCATENATE(Introduction!C23,\": \",Introduction!D23))","v":"4.6: ENTERPRISE RISK MANAGEMENT"},null,null,null,null,{"$f":"Introduction!E23","v":"Providers shall establish a risk management framework for identifying, assessing and controlling risks"},null,null,null,null,null,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4",null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$23,\": \",Introduction!$L$23))","v":"4.6: ENTERPRISE RISK MANAGEMENT"},null,null,null,null,0,{"$f":"Introduction!$M$23","v":"Providers shall establish a risk management framework for identifying, assessing and controlling risks"},null,null,null,null,0,null,null,"4",0,0,null,0,null,0,0,"",null,null,null,null,0,null,null,"4",0,0,{"$f":"UPPER(CONCATENATE(Introduction!$U$23,\": \",Introduction!$V$23))","v":"4.6: GESTIÓN DE RIESGOS EMPRESARIALES"},null,null,0,0,{"$f":"Introduction!W23","v":"El proveedor establecerá un marco para la gestión de riesgos empresariales a fin de identificar, estimar y controlar los riesgos"},null,null,null,null,0,null,null,"4",0,0,null,0,null,0,0,null,null,null,null,null,0]
[null,"4","4.6","4.6.1",{"$f":"CHOOSE(LanguageNumber,AY101,BP101,CF101,CV101)","v":"4.6.1: Providers should establish a risk management framework for identifying, assessing and controlling risks"},"4.6.1.1",{"$f":"AZ101&\": \"&CHOOSE(LanguageNumber,BA101,BR101,CH101,CX101)","v":"4.6.1.1: MOBILE MONEY RISK MANAGEMENT GOVERNANCE\nA mobile money risk management policy should be documented that defines the framework for mobile money risk management, including scope, process, governance and organization. The framework should be focused on mobile money risks, which are distinct from the usual mobile operator risks.\n\nA Risk Manager should be appointed as the single point of contact with responsibility for mobile money risk management.  This need not be a dedicated role and the individual could have other responsibilities.\n\nIf the provider has an enterprise risk management function, the mobile money Risk Manager should inform that team of the key mobile money risks.\n\nNote: GSMA has published a separate Risk Management Toolkit, which has examples of the risk management process and mobile money risks and controls."},{"$f":"BB101","v":"ISO 27005:2018 Sec. 7.1"},{"$f":"BC101","v":"4.6.1.1.1"},{"$f":"BC101&\": \"&CHOOSE(LanguageNumber,BE101,BU101,CK101,DA101)&CarriageReturn","v":"4.6.1.1.1: Has a mobile money risk management framework been documented that defines the mobile money risk management scope, process, governance and organization?\n"},{"$f":"CHOOSE(LanguageNumber,BF101,BV101,CL101,DB101)","v":"1) Risk management framework, process or similar document\n- Check that the process has been documented\n- Check that it defines the framework for mobile money risk management, including:\na) Scope\nb) Process \nc) Governance\nd) Organization"},0,{"$f":"CHOOSE(LanguageNumber,BH101,BX101,CN101,DD101)","v":"Standard Required"},{"$f":"CHOOSE(LanguageNumber,BI101,BY101,CO101,DE101)","v":"Required"},"FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.6","4.6.1","4.6.1: Providers should establish a risk management framework for identifying, assessing and controlling risks","4.6.1.1","MOBILE MONEY RISK MANAGEMENT GOVERNANCE\nA mobile money risk management policy should be documented that defines the framework for mobile money risk management, including scope, process, governance and organization. The framework should be focused on mobile money risks, which are distinct from the usual mobile operator risks.\n\nA Risk Manager should be appointed as the single point of contact with responsibility for mobile money risk management.  This need not be a dedicated role and the individual could have other responsibilities.\n\nIf the provider has an enterprise risk management function, the mobile money Risk Manager should inform that team of the key mobile money risks.\n\nNote: GSMA has published a separate Risk Management Toolkit, which has examples of the risk management process and mobile money risks and controls.","ISO 27005:2018 Sec. 7.1","4.6.1.1.1","4.6.1.1.1","Has a mobile money risk management framework been documented that defines the mobile money risk management scope, process, governance and organization?","1) Risk management framework, process or similar document\n- Check that the process has been documented\n- Check that it defines the framework for mobile money risk management, including:\na) Scope\nb) Process \nc) Governance\nd) Organization",null,"Standard Required","Required","FraudRisk",null,null,"4","4.6","4.6.1","4.6.1: Les prestataires doivent mettre en place un cadre de gestion du risque permettant la détection, l’évaluation et le contrôle des risques.\n","4.6.1.1","GOUVERNANCE DE LA GESTION DES RISQUSE LIÉS À L'ARGENT MOBILE\nUne politique documentée de gestion des risques liés à l’argent mobile doit définir le cadre général de la gestion de ces risques, en termes notamment de champ d’application, de processus, de gouvernance et d’organisation. Ce cadre doit être axé sur les risques liés à l'argent mobile, qui sont distincts des risques habituels de la téléphonie mobile.\n\nUn responsable du risque doit être nommé en tant que point de contact unique ayant la responsabilité de la gestion des risques liés à l’argent mobile.   Cette fonction ne doit pas être sous-traitée à un intervenant extérieur et le responsable peut avoir d’autres responsabilités en parallèle.\n\nSi le prestataire dispose d’une fonction de gestion du risque au niveau de l’entreprise, le responsable du risque de l’argent mobile doit informer cette équipe des risques clés liés à l’argent mobile.\n\nRemarque : la GSMA a publié un outil spécifique de gestion des risques liés à l'argent mobile, qui contient des exemples de risques et de processus de gestion de ces risques.","ISO 27005:2018 Sec. 7.1","4.6.1.1.1","Un cadre général de la gestion des risques liés à l’argent mobile, en termes notamment de champ d’application, de processus, de gouvernance et d’organisation, a-t-il été défini ?","1) Directives relatives à la gestion des risques, processus de gestion des risques ou document similaire\n- Vérifier que le processus est documenté\n- Vérifier que le processus définit le cadre de la gestion des risques liés à l’argent mobile, y compris :\na) Sa portée\nb) Le processus \nc) Sa gouvernance\nd) Son organisation",null,{"$f":"VLOOKUP($BH101,CategoryTranslationTable,2,FALSE)","v":"Requis Normal"},{"$f":"VLOOKUP($BI101,CategoryTranslationTable,2,FALSE)","v":"Requis"},"FraudRisk",0,null,"4","4.6","4.6.1","4.6.1: Los proveedores deben establecer un marco de gestión de riesgos para la identificación, evaluación y control de riesgos","4.6.1.1","GOBERNANZA DE GESTIÓN DE RIESGOS DEL DINERO MÓVIL\nSe debe documentar una política de gestión de riesgos del dinero móvil que defina el marco de gestión de riesgos del dinero móvil, incluido su alcance, proceso, gobernanza y organización. El marco debe estar enfocado en los riesgos del dinero móvil, que son distintos de los riesgos habituales de los operadores móviles.\n\nSe debe designar un Gerente de Riesgos como único punto de contacto, responsable de la gestión de riesgos del dinero móvil.  No necesariamente tiene que ser un rol dedicado, sino que la persona podría tener otras responsabilidades.\n\nSi el proveedor cuenta con una función de gestión de riesgos empresariales, el Gerente de Riesgos del dinero móvil debe informar a ese equipo los riesgos clave del dinero móvil.\n\nNota: GSMA ha publicado un Kit de Herramientas de Gestión de Riesgos por separado, con ejemplos del proceso de gestión de riesgos, y los riesgos y controles del dinero móvil.","ISO 27005:2018 Sec. 7.1","4.6.1.1.1","¿Se documentó un marco de gestión de riesgos del dinero móvil que defina el alcance, proceso, gobernanza y organización de la gestión de riesgos?","1) Marco, proceso o documento similar de gestión de riesgos\n- Verificar que el proceso haya sido documentado\n- Verificar que defina el marco para la gestión de riesgos del dinero móvil, incluyendo:\na) Alcance\nb) Proceso\nc) Gobernanza\nd) Organización",null,{"$f":"VLOOKUP($BH101,CategoryTranslationTable,3,FALSE)","v":"Obligatorio estándar"},{"$f":"VLOOKUP($BI101,CategoryTranslationTable,3,FALSE)","v":"Obligatorio"},"FraudRisk",null,null,"4","4.6","4.6.1",null,"4.6.1.1",null,"ISO 27005:2018 Sec. 7.1","4.6.1.1.1",null,null,null,{"$f":"VLOOKUP($BH101,CategoryTranslationTable,4,FALSE)","v":"ReqS4"},{"$f":"VLOOKUP($BI101,CategoryTranslationTable,4,FALSE)","v":"Req4"},"FraudRisk",null,null,null,null,null,null,null,"MERGE","4.6.1.1.1","4.6.1.1.4",null,null,{"$f":"IF(OR($EA101=0,$EA101=2),VLOOKUP(DO101,INDIRECT(ED101),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP101),\"\",VLOOKUP(DP101,INDIRECT(EE101),7,FALSE))","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DQ101),\"\",VLOOKUP(DQ101,INDIRECT(EF101),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR101),\"\",VLOOKUP(DR101,INDIRECT(EG101),7,FALSE))","v":""},{"$f":"IF(OR($EA101=0,$EA101=2),VLOOKUP(DO101,INDIRECT(ED101),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP101),\"\",VLOOKUP(DP101,INDIRECT(EE101),8,FALSE))","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DQ101),\"\",VLOOKUP(DQ101,INDIRECT(EF101),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR101),\"\",VLOOKUP(DR101,INDIRECT(EG101),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN101,3)=\"NEW\")+2*AND(LEFT(DN101,3)=\"MER\")+3*AND(LEFT(DN101,3)=\"MOV\")+4*AND(LEFT(DN101,3)=\"SWA\")","v":2},{"$f":"IF(EA101=0,DS101,EN101)","v":""},{"$f":"IF(EA101=0,IF(DW101=0,\"\",DW101),CHOOSE(EA101,\"New indicator\",CONCATENATE(DW101,CarriageReturn,DX101,CarriageReturn,DY101,CarriageReturn,DZ101)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO101,1)","v":"OriginalComplianceP4"},{"$f":"\"OriginalComplianceP\"&LEFT(DP101,1)","v":"OriginalComplianceP4"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ101,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR101,1)","v":"OriginalComplianceP"},0,0,0,0,0,2,""]
[null,"4","4.6","4.6.1",0,"4.6.1.1",null,0,"4.6.1.1.2","4.6.1.1.2: Has an individual been appointed with responsibility for mobile money risk management?\n","1) Risk management organization chart and/or risk manager job description\n- Check that an individual been appointed with responsibility for mobile money risk management, to be the single point of contact. ",0,"Standard Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.6","4.6.1",null,"4.6.1.1",null,null,"4.6.1.1.2","4.6.1.1.2","Has an individual been appointed with responsibility for mobile money risk management?","1) Risk management organization chart and/or risk manager job description\n- Check that an individual been appointed with responsibility for mobile money risk management, to be the single point of contact. ",null,"Standard Required","Required","FraudRisk",null,null,"4","4.6","4.6.1",0,"4.6.1.1",0,0,"4.6.1.1.2","Une personne ayant la responsabilité de la gestion des risques liés à l'argent mobile a-t-elle été nommée ?","1) Organigramme de la gestion des risques et/ou descriptif du poste de responsable de la gestion des risques \n- Vérifier que la responsabilité de la gestion des risques liés à l’argent mobile a été assignée à une personne ayant le rôle de point de contact unique. ",null,"Requis Normal","Requis","FraudRisk",0,null,"4","4.6","4.6.1",null,"4.6.1.1",null,0,"4.6.1.1.2","¿Se designó a una persona como responsable de la gestión de riesgos del dinero móvil?","1) Organigrama de gestión de riesgos y/o descripción del trabajo del gerente de riesgos\n- Verificar que se haya designado a una persona como responsable de la gestión de riesgos del dinero móvil, para que actúe como único punto de contacto. ",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,"4","4.6","4.6.1",null,"4.6.1.1",null,0,"4.6.1.1.2",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"4.6.1.1.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.6","4.6.1","","4.6.1.2","4.6.1.2: RISK ASSESSMENT PROCESS\nRisk assessments should be carried out:\n- Regularly (at least annually);\n- Following a significant change to the mobile money system. \nThe assessment of each risk should be documented in a risk register.\n\nAll types of known risk that could impact the mobile money business should be included, including the following:\n- Fraud risks;\n- ML/ TF risks;\n- Financial risks;\n- Compliance risks;\n- Operational risks; and\n- Strategic risks.\n\nRisk management should be applied to all functions and systems delivering the mobile money service, including agents and other external parties that are part of the delivery of the mobile money service.","PCI DSS, ISO 27005:2018 Sec. 8 & 12.1, \nECB RSMP","4.6.1.2.1","4.6.1.2.1: Are risk assessments carried out at least annualy as well as following a significant change to the mobile money service?\n","1) Risk register (extract)\n2) Risk management framework, process or similar document\n- Check a risk assessment has been performed in at least the last year, and following a significant change to the mobile money service.\n- If no significant changes made in the last year, check the process documentation.\nNote: it may not be possible to view the contents of the risk register, as it is sensitive, but is should be possible to view its change log",0,"Urgent Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.6","4.6.1","","4.6.1.2","RISK ASSESSMENT PROCESS\nRisk assessments should be carried out:\n- Regularly (at least annually);\n- Following a significant change to the mobile money system. \nThe assessment of each risk should be documented in a risk register.\n\nAll types of known risk that could impact the mobile money business should be included, including the following:\n- Fraud risks;\n- ML/ TF risks;\n- Financial risks;\n- Compliance risks;\n- Operational risks; and\n- Strategic risks.\n\nRisk management should be applied to all functions and systems delivering the mobile money service, including agents and other external parties that are part of the delivery of the mobile money service.","PCI DSS, ISO 27005:2018 Sec. 8 & 12.1, \nECB RSMP","4.6.1.2.1","4.6.1.2.1","Are risk assessments carried out at least annualy as well as following a significant change to the mobile money service?","1) Risk register (extract)\n2) Risk management framework, process or similar document\n- Check a risk assessment has been performed in at least the last year, and following a significant change to the mobile money service.\n- If no significant changes made in the last year, check the process documentation.\nNote: it may not be possible to view the contents of the risk register, as it is sensitive, but is should be possible to view its change log",null,"Urgent Required","Required","FraudRisk",null,null,"4","4.6","4.6.1","","4.6.1.2","PROCESSUS D'ÉVALUATION DES RISQUES\nUne évaluation des risques doit être effectuée :\n- régulièrement (au moins une fois par an) ;\n- à la suite de tout changement significatif du système de l’argent mobile. \nL’évaluation de chaque risque doit être documentée dans un registre des risques.\n\nToutes les catégories de risques connus susceptibles d’avoir un impact sur l’activité de l’argent mobile doivent être couvertes, et notamment :\n- les risques liés à la fraude ;\n- les risques de blanchiment de capitaux et de financement du terrorisme ;\n- les risques financiers ;\n- les risques de conformité ;\n- les risques opérationnels ;\n- les risques stratégiques.\n\nLa gestion des risques doit concerner toutes les fonctions et tous les systèmes contribuant au service d’argent mobile, y compris les agents et autres intervenants extérieurs participant à la distribution du service.","PCI DSS, ISO 27005:2018 Sec. 8 & 12.1, \nECB RSMP","4.6.1.2.1","Les évaluations des risques sont-elles réalisées au moins une fois par an et à la suite de tout changement significatif du système de l’argent mobile ?","1) Registre des risques (extrait)\n\r2) Processus/directive-cadre encadrant la gestion des risques ou document similaire\r\n- Vérifier que des évaluations de risques ont été effectuées au minimum au cours de l’année passée, et à la suite de changements significatifs du service d’argent mobile.\r\n- Si aucun changement significatif n’a eu lieu au cours de l’année passée, vérifier la documentation du processus.\r\nRemarque : le contenu du registre des risques peut ne pas être accessible, car il s’agit d’informations sensibles. Le journal des changements devrait en revanche pouvoir être consulté.\r",null,"Requis Prioritaire","Requis","FraudRisk",0,null,"4","4.6","4.6.1","","4.6.1.2","PROCESO DE EVALUACIÓN DE RIESGOS\nSe deben llevar a cabo evaluaciones de riesgos:\n- Periódicamente (al menos una vez al año);\n- Después de un cambio significativo al sistema del dinero móvil. \nLa evaluación de cada riesgo debe ser documentada en un registro de riesgos.\n\nSe deben incluir todos los tipos de riesgos conocidos que podrían afectar al negocio del dinero móvil, incluidos los siguientes:\n- Riesgos de fraude;\n- Riesgos de LA/FT;\n- Riesgos financieros;\n- Riesgos de cumplimiento;\n- Riesgos operativos; y\n- Riesgos estratégicos.\n\nSe debe aplicar la gestión de riesgos a todas las funciones y sistemas que prestan el servicio del dinero móvil, incluidos los agentes y otros terceros externos que forman parte de la prestación del servicio del dinero móvil.","PCI DSS, ISO 27005:2018 Sec. 8 & 12.1, \nECB RSMP","4.6.1.2.1","¿Se llevan a cabo evaluaciones de riesgos, al menos, una vez al año o después de un cambio significativo al servicio del dinero móvil?","1) Registro de riesgos (extracto)\n2) Marco, proceso o documento similar de gestión de riesgos\n- Verificar que se haya realizado una evaluación de riesgos, al menos, en el último año, y después de un cambio significativo en el servicio del dinero móvil.\n- Si no se realizaron cambios significativos en el último año, verificar la documentación del proceso.\nNota: es posible que no se pueda visualizar el contenido del registro de riesgos porque es sensible, pero se debería poder visualizar su registro de cambios",null,"Obligatorio urgente","Obligatorio","FraudRisk",null,null,"4","4.6","4.6.1",null,"4.6.1.2",null,"PCI DSS, ISO 27005:2018 Sec. 8 & 12.1, \nECB RSMP","4.6.1.2.1",null,null,null,"ReqU4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"4.6.1.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.6","4.6.1","","4.6.1.2",null,0,"4.6.1.2.2","4.6.1.2.2: Are risk assessments documented in a risk register?\n","1) Risk register (extract)\n- Check that there is a documented risk register that has been updated/reviewed in at least the last year. \nNote: it may not be possible to view the contents of the risk register, as it is sensitive, but is should be possible to view a heat map showing number of risks identified and categorized, or similar extract. ",0,"Standard Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.6","4.6.1","","4.6.1.2",null,null,"4.6.1.2.2","4.6.1.2.2","Are risk assessments documented in a risk register?","1) Risk register (extract)\n- Check that there is a documented risk register that has been updated/reviewed in at least the last year. \nNote: it may not be possible to view the contents of the risk register, as it is sensitive, but is should be possible to view a heat map showing number of risks identified and categorized, or similar extract. ",null,"Standard Required","Required","FraudRisk",null,null,"4","4.6","4.6.1","","4.6.1.2",0,0,"4.6.1.2.2","les évaluations des risques sont-elles documentées dans un registre des risques ?","1) Registre des risques (extrait)\n\r- Vérifier qu’un registre des risques documenté a été établi et qu’il a été mis à jour/examiné au minimum cours de l’année passée. \r\nRemarque : le contenu du registre des risques peut ne pas être accessible, car il s’agit d’informations sensibles. Une heat map présentant le nombre de risques identifiés et classés, ou l’extrait d’un document similaire devrait en revanche pouvoir être consulté(e).\r",null,"Requis Normal","Requis","FraudRisk",0,null,"4","4.6","4.6.1","","4.6.1.2",null,0,"4.6.1.2.2","¿Las evaluaciones de riesgos son documentadas en un registro de riesgos?","1) Registro de riesgos (extracto)\n- Verificar que exista un registro de riesgos documentado que haya sido actualizado/revisado, al menos, una vez en el último año. \nNota: es posible que no se pueda visualizar el contenido del registro de riesgos porque es sensible, pero se debería poder visualizar un mapa de riesgos que muestre la cantidad de riesgos identificados y categorizados, o un extracto similar. ",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,"4","4.6","4.6.1",null,"4.6.1.2",null,0,"4.6.1.2.2",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"4.6.1.2.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.6","4.6.1","","4.6.1.2",null,0,"4.6.1.2.3","4.6.1.2.3: Are all types of known risk that could impact the mobile money business included in risk assessments, including fraud risks, ML/ TF risks, financial risks, compliance risks, operational risks, strategic risks, agent risks, 3rd party risks?\n","1) Risk management process or framework\n- Check there are suitable / sufficient categories including, for example\na) Fraud\nb) ML/CFT\nc) Financial\nd) Compliance\ne) Operational and strategic risks\nf) Agent and 3rd party risks\n",0,"Standard Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.6","4.6.1","","4.6.1.2",null,null,"4.6.1.2.3","4.6.1.2.4","Are all types of known risk that could impact the mobile money business included in risk assessments, including fraud risks, ML/ TF risks, financial risks, compliance risks, operational risks, strategic risks, agent risks, 3rd party risks?","1) Risk management process or framework\n- Check there are suitable / sufficient categories including, for example\na) Fraud\nb) ML/CFT\nc) Financial\nd) Compliance\ne) Operational and strategic risks\nf) Agent and 3rd party risks\n",null,"Standard Required","Required","FraudRisk",null,null,"4","4.6","4.6.1","","4.6.1.2",0,0,"4.6.1.2.3","Toutes les catégories de risques connus susceptibles d’avoir un impact sur l’activité de l’argent mobile , y compris les risques liés à la fraude, de blanchiment de capitaux et de financement du terrorisme, financiers, de conformité, opérationnels, stratégiques, et risques liés aux agents et aux tiers sont-elles comprises dans les évaluations des risques ?","1) Processus de gestion des risques ou directives relatives à la gestion des risques\n- Vérifier que les catégories sont appropriées/en nombre suffisant, par exemple\na) Fraude, \nb) ML/CFT, \nc) Finances, \nd) Conformité, \ne) Risques opérationnels et stratégiques\nf) Risques liés aux agents et aux tiers\n",null,"Requis Normal","Requis","FraudRisk",0,null,"4","4.6","4.6.1","","4.6.1.2",null,0,"4.6.1.2.3","¿Las evaluaciones de riesgos incluyen todos los riesgos conocidos que podrían afectar al negocio del dinero móvil, incluidos los riesgos de fraude, riesgos de LA/FT, riesgos financieros, riesgos de cumplimiento, riesgos operativos, riesgos estratégicos, riesgos de agentes y riesgos de terceros?","1) Proceso o marco de gestión de riesgos\n- Verificar que existan categorías adecuadas / suficientes, incluidas, por ejemplo\na) Fraude, \nb) LA/CFT, \nc) Financiero, \nd) Cumplimiento, \ne) Riesgos operativos y estratégicos\nf) Riesgos de agentes y terceros\n",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,"4","4.6","4.6.1",null,"4.6.1.2",null,0,"4.6.1.2.3",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,"MERGE","4.6.1.2.4","4.6.1.2.3",null,null,{"$error":"#REF!"},{"$error":"#REF!"},"","",{"$error":"#REF!"},{"$error":"#REF!"},"","",2,"",{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,2,""]
[null,"4","4.6","4.6.1","","4.6.1.3","4.6.1.3: RISK IDENTIFICATION AND EVALUATION \nEach risk assessment should identify new risks and evaluate their severity. It should also re-evaluate risks that were reviewed in the previous risk assessment. This information can be used to prioritize the application of resources to address these risks.\n\nAn owner should be assigned to each risk, which is usually the relevant functional manager.\n\nThe severity of each risk should be assessed. Usually, this is calculated using a formula combining risk impact and likelihood:\n- Impact - the impact that the risk would have if it materialized;\n- Likelihood - the probability (or frequency) that the risk will materialize.\nThe impact and likelihood scores should take into account the existing controls that are in place to mitigate the risk (net risk). Additionally, if desired, scoring can be done on the assumption of no controls (gross risk).\n\nOne way to measure severity is to assign a score (e.g. 1-5) to Impact and to Likelihood and to multiply these values together to give a combined score for Severity (1-25).\n\nExamples of types of impact that should be considered include:\n- Financial loss for the provider or customers;\n- Reputation / brand damage;\n- Non-compliance with regulatory requirements; and\n- Operational impact on the mobile money business.","ISO 27005:2018 Sec. 7 & 7.2.3","4.6.1.3.1","4.6.1.3.1: Do risk assessments identify and evaluate new risks that have emerged since the previous risk assessment?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.6","4.6.1","","4.6.1.3","RISK IDENTIFICATION AND EVALUATION \nEach risk assessment should identify new risks and evaluate their severity. It should also re-evaluate risks that were reviewed in the previous risk assessment. This information can be used to prioritize the application of resources to address these risks.\n\nAn owner should be assigned to each risk, which is usually the relevant functional manager.\n\nThe severity of each risk should be assessed. Usually, this is calculated using a formula combining risk impact and likelihood:\n- Impact - the impact that the risk would have if it materialized;\n- Likelihood - the probability (or frequency) that the risk will materialize.\nThe impact and likelihood scores should take into account the existing controls that are in place to mitigate the risk (net risk). Additionally, if desired, scoring can be done on the assumption of no controls (gross risk).\n\nOne way to measure severity is to assign a score (e.g. 1-5) to Impact and to Likelihood and to multiply these values together to give a combined score for Severity (1-25).\n\nExamples of types of impact that should be considered include:\n- Financial loss for the provider or customers;\n- Reputation / brand damage;\n- Non-compliance with regulatory requirements; and\n- Operational impact on the mobile money business.","ISO 27005:2018 Sec. 7 & 7.2.3","4.6.1.3.1","4.6.1.3.1","Do risk assessments identify and evaluate new risks that have emerged since the previous risk assessment?",null,null,"Recommended","Recommended","FraudRisk",null,null,"4","4.6","4.6.1","","4.6.1.3","IDENTIFICATION ET ÉVALUATION DES RISQUES\nChaque évaluation des risques doit recenser les nouveaux risques et évaluer leur gravité. Elle doit également réévaluer les risques examinés dans le cadre des précédentes évaluations. Ces informations permettent ensuite de déterminer l’ordre de priorité de l’attribution des ressources pour répondre à ces risques.   \n\nUn « propriétaire » doit être assigné à chaque risque – Il s’agit en général du responsable de la fonction concernée.  \n\nLa gravité de chaque risque doit être évaluée. Elle est généralement calculée sur la base d’une formule combinant l’impact et la probabilité du risque en question:\n- Impact : conséquences du risque s’il devait se concrétiser ;  \n- Probabilité : probabilité (ou fréquence) de concrétisation du risque.\nLes notes d’impact et de probabilité doivent tenir compte des mesures de contrôle déjà en place pour atténuer le risque (risque net). Elles peuvent également, si l’entreprise le souhaite, être établies sans tenir compte des mesures de contrôle (risque brut).\n\nUne méthode de mesure de la gravité consiste à attribuer une note (de 1 à 5 par exemple) à l’impact et à la probabilité et à multiplier ces deux chiffres pour obtenir une note combinée de gravité (de 1 à 25).\n\nParmi les impacts à évaluer figurent par exemple :\n- les pertes financières pour le prestataire ou ses clients ;\n- les atteintes à sa réputation et son image de marque ; \n- les infractions aux obligations réglementaires ;   \n- l’impact opérationnel sur l’activité de l’argent mobile.","ISO 27005:2018 Sec. 7 & 7.2.3","4.6.1.3.1","est-ce que les évaluations des risques recensent et évaluent les nouveaux risques qui sont apparus depuis la précédente évaluation ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"4","4.6","4.6.1","","4.6.1.3","EVALUACIÓN E IDENTIFICACIÓN DE RIESGOS\nCada evaluación de riesgos debe identificar nuevos riesgos y evaluar su severidad. También debe reevaluar los riesgos revisados en la evaluación de riesgos anterior. Esta información puede ser utilizada para priorizar la asignación de recursos y resolver estos riesgos.\n\nSe debe asignar un titular a cada riesgo, que generalmente es el gerente de la función correspondiente.\n\nSe debe evaluar la severidad de cada riesgo. En general, se calcula empleando una fórmula que combina el impacto y la probabilidad del riesgo:\n- Impacto - el impacto que causaría el riesgo si se materializara;\n- Probabilidad - la probabilidad (o frecuencia) de que el riesgo se materialice.\nLos puntajes de impacto y probabilidad deben tener en cuenta los controles existentes implementados para mitigar el riesgo (riesgo neto). Adicionalmente, si se desea, se pueden asignar los puntajes suponiendo que no existe ningún control (riesgo bruto).\n\nUna forma de medir la severidad es asignar un puntaje (por ej., 1-5) al Impacto y a la Probabilidad y multiplicarlos para obtener un puntaje combinado de Severidad (1-25).\n\nLos ejemplos de tipos de impacto que se deben considerar incluyen:\n- Pérdida financiera para el proveedor o los clientes;\n- Daño a la reputación / marca;\n- Incumplimiento de los requisitos regulatorios; e \n- Impacto operativo al negocio del dinero móvil.","ISO 27005:2018 Sec. 7 & 7.2.3","4.6.1.3.1","¿Las evaluaciones de riesgos identifican y evalúan nuevos riesgos que surgieron desde la evaluación de riesgos anterior?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"4","4.6","4.6.1",null,"4.6.1.3",null,"ISO 27005:2018 Sec. 7 & 7.2.3","4.6.1.3.1",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"4.6.1.3.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.6","4.6.1","","4.6.1.3",null,0,"4.6.1.3.2","4.6.1.3.2: Do risk assessments re-evaluate risks that were reviewed in the previous risk assessment?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.6","4.6.1","","4.6.1.3",null,null,"4.6.1.3.2","4.6.1.3.2","Do risk assessments re-evaluate risks that were reviewed in the previous risk assessment?",null,null,"Recommended","Recommended","FraudRisk",null,null,"4","4.6","4.6.1","","4.6.1.3",0,0,"4.6.1.3.2","est-ce que les évaluations des risques réévaluent les risques analysés dans le cadre de la précédente évaluation ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"4","4.6","4.6.1","","4.6.1.3",null,0,"4.6.1.3.2","¿Las evaluaciones de riesgos reevalúan los riesgos revisados en la evaluación de riesgos anterior?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"4","4.6","4.6.1",null,"4.6.1.3",null,0,"4.6.1.3.2",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"4.6.1.3.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.6","4.6.1","","4.6.1.3",null,0,"4.6.1.3.3","4.6.1.3.3: Is an owner assigned to each risk (e.g. the relevant functional manager)?\n","1) Risk register (extract)\n2) Risk management framework, process or similar document\n- Check that all risks in the register have an owner assigned from the relevant functional department.",0,"Standard Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.6","4.6.1","","4.6.1.3",null,null,"4.6.1.3.3","4.6.1.3.3","Is an owner assigned to each risk (e.g. the relevant functional manager)?","1) Risk register (extract)\n2) Risk management framework, process or similar document\n- Check that all risks in the register have an owner assigned from the relevant functional department.",null,"Standard Required","Required","FraudRisk",null,null,"4","4.6","4.6.1","","4.6.1.3",0,0,"4.6.1.3.3","un propriétaire du risque est-il assigné à chaque risque (par exemple, le responsable de la fonction concernée) ?","1) Registre des risques (extrait) \n2) Processus/directive encadrant la gestion des risques ou document similaire\n- Vérifier qu’un propriétaire issu de la fonction concernée a été assigné à chacun des risques figurant au registre.",null,"Requis Normal","Requis","FraudRisk",0,null,"4","4.6","4.6.1","","4.6.1.3",null,0,"4.6.1.3.3","¿Se asigna un titular a cada riesgo (por ej., el gerente de la función correspondiente)?","1) Registro de riesgos (extracto)\n2) Marco, proceso o documento similar de gestión de riesgos\n- Verificar que todos los riesgos en el registro tengan un titular asignado del departamento de la función correspondiente.",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,"4","4.6","4.6.1",null,"4.6.1.3",null,0,"4.6.1.3.3",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"4.6.1.3.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.6","4.6.1","","4.6.1.3",null,0,"4.6.1.3.4","4.6.1.3.4: Is the severity of each risk assessed by considering the impact and likelihood of the risk occurring, taking into account the controls that are in place to mitigate the risk?\n","1) Risk register (extract)\n2) Risk management framework, process or similar document\n- Check that all risks in the register have a severity rating assigned.",0,"Standard Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.6","4.6.1","","4.6.1.3",null,null,"4.6.1.3.4","4.6.1.3.4","Is the severity of each risk assessed by considering the impact and likelihood of the risk occurring, taking into account the controls that are in place to mitigate the risk?","1) Risk register (extract)\n2) Risk management framework, process or similar document\n- Check that all risks in the register have a severity rating assigned.",null,"Standard Required","Required","FraudRisk",null,null,"4","4.6","4.6.1","","4.6.1.3",0,0,"4.6.1.3.4","la gravité de chaque risque est-elle évaluée sur la base de l'impact et de la probabilité d’occurrence du risque, en tenant compte des mesures de contrôle en place qui atténuent le risque en question ?","1) Registre des risques (extrait) \n2) Processus/directive encadrant la gestion des risques ou document similaire\n- Vérifier qu’une note de gravité a été attribuée à chacun des risques figurant au registre.",null,"Requis Normal","Requis","FraudRisk",0,null,"4","4.6","4.6.1","","4.6.1.3",null,0,"4.6.1.3.4","¿Se evalúa la severidad de cada riesgo considerando el impacto y la probabilidad de ocurrencia del riesgo, teniendo en cuenta los controles implementados para mitigar el riesgo?","1) Registro de riesgos (extracto)\n2) Marco, proceso o documento similar de gestión de riesgos\n- Verificar que todos los riesgos en el registro tengan un puntaje de severidad asignado.",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,"4","4.6","4.6.1",null,"4.6.1.3",null,0,"4.6.1.3.4",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"4.6.1.3.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.6","4.6.1","","4.6.1.4","4.6.1.4: RISK ACTIONS\nThe risk management process should identify actions to be taken to manage each risk. Actions include:\n- treat (apply additional controls);\n- tolerate (accept the level of risk);\n- transfer (pass the risk onto another party - e.g. insurance); or\n- terminate (cease the business activity that has the risk).\n\nThe usual course of action is to implement improved controls to improve the risk severity score to an acceptable level. Controls reduce the severity of the risk by reducing the impact and/or likelihood.\n\nActions should be assigned to the owners of the risks, which are usually the functional managers and not the Risk Manager.","ISO 27005:2018 Sec. 9","4.6.1.4.1","4.6.1.4.1: Does the risk management process identify actions to be taken to manage each risk, such as improving controls where necessary (i.e. treat / tolerate / transfer / terminate)?\n","1) Risk register (extract)\n2) Risk management framework, process or similar document\n- Check the risk management process has actions identified for each risk,  (e.g. treat / tolerate / transfer / terminate), with a responsible party for each action.",0,"Standard Required","Required","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.6","4.6.1","","4.6.1.4","RISK ACTIONS\nThe risk management process should identify actions to be taken to manage each risk. Actions include:\n- treat (apply additional controls);\n- tolerate (accept the level of risk);\n- transfer (pass the risk onto another party - e.g. insurance); or\n- terminate (cease the business activity that has the risk).\n\nThe usual course of action is to implement improved controls to improve the risk severity score to an acceptable level. Controls reduce the severity of the risk by reducing the impact and/or likelihood.\n\nActions should be assigned to the owners of the risks, which are usually the functional managers and not the Risk Manager.","ISO 27005:2018 Sec. 9","4.6.1.4.1","4.6.1.4.1","Does the risk management process identify actions to be taken to manage each risk, such as improving controls where necessary (i.e. treat / tolerate / transfer / terminate)?","1) Risk register (extract)\n2) Risk management framework, process or similar document\n- Check the risk management process has actions identified for each risk,  (e.g. treat / tolerate / transfer / terminate), with a responsible party for each action.",null,"Standard Required","Required","FraudRisk",null,null,"4","4.6","4.6.1","","4.6.1.4","MESURES DE CONTRÔLE DES RISQUES\nLe processus de gestion du risque doit identifier les mesures à prendre pour gérer chaque risque. Ces mesures peuvent consister à :\n- traiter (mettre en place des mesures de contrôle supplémentaires) ;\n- tolérer (accepter le niveau de risque) ;\n- transférer (transmettre le risque à une autre partie – par le biais de l’assurance par exemple) ;\n- cesser (mettre fin à l’activité qui est à l'origine du risque). \n\nLes mesures habituelles consistent à mettre en place des mesures de contrôle améliorées pour ramener la note de gravité du risque à un niveau acceptable. Les mesures de contrôle réduisent la gravité du risque en réduisant son impact et/ou sa probabilité. \n\nCes mesures doivent être assignées aux propriétaires des risques, qui sont généralement les responsables des fonctions concernées et non le responsable de la gestion des risques.\n","ISO 27005:2018 Sec. 9","4.6.1.4.1","le processus de gestion du risque identifie-t-il les mesures à prendre pour gérer chaque risque, comme par exemple une amélioration des mesures de contrôle si nécessaire (ex. traiter / tolérer / transférer / cesser) ?","1) Registre des risques (extrait) \n2) Processus/directive encadrant la gestion des risques ou document similaire\n- Vérifier que le processus de gestion des risques identifie les mesures à prendre pour gérer chaque risque (ex. traiter / tolérer / transférer / cesser), et désigne la partie responsable de la mise en œuvre de chaque mesure.\n",null,"Requis Normal","Requis","FraudRisk",0,null,"4","4.6","4.6.1","","4.6.1.4","ACCIONES PARA GESTIONAR RIESGOS\nEl proceso de gestión de riesgos debe identificar las acciones que se deben implementar para gestionar cada riesgo. Estas acciones incluyen:\n- tratar (aplicar controles adicionales);\n- tolerar (aceptar el nivel del riesgo);\n- transferir (traspasar el riesgo a otra parte - por ej., seguro); o\n- terminar (interrumpir la actividad del negocio que plantea el riesgo).\n\nEl curso de acción habitual es aumentar los controles para mejorar el puntaje de severidad del riesgo a un nivel aceptable. Los controles reducen la severidad del riesgo al reducir el impacto y/o la probabilidad.\n\nLas acciones deben ser asignadas a cada titular de los riesgos, que generalmente son los gerentes de las funciones y no el Gerente de Riesgos.","ISO 27005:2018 Sec. 9","4.6.1.4.1","¿El proceso de gestión de riesgos identifica las acciones que se deben realizar para gestionar cada riesgo, tal como aumentar los controles cuando sea necesario (es decir, tratar/ tolerar / transferir / terminar)?","1) Registro de riesgos (extracto)\n2) Marco, proceso o documento similar de gestión de riesgos\n- Verificar que el proceso de gestión de riesgos haya identificado acciones para cada riesgo, (por ej., tratar / tolerar / transferir / terminar), con un responsable para cada acción.",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,"4","4.6","4.6.1",null,"4.6.1.4",null,"ISO 27005:2018 Sec. 9","4.6.1.4.1",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"4.6.1.4.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.6","4.6.1","","4.6.1.5","4.6.1.5: RISK ACCEPTANCE \nRisks cannot, in general, be reduced to zero. This means that the provider should make a formal decision to tolerate certain levels of risk. This requires acceptance of the risk at the appropriate level of management, with the justification documented.\n\nRisk acceptance criteria should be set to help determine when to accept risks. Typically, a maximum target level of risk should be set. Exceptions may be allowed under certain circumstances. For example:\n- Provisions may be included for senior managers to accept risks above the maximum level under defined circumstances;\n- Higher risks may be accepted by comparing estimated profit (or other business benefit) to the cost of controlling the risk;\n- Higher risks may be accepted temporarily pending controls to be implemented within a defined time period.\n\nNOTE: A lower threshold of risk acceptability may be established for compliance risks.\n","ISO 27005:2011 Sec. 7.2.4, Sec. 10","4.6.1.5.1","4.6.1.5.1: Has the decision to tolerate certain levels of risk been signed off at the appropriate level of management?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.6","4.6.1","","4.6.1.5","RISK ACCEPTANCE \nRisks cannot, in general, be reduced to zero. This means that the provider should make a formal decision to tolerate certain levels of risk. This requires acceptance of the risk at the appropriate level of management, with the justification documented.\n\nRisk acceptance criteria should be set to help determine when to accept risks. Typically, a maximum target level of risk should be set. Exceptions may be allowed under certain circumstances. For example:\n- Provisions may be included for senior managers to accept risks above the maximum level under defined circumstances;\n- Higher risks may be accepted by comparing estimated profit (or other business benefit) to the cost of controlling the risk;\n- Higher risks may be accepted temporarily pending controls to be implemented within a defined time period.\n\nNOTE: A lower threshold of risk acceptability may be established for compliance risks.\n","ISO 27005:2011 Sec. 7.2.4, Sec. 10","4.6.1.5.1","4.6.1.5.1","Has the decision to tolerate certain levels of risk been signed off at the appropriate level of management?",null,null,"Recommended","Recommended","FraudRisk",null,null,"4","4.6","4.6.1","","4.6.1.5","ACCEPTATION DU RISQUE\nEn règle générale, les risques ne peuvent pas être réduits à zéro. Cela signifie que le prestataire doit prendre la décision formelle de tolérer certains niveaux de risque, ce qui implique qu’il y ait acceptation du risque au niveau hiérarchique approprié, avec documentation de la justification.\n\nDes critères d’acceptation du risque doivent être définis pour permettre de déterminer quand certains risques peuvent être acceptés. Il convient en général de fixer un niveau de risque maximum. Des exceptions peuvent être autorisées dans certaines circonstances, par exemple :  \n- des dispositions peuvent autoriser les dirigeants de l’entreprise à accepter des risques  supérieurs au plafond fixé dans certaines circonstances précises ;  \n- des risques plus importants peuvent être acceptés dans le cadre d’une comparaison des bénéfices estimés (ou autre avantage commercial) par rapport au coût des mesures de prévention ;\n- des risques plus importants peuvent être acceptés temporairement dans l’attente de la mise en place de mesures de contrôle à l’issue d’un certain délai.  \n\nREMARQUE : un seuil réduit d’acceptabilité des risques peut être fixé pour les risques de conformité. \n","ISO 27005:2011 Sec. 7.2.4, Sec. 10","4.6.1.5.1","la décision de tolérer certains niveaux de risque a-t-elle été approuvée au niveau hiérarchique approprié ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"4","4.6","4.6.1","","4.6.1.5","ACEPTACIÓN DE RIESGOS\nPor lo general, los riesgos no se pueden reducir a cero. Esto significa que un proveedor debe tomar la decisión formal de tolerar ciertos niveles de riesgo. Esto requiere la aceptación del riesgo por parte del nivel de gerencia correspondiente, con la justificación documentada.\n\nSe deben establecer criterios de aceptación de riesgos para ayudar a determinar cuándo aceptar riesgos. Generalmente, se debe establecer un nivel de riesgo objetivo máximo. Se pueden permitir excepciones bajo determinadas circunstancias. Por ejemplo:\n- Se pueden incluir disposiciones para que la alta gerencia pueda aceptar riesgos por encima del nivel máximo bajo determinadas circunstancias;\n- Se pueden aceptar riesgos más altos al comparar las ganancias estimadas (u otro beneficio comercial) con el costo de control del riesgo;\n- Se pueden aceptar riesgos más altos temporalmente cuando existen controles pendientes de implementación dentro de un período de tiempo definido.\n\nNOTA: Para los riesgos de cumplimiento se puede establecer un umbral más bajo de aceptación de riesgos.\n","ISO 27005:2011 Sec. 7.2.4, Sec. 10","4.6.1.5.1","¿El nivel de gerencia correspondiente aprobó la decisión de tolerar ciertos niveles de riesgo?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"4","4.6","4.6.1",null,"4.6.1.5",null,"ISO 27005:2011 Sec. 7.2.4, Sec. 10","4.6.1.5.1",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"4.6.1.5.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.6","4.6.1","","4.6.1.5",null,0,"4.6.1.5.2","4.6.1.5.2: Have risk acceptance criteria been defined to help determine when to accept risks and to establish maximum target levels of risk?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.6","4.6.1","","4.6.1.5",null,null,"4.6.1.5.2","4.6.1.5.2","Have risk acceptance criteria been defined to help determine when to accept risks and to establish maximum target levels of risk?",null,null,"Recommended","Recommended","FraudRisk",null,null,"4","4.6","4.6.1","","4.6.1.5",0,0,"4.6.1.5.2","des critères d’acceptation du risque ont-ils été définis pour permettre de déterminer quand certains risques peuvent être acceptés et d’établir des niveaux de risque maximum ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"4","4.6","4.6.1","","4.6.1.5",null,0,"4.6.1.5.2","¿Se definieron criterios de aceptación de riesgos para ayudar a determinar cuándo aceptar riesgos y para establecer niveles de riesgo máximos?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"4","4.6","4.6.1",null,"4.6.1.5",null,0,"4.6.1.5.2",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"4.6.1.5.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.6","4.6.1","","4.6.1.5",null,0,"4.6.1.5.3","4.6.1.5.3: Do risk acceptance criteria allow exceptions, such as higher risks being approved by senior management or higher risks being accepted temporarily pending planned implementation of controls?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.6","4.6.1","","4.6.1.5",null,null,"4.6.1.5.3","4.6.1.5.3","Do risk acceptance criteria allow exceptions, such as higher risks being approved by senior management or higher risks being accepted temporarily pending planned implementation of controls?",null,null,"Recommended","Recommended","FraudRisk",null,null,"4","4.6","4.6.1","","4.6.1.5",0,0,"4.6.1.5.3","les critères d’acceptation du risque autorisent-ils des exceptions, comme par exemple l’autorisation par les dirigeants de risques plus importants ou l’acceptation temporaire de risques plus importants dans l’attente de la mise en place prévue de mesures de contrôle ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"4","4.6","4.6.1","","4.6.1.5",null,0,"4.6.1.5.3","¿Los criterios de aceptación de riesgos permiten excepciones, tales como la aprobación de riesgos más altos por parte de la alta gerencia o la aceptación temporal de riesgos más altos cuando existen controles planificados pendientes de implementación?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"4","4.6","4.6.1",null,"4.6.1.5",null,0,"4.6.1.5.3",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"4.6.1.5.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.6","4.6.1","","4.6.1.5",null,0,"4.6.1.5.4","4.6.1.5.4: Do compliance risks have a lower threshold of risk acceptability?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.6","4.6.1","","4.6.1.5",null,null,"4.6.1.5.4","4.6.1.5.4","Do compliance risks have a lower threshold of risk acceptability?",null,null,"Recommended","Recommended","FraudRisk",null,null,"4","4.6","4.6.1","","4.6.1.5",0,0,"4.6.1.5.4","les risques de conformité ont-ils un seuil plus bas d'acceptabilité du risque ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"4","4.6","4.6.1","","4.6.1.5",null,0,"4.6.1.5.4","¿Los riesgos de cumplimiento tienen un umbral de aceptabilidad más bajo?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"4","4.6","4.6.1",null,"4.6.1.5",null,0,"4.6.1.5.4",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"4.6.1.5.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.6","4.6.1","","4.6.1.6","4.6.1.6: RISK COMMUNICATION AND MONITORING\nThe risk register should be communicated to risk owners and the head of mobile money at least every 12 months. High-severity risks should be highlighted to senior management.\n\nRisk owners should be informed of the required actions for implementing further controls, and these actions should be monitored by the Risk Manager to ensure that they are implemented.\n\nRegular reporting should be implemented to track Key Risk Indicators (KRIs) which will show whether risks are materializing. KRIs fall into two categories:\n - Leading indicators, which give an indication of risks that may be about to materialize;\n - Lagging indicators, which report on risks that are already starting to materialize.\n","ISO 27005:2018 Sec. 11","4.6.1.6.1","4.6.1.6.1: Is the risk register been communicated to risk owners, the head of mobile money and senior management at least every 12 months?\n","1) Risk management process \n-  Check that in the last 12 months the risk register has been communicated to risk owners, the head of mobile money and senior management (including the board risk committee or similar governance entity). ",0,"Standard Required","Required","FraudRisk",{"$f":"CHOOSE(LanguageNumber,BK115,CA115,CQ115,DG115)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.6","4.6.1","","4.6.1.6","RISK COMMUNICATION AND MONITORING\nThe risk register should be communicated to risk owners and the head of mobile money at least every 12 months. High-severity risks should be highlighted to senior management.\n\nRisk owners should be informed of the required actions for implementing further controls, and these actions should be monitored by the Risk Manager to ensure that they are implemented.\n\nRegular reporting should be implemented to track Key Risk Indicators (KRIs) which will show whether risks are materializing. KRIs fall into two categories:\n - Leading indicators, which give an indication of risks that may be about to materialize;\n - Lagging indicators, which report on risks that are already starting to materialize.\n","ISO 27005:2018 Sec. 11","4.6.1.6.1","4.6.1.6.1","Is the risk register been communicated to risk owners, the head of mobile money and senior management at least every 12 months?","1) Risk management process \n-  Check that in the last 12 months the risk register has been communicated to risk owners, the head of mobile money and senior management (including the board risk committee or similar governance entity). ",null,"Standard Required","Required","FraudRisk",null,null,"4","4.6","4.6.1","","4.6.1.6","COMMUNICATION ET SURVEILLANCE DES RISQUES\nLe registre des risques doit être communiqué aux propriétaires des risques et à la direction de l’argent mobile au mois une fois par an. Les risques graves doivent être notifiés à la direction générale.\n\nLes propriétaires des risques doivent être informés des actions requises pour la mise en place de contrôles supplémentaires, et ces actions doivent être surveillées par le responsable de la gestion des risques pour en assurer la bonne mise en place. \n\nDes rapports réguliers doivent être mis en place pour suivre les principaux indicateurs de risque (KRI : Key Risk Indicators) susceptibles de signaler la concrétisation des risques. Les KRI se divisent en deux catégories :\n - indicateurs prévisionnels, qui signalent les risques sur le point de se concrétiser ;\n - indicateurs rétrospectifs, qui signalent les risques ayant déjà commencé à se concrétiser.\n","ISO 27005:2018 Sec. 11","4.6.1.6.1","Le registre des risques est-il communiqué aux propriétaires des risques, à la direction de l’argent mobile et à la direction générale au moins une fois par an ?","1) Processus de gestion des risques\n- Vérifier que le registre des risques a été communiqué aux propriétaires des risques, au responsable de l’exploitation de l’argent mobile et à la direction générale (y compris le comité de risques du conseil d’administration ou toute entité de la gouvernance similaire). ",null,"Requis Normal","Requis","FraudRisk",0,null,"4","4.6","4.6.1","","4.6.1.6","COMUNICACIÓN Y MONITOREO DE RIESGOS\nEl registro de riesgos debe ser comunicado a los titulares de riesgos y al jefe del dinero móvil, al menos, cada 12 meses. Los riesgos de severidad alta deben ser informados a la alta gerencia.\n\nSe debe informar a los titulares de riesgos las acciones requeridas para la implementación de controles adicionales y estas acciones deben ser monitoreadas por el Gerente de Riesgos para garantizar su implementación.\n\nSe debe implementar la generación de informes periódicos para rastrear los Indicadores de Riesgos Clave (KRI) que mostrarán si los riesgos se materializan. Los KRI se dividen en dos categorías:\n - Indicadores adelantados, que indican los riesgos que podrían estar por materializarse;\n - Indicadores retrasados, que informan los riesgos que ya empezaron a materializarse.\n","ISO 27005:2018 Sec. 11","4.6.1.6.1","¿El registro de riesgos es comunicado a los titulares de riesgos, al jefe del dinero móvil y a la alta gerencia, al menos, una vez cada 12 meses?","1) Proceso de gestión de riesgos\n-  Verificar que en los últimos 12 meses se haya comunicado el registro de riesgos a los titulares de riesgos, al jefe del dinero móvil y a la alta gerencia (incluido el comité de riesgos o entidad de gobernanza similar). ",null,"Obligatorio estándar","Obligatorio","FraudRisk",null,null,"4","4.6","4.6.1",null,"4.6.1.6",null,"ISO 27005:2018 Sec. 11","4.6.1.6.1",null,null,null,"ReqS4","Req4","FraudRisk",null,null,null,null,null,null,null,null,"4.6.1.6.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.6","4.6.1","","4.6.1.6",null,0,"4.6.1.6.2","4.6.1.6.2: Are the required actions for implementing further controls monitored by the Risk Manager to ensure that they are implemented by the risk owners?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.6","4.6.1","","4.6.1.6",null,null,"4.6.1.6.2","4.6.1.6.2","Are the required actions for implementing further controls monitored by the Risk Manager to ensure that they are implemented by the risk owners?",null,null,"Recommended","Recommended","FraudRisk",null,null,"4","4.6","4.6.1","","4.6.1.6",0,0,"4.6.1.6.2","les actions nécessaires à la mise en place de contrôles supplémentaires sont-elles surveillées par le responsable de la gestion des risques pour s’assurer de leur mise en œuvre par les propriétaires des risques ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"4","4.6","4.6.1","","4.6.1.6",null,0,"4.6.1.6.2","¿Las acciones requeridas para implementar controles adicionales son monitoreadas por el Gerente de Riesgos a fin de garantizar que sean implementadas por los titulares de riesgos?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"4","4.6","4.6.1",null,"4.6.1.6",null,0,"4.6.1.6.2",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"4.6.1.6.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.6","4.6.1",0,"4.6.1.6",null,0,"4.6.1.6.3","4.6.1.6.3: Has regular reporting been implemented to track Key Risk Indicators (KRIs), showing risks that may be about to materialize or which have started to materialize?\n",0,0,"Recommended","Recommended","FraudRisk",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.6","4.6.1",null,"4.6.1.6",null,null,"4.6.1.6.3","4.6.1.6.3","Has regular reporting been implemented to track Key Risk Indicators (KRIs), showing risks that may be about to materialize or which have started to materialize?",null,null,"Recommended","Recommended","FraudRisk",null,null,"4","4.6","4.6.1",0,"4.6.1.6",0,0,"4.6.1.6.3","existe-t-il des rapports réguliers de suivi des principaux indicateurs de risque (KRI), montrant les risques susceptibles de bientôt se concrétiser et ceux qui se sont déjà concrétisés ?",null,null,"Recommandé","Recommandé","FraudRisk",0,null,"4","4.6","4.6.1",null,"4.6.1.6",null,0,"4.6.1.6.3","¿Se implementó la generación de informes periódicos para rastrear los Indicadores de Riesgos Clave (KRI), que muestren los riesgos que están por materializarse o los que comenzaron a materializarse?",null,null,"Recomendado","Recomendado","FraudRisk",null,null,"4","4.6","4.6.1",null,"4.6.1.6",null,0,"4.6.1.6.3",null,null,null,"Rec4","Rec4","FraudRisk",null,null,null,null,null,null,null,null,"4.6.1.6.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4",0,0,{"$f":"UPPER(CONCATENATE(Introduction!C24,\": \",Introduction!D24))","v":"4.7: SERVICE CONTINUITY"},null,null,null,null,{"$f":"Introduction!E24","v":"Providers shall develop effective business continuity and contingency plans"},null,null,null,null,null,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4",null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$24,\": \",Introduction!$L$24))","v":"4.7: SERVICE CONTINUITY"},null,null,null,null,0,{"$f":"Introduction!$M$24","v":"Providers shall develop effective business continuity and contingency plans"},null,null,null,null,0,null,null,"4",0,0,null,0,null,0,0,"",null,null,null,null,0,null,null,"4",0,0,{"$f":"UPPER(CONCATENATE(Introduction!$U$24,\": \",Introduction!$V$24))","v":"4.7: CONTINUIDAD DEL SERVICIO"},null,null,0,0,{"$f":"Introduction!W24","v":"El proveedor establecerá planes eficaces para contingencias y la continuidad del negocio"},null,null,null,null,0,null,null,"4",0,0,null,0,null,0,0,null,null,null,null,null,0]
[null,"4","4.7","4.7.1",{"$f":"CHOOSE(LanguageNumber,AY119,BP119,CF119,CV119)","v":"4.7.1: Providers shall develop effective business continuity and contingency plans"},"4.7.1.1",{"$f":"AZ119&\": \"&CHOOSE(LanguageNumber,BA119,BR119,CH119,CX119)","v":"4.7.1.1: BUSINESS CONTINUITY FRAMEWORK\nProviders should define their approach to maintaining continuity of mobile money business functions in the event of major disruptions (such as fire, flood or earthquake). The framework should define the process, roles and responsibilities for managing the Business Continuity Plan (see 4.7.1.3).  This could be documented as part of a mobile operator-wide framework.\n\nBusiness continuity should address all critical mobile money business functions. Special consideration should be given to disaster recovery for the mobile money technical system - see 4.7.1.4.\n\nSomeone with sufficient seniority should be appointed as the single point of contact for business continuity planning, with responsibility for ensuring that all functions set up appropriate business continuity plans and that the plans are co-ordinated. \n\nThe policy should be communicated and made available to senior management, the head of mobile money and all managers. It should be reviewed and updated at least every two years.\n"},{"$f":"BB119","v":"ISO 22313:2020 Sec. 5.2 & 5.3"},{"$f":"BC119","v":"4.7.1.1.1"},{"$f":"BC119&\": \"&CHOOSE(LanguageNumber,BE119,BU119,CK119,DA119)&CarriageReturn","v":"4.7.1.1.1: Is there a business continuity framework that defines the approach to maintaining continuity of mobile money business functions in the event of major disruptions?\n"},{"$f":"CHOOSE(LanguageNumber,BF119,BV119,CL119,DB119)","v":"1) Business Continuity Framework or Process\n-  Check the documentation defines the approach to maintaining continuity of mobile money business operations in the event of disruption\n- Check that the policy/process  has been signed by a current member of senior management in the last 2 years.  "},{"$f":"CHOOSE(LanguageNumber,BG119,BW119,CM119,DC119)","v":0},{"$f":"CHOOSE(LanguageNumber,BH119,BX119,CN119,DD119)","v":"Urgent Required"},{"$f":"CHOOSE(LanguageNumber,BI119,BY119,CO119,DE119)","v":"Required"},"BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.7","4.7.1","4.7.1: Providers shall develop effective business continuity and contingency plans","4.7.1.1","BUSINESS CONTINUITY FRAMEWORK\nProviders should define their approach to maintaining continuity of mobile money business functions in the event of major disruptions (such as fire, flood or earthquake). The framework should define the process, roles and responsibilities for managing the Business Continuity Plan (see 4.7.1.3).  This could be documented as part of a mobile operator-wide framework.\n\nBusiness continuity should address all critical mobile money business functions. Special consideration should be given to disaster recovery for the mobile money technical system - see 4.7.1.4.\n\nSomeone with sufficient seniority should be appointed as the single point of contact for business continuity planning, with responsibility for ensuring that all functions set up appropriate business continuity plans and that the plans are co-ordinated. \n\nThe policy should be communicated and made available to senior management, the head of mobile money and all managers. It should be reviewed and updated at least every two years.\n","ISO 22313:2020 Sec. 5.2 & 5.3","4.7.1.1.1","4.7.1.1.1","Is there a business continuity framework that defines the approach to maintaining continuity of mobile money business functions in the event of major disruptions?","1) Business Continuity Framework or Process\n-  Check the documentation defines the approach to maintaining continuity of mobile money business operations in the event of disruption\n- Check that the policy/process  has been signed by a current member of senior management in the last 2 years.  ",null,"Urgent Required","Required","BizOps",null,null,"4","4.7","4.7.1","4.7.1: Les prestataires doivent mettre en place des plans efficaces de poursuite de l’activité en cas d’urgence ou de sinistre.","4.7.1.1","CADRE GÉNÉRAL DE LA CONTINUITÉ DE L’ACTIVITÉ\nLes prestataires doivent définir leur approche de maintien de la continuité des fonctions de l’activité de l’argent mobile en cas de perturbations majeurs (ex. incendie, inondation ou tremblement de terre). Le cadre doit définir les processus, les rôles et responsabilités pour la gestion du plan de continuité de l’activité (cf. 4.7.1.3).  Ceci peut être documenté en tant que cadre général commun à tous les opérateurs mobile.\n\nLa continuité de l’activité doit concerner toutes les fonctions essentielles de l’activité d’argent mobile. Une attention particulière doit être portée à la reprise après sinistre du système technique de l’argent mobile – cf. 4.7.1.4.\n\nUne personne ayant le niveau hiérarchique suffisant doit être nommée comme point de contact unique pour la planification de la continuité de l’activité, avec la responsabilité de s’assurer que toutes les fonctions mettent en place des plans adaptés de continuité de leur activité et que ces plans soient coordonnés. \n\nLa politique doit être communiquée et mise à la disposition de la direction générale, de la direction de l’argent mobile et de tous les responsables. Celle-ci doit être examinée et mise à jour au moins tous les deux ans.\n","ISO 22313:2020 Sec. 5.2 & 5.3","4.7.1.1.1","existe-t-il un cadre général de continuité de l’activité pour l’argent mobile définissant l’approche de maintien de la continuité des fonctions de l’activité d’argent mobile en cas de perturbations majeures ?","1) Directives ou processus de continuité de l’activité\n- Vérifier que la documentation définit l’approche de maintien de la continuité de l’activité de l’argent mobile en cas de perturbations\n- Vérifier que la politique/le processus a été signé(e) par un membre actuel de la direction générale au cours des deux dernières années. ",null,{"$f":"VLOOKUP($BH119,CategoryTranslationTable,2,FALSE)","v":"Requis Prioritaire"},{"$f":"VLOOKUP($BI119,CategoryTranslationTable,2,FALSE)","v":"Requis"},"BizOps",0,null,"4","4.7","4.7.1","4.7.1: Los proveedores deben desarrollar planes efectivos de contingencia y continuidad del negocio","4.7.1.1","MARCO DE CONTINUIDAD DEL NEGOCIO\nLos proveedores deben definir su enfoque para mantener la continuidad de las funciones del negocio del dinero móvil en caso de interrupciones importantes (tales como incendio, inundación o terremoto). El marco debe definir el proceso, los roles y las responsabilidades para gestionar el Plan de Continuidad del Negocio (ver 4.7.1.3).  Éste podría documentarse como parte de un marco de todos los operadores móviles.\n\nEl plan de continuidad del negocio debe abordar todas las funciones críticas del negocio del dinero móvil. Se debe prestar especial atención a la recuperación ante desastres del sistema técnico del dinero móvil - ver 4.7.1.4.\n\nSe debe designar a una persona con antigüedad suficiente para que actúe como único punto de contacto para la planificación de la continuidad del negocio, siendo responsable de garantizar que todas las funciones establezcan planes de continuidad del negocio adecuados y que estos planes sean coordinados. \n\nEsta política debe ser comunicada y puesta a disposición de la alta gerencia, el jefe del dinero móvil y todos los gerentes. Debe ser revisada y actualizada, al menos, una vez cada dos años.\n","ISO 22313:2020 Sec. 5.2 & 5.3","4.7.1.1.1","¿Existe un plan de continuidad del negocio que defina el alcance para mantener la continuidad de las funciones del negocio del dinero móvil en caso de interrupciones importantes?","1) Marco o Proceso de Continuidad del Negocio\n-  Verificar que la documentación defina el alcance para mantener la continuidad de las operaciones del negocio del dinero móvil en caso de interrupciones\n- Verificar que la política/proceso haya sido aprobado por un miembro actual de la alta gerencia en los últimos 2 años.  ",null,{"$f":"VLOOKUP($BH119,CategoryTranslationTable,3,FALSE)","v":"Obligatorio urgente"},{"$f":"VLOOKUP($BI119,CategoryTranslationTable,3,FALSE)","v":"Obligatorio"},"BizOps",null,null,"4","4.7","4.7.1",null,"4.7.1.1",null,"ISO 22313:2020 Sec. 5.2 & 5.3","4.7.1.1.1",null,null,null,{"$f":"VLOOKUP($BH119,CategoryTranslationTable,4,FALSE)","v":"ReqU4"},{"$f":"VLOOKUP($BI119,CategoryTranslationTable,4,FALSE)","v":"Req4"},"BizOps",null,null,null,null,null,null,null,null,"4.7.1.1.1",null,null,null,{"$f":"IF(OR($EA119=0,$EA119=2),VLOOKUP(DO119,INDIRECT(ED119),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP119),\"\",VLOOKUP(DP119,INDIRECT(EE119),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ119),\"\",VLOOKUP(DQ119,INDIRECT(EF119),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR119),\"\",VLOOKUP(DR119,INDIRECT(EG119),7,FALSE))","v":""},{"$f":"IF(OR($EA119=0,$EA119=2),VLOOKUP(DO119,INDIRECT(ED119),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP119),\"\",VLOOKUP(DP119,INDIRECT(EE119),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ119),\"\",VLOOKUP(DQ119,INDIRECT(EF119),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR119),\"\",VLOOKUP(DR119,INDIRECT(EG119),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN119,3)=\"NEW\")+2*AND(LEFT(DN119,3)=\"MER\")+3*AND(LEFT(DN119,3)=\"MOV\")+4*AND(LEFT(DN119,3)=\"SWA\")","v":0},{"$f":"IF(EA119=0,DS119,EN119)","v":{"$error":"#REF!"}},{"$f":"IF(EA119=0,IF(DW119=0,\"\",DW119),CHOOSE(EA119,\"New indicator\",CONCATENATE(DW119,CarriageReturn,DX119,CarriageReturn,DY119,CarriageReturn,DZ119)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO119,1)","v":"OriginalComplianceP4"},{"$f":"\"OriginalComplianceP\"&LEFT(DP119,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ119,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR119,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,""]
[null,"4","4.7","4.7.1",{"$f":"CHOOSE(LanguageNumber,AY120,BP120,CF120,CV120)","v":""},"4.7.1.1",null,null,{"$f":"BC120","v":"4.7.1.1.2"},"4.7.1.1.2: Does someone with sufficient seniority have overall responsibility and accountability for the business continuity of the mobile money service?\n",{"$f":"CHOOSE(LanguageNumber,BF120,BV120,CL120,DB120)","v":"1) Business Continuity Process\n-  Check a senior member of management has been allocated direct responsibility for business continuity of the mobile money service"},0,{"$f":"CHOOSE(LanguageNumber,BH120,BX120,CN120,DD120)","v":"Standard Required"},{"$f":"CHOOSE(LanguageNumber,BI120,BY120,CO120,DE120)","v":"Required"},"BizOps",{"$f":"CHOOSE(LanguageNumber,BK120,CA120,CQ120,DG120)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.7","4.7.1","","4.7.1.1",null,null,"4.7.1.1.2",{"$f":"DO120","v":"4.7.1.1.5"},"Does someone with sufficient seniority have overall responsibility and accountability for the business continuity of the mobile money service?","1) Business Continuity Process\n-  Check a senior member of management has been allocated direct responsibility for business continuity of the mobile money service",null,"Standard Required","Required","BizOps",null,null,"4","4.7","4.7.1","","4.7.1.1",null,null,"4.7.1.1.2","une personne ayant le niveau hiérarchique suffisant a-t-elle la charge et la responsabilité globale de la continuité de l’activité du service d’argent mobile ?","1) Processus de continuité de l’activité\n- Vérifier que la responsabilité directe de la continuité de l’activité du service d’argent mobile a été assignée à un membre de la direction ayant suffisamment d’ancienneté",null,"Requis Normal","Requis","BizOps",0,null,"4","4.7","4.7.1","","4.7.1.1",null,null,"4.7.1.1.2","¿Alguna persona con antigüedad suficiente tiene la responsabilidad general de la continuidad del negocio del servicio del dinero móvil?","1) Proceso de Continuidad del Negocio\n-  Verificar que se haya asignado la responsabilidad directa de la continuidad del negocio del servicio del dinero móvil a un miembro de la alta gerencia",null,"Obligatorio estándar","Obligatorio","BizOps",null,null,"4","4.7","4.7.1",null,"4.7.1.1",null,null,"4.7.1.1.2",null,null,null,"ReqS4","Req4","BizOps",null,null,null,null,null,null,null,null,"4.7.1.1.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.7","4.7.1","","4.7.1.1",null,{"$f":"BB121","v":0},{"$f":"BC121","v":"4.7.1.1.3"},"4.7.1.1.3: Are roles and responsibilities defined for design and management of Business Continuity?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.7","4.7.1","","4.7.1.1",null,null,"4.7.1.1.3","4.7.1.1.4","Are roles and responsibilities defined for design and management of Business Continuity?",null,null,"Recommended","Recommended","BizOps",null,null,"4","4.7","4.7.1","","4.7.1.1",0,0,"4.7.1.1.3","la politique de continuité de l’activité définit-elle les rôles et les responsabilités pour l’élaboration et la tenue à jour du plan de continuité de l’activité (cf. 4.7.1.3) ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"4","4.7","4.7.1","","4.7.1.1",null,0,"4.7.1.1.3","¿Se definieron roles y responsabilidades para el diseño y la gestión de la Continuidad del Negocio?",null,null,"Recomendado","Recomendado","BizOps",null,null,"4","4.7","4.7.1",null,"4.7.1.1",null,0,"4.7.1.1.3",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"4.7.1.1.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.7","4.7.1","","4.7.1.1",null,0,"4.7.1.1.4","4.7.1.1.4: Is the business continuity framework communicated and made available to senior management, the head of mobile money and all managers?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.7","4.7.1","","4.7.1.1",null,null,"4.7.1.1.4","4.7.1.1.6","Is the business continuity framework communicated and made available to senior management, the head of mobile money and all managers?",null,null,"Recommended","Recommended","BizOps",null,null,"4","4.7","4.7.1","","4.7.1.1",0,0,"4.7.1.1.4","la politique de continuité de l’activité est-elle communiquée et mise à la disposition de la direction générale, des responsables techniques et des responsables fonctionnels ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"4","4.7","4.7.1","","4.7.1.1",null,0,"4.7.1.1.4","¿El marco de continuidad del negocio es comunicado y puesto a disposición de la alta gerencia, el jefe del dinero móvil y todos los gerentes?",null,null,"Recomendado","Recomendado","BizOps",null,null,"4","4.7","4.7.1",null,"4.7.1.1",null,0,"4.7.1.1.4",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"4.7.1.1.6",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.7","4.7.1","","4.7.1.2","4.7.1.2: BUSINESS CONTINUITY RISK ASSESSMENT\nProviders should carry out a business continuity risk assessment as an input into the Business Continuity Plan. \n\nThe risk assessment should include:\n1. Business Impact Analysis (BIA)\n2. Threat evaluation.\n\nThe BIA determines the key business activities that should be maintained in the event of a major disruption. The BIA:\n- identifies key mobile money business activities;\n- sets a recovery objective for each activity (a minimum timeframe for recovery); and\n- identifies dependencies and 3rd party resources for these activities.\n\nThe threat evaluation identifies risks of disruption, such as fire, flood, power failure, staff loss or disruptive incidents. Each threat should be evaluated in terms of its potential impact on business activities in the BIA. This is normally documented in the Business Continuity Plan (see 4.7.1.3).","ISO 22313:2020 Sec. 8.2.2 & 8.2.3","4.7.1.2.1","4.7.1.2.1: Has a business continuity risk assessment been carried out?\n","1) Business Continuity Risk Assessment or Impact Analysis (or similar document)\n- Check that the BIA has been updated in the last year",0,"Standard Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.7","4.7.1","","4.7.1.2","BUSINESS CONTINUITY RISK ASSESSMENT\nProviders should carry out a business continuity risk assessment as an input into the Business Continuity Plan. \n\nThe risk assessment should include:\n1. Business Impact Analysis (BIA)\n2. Threat evaluation.\n\nThe BIA determines the key business activities that should be maintained in the event of a major disruption. The BIA:\n- identifies key mobile money business activities;\n- sets a recovery objective for each activity (a minimum timeframe for recovery); and\n- identifies dependencies and 3rd party resources for these activities.\n\nThe threat evaluation identifies risks of disruption, such as fire, flood, power failure, staff loss or disruptive incidents. Each threat should be evaluated in terms of its potential impact on business activities in the BIA. This is normally documented in the Business Continuity Plan (see 4.7.1.3).","ISO 22313:2020 Sec. 8.2.2 & 8.2.3","4.7.1.2.1","4.7.1.2.1","Has a business continuity risk assessment been carried out?","1) Business Continuity Risk Assessment or Impact Analysis (or similar document)\n- Check that the BIA has been updated in the last year",null,"Standard Required","Required","BizOps",null,null,"4","4.7","4.7.1","",{"$f":"$AZ123","v":"4.7.1.2"},"ÉVALUATION DES RISQUES\nLes prestataires doivent réaliser une évaluation des risques affectant la continuité de l’activité pour alimenter le plan de continuité de l’activité. \n\nCette évaluation des risques doit inclure :\n1. l'analyse d’impact sur l’activité (AIA)\n2. l’évaluation des menaces.\n\nL’AIA permet d’identifier les activités clés de l’entreprise devant être maintenues en cas de perturbation majeure. L’AIA :\n- identifie les activités clés du service d’argent mobile ;\n- définit un objectif de reprise pour chaque activité (délai maximum de reprise) ;\n- identifie les liens de dépendance et les ressources extérieures pour ces activités.\n\nL’évaluation des menaces recense les risques de perturbation, tels que le feu, les inondations, les pannes d’électricité, les pertes de personnel ou les incidents perturbateurs. Chaque menace doit être évaluée dans l’optique de son impact potentiel sur les activités du service dans l’AIA. Cela est normalement documenté dans le plan de continuité de l’activité (cf. 4.7.1.3).",{"$f":"$BB123","v":"ISO 22313:2020 Sec. 8.2.2 & 8.2.3"},{"$f":"$BC123","v":"4.7.1.2.1"},"une évaluation des risques affectant la continuité de l’activité a-t-elle été effectuée ?","1) Évaluation des risques relatifs à la continuité de l’activité ou Analyse d’impact sur l’activité (ou document similaire)\n- Vérifier que l’AIA a été mise à jour au cours de l’année passée",null,"Requis Normal","Requis","BizOps","L’analyse d’impact sur l’activité (AIA) détermine les priorités et objectifs de continuité et de reprise, tandis que l’évaluation des menaces s’interroge sur : (1) ce qui pourrait se produire et pourquoi, (2) quelles en serait les conséquences potentielles, (3) quelle est la probabilité que ces problèmes surviennent et (4) ce qui il possible de faire (le cas échéant) pour en atténuer l’impact ou en réduire la probabilité.",null,"4","4.7","4.7.1","","4.7.1.2","EVALUACIÓN DE RIESGOS DE LA CONTINUIDAD DEL NEGOCIO\nLos proveedores deben llevar a cabo una evaluación de riesgos de la continuidad del negocio como un aporte al Plan de Continuidad del Negocio. \n\nLa evaluación de riesgos debe incluir:\n1. Análisis de Impactos en el Negocio (BIA)\n2. Evaluación de amenazas.\n\nEl BIA determina las actividades del negocio clave que se deben mantener en caso de una interrupción importante. El BIA:\n- identifica las actividades clave del negocio del dinero móvil;\n- establece un objetivo de recuperación para cada actividad (un marco de tiempo mínimo para la recuperación); e \n- identifica dependencias y recursos de terceros para estas actividades.\n\nLa evaluación de amenazas identifica los riesgos de interrupción, tales como incendio, inundación, corte de electricidad, pérdida de personal o incidentes disruptivos. En el BIA se debe evaluar cada amenaza en función de su potencial impacto en las actividades del negocio. Normalmente, esto se documenta en el Plan de Continuidad del Negocio (ver 4.7.1.3).","ISO 22313:2020 Sec. 8.2.2 & 8.2.3",{"$f":"$BC123","v":"4.7.1.2.1"},"¿Se realizó una evaluación de riesgos de la continuidad del negocio?","1) Evaluación de Riesgos de la Continuidad del Negocio o Análisis de Impactos (o documento similar)\n- Verificar que el BIA se haya actualizado en el último año",null,"Obligatorio estándar","Obligatorio","BizOps",null,null,"4","4.7","4.7.1",null,{"$f":"$AZ123","v":"4.7.1.2"},null,"ISO 22313:2020 Sec. 8.2.2 & 8.2.3",{"$f":"$BC123","v":"4.7.1.2.1"},null,null,null,"ReqS4","Req4","BizOps",null,null,null,null,null,null,null,null,"4.7.1.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",{"$f":"COUNTIF($DS123:$DV123,EH$3)","v":0},0,0,0,0,1,""]
[null,"4","4.7","4.7.1","","4.7.1.2",null,0,"4.7.1.2.2","4.7.1.2.2: Does the risk assessment include a Business Impact Analysis (BIA) that determines the key business activities that should be maintained in the event of a major disruption, and the minimum timeframe for recovery of each activity?\n","1) Business Continuity Risk Assessment or Impact Analysis (or similar document)\n- Check the document identifies key business activities that should be maintained in the event of a disruption.\n- Check that the documentation sets the minimum timeframe for recovery of each key business activity.",0,"Standard Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.7","4.7.1","","4.7.1.2",null,null,"4.7.1.2.2","4.7.1.2.2","Does the risk assessment include a Business Impact Analysis (BIA) that determines the key business activities that should be maintained in the event of a major disruption, and the minimum timeframe for recovery of each activity?","1) Business Continuity Risk Assessment or Impact Analysis (or similar document)\n- Check the document identifies key business activities that should be maintained in the event of a disruption.\n- Check that the documentation sets the minimum timeframe for recovery of each key business activity.",null,"Standard Required","Required","BizOps",null,null,"4","4.7","4.7.1","","4.7.1.2",0,0,"4.7.1.2.2","l'évaluation des risques comprend-elle une analyse d’impact sur l’activité (AIA) recensant les principales activités devant être maintenues dans l’éventualité d’une perturbation majeure (cf. note explicative) ?","1) Évaluation des risques relatifs à la continuité de l’activité ou Analyse d’impact sur l’activité (ou document similaire)\n- Vérifier que le document recense les activités clés devant être maintenues en cas de perturbation.\n- Vérifier que la documentation définit les délais minimaux de reprise pour chaque activité clé.",null,"Requis Normal","Requis","BizOps",0,null,"4","4.7","4.7.1","","4.7.1.2",null,0,"4.7.1.2.2","¿La evaluación de riesgos incluye un Análisis de Impactos en el Negocio (BIA) que determine las actividades del negocio clave que se deben mantener en caso de una interrupción importante, y el marco de tiempo mínimo para la recuperación de cada actividad?","1)  Evaluación de Riesgos de la Continuidad del Negocio o Análisis de Impactos (o documento similar)\n- Verificar que el documento identifique las actividades del negocio clave que se deben mantener en caso de una interrupción.\n- Verificar que la documentación establezca el marco de tiempo mínimo para la recuperación de cada actividad del negocio clave.",null,"Obligatorio estándar","Obligatorio","BizOps",null,null,"4","4.7","4.7.1",null,"4.7.1.2",null,0,"4.7.1.2.2",null,null,null,"ReqS4","Req4","BizOps",null,null,null,null,null,null,null,"MERGE","4.7.1.2.2","4.7.1.2.3",null,null,{"$error":"#REF!"},{"$error":"#REF!"},"","",{"$error":"#REF!"},{"$error":"#REF!"},"","",2,"",{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,2,""]
[null,"4","4.7","4.7.1",{"$f":"CHOOSE(LanguageNumber,AY125,BP125,CF125,CV125)","v":""},{"$f":"AZ125","v":"4.7.1.2"},null,null,{"$f":"BC125","v":"4.7.1.2.3"},"4.7.1.2.3: Does the risk assessment include a threat evaluation to identify risks of disruption (such as fire, flood, power failure, staff loss or disruptive incidents), with each threat evaluated in terms of its potential impact on business activities?\n",{"$f":"CHOOSE(LanguageNumber,BF125,BV125,CL125,DB125)","v":"1) Business Continuity Risk Assessment or Impact Analysis (or similar document)\n- Check the documenation includes a threat evaluation to identify risks of disruption (such as fire, flood, power failure, staff loss or disruptive incidents).\n- Check  each threat has been evaluated in terms of its potential impact on each key mobile money business activity."},0,{"$f":"CHOOSE(LanguageNumber,BH125,BX125,CN125,DD125)","v":"Standard Required"},{"$f":"CHOOSE(LanguageNumber,BI125,BY125,CO125,DE125)","v":"Required"},"BizOps",{"$f":"CHOOSE(LanguageNumber,BK125,CA125,CQ125,DG125)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.7","4.7.1","","4.7.1.2",null,null,"4.7.1.2.3",{"$f":"DO125","v":"4.7.1.2.5"},"Does the risk assessment include a threat evaluation to identify risks of disruption (such as fire, flood, power failure, staff loss or disruptive incidents), with each threat evaluated in terms of its potential impact on business activities?","1) Business Continuity Risk Assessment or Impact Analysis (or similar document)\n- Check the documenation includes a threat evaluation to identify risks of disruption (such as fire, flood, power failure, staff loss or disruptive incidents).\n- Check  each threat has been evaluated in terms of its potential impact on each key mobile money business activity.",null,"Standard Required","Required","BizOps",null,null,"4","4.7","4.7.1","","4.7.1.2",null,null,"4.7.1.2.3","l’évaluation des risques contient-elle une évaluation des menaces recensant les risques de perturbation (incendie, inondation, panne d’électricité, perte de personnel ou incidents perturbateurs), avec évaluation de chaque menace dans l’optique de son impact potentiel sur les activités du service d’argent mobile ?","1) Évaluation des risques relatifs à la continuité de l’activité ou Analyse d’impact sur l’activité (ou document similaire)\n- Vérifier que la documentation inclut une évaluation des menaces recensant les risques de perturbation (incendie, inondation, panne d’électricité, perte de personnel ou incidents perturbateurs).\n- Vérifier que chaque menace a été évaluée dans l’optique de son impact potentiel sur chaque activité clé du service d’argent mobile.",null,"Requis Normal","Requis","BizOps",0,null,"4","4.7","4.7.1","","4.7.1.2",null,null,"4.7.1.2.3","¿La evaluación de riesgos incluye una evaluación de amenazas para identificar los riesgos de interrupción (tales como incendio, inundación, corte de electricidad, pérdida de personal o incidentes disruptivos), con la evaluación de cada amenaza en función de su impacto potencial en las actividades del negocio?","1) Evaluación de Riesgos de la Continuidad del Negocio o Análisis de Impactos (o documento similar)\n- Verificar que la documentación incluya una evaluación de amenazas para identificar los riesgos de interrupción (tales como incendio, inundación, corte de electricidad, pérdida de personal o incidentes disruptivos).\n- Verificar que cada amenaza haya sido evaluada en función de su impacto potencial en las actividades clave del negocio del dinero móvil.",null,"Obligatorio estándar","Obligatorio","BizOps",null,null,"4","4.7","4.7.1",null,"4.7.1.2",null,null,"4.7.1.2.3",null,null,null,"ReqS4","Req4","BizOps",null,null,null,null,null,null,null,null,"4.7.1.2.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.7","4.7.1","","4.7.1.2",null,0,"4.7.1.2.4","4.7.1.2.4: Does the BIA identify dependencies and 3rd party resources for each key business activity?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.7","4.7.1","","4.7.1.2",null,null,"4.7.1.2.4","4.7.1.2.4","Does the BIA identify dependencies and 3rd party resources for each key business activity?",null,null,"Recommended","Recommended","BizOps",null,null,"4","4.7","4.7.1","","4.7.1.2",0,0,"4.7.1.2.4","l’AIA identifie-t-elle les liens de dépendances et les ressources extérieures pour chaque activité clé ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"4","4.7","4.7.1","","4.7.1.2",null,0,"4.7.1.2.4","¿El BIA identifica las dependencias y recursos de terceros para cada actividad del negocio clave?",null,null,"Recomendado","Recomendado","BizOps",null,null,"4","4.7","4.7.1",null,"4.7.1.2",null,0,"4.7.1.2.4",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"4.7.1.2.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.7","4.7.1","","4.7.1.3","4.7.1.3: BUSINESS CONTINUITY PLAN\nA Business Continuity Plan (BCP) should be documented that defines the responses in the event of a disruptive incident. It should be implemented by all affected business functions, including agents and 3rd parties where relevant. The BCP should be updated regularly and following significant changes to the mobile money business. \n\nThe BCP should identify how each key mobile money activity will be resumed within its recovery objective, considering each threat identified in the business continuity risk assessment. It should also cover potential disruption of outsourced services.\n\nThe BCP should create:\n- an incident response management structure, including resources responsible for responding to the major incident;\n- the procedures for returning to 'business as usual'; and\n- a communications plan to be actioned during a disruptive event.\n\nThe BCP should be:\n- specific – with regard to the immediate steps that should be taken by staff, agents and 3rd parties if an identified threat materialises;\n- flexible – to respond to unanticipated threat scenarios and changing conditions; and\n- focused on the key business activities to be resumed.\n\nThe BCP should consider a range of response options and assign the appropriate response to each activity/risk. Response options include:\n- Activity relocation: re-establish operations at an alternate location;\n- Resource reallocation: resources, including staff, may be transferred from another activity or from a third party; or\n- Alternate processes: using workaround processes temporarily.\n","ISO 22313:2020 Sec. 8.3 & 8.4","4.7.1.3.1","4.7.1.3.1: Has a Business Continuity Plan (BCP) been documented and updated everey two years and following significant changes to the mobile money business?\n","1) Business Continuity Plan (BCP) \n- Check that the business continuity plan is documented \n- Check that the BCP has been updated in the last 24 months\n- Check the BCP has been reviewed and updated following significant changes to the mobile money business. If there have been no major changes, refer to the BCP process / framework.",0,"Urgent Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.7","4.7.1","","4.7.1.3","BUSINESS CONTINUITY PLAN\nA Business Continuity Plan (BCP) should be documented that defines the responses in the event of a disruptive incident. It should be implemented by all affected business functions, including agents and 3rd parties where relevant. The BCP should be updated regularly and following significant changes to the mobile money business. \n\nThe BCP should identify how each key mobile money activity will be resumed within its recovery objective, considering each threat identified in the business continuity risk assessment. It should also cover potential disruption of outsourced services.\n\nThe BCP should create:\n- an incident response management structure, including resources responsible for responding to the major incident;\n- the procedures for returning to 'business as usual'; and\n- a communications plan to be actioned during a disruptive event.\n\nThe BCP should be:\n- specific – with regard to the immediate steps that should be taken by staff, agents and 3rd parties if an identified threat materialises;\n- flexible – to respond to unanticipated threat scenarios and changing conditions; and\n- focused on the key business activities to be resumed.\n\nThe BCP should consider a range of response options and assign the appropriate response to each activity/risk. Response options include:\n- Activity relocation: re-establish operations at an alternate location;\n- Resource reallocation: resources, including staff, may be transferred from another activity or from a third party; or\n- Alternate processes: using workaround processes temporarily.\n","ISO 22313:2020 Sec. 8.3 & 8.4","4.7.1.3.1","4.7.1.3.1","Has a Business Continuity Plan (BCP) been documented and updated everey two years and following significant changes to the mobile money business?","1) Business Continuity Plan (BCP) \n- Check that the business continuity plan is documented \n- Check that the BCP has been updated in the last 24 months\n- Check the BCP has been reviewed and updated following significant changes to the mobile money business. If there have been no major changes, refer to the BCP process / framework.",null,"Urgent Required","Required","BizOps",null,null,"4","4.7","4.7.1","","4.7.1.3","PLAN DE CONTINUITÉ DE L’ACTIVITÉ\nUn plan de continuité de l'activité (PCA) qui définit les réactions appropriées en cas d’incident perturbateur doit être documenté. Il doit être mis en place par toutes les fonctions de l'activité concernées, y compris les agents et tiers le cas échéant. Le PCA doit être mis à jour régulièrement et après tout changement significatif de l’activité de l’argent mobile. \n\nLe PCA doit identifier les façons dont chaque activité clé de l’argent mobile reprendra dans le cadre de son objectif de reprise, en prenant en compte chaque menace identifiée dans l’évaluation des risques de la continuité de l’activité. Il doit également couvrir la perturbation potentielle des services externalisés.\n\nLe PCA doit créer :\nune structure de gestion de la réponse aux incidents, y compris les ressources chargées de répondre à un incident majeur ;\n- les procédures de retour à un fonctionnement normal ;\n- un plan de communication à déclencher lors d’un événement perturbateur.\n\nLe PCA doit être :\n- spécifique en ce qui concerne les mesures immédiates devant être prises par le personnel, les agents et les tiers en cas de concrétisation d’une menace identifiée ;\n- flexible, pour s’adapter à des scénarios de menace imprévus et à des conditions changeantes ;\n- axé sur la reprise des activités clés.\n\nLe PCA doit prévoir un éventail de réponses possibles et assigner à chaque activité/risque la réponse appropriée. Les réponses possibles comprennent :\n- déménagement de l’activité : déplacement des fonctions de l’entreprise sur un autre site ;\n- réallocation des ressources : transfert de ressources, personnel compris, d’une activité à l’autre ou en provenance de l’extérieur ; ou\n- processus de remplacement : recours provisoire à des processus alternatifs.\n","ISO 22313:2020 Sec. 8.3 & 8.4","4.7.1.3.1","existe-t-il un plan documenté de continuité de l’activité (PCA) définissant les mesures à prendre en cas d’incident perturbateur ?","1) Plan de continuité de l’activité (PCA) \n\r- Vérifier que le plan de continuité de l’activité est documenté \n\r- Vérifier que le PCA a été mis à jour au cours des 24 derniers mois\r\n- Vérifier que le PCA a été examiné et mis à jour suite à des changements significatifs de l’activité de l’argent mobile. Si aucun changement significatif n’a eu lieu, se référer au processus/aux directives relatifs au PCA.",null,"Requis Prioritaire","Requis","BizOps",0,null,"4","4.7","4.7.1","","4.7.1.3","PLAN DE CONTINUIDAD DEL NEGOCIO\nSe debe documentar un Plan de Continuidad del Negocio (BCP) que defina las respuestas en caso de un incidente disruptivo. Debe ser implementado por todas las funciones del negocio afectadas, inclusive agentes y terceros, cuando corresponda. El BCP debe ser actualizado de forma periódica y después de cambios significativos al negocio del dinero móvil. \n\nEl BCP debe identificar cómo se reanudará cada actividad clave del dinero móvil dentro de su objetivo de recuperación, considerando cada amenaza identificada en la evaluación de riesgos de la continuidad del negocio. También debe cubrir la interrupción potencial de los servicios tercerizados.\n\nEl BCP debe crear:\n- una estructura de gestión de respuesta ante incidentes, que incluya los recursos responsables de responder ante un incidente importante;\n- el procedimiento para volver a la normalidad; y \n- un plan de comunicaciones para ser accionado durante un evento disruptivo.\n\nEl BCP debe ser:\n- específico – respecto de los pasos inmediatos que debe realizar el personal, los agentes y terceros si se materializa una amenaza identificada;\n- flexible – para responder ante escenarios de amenazas inesperados y condiciones cambiantes; y \n- enfocado en las actividades del negocio clave que se deben reanudar.\n\nEl BCP debe considerar una variedad de opciones de respuesta y asignar la respuesta correspondiente a cada actividad/riesgo. Las opciones de respuesta incluyen:\n- Reubicación de las actividades: reestablecer las operaciones en una ubicación alternativa;\n- Reasignación de recursos: se pueden transferir recursos, incluido el personal, de una actividad o de un tercero; o\n- Procesos alternativos: empleando procesos de una solución temporal.\n",{"$f":"$BB127","v":"ISO 22313:2020 Sec. 8.3 & 8.4"},"4.7.1.3.1","¿Se documentó e implementó un Plan de Continuidad del Negocio (BCP) cada dos años y después de cambios significativos al negocio del dinero móvil?","1) Plan de Continuidad del Negocio (BCP) \n- Verificar que el plan de continuidad del negocio esté documentado\n- Verificar que el BCP haya sido actualizado en los últimos 24 meses\n- Verificar que el BCP haya sido revisado y actualizado después de cambios significativos al negocio del dinero móvil. Si no se realizaron cambios significativos, consultar el proceso / marco de BCP.",null,"Obligatorio urgente","Obligatorio","BizOps",null,null,"4","4.7","4.7.1",null,"4.7.1.3",null,{"$f":"$BB127","v":"ISO 22313:2020 Sec. 8.3 & 8.4"},"4.7.1.3.1",null,null,null,"ReqU4","Req4","BizOps",null,null,null,null,null,null,null,"MERGE","4.7.1.3.1","4.7.1.3.4",null,null,{"$error":"#REF!"},{"$error":"#REF!"},"","",{"$error":"#REF!"},{"$error":"#REF!"},"","",2,"",{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,2,""]
[null,"4","4.7","4.7.1","","4.7.1.3",null,0,"4.7.1.3.2","4.7.1.3.2: Has the BCP been implemented by all affected business functions and 3rd parties?\n","1) Business Continuity Plan (BCP) \n- Check the acceptance of the BCP by all business functions and key 3rd parties identified in the BCP. Acceptance should be indicated by signature of the BCP.\n",0,"Standard Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.7","4.7.1","","4.7.1.3",null,null,"4.7.1.3.2","4.7.1.3.2","Has the BCP been implemented by all affected business functions and 3rd parties?","1) Business Continuity Plan (BCP) \n- Check the acceptance of the BCP by all business functions and key 3rd parties identified in the BCP. Acceptance should be indicated by signature of the BCP.\n",null,"Standard Required","Required","BizOps",null,null,"4","4.7","4.7.1","","4.7.1.3",0,0,"4.7.1.3.2","le PCA a-t-il été mis en œuvre par l’ensemble des fonctions et tierces parties concernées ?","1) Plan de continuité de l’activité (PCA) \n- Vérifier que le PCA a été approuvé par l’ensemble des fonctions opérationnelles et des tierces parties clés identifiées dans le PCA. L'acceptation du PCA doit être matérialisée par une signature.\n",null,"Requis Normal","Requis","BizOps",0,null,"4","4.7","4.7.1","","4.7.1.3",null,0,"4.7.1.3.2","¿El BCP fue implementado por todas las funciones del negocio y terceros afectados?","1) Plan de Continuidad del Negocio (BCP) \n- Verificar la aceptación del BCP por parte de todas las funciones del negocio y terceros afectados identificados como funciones clave del BCP. La aceptación se debe indicar mediante la firma del BCP.\n",null,"Obligatorio estándar","Obligatorio","BizOps",null,null,"4","4.7","4.7.1",null,"4.7.1.3",null,0,"4.7.1.3.2",null,null,null,"ReqS4","Req4","BizOps",null,null,null,null,null,null,null,null,"4.7.1.3.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.7","4.7.1","","4.7.1.3",null,0,"4.7.1.3.3","4.7.1.3.3: Does the BCP identify how each key mobile money activity will be resumed within its recovery objective, considering each threat identified in the business continuity risk assessment?\n","1) Business Continuity Plan (BCP)\n- Check the BCP contains processes for how each key mobile money activity will be resumed within its recovery objective.\n- Check the BCP processes identify responses for each threat identified in the business continuity risk assessment.",0,"Standard Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.7","4.7.1","","4.7.1.3",null,null,"4.7.1.3.3","4.7.1.3.5","Does the BCP identify how each key mobile money activity will be resumed within its recovery objective, considering each threat identified in the business continuity risk assessment?","1) Business Continuity Plan (BCP)\n- Check the BCP contains processes for how each key mobile money activity will be resumed within its recovery objective.\n- Check the BCP processes identify responses for each threat identified in the business continuity risk assessment.",null,"Standard Required","Required","BizOps",null,null,"4","4.7","4.7.1","","4.7.1.3",0,0,"4.7.1.3.3","le PCA précise-t-il la manière dont chaque activité clé de l’argent mobile reprendra à l’issue du délai de reprise visé, dans le cadre de chacune des menaces recensées dans l’évaluation des risques affectant la continuité de l’activité ?","1) Plan de continuité de l’activité (PCA) \n\r- Vérifier que le PCA prévoit des processus définissant la manière dont chaque activité clé de l’argent mobile reprendra à l’issue du délai de reprise visé.\r\n- Vérifier que les processus du PCA définissent les réponses appropriées pour chaque menace identifiée dans le cadre de l’évaluation des risques affectant la continuité de l’activité.",null,"Requis Normal","Requis","BizOps",0,null,"4","4.7","4.7.1","","4.7.1.3",null,0,"4.7.1.3.3","¿El BCP identifica cómo se reanudará cada actividad clave del negocio del dinero móvil dentro de su objetivo de recuperación, considerando cada amenaza identificada en la evaluación de riesgos de continuidad del negocio?","1) Plan de Continuidad del Negocio (BCP)\n- Verificar que el BCP contenga procesos respecto de cómo se reanudará cada actividad clave del negocio del dinero móvil dentro de su objetivo de recuperación.\n- Verificar que los procesos del BCP identifiquen las respuestas para cada amenaza identificada en la evaluación de riesgos de la continuidad del negocio.",null,"Obligatorio estándar","Obligatorio","BizOps",null,null,"4","4.7","4.7.1",null,"4.7.1.3",null,0,"4.7.1.3.3",null,null,null,"ReqS4","Req4","BizOps",null,null,null,null,null,null,null,null,"4.7.1.3.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.7","4.7.1","","4.7.1.3",null,0,"4.7.1.3.4","4.7.1.3.4: Does the BCP define an incident response management structure, including individual roles responsible for responding to the major incident?\n","1) Business Continuity Plan (BCP) \n- Check the BCP defines an incident response management structure and individual roles responsible for responding to major incidents.",0,"Standard Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.7","4.7.1","","4.7.1.3",null,null,"4.7.1.3.4","4.7.1.3.6","Does the BCP define an incident response management structure, including individual roles responsible for responding to the major incident?","1) Business Continuity Plan (BCP) \n- Check the BCP defines an incident response management structure and individual roles responsible for responding to major incidents.",null,"Standard Required","Required","BizOps",null,null,"4","4.7","4.7.1","","4.7.1.3",0,0,"4.7.1.3.4","le PCA établit-il une structure de gestion de la réponse aux incidents, y compris les ressources chargées de répondre à un incident majeur ?","1) Plan de continuité de l’activité (PCA) \n- Vérifier que le PCA établit une structure de gestion de la réponse aux incidents, y compris le rôle de chaque personne chargée de répondre à un incident majeur.",null,"Requis Normal","Requis","BizOps",0,null,"4","4.7","4.7.1","","4.7.1.3",null,0,"4.7.1.3.4","¿El BCP define una estructura de gestión de respuesta ante incidentes, que incluya los roles individuales responsables de responder ante un incidente importante?","1) Plan de Continuidad del Negocio (BCP) \n- Verificar que el BCP defina una estructura de gestión de respuesta ante incidentes y los roles individuales responsables de responder ante incidentes importantes.",null,"Obligatorio estándar","Obligatorio","BizOps",null,null,"4","4.7","4.7.1",null,"4.7.1.3",null,0,"4.7.1.3.4",null,null,null,"ReqS4","Req4","BizOps",null,null,null,null,null,null,null,null,"4.7.1.3.6",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.7","4.7.1",{"$f":"CHOOSE(LanguageNumber,AY131,BP131,CF131,CV131)","v":""},"4.7.1.3",null,null,{"$f":"BC131","v":"4.7.1.3.5"},"4.7.1.3.5: Does the BCP define contingency plans for each entity providing material outsourced services and have they accepted the BCP?\n",{"$f":"CHOOSE(LanguageNumber,BF131,BV131,CL131,DB131)","v":"1) Business Continuity Plan (BCP) \n- Check the acceptance of the BCP by all business functions and key 3rd parties identified in the BCP. Acceptance should be indicated by signature of the BCP.\n\n"},0,{"$f":"CHOOSE(LanguageNumber,BH131,BX131,CN131,DD131)","v":"Recommended"},{"$f":"CHOOSE(LanguageNumber,BI131,BY131,CO131,DE131)","v":"Recommended"},"BizOps",{"$f":"CHOOSE(LanguageNumber,BK131,CA131,CQ131,DG131)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.7","4.7.1","","4.7.1.3",null,null,"4.7.1.3.5",{"$f":"DO131","v":"4.7.1.3.10"},"Does the BCP define contingency plans for each entity providing material outsourced services and have they accepted the BCP?","1) Business Continuity Plan (BCP) \n- Check the acceptance of the BCP by all business functions and key 3rd parties identified in the BCP. Acceptance should be indicated by signature of the BCP.\n\n",null,"Recommended","Recommended","BizOps",null,null,"4","4.7","4.7.1","","4.7.1.3",null,null,"4.7.1.3.5","le cas échéant, le PCA prévoit-il des plans de secours pour chaque entité fournissant des services critiques en sous-traitance dans l’éventualité d’une défaillance opérationnelle majeure (en prévoyant par exemple des solutions alternatives telles que le retour en interne de l’activité, le remplacement du sous-traitant ou l’arrêt pur et simple de l’activité) ?","1) Plan de continuité de l’activité (PCA) \n- Vérifier que le PCA prévoit des plans de secours pour chaque service clé sous-traité dans l’éventualité d’une défaillance opérationnelle majeure.\n",null,"Recommandé","Recommandé","BizOps",0,null,"4","4.7","4.7.1","","4.7.1.3",null,null,"4.7.1.3.5","¿El BCP define planes de contingencia para cada entidad que preste servicios tercerizados sustanciales en caso de una falla operativa importante?","1) Plan de Continuidad del Negocio (BCP) \n- Verificar que el BCP incluya planes de contingencia para cualquier servicio tercerizado clave en caso de una falla operativa importante.\n",null,"Recomendado","Recomendado","BizOps",null,null,"4","4.7","4.7.1",null,"4.7.1.3",null,null,"4.7.1.3.5",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"4.7.1.3.10",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.7","4.7.1","","4.7.1.3",null,0,"4.7.1.3.6","4.7.1.3.6: Does the BCP contain the immediate steps that should be taken by staff, agents and 3rd parties if an identified threat materialises?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.7","4.7.1","","4.7.1.3",null,null,"4.7.1.3.6","4.7.1.3.7","Does the BCP contain the immediate steps that should be taken by staff, agents and 3rd parties if an identified threat materialises?",null,null,"Recommended","Recommended","BizOps",null,null,"4","4.7","4.7.1","","4.7.1.3",0,0,"4.7.1.3.6","le PCA précise-t-il les mesures immédiates devant être prises par le personnel, les agents et les tiers en cas de concrétisation d’une menace identifiée ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"4","4.7","4.7.1","","4.7.1.3",null,0,"4.7.1.3.6","¿El BCP contiene los pasos inmediatos que debe realizar el personal, los agentes y terceros si se materializa una amenaza identificada?",null,null,"Recomendado","Recomendado","BizOps",null,null,"4","4.7","4.7.1",null,"4.7.1.3",null,0,"4.7.1.3.6",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"4.7.1.3.7",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.7","4.7.1","","4.7.1.3",null,0,"4.7.1.3.7","4.7.1.3.7: Does the BCP contain the procedures for returning to 'business as usual' following the occurrence of an identified threat?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.7","4.7.1","","4.7.1.3",null,null,"4.7.1.3.7","4.7.1.3.8","Does the BCP contain the procedures for returning to 'business as usual' following the occurrence of an identified threat?",null,null,"Recommended","Recommended","BizOps",null,null,"4","4.7","4.7.1","","4.7.1.3",0,0,"4.7.1.3.7","le PCA précise-t-il les procédures de retour à un fonctionnement normal après la survenue d’une menace identifiée ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"4","4.7","4.7.1","",{"$f":"$AZ133","v":"4.7.1.3"},null,0,"4.7.1.3.7","¿El BCP contiene los procedimientos para volver a la normalidad después de la ocurrencia de una amenaza identificada?",null,null,"Recomendado","Recomendado","BizOps",null,null,"4","4.7","4.7.1",null,"4.7.1.3",null,0,"4.7.1.3.7",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"4.7.1.3.8",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,{"$f":"COUNTIF($DO133:$DR133,\"*?\")","v":1},""]
[null,"4","4.7","4.7.1",0,"4.7.1.3",null,0,"4.7.1.3.8","4.7.1.3.8: Does the BCP contain protocols for communicating internally and externally (including to agents) in the event of a major incident?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.7","4.7.1",null,"4.7.1.3",null,null,"4.7.1.3.8","4.7.1.3.9","Does the BCP contain protocols for communicating internally and externally (including to agents) in the event of a major incident?",null,null,"Recommended","Recommended",{"$f":"$O134","v":"BizOps"},null,null,"4","4.7","4.7.1",0,"4.7.1.3",0,0,"4.7.1.3.8","le PCA précise-t-il les protocoles de communication interne et externe (notamment avec les agents) en cas d’incident majeur ?",null,null,"Recommandé","Recommandé",{"$f":"$O134","v":"BizOps"},0,null,"4","4.7","4.7.1",null,"4.7.1.3",null,0,"4.7.1.3.8","¿El BCP contiene protocolos de comunicación interna y externa (incluidos los agentes) en caso de un incidente importante?",null,null,"Recomendado","Recomendado",{"$f":"$O134","v":"BizOps"},null,null,"4","4.7","4.7.1",null,"4.7.1.3",null,0,"4.7.1.3.8",null,null,null,"Rec4","Rec4",{"$f":"$O134","v":"BizOps"},null,null,null,null,null,null,null,null,"4.7.1.3.9",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,{"$f":"$AV135","v":"4"},{"$f":"$AW135","v":"4.7"},{"$f":"$AX135","v":"4.7.1"},"",{"$f":"AZ135","v":"4.7.1.4"},{"$f":"AZ135&\": \"&CHOOSE(LanguageNumber,BA135,BR135,CH135,CX135)","v":"4.7.1.4: DISASTER RECOVERY (TECHNICAL SYSTEMS)\nA disaster recovery (DR) plan should be implemented for the mobile money technical system. The DR plan defines how the system will be recovered if one or more of the identified threats in the BCP materialises.\n\nIt is essential that the DR plan minimize the loss of customer transaction data, otherwise customer accounts will be incorrect. This is particularly significant given that the accounts contain money rather than airtime. At minimum, all transaction and account data should be replicated to a database hosted with geographical separation.\n\nRecovery objectives should be set for the mobile money system:\n- Recovery Time Objective (RTO) defines the time it should take to recover the system, usually in a separate DR data centre.\n- Recovery Point Objective (RPO) defines the amount of data loss that can be accepted, expressed as a time - i.e. how out-of-date the accounts can become. This should be minimized and set to zero if possible.\n\nThe DR plan should include:\n- The Recovery Time Objective (RTO) and Recovery Point Objective (RPO)\n- Technical architecture for disaster recovery (e.g. data replication);\n- A plan for recovery of systems following a disaster (for  example, acquisition of hardware, relocation of processing into second datacentre) to achieve both RTO and RPO in case any of the identified threats materializes;\n- Management and staffing arrangements for each identified scenario."},0,"4.7.1.4.1","4.7.1.4.1: Has a disaster recovery (DR) plan been implemented for the mobile money technical system that defines how the system will be recovered if one or more of the identified risks materialises?\n","1) Disaster Recovery Plan \n- Check the DRP has been documented\n- Check the DRP defines how each technical system will be recovered if any identified risks materialise. \n",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.7","4.7.1","","4.7.1.4","DISASTER RECOVERY (TECHNICAL SYSTEMS)\nA disaster recovery (DR) plan should be implemented for the mobile money technical system. The DR plan defines how the system will be recovered if one or more of the identified threats in the BCP materialises.\n\nIt is essential that the DR plan minimize the loss of customer transaction data, otherwise customer accounts will be incorrect. This is particularly significant given that the accounts contain money rather than airtime. At minimum, all transaction and account data should be replicated to a database hosted with geographical separation.\n\nRecovery objectives should be set for the mobile money system:\n- Recovery Time Objective (RTO) defines the time it should take to recover the system, usually in a separate DR data centre.\n- Recovery Point Objective (RPO) defines the amount of data loss that can be accepted, expressed as a time - i.e. how out-of-date the accounts can become. This should be minimized and set to zero if possible.\n\nThe DR plan should include:\n- The Recovery Time Objective (RTO) and Recovery Point Objective (RPO)\n- Technical architecture for disaster recovery (e.g. data replication);\n- A plan for recovery of systems following a disaster (for  example, acquisition of hardware, relocation of processing into second datacentre) to achieve both RTO and RPO in case any of the identified threats materializes;\n- Management and staffing arrangements for each identified scenario.",null,"4.7.1.4.1","4.7.1.4.1","Has a disaster recovery (DR) plan been implemented for the mobile money technical system that defines how the system will be recovered if one or more of the identified risks materialises?","1) Disaster Recovery Plan \n- Check the DRP has been documented\n- Check the DRP defines how each technical system will be recovered if any identified risks materialise. \n",null,"Urgent Required","Required","TechOps",null,null,{"$f":"$AV135","v":"4"},{"$f":"$AW135","v":"4.7"},{"$f":"$AX135","v":"4.7.1"},"","4.7.1.4","REPRISE APRÈS SINISTRE (SYSTÈMES TECHNIQUES)\nUn plan de reprise après sinistre (PRAS) doit être mis en œuvre pour le système technique de l’argent mobile afin de définir le mode de reprise du système en cas de concrétisation d’une ou plusieurs des menaces identifiées dans le PCA.\n\nIl est essentiel que le PRAS minimise les pertes des données relatives aux transactions des clients, sans quoi les comptes client pourraient être faussés. Cela est particulièrement important puisque les comptes contiennent de l'argent plutôt que du crédit. Au minimum, toutes les donnes relatives aux comptes et aux transactions doivent être dupliquées dans une base de données hébergée dans un centre de données physiquement séparé.\n\nDes objectifs de reprise doivent être définis pour le système de l'argent mobile :\n- le RTO (Recovery Time Objective) définit le délai souhaité pour la reprise de l’activité du système, généralement dans le cadre d’un centre de données de reprise après sinistre séparé.\n- le RPO (Recovery Point Objective) définit la perte de données maximale admissible (PDMA), exprimée sous forme de durée, à savoir le temps pendant lequel les comptes pourraient ne pas être actualisés. Le RPO doit être minimisé et fixé à zéro, si possible.\n\nLe PRAS doit inclure :\n- le RTO (Recovery Time Objective) et le RPO (Recovery Point Objective) \n- l’architecture technique de reprise après sinistre (par ex. duplication des données) ;\n- un plan de reprise des systèmes après sinistre (ex. acquisition d’équipements, réinstallation du traitement dans un nouveau centre de données) pour respecter à la fois le RTO et le RPO en cas de concrétisation des menaces identifiées ;\n- les dispositions prises concernant la gestion et le personnel pour chaque risque identifié.\n",0,"4.7.1.4.1","un plan de reprise après sinistre (PRAS) a-t-il été mis en œuvre pour le système technique de l’argent mobile afin de définir le mode de reprise du système en cas de concrétisation d’une ou plusieurs des menaces identifiées ?","1) Plan de reprise après sinistre (PRAS) \n- Vérifier que le PRAS est documenté\n- Vérifier que le PRAS définit le mode de reprise de chaque système technique en cas de concrétisation de tout risque identifié. \n",null,"Requis Prioritaire","Requis","TechOps",0,null,{"$f":"$AV135","v":"4"},{"$f":"$AW135","v":"4.7"},{"$f":"$AX135","v":"4.7.1"},"","4.7.1.4","RECUPERACIÓN ANTE DESASTRES (SISTEMAS TÉCNICOS)\nSe debe implementar un plan de recuperación ante desastres (DR) para el sistema técnico del dinero móvil. El plan de DR define cómo se recuperará el sistema si se materializan una o más de las amenazas identificadas en el BCP.\n\nEs esencial que el plan de DR minimice la pérdida de datos de transacciones de los clientes; en caso contrario las cuentas de los clientes serán incorrectas. Esto es particularmente importante porque las cuentas contienen dinero en lugar de tiempo aire. Como mínimo, se deben replicar todos los datos de transacciones y cuentas en una base de datos alojada con separación geográfica.\n\nSe deben establecer objetivos de recuperación para el sistema del dinero móvil:\n- El Objetivo de Tiempo de Recuperación (RTO) define el tiempo que debe tomar recuperar el sistema, generalmente en un centro de datos de DR por separado.\n- El Objetivo de Punto de Recuperación (RPO) define la cantidad de pérdida de datos aceptable, expresada en tiempo - es decir, lo desactualizadas que pueden tornarse las cuentas. Esto último debe minimizarse y establecerse en cero, si fuese posible.\n\nEl plan de DR debe incluir:\n- El Objetivo de Tiempo de Recuperación (RTO) y el Objetivo de Punto de Recuperación (RPO)\n- Arquitectura técnica para recuperación ante desastres (por ej., réplica de datos);\n- Un plan para la recuperación del sistema después de un desastre (por ej., adquisición de hardware, reubicación del procesamiento en un centro de datos secundario) para alcanzar ambos RTO y RPO, en caso de que se materialice alguna de las amenazas identificadas;\n- Arreglos con la gerencia y el personal para cada escenario identificado.",0,"4.7.1.4.1","¿Se implementó un plan de recuperación ante desastres (DR) para el sistema técnico del dinero móvil que defina cómo se recuperará el sistema si se materializan uno o más de los riesgos identificados?","1) Plan de Recuperación ante Desastres\n- Verificar que se haya documentado el DRP\n- Verificar que el DRP defina cómo se recuperará cada sistema técnico si se materializa alguna de las amenazas identificadas. \n",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,{"$f":"$AV135","v":"4"},{"$f":"$AW135","v":"4.7"},{"$f":"$AX135","v":"4.7.1"},null,"4.7.1.4",null,0,"4.7.1.4.1",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"4.7.1.4.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.7","4.7.1","","4.7.1.4",null,0,"4.7.1.4.2","4.7.1.4.2: Is all transaction and account data replicated to a second database hosted with geographcal separation?\n","1) Disaster Recovery Plan and/or \n2) System architecture spec.\n- Check there is a process for all transaction and account data to be replicated to a second database with geographic separation",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.7","4.7.1","","4.7.1.4",null,null,"4.7.1.4.2","4.7.1.4.2","Is all transaction and account data replicated to a second database hosted with geographcal separation?","1) Disaster Recovery Plan and/or \n2) System architecture spec.\n- Check there is a process for all transaction and account data to be replicated to a second database with geographic separation",null,"Urgent Required","Required","TechOps",null,null,"4","4.7","4.7.1","","4.7.1.4",0,0,"4.7.1.4.2","toutes les données relatives aux comptes et aux transactions sont-elles dupliquées en temps réel dans une base de données hébergée dans un centre de données séparé ?","1) Plan de reprise après sinistre (PRAS) et/ou \n2) Spécification de l’architecture du système\n-Vérifier qu’un processus a été mis en place afin de dupliquer toutes les données relatives aux comptes et aux transactions dans une seconde base de données physiquement séparée de la première\n",null,"Requis Prioritaire","Requis","TechOps",0,null,"4","4.7","4.7.1","","4.7.1.4",null,0,"4.7.1.4.2","¿Se replican todos los datos de transacciones y cuentas en una base de datos por separado alojada con separación geográfica?","1) Plan de Recuperación ante Desastres y/o \n2) Especificación de arquitectura del sistema\n- Verificar que exista un proceso para replicar todos los datos de transacciones y cuentas en una base de datos secundaria alojada con separación geográfica",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"4","4.7","4.7.1",null,"4.7.1.4",null,0,"4.7.1.4.2",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"4.7.1.4.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.7","4.7.1","","4.7.1.4",null,0,"4.7.1.4.3","4.7.1.4.3: Has a Recovery Time Objective (RTO) been set to define the time it should take to recover the system, usually in a separate DR data centre?\n","1) Disaster Recovery Plan (DRP) \n- Check that a recovery time objective (RTO) has been set.\n- Check the RTO has been accepted by the head of mobile money and the board risk committee (or similar governance entity).",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.7","4.7.1","","4.7.1.4",null,null,"4.7.1.4.3","4.7.1.4.3","Has a Recovery Time Objective (RTO) been set to define the time it should take to recover the system, usually in a separate DR data centre?","1) Disaster Recovery Plan (DRP) \n- Check that a recovery time objective (RTO) has been set.\n- Check the RTO has been accepted by the head of mobile money and the board risk committee (or similar governance entity).",null,"Standard Required","Required","TechOps",null,null,"4","4.7","4.7.1","","4.7.1.4",0,0,"4.7.1.4.3","un RTO (Recovery Time Objective) a-t-il été fixé pour définir le délai souhaité de reprise de l’activité du système, dans le cadre généralement d’un centre de données séparé ?","1) Plan de reprise après sinistre (PRAS)\n- Vérifier qu’un RTO (Recovery Time Objective) a été fixé.\n- Vérifier que le RTO a été approuvé par le responsable de l’exploitation de l’argent mobile et le comité des risques du conseil d’administration (ou toute entité de la gouvernance similaire).",null,"Requis Normal","Requis","TechOps",0,null,"4","4.7","4.7.1","","4.7.1.4",null,0,"4.7.1.4.3","¿Se estableció un Objetivo de Tiempo de Recuperación (RTO) para definir el tiempo que debe tomar recuperar el sistema, generalmente en un centro de datos de DR por separado?","1) Plan de Recuperación ante Desastre (DRP) \n- Verificar que se haya establecido un objetivo de tiempo de recuperación (RTO).\n- Verificar que el RTO haya sido aceptado por el jefe del dinero móvil y por el comité de riesgos (o entidad de gobernanza similar).",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"4","4.7","4.7.1",null,"4.7.1.4",null,0,"4.7.1.4.3",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"4.7.1.4.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.7","4.7.1","","4.7.1.4",null,0,"4.7.1.4.4","4.7.1.4.4: Has a Recovery Point Objective (RPO) been set close to zero to define the amount of data loss that can be accepted, expressed as a time (i.e. how out-of-date the accounts can become)?\n","1) Disaster Recovery Plan (DRP) \n- Check that a low or zero recovery point objective (RPO) has been set.\n- Check the RPO has been accepted by the head of mobile money and the board risk committee (or similar governance entity).",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.7","4.7.1","","4.7.1.4",null,null,"4.7.1.4.4","4.7.1.4.4","Has a Recovery Point Objective (RPO) been set close to zero to define the amount of data loss that can be accepted, expressed as a time (i.e. how out-of-date the accounts can become)?","1) Disaster Recovery Plan (DRP) \n- Check that a low or zero recovery point objective (RPO) has been set.\n- Check the RPO has been accepted by the head of mobile money and the board risk committee (or similar governance entity).",null,"Standard Required","Required","TechOps",null,null,"4","4.7","4.7.1","","4.7.1.4",0,0,"4.7.1.4.4","un RPO (Recovery Point Objective) proche de zéro a-t-il été fixé pour définir la perte de données maximale admissible exprimée sous forme de durée (à savoir le temps pendant lequel les comptes pourraient ne pas être actualisés) ?","1) Plan de reprise après sinistre (PRAS) \n- Vérifier qu’un RPO (Recovery Point Objective) proche de zéro a été fixé.\n- Vérifier que le RPO a été approuvé par le responsable de l’exploitation de l’argent mobile et le comité des risques du conseil d’administration (ou toute entité de la gouvernance similaire). ",null,"Requis Normal","Requis","TechOps",0,null,"4","4.7","4.7.1","","4.7.1.4",null,0,"4.7.1.4.4","¿Se estableció un Objetivo de Punto de Recuperación (RPO) cercano a cero para definir la cantidad de pérdida de datos aceptable, expresada en tiempo (es decir, lo desactualizadas que pueden tornarse las cuentas)?","1) Plan de Recuperación ante Desastres (DRP) \n- Verificar que se haya establecido un objetivo de punto de recuperación (RTO) bajo o en cero.\n- Verificar que el RPO haya sido aceptado por el jefe del dinero móvil y por el comité de riesgos (o entidad de gobernanza similar).",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"4","4.7","4.7.1",null,"4.7.1.4",null,0,"4.7.1.4.4",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"4.7.1.4.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.7","4.7.1","","4.7.1.5","4.7.1.5: DISASTER RECOVERY TESTING\nDisaster recovery (failover) plans for the mobile money system should be tested every two years at minimum and annually if possible.\n\nDR testing should test the failover scenarios for all identified threats and evaluate whether the recovery time objective (RTO) and recovery point objective (RPO) is met for each identified threat.\n\nDR testing should evaluate internal procedures as well as dependencies on 3rd party suppliers.\n\nRecords of all periodic evaluations and their results should be maintained. DR testing reports should be sent to mobile money technical and business managers.","ISO 22313:2020 Sec. 8.5, 9.1 & 9.3","4.7.1.5.1","4.7.1.5.1: Are disaster recovery (failover) plans for the mobile money system tested every two years at minimum?\n","1) Disaster Recovery testing plan\n- Check that the disaster recover (failover) plan has been tested in at least the last 2 years for the core mobile money system as well as any other systems identified as mission critical to the mobile money service.  ",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.7","4.7.1","","4.7.1.5","DISASTER RECOVERY TESTING\nDisaster recovery (failover) plans for the mobile money system should be tested every two years at minimum and annually if possible.\n\nDR testing should test the failover scenarios for all identified threats and evaluate whether the recovery time objective (RTO) and recovery point objective (RPO) is met for each identified threat.\n\nDR testing should evaluate internal procedures as well as dependencies on 3rd party suppliers.\n\nRecords of all periodic evaluations and their results should be maintained. DR testing reports should be sent to mobile money technical and business managers.","ISO 22313:2020 Sec. 8.5, 9.1 & 9.3","4.7.1.5.1","4.7.1.5.1","Are disaster recovery (failover) plans for the mobile money system tested every two years at minimum?","1) Disaster Recovery testing plan\n- Check that the disaster recover (failover) plan has been tested in at least the last 2 years for the core mobile money system as well as any other systems identified as mission critical to the mobile money service.  ",null,"Standard Required","Required","TechOps",null,null,"4","4.7","4.7.1","","4.7.1.5","TESTS DE REPRISE APRÈS SINISTRE\nLes plans de reprise après sinistre du système de l’argent mobile doivent être testés au minimum une fois tous les deux ans, et une fois par an dans l'idéal,\n\nLes tests de reprise après sinistre doivent vérifier que le RTO (Recovery Time Objective) et le RPO (Recovery Point Objective) sont respectés pour chaque menace identifiée,\n\nLes tests de reprise après sinistre doivent évaluer les procédures internes de continuité ainsi que les liens de dépendance vis-à-vis de fournisseurs extérieurs,\n\nLes dossiers de toutes les évaluations périodiques et de leurs résultats doivent être conservés. Les rapports des tests de reprise après sinistre doivent être communiqués aux responsables techniques et fonctionnels de l’argent mobile.\n","ISO 22313:2020 Sec. 8.5, 9.1 & 9.3","4.7.1.5.1","les plans de reprise après sinistre du système de l’argent mobile sont-ils testés au minimum une fois tous les deux ans ?","1) Plan de test de reprise après sinistre\n- Vérifier que le plan de reprise après sinistre est testé au minimum une fois tous les deux ans pour le système central de l’argent mobile ainsi que tout autre système identifié comme essentiel au service d’argent mobile. ",null,"Requis Normal","Requis","TechOps",0,null,"4","4.7","4.7.1","","4.7.1.5","PRUEBAS DE RECUPERACIÓN ANTE DESASTRES\nLos planes de recuperación ante desastres (fallas) para el sistema del dinero móvil deben ser probados, como mínimo, cada dos años y una vez al año, si fuese posible.\n\nLas pruebas de DR deben probar los escenarios de recuperación ante fallas para todas las amenazas identificadas y evaluar si se cumplen el objetivo de tiempo de recuperación (RTO) y el objetivo de punto de recuperación (RPO) para cada amenaza identificada.\n\nLas pruebas de DR deben evaluar los procedimientos internos así como las dependencias con los terceros proveedores.\n\nSe deben mantener registros de todas las evaluaciones periódicas y de sus resultados. Los informes de pruebas de DR deben ser enviados a los gerentes técnicos y comerciales del dinero móvil.","ISO 22313:2020 Sec. 8.5, 9.1 & 9.3","4.7.1.5.1","¿Los planes de recuperación ante desastres (fallas) para el sistema del dinero móvil son probados, como mínimo, cada dos años?","1) Plan de pruebas de Recuperación ante Desastres\n- Verificar que el plan de recuperación ante desastres (fallas) haya sido probado, al menos, una vez en los últimos 2 años para el sistema central del dinero móvil, así como también para todos los demás sistemas identificados como de misión crítica para el servicio del dinero móvil.  ",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"4","4.7","4.7.1",null,"4.7.1.5",null,"ISO 22313:2020 Sec. 8.5, 9.1 & 9.3","4.7.1.5.1",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"4.7.1.5.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.7","4.7.1","","4.7.1.5",null,0,"4.7.1.5.2","4.7.1.5.2: Does DR testing evaluate whether the recovery time objective (RTO) and recovery point objective (RPO) is met for each identified risk?\n","1) Disaster Recovery testing plan\n-  Check that the targeted recovery time objective (RTO) and the recovery point objective (RPO) where evaluated during the last failover test performed.",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.7","4.7.1","","4.7.1.5",null,null,"4.7.1.5.2","4.7.1.5.2","Does DR testing evaluate whether the recovery time objective (RTO) and recovery point objective (RPO) is met for each identified risk?","1) Disaster Recovery testing plan\n-  Check that the targeted recovery time objective (RTO) and the recovery point objective (RPO) where evaluated during the last failover test performed.",null,"Standard Required","Required","TechOps",null,null,"4","4.7","4.7.1","","4.7.1.5",0,0,"4.7.1.5.2","les tests de reprise après sinistre vérifient-ils que le RTO (Recovery Time Objective) et le RPO (Recovery Point Objective) sont respectés pour chaque menace identifiée ?","1) Plan de test de reprise après sinistre\n- Vérifier que le RTO (Recovery Time Objective) et le RPO (Recovery Point Objective) visés ont été évalués au cours du dernier test de reprise après sinistre réalisé.",null,"Requis Normal","Requis","TechOps",0,null,"4","4.7","4.7.1","","4.7.1.5",null,0,"4.7.1.5.2","¿Las pruebas de DR evalúan si se cumple el objetivo de tiempo de recuperación (RTO) y el objetivo de punto de recuperación (RPO) para cada riesgo identificado?","1) Plan de pruebas de Recuperación ante Desastres\n-  Verificar que el objetivo de tiempo de recuperación (RTO) y el objetivo de punto de recuperación (RPO) hayan sido evaluados durante la última prueba de recuperación ante fallas.",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"4","4.7","4.7.1",null,"4.7.1.5",null,0,"4.7.1.5.2",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"4.7.1.5.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.7","4.7.1","","4.7.1.5",null,0,"4.7.1.5.3","4.7.1.5.3: Does DR testing evaluate internal continuity procedures as well as dependencies on 3rd party suppliers?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.7","4.7.1","","4.7.1.5",null,null,"4.7.1.5.3","4.7.1.5.3","Does DR testing evaluate internal continuity procedures as well as dependencies on 3rd party suppliers?",null,null,"Recommended","Recommended","TechOps",null,null,"4","4.7","4.7.1","","4.7.1.5",0,0,"4.7.1.5.3","les tests de reprise après sinistre évaluent-ils les procédures internes de continuité ainsi que les liens de dépendance vis-à-vis de fournisseurs extérieurs ?",null,null,"Recommandé","Recommandé","TechOps",0,null,"4","4.7","4.7.1","","4.7.1.5",null,0,"4.7.1.5.3","¿Las pruebas de DR evalúan los procedimientos de continuidad internos, así como las dependencias con los terceros proveedores?",null,null,"Recomendado","Recomendado","TechOps",null,null,"4","4.7","4.7.1",null,"4.7.1.5",null,0,"4.7.1.5.3",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.7.1.5.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"4","4.7","4.7.1","","4.7.1.5",null,0,"4.7.1.5.4","4.7.1.5.4: Are DR testing reports sent to mobile money technical and business managers?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4","4.7","4.7.1","","4.7.1.5",null,null,"4.7.1.5.4","4.7.1.5.4","Are DR testing reports sent to mobile money technical and business managers?",null,null,"Recommended","Recommended","TechOps",null,null,"4","4.7","4.7.1","","4.7.1.5",0,0,"4.7.1.5.4","les rapports des tests de reprise après sinistre sont-ils communiqués aux responsables techniques et fonctionnels de l’argent mobile ?",null,null,"Recommandé","Recommandé","TechOps",0,null,"4","4.7","4.7.1","","4.7.1.5",null,0,"4.7.1.5.4","¿Los informes de pruebas de DR son enviados a los gerentes técnicos y comerciales del dinero móvil?",null,null,"Recomendado","Recomendado","TechOps",null,null,"4","4.7","4.7.1",null,"4.7.1.5",null,0,"4.7.1.5.4",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"4.7.1.5.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP4","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,null,null,null,null,".",".",".",".","."]

{"sheet":"5","index":6,"n_rows":147,"n_cols":144,"rows_kept":147,"cut":false,"hidden":false,"merged":[[51,86,54,86],[66,52,70,52],[80,70,83,70],[116,53,118,53],[111,53,115,53],[106,53,108,53],[109,53,110,53],[100,69,103,69],[84,70,88,70],[63,83,65,83],[63,85,64,85],[89,53,92,53],[80,53,83,53],[71,53,72,53],[73,53,79,53],[66,53,70,53],[73,70,79,70],[106,52,108,52],[71,52,72,52],[104,69,105,69],[106,69,108,69],[63,69,64,69],[66,69,70,69],[71,69,72,69],[35,86,41,86],[35,85,41,85],[35,70,41,70],[35,69,41,69],[28,70,33,70],[141,70,144,70],[138,67,139,67],[136,69,137,69],[109,69,110,69],[111,69,115,69],[116,67,117,67],[138,69,140,69],[63,67,65,67],[93,67,94,67],[89,67,90,67],[130,69,135,69],[119,69,121,69],[122,69,127,69],[128,69,129,69],[98,85,99,85],[63,70,64,70],[44,86,45,86],[46,86,50,86],[51,85,54,85],[141,67,142,67],[141,83,142,83],[141,53,145,53],[98,52,99,52],[98,53,99,53],[35,53,41,53],[80,6,83,6],[58,6,61,6],[63,6,64,6],[66,6,70,6],[89,50,90,50],[93,70,97,70],[93,69,97,69],[73,69,79,69],[98,69,99,69],[46,52,50,52],[46,53,50,53],[130,6,135,6],[119,6,121,6],[122,6,127,6],[128,6,129,6],[136,6,137,6],[93,6,97,6],[89,6,92,6],[4,53,6,53],[4,52,6,52],[23,69,27,69],[28,69,33,69],[23,52,27,52],[9,52,11,52],[13,52,15,52],[9,53,11,53],[14,53,15,53],[13,69,15,69],[21,53,22,53],[28,52,33,52],[28,53,33,53],[4,67,5,67],[4,85,6,85],[9,69,11,69],[4,70,6,70],[4,69,6,69],[9,70,11,70],[14,70,15,70],[13,67,15,67],[17,83,18,83],[21,85,22,85],[17,67,18,67],[42,4,43,4],[42,6,43,6],[55,6,57,6],[51,6,54,6],[42,53,43,53],[44,52,45,52],[44,53,45,53],[9,85,11,85],[23,53,27,53],[35,6,41,6],[51,69,54,69],[21,69,22,69],[28,85,33,85],[42,85,43,85],[55,85,57,85],[21,70,22,70],[23,70,27,70],[23,85,27,85],[35,52,41,52],[42,69,43,69],[44,69,45,69],[46,69,50,69],[55,69,57,69],[42,52,43,52],[4,4,5,4],[17,4,18,4],[21,6,22,6],[23,6,27,6],[28,6,33,6],[20,4,21,4],[9,6,11,6],[21,52,22,52],[13,6,15,6],[4,6,6,6],[13,4,14,4],[17,50,18,50],[13,50,15,50],[98,6,99,6],[58,69,61,69],[93,53,97,53],[84,53,88,53],[89,69,92,69],[84,69,88,69],[119,53,121,53],[116,69,118,69],[98,67,99,67],[106,67,107,67],[80,69,83,69],[111,6,115,6],[100,52,103,52],[100,53,103,53],[141,6,145,6],[71,6,72,6],[109,6,110,6],[104,6,105,6],[106,6,108,6],[73,6,79,6],[84,6,88,6],[100,6,103,6],[141,52,145,52],[73,52,79,52],[116,50,117,50],[116,52,118,52],[111,52,115,52],[104,52,105,52],[109,52,110,52],[80,52,83,52],[89,52,92,52],[119,52,121,52],[73,50,74,50],[84,52,88,52],[93,52,97,52],[138,50,139,50],[138,52,140,52],[138,6,140,6],[63,4,65,4],[46,6,50,6],[44,6,45,6],[138,53,140,53],[130,52,135,52],[130,53,135,53],[122,52,127,52],[122,53,127,53],[128,52,129,52],[128,53,129,53],[136,52,137,52],[136,53,137,53],[63,50,65,50],[63,53,64,53],[51,52,54,52],[51,53,54,53],[58,52,61,52],[58,53,61,53],[55,53,57,53],[63,52,64,52],[55,52,57,52],[138,4,139,4],[116,4,117,4],[116,6,118,6],[138,83,139,83],[138,85,140,85],[42,70,43,70],[44,70,45,70],[46,70,50,70],[51,70,54,70],[55,70,57,70],[130,85,135,85],[136,70,137,70],[58,70,61,70],[66,70,70,70],[44,85,45,85],[46,85,50,85],[136,85,137,85],[122,70,127,70],[128,70,129,70],[130,70,135,70],[89,70,92,70],[71,70,72,70],[138,70,140,70],[106,70,108,70],[109,70,110,70],[100,70,103,70],[100,85,103,85],[136,86,137,86],[119,85,121,85],[119,86,121,86],[122,85,127,85],[122,86,127,86],[128,85,129,85],[128,86,129,86],[98,86,99,86],[138,86,140,86],[106,86,108,86],[109,86,110,86],[111,85,115,85],[111,86,115,86],[116,86,118,86],[104,85,105,85],[106,85,108,85],[109,85,110,85],[116,85,118,85],[111,70,115,70],[116,70,118,70],[119,70,121,70],[63,86,64,86],[66,85,70,85],[66,86,70,86],[93,85,97,85],[93,86,97,86],[71,85,72,85],[71,86,72,86],[80,85,83,85],[80,86,83,86],[89,85,92,85],[89,86,92,86],[84,85,88,85],[84,86,88,86],[116,83,117,83],[98,70,99,70],[4,86,6,86],[141,86,144,86],[44,102,45,102],[58,102,61,102],[71,102,72,102],[93,102,97,102],[106,102,108,102],[119,102,121,102],[130,102,135,102],[73,86,79,86],[44,101,45,101],[130,86,135,86],[119,101,121,101],[122,101,127,101],[128,101,129,101],[138,101,140,101],[141,101,144,101],[89,102,92,102],[136,102,137,102],[93,101,97,101],[89,101,92,101],[98,101,99,101],[55,86,57,86],[58,86,61,86],[4,102,6,102],[17,99,18,99],[20,99,21,99],[21,102,22,102],[23,102,27,102],[28,102,33,102],[42,99,43,99],[42,102,43,102],[42,101,43,101],[9,102,11,102],[14,102,15,102],[9,101,11,101],[21,101,22,101],[23,101,27,101],[28,101,33,101],[13,101,15,101],[35,102,41,102],[35,101,41,101],[4,101,6,101],[111,101,115,101],[116,101,118,101],[100,102,103,102],[100,101,103,101],[13,83,15,83],[73,83,74,83],[89,83,90,83],[63,99,65,99],[63,102,64,102],[46,102,50,102],[46,101,50,101],[51,102,54,102],[66,102,70,102],[98,102,99,102],[80,102,83,102],[55,102,57,102],[73,101,79,101],[84,101,88,101],[100,86,103,86],[73,85,79,85],[58,85,61,85],[13,85,15,85],[42,86,43,86],[106,101,108,101],[141,85,145,85],[3,88,3,89],[141,69,145,69],[138,99,139,99],[138,102,140,102],[109,102,110,102],[111,102,115,102],[116,99,117,99],[116,102,118,102],[51,101,54,101],[55,101,57,101],[58,101,61,101],[63,101,64,101],[73,102,79,102],[84,102,88,102],[66,101,70,101],[71,101,72,101],[80,101,83,101],[141,102,144,102],[122,102,127,102],[128,102,129,102],[130,101,135,101],[136,101,137,101],[109,101,110,101]]}
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,"x",null,null,null,null,"x",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"x"]
[null,null,null,null,null,null,{"$f":"UPPER(Introduction!B25)","v":"5. SECURITY:  ENSURE THE SECURITY OF THE SYSTEMS SUPPORTING THE SERVICE"},null,null,null,null,null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,Drivers!K18,Drivers!L18,Drivers!M18,Drivers!N18)","v":"SELF-ASSESSMENT"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,Drivers!K34,Drivers!L34,Drivers!M34,Drivers!N34)","v":"EXTERNAL ASSESSMENT"},null,null,null,null,null,"SCHEME OPERATOR REVIEW",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,16,null,17,null,null,3,null,null,4,5,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Change types: NEW, MERGE, MOVE, SWAP","Don't edit the Indicator ID",null,null,null,"*** Don't edit any cell from AB and onwards *** Ignore #NAME errors; these will disappear during migration",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Counts for computed Compliance calc"]
[null,{"$f":"CHOOSE(LanguageNumber,AV3,BM3,CC3,CS3)","v":"Principle"},"Sub-principle","Sub-sub-principle","Sub-sub-principle","Practice ID","Practice","Practice data source","Indicator ID",{"$f":"CHOOSE(LanguageNumber,BE3,BU3,CK3,DA3)","v":"Indicator"},"Evidence required","[SPARE]","Detailed indicator category","Indicator category","Function","[SPARE]",{"$f":"CHOOSE(LanguageNumber,Drivers!K19,Drivers!L19,Drivers!M19,Drivers!N19)","v":"Compliance"},{"$f":"CHOOSE(LanguageNumber,Drivers!K20,Drivers!L20,Drivers!M20,Drivers!N20)","v":"Evidence document (specify document name, section number and page number)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K21,Drivers!L21,Drivers!M21,Drivers!N21)","v":"Comments \n(include notes on how the practice is implemented)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K22,Drivers!L22,Drivers!M22,Drivers!N22)","v":"Action"},{"$f":"CHOOSE(LanguageNumber,Drivers!K23,Drivers!L23,Drivers!M23,Drivers!N23)","v":"Reviewer name"},{"$f":"CHOOSE(LanguageNumber,Drivers!K24,Drivers!L24,Drivers!M24,Drivers!N24)","v":"Evidence sent to Assessor?"},{"$f":"CHOOSE(LanguageNumber,Drivers!K25,Drivers!L25,Drivers!M25,Drivers!N25)","v":"Spare 2"},{"$f":"CHOOSE(LanguageNumber,Drivers!K26,Drivers!L26,Drivers!M26,Drivers!N26)","v":"Spare 3"},{"$f":"CHOOSE(LanguageNumber,Drivers!K27,Drivers!L27,Drivers!M27,Drivers!N27)","v":"Spare 4"},{"$f":"CHOOSE(LanguageNumber,Drivers!K28,Drivers!L28,Drivers!M28,Drivers!N28)","v":"Spare 5"},{"$f":"CHOOSE(LanguageNumber,Drivers!K29,Drivers!L29,Drivers!M29,Drivers!N29)","v":"Spare 6"},{"$f":"CHOOSE(LanguageNumber,Drivers!K30,Drivers!L30,Drivers!M30,Drivers!N30)","v":"Spare 7"},{"$f":"CHOOSE(LanguageNumber,Drivers!K31,Drivers!L31,Drivers!M31,Drivers!N31)","v":"Spare 8"},{"$f":"CHOOSE(LanguageNumber,Drivers!K32,Drivers!L32,Drivers!M32,Drivers!N32)","v":"Spare 9"},{"$f":"CHOOSE(LanguageNumber,Drivers!K33,Drivers!L33,Drivers!M33,Drivers!N33)","v":"Spare 10"},{"$f":"CHOOSE(LanguageNumber,Drivers!K35,Drivers!L35,Drivers!M35,Drivers!N35)","v":"Compliance"},{"$f":"CHOOSE(LanguageNumber,Drivers!K36,Drivers!L36,Drivers!M36,Drivers!N36)","v":"Evidence document (specify document name, section number and page number)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K37,Drivers!L37,Drivers!M37,Drivers!N37)","v":"Comments \n(include notes on how the practice is implemented)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K38,Drivers!L38,Drivers!M38,Drivers!N38)","v":"Recommendation to Provider"},{"$f":"CHOOSE(LanguageNumber,Drivers!K39,Drivers!L39,Drivers!M39,Drivers!N39)","v":"Reviewer name"},{"$f":"CHOOSE(LanguageNumber,Drivers!K40,Drivers!L40,Drivers!M40,Drivers!N40)","v":"Guidance notes for Assessor"},{"$f":"CHOOSE(LanguageNumber,Drivers!K41,Drivers!L41,Drivers!M41,Drivers!N41)","v":"Scheme Operator comments"},{"$f":"CHOOSE(LanguageNumber,Drivers!K42,Drivers!L42,Drivers!M42,Drivers!N42)","v":"Assessor's response to Scheme Operator"},{"$f":"CHOOSE(LanguageNumber,Drivers!K43,Drivers!L43,Drivers!M43,Drivers!N43)","v":"Scheme Operator conclusion"},{"$f":"CHOOSE(LanguageNumber,Drivers!K44,Drivers!L44,Drivers!M44,Drivers!N44)","v":"Spare 15"},{"$f":"CHOOSE(LanguageNumber,Drivers!K45,Drivers!L45,Drivers!M45,Drivers!N45)","v":"Spare 16"},{"$f":"CHOOSE(LanguageNumber,Drivers!K46,Drivers!L46,Drivers!M46,Drivers!N46)","v":"Spare 17"},{"$f":"CHOOSE(LanguageNumber,Drivers!K47,Drivers!L47,Drivers!M47,Drivers!N47)","v":"Spare 18"},{"$f":"CHOOSE(LanguageNumber,Drivers!K48,Drivers!L48,Drivers!M48,Drivers!N48)","v":"Spare 19"},{"$f":"CHOOSE(LanguageNumber,Drivers!K49,Drivers!L49,Drivers!M49,Drivers!N49)","v":"Spare 20"},null,"Principle","Sub-principle","Sub-sub-principle","Sub-sub-principle","Practice ID","Practice","Practice data source","Indicator ID","ORIGINAL ID","Indicator","Evidence required","[SPARE]","Detailed indicator category","Indicator category","Function","[SPARE]",null,"Principe","Sous-principe","Sous-sous-principe","Description du sous-sous-principe","Pratique ID","Pratique","Source de données pratique","Indicateur ID","Indicateur","Documents généralement requis","[SPARE]","Catégorie détaillée d’indicateur","Catégorie d’indicateur","Fonction","[SPARE]",null,"Principio","Sub-principio","Sub-sub-principio","Sub-sub-principio","Nro. de Práctica","Práctica","Origen de datos de Práctica","Nro. de Indicador","Indicador","Documentación obligatoria","[SPARE]","Categoría indicador detallada","Categoría de Indicador","Función","[SPARE]",null,"Principle","Sub-principle","Sub-sub-principle","Sub-sub-principle Description","Practice ID","Practice","Practice data source","Indicator","Indicator","Evidence required","[SPARE]","Detailed indicator category","Indicator category","Function","[SPARE]",null,null,null,null,null,null,"Change type","Original Indicator ID","Merged indicator #1","Merged indicator #2","Merged indicator #3","v1 Compliance rating Original Indicator ID","v1 Compliance rating Merged indicator #1","v1 Compliance rating Merged indicator #2","v1 Compliance rating Merged indicator #3","v1 Comment Original Indicator ID","v1 Comment Merged indicator #1  ","v1 Comment Merged indicator #2","v1 Comment Merged indicator #3","v2 Computed change type","v2 Computed compliance rating","v2 Computed comment","rangename1","rangename2","rangename3","rangename4","Yes","No","N/A","Partial","No Response","how many","calc"]
[null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!C25,\": \",Introduction!D25))","v":"5.1: SECURITY GOVERNANCE"},null,null,null,null,{"$f":"Introduction!E25","v":"Providers shall implement governance mechanisms to ensure that security policies are defined and implemented with ongoing management"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$25,\": \",Introduction!$L$25))","v":"5.1: SECURITY GOVERNANCE"},null,null,null,null,null,{"$f":"Introduction!$M$25","v":"Providers shall implement governance mechanisms to ensure that security policies are defined and implemented with ongoing management"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!$U$25,\": \",Introduction!$V$25))","v":"5.1: GOBERNANZA DE LA SEGURIDAD"},null,null,0,null,{"$f":"Introduction!W25","v":"El proveedor implementará mecanismos de gobernanza para garantizar la constante gestión de la definición e implementación de las políticas de seguridad"},null,null,null,null,null,null,null,null,null,null,null,0,null,0]
[null,{"$f":"$AV5","v":"5"},{"$f":"$AW5","v":"5.1"},{"$f":"$AX5","v":"5.1.1"},{"$f":"CHOOSE(LanguageNumber,AY5,BP5,CF5,CV5)","v":"5.1.1: Providers shall develop, implement, and regularly review a formal security policy for mobile money services"},{"$f":"AZ5","v":"5.1.1.1"},{"$f":"AZ5&\": \"&CHOOSE(LanguageNumber,BA5,BR5,CH5,CX5)","v":"5.1.1.1: SECURITY POLICY\nProviders should define an information security policy which should be:\n- properly documented;\n- approved by senior technical management and the head of mobile money;\n- reviewed at least annually and updated when the environment changes.\n\nThe policy should require a security manager with sufficient seniority that has responsibility for implementing the security policy across the mobile money system and its operations. Other key roles and responsibilities for fulfilling the security objectives should also be defined.\n\nThe policy should ensure that all relevant legal and regulatory requirements related to information security are identified and met (e.g. cryptographic controls)."},{"$f":"BB5","v":"ECB RSMP, PCI DSS, ISO 27002:2013 Sec. 5"},{"$f":"BC5","v":"5.1.1.1.1"},{"$f":"BC5&\": \"&CHOOSE(LanguageNumber,BE5,BU5,CK5,DA5)&CarriageReturn","v":"5.1.1.1.1: Is there an information security policy that is properly documented and approved by senior technical management?\n"},{"$f":"CHOOSE(LanguageNumber,BF5,BV5,CL5,DB5)","v":"1) Security policy or equivalent compliance framework or audit documentation\n- Check the security policy is properly documented \n- Check the document has been approved by senior technical management "},0,{"$f":"CHOOSE(LanguageNumber,BH5,BX5,CN5,DD5)","v":"Urgent Required"},{"$f":"CHOOSE(LanguageNumber,BI5,BY5,CO5,DE5)","v":"Required"},"TechOps",{"$f":"CHOOSE(LanguageNumber,BK5,CA5,CQ5,DG5)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.1","5.1.1","5.1.1: Providers shall develop, implement, and regularly review a formal security policy for mobile money services","5.1.1.1","SECURITY POLICY\nProviders should define an information security policy which should be:\n- properly documented;\n- approved by senior technical management and the head of mobile money;\n- reviewed at least annually and updated when the environment changes.\n\nThe policy should require a security manager with sufficient seniority that has responsibility for implementing the security policy across the mobile money system and its operations. Other key roles and responsibilities for fulfilling the security objectives should also be defined.\n\nThe policy should ensure that all relevant legal and regulatory requirements related to information security are identified and met (e.g. cryptographic controls).","ECB RSMP, PCI DSS, ISO 27002:2013 Sec. 5","5.1.1.1.1",{"$f":"DO5","v":"5.1.1.1.1"},"Is there an information security policy that is properly documented and approved by senior technical management?","1) Security policy or equivalent compliance framework or audit documentation\n- Check the security policy is properly documented \n- Check the document has been approved by senior technical management ",null,"Urgent Required","Required",{"$f":"$O5","v":"TechOps"},null,null,{"$f":"$AV5","v":"5"},{"$f":"$AW5","v":"5.1"},{"$f":"$AX5","v":"5.1.1"},"5.1.1: Les prestataires doivent définir et mettre en œuvre une politique formelle de sécurité des services d’argent mobile et l’examiner périodiquement. ",{"$f":"$AZ5","v":"5.1.1.1"},"POLITIQUE DE SÉCURITÉ\nLes prestataires doivent établir une politique de sécurité de l’information qui doit être :\n- correctement documentée ;\n-  approuvée par la direction technique générale et la direction de l’argent mobile ;\n- revue au moins une fois par an et actualisée en fonction des changements de l’environnement.\n\nCette politique doit inclure un responsable de la sécurité ayant un niveau hiérarchique suffisant pour faire appliquer la politique de sécurité à travers tout le système de l’argent mobile et son fonctionnement. La politique doit également définir les autres rôles et responsabilités contribuant à la réalisation des objectifs de sécurité.\n\nLa politique doit garantir que toutes les obligations juridiques et réglementaires liées à la sécurité de l’information soient identifiées et respectées (ex. chiffrement).",{"$f":"BB5","v":"ECB RSMP, PCI DSS, ISO 27002:2013 Sec. 5"},{"$f":"BC5","v":"5.1.1.1.1"},"existe-t-il une politique de sécurité de l’information dûment documentée et approuvée par la direction technique générale ?","1) Politique de sécurité ou directives de conformité ou documentation d’audit équivalentes (Remarque : ce document peut concerner le groupe dans son intégralité)\n- Vérifier que la politique de sécurité est dûment documentée \n- Vérifier que le document a été approuvé par la direction technique ",null,{"$f":"VLOOKUP($BH5,CategoryTranslationTable,2,FALSE)","v":"Requis Prioritaire"},{"$f":"VLOOKUP($BI5,CategoryTranslationTable,2,FALSE)","v":"Requis"},{"$f":"$O5","v":"TechOps"},null,null,{"$f":"$AV5","v":"5"},{"$f":"$AW5","v":"5.1"},{"$f":"$AX5","v":"5.1.1"},"5.1.1: Los proveedores deben desarrollar, implementar y revisar periódicamente una política de seguridad formal para los servicios del dinero móvil",{"$f":"$AZ5","v":"5.1.1.1"},"POLÍTICA DE SEGURIDAD\nLos proveedores deben definir una política de seguridad de la información que debe ser:\n- correctamente documentada;\n- aprobada por la alta gerencia técnica y el jefe del dinero móvil;\n- revisada, al menos, una vez al año y actualizada cuando se realicen cambios al entorno.\n\nLa política debe requerir un gerente de seguridad con antigüedad suficiente, que sea responsable de implementar la política de seguridad a lo largo de todo el sistema del dinero móvil y sus operaciones. También se deben definir otros roles y responsabilidades clave para cumplir con los objetivos de seguridad.\n\nLa política debe garantizar que se definan y cumplan todos los requisitos legales y regulatorios relevantes relacionados con la seguridad de la información (por ej., controles criptográficos).",{"$f":"BB5","v":"ECB RSMP, PCI DSS, ISO 27002:2013 Sec. 5"},{"$f":"$BC5","v":"5.1.1.1.1"},"¿Existe una política de seguridad de la información correctamente documentada y aprobada por la alta gerencia técnica?","1) Política de seguridad, marco de cumplimiento equivalente o documentación de auditoría\n- Verificar que la política de seguridad esté correctamente documentada\n- Verificar que el documento haya sido aprobado por la alta gerencia técnica ",null,{"$f":"VLOOKUP($BH5,CategoryTranslationTable,3,FALSE)","v":"Obligatorio urgente"},{"$f":"VLOOKUP($BI5,CategoryTranslationTable,3,FALSE)","v":"Obligatorio"},{"$f":"$O5","v":"TechOps"},null,null,{"$f":"$AV5","v":"5"},{"$f":"$AW5","v":"5.1"},{"$f":"$AX5","v":"5.1.1"},null,{"$f":"$AZ5","v":"5.1.1.1"},null,{"$f":"BB5","v":"ECB RSMP, PCI DSS, ISO 27002:2013 Sec. 5"},{"$f":"$BC5","v":"5.1.1.1.1"},null,null,null,{"$f":"VLOOKUP($BH5,CategoryTranslationTable,4,FALSE)","v":"ReqU4"},{"$f":"VLOOKUP($BI5,CategoryTranslationTable,4,FALSE)","v":"Req4"},{"$f":"$O5","v":"TechOps"},null,null,null,null,null,null,null,null,"5.1.1.1.1",null,null,null,{"$f":"IF(OR($EA5=0,$EA5=2),VLOOKUP(DO5,INDIRECT(ED5),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP5),\"\",VLOOKUP(DP5,INDIRECT(EE5),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ5),\"\",VLOOKUP(DQ5,INDIRECT(EF5),7,FALSE))","v":""},"",{"$f":"IF(OR($EA5=0,$EA5=2),VLOOKUP(DO5,INDIRECT(ED5),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP5),\"\",VLOOKUP(DP5,INDIRECT(EE5),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ5),\"\",VLOOKUP(DQ5,INDIRECT(EF5),8,FALSE))","v":""},"",{"$f":"1*AND(LEFT(DN5,3)=\"NEW\")+2*AND(LEFT(DN5,3)=\"MER\")+3*AND(LEFT(DN5,3)=\"MOV\")+4*AND(LEFT(DN5,3)=\"SWA\")","v":0},{"$f":"IF(EA5=0,DS5,EN5)","v":{"$error":"#REF!"}},{"$f":"IF(EA5=0,IF(DW5=0,\"\",DW5),CHOOSE(EA5,\"New indicator\",CONCATENATE(DW5,CarriageReturn,DX5,CarriageReturn,DY5,CarriageReturn,DZ5)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO5,1)","v":"OriginalComplianceP5"},{"$f":"\"OriginalComplianceP\"&LEFT(DP5,1)","v":"OriginalComplianceP"},"OriginalComplianceP","OriginalComplianceP",{"$f":"COUNTIF($DS5:$DV5,EH$3)","v":0},0,0,0,0,{"$f":"COUNTIF($DO5:$DR5,\"*?\")","v":1},{"$f":"IF(OR(AND(EH5>0,SUM(EI5:EL5)>0),EK5>0),\"Partial\",IF(EH5=EM5,\"Yes\",IF(EI5=EM5,\"No\",IF(EJ5=EM5,\"N/A\",IF(EK5=EM5,\"Partial\",IF(EL5=EM5,\"\",\"\"))))))","v":""}]
[null,{"$f":"$AV6","v":"5"},{"$f":"$AW6","v":"5.1"},{"$f":"$AX6","v":"5.1.1"},null,{"$f":"AZ6","v":"5.1.1.1"},null,{"$f":"CHOOSE(LanguageNumber,BB6,BS6,CI6,CY6)","v":0},{"$f":"BC6","v":"5.1.1.1.2"},"5.1.1.1.2: Is there someone with sufficient seniority that has responsibility for implementing the security policy across the mobile money system and its operations?\n","1) Technical operations organisation chart\n- Check that an officer has responsibility for implementing security policy across the mobile money system and its operations\n- Check that the officer's grade/rank/band is sufficiently senior to carry out their role effectively\n- Check the officer's job description to see that they are charged with the implementation of security polices for mobile system and its operations.",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.1","5.1.1","","5.1.1.1",null,null,"5.1.1.1.2","5.1.1.1.3","Is there someone with sufficient seniority that has responsibility for implementing the security policy across the mobile money system and its operations?","1) Technical operations organisation chart\n- Check that an officer has responsibility for implementing security policy across the mobile money system and its operations\n- Check that the officer's grade/rank/band is sufficiently senior to carry out their role effectively\n- Check the officer's job description to see that they are charged with the implementation of security polices for mobile system and its operations.",null,"Standard Required","Required",{"$f":"$O6","v":"TechOps"},null,null,{"$f":"$AV6","v":"5"},{"$f":"$AW6","v":"5.1"},{"$f":"$AX6","v":"5.1.1"},null,"5.1.1.1",0,{"$f":"BB6","v":0},{"$f":"BC6","v":"5.1.1.1.2"},"existe-t-il un responsable de la sécurité ayant un niveau hiérarchique suffisant pour faire appliquer la politique de sécurité à l'ensemble du système de l’argent mobile et son fonctionnement ?","1) Organigramme des opérations techniques\n- Vérifier qu’un responsable est chargé de faire appliquer la politique de sécurité à l’ensemble du système d’argent mobile et son fonctionnement\n- Vérifier que le responsable de la sécurité a un niveau hiérarchique suffisant pour accomplir sa mission de manière efficace\n- Vérifier le descriptif du poste du responsable afin de s’assurer que cette personne est chargée de faire appliquer les politiques de sécurité pour le système mobile et son fonctionnement.",null,"Requis Normal","Requis",{"$f":"$O6","v":"TechOps"},null,null,{"$f":"$AV6","v":"5"},{"$f":"$AW6","v":"5.1"},{"$f":"$AX6","v":"5.1.1"},"","5.1.1.1",null,null,"5.1.1.1.2","¿Se designó a una persona con antigüedad suficiente responsable de implementar la política de seguridad a lo largo de todo el sistema del dinero móvil y sus operaciones?","1) Organigrama de operaciones técnicas\n- Verificar que un funcionario sea responsable de implementar la política de seguridad a lo largo de todo el sistema del dinero móvil y sus operaciones\n- Verificar que la antigüedad del grado/rango/nivel del funcionario sea suficiente como para desempeñar su función con eficacia\n- Verificar la descripción del trabajo del funcionario para ver si tiene asignada la implementación de las políticas de seguridad del sistema del dinero móvil y sus operaciones.",null,"Obligatorio estándar","Obligatorio",{"$f":"$O6","v":"TechOps"},null,null,{"$f":"$AV6","v":"5"},{"$f":"$AW6","v":"5.1"},{"$f":"$AX6","v":"5.1.1"},null,"5.1.1.1",null,{"$f":"BB6","v":0},"5.1.1.1.2",null,null,null,"ReqS4","Req4",{"$f":"$O6","v":"TechOps"},null,null,null,null,null,null,null,null,"5.1.1.1.3",null,null,null,{"$f":"IF(OR($EA6=0,$EA6=2),VLOOKUP(DO6,INDIRECT(ED6),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP6),\"\",VLOOKUP(DP6,INDIRECT(EE6),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ6),\"\",VLOOKUP(DQ6,INDIRECT(EF6),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR6),\"\",VLOOKUP(DR6,INDIRECT(EG6),7,FALSE))","v":""},{"$f":"IF(OR($EA6=0,$EA6=2),VLOOKUP(DO6,INDIRECT(ED6),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP6),\"\",VLOOKUP(DP6,INDIRECT(EE6),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ6),\"\",VLOOKUP(DQ6,INDIRECT(EF6),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR6),\"\",VLOOKUP(DR6,INDIRECT(EG6),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN6,3)=\"NEW\")+2*AND(LEFT(DN6,3)=\"MER\")+3*AND(LEFT(DN6,3)=\"MOV\")+4*AND(LEFT(DN6,3)=\"SWA\")","v":0},{"$error":"#REF!"},{"$f":"IF(EA6=0,IF(DW6=0,\"\",DW6),CHOOSE(EA6,\"New indicator\",CONCATENATE(DW6,CarriageReturn,DX6,CarriageReturn,DY6,CarriageReturn,DZ6)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO6,1)","v":"OriginalComplianceP5"},{"$f":"\"OriginalComplianceP\"&LEFT(DP6,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ6,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR6,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,{"$f":"IF(OR(AND(EH6>0,SUM(EI6:EL6)>0),EK6>0),\"Partial\",IF(EH6=EM6,\"Yes\",IF(EI6=EM6,\"No\",IF(EJ6=EM6,\"N/A\",IF(EK6=EM6,\"Partial\",IF(EL6=EM6,\"\",\"\"))))))","v":""}]
[null,"5","5.1","5.1.1",null,"5.1.1.1",null,{"$f":"CHOOSE(LanguageNumber,BB7,BS7,CI7,CY7)","v":0},"5.1.1.1.3","5.1.1.1.3: Is the information security policy reviewed at least annually and updated when the environment changes?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.1","5.1.1",null,"5.1.1.1",null,null,"5.1.1.1.3","5.1.1.1.2","Is the information security policy reviewed at least annually and updated when the environment changes?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.1","5.1.1",null,"5.1.1.1",null,null,{"$f":"BC7","v":"5.1.1.1.3"},"la politique de sécurité du service d’argent mobile est-elle examinée au moins une fois par an et actualisée lorsque l’environnement change ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.1","5.1.1",null,"5.1.1.1",null,null,"5.1.1.1.3","¿La política de seguridad de la información es revisada, al menos, una vez al año y actualizada cuando se realizan cambios al entorno?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.1","5.1.1",null,"5.1.1.1",null,null,"5.1.1.1.3",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.1.1.1.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.1","5.1.1",{"$f":"CHOOSE(LanguageNumber,AY8,BP8,CF8,CV8)","v":""},"5.1.1.2",{"$f":"AZ8&\": \"&CHOOSE(LanguageNumber,BA8,BR8,CH8,CX8)","v":"5.1.1.2: SECURITY OBJECTIVES AND APPROACH\nThe information security policy should set the security objectives, including objectives created by:\n- regulations, legislation and contracts;\n- the current and projected information security threat environment;\n- business appetite for risk.\n\nThe policy should set out the approach to managing the security objectives. The approach should provide multiple levels of security risk monitoring and mitigation e.g. Three Lines of Defence (3LoD) or similar model. This typically means:\n - operational security management (5.3 - especially 5.3.5);\n - security risk management (5.3.1);\n - auditing of security (5.1.1.4)."},{"$f":"BB8","v":"ECB RSMP, ISO 27002:2013 Sec. 6.1"},"5.1.1.2.1","5.1.1.2.1: Does the security policy specify security objectives that provide for multiple levels of security risk monitoring and mitigation (e.g.3LoD or similar)?\n","1) Security policy or equivalent compliance framework or audit documentation\n- Check the security policy specifies security objectives that provide multiple levels of security risk monitoring, for example 3 line of defence etc.",0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.1","5.1.1","","5.1.1.2","SECURITY OBJECTIVES AND APPROACH\nThe information security policy should set the security objectives, including objectives created by:\n- regulations, legislation and contracts;\n- the current and projected information security threat environment;\n- business appetite for risk.\n\nThe policy should set out the approach to managing the security objectives. The approach should provide multiple levels of security risk monitoring and mitigation e.g. Three Lines of Defence (3LoD) or similar model. This typically means:\n - operational security management (5.3 - especially 5.3.5);\n - security risk management (5.3.1);\n - auditing of security (5.1.1.4).","ECB RSMP, ISO 27002:2013 Sec. 6.1","5.1.1.2.1","5.1.1.2.1","Does the security policy specify security objectives that provide for multiple levels of security risk monitoring and mitigation (e.g.3LoD or similar)?","1) Security policy or equivalent compliance framework or audit documentation\n- Check the security policy specifies security objectives that provide multiple levels of security risk monitoring, for example 3 line of defence etc.",null,"Recommended","Recommended","TechOps",null,null,"5","5.1","5.1.1","","5.1.1.2","OBJECTIFS ET APPROCHE DE LA SÉCURITÉ\nLa politique de sécurité de l’information doit définir les objectifs en matière de sécurité, y compris les objectifs relevant :\n- de la réglementation, de la législation et des contrats ;\n- des menaces existantes et prévisibles pesant sur la sécurité de l’environnement ;\n- du niveau d’appétence au risque de l’entreprise.\n\nLa politique doit également définir l’approche de gestion des objectifs de sécurité. Cette approche doit prévoir plusieurs niveaux de surveillance et d’atténuation des risques de sécurité, par exemple un modèle de « trois lignes de défense » (3LoD) ou équivalent,  impliquant généralement :\n - gestion opérationnelle de la sécurité (cf. 5.3, et notamment 5.3.5) ;\n - gestion des risques en matière de sécurité (cf. 5.3.1) ;\n - audits de sécurité (cf. 5.1.1.4).",{"$f":"BB8","v":"ECB RSMP, ISO 27002:2013 Sec. 6.1"},"5.1.1.2.1","la politique de sécurité spécifie-t-elle des objectifs de sécurité prévoyant plusieurs niveaux de surveillance et d’atténuation des risques de sécurité (par exemple un modèle de « trois lignes de défense » (3LoD) ou équivalent) ?","1) Politique de sécurité ou directives de conformité ou documentation d’audit équivalentes (Remarque : ce document peut concerner le groupe dans son intégralité)\n- Vérifier que la politique de sécurité spécifie des objectifs de sécurité prévoyant plusieurs niveaux de surveillance des risques de sécurité, par exemple un modèle de \"trois lignes de défense\", etc.",null,"Recommandé","Recommandé","TechOps",null,null,"5","5.1","5.1.1","","5.1.1.2","OBJETIVOS Y ENFOQUE DE LA SEGURIDAD\nLa política de seguridad de la información debe establecer objetivos de seguridad, incluidos los objetivos creados por:\n- las regulaciones, las leyes y los contratos;\n- el entorno de amenazas a la seguridad de la información actual y proyectado;\n- el apetito del negocio por el riesgo.\n\nLa política debe establecer el enfoque para gestionar los objetivos de seguridad. El enfoque debe establecer múltiples niveles de monitoreo y mitigación de riesgos de la seguridad, por ej., Tres Líneas de Defensa (3LoD) o un modelo similar. Esto generalmente significa:\n - gestión de seguridad operativa (5.3 - especialmente 5.3.5);\n - gestión de riesgos a la seguridad (5.3.1);\n - realización de auditorías de seguridad (5.1.1.4).",{"$f":"BB8","v":"ECB RSMP, ISO 27002:2013 Sec. 6.1"},"5.1.1.2.1","¿La política de seguridad especifica objetivos de seguridad que establezcan múltiples niveles de monitoreo y mitigación de riesgos a la seguridad (por ej., 3LoD o similar)?","1) Política de seguridad, marco de cumplimiento equivalente o documentación de auditoría\n- Verificar que la política de seguridad especifique objetivos de seguridad que establezcan múltiples niveles de monitoreo de riesgos a la seguridad, por ej., 3 líneas de defensa, etc.",null,"Recomendado","Recomendado","TechOps",null,null,"5","5.1","5.1.1",null,"5.1.1.2",null,{"$f":"BB8","v":"ECB RSMP, ISO 27002:2013 Sec. 6.1"},"5.1.1.2.1",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.1.1.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.1","5.1.1","","5.1.1.3","5.1.1.3: SECURITY AUDIT\nThe provider's approach to managing information security, and its implementation (i.e. security policy, procedures and controls), should be independently audited at planned intervals, and when significant changes occur. Management should initiate the independent review, which should include:\n- assessing compliance of the security processes with the security policy and standards;\n- identifying required improvements to the security policy and its approach and control objectives.\n\nThe security audit / compliance review could be carried out by an internal audit team, provided it is independent.\n\nIn addition, technical operations managers should regularly review the compliance of their procedures with the security policy.","ISO 27002:2013 Sec. 18.2 ","5.1.1.3.1","5.1.1.3.1: Are security audits / compliance reviews carried out regularly to assess compliance of the security processes with the mobile money security policy?\n","1) Security policy or equivalent compliance framework or audit documentation (Note this could be a  group-level document)\n- Check the policy includes requirements security processes to be audited against policy requirements, its approach and control objectives.\n- Check the policy set out frequency for the audits.\n- Check the most recent security audit report to ensure it is within the timescales set out in the policy (if not, look for evidence of change to ensure future audits will be timely).\n- Check there is a process for reporting and following up actions.\n\n",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.1","5.1.1","","5.1.1.3","SECURITY AUDIT\nThe provider's approach to managing information security, and its implementation (i.e. security policy, procedures and controls), should be independently audited at planned intervals, and when significant changes occur. Management should initiate the independent review, which should include:\n- assessing compliance of the security processes with the security policy and standards;\n- identifying required improvements to the security policy and its approach and control objectives.\n\nThe security audit / compliance review could be carried out by an internal audit team, provided it is independent.\n\nIn addition, technical operations managers should regularly review the compliance of their procedures with the security policy.","ISO 27002:2013 Sec. 18.2 ","5.1.1.3.1","5.1.1.4.1","Are security audits / compliance reviews carried out regularly to assess compliance of the security processes with the mobile money security policy?","1) Security policy or equivalent compliance framework or audit documentation (Note this could be a  group-level document)\n- Check the policy includes requirements security processes to be audited against policy requirements, its approach and control objectives.\n- Check the policy set out frequency for the audits.\n- Check the most recent security audit report to ensure it is within the timescales set out in the policy (if not, look for evidence of change to ensure future audits will be timely).\n- Check there is a process for reporting and following up actions.\n\n",null,"Standard Required","Required","TechOps",null,null,"5","5.1","5.1.1","","5.1.1.3","AUDITS DE SÉCURITÉ\nL’approche de gestion de la sécurité de l’information et sa mise en œuvre par le prestataire (politique de sécurité, procédures et mesures de contrôle) doivent faire l’objet d’audits indépendants programmés à des intervalles réguliers et lors de changements significatifs. La direction doit donner l’initiative de cet examen indépendant, qui doit inclure :\n- une évaluation de la conformité des processus de sécurité aux politiques et normes de sécurité ;\n- le recensement des améliorations à apporter à la politique de sécurité, à son approche et à ses objectifs de contrôle.\n\nL'audit de sécurité / l’examen de conformité peut être réalisé par une équipe d'audit interne, à condition que celle-ci soit indépendante.\n\nLes responsables des opérations techniques doivent également procéder à des examens réguliers de la conformité de leurs procédures à la politique de sécurité.","ISO 27002:2013 Sec. 18.2 ","5.1.1.3.1","Des audits de sécurité / des examens de conformité sont-ils réalisés régulièrement pour évaluer la conformité des processus de sécurité à la politique de sécurité de l’argent mobile ?","1) Politique de sécurité ou directives de conformité ou documentation d’audit équivalentes \n(Remarque : ce document peut concerner le groupe dans son intégralité)\n- Vérifier que la politique inclut l’obligation d’examiner les processus de sécurité pour évaluer leur conformité aux exigences définies par la politique, à son approche et à ses objectifs de contrôle.\n- Vérifier que la politique définit une échéance pour les audits.\n- Examiner le rapport d’audit de sécurité le plus récent pour s’assurer que cet audit a été réalisé dans les délais définis par la politique (dans le cas contraire, rechercher des éléments prouvant que des changements ont été mis en œuvre pour faire en sorte que les prochains audits soient réalisés dans les délais prévus).\n- Vérifier qu’un processus a été mis en place concernant l’établissement de rapports et les mesures de suivi.\n\n",null,"Requis Normal","Requis","TechOps",null,null,"5","5.1","5.1.1","","5.1.1.3","AUDITORÍA DE SEGURIDAD\nEl enfoque del proveedor para gestionar la seguridad de la información, y su implementación (es decir, política, procedimientos y controles de seguridad) debe ser auditado de forma independiente, a intervalos planificados y cuando se realizan cambios significativos. La gerencia debe iniciar la revisión independiente, que debe incluir:\n- evaluar que los procesos de seguridad cumplan con la política y las normas de seguridad;\n- identificar las mejoras requeridas a la política de seguridad y a su enfoque y sus objetivos de control.\n\nLa auditoría de seguridad / revisión de cumplimiento podría llevarse a cabo por un equipo de auditoría interno, siempre que sea independiente.\n\nAdemás, los gerentes de operaciones técnicas deben revisar periódicamente que sus procedimientos cumplan con la política de seguridad.","ISO 27002:2013 Sec. 18.2 ","5.1.1.3.1","¿Se llevan a cabo, periódicamente, auditorías de seguridad / revisiones de cumplimiento para evaluar el cumplimiento de los procesos de seguridad con la política de seguridad del dinero móvil?","1) Política de seguridad, marco de cumplimiento equivalente o documentación de auditoría\n(Nótese que éste podría ser un documento a nivel del grupo)\n- Verificar que la política requiera la auditoría de los procesos de seguridad en base a los requisitos de la política, su enfoque y los objetivos de control.\n- Verificar que la política establezca plazos para las auditorías.\n- Verificar el informe de auditoría de seguridad más reciente para garantizar que se encuentre dentro de los plazos establecidos en la política (de lo contrario, buscar evidencias de cambios para garantizar que las auditorías futuras serán oportunamente realizadas).\n- Verificar que exista un proceso para generar informes y realizar el seguimiento de las acciones.\n\n",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.1","5.1.1",null,"5.1.1.3",null,"ISO 27002:2013 Sec. 18.2 ","5.1.1.3.1",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.1.1.4.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.1","5.1.2","5.1.2: Providers shall train internal staff about their security responsibilities","5.1.2.1","5.1.2.1: EMPLOYEE SECURITY TRAINING\nAll mobile money staff (including contractors) should receive training in the security policy and procedures before being granted access to the mobile money system.\n\nThe security training programme should be updated regularly to account for changes in procedures and staff should be given regular security training updates. Staff should be briefed on any relevant emerging threats. \n\nThe training should ensure that staff are properly briefed on their security responsibilities including:\n - security of customer data;\n - protection of user IDs and passwords.","ISO 27002:2013 Sec. 7.2","5.1.2.1.1","5.1.2.1.1: Do all mobile money staff (including contractors) receive training in security policies and procedures before being granted access to the mobile money system?\n","1) Security training plan\n- Check the plan includes a process to deliver relevant job specific training to all staff and contractors prior to them being granted access to the system.\n",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.1","5.1.2","5.1.2: Providers shall train internal staff about their security responsibilities","5.1.2.1","EMPLOYEE SECURITY TRAINING\nAll mobile money staff (including contractors) should receive training in the security policy and procedures before being granted access to the mobile money system.\n\nThe security training programme should be updated regularly to account for changes in procedures and staff should be given regular security training updates. Staff should be briefed on any relevant emerging threats. \n\nThe training should ensure that staff are properly briefed on their security responsibilities including:\n - security of customer data;\n - protection of user IDs and passwords.","ISO 27002:2013 Sec. 7.2","5.1.2.1.1","5.1.2.1.1","Do all mobile money staff (including contractors) receive training in security policies and procedures before being granted access to the mobile money system?","1) Security training plan\n- Check the plan includes a process to deliver relevant job specific training to all staff and contractors prior to them being granted access to the system.\n",null,"Urgent Required","Required","TechOps",null,null,"5","5.1","5.1.2","5.1.2: Les prestataires doivent former en matière de sécurité leur personnel interne","5.1.2.1","FORMATION DU PERSONNEL EN MATIÈRE DE SÉCURITÉ\nTout le personnel travaillant sur le service d’argent mobile (y compris les co-contractants) doit recevoir une formation sur la politique et les procédures de sécurité avant de pouvoir accéder au système de l'argent mobile.\n\nLe programme de formation à la sécurité doit être régulièrement actualisé pour refléter les changements de procédure. Les membres du personnel doivent recevoir des formations de rappel régulières en matière de sécurité et être sensibilisés aux nouvelles menaces pouvant affecter leur fonction.    \n\nLa formation doit garantir que le personnel est correctement informé de ses responsabilités en matière de sécurité, notamment en ce qui concerne :\n - la sécurité des données liées aux clients ;\n- la protection des identifiants et mots de passe des utilisateurs.","ISO 27002:2013 Sec. 7.2","5.1.2.1.1","est-ce que l’ensemble du personnel travaillant sur le service d’argent mobile (y compris les sous-traitants) reçoit une formation sur les politiques et procédures de sécurité qui s’appliquent à leurs fonctions avant d'avoir accès au système de l’argent mobile ?","1) Plan de formation de sécurité\n- Vérifier que ce plan inclut un processus visant à dispenser à l’ensemble du personnel et des cocontractants des formations s’appliquant spécifiquement à leurs fonctions avant d’avoir accès au système.\n",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.1","5.1.2","5.1.2: Los proveedores deben brindar capacitación al personal interno sobre sus responsabilidades de seguridad","5.1.2.1","CAPACITACIÓN EN MATERIA DE SEGURIDAD PARA LOS EMPLEADOS\nTodo el personal del dinero móvil (incluidos los contratistas) deben recibir capacitación sobre la política y los procedimientos de seguridad antes de obtener acceso al sistema del dinero móvil. \n\nLos programas de capacitación en materia de seguridad deben ser actualizados periódicamente para contemplar los cambios en los procedimientos, y los empleados deben recibir actualizaciones de capacitación periódicas en materia de seguridad. El personal debe recibir información sobre nuevas amenazas importantes.\n\nLa capacitación debe garantizar que el personal sea correctamente informado acerca de sus responsabilidades de seguridad, incluyendo:\n - seguridad de los datos de los clientes. \n - protección de ID de usuario y contraseñas.","ISO 27002:2013 Sec. 7.2","5.1.2.1.1","¿Todo el personal del dinero móvil (incluidos los contratistas) reciben capacitación sobre las políticas y procedimientos de seguridad correspondientes a su función de trabajo antes de obtener acceso al sistema del dinero móvil?","1) Plan de capacitación en materia de seguridad\n- Verificar que el plan incluya un proceso para brindar capacitación específica y relevante para el trabajo a todo el personal y los contratistas antes de otorgarles acceso al sistema.\n",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.1","5.1.2",null,"5.1.2.1",null,"ISO 27002:2013 Sec. 7.2","5.1.2.1.1",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.1.2.1.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.1","5.1.2","","5.1.2.1",null,0,"5.1.2.1.2","5.1.2.1.2: Does senior management arrange a regular audit of the mobile money service (at least every two years) to evaluate whether the MM governance, internal control and risk management processes are operating effectively.\n","1. Header page of last audit, or audit policy/process/plan, or compliance framework\n- Check that an audit of mobile money is performed at least every 2 years by an independent function (e.g. internal audit or compliance team).\n",0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.1","5.1.2","","5.1.2.1",null,null,"5.1.2.1.2","5.1.2.1.2","Does senior management arrange a regular audit of the mobile money service (at least every two years) to evaluate whether the MM governance, internal control and risk management processes are operating effectively.","1. Header page of last audit, or audit policy/process/plan, or compliance framework\n- Check that an audit of mobile money is performed at least every 2 years by an independent function (e.g. internal audit or compliance team).\n",null,"Recommended","Recommended","TechOps",null,null,"5","5.1","5.1.2","","5.1.2.1",0,0,"5.1.2.1.2","le programme de formation sur la sécurité est-il régulièrement mis à jour pour refléter les changements de procédure et les nouvelles menaces en matière de sécurité, et le personnel reçoit-il des formations de rappel régulières ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.1","5.1.2","","5.1.2.1",null,0,"5.1.2.1.2","¿El programa de capacitación en materia de seguridad se actualiza periódicamente para contemplar los cambios en los procedimientos y las nuevas amenazas a la seguridad, y los empleados reciben actualizaciones de capacitación periódicas?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.1","5.1.2",null,"5.1.2.1",null,0,"5.1.2.1.2",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.1.2.1.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.1","5.1.2","","5.1.2.1",null,0,"5.1.2.1.3","5.1.2.1.3: Are issues raised by audits being followed up by senior management to ensure they are addressed promptly?\n","1) Records of last audit, or audit policy/process/plan, or compliance framework\n- Check that issues raised by audits are being followed up by senior management to ensure they are addressed promptly\n(Note: Records of the last audit could be redacted to remove sensitive contents but to show that actions are being followed up. Alternatively, the process documentation could be reviewed)",0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.1","5.1.2","","5.1.2.1",null,null,"5.1.2.1.3","5.1.2.1.3","Are issues raised by audits being followed up by senior management to ensure they are addressed promptly?","1) Records of last audit, or audit policy/process/plan, or compliance framework\n- Check that issues raised by audits are being followed up by senior management to ensure they are addressed promptly\n(Note: Records of the last audit could be redacted to remove sensitive contents but to show that actions are being followed up. Alternatively, the process documentation could be reviewed)",null,"Recommended","Recommended","TechOps",null,null,"5","5.1","5.1.2","","5.1.2.1",0,0,"5.1.2.1.3","la formation sur la sécurité couvre-t-elle la protection des informations et des actifs matériels, les menaces en matière de sécurité actuelles et l’importance de la sécurité des données liées aux clients ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.1","5.1.2","","5.1.2.1",null,0,"5.1.2.1.3","¿La capacitación en materia de seguridad incluye la protección de activos físicos y de información, las amenazas a la seguridad actuales, y la promoción de la importancia de la seguridad de los datos de los clientes?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.1","5.1.2",null,"5.1.2.1",null,0,"5.1.2.1.3",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.1.2.1.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.1","5.1.2","","5.1.2.2","5.1.2.2: SECURITY RESPONSIBILITIES AFTER TERMINATION OF EMPLOYMENT\nProviders should define security responsibilities that will remain valid after termination or change of employment. These should be  communicated to staff (including contractors) and included in their terms and conditions of employment.","ISO 27002:2013 Sec. 7.3","5.1.2.2.1","5.1.2.2.1: Are security responsibilities that apply after termination of employment communicated to staff and enforced?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.1","5.1.2","","5.1.2.2","SECURITY RESPONSIBILITIES AFTER TERMINATION OF EMPLOYMENT\nProviders should define security responsibilities that will remain valid after termination or change of employment. These should be  communicated to staff (including contractors) and included in their terms and conditions of employment.","ISO 27002:2013 Sec. 7.3","5.1.2.2.1","5.1.2.2.1","Are security responsibilities that apply after termination of employment communicated to staff and enforced?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.1","5.1.2","","5.1.2.2","RESPONSABILITÉS EN MATIÈRE DE SÉCURITÉ APRÈS LA FIN DU CONTRAT DE TRAVAIL\nLes prestataires doivent définir les responsabilités de sécurité qui continuent de s’appliquer après un changement de poste ou la fin du contrat de travail. Ces responsabilités doivent être communiquées au personnel (y compris les sous-traitants) et figurer dans le contrat de travail ou de sous-traitance.\n","ISO 27002:2013 Sec. 7.3","5.1.2.2.1","les responsabilités de sécurité qui s’appliquent après la fin du contrat de travail ou de sous-traitance sont-elles communiquées au personnel et aux sous-traitants et respectées ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.1","5.1.2","","5.1.2.2","RESPONSABILIDADES DE SEGURIDAD DESPUÉS DE LA TERMINACIÓN DEL EMPLEO\nLos proveedores deben definir responsabilidades de seguridad que seguirán siendo válidas después de la terminación o cambio del empleo. Las mismas deben ser comunicadas al personal (incluidos los contratistas) e incluidas en los términos y condiciones del empleo.","ISO 27002:2013 Sec. 7.3","5.1.2.2.1","¿Las responsabilidades de seguridad aplicables después de la terminación del empleo son comunicadas y exigidas al personal?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.1","5.1.2",null,"5.1.2.2",null,"ISO 27002:2013 Sec. 7.3","5.1.2.2.1",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.1.2.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.1","5.1.3","5.1.3: Providers shall ensure policies are in place for the secure handling of information and assets","5.1.3.1","5.1.3.1: INVENTORY AND SECURITY CLASSIFICATION OF ALL DATA ASSETS\nProviders should identify all data assets associated with the mobile money system. An inventory of these assets should be maintained and an owner identified for each asset. The owner should be responsible for the customer data that is held by it. \n\nThe data sensitivity should be classified and documented for all mobile money data systems (databases, SANs etc.) and removable media, including laptops, smartphones, tablets, storage media, and paper receipts /reports /forms. Removable assets in particular risk exposure of the data they contain.\nSecurity requirements for each system and removable data asset should be determined according to data sensitivity.\n","ISO 27002:2013 Sec. 8.1, Sec 8.3","5.1.3.1.1","5.1.3.1.1: Is each mobile money data asset identified with an owner who is responsible the customer data that is held by it?\n","1) Asset management process\n- Check the policy to ensure there is a process for all assets to be added to the asset register.\n- Check the asset register includes an owner for each and every asset, and any personal data held on it.",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.1","5.1.3","5.1.3: Providers shall ensure policies are in place for the secure handling of information and assets","5.1.3.1","INVENTORY AND SECURITY CLASSIFICATION OF ALL DATA ASSETS\nProviders should identify all data assets associated with the mobile money system. An inventory of these assets should be maintained and an owner identified for each asset. The owner should be responsible for the customer data that is held by it. \n\nThe data sensitivity should be classified and documented for all mobile money data systems (databases, SANs etc.) and removable media, including laptops, smartphones, tablets, storage media, and paper receipts /reports /forms. Removable assets in particular risk exposure of the data they contain.\nSecurity requirements for each system and removable data asset should be determined according to data sensitivity.\n","ISO 27002:2013 Sec. 8.1, Sec 8.3","5.1.3.1.1","5.1.3.1.1","Is each mobile money data asset identified with an owner who is responsible the customer data that is held by it?","1) Asset management process\n- Check the policy to ensure there is a process for all assets to be added to the asset register.\n- Check the asset register includes an owner for each and every asset, and any personal data held on it.",null,"Standard Required","Required","TechOps",null,null,"5","5.1","5.1.3","5.1.3: Les prestataires doivent veiller à ce que des politiques soient en place pour assurer un traitement sécurisé des informations et des actifs.","5.1.3.1","INVENTAIRE ET CLASSIFICATION DE SÉCURITÉ DE TOUS LES ACTIFS CONTENANT DES DONNÉES\nLes prestataires doivent identifier tous les actifs contenant des données utilisés en lien avec le système d'argent mobile. Un inventaire de ces actifs doit être tenu à jour et un propriétaire doit être identifié pour chaque actif. Le propriétaire doit être responsable des données client contenues dans chaque actif. \n\nLa sensibilité des données doit être répertoriée et documentée pour tous les systèmes de données (bases de données, réseaux de stockage SAN, etc.) et pour tous les supports amovibles tels que les ordinateurs portables, smartphones, tablettes, supports de stockage et reçus/rapports/formulaires sous forme papier. Les actifs amovibles sont particulièrement exposés au risque de divulgation des données qu’ils contiennent.\nLes exigences de sécurité pour chaque système et support amovible doivent être déterminées en fonction de la sensibilité des données.\n","ISO 27002:2013 Sec. 8.1, Sec 8.3","5.1.3.1.1","Les actifs contenant des données d'argent mobile sont-ils tous associés à un propriétaire responsable des données client qu’ils contiennent ?","1) Processus de gestion des actifs\n- Vérifier la politique afin de s’assurer qu’un processus a été mis en place pour dresser un inventaire de tous les actifs.\n- Vérifier que l’inventaire les actifs identifie le responsable de chaque élément d’actif, et toute donnée personnelle qui s’y trouve.",null,"Requis Normal","Requis","TechOps",null,null,"5","5.1","5.1.3","5.1.3: Los proveedores deben garantizar que se implementen políticas para el manejo seguro de la información y los activos","5.1.3.1","INVENTARIO Y CLASIFICACIÓN DE SEGURIDAD DE TODOS LOS ACTIVOS DE DATOS\nLos proveedores deben identificar todos los activos de datos asociados al sistema del dinero móvil. Se debe mantener un inventario de estos activos y se debe identificar un titular para cada activo. El titular debe ser responsable de los datos de los clientes allí contenidos. \n\nSe debe clasificar y documentar la sensibilidad de los datos para todos los sistemas de datos (bases de datos, SANs, etc.) y los medios extraíbles, incluyendo laptops, smartphones, tabletas, medios de almacenamiento, y recibos/informes/formularios en papel. Los activos extraíbles están particularmente expuestos a los riesgos de los datos que contienen.\nSe deben determinar los requisitos de seguridad para cada sistema y activo de datos extraíbles de acuerdo con la sensibilidad de los datos.\n","ISO 27002:2013 Sec. 8.1, Sec 8.3","5.1.3.1.1","¿Cada activo de datos del dinero móvil está identificado con un titular responsable de los datos de los clientes allí contenidos?","1) Proceso de gestión de activos\n- Verificar la política para garantizar que exista un proceso para que todos los activos estén incluidos en el registro de activos.\n- Verificar que el registro incluya un titular para cada uno de los activos y todos los datos personales allí contenidos.",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.1","5.1.3",null,"5.1.3.1",null,"ISO 27002:2013 Sec. 8.1, Sec 8.3","5.1.3.1.1",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,"MERGE","5.1.3.1.1","5.1.3.1.2",null,null,{"$error":"#REF!"},{"$error":"#REF!"},"","",{"$error":"#REF!"},{"$error":"#REF!"},"","",2,"",{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,2,""]
[null,"5","5.1","5.1.3",null,"5.1.3.1",null,0,"5.1.3.1.2","5.1.3.1.2: Has data sensitivity classification been documented for:\n - Mobile money data systems;\n - Removable media, including laptops, smartphones, tablets, storage media, and paper media (e.g. registration forms and agent log books)?\n","1) Asset management process\n- Check that there is a documented process and standards for classifying all data held in mobile money systems and removable media.",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.1","5.1.3",null,"5.1.3.1",null,null,"5.1.3.1.2","5.1.3.2.1","Has data sensitivity classification been documented for:\n - Mobile money data systems;\n - Removable media, including laptops, smartphones, tablets, storage media, and paper media (e.g. registration forms and agent log books)?","1) Asset management process\n- Check that there is a documented process and standards for classifying all data held in mobile money systems and removable media.",null,"Standard Required","Required","TechOps",null,null,"5","5.1","5.1.3",null,"5.1.3.1",null,0,"5.1.3.1.2","existe-t-il une classification documentée de la sensibilité des données pour :\n- les systèmes de données de l'argent mobile ;\n- les supports amovibles tels que les ordinateurs portables, smartphones, tablettes, supports de stockage et supports papier (par ex. formulaires d'enregistrement et registres des agents)","1) Processus de gestion des actifs\n- Vérifier qu'un processus et des normes documentés ont été mis en place aux fins de la classification de l'ensemble des données détenues dans les systèmes de l'argent mobile et sur les supports amovibles.",null,"Requis Normal","Requis","TechOps",null,null,"5","5.1","5.1.3",null,"5.1.3.1",null,0,"5.1.3.1.2","¿Se documentó la clasificación de sensibilidad de los datos para:\n - Los sistemas de datos del dinero móvil;\n - Medios extraíbles, incluyendo laptops, smartphones, tabletas, medios de almacenamiento, y medios en papel (por ej., formularios de registro y libros de registro de agentes)?","1) Proceso de gestión de activos\n- Verificar que exista un proceso y normas documentados para clasificar todos los datos de los sistemas del dinero móvil y medios extraíbles.",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.1","5.1.3",null,"5.1.3.1",null,0,"5.1.3.1.2",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,"MERGE","5.1.3.2.1","5.1.3.2.2","5.1.3.2.3",null,{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},"",{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},"",2,"",{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP5","OriginalComplianceP5","OriginalComplianceP",0,0,0,0,0,3,""]
[null,"5","5.1","5.1.3",0,"5.1.3.1",null,0,"5.1.3.1.3","5.1.3.1.3: Are inventory logs of data systems and removable media maintained and updated at least annually?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.1","5.1.3",null,"5.1.3.1",null,null,"5.1.3.1.3","5.1.3.2.4","Are inventory logs of data systems and removable media maintained and updated at least annually?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.1","5.1.3",null,"5.1.3.1",null,0,"5.1.3.1.3","existe-t-il des journaux d’inventaire des supports amovibles remis à jour au moins une fois par an ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.1","5.1.3",null,"5.1.3.1",null,0,"5.1.3.1.3","¿Se mantienen y actualizan, al menos, una vez al año los registros de sistemas de datos y medios extraíbles?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.1","5.1.3",null,"5.1.3.1",null,0,"5.1.3.1.3",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.1.3.2.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.1","5.1.3","","5.1.3.2","5.1.3.2: SECURE DISPOSAL OF DATA SYSTEMS AND MEDIA\nFormal procedures should be implemented for the secure disposal of data storage systems and media that are no longer needed. This is important to minimize the risk of confidential information leakage. The procedures for secure disposal of data systems and media should be proportionate to the sensitivity of the information stored. The procedured should also apply to paper and other non-electronic media.\n\nProviders should:\n- take steps to verify that customer data has been removed or securely overwritten prior to disposal or re-use of data storage systems or media;\n- render customer and financial data on electronic media unrecoverable so that the data cannot be reconstructed;\n- shred, incinerate, or pulp paper materials (e.g. agent log books) so that customer and financial data cannot be reconstructed; \n\nThis practice should extend to assets accessible by third parties (see 5.1.4).","PCI DSS, ISO 27002:2013 Sec. 8.3 ","5.1.3.2.1","5.1.3.2.1: Are there procedures for the secure reuse or disposal of all data storage systems to minimize the risk of confidential information leakage (e.g. by making electronic data unrecoverable?\nAre old paper records (e.g. agent log books) securely destroyed by shredding/incineration?\n","1) Asset management process\n- Check there are documented procedures for the secure reuse or disposal of all data storage systems to minimize the risk of confidential information leakage (e.g. by making electronic data unrecoverable)\n- Check that old paper records (e.g. agent log books) are securely destroyed by shredding/incineration.\n",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.1","5.1.3","","5.1.3.2","SECURE DISPOSAL OF DATA SYSTEMS AND MEDIA\nFormal procedures should be implemented for the secure disposal of data storage systems and media that are no longer needed. This is important to minimize the risk of confidential information leakage. The procedures for secure disposal of data systems and media should be proportionate to the sensitivity of the information stored. The procedured should also apply to paper and other non-electronic media.\n\nProviders should:\n- take steps to verify that customer data has been removed or securely overwritten prior to disposal or re-use of data storage systems or media;\n- render customer and financial data on electronic media unrecoverable so that the data cannot be reconstructed;\n- shred, incinerate, or pulp paper materials (e.g. agent log books) so that customer and financial data cannot be reconstructed; \n\nThis practice should extend to assets accessible by third parties (see 5.1.4).","PCI DSS, ISO 27002:2013 Sec. 8.3 ","5.1.3.2.1","5.1.3.3.1","Are there procedures for the secure reuse or disposal of all data storage systems to minimize the risk of confidential information leakage (e.g. by making electronic data unrecoverable?\nAre old paper records (e.g. agent log books) securely destroyed by shredding/incineration?","1) Asset management process\n- Check there are documented procedures for the secure reuse or disposal of all data storage systems to minimize the risk of confidential information leakage (e.g. by making electronic data unrecoverable)\n- Check that old paper records (e.g. agent log books) are securely destroyed by shredding/incineration.\n",null,"Standard Required","Required","TechOps",null,null,"5","5.1","5.1.3","","5.1.3.2","ÉLIMINATION SÉCURISÉE DES SYSTÈMES DE DONNÉES ET DES SUPPORTS\nDes procédures formelles doivent être mises en place pour l'élimination sécurisée des systèmes de stockage de données et des supports qui ne sont plus nécessaires à l’activité. Ces procédures sont essentielles pour minimiser les risques de fuite d’informations confidentielles. Ces procédures d'élimination sécurisée des systèmes de données et des supports doivent être adaptées au niveau de sensibilité des informations conservées. Elles doivent également s'appliquer aux supports sous forme papier ou non-électronique.\n\nLes prestataires doivent :\n- prendre les mesures nécessaires pour s’assurer que les données relatives aux clients ont été supprimées ou écrasées de façon sécurisée avant d’éliminer ou de réutiliser des systèmes ou des supports de stockage.\n- rendre les données financières ou concernant des clients irrécupérables sur les supports électroniques de façon à ce que ces données ne puissent pas être reconstituées ;\n- déchiqueter, brûler ou réduire en pâte les documents en papier (par ex. les registres des agents) de façon à ce que les données financières ou concernant des clients ne puissent pas être reconstituées ; \n\nCette pratique doit s’étendre aux actifs accessibles par des tiers (cf. 5.1.4).","PCI DSS, ISO 27002:2013 Sec. 8.3 ","5.1.3.2.1","Existe-t-il des procédures d'élimination ou de réutilisation sécurisée de tous les systèmes de stockage de données pour minimiser les risques de fuite d’informations confidentielles (par ex. en rendant les données électroniques irrécupérables) ?\nLes documents en papier qui ne sont plus utilisés (par ex. les registres des agents) sont-ils détruits de manière sécurisée (déchiquetés/brûlés) ?","1) Processus de gestion des actifs\n- Vérifier que des procédures documentées ont été mises en place pour l’élimination ou la réutilisation  sécurisée de l’ensemble des systèmes de stockage de données afin de minimiser les risques de fuite d’informations confidentielles (par ex. en rendant les données électroniques irrécupérables)\n- Vérifier que les documents en papier qui ne sont plus utilisés (par ex. les registres des agents) sont détruits de manière sécurisée (déchiquetés/brûlés).\n",null,"Requis Normal","Requis","TechOps",null,null,"5","5.1","5.1.3","","5.1.3.2","ELIMINACIÓN SEGURA DE SISTEMAS Y MEDIOS DE DATOS\nSe deben implementar procedimientos formales para la eliminación segura de sistemas y medios de almacenamiento de datos que ya no son necesarios. Esto es importante para minimizar el riesgo de filtración de la información confidencial. Los procedimientos para la eliminación segura de los sistemas y medios de datos deben ser proporcionales a la sensibilidad de la información almacenada. Los procedimientos también deben aplicar al papel y a otros medios no electrónicos.\n\nLos proveedores deben:\n- tomar medidas para verificar que los datos del cliente hayan sido eliminados o sobrescritos de forma segura antes de la eliminación o reutilización de los sistemas o medios de almacenamiento de datos;\n- tornar irrecuperables los datos de clientes y financieros en los medios electrónicos para que no puedan ser reconstruidos;\n- destruir, incinerar o desintegrar material impreso (por ej., libros de registro de agentes) para que no se puedan reconstruir los datos de los clientes y financieros; \n\nEsta práctica debe extenderse a los activos accedidos por terceros (ver 5.1.4). \n","PCI DSS, ISO 27002:2013 Sec. 8.3 ","5.1.3.2.1","¿Existen procedimientos para la reutilización o eliminación segura de todos los sistemas de almacenamiento de datos a fin de minimizar el riesgo de filtración de información confidencial (por ej., haciendo que los datos electrónicos sean irrecuperables)?  \n¿Se destruyen en forma segura los viejos registros en papel (por ej., libros de registro de agentes) triturándolos/incinerándolos?","1) Proceso de gestión de activos\n\n- Verificar que existan procedimientos documentados para la reutilización o eliminación segura de todos los sistemas de almacenamiento de datos a fin de minimizar el riesgo de filtración de información confidencial (por ej., haciendo que los datos electrónicos sean irrecuperables).\n- Verificar que se destruyan en forma segura los viejos registros en papel (por ej., libros de registro de agentes) triturándolos/incinerándolos.",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.1","5.1.3",null,"5.1.3.2",null,"PCI DSS, ISO 27002:2013 Sec. 8.3 ","5.1.3.2.1",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,"MERGE","5.1.3.3.1","5.1.3.3.2",null,null,{"$error":"#REF!"},{"$error":"#REF!"},"","",{"$error":"#REF!"},{"$error":"#REF!"},"","",2,"",{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,2,""]
[null,"5","5.1","5.1.4","5.1.4: Providers shall ensure the protection of their assets that are accessible by suppliers and third parties","5.1.4.1","5.1.4.1: SECURITY POLICY AND THIRD PARTIES\nThe information security policy should apply to suppliers and third parties and should include:\n- security controls for managing their access; \n- security training as and when needed;\n- processes that these parties have to follow.\nThis should be enforced in third party contracts.","ISO 27002:2013 Sec. 15.2 ","5.1.4.1.1","5.1.4.1.1: Does the information security policy contractually apply to suppliers and third parties?\n","1) Contracts with key third parties (e.g. mobile money system supplier)\n- Check the contracts specify adherence to the provider's security policy and processes.\n",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.1","5.1.4","5.1.4: Providers shall ensure the protection of their assets that are accessible by suppliers and third parties","5.1.4.1","SECURITY POLICY AND THIRD PARTIES\nThe information security policy should apply to suppliers and third parties and should include:\n- security controls for managing their access; \n- security training as and when needed;\n- processes that these parties have to follow.\nThis should be enforced in third party contracts.","ISO 27002:2013 Sec. 15.2 ","5.1.4.1.1","5.1.4.1.1","Does the information security policy contractually apply to suppliers and third parties?","1) Contracts with key third parties (e.g. mobile money system supplier)\n- Check the contracts specify adherence to the provider's security policy and processes.\n",null,"Urgent Required","Required","TechOps",null,null,"5","5.1","5.1.4","5.1.4: Les prestataires doivent assurer la protection des actifs accessibles aux fournisseurs ou à des tiers.","5.1.4.1","POLITIQUE DE SÉCURITÉ ET TIERCES PARTIES\nLa politique de sécurité de l'information doit s’appliquer aux fournisseurs et aux tiers et prévoir :\n- des contrôles de sécurité pour la gestion de leurs accès ; \n- des formations sur la sécurité organisées en fonction des besoins ;\n- des procédures devant être respectées par ces personnes.\nCes éléments doivent faire l'objet de stipulations particulières dans les contrats conclus avec des tiers.","ISO 27002:2013 Sec. 15.2 ","5.1.4.1.1","La politique de sécurité de l’information s’applique-t-elle de façon contractuelles aux fournisseurs et aux tiers ?","1) Contrats avec les tiers clés (par exemple fournisseur du système d’argent mobile)\n- Vérifier que les contrats stipulent qu’il est obligatoire de se conformer à la politique et aux processus de sécurité du fournisseur.\n",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.1","5.1.4","5.1.4: Los proveedores deben garantizar la protección de sus activos accedidos por proveedores y terceros","5.1.4.1","POLÍTICA DE SEGURIDAD Y TERCEROS\nLa política de seguridad de la información debe ser aplicable a proveedores y terceros y debe incluir:\n- controles de seguridad para gestionar su acceso; \n- capacitación en seguridad tal como y cuando sea necesario;\n- procesos que deben seguir estas partes.\nEsto se debe exigir en los contratos de terceros.","ISO 27002:2013 Sec. 15.2 ","5.1.4.1.1","¿La política de seguridad de la información es aplicable contractualmente a los proveedores y terceros?","1) Contratos con terceros clave (por ej., proveedores del sistema del dinero móvil)\n- Verificar que los contratos especifiquen adhesión a las políticas y procesos de seguridad del proveedor.\n",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.1","5.1.4",null,"5.1.4.1",null,"ISO 27002:2013 Sec. 15.2 ","5.1.4.1.1",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.1.4.1.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.1","5.1.4",0,"5.1.4.2","5.1.4.2: SECURITY BRIEFING AND REVIEWS FOR THIRD PARTIES\nThird parties and suppliers should be briefed on the security policy and their security obligations before being granted access to the mobile money system, including:\n - protection of physical and information assets;\n - current security threats; and\n - promotion of the importance of customer data security.\n\nPeriodic reviews should be performed to ensure that the mobile money security policy is being adhered to.","ISO 27002:2013 Sec. 15.1 ","5.1.4.2.1","5.1.4.2.1: Have suppliers and third parties been briefed on the security policy and their security obligations, and are periodic reviews performed to verify adherence to the security policy?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.1","5.1.4",null,"5.1.4.2","SECURITY BRIEFING AND REVIEWS FOR THIRD PARTIES\nThird parties and suppliers should be briefed on the security policy and their security obligations before being granted access to the mobile money system, including:\n - protection of physical and information assets;\n - current security threats; and\n - promotion of the importance of customer data security.\n\nPeriodic reviews should be performed to ensure that the mobile money security policy is being adhered to.","ISO 27002:2013 Sec. 15.1 ","5.1.4.2.1","5.1.4.2.1","Have suppliers and third parties been briefed on the security policy and their security obligations, and are periodic reviews performed to verify adherence to the security policy?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.1","5.1.4",0,"5.1.4.2","CONSIGNES ET EXAMENS DE SECURITÉ POUR LES TIERS\nLes fournisseurs et autres tiers doivent être informés de la politique de sécurité et de leurs obligations en la matière avant de pouvoir accéder au système du service d’argent mobile, notamment en ce qui concerne :\n - la protection des informations et des actifs matériels ;  \n - les menaces existantes en matière de sécurité ; \n - l’importance de la sécurité des données liées aux clients. \n\nDes examens périodiques doivent être effectués pour s’assurer du respect de la politique de sécurité du service d’argent mobile. \n","ISO 27002:2013 Sec. 15.1 ","5.1.4.2.1","les fournisseurs et autres tiers sont-ils informés de la politique de sécurité et de leurs obligations en la matière, et des examens périodiques sont-ils effectués pour s’assurer du respect de la politique de sécurité ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.1","5.1.4",null,"5.1.4.2","INFORME Y REVISIONES DE SEGURIDAD PARA TERCEROS\nSe debe informar a terceros y proveedores acerca de la política de seguridad y de sus obligaciones de seguridad antes de otorgarles acceso al sistema del dinero móvil, incluyendo:\n - protección de activos físicos y de información;\n - amenazas a la seguridad actuales; y\n - promoción de la importancia de la seguridad de los datos de los clientes.\n\nSe deben realizar revisiones periódicas para garantizar que se cumpla la política de seguridad del dinero móvil.","ISO 27002:2013 Sec. 15.1 ","5.1.4.2.1","¿Se informó a los proveedores y terceros acerca de la política de seguridad y de sus obligaciones de seguridad, y se realizan revisiones periódicas para verificar el cumplimiento de la política de seguridad?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.1","5.1.4",null,"5.1.4.2",null,"ISO 27002:2013 Sec. 15.1 ","5.1.4.2.1",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.1.4.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5",0,0,{"$f":"UPPER(CONCATENATE(Introduction!C26,\": \",Introduction!D26))","v":"5.2: DESIGNING AND DEVELOPING SECURE SYSTEMS, APPLICATIONS AND NETWORK"},null,null,null,null,{"$f":"Introduction!E26","v":"Providers shall ensure that the systems, applications and network that support mobile money are designed and developed securely"},null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,BK20,CA20,CQ20,DG20)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5",null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$26,\": \",Introduction!$L$26))","v":"5.2: DESIGNING AND DEVELOPING SECURE SYSTEMS, APPLICATIONS AND NETWORK"},null,null,null,null,null,{"$f":"Introduction!$M$26","v":"Providers shall ensure that the systems, applications and network that support mobile money are designed and developed securely"},null,null,null,null,0,null,null,"5",0,0,null,0,null,0,0,"",null,null,null,null,0,null,null,"5",0,0,{"$f":"UPPER(CONCATENATE(Introduction!$U$26,\": \",Introduction!$V$26))","v":"5.2: DISEÑO Y DESARROLLO DE SISTEMAS, APLICACIONES Y REDES SEGURAS"},null,null,0,0,{"$f":"Introduction!W26","v":"El proveedor garantizará que los sistemas, aplicaciones y redes que sustentan los servicios del dinero móvil han sido diseñados y desarrollados en forma segura"},null,null,null,null,0,null,null,"5",0,0,null,0,null,0,0,null,null,null,null,null,0]
[null,"5","5.2","5.2.1",{"$f":"CHOOSE(LanguageNumber,AY21,BP21,CF21,CV21)","v":"5.2.1: Providers shall ensure that data is protected by cryptography and network security controls"},"5.2.1.1",{"$f":"AZ21&\": \"&CHOOSE(LanguageNumber,BA21,BR21,CH21,CX21)","v":"5.2.1.1: ENCRYPTION POLICY\nProviders should develop a policy on the use of cryptographic controls for protection of customer data, transactions and security credentials. \n\nThe policy should define when encryption is required, and which data should be encrypted. For example, encryption may be required for:\n- sensitive data within the mobile money system;\n- data transmitted externally; and\n- security credentials or customer account data.\n\nThe approach to key management should also be defined in the policy (see 5.2.1.4).\n\nCryptographic algorithms and key lengths should be selected according to best practice and local laws."},{"$f":"BB21","v":"ISO 27002:2013 Sec. 10"},{"$f":"BC21","v":"5.2.1.1.1"},{"$f":"BC21&\": \"&CHOOSE(LanguageNumber,BE21,BU21,CK21,DA21)&CarriageReturn","v":"5.2.1.1.1: Is there a data encryption policy that defines when cryptographic controls are required to protect mobile money data, such as when data is transmitted externally or security credentials are held in the system?\n"},{"$f":"CHOOSE(LanguageNumber,BF21,BV21,CL21,DB21)","v":"1) Security policy or equivalent compliance framework or audit documentation\n- Check that the policy is documented and approved by current senior management\n- Check it outlines when cryptographic controls required to protect mobile money data\n(note: this should include when data is transmitted externally or security credentials are held on the system etc.)"},0,{"$f":"CHOOSE(LanguageNumber,BH21,BX21,CN21,DD21)","v":"Recommended"},{"$f":"CHOOSE(LanguageNumber,BI21,BY21,CO21,DE21)","v":"Recommended"},"TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.1","5.2.1: Providers shall ensure that data is protected by cryptography and network security controls","5.2.1.1","ENCRYPTION POLICY\nProviders should develop a policy on the use of cryptographic controls for protection of customer data, transactions and security credentials. \n\nThe policy should define when encryption is required, and which data should be encrypted. For example, encryption may be required for:\n- sensitive data within the mobile money system;\n- data transmitted externally; and\n- security credentials or customer account data.\n\nThe approach to key management should also be defined in the policy (see 5.2.1.4).\n\nCryptographic algorithms and key lengths should be selected according to best practice and local laws.","ISO 27002:2013 Sec. 10","5.2.1.1.1","5.2.1.1.1","Is there a data encryption policy that defines when cryptographic controls are required to protect mobile money data, such as when data is transmitted externally or security credentials are held in the system?","1) Security policy or equivalent compliance framework or audit documentation\n- Check that the policy is documented and approved by current senior management\n- Check it outlines when cryptographic controls required to protect mobile money data\n(note: this should include when data is transmitted externally or security credentials are held on the system etc.)",null,"Recommended","Recommended","TechOps",null,null,"5","5.2","5.2.1","5.2.1: Les prestataires doivent veiller à ce que les données soient protégées au moyen de la cryptographie et de systèmes de contrôle de la sécurité des réseaux.","5.2.1.1","POLITIQUE DE CHIFFREMENT\nLes prestataires doivent définir une politique d’utilisation de mesures de chiffrement pour la protection des données relatives aux clients, des transactions et des identifiants de sécurité. \n\nCette politique doit définir les circonstances dans lesquelles le chiffrement est requis et les données devant en faire l’objet. Le chiffrement peut par exemple être requis pour : \n- les données sensibles dans le système de l'argent mobile ; \n- les données transmises à l’extérieur ; et\n- les identifiants de sécurité ou les données concernant les comptes des clients. \n\nElle doit également préciser l’approche de gestion des clés (cf. 5.2.1.4).\n\nLes algorithmes de chiffrement et la longueur des clés doivent être choisis conformément aux meilleures pratiques et aux lois locales.","ISO 27002:2013 Sec. 10","5.2.1.1.1","existe-t-il une politique de cryptage des données définissant les critères d’utilisation de contrôles cryptographiques pour la protection des données de l’argent mobile, par exemple lorsque des données sont transmises à l’extérieur ou des identifiants de sécurité sont conservés dans le système ?","1) Politique de sécurité ou directives de conformité équivalentes ou documentation d’audit équivalente\n\r- Vérifier que la politique est documentée et approuvée par la direction générale actuelle\r\n- Vérifier qu’elle définit les critères d’utilisation des contrôles cryptographiques pour la protection des données de l’argent mobile\r(remarque : ces cas doivent inclure les situations où des données sont transmises à l’extérieur ou des identifiants de sécurité sont conservés dans le système, etc.)",null,{"$f":"VLOOKUP($BH21,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},{"$f":"VLOOKUP($BI21,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},"TechOps",null,null,"5","5.2","5.2.1","5.2.1: Los proveedores deben garantizar que los datos estén protegidos por criptografía y controles de seguridad de la red","5.2.1.1","POLÍTICA DE ENCRIPTACIÓN\nLos proveedores deben desarrollar una política sobre el uso de controles criptográficos para proteger los datos de los clientes, las transacciones y las credenciales de seguridad. \n\nLa política debe definir cuándo se requiere encriptación y qué datos se deben encriptar. Por ejemplo, se puede requerir encriptación para:\n- datos sensibles dentro del sistema del dinero móvil;\n- datos transmitidos externamente; y\n- credenciales de seguridad o datos de cuentas de los clientes.\n\nLa política también debe definir el enfoque de gestión de claves (ver 5.2.1.4).\n\nLos algoritmos criptográficos y la longitud de las claves se deben seleccionar de acuerdo con las mejores prácticas y las leyes locales.","ISO 27002:2013 Sec. 10","5.2.1.1.1","¿Existe una política de encriptación de datos que defina cuándo se requieren controles criptográficos para proteger los datos del dinero móvil, tal como cuando se transmiten los datos externamente o cuando el sistema cuenta con credenciales de seguridad?","1) Política de seguridad, marco de cumplimiento equivalente o documentación de auditoría\n- Verificar que la política esté documentada y aprobada por la alta gerencia actual\n- Verificar que detalle cuándo se requieren controles criptográficos para proteger los datos del dinero móvil\n(nota:  debe incluir la transmisión externa de datos o cuando el sistema cuenta con credenciales de seguridad, etc.)",null,{"$f":"VLOOKUP($BH21,CategoryTranslationTable,3,FALSE)","v":"Recomendado"},{"$f":"VLOOKUP($BI21,CategoryTranslationTable,3,FALSE)","v":"Recomendado"},"TechOps",null,null,"5","5.2","5.2.1",null,"5.2.1.1",null,"ISO 27002:2013 Sec. 10","5.2.1.1.1",null,null,null,{"$f":"VLOOKUP($BH21,CategoryTranslationTable,4,FALSE)","v":"Rec4"},{"$f":"VLOOKUP($BI21,CategoryTranslationTable,4,FALSE)","v":"Rec4"},"TechOps",null,null,null,null,null,null,null,null,"5.2.1.1.1",null,null,null,{"$f":"IF(OR($EA21=0,$EA21=2),VLOOKUP(DO21,INDIRECT(ED21),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP21),\"\",VLOOKUP(DP21,INDIRECT(EE21),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ21),\"\",VLOOKUP(DQ21,INDIRECT(EF21),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR21),\"\",VLOOKUP(DR21,INDIRECT(EG21),7,FALSE))","v":""},{"$f":"IF(OR($EA21=0,$EA21=2),VLOOKUP(DO21,INDIRECT(ED21),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP21),\"\",VLOOKUP(DP21,INDIRECT(EE21),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ21),\"\",VLOOKUP(DQ21,INDIRECT(EF21),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR21),\"\",VLOOKUP(DR21,INDIRECT(EG21),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN21,3)=\"NEW\")+2*AND(LEFT(DN21,3)=\"MER\")+3*AND(LEFT(DN21,3)=\"MOV\")+4*AND(LEFT(DN21,3)=\"SWA\")","v":0},{"$error":"#REF!"},{"$f":"IF(EA21=0,IF(DW21=0,\"\",DW21),CHOOSE(EA21,\"New indicator\",CONCATENATE(DW21,CarriageReturn,DX21,CarriageReturn,DY21,CarriageReturn,DZ21)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO21,1)","v":"OriginalComplianceP5"},{"$f":"\"OriginalComplianceP\"&LEFT(DP21,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ21,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR21,1)","v":"OriginalComplianceP"},{"$f":"COUNTIF($DS21:$DV21,EH$3)","v":0},0,0,0,0,1,""]
[null,"5","5.2","5.2.1","5.2.1: Providers shall ensure that data is protected by cryptography and network security controls","5.2.1.2","5.2.1.2: ENCRYPTION CONTROLS - SENSITIVE DATA\nAll security credentials (PINs, passwords, etc.) should be stored using at minimum a strong cryptographic hash function with a salted hash. It is recomended that a hash be chosen such that it is computationally impractical to generate any other string that generates the same hash.\n\nAlternatively, providers should consider encrypting PINs and passwords using a Hardware Security Module (HSM) or other method to harden the level of security. Providers may also consider encrypting all stored customer account data for additional security.","PCI DSS, ISO 27002: 2013 Sec. 10, 12.1 ","5.2.1.2.1","5.2.1.2.1: Are all security credentials (PINs, passwords, etc.) stored using either a strong cryptograpic hash with salt or strong encryption?\n","1) System architecture specification \n- Check the documentation outlines the encryption requirements for all security credentials \n- Check PINs and passwords are secured using a cryptographic hash with salt, or encryption with a Hardware Security Module (HSM) or equivalent.\n\n\n\n",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.1","5.2.1: Providers shall ensure that data is protected by cryptography and network security controls","5.2.1.2","ENCRYPTION CONTROLS - SENSITIVE DATA\nAll security credentials (PINs, passwords, etc.) should be stored using at minimum a strong cryptographic hash function with a salted hash. It is recomended that a hash be chosen such that it is computationally impractical to generate any other string that generates the same hash.\n\nAlternatively, providers should consider encrypting PINs and passwords using a Hardware Security Module (HSM) or other method to harden the level of security. Providers may also consider encrypting all stored customer account data for additional security.","PCI DSS, ISO 27002: 2013 Sec. 10, 12.1 ","5.2.1.2.1","5.2.1.2.1","Are all security credentials (PINs, passwords, etc.) stored using either a strong cryptograpic hash with salt or strong encryption?","1) System architecture specification \n- Check the documentation outlines the encryption requirements for all security credentials \n- Check PINs and passwords are secured using a cryptographic hash with salt, or encryption with a Hardware Security Module (HSM) or equivalent.\n\n\n\n",null,"Urgent Required","Required","TechOps",null,null,"5","5.2","5.2.1","5.2.1: Les prestataires doivent veiller à ce que les données soient protégées au moyen de la cryptographie et de systèmes de contrôle de la sécurité des réseaux.","5.2.1.2","MESURES DE PROTECTION PAR CHIFFREMENT - DONNÉES SENSIBLES\nTous les identifiants de sécurité (codes confidentiels, mots de passe, etc.) doivent être stockés au minimum à l'aide d’une fonction de hachage cryptographique forte, renforcée par un salage. Il est recommandé de choisir une fonction de hachage qui empêche les systèmes informatiques de générer un hash identique pour deux chaînes de caractères sources différentes.\n\nLes prestataires doivent, autrement, envisager l'utilisation d’un HSM (Hardware Security Module : module matériel de sécurité) ou d’une autre méthode permettant de renforcer le niveau de sécurité pour le chiffrement des codes confidentiels et des mots de passe. Par mesure de sécurité supplémentaire, les prestataires peuvent également envisager de chiffrer l’ensemble des données conservées relatives aux comptes de clients.","PCI DSS, ISO 27002: 2013 Sec. 10, 12.1 ","5.2.1.2.1","les identifiants de sécurité (codes confidentiels, mots de passe, etc.) sont-ils tous conservés sous forme chiffrée au moyen d’une fonction de hachage cryptographique forte renforcée par un salage ou une méthode de chiffrement forte ?","1) Spécification de l'architecture du système\n- Vérifier que la documentation définit les exigences en matière de chiffrement pour l’ensemble des identifiants de sécurité \n- Vérifier que les codes confidentiels et les mots de passe sont protégés à l'aide d'une fonction de hachage cryptographique renforcée par un salage ou chiffrés à l'aide d'un HSM (Hardware Security Module) ou d'une méthode équivalente.\n\n\n\n",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.2","5.2.1","5.2.1: Los proveedores deben garantizar que los datos estén protegidos por criptografía y controles de seguridad de la red","5.2.1.2","CONTROLES DE ENCRIPTACIÓN - DATOS SENSIBLES\nTodas las credenciales de seguridad (PIN, contraseñas, etc.) deben ser almacenadas usando, por lo menos, una función hash criptográfica robusta con un hash aleatorizado. Se recomienda que el hash elegido dificulte, a nivel informático, la generación de cualquier otra cadena que genere el mismo hash.\n\nComo alternativa, los proveedores pueden considerar la encriptación de PIN y contraseñas utilizando un Módulo de Seguridad de Hardware (HSM) u otro método para fortalecer el nivel de seguridad. Los proveedores también pueden considerar la encriptación de todos los datos de cuentas de los clientes almacenados para fines de seguridad adicional. ","PCI DSS, ISO 27002: 2013 Sec. 10, 12.1 ","5.2.1.2.1","¿Todas las credenciales de seguridad (PIN, contraseñas, etc.) son almacenadas usando criptografía aleatorizada robusta o encriptación robusta?","1) Especifcación de arquitectura del sistema.\n- Verificar que la documentación detalle los requisitos de encriptación para todas las credenciales de seguridad\n- Verificar que para la seguridad de los PIN y contraseñas se utilice criptografía aleatorizada robusta o encriptación con un Módulo de Seguridad de Hardware (HSM), o su equivalente. \n\n\n\n",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.2","5.2.1",null,"5.2.1.2",null,"PCI DSS, ISO 27002: 2013 Sec. 10, 12.1 ","5.2.1.2.1",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.2.1.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.1","","5.2.1.2",null,0,"5.2.1.2.2","5.2.1.2.2: Has all stored customer account data been encrypted for additional security?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.1","","5.2.1.2",null,null,"5.2.1.2.2","5.2.1.2.2","Has all stored customer account data been encrypted for additional security?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.2",0,0,"5.2.1.2.2","les données conservées concernant les comptes de clients sont-elles toutes cryptées à titre de précaution supplémentaire ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.2",null,0,"5.2.1.2.2","¿Todos los datos de cuentas de clientes fueron encriptados para fines de seguridad adicional?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.2","5.2.1",null,"5.2.1.2",null,0,"5.2.1.2.2",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.2.1.2.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.1","","5.2.1.3","5.2.1.3: ENCRYPTION CONTROLS - EXTERNAL CONNECTIONS\nTransactions and customer data (especially security credentials) should be encrypted with strong cryptography (e.g. SSL/TLS, IPSEC, SSH) whenever they are transmitted outside the mobile money system. Data transfer mechanisms must prevent data from interception, copying, modification, misrouting and destruction by ensuring:\n- data integrity (data has not been tampered with);\n- confidentiality (data can not be read by unauthorised party); and\n- authentication (connected parties are identified).\n\nEncryption should be implemented for these external connections, at minimum:\n- all connectivity over the Internet;\n- API connections to third parties; and\n- connectivity to smartphones and PoS devices.\n\nThe following cryptographic controls should be implemented:\n- Electronic signatures should be used by each of the parties involved in the transaction to verify identity of both client and server;\n- When exchanging transactions with external systems, electronic signatures / certificates should be used by each of the parties involved to verify identity of both client and server, and the end-to end certificate handling process should be secure;\n- Data integrity of all messages should be ensured via a suitable mechanism, such as digital signatures or message authentication codes;\n- The implemented security protocols should use only secure versions and secure configurations; and\n- Appropriate encryption strength should be implemented for the encryption methodology in use, following vendor recommendations/ best practices.","ISO 27002:2013 Sec. 10, PCI DSS","5.2.1.3.1","5.2.1.3.1: Is all transaction data and customer data encrypted when transmitted externally (e.g. to financial ecosystem partners / merchants / businesses)?\n","1) System architecture specification / interface specifications\n- Check that every external interface and its encryption is documented.\n- Check that all transactions data encrypted when transmitted externally (e.g. to financial ecosystem partners / merchants / businesses).",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.1","","5.2.1.3","ENCRYPTION CONTROLS - EXTERNAL CONNECTIONS\nTransactions and customer data (especially security credentials) should be encrypted with strong cryptography (e.g. SSL/TLS, IPSEC, SSH) whenever they are transmitted outside the mobile money system. Data transfer mechanisms must prevent data from interception, copying, modification, misrouting and destruction by ensuring:\n- data integrity (data has not been tampered with);\n- confidentiality (data can not be read by unauthorised party); and\n- authentication (connected parties are identified).\n\nEncryption should be implemented for these external connections, at minimum:\n- all connectivity over the Internet;\n- API connections to third parties; and\n- connectivity to smartphones and PoS devices.\n\nThe following cryptographic controls should be implemented:\n- Electronic signatures should be used by each of the parties involved in the transaction to verify identity of both client and server;\n- When exchanging transactions with external systems, electronic signatures / certificates should be used by each of the parties involved to verify identity of both client and server, and the end-to end certificate handling process should be secure;\n- Data integrity of all messages should be ensured via a suitable mechanism, such as digital signatures or message authentication codes;\n- The implemented security protocols should use only secure versions and secure configurations; and\n- Appropriate encryption strength should be implemented for the encryption methodology in use, following vendor recommendations/ best practices.","ISO 27002:2013 Sec. 10, PCI DSS","5.2.1.3.1","5.2.1.3.1","Is all transaction data and customer data encrypted when transmitted externally (e.g. to financial ecosystem partners / merchants / businesses)?","1) System architecture specification / interface specifications\n- Check that every external interface and its encryption is documented.\n- Check that all transactions data encrypted when transmitted externally (e.g. to financial ecosystem partners / merchants / businesses).",null,"Urgent Required","Required","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.3","MESURES DE PROTECTION PAR CRYPTAGE - CONNEXIONS EXTERNES\nLes données relatives aux transactions et aux clients (et notamment les identifiants de sécurité) doivent être cryptées au moyen d’une solide méthode de cryptage (ex. SSL/TLS, IPSEC, SSH) chaque fois qu’elles sont transmises en dehors du système de l’argent mobile. Les mécanismes de transfert de données doivent empêcher l’interception, la copie, la modification, le mauvais acheminement ou la destruction des données en garantissant :\n- l’intégrité des données (les données ne sont pas modifiées) ;\n- leur confidentialité (les données ne peuvent pas être lues par un tiers non autorisé) ;\n- l’authentification (identification des parties connectées).\n\nLe cryptage des connexions externes doit au minimum s’appliquer :\n- à toutes les connexions effectuées via l’Internet ;\n- aux connexions API avec des tiers ;\n- aux connexions vers les téléphones intelligents et les terminaux de point de vente.\n\nLes mesures de protection cryptographique suivantes doivent être appliquées :\n- utilisation de la signature électronique de chacune des parties impliquées dans les transactions pour vérifier l’identité du client et du serveur ;\n- lors de l’échange de transactions avec des systèmes externes, des signatures ou des certificats électroniques doivent être utilisés par chacune des parties pour vérifier l’identité du client comme du serveur, et le processus de traitement du certificat doit être sécurisé de bout en bout ;\n- l’intégrité des données doit être garantie pour tous les messages au moyen d’un mécanisme approprié, comme par exemple des signatures numériques ou des codes d’authentification des messages ;\n- les protocoles de sécurité utilisés doivent reposer uniquement sur des versions et configurations sécurisées ; et\n- un niveau de cryptage suffisant doit être utilisé dans la méthode de cryptage appliquée, sur la base des recommandations du fournisseur et des pratiques de référence.","ISO 27002:2013 Sec. 10, PCI DSS","5.2.1.3.1","Toutes les données de transaction et des clients sont-elles chiffrées pour leur transmission externe (par ex. vers des partenaires de l’écosystème financier/des commerçants/des entreprises) ?","1) Spécification de l'architecture du système/spécifications de l'interface\n\r- Vérifier que chaque interface externe et son chiffrement sont documentés.\r\n- Vérifier que l’ensemble des données de transaction sont chiffrées pour leur transmission externe (par exemple vers des partenaires de l’écosystème financier/des commerçants/des entreprises).",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.3","CONTROLES DE ENCRIPTACIÓN - CONEXIONES EXTERNAS \nLos datos de transacciones y de clientes (especialmente las credenciales de seguridad) deben ser encriptados con criptografía robusta (por ej., SSL/TLS, IPSEC, SSH) siempre que sean transmitidos fuera del sistema del dinero móvil. Los mecanismos de transferencia de datos deben evitar la intercepción, copia, modificación, desvío y destrucción de los datos al garantizar:\n- integridad de los datos (los datos no han sido alterados);\n- confidencialidad (los datos no pueden ser leídos por un tercero no autorizado); y\n- autenticación (se identifican las partes conectadas).\n\nSe debe implementar la encriptación para las siguientes conexiones externas, como mínimo:\n- toda conectividad por Internet;\n- conexiones API con terceros; y \n- conectividad a smartphones y dispositivos PoS.\n\nSe deben implementar los siguientes controles criptográficos:\n- Cada parte involucrada en la transacción debe utilizar firmas electrónicas para verificar la identidad del cliente y del servidor;\n- Al intercambiar transacciones con sistemas externos, cada parte involucrada debe utilizar firmas / certificados electrónicos para verificar la identidad del cliente y del servidor, y el certificado punta a punta que maneja el proceso debe ser seguro;\n- Se debe garantizar la integridad de los datos de todos los mensajes mediante un mecanismo adecuado, tal como firmas digitales o códigos de autenticación de mensajes;\n- Los protocolos de seguridad implementados deben usar solo versiones seguras y configuraciones seguras; y\n- Se debe implementar una robustez de encriptación adecuada para la metodología de encriptación utilizada, siguiendo las recomendaciones / mejores prácticas de los proveedores.","ISO 27002:2013 Sec. 10, PCI DSS","5.2.1.3.1","¿Todos los datos de transacciones y datos de clientes son encriptados cuando se transmiten externamente (por ej., a los socios del ecosistema financiero / comerciantes / negocios)?","1) Especificación de la arquitectura del sistema / especificaciones de interfaces\n- Verificar que cada interfaz externa y su encriptación esté documentada.\n- Verificar que los datos de todas las transacciones estén encriptados cuando se transmiten externamente (por ej., a los socios del ecosistema financiero / comerciantes / negocios).",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.2","5.2.1",null,"5.2.1.3",null,"ISO 27002:2013 Sec. 10, PCI DSS","5.2.1.3.1",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.2.1.3.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.1","","5.2.1.3",null,0,"5.2.1.3.2","5.2.1.3.2: Are transactions encrypted when transmitted to and from smartphones?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.1","","5.2.1.3",null,null,"5.2.1.3.2","5.2.1.3.2","Are transactions encrypted when transmitted to and from smartphones?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.3",0,0,"5.2.1.3.2","les transactions sont-elles cryptées pour leur transmission vers ou en provenance de téléphones intelligents (smartphones)?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.3",null,0,"5.2.1.3.2","¿Las transacciones son encriptadas cuando se transmiten desde y hacia smartphones?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.2","5.2.1",null,"5.2.1.3",null,0,"5.2.1.3.2",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.2.1.3.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.1","","5.2.1.3",null,0,"5.2.1.3.3","5.2.1.3.3: When exchanging transactions with external systems, are electronic signatures / certificates used by each of the parties involved to verify identity of both client and server, and is the end-to end certificate handling process secure?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.1","","5.2.1.3",null,null,"5.2.1.3.3","5.2.1.3.4","When exchanging transactions with external systems, are electronic signatures / certificates used by each of the parties involved to verify identity of both client and server, and is the end-to end certificate handling process secure?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.3",0,0,"5.2.1.3.3","lors de l’échange de transactions avec des systèmes externes, les parties concernées utilisent-elles toutes des signatures / des certificatis électroniques pour vérifier l’identité du client et du serveur, et le processus de traitement des certificats de bout en bout est-il sécurisé ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.3",null,0,"5.2.1.3.3","¿Al intercambiar transacciones con sistemas externos, cada parte involucrada utiliza firmas / certificados electrónicos para verificar la identidad del cliente y del servidor, y el certificado punta a punta que maneja el proceso es seguro?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.2","5.2.1",null,"5.2.1.3",null,0,"5.2.1.3.3",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,"MERGE","5.2.1.3.4","5.2.1.3.4","5.2.1.3.5",null,{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},"",{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},"",2,"",{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP5","OriginalComplianceP5","OriginalComplianceP",0,0,0,0,0,3,""]
[null,"5","5.2","5.2.1","","5.2.1.3",null,0,"5.2.1.3.4","5.2.1.3.4: Have the security protocols for encrypting external data connections been implemented with secure versions and secure configurations?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.1","","5.2.1.3",null,null,"5.2.1.3.4","5.2.1.3.7","Have the security protocols for encrypting external data connections been implemented with secure versions and secure configurations?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.3",0,0,"5.2.1.3.4","les protocoles de sécurité utilisés pour le cryptage des connexions de données externes reposent-ils sur des versions et configurations sécurisées ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.3",null,0,"5.2.1.3.4","¿Se implementaron protocolos de seguridad para encriptar conexiones de datos externos con versiones seguras y configuraciones seguras?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.2","5.2.1",null,"5.2.1.3",null,0,"5.2.1.3.4",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.2.1.3.7",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.1","","5.2.1.3",null,0,"5.2.1.3.5","5.2.1.3.5: Has appropriate encryption strength been implemented for the encryption methodology in use, following vendor recommendations/ best practices?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.1","","5.2.1.3",null,null,"5.2.1.3.5","5.2.1.3.8","Has appropriate encryption strength been implemented for the encryption methodology in use, following vendor recommendations/ best practices?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.3",0,0,"5.2.1.3.5","est-ce qu’un niveau de cryptage suffisant est utilisé dans la méthode de cryptage appliquée, sur la base des recommandations du fournisseur et des pratiques de référence ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.3",null,0,"5.2.1.3.5","¿Se implementó la robustez de encriptación adecuada para la metodología de encriptación utilizada, siguiendo las recomendaciones / mejores prácticas de los proveedores?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.2","5.2.1",null,"5.2.1.3",null,0,"5.2.1.3.5",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.2.1.3.8",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.1","","5.2.1.4","5.2.1.4: ENCRYPTION KEY MANAGEMENT\nIf PINs/passwords are encrypted, providers should implement robust key-management procedures for protecting encryption keys. The whole lifecycle should be documented, including generating, storing, retrieving, distributing, retiring, archiving and destroying keys. \n\nKey custodians should be nominated and should formally acknowledge that they understand their key-custodian responsibilities and processes.\n\nKey management processes should include the following:\n- store keys securely and protect equipment used to generate, store and archive keys. \n- ideally, store keys in an encrypted format and store key-encrypting keys separately from data-encrypting keys;\n- restrict access to keys to the fewest custodians necessary;\n- store keys in the fewest possible locations and forms;\n- prevent reuse of retired security keys when changing keys;\n- replace keys when the integrity of the key has been weakened or is suspect;\n- split knowledge and control of keys where manual clear-text keys are used;\n- backup keys and certificates securely and sufficiently to protect against system failure or disaster;\n- use sufficiently random numbers for cryptographic key generation (this is a common failing).\n","ISO 27002: 2013 Sec. 10, 12.1,\nPCI DSS","5.2.1.4.1","5.2.1.4.1: If PINs/passwords are encrypted, have robust procedures been implemented for protecting encryption keys throughout the whole lifecycle of generating, storing, retrieving, distributing, retiring, archiving and destroying keys?\n","1) Encryption key management process.\n- Check there are processes for protecting encryption keys and certificates\n- Check the process covers requirements for:\na) Generating\nb) Storing\nc) Retrieving\nd) Distribution\ne) Retiring\nf) Archiving \ng) Destroying keys and certificates\n- Check that the procedure give consideration to both physical and logical security requirements\n\n[If encryption is not used to secure PINs/passwords/data then this can be marked N/A]",0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.1","","5.2.1.4","ENCRYPTION KEY MANAGEMENT\nIf PINs/passwords are encrypted, providers should implement robust key-management procedures for protecting encryption keys. The whole lifecycle should be documented, including generating, storing, retrieving, distributing, retiring, archiving and destroying keys. \n\nKey custodians should be nominated and should formally acknowledge that they understand their key-custodian responsibilities and processes.\n\nKey management processes should include the following:\n- store keys securely and protect equipment used to generate, store and archive keys. \n- ideally, store keys in an encrypted format and store key-encrypting keys separately from data-encrypting keys;\n- restrict access to keys to the fewest custodians necessary;\n- store keys in the fewest possible locations and forms;\n- prevent reuse of retired security keys when changing keys;\n- replace keys when the integrity of the key has been weakened or is suspect;\n- split knowledge and control of keys where manual clear-text keys are used;\n- backup keys and certificates securely and sufficiently to protect against system failure or disaster;\n- use sufficiently random numbers for cryptographic key generation (this is a common failing).\n","ISO 27002: 2013 Sec. 10, 12.1,\nPCI DSS","5.2.1.4.1","5.2.1.4.1","If PINs/passwords are encrypted, have robust procedures been implemented for protecting encryption keys throughout the whole lifecycle of generating, storing, retrieving, distributing, retiring, archiving and destroying keys?","1) Encryption key management process.\n- Check there are processes for protecting encryption keys and certificates\n- Check the process covers requirements for:\na) Generating\nb) Storing\nc) Retrieving\nd) Distribution\ne) Retiring\nf) Archiving \ng) Destroying keys and certificates\n- Check that the procedure give consideration to both physical and logical security requirements\n\n[If encryption is not used to secure PINs/passwords/data then this can be marked N/A]",null,"Recommended","Recommended","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.4","GESTION DES CLÉS DE CHIFFREMENT\nLorsque les codes confidentiels/les mots de passe sont chiffrés, les prestataires doivent se doter de procédures rigoureuses de gestion des clés afin de protéger les clés de chiffrement. La totalité du cycle d’utilisation doit être documentée, comprenant la génération, le stockage, la récupération, la distribution, le retrait, l’archivage et la destruction des clés. \n\nDes gardiens des clés doivent être nommés et reconnaître formellement qu’ils comprennent leurs responsabilités de gardien des clés et les procédures qui s’y rattachent.\n\nLes procédures de gestion des clés doivent couvrir les aspects suivants :\n- stockage sécurisé des clés et protection des équipements servant à générer, conserver et archiver les clés ; \n- stockage des clés sous forme chiffrée de préférence, avec stockage séparé des clés de chiffrement des clés d'une part et des clés de chiffrement des données d'autre part ;\n- accès aux clés limité au nombre minimum de gardiens nécessaires ;\n- stockage des clés limité au nombre minimum de sites et formes nécessaires ;\n- blocage de la réutilisation des clés de sécurité obsolètes lors du changement des clés ;\n- remplacement des clés en cas d’atteinte avérée ou soupçonnée à leur intégrité;\n- division de la connaissance et du contrôle des clés lorsque des clés manuelles à affichage de texte clair sont utilisées ;\n- sauvegarde adéquate et sécurisée des clés et certificats à titre de mesure de précaution en cas de sinistre ou de défaillance du système ;\n- utilisation de chiffres suffisamment aléatoires pour la génération des clés de chiffrement (cela représente une faille courante).","ISO 27002: 2013 Sec. 10, 12.1,\nPCI DSS","5.2.1.4.1","des procédures rigoureuses de protection des certificats et clés de cryptage sont-elles appliquées pour la totalité du cycle d’utilisation, comprenant la génération, le stockage, la récupération, la distribution, le retrait, l’archivage et la destruction des clés ?","1) Processus de gestion des clés de cryptage.\n- Vérifier que des processus ont été mis en place pour la protection des clés et des certificats de cryptage\n- Vérifier que le processus inclut des exigences pour :\na) La génération\nb) Le stockage\nc) La récupération\nd) La distribution\ne) Le retrait\nf) L’archivage \ng) La destruction des clés et certificats\n- Vérifier que le processus tient compte des exigences de sécurité à la fois physiques et logiques",null,"Recommandé","Recommandé","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.4","GESTIÓN DE CLAVES DE ENCRIPTACIÓN\nSi los PIN/contraseñas están encriptados, los proveedores deben implementar procedimientos de gestión de claves robustos para proteger las claves de encriptación. Se debe documentar todo el ciclo de vida, incluyendo la generación, almacenamiento, recuperación, distribución, retiro, archivo y destrucción de claves. \n\nSe deben designar custodios de claves, que deben reconocer formalmente que comprenden sus responsabilidades y procesos como custodios de claves.\n\nLos procesos de gestión de claves deben incluir lo siguiente:\n- almacenar claves de forma segura y proteger los equipos utilizados para generar, almacenar y archivar claves. \n- idealmente, almacenar claves en un formato encriptado y almacenar las claves de encriptación de claves separadas de las claves de encriptación de datos;\n- restringir el acceso a las claves a la menor cantidad necesaria de custodios;\n- almacenar claves en la menor cantidad de ubicaciones y formatos posibles;\n- evitar la reutilización de claves de seguridad retiradas cuando se cambian las claves;\n- reemplazar las claves cuando se debilitó la integridad de la clave o está bajo sospecha;\n- dividir el conocimiento y el control de claves cuando se utilizan claves manuales no encriptadas;\n- contar con claves y certificados de respaldo seguros y suficientes para la protección ante fallas o desastres al sistema;\n- utilizar números lo suficientemente aleatorios para la generación de claves criptográficas (ésta es una falla común).\n\n","ISO 27002: 2013 Sec. 10, 12.1,\nPCI DSS","5.2.1.4.1","¿Se implementaron procedimientos robustos para proteger las claves y los certificados de encriptación a lo largo de todo el ciclo de vida de generación, almacenamiento, recuperación, distribución, retiro, archivo y destrucción de claves?","1) Proceso de gestión de claves de certificados.\n- Verificar que existan procesos para proteger las claves y los certificados de encriptación\n- Verificar que el proceso contemple los requisitos para:\na) Generar\nb) Almacenar\nc) Recuperar\nd) Distribuir\ne) Retirar\nf) Archivar\ng) Destruir claves y certificados\n- Verificar que el procedimiento tenga en cuenta los requisitos de seguridad físicos y lógicos",null,"Recomendado","Recomendado","TechOps",null,null,"5","5.2","5.2.1",null,"5.2.1.4",null,"ISO 27002: 2013 Sec. 10, 12.1,\nPCI DSS","5.2.1.4.1",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.2.1.4.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.1","","5.2.1.4",null,0,"5.2.1.4.2","5.2.1.4.2: If PINs/passwords are encrypted, have encryption key custodians been nominated and formally acknowledged that they understand their key-custodian responsibilities and processes?\n","1) Encryption policy\n- Check the policy states who the custodians of the keys are\n- Check the custodians have received a briefing regarding their responsibilities and the processes they are required to undertake\n- Check the custodians have formally acknowledged and understand their role\n\n[If encryption is not used to secure PINs/passwords/data then this can be marked N/A]",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.1","","5.2.1.4",null,null,"5.2.1.4.2","5.2.1.4.2","If PINs/passwords are encrypted, have encryption key custodians been nominated and formally acknowledged that they understand their key-custodian responsibilities and processes?","1) Encryption policy\n- Check the policy states who the custodians of the keys are\n- Check the custodians have received a briefing regarding their responsibilities and the processes they are required to undertake\n- Check the custodians have formally acknowledged and understand their role\n\n[If encryption is not used to secure PINs/passwords/data then this can be marked N/A]",null,"Standard Required","Required","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.4",0,0,"5.2.1.4.2","Si les codes confidentiels/les mots de passe sont chiffrés, existe-t-il des « gardiens des clés de chiffrement » désignés ayant formellement reconnu qu’ils comprenaient leurs responsabilités de gardien des clés et les procédures qui s’y rattachaient ?","1) Politique de chiffrement\n- Vérifier que la politique désigne les gardiens des clés\n- Vérifier que les gardiens des clés ont été informés de leurs responsabilités et des processus qu’ils doivent appliquer\n- Vérifier que les gardiens des clés ont formellement reconnu et compris leur rôle\n\n[Indiquez la mention n/d pour cet indicateur si la protection des codes confidentiels/mots de passe/données n'inclut pas de procédure de chiffrement]\n",null,"Requis Normal","Requis","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.4",null,0,"5.2.1.4.2","Si los PIN/contraseñas están encriptados, ¿se designaron custodios de claves y ellos reconocieron formalmente comprender sus responsabilidades y procesos como custodios de claves?","1) Política de encriptación\n- Verificar que la política establezca quiénes son los custodios de las claves\n- Verificar que los custodios hayan sido informados acerca de sus responsabilidades y los procesos que deben realizar\n- Verificar que los custodios hayan reconocido formalmente que comprenden su rol   \n\n[Si no se utiliza encriptación para la seguridad de PIN/contraseñas/datos, esto se puede marcar con N/A]\n",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.2","5.2.1",null,"5.2.1.4",null,0,"5.2.1.4.2",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.2.1.4.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.1","","5.2.1.4",null,0,"5.2.1.4.3","5.2.1.4.3: If PINs/passwords are encrypted, are encryption keys stored securely and protected against disaster, and is equipment used to generate, store and archive keys protected?\n","1) Encryption policy\n- Check there are processes for the secure storage of the keys\n- Check that keys are protected against key storage system failure or disaster.\n- Check that are security measures to protect any equipment that is used to store the keys.\n\n[If encryption is not used to secure PINs/passwords/data then this can be marked N/A]",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.1","","5.2.1.4",null,null,"5.2.1.4.3",{"$f":"DO31","v":"5.2.1.4.3"},"If PINs/passwords are encrypted, are encryption keys stored securely and protected against disaster, and is equipment used to generate, store and archive keys protected?","1) Encryption policy\n- Check there are processes for the secure storage of the keys\n- Check that keys are protected against key storage system failure or disaster.\n- Check that are security measures to protect any equipment that is used to store the keys.\n\n[If encryption is not used to secure PINs/passwords/data then this can be marked N/A]",null,"Urgent Required","Required","TechOps",null,null,"5","5.2","5.2.1","",{"$f":"$AZ31","v":"5.2.1.4"},0,0,"5.2.1.4.3","Si les codes confidentiels/les mots de passe sont chiffrés, les clés de chiffrement sont-elles stockées de manière sécurisée et protégées en cas de sinistre, et les équipements utilisés pour les générer, les conserver et les archiver sont-ils également protégés ?","1) Politique de chiffrement\n- Vérifier que des processus ont été mis en place pour stocker les clés de manière sécurisée\n- Vérifier que les clés sont protégées en cas de sinistre ou de défaillance du système de stockage des clés.\n- Vérifier que des mesures de sécurité sont appliquées pour protéger les équipements utilisés pour stocker les clés.\n\n[Indiquez la mention n/d pour cet indicateur si la protection des codes confidentiels/mots de passe/données n'inclut pas de procédure de chiffrement]\n",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.4",null,0,{"$f":"$BC31","v":"5.2.1.4.3"},"Si los PIN/contraseñas están encriptados, ¿las claves de encriptación son almacenadas de forma segura y están protegidas contra desastres, y los equipos utilizados para generar, almacenar y archivar claves están protegidos?","1) Política de encriptación\n- Verificar que existan procesos para el almacenamiento seguro de las claves\n- Verificar que las claves estén protegidas contra fallas o desastres al sistema de almacenamiento.\n- Verificar que existan medidas de seguridad para proteger los equipos utilizados para almacenar las claves.  \n\n[Si no se utiliza encriptación para la seguridad de PIN/contraseñas/datos, esto se puede marcar con N/A]",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.2","5.2.1",null,{"$f":"$AZ31","v":"5.2.1.4"},null,0,{"$f":"$BC31","v":"5.2.1.4.3"},null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,"MERGE","5.2.1.4.3","5.2.1.4.9",null,null,{"$error":"#REF!"},{"$error":"#REF!"},"","",{"$error":"#REF!"},{"$error":"#REF!"},"","",2,"",{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,2,""]
[null,"5","5.2","5.2.1","","5.2.1.4",null,0,"5.2.1.4.4","5.2.1.4.4: Are keys stored in an encrypted format and key-encrypting keys stored separately from data-encrypting keys?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.1","","5.2.1.4",null,null,"5.2.1.4.4","5.2.1.4.4","Are keys stored in an encrypted format and key-encrypting keys stored separately from data-encrypting keys?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.4",0,0,"5.2.1.4.4","les clés sont-elles stockées sous forme cryptée avec stockage séparé des clés de cryptage des clés et des clés de cryptage des données?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.4",null,0,"5.2.1.4.4","¿Las claves son almacenadas en un formato encriptado y las claves de encriptación de claves están separadas de las claves de encriptación de datos?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.2","5.2.1",null,"5.2.1.4",null,0,"5.2.1.4.4",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.2.1.4.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.1","","5.2.1.4",null,0,"5.2.1.4.5","5.2.1.4.5: If manual clear-text keys are used, do key-management procedures require split knowledge and dual control of keys?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.1","","5.2.1.4",null,null,"5.2.1.4.5","5.2.1.4.8","If manual clear-text keys are used, do key-management procedures require split knowledge and dual control of keys?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.4",0,{"$f":"BB33","v":0},{"$f":"BC33","v":"5.2.1.4.5"},"en cas d’utilisation de clés manuelles à affichage de texte clair, les procédures de gestion des clés exigent-elles une division de leur connaissance et un double contrôle des clés ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.4",null,{"$f":"BB33","v":0},"5.2.1.4.5","Si se utilizan claves manuales no encriptadas, ¿los procedimientos de gestión de claves requieren dividir el conocimiento y el control dual de las claves?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.2","5.2.1",null,"5.2.1.4",null,{"$f":"BB33","v":0},"5.2.1.4.5",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.2.1.4.8",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.1","","5.2.1.4",null,0,"5.2.1.4.6","5.2.1.4.6: Are sufficiently random numbers used for cryptographic key generation?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.1","","5.2.1.4",null,null,"5.2.1.4.6","5.2.1.4.10","Are sufficiently random numbers used for cryptographic key generation?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.4",0,0,"5.2.1.4.6","est-ce que des chiffres suffisamment aléatoires sont utilisés pour la génération des clés de cryptage ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.4",null,0,"5.2.1.4.6","¿Se utilizan números lo suficientemente aleatorios para la generación de claves criptográficas?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.2","5.2.1",null,"5.2.1.4",null,0,"5.2.1.4.6",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.2.1.4.10",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.1","","5.2.1.5","5.2.1.5: AD-HOC AND OFFLINE DATA TRANSFER\nAn data transfer policy or process should be implemented that defines how offline and ad-hoc transfers of mobile money data to/from third parties should be done (i.e. to/from agents, entities providing outsourced services, and financial ecosystem partners).\n\nThe detailed security measures to ensure the confidentiality and integrity of the data should be documented (e.g. encryption, anonymization).\n","ISO 27002:2013 Sec. 13.2 ","5.2.1.5.1","5.2.1.5.1: Has a data transfer policy or process been implemented that defines how offline and ad-hoc transfers of mobile money data to/from third parties should be done, including the detailed security measures to ensure the confidentiality and integrity of the data?\n","1) Data protection policy, security policy, process or equivalent.\n- Check the document specifies how the data should be protected (e.g. anonymisation, encryption).\n- Check the document identifies applicable data (e.g. via classification level).\n- Check the policy covers all ad-hoc and offline external data transfers.\n",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.1","","5.2.1.5","AD-HOC AND OFFLINE DATA TRANSFER\nAn data transfer policy or process should be implemented that defines how offline and ad-hoc transfers of mobile money data to/from third parties should be done (i.e. to/from agents, entities providing outsourced services, and financial ecosystem partners).\n\nThe detailed security measures to ensure the confidentiality and integrity of the data should be documented (e.g. encryption, anonymization).\n","ISO 27002:2013 Sec. 13.2 ","5.2.1.5.1","5.2.1.5.1","Has a data transfer policy or process been implemented that defines how offline and ad-hoc transfers of mobile money data to/from third parties should be done, including the detailed security measures to ensure the confidentiality and integrity of the data?","1) Data protection policy, security policy, process or equivalent.\n- Check the document specifies how the data should be protected (e.g. anonymisation, encryption).\n- Check the document identifies applicable data (e.g. via classification level).\n- Check the policy covers all ad-hoc and offline external data transfers.\n",null,"Standard Required","Required","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.5","POLITIQUE DE TRANSFERT DES INFORMATIONS\nUne politique doit être mise en œuvre pour définir les conditions de transfert des données liées à l’argent mobile vers/en provenance de tiers (agents, entités assurant des services de sous-traitance et partenaires de l’écosystème financier).\n\nCette politique doit identifier les données jugées confidentielles et sensibles et définir les procédures de communication de ces informations, et notamment le type de mesures de sécurité (ex. cryptage, anonymisation) à utiliser pour en garantir la confidentialité et l’intégrité.\n\nLes responsabilités du prestataire et des tiers doivent être définies en cas d’incident relatif à la sécurité de l’information, comme par exemple les pertes de données.","ISO 27002:2013 Sec. 13.2 ","5.2.1.5.1","Existe-t-il une politique ou un processus de transfert de données qui définit les façons d’effectuer des transferts par réseaux ad hoc et hors-ligne de données concernant l'argent mobile vers/en provenance de tiers, y compris les mesures de sécurité détaillées qui garantissent la confidentialité et l’intégrité des données ?","1) Politique de protection des données, politique ou processus de sécurité ou équivalent\n- Vérifier que le document indique la façon dont les données doivent être protégées (par exemple anonymisation, cryptage)\n- Vérifier que le document identifie les données concernées (par exemple niveau de classification).\n- Vérifier que la politique concerne l’ensemble des transferts de données vers l’extérieur, hors lignes ou ad hoc.\n",null,"Requis Normal","Requis","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.5","TRANSFERENCIA DE DATOS AD-HOC Y FUERA DE LÍNEA\nSe debe implementar una política o proceso de transferencia de datos que defina cómo se deben realizar las transferencias de datos del dinero móvil ad-hoc y fuera de línea hacia/desde terceros (es decir hacia/desde agentes, entidades que prestan servicios tercerizados y socios del ecosistema financiero).\n\nSe deben documentar las medidas de seguridad detalladas para garantizar la confidencialidad e integridad de los datos (por ej., encriptación, anonimización).\n","ISO 27002:2013 Sec. 13.2 ","5.2.1.5.1","¿Se implementó una política o proceso de transferencia de datos que defina cómo se deben realizar las transferencias de datos del dinero móvil ad-hoc y fuera de línea hacia/desde terceros, incluyendo las medidas de seguridad detalladas para garantizar la confidencialidad e integridad de los datos?","1) Política de protección de datos, política, proceso de seguridad, o su equivalente.\n- Verificar que el documento especifique cómo se deben proteger los datos (por ej., anonimización, encriptación).\n- Verificar que el documento identifique los datos aplicables (por ej., por nivel de clasificación).\n- Verificar que la política contemple todas las transferencias de datos ad-hoc y fuera de línea.\n",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.2","5.2.1",null,"5.2.1.5",null,"ISO 27002:2013 Sec. 13.2 ","5.2.1.5.1",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,"MERGE","5.2.1.5.1","5.2.1.5.2",null,null,{"$error":"#REF!"},{"$error":"#REF!"},"","",{"$error":"#REF!"},{"$error":"#REF!"},"","",2,"",{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,2,""]
[null,"5","5.2","5.2.1","","5.2.1.6","5.2.1.6: NETWORK SECURITY\nExternal connectivity of the mobile money system should be protected with firewalls to only allow authorized traffic and protect access to customer data. An external-facing DMZ should be established that is separate from the internal network segment (see 5.2.1.8). Sensitive mobile money system components should be located in the internal network segment, segregated from the DMZ and other untrusted networks.\n\nA network diagram should be documented, identifying connections between the mobile money network environment and external networks.\n\nFirewalls and routers should be set up as follows:\n- position firewalls on every Internet connection and between the DMZ and internal network segment;\n- position firewalls between the internal network segment and the network segment for the wireless phone network;\n- restrict inbound and outbound traffic to that which is necessary for the customer data environment and specifically deny all other traffic;\n- document the rule set for each firewall, including business justification for use of all services, protocols, and ports allowed;\n- ensure firewall and router configuration files are secure and backed up regularly;\n- review firewall and router rule sets at least every six months.\n\nThe DMZ should be set up to:\n- limit inbound Internet traffic to authorized publicly-accessible services, protocols, and ports within the DMZ to prevent direct connections to the mobile money network segment;\n- implement anti-spoofing measures to detect and block forged source IP addresses from entering the network;\n- implement stateful inspection (dynamic packet filtering), ensuring that only established connections are allowed into the network;\n- not disclose private IP addresses and routing information externally (e.g. using NAT).\n\nMeasures should be put in place to prevent devices from being simultaneously connected to the organization’s trusted internal network and untrusted external networks (e.g. establishing connectivity via Ethernet adapter and wireless adapter on the same device).","PCI DSS, ISO 27002:2013 Sec. 13.1 ","5.2.1.6.1","5.2.1.6.1: Is external connectivity of the mobile money system protected with firewalls to only allow authorized traffic and protect access to customer data, with external-facing components located in a DMZ?\n","1) Network design and communications matrix\n- Check the Mobile Money System is protected by firewalls defining internal zone and DMZs.\n- Check the firewall only permits necessary traffic and denies all other traffic.\n- Check all routes through firewalls are documented.",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.1","","5.2.1.6","NETWORK SECURITY\nExternal connectivity of the mobile money system should be protected with firewalls to only allow authorized traffic and protect access to customer data. An external-facing DMZ should be established that is separate from the internal network segment (see 5.2.1.8). Sensitive mobile money system components should be located in the internal network segment, segregated from the DMZ and other untrusted networks.\n\nA network diagram should be documented, identifying connections between the mobile money network environment and external networks.\n\nFirewalls and routers should be set up as follows:\n- position firewalls on every Internet connection and between the DMZ and internal network segment;\n- position firewalls between the internal network segment and the network segment for the wireless phone network;\n- restrict inbound and outbound traffic to that which is necessary for the customer data environment and specifically deny all other traffic;\n- document the rule set for each firewall, including business justification for use of all services, protocols, and ports allowed;\n- ensure firewall and router configuration files are secure and backed up regularly;\n- review firewall and router rule sets at least every six months.\n\nThe DMZ should be set up to:\n- limit inbound Internet traffic to authorized publicly-accessible services, protocols, and ports within the DMZ to prevent direct connections to the mobile money network segment;\n- implement anti-spoofing measures to detect and block forged source IP addresses from entering the network;\n- implement stateful inspection (dynamic packet filtering), ensuring that only established connections are allowed into the network;\n- not disclose private IP addresses and routing information externally (e.g. using NAT).\n\nMeasures should be put in place to prevent devices from being simultaneously connected to the organization’s trusted internal network and untrusted external networks (e.g. establishing connectivity via Ethernet adapter and wireless adapter on the same device).","PCI DSS, ISO 27002:2013 Sec. 13.1 ","5.2.1.6.1","5.2.1.7.1","Is external connectivity of the mobile money system protected with firewalls to only allow authorized traffic and protect access to customer data, with external-facing components located in a DMZ?","1) Network design and communications matrix\n- Check the Mobile Money System is protected by firewalls defining internal zone and DMZs.\n- Check the firewall only permits necessary traffic and denies all other traffic.\n- Check all routes through firewalls are documented.",null,"Urgent Required","Required","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.6","SÉCURITÉ DU RÉSEAU\nLa connectivité externe du système du service d’argent mobile doit être protégée au moyen de firewalls qui ne laissent passer que le trafic autorisé et protègent l’accès aux données concernant les clients. Une DMZ tournée vers l’extérieur et séparée du segment de réseau interne doit être mise en place (cf. 5.2.1.8). Les composants sensibles du système de l’argent mobile doivent être situés dans le segment de réseau interne, séparés de la DMZ et des autres réseaux non autorisés.\n\nUn diagramme de réseau recensant les connexions entre l’environnement de réseau du service d'argent mobile et les réseaux externes doit être documenté.\n\nLes firewalls et routeurs doivent être installés comme suit :\n- firewalls sur chaque connexion internet et entre la DMZ et le segment de réseau interne ;\n- firewalls entre le segment de réseau interne et le segment de réseau de la téléphonie mobile ;\n- limitation du trafic entrant et sortant à ce qui est nécessaire pour l’environnement des données concernant les clients avec rejet spécifique de tout autre trafic ;\n- les règles de chaque firewall doivent être documentées, avec justification fonctionnelle de tous les services, protocoles et points de connexion utilisés ;\n- les fichiers de configuration des firewalls et routeurs doivent être sécurisés et régulièrement sauvegardés ;\n- les règles de fonctionnement des firewalls et routeurs doivent être revues tous les six mois au minimum.\n\nLa DMZ doit être configurée pour :\n- limiter le trafic internet entrant aux services, protocoles et ports accessibles au public pour empêcher des connexions directes au segment de réseau du service d'argent mobile ;\n- mettre en place des mesures anti-usurpation pour détecter et bloquer l’accès des fausses adresses IP sources ;\n- mettre en place une inspection d’état (filtrage dynamique de paquets) pour s’assurer que seules les connexions déjà établies puissent accéder au réseau ;\n- ne pas divulguer les adresses IP privées et les informations de routage à l’extérieur (par ex. à l’aide d’une fonction NAT).\n\nDes mesures visant à empêcher les terminaux d’être connectés à la fois sur le réseau interne de l’entreprise et sur des réseaux externes non sécurisés (par ex. en établissant une connexion via un adaptateur Ethernet et un adaptateur sans fil sur le même terminal).","PCI DSS, ISO 27002:2013 Sec. 13.1 ","5.2.1.6.1","la connectivité externe du système de l’argent mobile est-elle protégée au moyen de firewalls qui ne laissent passer que le trafic autorisé et protègent l’accès aux données concernant les clients, avec des composants externes situés dans une DMZ  ?","1) Conception du réseau et matrice de communication\n- Vérifier que le système d’argent mobile est protégé au moyen de firewalls définissant la zone interne et les DMZ.\n- Vérifier que le firewall ne laisse passer que le trafic nécessaire et rejette tout autre trafic.\n- Vérifier que l’ensemble des connexions via le firewall sont documentées.",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.6","SEGURIDAD DE LA RED\nLa conectividad externa del sistema del dinero móvil debe estar protegida con firewalls para permitir solo el tráfico autorizado y proteger el acceso a los datos de los clientes. Se debe establecer una zona desmilitarizada (DMZ) externa que esté separada del segmento de red interno (ver 5.2.1.8). Los componentes del sistema del dinero móvil sensibles deben estar ubicados en el segmento de red interno, separados de la DMZ y otras redes no confiables.\n\nSe debe documentar un diagrama de red que identifique las conexiones entre el entorno de red del dinero móvil y las redes externas.\n\nLos firewalls y ruteadores se deben configurar de la siguiente manera:\n- colocar firewalls en cada conexión a Internet y entre la DMZ y el segmento de red interno;\n- colocar firewalls entre el segmento de red interno y el segmento de red para la red de teléfonos inalámbricos;\n- restringir el tráfico entrante y saliente al que sea necesario para el entorno de datos del  cliente y específicamente denegar cualquier otro tráfico;\n- documentar el conjunto de reglas para cada firewall, incluyendo la justificación comercial para el uso de todos los servicios, protocolos y puertos permitidos;\n- garantizar que los archivos de configuración de firewalls y ruteadores sean seguros y se realicen periódicamente copias de respaldo;\n- revisar el conjunto de reglas de firewalls y ruteadores al menos, cada seis meses.\n\nLa DMZ debe estar configurada para:\n- limitar el tráfico de Internet entrante a servicios, protocolos y puertos públicos autorizados dentro de la DMZ para evitar conexiones directas al segmento de red del dinero móvil;\n- implementar medidas anti-spoofing para detectar y bloquear direcciones IP de fuente falsificada y evitar que ingresen a la red;\n- implementar inspección de estados (filtrado de paquetes dinámico) para garantizar que solo las conexiones establecidas puedan ingresar a la red;\n- no divulgar direcciones IP privadas e información de enrutamiento externamente (por ej., usando NAT).\n\nSe deben implementar medidas para evitar que los dispositivos estén simultáneamente conectados a la red interna confiable de la organización y a redes externas no confiables (por ej., estableciendo conectividad mediante adaptador Ethernet y adaptador inalámbrico en el mismo dispositivo).","PCI DSS, ISO 27002:2013 Sec. 13.1 ","5.2.1.6.1","¿La conectividad externa del sistema del dinero móvil está protegida con firewalls para permitir solo el tráfico autorizado y proteger el acceso a los datos de los clientes, con componentes externos ubicados en una DMZ?","1) Diseño de red y matriz de comunicaciones\n- Verificar que el Sistema del Dinero Móvil esté protegido con firewalls que definan la zona interna y las DMZ.\n- Verificar que el firewall solo permita el tráfico necesario y deniegue cualquier otro tráfico.\n- Verificar que estén documentadas todas las rutas a través de firewalls.",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.2","5.2.1",null,"5.2.1.6",null,"PCI DSS, ISO 27002:2013 Sec. 13.1 ","5.2.1.6.1",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,"MERGE","5.2.1.7.1","5.2.1.7.2","5.2.1.7.3","5.2.1.6.1",{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},2,"",{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP5","OriginalComplianceP5","OriginalComplianceP5",0,0,0,0,0,4,""]
[null,"5","5.2","5.2.1","","5.2.1.6",null,0,"5.2.1.6.2","5.2.1.6.2: Have the rule sets for all mobile money system firewalls been documented, including all services, protocols, and ports allowed and business justification for each?\n","1) Network security policy (or equivalent documents) or firewall/router rules documentation\n- Check the document includes rules for all mobile money system firewalls\n- Check the document includes:\n     a) All services\n     b) Protocols\n     c) Allowed ports\n- Check there is a business justification for each of the above\n- Check all routes through firewalls are documented.",0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.1","","5.2.1.6",null,null,"5.2.1.6.2","5.2.1.7.4","Have the rule sets for all mobile money system firewalls been documented, including all services, protocols, and ports allowed and business justification for each?","1) Network security policy (or equivalent documents) or firewall/router rules documentation\n- Check the document includes rules for all mobile money system firewalls\n- Check the document includes:\n     a) All services\n     b) Protocols\n     c) Allowed ports\n- Check there is a business justification for each of the above\n- Check all routes through firewalls are documented.",null,"Recommended","Recommended","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.6",0,0,"5.2.1.6.2","existe-t-il des règles documentées pour tous les firewalls du système de l’argent mobile, couvrant tous les services, protocoles et points de connexion autorisés et leur justification fonctionnelle ?","1) Politique de sécurité du réseau (ou documents équivalents) ou documentation énonçant les règles relatives aux firewalls/routeurs\r\n- Vérifier que le document inclut des règles pour tous les firewalls du système d’argent mobile\r\n- Vérifier que le document couvre :\n\r     a) Tous les services\r\n     b) Les protocoles\n\r     c) Les points de connexion autorisés\r\n- Vérifier que le document inclut la justification fonctionnelle de chacun des éléments définis ci-dessus\n\r- Vérifier que l’ensemble des connexions via les firewalls sont documentées.",null,"Recommandé","Recommandé","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.6",null,0,"5.2.1.6.2","¿Se documentaron los conjuntos de reglas para todos los firewalls del sistema del dinero móvil, incluyendo todos los servicios, protocolos y puertos permitidos y la justificación comercial para cada uno?","1) Política de seguridad de la red (o documentos equivalentes) o documentación de las reglas de firewall/router\n- Verificar que el documento incluya reglas para todos los firewalls del sistema del dinero móvil\n- Verificar que el documento incluya:\n     a) Todos los servicios\n     b) Protocolos\n     c) Puertos permitidos\n- Verificar que exista una justificación comercial para cada uno de los anteriores\n- Verificar que estén documentadas todas las rutas a través de firewalls.",null,"Recomendado","Recomendado","TechOps",null,null,"5","5.2","5.2.1",null,"5.2.1.6",null,0,"5.2.1.6.2",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.2.1.7.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.1",{"$f":"CHOOSE(LanguageNumber,AY38,BP38,CF38,CV38)","v":""},"5.2.1.6",null,{"$f":"BB38","v":0},{"$f":"BC38","v":"5.2.1.6.3"},"5.2.1.6.3: Is there a formal process for approval of all network connections and changes to firewall and router configurations?\n",{"$f":"CHOOSE(LanguageNumber,BF38,BV38,CL38,DB38)","v":"1) Network security policy (or equivalent documents) or firewall/router rules documentation\n- Check that there is a process for approving:\n     a) all network connections\n     b) all router configurations\n"},0,{"$f":"CHOOSE(LanguageNumber,BH38,BX38,CN38,DD38)","v":"Urgent Required"},{"$f":"CHOOSE(LanguageNumber,BI38,BY38,CO38,DE38)","v":"Required"},"TechOps",{"$f":"CHOOSE(LanguageNumber,BK38,CA38,CQ38,DG38)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.1","","5.2.1.6",null,null,"5.2.1.6.3",{"$f":"DO38","v":"5.2.1.6.2"},"Is there a formal process for approval of all network connections and changes to firewall and router configurations?","1) Network security policy (or equivalent documents) or firewall/router rules documentation\n- Check that there is a process for approving:\n     a) all network connections\n     b) all router configurations\n",null,"Urgent Required","Required","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.6",null,null,{"$f":"BC38","v":"5.2.1.6.3"},"existe-t-il un processus formel d’autorisation de toutes les connexions de réseau et modifications de configuration des firewalls et routeurs ?","1) Politique de sécurité du réseau (ou documents équivalents) ou documentation énonçant les règles relatives aux firewalls/routeurs\n\r- Vérifier qu’un processus a été mis en place pour l’autorisation :\n\r     a) de toutes les connexions de réseau\r\n     b) de toutes les configurations des routeurs\r",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.6",null,null,"5.2.1.6.3","¿Existe un proceso formal para la aprobación de todas las conexiones de red y cambios a las configuraciones de firewalls y routers?","1) Política de seguridad de la red (o documentos equivalentes) o documentación de las reglas de firewall/router\n- Verificar que exista un proceso para aprobar:\n     a) todas las conexiones de red\n     b) todas las configuraciones de router\n",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.2","5.2.1",null,"5.2.1.6",null,null,"5.2.1.6.3",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.2.1.6.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.1","","5.2.1.6",null,0,"5.2.1.6.4","5.2.1.6.4: Is there a network diagram identifying connections within the mobile money network environment and to external networks?\n","1) Network Diagram\n- Check that there is a network diagram details connections within the mobile money network environment and to the external network\n\n",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.1","","5.2.1.6",null,null,"5.2.1.6.4","5.2.1.6.3","Is there a network diagram identifying connections within the mobile money network environment and to external networks?","1) Network Diagram\n- Check that there is a network diagram details connections within the mobile money network environment and to the external network\n\n",null,"Standard Required","Required","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.6",null,null,"5.2.1.6.4","existe-t-il un diagramme de réseau recensant les connexions dans l’environnement de réseau du service d’argent mobile et les réseaux externes ?","1) Diagramme de réseau\n- Vérifier qu’un diagramme de réseau recensant les connexions entre l’environnement de réseau du service d’argent mobile et les réseaux externes a été établi\n\n",null,"Requis Normal","Requis","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.6",null,null,"5.2.1.6.4","¿Existe un diagrama de red que identifique las conexiones dentro del entorno de red del dinero móvil y a redes externas?","1) Diagrama de Red\n- Verificar que exista un diagrama de red que detalle las conexiones dentro del entorno de red del dinero móvil y a la red externa\n\n",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.2","5.2.1",null,"5.2.1.6",null,null,"5.2.1.6.4",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.2.1.6.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.1","","5.2.1.6",null,0,"5.2.1.6.5","5.2.1.6.5: Are all firewall and router configuration files secure and backed up regularly?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.1","","5.2.1.6",null,null,"5.2.1.6.5","5.2.1.7.5","Are all firewall and router configuration files secure and backed up regularly?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.6",0,0,"5.2.1.6.5","les fichiers de configuration des firewalls et routeurs sont-ils tous sécurisés et sauvegardés périodiquement ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.6",null,0,"5.2.1.6.5","¿Todos los archivos de configuración de firewall son seguros y se realizan periódicamente copias de respaldo?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.2","5.2.1",null,"5.2.1.6",null,0,"5.2.1.6.5",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.2.1.7.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.1","","5.2.1.6",null,0,"5.2.1.6.6","5.2.1.6.6: Are firewall and router rule sets reviewed at least every six months?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.1","","5.2.1.6",null,null,"5.2.1.6.6","5.2.1.7.6","Are firewall and router rule sets reviewed at least every six months?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.6",0,0,"5.2.1.6.6","les règles de fonctionnement des firewalls et routeurs sont-elles revues tous les six mois au minimum ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.2","5.2.1","","5.2.1.6",null,0,"5.2.1.6.6","¿Los conjuntos de reglas de firewalls y routers son revisados, al menos, cada seis meses?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.2","5.2.1",null,"5.2.1.6",null,0,"5.2.1.6.6",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.2.1.7.6",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.1",null,"5.2.1.6",null,null,"5.2.1.6.7","5.2.1.6.7: Are measures in place to prevent devices from being simultaneously connected to the organization’s trusted internal network and untrusted external network?\n(e.g. establishing connectivity via Ethernet adapter and wireless adapter on the same device).\n",{"$f":"CHOOSE(LanguageNumber,BF42,BV42,CL42,DB42)","v":0},0,{"$f":"CHOOSE(LanguageNumber,BH42,BX42,CN42,DD42)","v":"Recommended"},{"$f":"CHOOSE(LanguageNumber,BI42,BY42,CO42,DE42)","v":"Recommended"},"TechOps",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.1",null,"5.2.1.6",null,null,"5.2.1.6.7",null,"Are measures in place to prevent devices from being simultaneously connected to the organization’s trusted internal network and untrusted external network?\n(e.g. establishing connectivity via Ethernet adapter and wireless adapter on the same device).",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.2","5.2.1",null,"5.2.1.6",null,null,"5.2.1.6.7","Des mesures ont-elles été mises en place pour empêcher les terminaux d’être connectés à la fois sur le réseau interne de l’entreprise et sur des réseaux externes non sécurisés ?\n(par ex. en établissant une connexion via un adaptateur Ethernet et un adaptateur sans fil sur le même terminal).",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.2","5.2.1",null,"5.2.1.6",null,null,"5.2.1.6.7","¿Se implementaron medidas para evitar que los dispositivos estén simultáneamente conectados a la red interna confiable de la organización y a la red externa no confiable?\n(por ej.,  el establecimiento de conectividad mediante un adaptador Ethernet y un adaptador inalámbrico en el mismo dispositivo).",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.2","5.2.1",null,"5.2.1.6",null,null,"5.2.1.6.7",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,"NEW"]
[null,"5","5.2","5.2.2","5.2.2: Providers shall ensure that systems and applications are designed and developed securely and are thoroughly tested","5.2.2.1","5.2.2.1: SECURE SOFTWARE DEVELOPMENT PROCESSES\nCustom development of mobile money system software should be developed using secure processes. Industry standard best practices should be followed (e.g. ISO 27034-01:2011, PCI-DSS v3.0) as well as other recommended practices (for example, secure authentication and logging). This practice is applicable to custom software development by either internal staff or outsourced suppliers.\n\nInformation security should be incorporated throughout the software-development life cycle to ensure that secure software is developed. \n\nProviders should train developers in secure coding techniques, including how to avoid common coding vulnerabilities, understanding how sensitive data is handled in memory, and developing applications based on secure coding guidelines.","PCI DSS, ISO 27002:2013 Sec. 14.2 ","5.2.2.1.1","5.2.2.1.1: Are custom developments of mobile money system software developed using secure processes throughout the software development life cycle, following industry standard best practices?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.2","5.2.2: Providers shall ensure that systems and applications are designed and developed securely and are thoroughly tested","5.2.2.1","SECURE SOFTWARE DEVELOPMENT PROCESSES\nCustom development of mobile money system software should be developed using secure processes. Industry standard best practices should be followed (e.g. ISO 27034-01:2011, PCI-DSS v3.0) as well as other recommended practices (for example, secure authentication and logging). This practice is applicable to custom software development by either internal staff or outsourced suppliers.\n\nInformation security should be incorporated throughout the software-development life cycle to ensure that secure software is developed. \n\nProviders should train developers in secure coding techniques, including how to avoid common coding vulnerabilities, understanding how sensitive data is handled in memory, and developing applications based on secure coding guidelines.","PCI DSS, ISO 27002:2013 Sec. 14.2 ","5.2.2.1.1","5.2.2.1.1","Are custom developments of mobile money system software developed using secure processes throughout the software development life cycle, following industry standard best practices?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.2","5.2.2","5.2.2: Les prestataires doivent s’assurer que les systèmes et les applications soient conçus et développés de façon sécurisée et fassent l’objet de tests rigoureux.","5.2.2.1","DÉVELOPPEMENT LOGICIEL SÉCURISÉ\nLe développement sur mesure du système de l’argent mobile doit être réalisé dans le respect de processus sécurisés. Les bonnes pratiques de référence du secteur doivent être suivies (ex. ISO 27034-01:2011, PCI-DSS v3.0) ainsi que d’autres pratiques recommandées (ex. authentification et ouvertures de session sécurisées). Cette pratique s’applique au développement logiciel sur mesure par le personnel en interne ou les fournisseurs sous-traitants.\n\nLa sécurité des informations doit être intégrée à tous les stades du développement logiciel pour garantir la sûreté des logiciels développés. \n\nLes prestataires doivent former les développeurs aux méthodes de programmation sécurisées, y compris les moyens d’éviter les vulnérabilités courantes de codages, le traitement des données sensibles en mémoire et le développement d’applications reposant sur une démarche de programmation sécurisée.","PCI DSS, ISO 27002:2013 Sec. 14.2 ","5.2.2.1.1","les modifications des logiciels du système du service d’argent mobile sont-elles développées dans le respect de processus sécurisés tout au long du cycle de développement, dans le respect des pratiques de référence du secteur ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.2","5.2.2","5.2.2: Los proveedores deben garantizar que los sistemas y las aplicaciones estén diseñadas y desarrolladas de forma segura y sean probadas minuciosamente","5.2.2.1","PROCESOS SEGUROS DE DESARROLLO DE SOFTWARE\nEl desarrollo personalizado del software del sistema del dinero móvil debe realizarse empleando procesos seguros. Se deben seguir las mejores prácticas estándar de la industria (por ej., ISO 27034-01:2011, PCI-DSS v3.0), así como también otras prácticas recomendadas (por ejemplo, autenticación y registro seguros). Esta práctica es aplicable al desarrollo personalizado de software ya sea por el personal interno o por proveedores externos.\n\nLa seguridad de la información se debe incorporar a lo largo de todo el ciclo de vida de desarrollo del software a fin de garantizar que se desarrolle software seguro. \n\nLos proveedores deben brindar capacitación a los desarrolladores sobre técnicas de codificación segura, incluyendo cómo evitar las vulnerabilidades de codificación comunes, comprender cómo se manejan los datos sensibles en la memoria y desarrollar aplicaciones basadas en lineamientos de codificación segura.","PCI DSS, ISO 27002:2013 Sec. 14.2 ","5.2.2.1.1","¿Los desarrollos personalizados del software del sistema del dinero móvil se realizan empleando procesos seguros a lo largo de todo el ciclo de vida de desarrollo del software, siguiendo las mejores prácticas estándar de la industria?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.2","5.2.2",null,"5.2.2.1",null,"PCI DSS, ISO 27002:2013 Sec. 14.2 ","5.2.2.1.1",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.2.2.1.1",null,null,null,{"$f":"IF(OR($EA43=0,$EA43=2),VLOOKUP(DO43,INDIRECT(ED43),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP43),\"\",VLOOKUP(DP43,INDIRECT(EE43),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ43),\"\",VLOOKUP(DQ43,INDIRECT(EF43),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR43),\"\",VLOOKUP(DR43,INDIRECT(EG43),7,FALSE))","v":""},{"$f":"IF(OR($EA43=0,$EA43=2),VLOOKUP(DO43,INDIRECT(ED43),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP43),\"\",VLOOKUP(DP43,INDIRECT(EE43),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ43),\"\",VLOOKUP(DQ43,INDIRECT(EF43),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR43),\"\",VLOOKUP(DR43,INDIRECT(EG43),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN43,3)=\"NEW\")+2*AND(LEFT(DN43,3)=\"MER\")+3*AND(LEFT(DN43,3)=\"MOV\")+4*AND(LEFT(DN43,3)=\"SWA\")","v":0},{"$error":"#REF!"},{"$f":"IF(EA43=0,IF(DW43=0,\"\",DW43),CHOOSE(EA43,\"New indicator\",CONCATENATE(DW43,CarriageReturn,DX43,CarriageReturn,DY43,CarriageReturn,DZ43)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO43,1)","v":"OriginalComplianceP5"},{"$f":"\"OriginalComplianceP\"&LEFT(DP43,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ43,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR43,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,""]
[null,"5","5.2","5.2.2",0,"5.2.2.1",null,0,"5.2.2.1.2","5.2.2.1.2: Is best practice for development of secure software enforced on entities providing outsourced software development services?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.2",null,"5.2.2.1",null,null,"5.2.2.1.2","5.2.2.1.2","Is best practice for development of secure software enforced on entities providing outsourced software development services?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.2","5.2.2",0,"5.2.2.1",0,0,"5.2.2.1.2","les bonnes pratiques de développement de logiciels sécurisés sont-elles exigées des prestataires extérieurs assurant des services de développement logiciel ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.2","5.2.2",null,"5.2.2.1",null,0,"5.2.2.1.2","¿Se exigen las mejores prácticas para el desarrollo del software seguro a las entidades que prestan servicios de desarrollo de software tercerizadas?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.2","5.2.2",null,"5.2.2.1",null,0,"5.2.2.1.2",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.2.2.1.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.2","","5.2.2.2","5.2.2.2: DEVELOPMENT OF SECURE MOBILE MONEY SOFTWARE\nNew software for the mobile money system should be developed so that it is secure. This applies to any new software component that forms part of the mobile money system, including:\n  - MM core system;\n  - MM ancillary systems (e.g. for use of agents / business customers);\n  - MM integrations with external systems such as banks and ATMs.\n\nNew software should include the following security features:\n- protection of transactions from unauthorized distortion, falsification, readdressing and destruction;\n- authentication and authorization of all transaction requests;\n- authentication and authorization of sensitive back end operator activities; and\n- authentication and authorization of all automated processes and external systems.\n","ISO 27015: 2012 Sec. 12.1, \nISO 27002: 2013 Sec. 14.2 \nPCI DSS","5.2.2.2.1","5.2.2.2.1: Does new software for the mobile money system include security features that ensure that transactions are protected from unauthorized distortion, falsification, readdressing and destruction?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.2","","5.2.2.2","DEVELOPMENT OF SECURE MOBILE MONEY SOFTWARE\nNew software for the mobile money system should be developed so that it is secure. This applies to any new software component that forms part of the mobile money system, including:\n  - MM core system;\n  - MM ancillary systems (e.g. for use of agents / business customers);\n  - MM integrations with external systems such as banks and ATMs.\n\nNew software should include the following security features:\n- protection of transactions from unauthorized distortion, falsification, readdressing and destruction;\n- authentication and authorization of all transaction requests;\n- authentication and authorization of sensitive back end operator activities; and\n- authentication and authorization of all automated processes and external systems.\n","ISO 27015: 2012 Sec. 12.1, \nISO 27002: 2013 Sec. 14.2 \nPCI DSS","5.2.2.2.1","5.2.2.2.1","Does new software for the mobile money system include security features that ensure that transactions are protected from unauthorized distortion, falsification, readdressing and destruction?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.2","DEVELOPPEMENT DE LOGICIELS SÉCURISÉS POUR L’ARGENT MOBILE \nLes nouveaux logiciels du système de l’argent mobile doivent être développés de manière à être sécurisés. Cette règle s’applique à tout nouveau logiciel faisant partie du système de l’argent mobile, y compris les adaptateurs et logiciels médiateurs. \n\nLes nouveaux logiciels doivent inclure les mesures de sécurité suivantes :\n- protection des transactions contre toute altération, falsification, déroutage ou destruction non autorisée ;\n- authentification et autorisation de toutes les demandes d’opérations ;\n- authentification et autorisation des activités sensibles de back-end de l’opérateur ;\n- authentification et autorisation de tous les processus automatisés et systèmes extérieurs.","ISO 27015: 2012 Sec. 12.1, \nISO 27002: 2013 Sec. 14.2 \nPCI DSS","5.2.2.2.1","les nouveaux logiciels du système de l’argent mobile sont-ils dotés de fonctionnalités de sécurité empêchant l’altération, la falsification, le déroutage ou la destruction sans autorisation des transactions ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.2","DESARROLLO DEL SOFTWARE DEL DINERO MÓVIL SEGURO\nSe debe desarrollar un nuevo software para el sistema del dinero móvil para que sea seguro. Esto aplica a todo componente de software nuevo que forma parte del sistema del dinero móvil, incluyendo:\n  - Sistema central del dinero móvil;\n  - sistemas auxiliares del dinero móvil (por ej., para uso de agentes / clientes comerciales);\n  - Integraciones del dinero móvil con sistemas externos tales como bancos y cajeros automáticos.\n\nEl software nuevo debe incluir las siguientes prestaciones de seguridad:\n- protección a las transacciones contra distorsión, falsificación, redireccionamiento y destrucción no autorizada;\n- autenticación y autorización de todas las solicitudes de transacciones;\n- autenticación y autorización de las actividades sensibles del back-end de los operadores; y\n- autenticación y autorización de todos los procesos automatizados y sistemas externos.\n","ISO 27015: 2012 Sec. 12.1, \nISO 27002: 2013 Sec. 14.2 \nPCI DSS","5.2.2.2.1","¿El software nuevo para el sistema del dinero móvil incluye prestaciones de seguridad que garantizan que las transacciones están protegidas contra distorsión, falsificación, redireccionamiento y destrucción no autorizada?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.2","5.2.2",null,"5.2.2.2",null,"ISO 27015: 2012 Sec. 12.1, \nISO 27002: 2013 Sec. 14.2 \nPCI DSS","5.2.2.2.1",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.2.2.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.2","","5.2.2.2",null,0,"5.2.2.2.2","5.2.2.2.2: Does new software for the mobile money system include security features that ensure that all automated processes and external systems are authenticated and authorized correctly?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.2","","5.2.2.2",null,null,"5.2.2.2.2","5.2.2.2.3","Does new software for the mobile money system include security features that ensure that all automated processes and external systems are authenticated and authorized correctly?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.2",0,0,"5.2.2.2.2","les nouveaux logiciels du système de l’argent mobile sont-ils dotés de fonctionnalités de sécurité garantissant que tous les processus automatisés et systèmes externes sont correctement authentifiés et autorisés ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.2",null,0,"5.2.2.2.2","¿El software nuevo para el sistema del dinero móvil incluye prestaciones de seguridad para garantizar que todos los procesos automáticos y los sistemas externos sean autenticados y autorizados correctamente?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.2","5.2.2",null,"5.2.2.2",null,0,"5.2.2.2.2",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.2.2.2.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.2","5.2.2: Providers shall ensure that systems and applications are designed and developed securely and are thoroughly tested","5.2.2.3","5.2.2.3: SECURE MOBILE MONEY SMARTPHONE APPS\nMobile applications accessible via public networks are especially subject to a range of threats. A security review of the mobile money smartphone app(s) should be carried out to ensure that controls have been properly implemented. A suitably qualified and trusted third party should also be used to validate and test the provider's mobile money apps to certify that they are secure and conform to suitable security standards.\n\nInformation security considerations for mobile application transactions should include the following:\n-   Client-side authentication by the app should not be used. The user's authentication information should be presented by the app for every call to the system.\n-   User credentials and transaction information should be held securely by the app (and not stored in log files, for example).\n-   Transaction notifications and messages should be sent and received within the app and stored securely, not via SMS.\n-   Client and server should identify themselves with trusted certificates and the communications path between all parties should be encrypted (see 5.2.1.3).\n\nMark these indicators as N/A if a smartphone app is not supported.","PCI DSS, ISO 27002:2013 Sec. 14.1,\nFlorida uni app review","5.2.2.3.1","5.2.2.3.1: Has a qualified and trusted third party been employed to validate and test the provider's mobile money app(s) to certify that they are secure and conform to suitable security standards?\n","1) Secure development requirements documentation or third party smartphone test report\n- Check that a third party has been employed to test the providers mobile money app(s)\n- Check that third party is qualified and trusted to carry out the validation and testing\n- Check that an assessment has been made to identify which security standards are required for the providers app(s)\n- Check that the third party has certified against the identified security standard",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.2","5.2.2: Providers shall ensure that systems and applications are designed and developed securely and are thoroughly tested","5.2.2.3","SECURE MOBILE MONEY SMARTPHONE APPS\nMobile applications accessible via public networks are especially subject to a range of threats. A security review of the mobile money smartphone app(s) should be carried out to ensure that controls have been properly implemented. A suitably qualified and trusted third party should also be used to validate and test the provider's mobile money apps to certify that they are secure and conform to suitable security standards.\n\nInformation security considerations for mobile application transactions should include the following:\n-   Client-side authentication by the app should not be used. The user's authentication information should be presented by the app for every call to the system.\n-   User credentials and transaction information should be held securely by the app (and not stored in log files, for example).\n-   Transaction notifications and messages should be sent and received within the app and stored securely, not via SMS.\n-   Client and server should identify themselves with trusted certificates and the communications path between all parties should be encrypted (see 5.2.1.3).\n\nMark these indicators as N/A if a smartphone app is not supported.","PCI DSS, ISO 27002:2013 Sec. 14.1,\nFlorida uni app review","5.2.2.3.1","5.2.2.3.1","Has a qualified and trusted third party been employed to validate and test the provider's mobile money app(s) to certify that they are secure and conform to suitable security standards?","1) Secure development requirements documentation or third party smartphone test report\n- Check that a third party has been employed to test the providers mobile money app(s)\n- Check that third party is qualified and trusted to carry out the validation and testing\n- Check that an assessment has been made to identify which security standards are required for the providers app(s)\n- Check that the third party has certified against the identified security standard",null,"Standard Required","Required","TechOps",null,null,"5","5.2","5.2.2","5.2.2: Les prestataires doivent s’assurer que les systèmes et les applications soient conçus et développés de façon sécurisée et fassent l’objet de tests rigoureux.","5.2.2.3","APPLICATIONS SMARTPHONES SÉCURISÉES POUR LE SERVICE D’ARGENT MOBILE\nLes applications mobiles accessibles par l’intermédiaire de réseaux publics sont particulièrement exposées à tout un éventail de risques. Une évaluation de la sécurité des applications smartphone d'argent mobile doit être effectuée pour s’assurer de la bonne mise en œuvre des mesures de contrôle. Il est également nécessaire de recourir à un prestataire extérieur sérieux et qualifié pour tester et valider les normes de sécurité appropriées.\n\nLes transactions effectuées par l’intermédiaire d’applications mobiles doivent respecter les règles de sécurité suivantes :\n- l’authentification client par l’application ne doit pas être utilisée. Les renseignements d’authentification de l’utilisateur doivent être présentés à chaque appel en direction du système.\n- les identifiants de l’utilisateur et les renseignements relatifs aux transactions doivent être conservés de façon sécurisée par l’application (et ne pas être stockés dans des fichiers journaux ('log files' en anglais) par exemple).\n- les avis et messages liés aux transactions doivent être envoyés et reçus au sein de l’application (et non par SMS) et conservés de manière sécurisée.\n- le client et le serveur doivent s’identifier au moyen de certificats autorisés et les voies de transmission entre chaque partie doivent être cryptées (cf. 5.2.1.3).\n\nCes indicateurs doivent être marqués « n/a » si une application smartphone n’est pas supportée.","PCI DSS, ISO 27002:2013 Sec. 14.1,\nFlorida uni app review","5.2.2.3.1","Un tiers extérieur sérieux et qualifié a-t-il testé et validé les applications d’argent mobile du prestataire et obtenu la garantie qu’elles sont sécurisées et conformes aux normes de sécurité appropriées ?","1) Documentation relative aux exigences de développement sécurisé ou rapport de tests propre aux smartphones établi par le tiers\n- Vérifier qu’un tiers a été employé afin de tester les applications d’argent mobile des prestataires\n- Vérifier que le tiers est sérieux et qualifié pour tester et valider les applications\n- Vérifier qu’une évaluation a été faite afin d’identifier les normes de sécurité devant être appliquées par le prestataire lors du développement de sa ou ses applications\n- Vérifier que le tiers a certifié la ou les applications comme conformes aux normes de sécurité identifiées",null,"Requis Normal","Requis","TechOps",null,null,"5","5.2","5.2.2","5.2.2: Los proveedores deben garantizar que los sistemas y las aplicaciones estén diseñadas y desarrolladas de forma segura y sean probadas minuciosamente","5.2.2.3","APPS DEL DINERO MÓVIL SEGURAS PARA SMARTPHONES\nLas aplicaciones móviles accesibles a través de redes públicas están especialmente sujetas a una serie de amenazas. Se debe llevar a cabo una revisión de seguridad de la(s) app(s) del dinero móvil para smartphones a fin de garantizar que los controles hayan sido implementados correctamente. También se debe emplear un tercero debidamente calificado y confiable para validar y probar las apps del dinero móvil del proveedor a fin de certificar que sean seguras y cumplan con los estándares de seguridad correspondientes.\n\nLas consideraciones de seguridad para las transacciones de las aplicaciones móviles deben incluir:\n-   No se debe utilizar autenticación del lado del cliente por parte de la app. La información de autenticación del usuario debe ser presentada por la app para cada llamada al sistema.\n-   La app debe contener, de forma segura, las credenciales del usuario y la información de las transacciones (y no deben estar guardadas, por ejemplo, en archivos de registro).\n-   Las notificaciones y los mensajes de transacciones deben ser enviados y recibidos dentro de la app y guardados de forma segura, no vía SMS.\n-   El cliente y el servidor deben identificarse con certificados confiables y las comunicaciones entre todas las partes deben estar encriptadas (ver 5.2.1.3).\n\nMarcar estos indicadores como N/A si no se soporta la app para smartphones.","PCI DSS, ISO 27002:2013 Sec. 14.1,\nFlorida uni app review","5.2.2.3.1","¿Se empleó un tercero calificado y confiable para validar y probar la(s) app(s) del dinero móvil del proveedor a fin de certificar que sean seguras y cumplan con los estándares de seguridad correspondientes?","1) Documentación de requisitos de desarrollo seguro o informe de pruebas de smartphones de terceros\n- Verificar que se haya empleado un tercero para probar la(s) app(s) de dinero móvil del proveedor\n- Verificar que el tercero esté calificado y sea confiable para llevar a cabo la validación y las pruebas\n- Verificar que se haya realizado una evaluación para identificar qué estándares de seguridad son requeridos para la(s) app(s) del proveedor\n- Verificar que el tercero esté certificado con el estándar de seguridad identificado",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.2","5.2.2",null,"5.2.2.3",null,"PCI DSS, ISO 27002:2013 Sec. 14.1,\nFlorida uni app review","5.2.2.3.1",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,"MERGE","5.2.2.3.1","5.2.2.3.2",null,null,{"$error":"#REF!"},{"$error":"#REF!"},"","",{"$error":"#REF!"},{"$error":"#REF!"},"","",2,"",{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,2,""]
[null,"5","5.2","5.2.2","","5.2.2.3",null,0,"5.2.2.3.2","5.2.2.3.2: Is authentication of the mobile money app(s) secure (i.e., no use of client-side authentication; the user's authentication information is presented by the app for every call to the system)?\n",0,0,"Recommended","Recommended","TechOps",{"$f":"CHOOSE(LanguageNumber,BK48,CA48,CQ48,DG48)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.2","","5.2.2.3",null,null,"5.2.2.3.2","5.2.2.3.3","Is authentication of the mobile money app(s) secure (i.e., no use of client-side authentication; the user's authentication information is presented by the app for every call to the system)?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.3",0,0,"5.2.2.3.2","les procédures d’authentification des applications d’argent mobile sont-elles sécurisées (pas d’utilisation de l’authentification coté client, soumission des renseignements d’authentification de l’utilisateur à chaque appel en direction du système) ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.3",null,0,"5.2.2.3.2","¿La autenticación de la(s) app(s) del dinero móvil es segura (es decir, no se utiliza autenticación del lado del cliente; la información de autenticación del usuario es presentada por la app para cada llamada al sistema)?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.2","5.2.2",null,"5.2.2.3",null,0,"5.2.2.3.2",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.2.2.3.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.2","","5.2.2.3",null,0,"5.2.2.3.3","5.2.2.3.3: Are user credentials and transaction information held securely by the mobile money app(s) (and not stored in log files, for example)?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.2","","5.2.2.3",null,null,"5.2.2.3.3","5.2.2.3.4","Are user credentials and transaction information held securely by the mobile money app(s) (and not stored in log files, for example)?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.3",0,0,"5.2.2.3.3","les identifiants des utilisateurs et les renseignements relatifs aux transactions sont-ils conservés de manière sécurisée par la ou les applications du service d’argent mobile (sans être stockés dans des fichiers journaux ('log files' en anglais) par exemple) ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.3",null,0,"5.2.2.3.3","¿Las app(s) del dinero móvil contienen, de forma segura, las credenciales del usuario y la información de las transacciones (y no están guardadas, por ejemplo, en archivos de registro)?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.2","5.2.2",null,"5.2.2.3",null,0,"5.2.2.3.3",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.2.2.3.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.2","","5.2.2.3",null,0,"5.2.2.3.4","5.2.2.3.4: Are transaction notifications and messages sent and received within the mobile money app(s) and stored securely, and not exchanged via SMS?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.2","","5.2.2.3",null,null,"5.2.2.3.4","5.2.2.3.5","Are transaction notifications and messages sent and received within the mobile money app(s) and stored securely, and not exchanged via SMS?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.3",0,0,"5.2.2.3.4","les avis et messages liés aux transactions sont-ils envoyés et reçus au sein de l’application d’argent mobile et conservés de manière sécurisée, et non échangés via SMS ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.3",null,0,"5.2.2.3.4","¿Las notificaciones de transacciones son enviadas y recibidas dentro de la(s) app(s) del dinero móvil y están guardadas de forma segura, y no se intercambian vía SMS?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.2","5.2.2",null,"5.2.2.3",null,0,"5.2.2.3.4",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.2.2.3.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.2","","5.2.2.3",null,0,"5.2.2.3.5","5.2.2.3.5: In mobile money app communication, do client and server identify themselves with trusted certificates and is the communications path between all parties encrypted?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.2","","5.2.2.3",null,null,"5.2.2.3.5","5.2.2.3.6","In mobile money app communication, do client and server identify themselves with trusted certificates and is the communications path between all parties encrypted?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.3",0,0,"5.2.2.3.5","dans le cadre des communications liées à l’application d’argent mobile, le client et le serveur s’identifient-ils au moyen de certificats autorisés et les voies de transmission sont-elles cryptées entre toutes les parties ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.3",null,0,"5.2.2.3.5","En la comunicación con la app del dinero móvil, ¿el cliente y el servidor se identifican con certificados confiables y la ruta de comunicación entre todas las partes está encriptada?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.2","5.2.2",null,"5.2.2.3",null,0,"5.2.2.3.5",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.2.2.3.6",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.2","","5.2.2.4","5.2.2.4: SECURITY TESTING OF NEW MOBILE MONEY SOFTWARE\nProviders should test major changes to software prior to release into production in order to identify any potential security vulnerabilities. Security testing should include all system components involved in providing the mobile money service (application servers, databases, gateways, etc.) and also handset and other terminals such as smartphones and PoS devices. For more information, please refer to security testing in the definitions.\n\nSecurity testing should be part of Operational Acceptance Testing (OAT) in the software release process (refer to 4.5.1.3). \n\nAutomated security testing is a useful tool but is not sufficient to discover all security weaknesses, so manual white-box security testing should also be performed.\n\nSecurity testing should be performed by individuals other than the originating code author. Security testers should be knowledgeable about code-review techniques and secure coding practices. Significant changes should be reviewed by external security experts before release. \n\nSecurity issues should be risk-assessed and higher-risk bugs fixed before software is released to production.","PCI-DSS, ISO 27002:2013 Sec. 14.2 ","5.2.2.4.1","5.2.2.4.1: Is security testing done on all major software changes to the mobile money system prior to release into production?\n","1) Security testing process documentation\n- Check there is a process for security testing of all major software changes.\n- Check the process requires testing to be completed prior to the release into production.",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.2","","5.2.2.4","SECURITY TESTING OF NEW MOBILE MONEY SOFTWARE\nProviders should test major changes to software prior to release into production in order to identify any potential security vulnerabilities. Security testing should include all system components involved in providing the mobile money service (application servers, databases, gateways, etc.) and also handset and other terminals such as smartphones and PoS devices. For more information, please refer to security testing in the definitions.\n\nSecurity testing should be part of Operational Acceptance Testing (OAT) in the software release process (refer to 4.5.1.3). \n\nAutomated security testing is a useful tool but is not sufficient to discover all security weaknesses, so manual white-box security testing should also be performed.\n\nSecurity testing should be performed by individuals other than the originating code author. Security testers should be knowledgeable about code-review techniques and secure coding practices. Significant changes should be reviewed by external security experts before release. \n\nSecurity issues should be risk-assessed and higher-risk bugs fixed before software is released to production.","PCI-DSS, ISO 27002:2013 Sec. 14.2 ","5.2.2.4.1","5.2.2.4.1","Is security testing done on all major software changes to the mobile money system prior to release into production?","1) Security testing process documentation\n- Check there is a process for security testing of all major software changes.\n- Check the process requires testing to be completed prior to the release into production.",null,"Urgent Required","Required","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.4","TESTS DE SÉCURITÉ DES NOUVEAUX LOGICIELS D’ARGENT MOBILE\nLes prestataires doivent tester tous les changements logiciels majeurs avant leur mise en production afin d’identifier toute vulnérabilité éventuelle en matière de sécurité. Les tests de sécurité doivent concerner tous les composants du système utilisés dans l’offre du service d’argent mobile (serveurs d’applications, bases de données, passerelles, etc.) ainsi que les appareils téléphoniques, smartphones et autres terminaux de point de vente (TPV). Pour plus d’informations, se référer à la définition de test de sécurité.\n\nLes tests de sécurité doivent faire partie des tests d’acceptation opérationnelle (OAT) du processus de mise en production des logiciels (cf. 4.5.1.3). \n\nLes tests de sécurité automatisés sont un outil précieux, mais pas suffisant pour révéler toutes les failles de sécurité. Il convient donc de procéder également à des tests de sécurité manuels dits de « boîte blanche ».\n\nLes tests de sécurité doivent être effectués par d’autres personnes que l’auteur du code d’origine. Ces personnes doivent connaître les méthodes d’examen des codes et les pratiques de programmation sécurisée. Les changements importants doivent être examinés par des spécialistes extérieurs avant leur mise en production. \n\nLes problèmes de sécurité doivent faire l’objet d’une évaluation des risques, et les problèmes à plus haut risque doivent être corrigés avant que le logiciel ne soit mis en production.","PCI-DSS, ISO 27002:2013 Sec. 14.2 ","5.2.2.4.1","Les tests de sécurité ont-ils été réalisés sur tous les changements logiciel majeurs apportés au système d'argent mobile avant la mise en production ?","1) Documentation du processus de test de sécurité\n- Vérifier qu’un processus a été mis en place pour procéder à des tests de sécurité sur toutes les modifications significatives des logiciels.\n- Vérifier que le processus inclut l’obligation de finaliser ces tests avant la mise en production des logiciels.",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.4","PRUEBAS DE SEGURIDAD DEL NUEVO SOFTWARE DEL DINERO MÓVIL\nLos proveedores deben probar los cambios importantes al software antes de la puesta en producción a fin de identificar toda vulnerabilidad de seguridad potencial. Las pruebas de seguridad deben incluir todos los componentes del sistema involucrados en la prestación del servicio del dinero móvil (servidores de la aplicación, bases de datos, gateways, etc.), así como también los dispositivos y otros terminales, tales como smartphones y dispositivos PoS. Para más información, por favor consultar las pruebas de seguridad en las definiciones.\n\nLas pruebas de seguridad deben formar parte de las Pruebas de Aceptación Operativa (OAT) en el proceso de lanzamiento del software (ver 4.5.1.3). \n\nLas pruebas de seguridad automáticas son una herramienta útil pero no son suficientes para descubrir todas las debilidades de seguridad, por ende, también se deben realizar pruebas manuales de caja blanca.\n\nLas pruebas de seguridad deben ser realizadas por personas que no sean el autor del código de origen. Las personas encargadas de realizar las pruebas de seguridad deben tener conocimientos acerca de las técnicas de revisión de códigos y prácticas de codificación seguras. Los cambios significativos deben ser revisados antes del lanzamiento por expertos en seguridad externos. \n\nAntes de la puesta en producción del software, se debe realizar una evaluación de riesgos de los problemas de seguridad y se deben corregir las fallas de alto riesgo.","PCI-DSS, ISO 27002:2013 Sec. 14.2 ","5.2.2.4.1","¿Se realizan pruebas de seguridad sobre todos los cambios importantes al software del sistema del dinero móvil antes de su puesta en producción?","1) Documentación del proceso de pruebas de seguridad\n- Verificar que exista un proceso para realizar pruebas de seguridad a todos los cambios importantes al software.\n- Verificar que el proceso requiera que se completen las pruebas antes de la puesta en producción.",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.2","5.2.2",null,"5.2.2.4",null,"PCI-DSS, ISO 27002:2013 Sec. 14.2 ","5.2.2.4.1",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.2.2.4.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.2",{"$f":"CHOOSE(LanguageNumber,AY53,BP53,CF53,CV53)","v":""},"5.2.2.4",null,{"$f":"BB53","v":0},{"$f":"BC53","v":"5.2.2.4.2"},"5.2.2.4.2: Are all security issues risk-assessed and higher-risk bugs fixed before software is released to production?\n",{"$f":"CHOOSE(LanguageNumber,BF53,BV53,CL53,DB53)","v":"1) Security testing process documentation\n- Check that the process requires all security issues to be risk-assessed and higher-risk bugs fixed before software is released to production."},0,{"$f":"CHOOSE(LanguageNumber,BH53,BX53,CN53,DD53)","v":"Standard Required"},{"$f":"CHOOSE(LanguageNumber,BI53,BY53,CO53,DE53)","v":"Required"},"TechOps",{"$f":"CHOOSE(LanguageNumber,BK53,CA53,CQ53,DG53)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.2","","5.2.2.4",null,null,"5.2.2.4.2",{"$f":"DO53","v":"5.2.2.4.4"},"Are all security issues risk-assessed and higher-risk bugs fixed before software is released to production?","1) Security testing process documentation\n- Check that the process requires all security issues to be risk-assessed and higher-risk bugs fixed before software is released to production.",null,"Standard Required","Required","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.4",null,null,{"$f":"BC53","v":"5.2.2.4.2"},"Tous les problèmes de sécurités ont-ils fait l’objet d’une évaluation des risques, et les problèmes à plus haut risque ont-ils été corrigés avant la mise en production du logiciel ?","1) Documentation du processus de test de sécurité\n- Vérifier que le processus inclut l’obligation d’évaluer les risques liés aux problèmes de sécurité et de corriger les bugs présentant les risques les plus élevés avant la mise en production des logiciels.",null,"Requis Normal","Requis","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.4",null,null,"5.2.2.4.2","¿Antes de la puesta en producción del software, se realiza una evaluación de riesgos de los problemas de seguridad y se corrigen las fallas de alto riesgo?","1) Documentación del proceso de pruebas de seguridad\n- Verificar que, antes de la puesta en producción del software, el proceso requiera la realización de una evaluación de riesgos de todos los problemas de seguridad y la corrección de las fallas de alto riesgo.",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.2","5.2.2",null,"5.2.2.4",null,null,"5.2.2.4.2",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.2.2.4.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.2",0,"5.2.2.4",null,0,"5.2.2.4.3","5.2.2.4.3: Does security testing of new software include testing of all system components of mobile money as well as handsets and other terminals (e.g. smartphones, PoS devices)?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.2",null,"5.2.2.4",null,null,"5.2.2.4.3","5.2.2.4.2","Does security testing of new software include testing of all system components of mobile money as well as handsets and other terminals (e.g. smartphones, PoS devices)?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.2","5.2.2",0,"5.2.2.4",0,0,"5.2.2.4.3","est-ce que les tests de sécurité concernent tous les composants du système de l’argent mobile ainsi que les appareils téléphoniques et autres terminaux (ex. smartphones, TPV) ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.2","5.2.2",null,"5.2.2.4",null,0,"5.2.2.4.3","¿Las pruebas de seguridad del software nuevo incluyen pruebas de todos los componentes del sistema del dinero móvil, así como también de los dispositivos y otros terminales (por ej., smartphones, dispositivos PoS)?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.2","5.2.2",null,"5.2.2.4",null,0,"5.2.2.4.3",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.2.2.4.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.2","","5.2.2.4",null,0,"5.2.2.4.4","5.2.2.4.4: Is new software reviewed by individuals other than the originating code author who are knowledgeable about code-review techniques and secure coding practices?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.2","","5.2.2.4",null,null,"5.2.2.4.4","5.2.2.4.3","Is new software reviewed by individuals other than the originating code author who are knowledgeable about code-review techniques and secure coding practices?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.4",0,0,"5.2.2.4.4","les nouveaux logiciels sont-ils examinés par d’autres personnes que l’auteur du code d’origine, et ces personnes sont-elles au fait des méthodes d’examen des codes et des pratiques de programmation sécurisée ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.4",null,0,"5.2.2.4.4","¿El software nuevo es revisado por personas que no sean el autor del código de origen con conocimientos acerca de las técnicas de revisión de códigos y prácticas de codificación seguras?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.2","5.2.2",null,"5.2.2.4",null,0,"5.2.2.4.4",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.2.2.4.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.2","","5.2.2.5","5.2.2.5: REMOVAL OF TEST DATA FROM SOFTWARE\nDevelopment and test accounts and test data should be removed from mobile money software before it is released to production, since these items may give away sensitive information or present back-doors for attackers.\n\nDevelopment code or compilers should also be removed from software before it is released into the live mobile money system.\n\nActual customer data should be anonymised if it is used in development or test environments (see also 8.1.1.9).","PCI-DSS, ISO 27002:2013 Sec. 14.3 ","5.2.2.5.1","5.2.2.5.1: Are development and test accounts and test data removed from mobile money software before it is released to production?\n","1) User acceptance testing specification\n- Check that there is a process to remove all test accounts and test data from the mobile money system  software prior to its release to production",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.2","","5.2.2.5","REMOVAL OF TEST DATA FROM SOFTWARE\nDevelopment and test accounts and test data should be removed from mobile money software before it is released to production, since these items may give away sensitive information or present back-doors for attackers.\n\nDevelopment code or compilers should also be removed from software before it is released into the live mobile money system.\n\nActual customer data should be anonymised if it is used in development or test environments (see also 8.1.1.9).","PCI-DSS, ISO 27002:2013 Sec. 14.3 ","5.2.2.5.1","5.2.2.5.1","Are development and test accounts and test data removed from mobile money software before it is released to production?","1) User acceptance testing specification\n- Check that there is a process to remove all test accounts and test data from the mobile money system  software prior to its release to production",null,"Standard Required","Required","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.5","SUPPRESSION DES DONNÉES DE TEST\nLes comptes de développement et de test et les données de test doivent être supprimés des logiciels du service d’argent mobile avant leur mise en production, car ces éléments pourraient laisser échapper des informations sensibles ou offrir une porte d’entrée à d'éventuelles attaques.\n\nLe code de développement ou compilateur doit également être supprimé dans le logiciel avant sa mise en production dans le système opérationnel du service d’argent mobile.\n\nLes données de clients réels utilisées dans les environnements de développement ou de test doivent être rendues anonymes au préalable (voir également 8.1.1.9).","PCI-DSS, ISO 27002:2013 Sec. 14.3 ","5.2.2.5.1","les comptes de développement et de test et les données de test sont-ils supprimés des logiciels de l’argent mobile avant leur mise en production ?","1) Spécification des tests d’acceptation par les utilisateurs\n- Vérifier qu’un processus a été mis en place pour supprimer l’ensemble des comptes de test et des données de test des logiciels du système d’argent mobile avant leur mis en production",null,"Requis Normal","Requis","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.5","ELIMINACIÓN DE LOS DATOS DE PRUEBAS DEL SOFTWARE\nLas cuentas de desarrollo y de pruebas y los datos de las pruebas deben ser eliminados del software del dinero móvil antes de la puesta en producción, dado que estos podrían dar a conocer información sensible o presentar puertas abiertas para los atacantes.\n\nTambién se deben eliminar del software los códigos de desarrollo o compiladores antes de la puesta en producción en el sistema del dinero móvil.\n\nLos datos de los clientes reales deben ser anonimizados si son utilizados en los entornos de desarrollo o pruebas (ver 8.1.1.9).","PCI-DSS, ISO 27002:2013 Sec. 14.3 ","5.2.2.5.1","¿Las cuentas de desarrollo y de pruebas y los datos de las pruebas son eliminados del software del dinero móvil antes de su puesta en producción?","1) Especificación de las pruebas de aceptación del usuario \n- Verificar que exista un proceso para eliminar todas las cuentas de pruebas y los datos de las pruebas del software del sistema del dinero móvil antes de su puesta en producción.",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.2","5.2.2",null,"5.2.2.5",null,"PCI-DSS, ISO 27002:2013 Sec. 14.3 ","5.2.2.5.1",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.2.2.5.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.2","","5.2.2.5",null,0,"5.2.2.5.2","5.2.2.5.2: Are all development code and compilers removed from software before it is released into the live mobile money system?\n","1) User acceptance testing specification\n- Check that there is a process to remove all code and compliers from the mobile money system  software prior to its release to production",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.2","","5.2.2.5",null,null,"5.2.2.5.2","5.2.2.5.2","Are all development code and compilers removed from software before it is released into the live mobile money system?","1) User acceptance testing specification\n- Check that there is a process to remove all code and compliers from the mobile money system  software prior to its release to production",null,"Standard Required","Required","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.5",0,0,"5.2.2.5.2","les codes de développement et compilateurs sont-ils tous supprimés du logiciel avant la mise en production de celui-ci dans le système opérationnel de l’argent mobile ?","1) Spécification des tests d’acceptation par les utilisateurs\n- Vérifier qu’un processus a été mis en place pour supprimer l’ensemble des codes et des compilateurs des logiciels du système d’argent mobile avant leur mis en production",null,"Requis Normal","Requis","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.5",null,0,"5.2.2.5.2","¿Se eliminan del software todos los códigos de desarrollo o compiladores antes de la puesta en producción en el sistema del dinero móvil?","1) Especificación de las pruebas de aceptación del usuario \n- Verificar que exista un proceso para eliminar todos los códigos y compiladores del software del sistema del dinero móvil antes de su puesta en producción.",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.2","5.2.2",null,"5.2.2.5",null,0,"5.2.2.5.2",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.2.2.5.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.2","","5.2.2.5",null,0,"5.2.2.5.3","5.2.2.5.3: If actual customer data is used in development or test environments, is it anonymised ?\n","1) User acceptance testing specification\n- Check that there is a process to anonymise customer data if it is used in the development or test environments\n[Mark as N/A if customer data is not used for development/test purposes]",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.2","","5.2.2.5",null,null,"5.2.2.5.3","5.2.2.5.3","If actual customer data is used in development or test environments, is it anonymised ?","1) User acceptance testing specification\n- Check that there is a process to anonymise customer data if it is used in the development or test environments\n[Mark as N/A if customer data is not used for development/test purposes]",null,"Standard Required","Required","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.5",0,0,"5.2.2.5.3","les données de clients réels utilisées dans les environnements de développement ou de test sont-elles rendues anonymes au préalable ?","1) Spécification des tests d’acceptation par les utilisateurs\n- Vérifier qu’un processus a été mis en place pour rendre anonymes les données de clients utilisées dans les environnements de développement ou de test\n\n[Indiquez la mention n/d pour cet indicateur si les données de clients ne sont pas utilisées à des fins de développement ou de test]",null,"Requis Normal","Requis","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.5",null,0,"5.2.2.5.3","¿Los datos de los clientes reales son anonimizados cuando se utilizan en los entornos de desarrollo o pruebas?","1) Especificación de las pruebas de aceptación del usuario\n- Verificar que exista un proceso para anonimizar los datos de los clientes cuando se utilizan en los entornos de desarrollo o pruebas \n[Marcar como N/A si los datos de los clientes no se utilizan con fines de desarrollo/pruebas]",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.2","5.2.2",null,"5.2.2.5",null,0,"5.2.2.5.3",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.2.2.5.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.2","","5.2.2.6","5.2.2.6: VENDOR SOFTWARE VERSIONS AND SECURITY PATCHES\nVendor-supplied software used in the mobile money system should be maintained at a level supported by the supplier. In particular, security patches should be applied promptly.\n\nSecurity patches should be implemented as soon as possible after they  are released by vendors. Critical security patches should be installed within 30 days, and other lower-risk patches should be installed within 2-3 months. \n\nAny decision to upgrade to a new release should take into account the security of the release, including:\n- the introduction of new information security functionality; and\n- the number and severity of information security problems affecting the new release.\n\nSecurity patches should be implemented on all mobile money components, including:\n - infrastructure components (routers, gateways, etc.); and\n - application components (accounting system, middleware, etc.).","PCI DSS, ISO 27002: 2013 Sec. 12.5, 14.1 ","5.2.2.6.1","5.2.2.6.1: Are critical security patches from vendors prioritized and installed within one month of release on mobile money infrastructure components (routers, gateways, etc.)?\n","1) Security Operations Manual or Technical Operations documentation\n- Check that there is a process for critical security patches from vendors to be installed on the mobile money infrastructure components\n- Check that infrastructure patches are installed within a month of release\n",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.2","","5.2.2.6","VENDOR SOFTWARE VERSIONS AND SECURITY PATCHES\nVendor-supplied software used in the mobile money system should be maintained at a level supported by the supplier. In particular, security patches should be applied promptly.\n\nSecurity patches should be implemented as soon as possible after they  are released by vendors. Critical security patches should be installed within 30 days, and other lower-risk patches should be installed within 2-3 months. \n\nAny decision to upgrade to a new release should take into account the security of the release, including:\n- the introduction of new information security functionality; and\n- the number and severity of information security problems affecting the new release.\n\nSecurity patches should be implemented on all mobile money components, including:\n - infrastructure components (routers, gateways, etc.); and\n - application components (accounting system, middleware, etc.).","PCI DSS, ISO 27002: 2013 Sec. 12.5, 14.1 ","5.2.2.6.1",{"$f":"DO59","v":"5.2.2.6.1"},"Are critical security patches from vendors prioritized and installed within one month of release on mobile money infrastructure components (routers, gateways, etc.)?","1) Security Operations Manual or Technical Operations documentation\n- Check that there is a process for critical security patches from vendors to be installed on the mobile money infrastructure components\n- Check that infrastructure patches are installed within a month of release\n",null,"Standard Required","Required","TechOps",null,null,"5","5.2","5.2.2","",{"$f":"$AZ59","v":"5.2.2.6"},"VERSIONS DES LOGICIELS EXTÉRIEURS ET CORRECTIFS DE SÉCURITÉ \nLes logiciels extérieurs utilisés dans le système de l’argent mobile doivent être tenus à jour au niveau suivi par le fournisseur. Les correctifs de sécurité doivent notamment être appliqués dans les meilleurs délais. \n\nLes correctifs de sécurité doivent être installés dès leur mise à disposition par les fournisseurs. Les correctifs de sécurité essentiels doivent être installés dans un délai de 30 jours et les correctifs à risque plus bas doivent être installés dans un délai de 2 à 3 mois.\n\nToute décision de passer à une nouvelle version du logiciel doit tenir compte de la sécurité de cette version, et notamment : \n- de l’introduction de nouvelles fonctionnalités de sécurité de l'information ;\n- du nombre et de la gravité des problèmes de sécurité de l'information affectant la nouvelle version.\n\nLes correctifs de sécurité doivent être mis en œuvre sur l’ensemble des composants du système de l’argent mobile, et notamment : \n- les composants d’infrastructure (routeurs, passerelles, etc.) ;\n- les composants d'applications (système comptable, logiciel médiateurs, etc.).\n","PCI DSS, ISO 27002: 2013 Sec. 12.5, 14.1 ","5.2.2.6.1","les correctifs de sécurité critiques en provenance de fournisseurs ont-ils priorité et sont-ils installés dans un délai d’un mois suivant leur mise à disposition sur les composants de l’infrastructure du service d’argent mobile (routeurs, passerelles, etc.) ?","1) Manuel des opérations de sécurité ou Documentation relative aux opérations techniques\r\n- Vérifier qu’un processus a été mis en place pour installer les correctifs de sécurité critiques en provenance des vendeurs sur les composants de l’infrastructure du service d’argent mobile\n\r- Vérifier que les correctifs de l’infrastructure sont installés dans un délai d’un mois suivant leur mise à disposition\r",null,"Requis Normal","Requis","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.6","VERSIONES DE SOFTWARE DE PROVEEDORES Y PARCHES DE SEGURIDAD\nEl software suministrado por proveedores utilizado en el sistema del dinero móvil se debe mantener a un nivel soportado por el proveedor. En particular, se deben aplicar parches de seguridad de inmediato.\n\nLos parches de seguridad deben ser implementados tan pronto como sea posible después de su lanzamiento por parte de los proveedores. Los parches de seguridad críticos deben ser instalados dentro de los 30 días, y los demás parches de bajo riesgo deben ser instalados dentro de los 2-3 meses. \n\nToda decisión de actualizar a una nueva versión debe tener en cuenta la seguridad de la misma, incluyendo:\n- la introducción de las nuevas funcionalidades de seguridad de la información; y \n- la cantidad y severidad de los problemas de seguridad de la información que afectan a la nueva versión.\n\nLos parches de seguridad deben ser implementados en todos los componentes del dinero móvil, incluyendo:\n - componentes de infraestructura (routers, gateways, etc.); y\n - componentes de aplicaciones (sistema contable, middleware, etc.)","PCI DSS, ISO 27002: 2013 Sec. 12.5, 14.1 ",{"$f":"$BC59","v":"5.2.2.6.1"},"¿Los parches de seguridad críticos de los proveedores se priorizan e instalan dentro del mes de su lanzamiento en los componentes de infraestructura del dinero móvil (routers, gateways, etc.)?","1) Manual de Operaciones de Seguridad o documentación de Operaciones Técnicas\n- Verificar que exista un proceso para la instalación de los parches de seguridad críticos de los proveedores en los componentes de infraestructura del dinero móvil\n- Verificar que los parches de infraestructura sean instalados dentro del mes de su lanzamiento\n",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.2","5.2.2",null,{"$f":"$AZ59","v":"5.2.2.6"},null,"PCI DSS, ISO 27002: 2013 Sec. 12.5, 14.1 ",{"$f":"$BC59","v":"5.2.2.6.1"},null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.2.2.6.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.2","","5.2.2.6",null,0,"5.2.2.6.2","5.2.2.6.2: Are critical security patches from vendors prioritized and installed within one month of release on mobile money application components (accounting system, middleware, etc.)?\n","1) Security Operations Manual or Technical Operations documentation\n- Check that there is a process for critical security patches from vendors to be installed on the mobile money application components\n- Check that application patches are installed within a month of release\n",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.2","","5.2.2.6",null,null,"5.2.2.6.2","5.2.2.6.2","Are critical security patches from vendors prioritized and installed within one month of release on mobile money application components (accounting system, middleware, etc.)?","1) Security Operations Manual or Technical Operations documentation\n- Check that there is a process for critical security patches from vendors to be installed on the mobile money application components\n- Check that application patches are installed within a month of release\n",null,"Standard Required","Required","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.6",0,0,"5.2.2.6.2","les correctifs de sécurité critiques en provenance de fournisseurs ont-ils priorité et sont-ils installés dans un délai d’un mois de leur mise à disposition sur les composants des applications d’argent mobile (système comptable, logiciel médiateurs, etc.) ?","1) Manuel des opérations de sécurité ou Documentation relative aux opérations techniques\n- Vérifier qu’un processus a été mis en place pour installer les correctifs de sécurité critiques en provenance des vendeurs sur les composants des applications d’argent mobile\n- Vérifier que les correctifs des applications sont installés dans un délai d’un mois suivant leur mise à disposition\n",null,"Requis Normal","Requis","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.6",null,0,"5.2.2.6.2","¿Los parches de seguridad críticos de los proveedores se priorizan e instalan dentro del mes de su lanzamiento en los componentes de las aplicaciones del dinero móvil (sistema contable, middleware, etc.)?","1) Manual de Operaciones de Seguridad o documentación de Operaciones Técnicas\n- Verificar que exista un proceso para la instalación de los parches de seguridad críticos de los proveedores en los componentes de las aplicaciones del dinero móvil\n- Verificar que los parches de las aplicaciones sean instalados dentro del mes de su lanzamiento\n",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.2","5.2.2",null,"5.2.2.6",null,0,"5.2.2.6.2",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.2.2.6.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.2","","5.2.2.6",null,0,"5.2.2.6.3","5.2.2.6.3: Are all other lower-risk vendor-supplied security patches installed within an appropriate time frame - i.e. within three months?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.2","","5.2.2.6",null,null,"5.2.2.6.3","5.2.2.6.3","Are all other lower-risk vendor-supplied security patches installed within an appropriate time frame - i.e. within three months?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.6",0,0,{"$f":"BC61","v":"5.2.2.6.3"},"les correctifs de sécurité moins urgents sont-ils installés dans un délai approprié, à savoir 2 à 3 mois ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.6",null,0,"5.2.2.6.3","¿Los demás parches de seguridad de bajo riesgo suministrados por los proveedores son instalados dentro del marco de tiempo correspondiente, es decir, dentro de tres meses?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.2","5.2.2",null,"5.2.2.6",null,0,"5.2.2.6.3",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.2.2.6.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.2","5.2.2","","5.2.2.6",null,0,"5.2.2.6.4","5.2.2.6.4: Does the decision whether to upgrade to a new release of vendor software consider both the introduction of new information security functionality and the number and severity of information security problems affecting the new release?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.2","5.2.2","","5.2.2.6",null,null,"5.2.2.6.4","5.2.2.6.4","Does the decision whether to upgrade to a new release of vendor software consider both the introduction of new information security functionality and the number and severity of information security problems affecting the new release?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.6",0,{"$f":"BB62","v":0},"5.2.2.6.4","la décision de passer à une nouvelle version d’un logiciel extérieur tient-elle compte de l’introduction de nouvelles fonctionnalités de sécurité de l’information ainsi que du nombre et de la gravité des problèmes de sécurité de l’information affectant la nouvelle version ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.2","5.2.2","","5.2.2.6",null,0,"5.2.2.6.4","¿La decisión de actualizar a una versión nueva del software del proveedor considera la introducción de nuevas funcionalidades de seguridad de la información y la cantidad y severidad de los problemas de seguridad de la información que afectan a la nueva versión?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.2","5.2.2",null,"5.2.2.6",null,{"$f":"BB62","v":0},"5.2.2.6.4",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.2.2.6.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5",0,0,{"$f":"UPPER(CONCATENATE(Introduction!C27,\": \",Introduction!D27))","v":"5.3: SECURITY OPERATIONS "},null,null,null,null,{"$f":"Introduction!E27","v":"Providers shall implement processes to manage all systems and operations securely "},null,null,null,null,null,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5",null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$27,\": \",Introduction!$L$27))","v":"5.3: SECURITY OPERATIONS "},null,null,null,null,null,{"$f":"Introduction!$M$27","v":"Providers shall implement processes to manage all systems and operations securely "},null,null,null,null,0,null,null,"5",0,0,null,0,null,0,0,"",null,null,null,null,0,null,null,"5",0,0,{"$f":"UPPER(CONCATENATE(Introduction!$U$27,\": \",Introduction!$V$27))","v":"5.3: OPERACIONES DE SEGURIDAD "},null,null,{"$f":"BC63","v":0},0,{"$f":"Introduction!W27","v":"El proveedor implementará procesos para gestionar todos los sistemas y operaciones de forma segura "},null,null,null,null,0,null,null,"5",0,0,null,0,null,0,0,null,null,null,null,null,0]
[null,"5","5.3","5.3.1",{"$f":"CHOOSE(LanguageNumber,AY64,BP64,CF64,CV64)","v":"5.3.1: Providers shall identify and assess security risks prior to offering mobile money services and shall continue to monitor such risks on an ongoing basis."},"5.3.1.1",{"$f":"AZ64&\": \"&CHOOSE(LanguageNumber,BA64,BR64,CH64,CX64)","v":"5.3.1.1: SECURITY RISK MANAGEMENT\nProviders should establish an Information Security Risk Management process and deploy sufficient resources to implement it. Security risks should be assessed at least annually, following a significant change in infrastructure or operating systems, and when new threats or vulnerabilities have been identified.\n\nSecurity risk assessments should be applied to all information systems and processes delivering the mobile money service (both internal and 3rd party). "},{"$f":"BB64","v":"ISO 27005: 2011, \nPCI DSS, \nECB RSMP"},{"$f":"BC64","v":"5.3.1.1.1"},{"$f":"BC64&\": \"&CHOOSE(LanguageNumber,BE64,BU64,CK64,DA64)&CarriageReturn","v":"5.3.1.1.1: Has an information security risk management process been documented?\n"},{"$f":"CHOOSE(LanguageNumber,BF64,BV64,CL64,DB64)","v":"1) Information security risk management process and security risk register\n- Check that the security risk management process has been documented. \nNote that security risk management could be done either at operator-level or at group level\n"},{"$f":"CHOOSE(LanguageNumber,BG64,BW64,CM64,DC64)","v":0},{"$f":"CHOOSE(LanguageNumber,BH64,BX64,CN64,DD64)","v":"Standard Required"},{"$f":"CHOOSE(LanguageNumber,BI64,BY64,CO64,DE64)","v":"Required"},"TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.1","5.3.1: Providers shall identify and assess security risks prior to offering mobile money services and shall continue to monitor such risks on an ongoing basis.","5.3.1.1","SECURITY RISK MANAGEMENT\nProviders should establish an Information Security Risk Management process and deploy sufficient resources to implement it. Security risks should be assessed at least annually, following a significant change in infrastructure or operating systems, and when new threats or vulnerabilities have been identified.\n\nSecurity risk assessments should be applied to all information systems and processes delivering the mobile money service (both internal and 3rd party). ","ISO 27005: 2011, \nPCI DSS, \nECB RSMP","5.3.1.1.1","5.3.1.1.1","Has an information security risk management process been documented?","1) Information security risk management process and security risk register\n- Check that the security risk management process has been documented. \nNote that security risk management could be done either at operator-level or at group level\n",null,"Standard Required","Required","TechOps",null,null,"5","5.3","5.3.1","5.3.1: Les prestataires doivent identifier et évaluer les risques en matière de sécurité avant d’offrir des services d’argent mobile et doivent surveiller ces risques de façon continue.","5.3.1.1","GESTION DES RISQUES LIÉS À LA SÉCURITÉ\nLes prestataires doivent mettre en place une procédure de gestion des risques liés à la sécurité de l’information et se doter de ressources suffisantes pour la mettre en œuvre. Les risques liés à la sécurité doivent être évalués au moins une fois par an, après tout changement significatif dans l’infrastructure ou les systèmes opérationnels et lorsque de nouvelles menaces ou vulnérabilités sont identifiées.\n\nL’évaluation des risques liés à la sécurité doit concerner l’ensemble des systèmes informatiques et des processus liés à l’offre de l’argent mobile (en interne et chez des tiers).","ISO 27005: 2011, \nPCI DSS, \nECB RSMP","5.3.1.1.1","existe-t-il une procédure documentée de gestion des risques liés à la sécurité ?","1) Processus de gestion des risques liés à la sécurité de l’information et registre des risques liés à la sécurité\n- Vérifier que le processus de gestion des risques liés à la sécurité est documenté. \nRemarque : la gestion des risques liés à la sécurité peut être effectuée au niveau de l’opérateur ou au niveau du groupe\n",null,{"$f":"VLOOKUP($BH64,CategoryTranslationTable,2,FALSE)","v":"Requis Normal"},{"$f":"VLOOKUP($BI64,CategoryTranslationTable,2,FALSE)","v":"Requis"},"TechOps",null,null,"5","5.3","5.3.1","5.3.1: Los proveedores deben identificar y evaluar los riesgos a la seguridad antes de ofrecer los servicios del dinero móvil y deben continuar monitoreando estos riesgos de forma continua.","5.3.1.1","GESTIÓN DE RIESGOS A LA SEGURIDAD\nLos proveedores deben establecer un proceso de Gestión de Riesgos a la Seguridad de la Información e implantar los recursos suficientes para implementarlo. Se deben evaluar los riesgos a la seguridad, al menos, una vez al año, después de un cambio significativo en la estructura o en los sistemas operativos, y cuando se identificaron nuevas amenazas o vulnerabilidades.\n\nLas evaluaciones de riesgos a la seguridad se deben aplicar a todos los sistemas y procesos informáticos que prestan el servicio del dinero móvil (internos y de terceros). ",{"$f":"BB64","v":"ISO 27005: 2011, \nPCI DSS, \nECB RSMP"},"5.3.1.1.1","¿Se documentó un proceso de gestión de riesgos a la seguridad de la información?","1) Proceso de gestión de riesgos a la seguridad de la información y registro de riesgos de seguridad\n- Verificar que se haya documentado el proceso de gestión de riesgos a la seguridad. \nNótese que la gestión de riesgos a la seguridad puede realizarse a nivel de los operadores o a nivel del grupo\n",null,{"$f":"VLOOKUP($BH64,CategoryTranslationTable,3,FALSE)","v":"Obligatorio estándar"},{"$f":"VLOOKUP($BI64,CategoryTranslationTable,3,FALSE)","v":"Obligatorio"},"TechOps",null,null,"5","5.3","5.3.1",null,"5.3.1.1",null,"ISO 27005: 2011, \nPCI DSS, \nECB RSMP","5.3.1.1.1",null,null,null,{"$f":"VLOOKUP($BH64,CategoryTranslationTable,4,FALSE)","v":"ReqS4"},{"$f":"VLOOKUP($BI64,CategoryTranslationTable,4,FALSE)","v":"Req4"},"TechOps",null,null,null,null,null,null,null,null,"5.3.1.1.1",null,null,null,{"$f":"IF(OR($EA64=0,$EA64=2),VLOOKUP(DO64,INDIRECT(ED64),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP64),\"\",VLOOKUP(DP64,INDIRECT(EE64),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ64),\"\",VLOOKUP(DQ64,INDIRECT(EF64),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR64),\"\",VLOOKUP(DR64,INDIRECT(EG64),7,FALSE))","v":""},{"$f":"IF(OR($EA64=0,$EA64=2),VLOOKUP(DO64,INDIRECT(ED64),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP64),\"\",VLOOKUP(DP64,INDIRECT(EE64),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ64),\"\",VLOOKUP(DQ64,INDIRECT(EF64),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR64),\"\",VLOOKUP(DR64,INDIRECT(EG64),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN64,3)=\"NEW\")+2*AND(LEFT(DN64,3)=\"MER\")+3*AND(LEFT(DN64,3)=\"MOV\")+4*AND(LEFT(DN64,3)=\"SWA\")","v":0},{"$error":"#REF!"},{"$f":"IF(EA64=0,IF(DW64=0,\"\",DW64),CHOOSE(EA64,\"New indicator\",CONCATENATE(DW64,CarriageReturn,DX64,CarriageReturn,DY64,CarriageReturn,DZ64)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO64,1)","v":"OriginalComplianceP5"},{"$f":"\"OriginalComplianceP\"&LEFT(DP64,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ64,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR64,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,""]
[null,"5","5.3","5.3.1",0,"5.3.1.1",null,0,"5.3.1.1.2","5.3.1.1.2: Are security risks assessed at least annually, following a significant change to the mobile money system, and when new threats or vulnerabilities have been identified?\n","1) Information security risk management process\n- Check that security risk assessments are carried out at least annually.\n- Check that the date of the last documented risk assessment has occurred in the last 12 months.\n",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.1",null,"5.3.1.1",null,null,"5.3.1.1.2","5.3.1.1.2","Are security risks assessed at least annually, following a significant change to the mobile money system, and when new threats or vulnerabilities have been identified?","1) Information security risk management process\n- Check that security risk assessments are carried out at least annually.\n- Check that the date of the last documented risk assessment has occurred in the last 12 months.\n",null,"Standard Required","Required","TechOps",null,null,"5","5.3","5.3.1",0,"5.3.1.1",0,0,"5.3.1.1.2","les risques liés à la sécurité sont-ils évalués au moins une fois par an, après tout changement significatif dans le système de l’argent mobile, et lorsque de nouvelles menaces ou vulnérabilités sont identifiées ?","1) Processus de gestion des risques liés à la sécurité de l’information\n- Vérifier que les risques liés à la sécurité sont évalués au moins une fois par an.\n- Vérifier que la dernière évaluation des risques documentée a été effectuée au cours des 12 derniers mois.\n",null,"Requis Normal","Requis","TechOps",null,null,"5","5.3","5.3.1",null,"5.3.1.1",null,0,"5.3.1.1.2","¿Los riesgos a la seguridad son evaluados, al menos, una vez al año, después de un cambio significativo al sistema del dinero móvil, y cuando se identificaron nuevas amenazas o vulnerabilidades?","1) Proceso de gestión de riesgos a la seguridad de la información\n- Verificar que las evaluaciones de riesgos a la seguridad se lleven a cabo, al menos, una vez al año\n- Verificar que la fecha de la última evaluación de riesgos documentada esté dentro de los últimos 12 meses.\n\n",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.3","5.3.1",null,"5.3.1.1",null,0,"5.3.1.1.2",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.1.1.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.1",0,"5.3.1.2","5.3.1.2: OBTAIN INFORMATION ABOUT KNOWN SECURITY RISKS\nProviders should establish a process to identify security vulnerabilities, using reputable outside sources for security vulnerability information.\n\nProviders should keep up to date with new vulnerabilities that may impact their environment. Sources for vulnerability information should be trustworthy and may include (among others) vendor websites, industry news groups, mailing lists, or RSS feeds.","PCI DSS, ISO 27002: 2013 Sec. 14.1 ","5.3.1.2.1","5.3.1.2.1: Are processes in place to identify new security vulnerabilities using information from reputable outside sources?\n","1) Information security risk management process\n- Check that there is a process to identify new security vulnerabilities\n- Check that the process includes information from reputable outside sources ",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.1",null,"5.3.1.2","OBTAIN INFORMATION ABOUT KNOWN SECURITY RISKS\nProviders should establish a process to identify security vulnerabilities, using reputable outside sources for security vulnerability information.\n\nProviders should keep up to date with new vulnerabilities that may impact their environment. Sources for vulnerability information should be trustworthy and may include (among others) vendor websites, industry news groups, mailing lists, or RSS feeds.","PCI DSS, ISO 27002: 2013 Sec. 14.1 ","5.3.1.2.1","5.3.1.2.1","Are processes in place to identify new security vulnerabilities using information from reputable outside sources?","1) Information security risk management process\n- Check that there is a process to identify new security vulnerabilities\n- Check that the process includes information from reputable outside sources ",null,"Urgent Required","Required","TechOps",null,null,"5","5.3","5.3.1",0,"5.3.1.2","INFORMATIONS RELATIVES AUX RISQUES CONNUS EN MATIÈRE DE SÉCURITÉ\nLes prestataires doivent mettre en place une procédure d’identification des vulnérabilités en matière de sécurité en utilisant des sources extérieures fiables dans ce domaine.\n\nLes prestataires doivent se tenir au courant des nouvelles vulnérabilités susceptibles d’avoir un impact sur leur environnement. Les sources d’informations relatives aux vulnérabilités doivent être fiables et peuvent inclure (entre autres) des sites internet de prestataires extérieurs, des groupements d’informations professionnelles, des listes de diffusion d’actualités ou des flux RSS. \n","PCI DSS, ISO 27002: 2013 Sec. 14.1 ","5.3.1.2.1","existe-t-il une procédure d’identification des nouvelles vulnérabilités en matière de sécurité au moyen de sources extérieures fiables ?","1) Processus de gestion des risques liés à la sécurité de l’information\n- Vérifier qu’un processus a été mis en place pour identifier les nouvelles vulnérabilités en matière de sécurité\n- Vérifier que ce processus inclut des informations provenant de sources extérieures fiables ",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.3","5.3.1",null,"5.3.1.2","OBTENER INFORMACIÓN ACERCA DE LOS RIESGOS A LA SEGURIDAD CONOCIDOS\nLos proveedores deben establecer un proceso para identificar las vulnerabilidades a la seguridad, utilizando información de vulnerabilidades a la seguridad de fuentes externas acreditadas.\n\nLos proveedores deben mantenerse actualizados con las nuevas vulnerabilidades que podrían impactar el entorno. Las fuentes de información de vulnerabilidades deben ser confiables y pueden incluir (entre otras) los sitios web de los proveedores, grupos de novedades de la industria, listas de correos electrónicos, o feed RSS.","PCI DSS, ISO 27002: 2013 Sec. 14.1 ","5.3.1.2.1","¿Se implementaron procesos para identificar nuevas vulnerabilidades a la seguridad utilizando información de fuentes externas acreditadas?","1) Proceso de gestión de riesgos a la seguridad de la información\n- Verificar que exista un proceso para identificar nuevas vulnerabilidades a la seguridad\n- Verificar que el proceso incluya información de fuentes externas acreditadas ",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.3","5.3.1",null,"5.3.1.2",null,"PCI DSS, ISO 27002: 2013 Sec. 14.1 ","5.3.1.2.1",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.1.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.1","","5.3.1.3","5.3.1.3: SECURITY RISK MANAGEMENT PROCESS\nSecurity risk assessments should be conducted to identify new risks and evaluate their severity. They should also re-evaluate risks that were reviewed in the previous risk assessment. \n\nThe severity of each risk should be assessed by evaluating the risk's impact (if it materialised) and likelihood of materialising. Examples of types of impact include:\n- Impairment of operations or service availability;\n- Loss of integrity of financial data;\n- Loss of financial value;\n- Damage to reputation;\n- Breaches of legal/ regulatory requirements;\n- Loss of customer confidentiality.\n\nThe security risk management process should identify controls that are in place or which could be implemented to reduce the severity of the risk by reducing the impact and/or likelihood. Actions should be identified to manage each risk, such as treating the risk by applying additional controls or deciding to tolerate the level of risk. The decision to tolerate risks should be confirmed at the appropriate level of management, and the justification should be documented.","ISO 27005: 2011, \nPCI DSS, \nECB RSMP","5.3.1.3.1","5.3.1.3.1: Do security risk assessments evaluate both new risks and previously-assessed risks?\n","1) Information security risk management process\n- Check that the security risk assessments evaluate new risk and previously -assessed risk\n- Check that there is a populated risk register",0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.1","","5.3.1.3","SECURITY RISK MANAGEMENT PROCESS\nSecurity risk assessments should be conducted to identify new risks and evaluate their severity. They should also re-evaluate risks that were reviewed in the previous risk assessment. \n\nThe severity of each risk should be assessed by evaluating the risk's impact (if it materialised) and likelihood of materialising. Examples of types of impact include:\n- Impairment of operations or service availability;\n- Loss of integrity of financial data;\n- Loss of financial value;\n- Damage to reputation;\n- Breaches of legal/ regulatory requirements;\n- Loss of customer confidentiality.\n\nThe security risk management process should identify controls that are in place or which could be implemented to reduce the severity of the risk by reducing the impact and/or likelihood. Actions should be identified to manage each risk, such as treating the risk by applying additional controls or deciding to tolerate the level of risk. The decision to tolerate risks should be confirmed at the appropriate level of management, and the justification should be documented.","ISO 27005: 2011, \nPCI DSS, \nECB RSMP","5.3.1.3.1","5.3.1.3.1","Do security risk assessments evaluate both new risks and previously-assessed risks?","1) Information security risk management process\n- Check that the security risk assessments evaluate new risk and previously -assessed risk\n- Check that there is a populated risk register",null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.1","","5.3.1.3","PROCÉDURE DE GESTION DES RISQUES LIÉS À LA SÉCURITÉ\nDes évaluations des risques liés à la sécurité doivent être réalisées pour identifier les nouveaux risques et évaluer leur gravité. Ces évaluations doivent également réévaluer les risques examinés dans les évaluations antérieures. \n\nLa gravité de chaque risque doit être mesurée en évaluant l’impact du risque (s’il se concrétise) et la probabilité de sa concrétisation. Les types d’impact peuvent inclure :\n- atteinte au fonctionnement ou à la disponibilité du service ; \n- atteinte à l’intégrité des données financières ;\n- perte financière ;\n- atteinte à la réputation ;\n- infractions légales/réglementaires ; \n- atteinte à la confidentialité des informations relatives aux clients.\n\nLa procédure de gestion des risques liés à la sécurité doit recenser les mesures de contrôle en place ou devant être appliquées pour réduire la gravité du risque en réduisant son impact et/ou sa probabilité. Des actions doivent également être répertoriées pour la gestion de chaque risque, comme par exemple traiter le risque au moyen de mesures de contrôle supplémentaires ou décider de tolérer ce niveau de risque. La décision de tolérer des risques doit être approuvée au niveau hiérarchique approprié et sa justification doit être documentée.","ISO 27005: 2011, \nPCI DSS, \nECB RSMP","5.3.1.3.1","les évaluations des risques liés à la sécurité analysent-elles à la fois les nouveaux risques et les risques précédemment examinés ?","1) Procédure de gestion des risques liés à la sécurité de l’information\n- Vérifier que les évaluations des risques liés à la sécurité analysent à la fois les nouveaux risques et des risques précédemment examinés.\n- Vérifier qu’un registre des risques est maintenu.",null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.1","","5.3.1.3","PROCESO DE GESTIÓN DE RIESGOS A LA SEGURIDAD\nSe deben realizar evaluaciones de riesgos a la seguridad para identificar nuevos riesgos y evaluar su severidad. También se debe reevaluar los riesgos revisados en la evaluación de riesgos anterior. \n\nSe debe evaluar la severidad de cada riesgo evaluando el impacto del riesgo (si se materializara) y la probabilidad de que se materialice. Los ejemplos de tipos de impacto incluyen:\n- Afectación de las operaciones o de la disponibilidad del servicio;\n- Pérdida de integridad de los datos financieros;\n- Pérdida de valor financiero;\n- Daños a la reputación;\n- Incumplimiento de los requisitos legales / regulatorios;\n- Pérdida de confidencialidad del cliente.\n\nEl proceso de gestión de riesgos a la seguridad debe identificar los controles implementados o que podrían implementarse para reducir la severidad del riesgo reduciendo el impacto y/o la probabilidad. Se deben identificar acciones para gestionar cada riesgo, tales como tratar el riesgo aplicando controles adicionales o decidiendo tolerar el nivel de riesgo. La decisión de tolerar riesgos debe ser confirmada por parte del nivel de gerencia correspondiente, y se debe documentar la justificación.","ISO 27005: 2011, \nPCI DSS, \nECB RSMP","5.3.1.3.1","¿Las evaluaciones de riesgos a la seguridad evalúan tanto los riesgos nuevos como los riesgos previamente evaluados?","1)  Proceso de gestión de riesgos a la seguridad de la información\n- Verificar que las evaluaciones de riesgos a la seguridad evalúen riesgos nuevos y riesgos previamente evaluados\n- Verificar que exista un registro de riesgos completo",null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.1",null,"5.3.1.3",null,"ISO 27005: 2011, \nPCI DSS, \nECB RSMP","5.3.1.3.1",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.1.3.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,{"$f":"$AV68","v":"5"},{"$f":"$AW68","v":"5.3"},{"$f":"$AX68","v":"5.3.1"},"",{"$f":"AZ68","v":"5.3.1.3"},null,0,"5.3.1.3.2","5.3.1.3.2: Is the severity of each security risk assessed by considering the impact and likelihood of the risk occurring, taking into account the controls that are in place to mitigate the risk?\n","1) Information security risk management process\n- Check that there is a process to assess security risks\n- Check that the assessment process includes the assessment of the impact and likelihood of a risk occurring\n- Check that the assessment includes consideration of controls that are in place to mitigate the risk",0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.1","","5.3.1.3",null,null,"5.3.1.3.2","5.3.1.3.2","Is the severity of each security risk assessed by considering the impact and likelihood of the risk occurring, taking into account the controls that are in place to mitigate the risk?","1) Information security risk management process\n- Check that there is a process to assess security risks\n- Check that the assessment process includes the assessment of the impact and likelihood of a risk occurring\n- Check that the assessment includes consideration of controls that are in place to mitigate the risk",null,"Recommended","Recommended","TechOps",null,null,{"$f":"$AV68","v":"5"},{"$f":"$AW68","v":"5.3"},{"$f":"$AX68","v":"5.3.1"},"","5.3.1.3",0,0,"5.3.1.3.2","la gravité de chaque risque de sécurité est-elle mesurée en évaluant l’impact du risque et sa probabilité de concrétisation, en tenant compte des mesures de contrôle en place pour l'atténuer ?","1) Procédure de gestion des risques liés à la sécurité de l’information\n- Vérifier qu’un processus a été mis en place pour évaluer les risques liés à la sécurité.\n- Vérifier que le processus d’évaluation inclut l’évaluation de l’impact du risque et sa probabilité de concrétisation.\n- Vérifier que l’évaluation tient compte des mesures de contrôle mises en place pour atténuer le risque.",null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.1","","5.3.1.3",null,0,"5.3.1.3.2","¿Se evalúa la severidad de cada riesgo a la seguridad considerando el impacto y la probabilidad de ocurrencia del riesgo, teniendo en cuenta los controles implementados para mitigar el riesgo?","1) Proceso de gestión de riesgos a la seguridad de la información\n- Verificar que exista un proceso para evaluar los riesgos a la seguridad\n- Verificar que el proceso de evaluación incluya la evaluación del impacto y la probabilidad de ocurrencia del riesgo\n- Verificar que la evaluación incluya la consideración de los controles implementados para mitigar el riesgo",null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.1",null,"5.3.1.3",null,0,"5.3.1.3.2",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.1.3.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.1","","5.3.1.3",null,0,"5.3.1.3.3","5.3.1.3.3: Does the security risk management process identify controls which could be implemented to reduce the severity of the risk by reducing the impact and/or likelihood?\n","1) Information security risk management process\n- Check that there is a process identifies controls that should be implemented to reduce the severity of the risk by reducing the impact and/or likelihood of the risk occurring",0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.1","","5.3.1.3",null,null,"5.3.1.3.3","5.3.1.3.3","Does the security risk management process identify controls which could be implemented to reduce the severity of the risk by reducing the impact and/or likelihood?","1) Information security risk management process\n- Check that there is a process identifies controls that should be implemented to reduce the severity of the risk by reducing the impact and/or likelihood of the risk occurring",null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.1","","5.3.1.3",0,0,"5.3.1.3.3","est-ce que la procédure de gestion des risques liés à la sécurité identifie les mesures de contrôle qui devraient être appliquées pour réduire la gravité du risque en réduisant son impact et/ou sa probabilité?","1) Procédure de gestion des risques liés à la sécurité de l’information\n- Vérifier qu’un processus a été mis en place pour identifier les mesures de contrôle qui devraient être appliquées afin de réduire la gravité du risque en réduisant son impact et/ou sa probabilité de concrétisation.",null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.1","",{"$f":"$AZ69","v":"5.3.1.3"},null,0,"5.3.1.3.3","¿El proceso de gestión de riesgos a la seguridad identifica los controles implementados o que podrían implementarse para reducir la severidad del riesgo reduciendo el impacto y/o la probabilidad?","1) Proceso de gestión de riesgos a la seguridad de la información\n- Verificar que exista un proceso para identificar los controles que deberían implementarse para reducir la severidad del riesgo reduciendo el impacto y/o la probabilidad de ocurrencia del riesgo",null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.1",null,"5.3.1.3",null,0,"5.3.1.3.3",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.1.3.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$f":"IF(EA69=0,DS69,EN69)","v":{"$error":"#REF!"}},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,{"$f":"COUNTIF($DO69:$DR69,\"*?\")","v":1},""]
[null,"5","5.3","5.3.1","","5.3.1.3",null,0,"5.3.1.3.4","5.3.1.3.4: Does the security risk management process identify actions to be taken to treat each risk by applying additional controls or deciding to tolerate the level of risk?\n","1) Information security risk management process\n- Check that there is a process identifies actions to be taken to treat each risk by applying additional controls or deciding to tolerate the level of risk",0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.1","","5.3.1.3",null,null,"5.3.1.3.4","5.3.1.3.4","Does the security risk management process identify actions to be taken to treat each risk by applying additional controls or deciding to tolerate the level of risk?","1) Information security risk management process\n- Check that there is a process identifies actions to be taken to treat each risk by applying additional controls or deciding to tolerate the level of risk",null,"Recommended","Recommended",{"$f":"$O70","v":"TechOps"},null,null,"5","5.3","5.3.1","","5.3.1.3",0,0,"5.3.1.3.4","est-ce que la procédure de gestion des risques liés à la sécurité identifie les actions à mettre en place en réponse à chaque risque, en appliquant des mesures de contrôle supplémentaires ou en décidant de tolérer le niveau de risque ?","1) Procédure de gestion des risques liés à la sécurité de l’information\n- Vérifier qu’un processus a été mis en place pour identifier les actions à mettre en œuvre en réponse à chaque risque en appliquant des mesures de contrôles supplémentaires ou en décidant de tolérer le niveau de risque.",null,"Recommandé","Recommandé",{"$f":"$O70","v":"TechOps"},null,null,{"$f":"$AV70","v":"5"},{"$f":"$AW70","v":"5.3"},{"$f":"$AX70","v":"5.3.1"},"","5.3.1.3",null,0,"5.3.1.3.4","¿El proceso de gestión de riesgos a la seguridad identifica las acciones que se deben realizar para tratar cada riesgo aplicando controles adicionales o decidiendo tolerar el nivel de riesgo?","1) Proceso de gestión de riesgos a la seguridad de la información\n- Verificar que exista un proceso para identificar las acciones que se deben realizar para tratar cada riesgo aplicando controles adicionales o decidiendo tolerar el nivel de riesgo",null,"Recomendado","Recomendado",{"$f":"$O70","v":"TechOps"},null,null,{"$f":"$AV70","v":"5"},{"$f":"$AW70","v":"5.3"},{"$f":"$AX70","v":"5.3.1"},null,"5.3.1.3",null,0,"5.3.1.3.4",null,null,null,"Rec4","Rec4",{"$f":"$O70","v":"TechOps"},null,null,null,null,null,null,null,null,"5.3.1.3.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,{"$f":"IF(OR(AND(EH70>0,SUM(EI70:EL70)>0),EK70>0),\"Partial\",IF(EH70=EM70,\"Yes\",IF(EI70=EM70,\"No\",IF(EJ70=EM70,\"N/A\",IF(EK70=EM70,\"Partial\",IF(EL70=EM70,\"\",\"\"))))))","v":""}]
[null,"5","5.3","5.3.1","","5.3.1.3",null,0,"5.3.1.3.5","5.3.1.3.5: Are all decisions to tolerate security risks confirmed at the appropriate level of management and documented?\n","1) Information security risk management process\n- Check that where a decision is taken to tolerate a security risk that this is confirmed by an appropriate level of management\n- Check that the process identifies what level of management is required to confirm a decision to tolerate a risk\n- Check that the decision and confirmation is records including the details of the confirmer\n- Check that the process is documented",0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.1","","5.3.1.3",null,null,"5.3.1.3.5","5.3.1.3.5","Are all decisions to tolerate security risks confirmed at the appropriate level of management and documented?","1) Information security risk management process\n- Check that where a decision is taken to tolerate a security risk that this is confirmed by an appropriate level of management\n- Check that the process identifies what level of management is required to confirm a decision to tolerate a risk\n- Check that the decision and confirmation is records including the details of the confirmer\n- Check that the process is documented",null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.1","","5.3.1.3",0,0,"5.3.1.3.5","est-ce que les décisions de tolérer des risques liés à la sécurité sont toutes documentées et approuvées au niveau hiérarchique approprié ?","1) Procédure de gestion des risques liés à la sécurité de l’information\n- Vérifier que les décisions de tolérer des risques liés à la sécurité sont approuvées au niveau hiérarchique approprié.\n- Vérifier que le processus identifie le niveau hiérarchique devant approuver les décisions de tolérer des risques.\n- Vérifier que la décision et l’approbation de cette dernière sont enregistrées et que l’enregistrement inclut les informations relatives à la personne chargée de l’approbation. \n- Vérifier que le processus est documenté.",null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.1","","5.3.1.3",null,0,"5.3.1.3.5","¿Todas las decisiones de tolerar riesgos son confirmadas por parte del nivel de gerencia correspondiente y están documentadas?","1) Proceso de gestión de riesgos a la seguridad de la información\n- Verificar que cuando se tome la decisión de tolerar un riesgo a la seguridad, ésta sea confirmada por parte del nivel de gerencia correspondiente\n- Verificar que el proceso identifique qué nivel de gerencia se requiere para confirmar la decisión de tolerar un riesgo\n- Verificar que se registre la decisión y la confirmación, incluyendo detalles del confirmador\n- Verificar que el proceso esté documentado",null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.1",null,"5.3.1.3",null,0,"5.3.1.3.5",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.1.3.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.1","","5.3.1.4","5.3.1.4: SECURITY RISK COMMUNICATION AND ACTION MONITORING\nThe results of the security risk assessment should be communicated to risk owners and technical & business managers. High-severity risks should be highlighted.\n\nSecurity risk owners should be informed of their actions for implementing further controls, and these actions should be monitored by the IT Security team to ensure that they are implemented.","ISO 27005: 2011, \nPCI DSS, \nECB RSMP","5.3.1.4.1","5.3.1.4.1: Have the results of the security risk assessment been communicated to risk owners and technical & business managers?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.1","","5.3.1.4","SECURITY RISK COMMUNICATION AND ACTION MONITORING\nThe results of the security risk assessment should be communicated to risk owners and technical & business managers. High-severity risks should be highlighted.\n\nSecurity risk owners should be informed of their actions for implementing further controls, and these actions should be monitored by the IT Security team to ensure that they are implemented.","ISO 27005: 2011, \nPCI DSS, \nECB RSMP","5.3.1.4.1","5.3.1.4.1","Have the results of the security risk assessment been communicated to risk owners and technical & business managers?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.1","","5.3.1.4","COMMUNICATION DES RISQUES LIÉS À LA SÉCURITÉ ET SURVEILLANCE DES ACTIONS\nLes résultats de l’évaluation des risques liés à la sécurité doivent être communiqués aux personnes en charge de ces risques ainsi qu’aux responsables techniques et fonctionnels, en faisant ressortir les risques les plus graves.\nLes personnes en charge de ces risques doivent être informées des actions à mener pour la mise en œuvre des mesures de contrôle supplémentaires et ces actions doivent être suivies par l’équipe de sécurité informatique pour s’assurer de leur mise en place. ","ISO 27005: 2011, \nPCI DSS, \nECB RSMP","5.3.1.4.1","les résultats de l’évaluation des risques liés à la sécurité sont-ils communiqués aux personnes en charge des risques ainsi qu’aux responsables techniques et fonctionnels ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.1","","5.3.1.4","COMUNICACIÓN DE RIESGOS A LA SEGURIDAD Y MONITOREO DE ACCIONES\nLos resultados de la evaluación de riesgos a la seguridad deben ser comunicados a los titulares de riesgos y a los gerentes técnicos y comerciales. Se deben destacar los riesgos de severidad alta.\n\nSe debe informar a los titulares de riesgos a la seguridad las acciones requeridas para la implementación de controles adicionales, y estas acciones deben ser monitoreadas por el equipo de Seguridad IT para garantizar su implementación.","ISO 27005: 2011, \nPCI DSS, \nECB RSMP","5.3.1.4.1","¿Los resultados de la evaluación de riesgos a la seguridad han sido comunicados a los titulares de riesgos y a los gerentes técnicos y comerciales?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.1",null,"5.3.1.4",null,"ISO 27005: 2011, \nPCI DSS, \nECB RSMP","5.3.1.4.1",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.1.4.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",{"$f":"COUNTIF($DS72:$DV72,EH$3)","v":0},0,0,0,0,1,""]
[null,"5","5.3","5.3.1","","5.3.1.4",null,0,"5.3.1.4.2","5.3.1.4.2: Are the actions for implementing further controls monitored by the IT Security team to ensure they are implemented by the risk owners?\n","1) Information security risk management process\n- Check that the IT Security team have a process to monitor that the required additional controls are being implemented by the risk owners\n",0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.1","","5.3.1.4",null,null,"5.3.1.4.2","5.3.1.4.2","Are the actions for implementing further controls monitored by the IT Security team to ensure they are implemented by the risk owners?","1) Information security risk management process\n- Check that the IT Security team have a process to monitor that the required additional controls are being implemented by the risk owners\n",null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.1","","5.3.1.4",0,0,"5.3.1.4.2","les actions visant à mettre en place des mesures de contrôle supplémentaires sont-elles suivies par l’équipe de sécurité informatique pour s’assurer de leur réalisation par les personnes en charge de ces risques ?","1) Procédure de gestion des risques liés à la sécurité de l’information\n- Vérifier que l’équipe de sécurité informatique a mis en place un processus visant à s’assurer que les mesures de contrôles supplémentaires nécessaires sont appliquées par les personnes en charge de ces risques.\n",null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.1","","5.3.1.4",null,0,"5.3.1.4.2","¿Las acciones para implementar controles adicionales son monitoreadas por el equipo de Seguridad IT a fin de garantizar que sean implementadas por los titulares de riesgos?","1) Proceso de gestión de riesgos a la seguridad de la información\n- Verificar que el equipo de Seguridad IT cuente con un proceso para monitorear que los controles adicionales requeridos sean implementados por los titulares de riesgos\n",null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.1",null,"5.3.1.4",null,0,"5.3.1.4.2",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.1.4.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.2","5.3.2: Providers shall properly identify and authenticate system users","5.3.2.1","5.3.2.1: ACCESS CONTROL POLICY - AUTHENTICATION\nAn access control policy should be documented. The policy should specify how authentication of users for access to the mobile money back end system and service will be managed.\n\nProviders should implement authentication measures for access to the mobile money application and system components. This should include the following:\n- assign all users and administrators a unique ID;\n- disable or remove generic user IDs;\n- control the addition, deletion, and modification accounts and credentials;\n- promptly revoke access for any terminated users;\n- review user accounts at least every 90 days and remove or disable inactive/inappropriate accounts;\n- manage IDs used by vendors to access, support, or maintain system components via remote access;\n- disable interactive login for all system-to-system accounts.\n\nProviders may also wish to:\n- limit repeated access attempts by locking out the user ID after not more than six attempts;\n- require the user to re-authenticate to re-activate the terminal or session after a session has been idle for more than 15 minutes.\n\nSteps should be taken to ensure that IDs are not shared by multiple users. For example, a security awareness programme should be run, backed up by discliplinary action for non-compliance.","PCI DSS, ISO 27002: 2013 Sec. 9.1","5.3.2.1.1","5.3.2.1.1: Is there a documented access control policy, standard or procedure that specifies how authentication of users will be managed, both for mobile money application users and system components?\n","1) Access control standard or security policy or similar document\n- Check there is a documented access control policy\n- Check that it specifies how authentication of users will be managed, both  for mobile money application users and system components.",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.2","5.3.2: Providers shall properly identify and authenticate system users","5.3.2.1","ACCESS CONTROL POLICY - AUTHENTICATION\nAn access control policy should be documented. The policy should specify how authentication of users for access to the mobile money back end system and service will be managed.\n\nProviders should implement authentication measures for access to the mobile money application and system components. This should include the following:\n- assign all users and administrators a unique ID;\n- disable or remove generic user IDs;\n- control the addition, deletion, and modification accounts and credentials;\n- promptly revoke access for any terminated users;\n- review user accounts at least every 90 days and remove or disable inactive/inappropriate accounts;\n- manage IDs used by vendors to access, support, or maintain system components via remote access;\n- disable interactive login for all system-to-system accounts.\n\nProviders may also wish to:\n- limit repeated access attempts by locking out the user ID after not more than six attempts;\n- require the user to re-authenticate to re-activate the terminal or session after a session has been idle for more than 15 minutes.\n\nSteps should be taken to ensure that IDs are not shared by multiple users. For example, a security awareness programme should be run, backed up by discliplinary action for non-compliance.","PCI DSS, ISO 27002: 2013 Sec. 9.1","5.3.2.1.1","5.3.2.1.1","Is there a documented access control policy, standard or procedure that specifies how authentication of users will be managed, both for mobile money application users and system components?","1) Access control standard or security policy or similar document\n- Check there is a documented access control policy\n- Check that it specifies how authentication of users will be managed, both  for mobile money application users and system components.",null,"Standard Required","Required","TechOps",null,null,"5","5.3","5.3.2","5.3.2: Les prestataires doivent correctement identifier et authentifier les utilisateurs du système du service d'argent mobile.","5.3.2.1","POLITIQUE DE CONTRÔLE DES ACCÈS - AUTHENTIFICATION\nUne politique de contrôle des accès doit être documentée pour spécifier le mode de gestion de l’authentification des utilisateurs pour l’accès au service et système de back-end du service d’argent mobile.\n\nLes prestataires doivent mettre en œuvre des mesures d’authentification pour l’accès à l’application et aux composants du système de l’argent mobile. Ces mesures doivent inclure:\n- l’attribution d’un identifiant unique à tous les utilisateurs et administrateurs ;\n- la désactivation ou la suppression des identifiants d’utilisateur génériques\n- le contrôle de l’ajout, de la suppression et de la modification des comptes et identifiants des utilisateurs  ;\n- l’annulation immédiate du droit d’accès de tout utilisateur quittant son emploi;\n- un examen des comptes d’utilisateurs au moins une fois tous les 90 jours et la suppression ou le blocage des comptes inactifs/n’ayant pas lieu d’être ;\n- la gestion des identifiants utilisés par des prestataires extérieurs pour l’accès, le support ou l’entretien à distance des composants du système ;\n- la désactivation de la connexion interactive pour tous les comptes « system-to-system ».\n\nLes prestataires peuvent également souhaiter :\n- limiter les tentatives répétées d’accès en bloquant l’identifiant d’utilisateur après six tentatives au maximum ;\n- obliger l’utilisateur à s’authentifier de nouveau pour réactiver le terminal ou la session après plus de 15 minutes d’inactivité.\n\nDes mesures permettant de garantir que les identifiants ne sont pas partagés par plusieurs utilisateurs doivent être prises. Par exemple, un programme de sensibilisation à la sécurité doit être mené, appuyé par des sanctions disciplinaires en cas de non-respect. ","PCI DSS, ISO 27002: 2013 Sec. 9.1","5.3.2.1.1","existe-t-il une politique, une norme ou un procédure documentée de contrôle des accès pour spécifier le mode de gestion de l’authentification des utilisateurs, tant pour les utilisateurs de l’application smartphone que les composants du système de l'argent mobile ?","1) Norme de contrôle des accès ou politique de sécurité ou document similaire\n- Vérifier qu’une politique de contrôle des accès documentée a été mise en œuvre\n- Vérifier que la politique spécifie le mode de gestion de l’authentification des utilisateurs, tant pour les utilisateurs des applications d’argent mobile que pour les composants du système.",null,"Requis Normal","Requis","TechOps",null,null,"5","5.3","5.3.2","5.3.2: Los proveedores deben identificar y autenticar correctamente a los usuarios del sistema","5.3.2.1","POLÍTICA DE CONTROL DE ACCESO - AUTENTICACIÓN\nSe debe documentar una política de control de acceso. La política debe especificar cómo se gestionará la autenticación de usuarios para el acceso al sistema back-end del dinero móvil.\n\nLos proveedores deben implementar medidas de autenticación para el acceso a la aplicación y a los componentes del sistema del dinero móvil. Las medidas deben incluir:\n- asignar un ID único a todos los usuarios y administradores;\n- deshabilitar o eliminar los ID de usuario genéricos;\n- controlar la incorporación, eliminación y modificación de cuentas y credenciales;\n- revocar inmediatamente el acceso a todos los usuarios cerrados;\n- revisar las cuentas de usuarios, al menos, una vez cada 90 días y eliminar o deshabilitar las cuentas inactiva/inadecuadas;\n- gestionar los ID utilizados por los proveedores para acceder, dar soporte o mantenimiento a los componentes del sistema mediante acceso remoto;\n- deshabilitar el inicio de sesión interactivo para todas las cuentas de sistema a sistema.\n\nEs posible que los proveedores también deseen:\n- limitar los intentos de acceso reiterados bloqueando el ID de usuario después de seis intentos, como máximo;\n- requerir que el usuario sea nuevamente autenticado para reactivar el terminal o la sesión después de haber estado inactiva por más de 15 minutos.\n\nSe deben tomar medidas para garantizar que los ID no sean compartidos por múltiples usuarios. Por ejemplo, se debe ejecutar un programa de concientización en materia de seguridad, respaldado por acciones disciplinarias en caso de incumplimiento.","PCI DSS, ISO 27002: 2013 Sec. 9.1","5.3.2.1.1","¿Existe una política, estándar o procedimiento de control de acceso documentado que especifique cómo se gestionará la autenticación de usuarios, para los usuarios de las aplicaciones del dinero móvil y los componentes del sistema?","1) Estándar de control de acceso, política de seguridad o documento similar\n- Verificar que exista una política de control de acceso documentada\n- Verificar que especifique cómo se gestionará la autenticación de usuarios, tanto para los usuarios de la aplicación del dinero móvil como para los componentes del sistema.",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.3","5.3.2",null,"5.3.2.1",null,"PCI DSS, ISO 27002: 2013 Sec. 9.1","5.3.2.1.1",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.2.1.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.2",0,"5.3.2.1",null,0,"5.3.2.1.2","5.3.2.1.2: Are all users that access the mobile money application and system components assigned a unique ID and have generic user IDs been disabled or removed?\n","1) Access control standard or security policy or similar document\n- Check there is a process to allocate a unique ID to any user who accesses the mobile money application.\n- Check there is a process to allocate a unique ID to any user who accesses the mobile money system components.\n- Check that generic/system user IDs are disabled, removed or allocated to a single named owner.",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.2",null,"5.3.2.1",null,null,"5.3.2.1.2","5.3.2.2.1","Are all users that access the mobile money application and system components assigned a unique ID and have generic user IDs been disabled or removed?","1) Access control standard or security policy or similar document\n- Check there is a process to allocate a unique ID to any user who accesses the mobile money application.\n- Check there is a process to allocate a unique ID to any user who accesses the mobile money system components.\n- Check that generic/system user IDs are disabled, removed or allocated to a single named owner.",null,"Urgent Required","Required","TechOps",null,null,"5","5.3","5.3.2","","5.3.2.1",null,null,"5.3.2.1.2","Tous les utilisateurs ayant accès à l’application smartphone et aux composants du système de l’argent mobile possèdent-ils un identifiant unique, et tous les identifiants d’utilisateur génériques ont-ils été désactivés ou supprimés ?","1) Norme de contrôle des accès ou politique de sécurité ou document similaire\n- Vérifier qu’un processus a été mis en place pour attribuer un identifiant unique à chaque utilisateur accédant à l’application d’argent mobile.\n- Vérifier qu’un processus a été mis en place pour attribuer un identifiant unique à chaque utilisateur accédant aux composantes du système de l’argent mobile.\n- Vérifier que les identifiants d’utilisateurs génériques/du système sont désactivés, supprimés ou attribués à un seul propriétaire désigné.",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.3","5.3.2",null,"5.3.2.1",null,null,"5.3.2.1.2","¿Todos los usuarios con acceso a la aplicación y a los componentes del sistema del dinero móvil tienen un ID único asignado y se deshabilitaron y eliminaron los ID genéricos?","1) Estándar de control de acceso, política de seguridad o documento similar\n- Verificar que exista un proceso para asignar un ID único a cada usuario con acceso a la aplicación del dinero móvil.\n- Verificar que exista un proceso para asignar un ID único a cada usuario con acceso a los componentes del sistema del dinero móvil.\n- Verificar que los ID de usuario del sistema/genéricos  se hayan deshabilitado, eliminado o asignado a un único titular designado.",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.3","5.3.2",null,"5.3.2.1",null,null,"5.3.2.1.2",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.2.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.2","","5.3.2.1",null,0,"5.3.2.1.3","5.3.2.1.3: Is the addition, deletion, and modification of user accounts and credentials properly controlled?\n","1) Access control standard or security policy or similar document\n- Check there is a process for managing back-end user accounts\n- Check this covers addition, deletion and modification of accounts\n- Check the process is properly controlled",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.2","","5.3.2.1",null,null,"5.3.2.1.3","5.3.2.2.2","Is the addition, deletion, and modification of user accounts and credentials properly controlled?","1) Access control standard or security policy or similar document\n- Check there is a process for managing back-end user accounts\n- Check this covers addition, deletion and modification of accounts\n- Check the process is properly controlled",null,"Urgent Required","Required","TechOps",null,null,"5","5.3","5.3.2","","5.3.2.1",null,null,"5.3.2.1.3","est-ce que l’ajout, la suppression et la modification des comptes et identifiants des utilisateurs sont correctement contrôlés ?","1) Norme de contrôle des accès ou politique de sécurité ou document similaire\n- Vérifier qu’un processus a été mis en place pour gérer les comptes d’utilisateurs de back-end\n- Vérifier que ce processus couvre l’ajout, la suppression et la modification des comptes\n- Vérifier que ce processus est correctement contrôlé",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.3","5.3.2","","5.3.2.1",null,null,"5.3.2.1.3","¿Se controla correctamente la incorporación, eliminación y modificación de las cuentas de usuarios?","1) Estándar de control de acceso, política de seguridad o documento similar\n- Verificar que exista un proceso para gestionar las cuentas de usuarios del back-end\n- Verificar que contemple la incorporación, eliminación y modificación de cuentas\n- Verificar que el proceso esté correctamente controlado",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.3","5.3.2",null,"5.3.2.1",null,null,"5.3.2.1.3",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.2.2.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.2","","5.3.2.1",null,0,"5.3.2.1.4","5.3.2.1.4: Is user access promptly revoked for any terminated users?\n","1) Access control standard or security policy or similar document\n- Check there is a process for the prompt revocation of access rights for any terminated user",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.2","","5.3.2.1",null,null,"5.3.2.1.4","5.3.2.2.3","Is user access promptly revoked for any terminated users?","1) Access control standard or security policy or similar document\n- Check there is a process for the prompt revocation of access rights for any terminated user",null,"Standard Required","Required","TechOps",null,null,"5","5.3","5.3.2","","5.3.2.1",null,null,"5.3.2.1.4","est-ce que le droit d’accès au système de est immédiatement annulé pour tout utilisateur quittant son emploi ?","1) Norme ou politique de sécurité relative au contrôle d’accès ou document similaire\n- Vérifier qu’un processus a été mis en place pour annuler immédiatement les droits d’accès de tout utilisateur quittant son emploi",null,"Requis Normal","Requis","TechOps",null,null,"5","5.3","5.3.2","","5.3.2.1",null,null,"5.3.2.1.4","¿Se revoca inmediatamente el acceso de usuario a todos los usuarios cerrados?","1) Estándar de control de acceso, política de seguridad o documento similar\n- Verificar que exista un proceso para la revocación inmediata de los derechos de acceso a todos los usuarios cerrados",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.3","5.3.2",null,"5.3.2.1",null,null,"5.3.2.1.4",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.2.2.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.2","","5.3.2.1",null,0,"5.3.2.1.5","5.3.2.1.5: Are steps taken to ensure that IDs are not shared by multiple users?\n","1) Security awareness programme\n- Check there is a process to educate staff about not sharing login credentials, for example, training, screen notices, disciplinary processes etc.",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.2","","5.3.2.1",null,null,"5.3.2.1.5","5.3.2.4.2","Are steps taken to ensure that IDs are not shared by multiple users?","1) Security awareness programme\n- Check there is a process to educate staff about not sharing login credentials, for example, training, screen notices, disciplinary processes etc.",null,"Urgent Required","Required","TechOps",null,null,"5","5.3","5.3.2","","5.3.2.1",null,null,"5.3.2.1.5","existe-t-il des mesures pour empêcher l'utilisation des identifiants par plusieurs utilisateurs ?","1) Programme de sensibilisation à la sécurité\n- Vérifier qu’un processus a été mis en place afin de sensibiliser le personnel à l’importance de ne pas partager des identifiants de connexion, par exemple, formations, notes sur écran, procédures disciplinaires, etc.",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.3","5.3.2","","5.3.2.1",null,null,"5.3.2.1.5","¿Se toman medidas para garantizar que los ID no sean compartidos por múltiples usuarios?","1) Programa de concientización en materia de seguridad\n- Verificar que exista un proceso para educar al personal acerca de no compartir las credenciales de inicio de sesión, por ej., capacitación, notificaciones en pantalla, procesos disciplinarios, etc.",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.3","5.3.2",null,"5.3.2.1",null,null,"5.3.2.1.5",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.2.4.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.2","","5.3.2.1",null,0,"5.3.2.1.6","5.3.2.1.6: Are user accounts reviewed at least every 90 days, and are inactive/inappropriate accounts removed or disabled?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.2","","5.3.2.1",null,null,"5.3.2.1.6","5.3.2.2.4","Are user accounts reviewed at least every 90 days, and are inactive/inappropriate accounts removed or disabled?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.2","","5.3.2.1",null,null,"5.3.2.1.6","un examen des comptes d’utilisateurs ayant accès au back-end est-il effectué au moins une fois tous les 90 jours pour supprimer/bloquer les comptes inactifs ou n’ayant pas lieu d’être ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.2","","5.3.2.1",null,null,"5.3.2.1.6","¿Las cuentas de usuarios son revisadas, al menos, una vez cada 90 días, y se eliminan o deshabilitan las cuentas inactivas/inadecuadas?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.2",null,"5.3.2.1",null,null,"5.3.2.1.6",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.2.2.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.2","","5.3.2.1",null,0,"5.3.2.1.7","5.3.2.1.7: Is interactive login disabled for all system-to-system accounts?\n",0,0,"Recommended","Recommended","TechOps",{"$f":"CHOOSE(LanguageNumber,BK80,CA80,CQ80,DG80)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.2","","5.3.2.1",null,null,"5.3.2.1.7","5.3.2.2.5","Is interactive login disabled for all system-to-system accounts?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.2","","5.3.2.1",null,null,"5.3.2.1.7","la connexion interactive est-elle desactivée pour tous les comptes \"system to system\" ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.2","","5.3.2.1",null,null,"5.3.2.1.7","¿Está deshabilitado el inicio de sesión interactivo para todas las cuentas de sistema a sistema?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.2",null,"5.3.2.1",null,null,"5.3.2.1.7",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.2.2.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.2","","5.3.2.2",{"$f":"AZ81&\": \"&CHOOSE(LanguageNumber,BA81,BR81,CH81,CX81)","v":"5.3.2.2: TWO-FACTOR AUTHENTICATION\nTwo-factor authentication means identifying users by two means. One factor is usually a security credential (such as a PIN or password), and the second factor is normally the user's handset.\n\nTwo-factor authentication should be employed for any access route that is higher risk. For mobile money, two-factor authentication should be enforced for the following access:\n- USSD or STK handset transactions should identify the handset via the MSISDN associated with the SIM;\n- Smartphone users should have their handset securely associated with their account before it is used for transactions;\n- Web and PoS transactions should include a customer confirmation step which involves use of both their handset and PIN.\n- Each user of the mobile money application should have a certificate installed on their computer to identify it (e.g. customer service staff and agents);\n- Remote access to mobile money system components (from outside the premises) should require a certificate on the user's computer or an access card that generates a pass code."},"PCI DSS, ISO 27002: 2013 Sec. 9.1","5.3.2.2.1","5.3.2.2.1: Are both handset and PIN required for all account-debiting customer transactions?\n","1) Access control standard or security policy or similar document\n- Check that both handset and PIN are required for all account-debiting customer transactions (including transactions from both feature phones and smartphones).\n\n2) Demonstration of a customer and agent login on feature phone and smartphone (if applicable).\n- Review transaction initiation to confirm authentication is effective (both positive and negative cases)",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.2","","5.3.2.2","TWO-FACTOR AUTHENTICATION\nTwo-factor authentication means identifying users by two means. One factor is usually a security credential (such as a PIN or password), and the second factor is normally the user's handset.\n\nTwo-factor authentication should be employed for any access route that is higher risk. For mobile money, two-factor authentication should be enforced for the following access:\n- USSD or STK handset transactions should identify the handset via the MSISDN associated with the SIM;\n- Smartphone users should have their handset securely associated with their account before it is used for transactions;\n- Web and PoS transactions should include a customer confirmation step which involves use of both their handset and PIN.\n- Each user of the mobile money application should have a certificate installed on their computer to identify it (e.g. customer service staff and agents);\n- Remote access to mobile money system components (from outside the premises) should require a certificate on the user's computer or an access card that generates a pass code.","PCI DSS, ISO 27002: 2013 Sec. 9.1","5.3.2.2.1","5.3.2.3.1","Are both handset and PIN required for all account-debiting customer transactions?","1) Access control standard or security policy or similar document\n- Check that both handset and PIN are required for all account-debiting customer transactions (including transactions from both feature phones and smartphones).\n\n2) Demonstration of a customer and agent login on feature phone and smartphone (if applicable).\n- Review transaction initiation to confirm authentication is effective (both positive and negative cases)",null,"Urgent Required","Required","TechOps",null,null,"5","5.3","5.3.2","","5.3.2.2","AUTHENTIFICATION À DEUX FACTEURS\nL’authentification à deux facteurs permet d’identifier les utilisateurs au moyen de deux modes d’authentification différents. Le premier facteur est généralement un identifiant de sécurité (code confidentiel ou mot de passe) et le second est habituellement le téléphone portable de l’utilisateur.\n\nL’authentification à deux facteurs doit être utilisée pour toute voie d’accès à plus haut risque. En matière d’argent mobile, elle doit être mise en place pour les accès suivants :\n- les transactions réalisées par fonction USSD ou STK via téléphone doivent identifier l’appareil à l’aide du numéro MSISDN associé à la carte SIM ;\n- les utilisateurs de smartphone doivent associer leur appareil à leur compte de manière sécurisée avant de pouvoir les utiliser pour des transactions ;\n- les transactions réalisées via internet ou un terminal de point de vente doivent inclure une étape de confirmation de la part du client qui requiert l’utilisation du téléphone et du code confidentiel ;\n- chaque utilisateur de l’application d'argent mobile doit avoir un certificat installé sur son ordinateur afin d’identifier ce dernier (par ex. le personnel du service client et les agents) ;\n- l'accès à distance aux composantes du système de l’argent mobile (en dehors des locaux) doit nécessiter un certificat installé sur l’ordinateur de l’utilisateur ou une carte d'accès permettant de générer un mot de passe.",{"$f":"BB81","v":"PCI DSS, ISO 27002: 2013 Sec. 9.1"},"5.3.2.2.1","Un téléphone et un code confidentiel sont-ils demandés pour toutes les transactions client entraînant un débit du compte ?","1) Norme de contrôle des accès ou politique de sécurité ou document similaire\n- Vérifier que l’utilisateur doit utiliser son appareil et entrer son code confidentiel pour toutes les transactions de débit de compte des clients (y compris les transactions depuis des téléphones basiques (feature phones) ou des smartphones).\n\n2) Démonstration d’un accès par un client et un agent sur un feature phone et un smartphone (le cas échéant).\n- Analyser l’initiation de la transaction afin de confirmer que l’authentification est efficace (cas positifs et négatifs)",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.3","5.3.2","","5.3.2.2","AUTENTICACIÓN DE DOS FACTORES\nLa autenticación de dos factores significa identificar usuarios por dos medios. Generalmente, un factor es una credencial de seguridad (tal como PIN o contraseña) y el otro factor es el dispositivo del usuario.\n\nSe debe emplear la autenticación de dos factores para cualquier ruta de acceso de alto riesgo. Para el dinero móvil, se debe exigir la autenticación de dos factores para los siguientes accesos:\n- Las transacciones con dispositivos USSD o STK deben identificar el dispositivo mediante el MSISDN asociado a la SIM;\n- Los usuarios de smartphones deben tener su dispositivo asociado, de forma segura, con su cuenta antes de utilizarlo para realizar transacciones;\n- Las transacciones web y PoS deben incluir un paso de confirmación del cliente que involucre el uso de su dispositivo y su PIN.\n- Cada usuario de la aplicación del dinero móvil debe tener un certificado instalado en su computadora para fines de identificación (por ej., personal y agentes de atención al cliente);\n- El acceso remoto a los componentes del sistema del dinero móvil  (desde afuera de las instalaciones) debe requerir un certificado en la computadora del usuario o una tarjeta de acceso que genere un código de acceso.",{"$f":"BB81","v":"PCI DSS, ISO 27002: 2013 Sec. 9.1"},"5.3.2.2.1","¿Se requiere el dispositivo y el PIN para todas las transacciones de débito de la cuenta del cliente?","1) Estándar de control de acceso, política de seguridad o documento similar\n- Verificar que se requieran el dispositivo y el PIN para todas las transacciones de débito de la cuenta del cliente (incluyendo transacciones desde teléfonos básicos y smartphones).\n\n2) Demostración de inicio de sesión de un cliente y agente en un teléfono básico y un smartphone (si corresponde).\n- Revisar el inicio de la transacción para confirmar que la autenticación sea efectiva (tanto en casos positivos como negativos)",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.3","5.3.2",null,"5.3.2.2",null,{"$f":"BB81","v":"PCI DSS, ISO 27002: 2013 Sec. 9.1"},"5.3.2.2.1",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.2.3.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.2",0,"5.3.2.2",null,null,null,"5.3.2.2.2: Do all online purchase, ATM and PoS transactions (both merchant and cash-out if applicable) include a customer confirmation step which involves use of both their handset and PIN?\n","1) Access control standard or security policy or similar document\n- Check that all online purchase and PoS transactions (both merchant and cash-out if applicable) include a customer confirmation step which involves use of both their handset and PIN.\n\n2) Demonstration of web and PoS transactions (if possible)\n- Check that all web and PoS merchant / cash-out transactions include a customer confirmation step which involves use of both their handset and PIN.",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.2",null,"5.3.2.2",null,null,"5.3.2.2.2",null,"Do all online purchase, ATM and PoS transactions (both merchant and cash-out if applicable) include a customer confirmation step which involves use of both their handset and PIN?","1) Access control standard or security policy or similar document\n- Check that all online purchase and PoS transactions (both merchant and cash-out if applicable) include a customer confirmation step which involves use of both their handset and PIN.\n\n2) Demonstration of web and PoS transactions (if possible)\n- Check that all web and PoS merchant / cash-out transactions include a customer confirmation step which involves use of both their handset and PIN.",null,"Urgent Required","Required","TechOps",null,null,"5","5.3","5.3.2",null,null,null,null,"5.3.2.2.2","L’ensemble des transactions sur internet, sur GAB et en point de vente (transactions de commerçants et retraits d’espèces, le cas échéant) incluent-elles une étape visant à obtenir la confirmation du client et nécessitant de ce dernier qu’il utilise pour cela son appareil et son code confidentiel ?","1) Norme de contrôle des accès ou politique de sécurité ou document similaire\n- Vérifier que l’ensemble des transactions sur internet et en point de vente (transactions de commerçants et retraits d’espèces, le cas échéant) incluent une étape visant à obtenir la confirmation du client et nécessitant de ce dernier qu’il utilise pour cela son appareil et son code confidentiel.\n\n2) Démonstration de transactions sur internet et en point de vente (si possible)\n- Vérifier que l’ensemble des transactions sur internet et des transactions de commerçants/des retraits d’espèces en point de vente incluent une étape visant à obtenir la confirmation du client et nécessitant de ce dernier qu’il utilise pour cela son appareil et son code confidentiel.",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.3","5.3.2",null,null,null,null,{"$f":"$BC82","v":"5.3.2.2.2"},"¿Todas las transacciones de compras en línea, por cajeros automáticos y PoS (de comercios y de retiro de efectivo, si corresponde) incluyen un paso de confirmación del cliente que involucre el uso de su dispositivo y su PIN? ","1) Estándar de control de acceso, política de seguridad o documento similar \n- Verificar que todas las transacciones web y PoS (de comercios y retiros de efectivo, si corresponde) incluyan un paso de confirmación del cliente que involucre el uso de su dispositivo y su PIN.\n\n2) Demostración de transacciones web y PoS (si es posible)\n- Verificar que todas las transacciones de comercios / de retiro de efectivo web y PoS incluyan un paso de confirmación del cliente que involucre el uso de su dispositivo y su PIN.",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.3","5.3.2",null,null,null,null,{"$f":"$BC82","v":"5.3.2.2.2"},null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,"NEW"]
[null,"5","5.3","5.3.2",{"$f":"CHOOSE(LanguageNumber,AY83,BP83,CF83,CV83)","v":""},"5.3.2.2",null,{"$f":"BB83","v":0},"5.3.2.2.3","5.3.2.2.3: Do all mobile money application users (e.g. customer service staff and agents) have certificates installed on their computers (or another two-factor authentication mechanism)?\n","1) Access control standard or security policy or similar document\n- Check that all mobile money application users (e.g. customer service staff and agents) have certificates installed on their computers (or another two-factor authentication mechanism)\n",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.2","","5.3.2.2",null,null,"5.3.2.2.3",{"$f":"DO83","v":"5.3.2.3.2"},"Do all mobile money application users (e.g. customer service staff and agents) have certificates installed on their computers (or another two-factor authentication mechanism)?","1) Access control standard or security policy or similar document\n- Check that all mobile money application users (e.g. customer service staff and agents) have certificates installed on their computers (or another two-factor authentication mechanism)\n",null,"Urgent Required","Required","TechOps",null,null,"5","5.3","5.3.2","",{"$f":"$AZ83","v":"5.3.2.2"},0,{"$f":"BB83","v":0},"5.3.2.2.3","Tous les utilisateurs de l’application d'argent mobile (par ex. le personnel du service client et les agents) possèdent-ils un certificat installé sur leur ordinateur (ou un autre mécanisme d'authentification à deux facteurs) ?","1) Norme de contrôle des accès ou politique de sécurité ou document similaire\n- Vérifier qu’un processus a été mis en place pour vérifier l’identité des clients/agents avant l’émission ou le remplacement d’identifiants de sécurité\n2) Démonstration du processus de modification du mot de passe / PIN en libre-service (le cas échéant)\n- Vérifier que le processus a été mis en œuvre",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.3","5.3.2","",{"$f":"$AZ83","v":"5.3.2.2"},null,{"$f":"BB83","v":0},"5.3.2.2.3","¿Todos los usuarios de la aplicación móvil (por ej., personal y agentes de atención al cliente) tienen certificados instalados en sus computadoras (u otro mecanismo de autenticación de dos factores)?","1) Estándar de control de acceso, política de seguridad o documento similar\n- Verificar que todos los usuarios de la aplicación del dinero móvil (por ej., personal y agentes de atención al cliente) tengan certificados instalados en sus computadoras (u otro mecanismo de autenticación de dos factores)\n",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.3","5.3.2",null,{"$f":"$AZ83","v":"5.3.2.2"},null,{"$f":"BB83","v":0},"5.3.2.2.3",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.2.3.2",null,null,null,{"$f":"IF(OR($EA83=0,$EA83=2),VLOOKUP(DO83,INDIRECT(ED83),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP83),\"\",VLOOKUP(DP83,INDIRECT(EE83),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ83),\"\",VLOOKUP(DQ83,INDIRECT(EF83),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR83),\"\",VLOOKUP(DR83,INDIRECT(EG83),7,FALSE))","v":""},{"$f":"IF(OR($EA83=0,$EA83=2),VLOOKUP(DO83,INDIRECT(ED83),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP83),\"\",VLOOKUP(DP83,INDIRECT(EE83),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ83),\"\",VLOOKUP(DQ83,INDIRECT(EF83),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR83),\"\",VLOOKUP(DR83,INDIRECT(EG83),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN83,3)=\"NEW\")+2*AND(LEFT(DN83,3)=\"MER\")+3*AND(LEFT(DN83,3)=\"MOV\")+4*AND(LEFT(DN83,3)=\"SWA\")","v":0},{"$f":"IF(EA83=0,DS83,EN83)","v":{"$error":"#REF!"}},{"$f":"IF(EA83=0,IF(DW83=0,\"\",DW83),CHOOSE(EA83,\"New indicator\",CONCATENATE(DW83,CarriageReturn,DX83,CarriageReturn,DY83,CarriageReturn,DZ83)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO83,1)","v":"OriginalComplianceP5"},{"$f":"\"OriginalComplianceP\"&LEFT(DP83,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ83,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR83,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,""]
[null,"5","5.3","5.3.2","","5.3.2.2",null,0,"5.3.2.2.4","5.3.2.2.4: Is two-factor authentication required for any remote access by staff or third parties to mobile money system components (e.g. a certificate on their computer or an access card that generates a pass code)?\n","1) Access control standard or security policy or similar document\n- Check that two-factor authentication is required for any remote access (from outside the premises) by staff or third parties to mobile money system components (e.g. a certificate on their computer or an access card that generates a pass code).",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.2","","5.3.2.2",null,null,"5.3.2.2.4",{"$f":"DO84","v":"5.3.2.3.3"},"Is two-factor authentication required for any remote access by staff or third parties to mobile money system components (e.g. a certificate on their computer or an access card that generates a pass code)?","1) Access control standard or security policy or similar document\n- Check that two-factor authentication is required for any remote access (from outside the premises) by staff or third parties to mobile money system components (e.g. a certificate on their computer or an access card that generates a pass code).",null,"Standard Required","Required","TechOps",null,null,"5","5.3","5.3.2","",{"$f":"$AZ84","v":"5.3.2.2"},0,0,"5.3.2.2.4","L'authentification à deux facteurs est-elle exigée pour tout accès à distance par le personnel ou les tiers aux composants du système de l’argent mobile (par ex. un certificat sur l’ordinateur ou une carte d'accès permettant de générer un mot de passe) ?","1) Norme de contrôle des accès ou politique de sécurité ou document similaire\n- Vérifier qu’une authentification à deux facteurs est requise pour tout accès à distance (en dehors des locaux) aux composantes du système de l’argent mobile par le personnel ou des tiers (par exemple, certificat installé sur leur ordinateur ou carte d’accès générant un mot de passe).",null,"Requis Normal","Requis","TechOps",null,null,"5","5.3","5.3.2","","5.3.2.2",null,{"$f":"BB84","v":0},"5.3.2.2.4","¿Se requiere la autenticación de dos factores para cualquier acceso remoto por parte del personal o de terceros a los componentes del sistema del dinero móvil (por ej., un certificado en su computadora o una tarjeta de acceso que genere un código de acceso)?","1) Estándar de control de acceso, política de seguridad o documento similar\n- Verificar que se requiera la autenticación de dos factores para cualquier acceso remoto (desde afuera de las instalaciones) por parte del personal o de terceros a los componentes del sistema del dinero móvil (por ej., un certificado en su computadora o una tarjeta de acceso que genere un código de acceso). ",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.3","5.3.2",null,{"$f":"$AZ84","v":"5.3.2.2"},null,{"$f":"BB84","v":0},"5.3.2.2.4",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.2.3.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.2","","5.3.2.3",{"$f":"AZ85&\": \"&CHOOSE(LanguageNumber,BA85,BR85,CH85,CX85)","v":"5.3.2.3: ALLOCATION OF SECURITY CREDENTIALS (PINs) TO CUSTOMERS\nProcedures should be implemented to verify the identity of a customer/agent prior to providing new or replacement security credentials (e.g. PIN or password).\n\nUsers should set their own PIN/password, and steps should be taken to prevent third parties from interference in the setup of customer security credentials. For example, agents should  be made aware that they should not set or change a customer's PIN. \n\nIf customers are provided initially with a temporary PIN/password it should be unique and not guessable and customers should be required to change it on first use. It should be sent in a secure manner: the use of clear text email messages should be avoided. \n\nCustomers and agents should be able to change their own PIN or password."},"PCI DSS, ISO 27002: 2013 Sec. 9.1, 9.2","5.3.2.3.1","5.3.2.3.1: Are procedures implemented to verify the identity of a customer/agent prior to providing replacement security credentials (e.g. PIN/password)?\n","1) Access control standard or security policy or similar document\n- Check that there is a process to verify the identity of a customer/agent prior to providing replacement security credential (e.g. the process in 7.1.1.5)\n2) Demonstration of self-service PIN / password change process (if applicable)\n- Check the process has been implemented",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.2","","5.3.2.3","ALLOCATION OF SECURITY CREDENTIALS (PINs) TO CUSTOMERS\nProcedures should be implemented to verify the identity of a customer/agent prior to providing new or replacement security credentials (e.g. PIN or password).\n\nUsers should set their own PIN/password, and steps should be taken to prevent third parties from interference in the setup of customer security credentials. For example, agents should  be made aware that they should not set or change a customer's PIN. \n\nIf customers are provided initially with a temporary PIN/password it should be unique and not guessable and customers should be required to change it on first use. It should be sent in a secure manner: the use of clear text email messages should be avoided. \n\nCustomers and agents should be able to change their own PIN or password.","PCI DSS, ISO 27002: 2013 Sec. 9.1, 9.2","5.3.2.3.1",{"$f":"DO85","v":"5.3.2.5.1"},"Are procedures implemented to verify the identity of a customer/agent prior to providing replacement security credentials (e.g. PIN/password)?","1) Access control standard or security policy or similar document\n- Check that there is a process to verify the identity of a customer/agent prior to providing replacement security credential (e.g. the process in 7.1.1.5)\n2) Demonstration of self-service PIN / password change process (if applicable)\n- Check the process has been implemented",null,"Urgent Required","Required","TechOps",null,null,"5","5.3","5.3.2","",{"$f":"$AZ85","v":"5.3.2.3"},"ATTRIBUTION DES IDENTIFIANTS DE SÉCURITÉ (CODES CONFIDENTIELS) AUX CLIENTS\nDes procédures doivent être mises en place pour vérifier l’identité des clients ou agents avant l’émission ou le remplacement d’identifiants de sécurité (ex. code confidentiel ou mot de passe).\n\nLes utilisateurs doivent définir leurs propres code confidentiel et mot de passe, et des mesures doivent être prises pour empêcher l’intervention de tiers dans la création des identifiants de sécurité des clients. Les agents doivent par exemple être informés qu’ils ne doivent pas créer ou modifier le code de sécurité des clients. \n\nSi, dans un premier temps, un code confidentiel/mot de passe temporaire est attribué aux clients, ce dernier doit être unique, impossible à deviner et doit être modifié par les clients dès la première utilisation. Il doit être transmis de manière sécurisée : la transmission par e-mail non chiffré doit être évitée.\n\nLes clients et les agents doivent avoir la possibilité de changer leur propre code confidentiel ou mot de passe.","PCI DSS, ISO 27002: 2013 Sec. 9.1, 9.2","5.3.2.3.1","des procédures sont-elles en place pour vérifier l’identité des clients ou agents avant l’émission ou le remplacement d’identifiants de sécurité (ex. code confidentiel ou mot de passe) ?","1) Norme de contrôle des accès ou politique de sécurité ou document similaire\n- Vérifier qu’un processus a été mis en place pour vérifier l’identité des clients/agents avant le remplacement d’identifiants de sécurité (par ex. processus visé au 7.1.1.5)\n\n2) Démonstration du processus de modification du code confidentiel/mot de passe en libre-service (le cas échéant)\n- Vérifier que le processus a été mis en œuvre",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.3","5.3.2","","5.3.2.3","ASIGNACIÓN DE CREDENCIALES DE SEGURIDAD (PIN) A LOS CLIENTES\nSe deben implementar procedimientos para verificar la identidad de un cliente/agente antes de otorgar credenciales de seguridad nuevas o de reemplazo (por ej., PIN o contraseña).\n\nLos usuarios deben establecer sus propios PIN/contraseñas, y se deben tomar medidas para evitar que terceros interfieran en la configuración de las credenciales de seguridad de los clientes. Por ejemplo, se debe informar a los agentes que no deben establecer ni cambiar el PIN de un cliente. \n\nInicialmente, se debe proporcionar a los clientes un PIN/contraseña temporal que debe ser único e indescifrable, y que deben cambiar en el primer uso. Debe ser enviado de manera segura: se debe evitar el uso de correos electrónicos con texto no encriptado.  \n\nLos clientes y agentes deben poder cambiar su propio PIN o contraseña.  ",{"$f":"BB85","v":"PCI DSS, ISO 27002: 2013 Sec. 9.1, 9.2"},"5.3.2.3.1","¿Se implementan procedimientos para verificar la identidad de un cliente/agente antes de otorgar credenciales de seguridad de reemplazo (por ej., PIN/contraseña)? ","1) Estándar de control de acceso, política de seguridad o documento similar \n- Verificar que exista un proceso para verificar la identidad de un cliente/agente antes de otorgar una credencial de seguridad de reemplazo (por ej., el proceso descrito en 7.1.1.5)\n2) Demostración del proceso de cambio del PIN con autoservicio (si corresponde)\n- Verificar que se haya implementado el proceso ",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.3","5.3.2",null,{"$f":"$AZ85","v":"5.3.2.3"},null,{"$f":"BB85","v":"PCI DSS, ISO 27002: 2013 Sec. 9.1, 9.2"},"5.3.2.3.1",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.2.5.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.2","","5.3.2.3",null,0,"5.3.2.3.2","5.3.2.3.2: If customers and agents are sent temporary PINs / passwords are they required to change them prior to using the mobile money service?\n","1) Access control standard or security policy or similar document or demonstration of account creation\n- Check that if temporary PINs/passwords are sent to users they have to change them prior to using the mobile money service.\n",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.2","","5.3.2.3",null,null,"5.3.2.3.2",{"$f":"DO86","v":"5.3.2.5.3"},"If customers and agents are sent temporary PINs / passwords are they required to change them prior to using the mobile money service?","1) Access control standard or security policy or similar document or demonstration of account creation\n- Check that if temporary PINs/passwords are sent to users they have to change them prior to using the mobile money service.\n",null,"Standard Required","Required","TechOps",null,null,"5","5.3","5.3.2","",{"$f":"$AZ86","v":"5.3.2.3"},0,0,"5.3.2.3.2","Les clients et les agents doivent-ils modifier les codes confidentiels / mots de passe temporaires qui leur sont envoyés avant de pouvoir utiliser le service de l’argent mobile ?","1) Norme de contrôle des accès ou politique de sécurité ou document similaire ou démonstration de  création de compte\n- Vérifier que les utilisateurs qui reçoivent d’abord un code confidentiel/mot de passe temporaire doivent le modifier avant d’utiliser le service d’argent mobile ",null,"Requis Normal","Requis","TechOps",null,null,"5","5.3","5.3.2","","5.3.2.3",null,{"$f":"BB86","v":0},"5.3.2.3.2","Si se envían PIN / contraseñas temporales a los clientes y agentes, ¿deben cambiarlas antes de usar el servicio del dinero móvil?","1) Estándar de control de acceso, política de seguridad, documento similar o demonstración de creación de cuenta\n- Si se envían PIN/contraseñas temporales a los usuarios, verificar que deban cambiarlas antes de usar el servicio del dinero móvil",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.3","5.3.2",null,{"$f":"$AZ86","v":"5.3.2.3"},null,{"$f":"BB86","v":0},"5.3.2.3.2",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.2.5.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.2","","5.3.2.3",null,0,"5.3.2.3.3","5.3.2.3.3: Are temporary PINs sent to customers securely, and are all temporary PINs unique and not guessable?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.2","","5.3.2.3",null,null,"5.3.2.3.3",{"$f":"DO87","v":"5.3.2.5.5"},"Are temporary PINs sent to customers securely, and are all temporary PINs unique and not guessable?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.2","",{"$f":"$AZ87","v":"5.3.2.3"},0,0,"5.3.2.3.3","les identifiants de sécurité temporaires sont-ils envoyés au client de manière sécurisée et les mots de passe temporaires sont-ils uniques et impossibles à deviner ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.2","","5.3.2.3",null,{"$f":"BB87","v":0},"5.3.2.3.3","¿Los PIN temporales son enviados a los clientes de manera segura, y son todos los PIN temporales únicos e indescifrables?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.2",null,{"$f":"$AZ87","v":"5.3.2.3"},null,{"$f":"BB87","v":0},"5.3.2.3.3",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.2.5.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.2",{"$f":"CHOOSE(LanguageNumber,AY88,BP88,CF88,CV88)","v":0},"5.3.2.3",null,null,null,"5.3.2.3.4: Can customers and agents change their own PIN or password?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.2",null,"5.3.2.3",null,null,"5.3.2.3.4",null,"Can customers and agents change their own PIN or password?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.2",null,null,null,null,"5.3.2.3.4","Les clients et les agents peuvent-ils modifier leur propre code confidentiel ou mot de passe ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.2",null,"5.3.2.3",null,null,"5.3.2.3.4","¿Los clientes y agentes pueden cambiar su propio PIN o contraseña?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.2",null,null,null,null,"5.3.2.3.4",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,"NEW"]
[null,"5","5.3","5.3.2",{"$f":"CHOOSE(LanguageNumber,AY89,BP89,CF89,CV89)","v":""},"5.3.2.3",null,{"$f":"BB89","v":0},{"$f":"BC89","v":"5.3.2.3.5"},"5.3.2.3.5: Are agents made aware that they should not set up or change a customer's security credentials?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.2","","5.3.2.3",null,null,"5.3.2.3.5",{"$f":"DO89","v":"5.3.2.5.2"},"Are agents made aware that they should not set up or change a customer's security credentials?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.2","",{"$f":"$AZ89","v":"5.3.2.3"},null,null,{"$f":"BC89","v":"5.3.2.3.5"},"les agents sont-ils informés qu’ils ne doivent pas créer ou modifier les identifiants de sécurité des clients ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.2","","5.3.2.3",null,null,{"$f":"$BC89","v":"5.3.2.3.5"},"¿Se informa a los agentes que no deben establecer ni cambiar las credenciales de seguridad de un cliente?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.2",null,{"$f":"$AZ89","v":"5.3.2.3"},null,null,{"$f":"$BC89","v":"5.3.2.3.5"},null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.2.5.2",null,null,null,{"$f":"IF(OR($EA89=0,$EA89=2),VLOOKUP(DO89,INDIRECT(ED89),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP89),\"\",VLOOKUP(DP89,INDIRECT(EE89),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ89),\"\",VLOOKUP(DQ89,INDIRECT(EF89),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR89),\"\",VLOOKUP(DR89,INDIRECT(EG89),7,FALSE))","v":""},{"$f":"IF(OR($EA89=0,$EA89=2),VLOOKUP(DO89,INDIRECT(ED89),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP89),\"\",VLOOKUP(DP89,INDIRECT(EE89),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ89),\"\",VLOOKUP(DQ89,INDIRECT(EF89),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR89),\"\",VLOOKUP(DR89,INDIRECT(EG89),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN89,3)=\"NEW\")+2*AND(LEFT(DN89,3)=\"MER\")+3*AND(LEFT(DN89,3)=\"MOV\")+4*AND(LEFT(DN89,3)=\"SWA\")","v":0},{"$f":"IF(EA89=0,DS89,EN89)","v":{"$error":"#REF!"}},{"$f":"IF(EA89=0,IF(DW89=0,\"\",DW89),CHOOSE(EA89,\"New indicator\",CONCATENATE(DW89,CarriageReturn,DX89,CarriageReturn,DY89,CarriageReturn,DZ89)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO89,1)","v":"OriginalComplianceP5"},{"$f":"\"OriginalComplianceP\"&LEFT(DP89,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ89,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR89,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,""]
[null,"5","5.3","5.3.3",{"$f":"CHOOSE(LanguageNumber,AY90,BP90,CF90,CV90)","v":"5.3.3: Providers shall limit access to customer data on a “need to know” basis"},"5.3.3.1",{"$f":"AZ90&\": \"&CHOOSE(LanguageNumber,BA90,BR90,CH90,CX90)","v":"5.3.3.1: ROLE-BASED AUTHORIZATION FOR MOBILE MONEY APPLICATION USERS\nRole-based permissions should be employed for operator accounts in the mobile money system so that specific functions can be assigned to individuals on a granular level, so that users can be restricted to access only the data and perform only the functions that they are supposed to.\n\nMaker-checker should be implemented to prevent a single person from accessing or modifying financial information without authorization or detection. Maker-checker should be enforced for these functions:\n  - financially-sensitive actions/events such as moving money between accounts, \n  - creating more operator accounts (which could be used to steal funds);\n  - accessing and modifying audit records to hide their tracks.\n\nThe possibility of collusion should be considered in designing the controls. Whenever it is difficult to segregate, other controls such as monitoring of activities, audit trails and management supervision should be prioritised."},"ISO 27002:2013 Sec. 9.2, BCBS RMPEB","5.3.3.1.1","5.3.3.1.1: Are role-based permissions employed to restrict users to access only the data and perform only the functions that they are supposed to?\n","1) Role permission report / matrix\n- Check that operator accounts in the mobile money system are role-based.\n- Check that there is an assessment on what roles are required and what permissions each role should have.",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.3","5.3.3: Providers shall limit access to customer data on a “need to know” basis","5.3.3.1","ROLE-BASED AUTHORIZATION FOR MOBILE MONEY APPLICATION USERS\nRole-based permissions should be employed for operator accounts in the mobile money system so that specific functions can be assigned to individuals on a granular level, so that users can be restricted to access only the data and perform only the functions that they are supposed to.\n\nMaker-checker should be implemented to prevent a single person from accessing or modifying financial information without authorization or detection. Maker-checker should be enforced for these functions:\n  - financially-sensitive actions/events such as moving money between accounts, \n  - creating more operator accounts (which could be used to steal funds);\n  - accessing and modifying audit records to hide their tracks.\n\nThe possibility of collusion should be considered in designing the controls. Whenever it is difficult to segregate, other controls such as monitoring of activities, audit trails and management supervision should be prioritised.","ISO 27002:2013 Sec. 9.2, BCBS RMPEB","5.3.3.1.1","5.3.3.3.1","Are role-based permissions employed to restrict users to access only the data and perform only the functions that they are supposed to?","1) Role permission report / matrix\n- Check that operator accounts in the mobile money system are role-based.\n- Check that there is an assessment on what roles are required and what permissions each role should have.",null,"Urgent Required","Required","TechOps",null,null,"5","5.3","5.3.3","5.3.3: Les prestataires doivent limiter l’accès aux données clients aux personnes qui en ont besoin.","5.3.3.1","AUTORISATIONS LIÉES AU POSTE POUR LES UTILISATEURS DE L'APPLICATION D’ARGENT MOBILE \nLes comptes d’opérateurs du système de l'argent mobile doivent être dotés d'autorisations liées au poste de façon à ce que des fonctions spécifiques puissent être assignées à chaque personne au niveau de granularité du système et à ce que les utilisateurs puissent uniquement accéder aux données et effectuer les fonctions couvertes par leur mission.\n\nLa séparation des fonctions, c’est-à-dire exiger que l’exécution et la validation soient effectuées par deux personnes différentes, doit être mise en place afin d’empêcher qu’une personne puisse à elle seule accéder aux informations financières ou les modifier sans y être autorisée ni être repérée. La séparation des fonctions doit être implémentée pour les fonctions suivantes :\n - activités/événements financièrement sensibles  tels que les virements entre comptes ;\n - création d’autres comptes d’opérateurs (pouvant être utilisés afin de voler des fonds) ;\n - accès aux pistes d’audit et modification de ces derniers afin de ne laisser aucune trace.\n\nLa possibilité de collusion doit être prise en compte dans la conception des mesures de contrôle. Lorsqu’il est difficile d'appliquer la séparation des fonctions, d’autres mesures de contrôle doivent être utilisées en priorité, telles que la surveillance des activités, les pistes d’audit et la supervision hiérarchique.",{"$f":"BB90","v":"ISO 27002:2013 Sec. 9.2, BCBS RMPEB"},"5.3.3.1.1","Des permissions liées au poste occupé sont-elles en place, permettant aux utilisateurs d'accéder aux données et de réaliser les fonctions pertinentes pour leur poste uniquement ?","1) Rapport/matrice de permission liée au poste\n- Vérifier que les comptes d’opérateurs du système de l’argent mobile sont dotés d'autorisations liées au poste\n- Vérifier qu’une évaluation a été effectuée afin de définir les postes concernés et les autorisations devant être attribuées à chaque poste.",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.3","5.3.3","5.3.3: Los proveedores deben limitar el acceso a los datos de los clientes según sea necesario","5.3.3.1","AUTORIZACIÓN BASADA EN ROLES PARA LOS USUARIOS DE LA APLICACIÓN DEL DINERO MÓVIL\nSe deben emplear permisos basados en roles para las cuentas de los operadores en el sistema del dinero móvil para que se puedan asignar funciones específicas a las personas a nivel granular, a fin de que se pueda restringir el acceso de los usuarios solo a los datos  y a realizar solo las funciones que se supone que deben realizar.\n\nSe debe implementar el rol de ejecutor-verificador para evitar que una sola persona acceda o modifique la información financiera sin autorización o detección.Para las el sistema debe exigir la división de funciones - es decir, requerir que distintas personas realicen las funciones de ejecutor y verificador. \n\nEl rol de ejecutor-verificador se debe exigir para las siguientes funciones:\n  -  acciones/eventos financieramente sensibles, tales como las transferencias de dinero entre cuentas; \n  - crear más cuentas de operadores (que se podrían utilizar para robar fondos); \n  - acceder y modificar registros de auditoría para esconder sus rastros.\n\nAl diseñar los controles se debe considerar la posibilidad de connivencia. Cuando es difícil realizar la división, se deben priorizar otros controles, tales como el monitoreo de las actividades, las pistas de auditoría y la supervisión de gestión.",{"$f":"BB90","v":"ISO 27002:2013 Sec. 9.2, BCBS RMPEB"},"5.3.3.1.1","¿Se emplean permisos basados en roles para restringir el acceso de los usuarios solo a los datos y a realizar solo las funciones que se supone deben realizar?","1) Informe / matriz de permisos por roles\n- Verificar que las cuentas de los operadores en el sistema del dinero móvil estén basadas en roles.\n- Verificar que exista una evaluación sobre qué roles se requieren y qué permisos debe tener cada rol.  ",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.3","5.3.3",null,"5.3.3.1",null,{"$f":"BB90","v":"ISO 27002:2013 Sec. 9.2, BCBS RMPEB"},"5.3.3.1.1",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.3.3.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.3",0,"5.3.3.1",null,0,"5.3.3.1.2","5.3.3.1.2: Is maker-checker enforced for all financially-sensitive actions (e.g. moving money between accounts)?\n","1) Role permission report / matrix\n- Check that maker-checker controls are in place for all financially-sensitive actions.\n",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.3",null,"5.3.3.1",null,null,"5.3.3.1.2","5.3.3.3.2","Is maker-checker enforced for all financially-sensitive actions (e.g. moving money between accounts)?","1) Role permission report / matrix\n- Check that maker-checker controls are in place for all financially-sensitive actions.\n",null,"Urgent Required","Required","TechOps",null,null,"5","5.3","5.3.3",null,"5.3.3.1",null,0,"5.3.3.1.2","la séparation des fonctions (exécution/validation) s'applique-t-elle à toutes les actions financièrement sensibles (ex. mouvements d'argent entre comptes) ?","1) Rapport /matrice de permission liée au poste\n- Vérifier que des contrôles de la séparation des fonctions (exécution/validation) sont en place pour l’ensemble des actions financièrement sensibles.\n",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.3","5.3.3",null,"5.3.3.1",null,0,"5.3.3.1.2","¿Se exige un ejecutor-verificador para todas las acciones financieramente sensibles (por ej., transferencias de dinero entre cuentas)?","1) Informe / matriz de permisos por roles\n- Verificar que se hayan implementado los controles de ejecutor-verificador para todas las acciones financieramente sensibles.  \n",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.3","5.3.3",null,"5.3.3.1",null,0,"5.3.3.1.2",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.3.3.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.3",0,"5.3.3.1",null,0,"5.3.3.1.3","5.3.3.1.3: Is maker-checker enforced for operator-creation functions, so that normal operators cannot create more operator accounts (which could potentially be used to steal funds)?\n","1) Role permission report / matrix\n- Check there is maker-checker in place for operator-creation functions.\n- Check that regular operator permissions do not include the ability to create more operators.",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.3",null,"5.3.3.1",null,null,"5.3.3.1.3","5.3.3.3.3","Is maker-checker enforced for operator-creation functions, so that normal operators cannot create more operator accounts (which could potentially be used to steal funds)?","1) Role permission report / matrix\n- Check there is maker-checker in place for operator-creation functions.\n- Check that regular operator permissions do not include the ability to create more operators.",null,"Urgent Required","Required","TechOps",null,null,"5","5.3","5.3.3",0,"5.3.3.1",null,0,"5.3.3.1.3","la séparation des fonctions (exécution/validation) s'applique-t-elle à toutes les fonctions de création d'opérateurs, de façon à ce que les opérateurs ordinaires ne puissent pas créer d’autres comptes d’opérateur (qui pourraient potentiellement être utilisés afin de voler des fonds) ?","1) Rapport/matrice de permission liée au poste\n- Vérifier que la séparation des fonctions (exécution/validation) a été mise en place pour les fonctions de création d’opérateurs.\n- Vérifier que les autorisations accordées aux opérateurs ordinaires n’incluent pas la possibilité de créer d’autres opérateurs.",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.3","5.3.3",null,"5.3.3.1",null,0,"5.3.3.1.3","¿Se exigen los roles de ejecutor-verificador para las funciones de creación de operadores de modo que los operadores estándar no puedan crear más cuentas de operadores (que se podrían utilizar para el potencial robo de fondos)?","1) Informe / matriz de permisos por roles\n- Verificar que existan un ejecutor-verificador para las funciones de creación de operadores.\n- -Verificar que los permisos de los operadores estándar no incluyan la capacidad de crear más operadores.  ",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.3","5.3.3",null,"5.3.3.1",null,0,"5.3.3.1.3",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.3.3.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.3","","5.3.3.1",null,0,"5.3.3.1.4","5.3.3.1.4: Where segregation of duties is difficult, are other controls such as monitoring of activities, audit trails, and management supervision prioritised?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.3","","5.3.3.1",null,null,"5.3.3.1.4","5.3.3.3.5","Where segregation of duties is difficult, are other controls such as monitoring of activities, audit trails, and management supervision prioritised?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.3","","5.3.3.1",null,0,"5.3.3.1.4","lorsqu’il est difficile d'appliquer la séparation des fonctions, est-ce que d’autres mesures de contrôle, telles que la surveillance des activités, les pistes d’audit et la supervision hiérarchique, sont mises en place ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.3","","5.3.3.1",null,0,"5.3.3.1.4","Cuando se dificulta la división de funciones, ¿se priorizan otros controles tales como el monitoreo de actividades, las pistas de auditoría y la supervisión de gestión?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.3",null,"5.3.3.1",null,0,"5.3.3.1.4",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.3.3.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.3",0,"5.3.3.2","5.3.3.2: AUTHORIZATION FOR MOBILE MONEY SYSTEM COMPONENTS\nProviders should limit access to system components, databases and log files to only those individuals whose job requires such access, following the principle of \"least privilege\". Providers should: \n- restrict access to the system components and data resources that each user needs to access for their job function;\n- restrict access to the least privilege necessary to perform job responsibilities;\n- require documented approval (electronically or in writing) by authorized parties for all new and changed account privileges.\n\nSpecific controls should be applied to databases containing financial and customer data:\n- Direct access to databases should be carefully controlled and only granted to database administrators.\n- Application IDs for database applications must only be used by the applications (and not by individual users or other non-application processes). It is recommended that monitoring is implemented to check for this.\n\nA user account and role/permissions report should be run at least every three months to highlight those accounts with inappropriate permissions.","PCI DSS, ISO 27002: 2013 Sec. 9.2, 9.4","5.3.3.2.1","5.3.3.2.1: Is access to back-end mobile money system components/ databases/log files restricted to only those individuals whose job requires such access, restricting access to the least privilege and only those components necessary to perform job responsibilities?\n","1) Access control standard or security policy or similar document\n- Check there is a process to give access to back-end mobile money system components/databases/log files.\n- Check the process include assessment as to what access is required.\n- Check the process only gives the access permissions that are required and only to the required components.\n",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.3",null,"5.3.3.2","AUTHORIZATION FOR MOBILE MONEY SYSTEM COMPONENTS\nProviders should limit access to system components, databases and log files to only those individuals whose job requires such access, following the principle of \"least privilege\". Providers should: \n- restrict access to the system components and data resources that each user needs to access for their job function;\n- restrict access to the least privilege necessary to perform job responsibilities;\n- require documented approval (electronically or in writing) by authorized parties for all new and changed account privileges.\n\nSpecific controls should be applied to databases containing financial and customer data:\n- Direct access to databases should be carefully controlled and only granted to database administrators.\n- Application IDs for database applications must only be used by the applications (and not by individual users or other non-application processes). It is recommended that monitoring is implemented to check for this.\n\nA user account and role/permissions report should be run at least every three months to highlight those accounts with inappropriate permissions.","PCI DSS, ISO 27002: 2013 Sec. 9.2, 9.4","5.3.3.2.1","5.3.3.2.1","Is access to back-end mobile money system components/ databases/log files restricted to only those individuals whose job requires such access, restricting access to the least privilege and only those components necessary to perform job responsibilities?","1) Access control standard or security policy or similar document\n- Check there is a process to give access to back-end mobile money system components/databases/log files.\n- Check the process include assessment as to what access is required.\n- Check the process only gives the access permissions that are required and only to the required components.\n",null,"Urgent Required","Required","TechOps",null,null,"5","5.3","5.3.3",null,"5.3.3.2","AUTORISATION D’ACCÈS AUX COMPOSANTS DU SYSTÈME DE L’ARGENT MOBILE\nL’accès aux composants du système, aux bases de données et aux fichiers journaux doit être limité aux personnes qui en ont besoin pour leur travail, selon le principe des « droits minimaux ». Les prestataires doivent : \n- restreindre l’accès de chaque utilisateur aux seuls composants du système et ressources de données nécessaires à ses fonctions ;\n- limiter les droits d’accès au minimum nécessaire pour assumer les responsabilités inhérentes à chaque poste ;\n- exiger l’autorisation documentée (électroniquement ou par écrit) d’une personne habilitée pour tout ajout ou modification des droits d’accès.\n\nDes mesures de contrôle particulières doivent s’appliquer aux bases de données contenant des données financières ou liées aux clients :\n- l’accès direct aux bases de données doit être soigneusement contrôlé et accordé uniquement aux administrateurs des bases de données ;\n- les identifiants d’application pour les base de données ne doivent être utilisés que pour l’application concernée (et non par des utilisateurs individuels ou d’autres processus hors application). Il est recommandé de mettre en place des contrôles pour vérifier ces accès.\n\nUn rapport des comptes d’utilisateurs reprenant leurs rôles et permissions doit être tiré au minimum tous les trois mois pour faire ressortir les comptes ayant des autorisations n’ayant pas lieu d’être.","PCI DSS, ISO 27002: 2013 Sec. 9.2, 9.4","5.3.3.2.1","l’accès aux composants/bases de données/fichiers journaux du système de back-end de l'argent mobile est-il limité aux personnes qui en ont besoin pour leur travail, dans le respect du principe des « droits minimaux » et dans la limite des composants nécessaires à l'exécution de leurs tâches ?","1) Norme de contrôle des accès ou politique de sécurité ou document similaire\n- Vérifier qu’un processus a été mis en place pour accorder l’accès aux composants/bases de données/fichiers journaux du système de back-end d’argent mobile. \n- Vérifier que le processus inclut une évaluation permettant de définir quel accès est nécessaire.\n- Vérifier que le processus octroie les autorisations uniquement dans la limite des accès et des composants nécessaires.\n",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.3","5.3.3",null,"5.3.3.2","AUTORIZACIÓN PARA COMPONENTES DEL SISTEMA DEL DINERO MÓVIL\nLos proveedores deben limitar el acceso a los componentes del sistema, bases de datos y archivos de registro solo a las personas cuyo trabajo requiere dicho acceso, siguiendo el principio del \"menor privilegio\". Los proveedores deben: \n- restringir el acceso a los componentes del sistema y a los recursos de datos a los que cada usuario necesita acceder para su función de trabajo;\n- restringir el acceso al menor privilegio necesario para cumplir con las responsabilidades de su trabajo;\n- requerir la aprobación documentada (de forma electrónica o por escrito) de las partes autorizadas para todos los privilegios de cuentas nuevos o modificados.\n\nSe deben aplicar controles específicos a las bases de datos que contienen datos financieros y de clientes:\n- Se debe controlar cuidadosamente el acceso directo a las bases de datos, y debe ser otorgado solo a los administradores de las bases de datos.\n- Los ID de aplicaciones para las aplicaciones de las bases de datos deben ser utilizados solo por las aplicaciones (y no por los usuarios individuales u otros procesos distintos de los de las aplicaciones). Para verificarlo, se recomienda implementar el monitoreo.\n\nSe debe ejecutar un informe de cuentas de usuarios y de permisos/roles, al menos, una vez cada tres meses para resaltar las cuentas con permisos inadecuados.","PCI DSS, ISO 27002: 2013 Sec. 9.2, 9.4","5.3.3.2.1","¿El acceso a los componentes/bases de datos/archivos de registro del sistema back-end del dinero móvil está restringido solo a las personas cuyo trabajo requiere dicho acceso, restringiendo el acceso con el menor privilegio y solo a los componentes necesarios para cumplir con las responsabilidades del trabajo?","1) Estándar de control de acceso, política de seguridad o documento similar\n- Verificar que exista un proceso para otorgar acceso a los componentes/bases de datos/archivos de registro del sistema back-end del dinero móvil\n- Verificar que el proceso incluya una evaluación respecto de qué tipo de acceso se requiere.\n- Verificar que el proceso solo otorgue los permisos de acceso necesarios a los componentes requeridos únicamente.\n",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.3","5.3.3",null,"5.3.3.2",null,"PCI DSS, ISO 27002: 2013 Sec. 9.2, 9.4","5.3.3.2.1",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.3.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.3","","5.3.3.2",null,0,"5.3.3.2.2","5.3.3.2.2: Is documented approval by authorized parties required for all new and changed account privileges?\n","1) Access control standard or security policy or similar document\n- Check that there is a process that requires documented approval by authorised parties required for all:\na) new account privileges\nb) changes in account privileges\n- Check that there is a process to identify who is authorised to approve new and changes to account privileges\n",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.3","","5.3.3.2",null,null,"5.3.3.2.2","5.3.3.2.2","Is documented approval by authorized parties required for all new and changed account privileges?","1) Access control standard or security policy or similar document\n- Check that there is a process that requires documented approval by authorised parties required for all:\na) new account privileges\nb) changes in account privileges\n- Check that there is a process to identify who is authorised to approve new and changes to account privileges\n",null,"Urgent Required","Required","TechOps",null,null,"5","5.3","5.3.3",null,"5.3.3.2",0,0,"5.3.3.2.2","une autorisation documentée par une personne habilitée est-elle requise pour tout ajout ou modification des droits d’accès aux comptes ?","1) Norme de contrôle des accès ou politique de sécurité ou document similaire\n- Vérifier qu’un processus a été mis en place afin de soumettre à une autorisation documentée par une personne habilitée :\na) l’ajout de droits d’accès aux comptes\nb) les modifications des droits d’accès aux comptes \n- Vérifier qu’un processus a été mis en place afin d’identifier les personnes habilitées à autoriser l’ajout ou la modification de droits d’accès\n",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.3","5.3.3","","5.3.3.2",null,0,"5.3.3.2.2","¿Se requiere la aprobación documentada de las partes autorizadas para todos los privilegios de cuentas nuevos y modificados?","1) Estándar de control de acceso, política de seguridad o documento similar \n- Verificar que exista un proceso que requiera la aprobación documentada de las partes autorizadas para todo lo siguiente:\na) nuevos privilegios de cuentas \nb) cambios a los privilegios de cuentas\n- Verificar que exista un proceso para identificar quién está autorizado a aprobar privilegios de cuentas nuevos o modificados\n",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.3","5.3.3",null,"5.3.3.2",null,0,"5.3.3.2.2",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.3.2.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.3","","5.3.3.2",null,0,"5.3.3.2.3",{"$f":"BC96&\": \"&CHOOSE(LanguageNumber,BE96,BU96,CK96,DA96)&CarriageReturn","v":"5.3.3.2.3: Is direct access to databases carefully controlled and only given to database administrators?\n"},{"$f":"CHOOSE(LanguageNumber,BF96,BV96,CL96,DB96)","v":"1) Access control standard or security policy or similar document\n- Check that there is a process that restricts direct access to databases with only database administrators granted access\n- Check that there are controls in place for granting direct access to the database\n"},0,{"$f":"CHOOSE(LanguageNumber,BH96,BX96,CN96,DD96)","v":"Standard Required"},{"$f":"CHOOSE(LanguageNumber,BI96,BY96,CO96,DE96)","v":"Required"},"TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.3","","5.3.3.2",null,null,"5.3.3.2.3","5.3.3.2.3","Is direct access to databases carefully controlled and only given to database administrators?","1) Access control standard or security policy or similar document\n- Check that there is a process that restricts direct access to databases with only database administrators granted access\n- Check that there are controls in place for granting direct access to the database\n",null,"Standard Required","Required","TechOps",null,null,"5","5.3","5.3.3","","5.3.3.2",0,0,"5.3.3.2.3","l’accès direct aux bases de données est-il soigneusement contrôlé et accordé uniquement aux administrateurs des bases de données ?","1) Norme de contrôle des accès ou politique de sécurité ou document similaire\n- Vérifier qu’un processus a été mis en place afin de limiter l’accès direct aux bases de données et d’accord l’accès uniquement aux administrateurs des bases de données\n- Vérifier que des contrôles ont été mis en place afin d’encadrer l’accès direct à la base de données\n",null,{"$f":"VLOOKUP($BH96,CategoryTranslationTable,2,FALSE)","v":"Requis Normal"},{"$f":"VLOOKUP($BI96,CategoryTranslationTable,2,FALSE)","v":"Requis"},"TechOps",null,null,"5","5.3","5.3.3","","5.3.3.2",null,0,"5.3.3.2.3","¿El acceso directo a las bases de datos es controlado cuidadosamente y otorgado solo a los administradores de las bases de datos?","1) Estándar de control de acceso, política de seguridad o documento similar\n- Verificar que exista un proceso que restrinja el acceso directo a las bases de datos solo a los administradores de las bases de datos\n- Verificar que se hayan implementado controles para otorgar acceso directo a la base de datos\n",null,{"$f":"VLOOKUP($BH96,CategoryTranslationTable,3,FALSE)","v":"Obligatorio estándar"},{"$f":"VLOOKUP($BI96,CategoryTranslationTable,3,FALSE)","v":"Obligatorio"},"TechOps",null,null,"5","5.3","5.3.3",null,"5.3.3.2",null,0,"5.3.3.2.3",null,null,null,{"$f":"VLOOKUP($BH96,CategoryTranslationTable,4,FALSE)","v":"ReqS4"},{"$f":"VLOOKUP($BI96,CategoryTranslationTable,4,FALSE)","v":"Req4"},"TechOps",null,null,null,null,null,null,null,null,"5.3.3.2.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.3","","5.3.3.2",null,0,"5.3.3.2.4","5.3.3.2.4: Are application IDs for database applications only used by the applications and not by individual users or other non-application processes?\n","1) Access control standard or security policy or similar document\n- Check there is a process to ensure application IDs for databases are not used by individuals or other non-application processes.",0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.3","","5.3.3.2",null,null,"5.3.3.2.4","5.3.3.2.4","Are application IDs for database applications only used by the applications and not by individual users or other non-application processes?","1) Access control standard or security policy or similar document\n- Check there is a process to ensure application IDs for databases are not used by individuals or other non-application processes.",null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.3","","5.3.3.2",0,0,"5.3.3.2.4","les identifiants d’application pour les base de données sont-ils uniquement utilisés pour l’application concernée et non par des utilisateurs individuels ou d’autres processus hors application ?","1) Norme de contrôle des accès ou politique de sécurité ou document similaire\n- Vérifier qu’un processus a été mis en place afin de s’assurer que les identifiants d’application pour les bases de données sont uniquement utilisés par les applications\n- Vérifier qu’un processus a été mis en place afin de s’assurer que les identifiants d’application pour les bases de données ne sont pas utilisés par des utilisateurs individuels ou d’autres processus hors application\n",null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.3","","5.3.3.2",null,0,"5.3.3.2.4","¿Los ID de aplicaciones para las aplicaciones de las bases de datos son utilizados únicamente por las aplicaciones y no por los usuarios individuales u otros procesos distintos de los de las aplicaciones?","1) Estándar de control de acceso, política de seguridad o documento similar\n- Verificar que exista un proceso para garantizar que los ID de aplicaciones para las aplicaciones de las bases de datos sean utilizados solo por las aplicaciones\n- Verificar que exista un proceso para garantizar que los ID de aplicaciones para las bases de datos no sean utilizados por personas u otros procesos distintos de los de las aplicaciones\n",null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.3",null,"5.3.3.2",null,0,"5.3.3.2.4",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.3.2.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.3","","5.3.3.2",null,0,"5.3.3.2.5","5.3.3.2.5: Is a user account and role/ permissions report run at least every three months to highlight those accounts with inappropriate permissions?\n","1) Access control standard or security policy or similar document\n- Check that there is a process to run reports on user account and role permissions to highlight accounts with inappropriate permissions\n- Check that the process is scheduled to be run at least every three months\n- Check the records of reports to assess that the process is being run at least every three months\n",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.3","","5.3.3.2",null,null,"5.3.3.2.5","5.3.3.2.5","Is a user account and role/ permissions report run at least every three months to highlight those accounts with inappropriate permissions?","1) Access control standard or security policy or similar document\n- Check that there is a process to run reports on user account and role permissions to highlight accounts with inappropriate permissions\n- Check that the process is scheduled to be run at least every three months\n- Check the records of reports to assess that the process is being run at least every three months\n",null,"Standard Required","Required","TechOps",null,null,"5","5.3","5.3.3","","5.3.3.2",0,0,"5.3.3.2.5","un rapport des comptes d’utilisateurs reprenant leurs rôles et leurs permissions est-il tiré au minimum tous les trois mois pour faire ressortir les autorisations de compte n’ayant pas lieu d’être ?","1) Norme de contrôle des accès ou politique de sécurité ou document similaire\n- Vérifier qu’un processus a été mis en place afin d’établir des rapports des comptes d’utilisateurs et faire ressortir les comptes ayant des autorisations n’ayant pas lieu d’être\n- Vérifier que le processus est programmé pour être effectué au minimum tous les trois mois\n- Vérifier les registres des rapports afin d’évaluer si le processus est bien effectué tous les trois mois au minimum\n",null,"Requis Normal","Requis","TechOps",null,null,"5","5.3","5.3.3","","5.3.3.2",null,0,"5.3.3.2.5","¿Se ejecuta un informe de cuentas de usuarios y de permisos/roles, al menos, una vez cada tres meses para resaltar las cuentas con permisos inadecuados?","1) Estándar de control de acceso, política de seguridad o documento similar \n- Verificar que exista un proceso para ejecutar informes sobre las cuentas de usuarios y los permisos por roles para resaltar las cuentas con permisos inadecuados\n- Verificar que el proceso esté programado para ejecutarse, al menos, una vez cada tres meses\n- Verificar el registro de informes para evaluar si el proceso se está ejecutando, al menos, una vez cada tres meses\n",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.3","5.3.3",null,"5.3.3.2",null,0,"5.3.3.2.5",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.3.2.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.4","5.3.4: Providers shall limit physical access to systems","5.3.4.1","5.3.4.1: ACCESS CONTROL POLICY - PHYSICAL ACCESS\nProviders should control physical access for onsite personnel to sensitive areas such as data centres. Access must be authorized and based on individual job function. \n\nThe policy should require that physical access privileges should be assigned only to those users that require it. Visitor access should be strictly controlled.\n\nPhysical access rights should be revoked promptly upon termination, and all physical access mechanisms (such as keys and access cards) should be returned or disabled.","PCI DSS, ISO 27002:2013 Sec. 11.1","5.3.4.1.1","5.3.4.1.1: Is access to mobile money system data centres restricted to authorized personnel, and only when required for the individual’s job function?\n","1) Access control standard or security policy or similar document\n- Check physical access to the mobile money system's data centre is restricted to authorised personnel.\n- Check those who have authorised access the data-centre only access it when their individual job requires it.\n(Note: if practical, visit the datacentre to assess if the above is operational)\n",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.4","5.3.4: Providers shall limit physical access to systems","5.3.4.1","ACCESS CONTROL POLICY - PHYSICAL ACCESS\nProviders should control physical access for onsite personnel to sensitive areas such as data centres. Access must be authorized and based on individual job function. \n\nThe policy should require that physical access privileges should be assigned only to those users that require it. Visitor access should be strictly controlled.\n\nPhysical access rights should be revoked promptly upon termination, and all physical access mechanisms (such as keys and access cards) should be returned or disabled.","PCI DSS, ISO 27002:2013 Sec. 11.1","5.3.4.1.1","5.3.4.2.1","Is access to mobile money system data centres restricted to authorized personnel, and only when required for the individual’s job function?","1) Access control standard or security policy or similar document\n- Check physical access to the mobile money system's data centre is restricted to authorised personnel.\n- Check those who have authorised access the data-centre only access it when their individual job requires it.\n(Note: if practical, visit the datacentre to assess if the above is operational)\n",null,"Urgent Required","Required","TechOps",null,null,"5","5.3","5.3.4","5.3.4: Les prestataires doivent restreindre l’accès physique aux systèmes.","5.3.4.1","ACCÈS PHYSIQUE RÉSERVÉ AU PERSONNEL AUTORISÉ\nLes prestataires doivent contrôler l’accès physique du personnel du site aux zones sensibles telles que les centres de données. L'accès doit être autorisé en fonction du poste occupé par chacun. \n\nLes droits d’accès physique ne peuvent être attribués qu’aux utilisateurs qui en ont besoin. L’accès des visiteurs doit être strictement contrôlé.\n\nLes droits d’accès physique doivent être révoqués dès que le titulaire quitte son emploi et tous les dispositifs d’accès physique (tels que clés ou cartes d’accès) doivent être récupérés ou désactivés.","PCI DSS, ISO 27002:2013 Sec. 11.1","5.3.4.1.1","l’accès physique aux centres de données du système de l'argent mobile est-il réservé au personnel autorisé, uniquement lorsque les fonctions des personnes concernées l'exigent?","1) Norme de contrôle des accès ou politique de sécurité ou document similaire\n- Vérifier que l’accès physique au centre de données du système d’argent mobile est réservé au personnel autorisé.\n- Vérifier que les personnes autorisées à accéder au centre de données ne peuvent le faire que lorsque leurs fonctions individuelles l’exigent.\n(Remarque : si possible, effectuer une visite du centre de données afin d’évaluer si ce processus est opérationnel)\n",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.3","5.3.4","5.3.4: Los proveedores deben limitar el acceso físico a los sistemas","5.3.4.1","POLÍTICA DE CONTROL DE ACCESO - ACCESO FÍSICO\nLos proveedores deben controlar el acceso físico del personal del sitio a las áreas sensibles, tales como los centros de datos. El acceso debe ser autorizado en base a la función del trabajo individual. \n\nLa política debe requerir que se asignen privilegios de acceso físico solo a aquellos usuarios que lo requieran. El acceso de visitantes debe ser estrictamente controlado.\n\nSe deben revocar inmediatamente los derechos de acceso físico al momento de la terminación, y se deben devolver o deshabilitar todos los mecanismos de acceso físico (tales como llaves y tarjetas de acceso).","PCI DSS, ISO 27002:2013 Sec. 11.1","5.3.4.1.1","¿El acceso a los centros de datos del sistema del dinero móvil está restringido al personal autorizado, solo cuando lo requiera la función del trabajo individual?","1) Estándar de control de acceso, política de seguridad o documento similar \n- Verificar que el acceso físico al centro de datos del sistema del dinero móvil esté restringido al personal autorizado.\n- Verificar que quienes tengan acceso autorizado al centro de datos, accedan solo cuando su trabajo individual lo requiera.\n(Nota: si es posible, visitar el centro de datos para evaluar si esto está funcionando)\n",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.3","5.3.4",null,"5.3.4.1",null,"PCI DSS, ISO 27002:2013 Sec. 11.1","5.3.4.1.1",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,"MERGE","5.3.4.2.1","5.3.4.1.1",null,null,{"$error":"#REF!"},{"$error":"#REF!"},"","",{"$error":"#REF!"},{"$error":"#REF!"},"","",2,"",{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,2,""]
[null,"5","5.3","5.3.4","","5.3.4.1",null,0,"5.3.4.1.2","5.3.4.1.2: Are physical access rights revoked promptly upon termination of an employee, and all physical access mechanisms (such as keys and access cards) returned or disabled?\n","1) Access control standard or security policy or similar document\n- Check that there is a process to revoke all physical access rights promptly upon the termination of an employee\n- Check that the process includes the return/disabling of access mechanisms (i.e. keys and access cards)\n(Note: if practical, visit the data centre to assess if the above is operational)\n",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.4","","5.3.4.1",null,null,"5.3.4.1.2","5.3.4.2.2","Are physical access rights revoked promptly upon termination of an employee, and all physical access mechanisms (such as keys and access cards) returned or disabled?","1) Access control standard or security policy or similar document\n- Check that there is a process to revoke all physical access rights promptly upon the termination of an employee\n- Check that the process includes the return/disabling of access mechanisms (i.e. keys and access cards)\n(Note: if practical, visit the data centre to assess if the above is operational)\n",null,"Standard Required","Required","TechOps",null,null,"5","5.3","5.3.4",null,"5.3.4.1",0,0,"5.3.4.1.2","les droits d’accès physique sont-ils révoqués dès que le titulaire quitte son emploi et tous les dispositifs d’accès physique (tels que clés ou cartes d’accès) sont-ils récupérés ou désactivés ?","1) Norme de contrôle des accès ou politique de sécurité ou document similaire\n- Vérifier qu’un processus a été mis en place afin de révoquer l’ensemble des droits d’accès physique dès que le titulaire quitte son emploi\n- Vérifier que ce processus inclut la récupération/la désactivation des dispositifs d’accès (clés et cartes d’accès)\n(Remarque : si possible, effectuer une visite du centre de données afin d’évaluer si ce processus est opérationnel)\n",null,"Requis Normal","Requis","TechOps",null,null,"5","5.3","5.3.4","","5.3.4.1",null,0,"5.3.4.1.2","¿Se revocan los derechos de acceso físico inmediatamente al momento de la terminación de la relación laboral y se devuelven o deshabilitan todos los mecanismos de acceso físico (tales como llaves y tarjetas de acceso)?","1) Estándar de control de acceso, política de seguridad o documento similar\n- Verificar que exista un proceso para revocar todos los derechos de acceso físico inmediatamente al momento de la terminación de la relación laboral\n- Verificar que el proceso incluya la devolución/inhabilitación de los mecanismos de acceso (es decir, llaves y tarjetas de acceso)\n(Nota: si es posible, visitar el centro de datos para evaluar si esto está funcionando)\n",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.3","5.3.4",null,"5.3.4.1",null,0,"5.3.4.1.2",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.4.2.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.4","","5.3.4.2","5.3.4.2: PHYSICAL ACCESS - ENTRY CONTROLS\nProviders should use appropriate facility entry controls to limit and monitor physical access to computer rooms, data centres, and other physical areas with mobile money system components. Providers should:\n- control entry with locked doors and mechanisms to avoid tailgating (unauthorized people following authorized users into the area);\n- maintain logs of people entering the data centre and keep the logs for at least three months;\n- implement controls to restrict access to network points and telecommunication lines.\n","PCI DSS, ISO 27002: 2013 Sec. 11.1","5.3.4.2.1","5.3.4.2.1: Are there physical security controls for each computer room, data centre, and other physical areas with mobile money system components?\n","1) Access control standard or security policy or similar document\n- Check that there are physical security controls for each computer room, data centre and any other physical areas that contain mobile money system components\n(Note: if practical, visit the data centre to assess if the above is operational)\n",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.4","","5.3.4.2","PHYSICAL ACCESS - ENTRY CONTROLS\nProviders should use appropriate facility entry controls to limit and monitor physical access to computer rooms, data centres, and other physical areas with mobile money system components. Providers should:\n- control entry with locked doors and mechanisms to avoid tailgating (unauthorized people following authorized users into the area);\n- maintain logs of people entering the data centre and keep the logs for at least three months;\n- implement controls to restrict access to network points and telecommunication lines.\n","PCI DSS, ISO 27002: 2013 Sec. 11.1","5.3.4.2.1","5.3.4.3.1","Are there physical security controls for each computer room, data centre, and other physical areas with mobile money system components?","1) Access control standard or security policy or similar document\n- Check that there are physical security controls for each computer room, data centre and any other physical areas that contain mobile money system components\n(Note: if practical, visit the data centre to assess if the above is operational)\n",null,"Urgent Required","Required","TechOps",null,null,"5","5.3","5.3.4","","5.3.4.2","ACCÈS PHYSIQUE - CONTRÔLES D’ENTRÉE\nLes prestataires doivent mettre en place des contrôles d’entrée appropriés pour l’accès à leurs locaux afin de limiter et de surveiller l’accès physique aux salles informatiques, centres de données et autres locaux où se trouvent des composantes du système de l’argent mobile. Ils doivent :\n- contrôler l’entrée dans les locaux au moyen de portes verrouillées et de mécanismes empêchant des personnes non autorisées de se faufiler derrière des utilisateurs autorisés (tailgating) ;\n- tenir des registres des personnes entrant dans le centre de données et les conserver pendant au moins trois mois ; \n- mettre en place des contrôles visant à empêcher l’accès aux points de réseau et aux lignes de télécommunication.","PCI DSS, ISO 27002: 2013 Sec. 11.1","5.3.4.2.1","existe-t-il des mesures de contrôle de sécurité physique pour l'ensemble des salles informatiques, centres de données et autres locaux abritant des composants du système de l'argent mobile ?","1) Norme de contrôle des accès ou politique de sécurité ou document similaire\n- Vérifier que des mesures de contrôle de sécurité physique ont été mises en place pour chaque salle informatique, centre de données et autres locaux abritant des composants du système d’argent mobile\n(Remarque : si possible, effectuer une visite du centre de données afin d’évaluer si ce processus est opérationnel)\n",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.3","5.3.4","","5.3.4.2","ACCESO FÍSICO - CONTROLES DE INGRESO \nLos proveedores deben emplear controles de ingreso a las instalaciones adecuados para limitar y monitorear el acceso físico a las salas de computadoras, centros de datos y otras áreas físicas con componentes del sistema del dinero móvil. Los proveedores deben:\n- controlar el ingreso con puertas cerradas con llave y mecanismos para evitar infiltraciones (personas no autorizadas que ingresan al área siguiendo a usuarios autorizados);\n- mantener registros de las personas que ingresan al centro de datos y conservar los registros durante, al menos, tres meses;\n- implementar controles para restringir el acceso a los puntos de red y líneas de telecomunicaciones.","PCI DSS, ISO 27002: 2013 Sec. 11.1","5.3.4.2.1","¿Existen controles de seguridad para cada sala de computadoras, centro de datos y otras áreas físicas con componentes del sistema del dinero móvil?","1) Estándar de control de acceso, política de seguridad o documento similar\n- Verificar que existan controles de seguridad físicos para cada sala de computadoras, centro de datos y cualquier otra área física que contenga componentes del sistema del dinero móvil\n(Nota: si es posible, visitar el centro de datos para evaluar si esto está operativo)\n",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.3","5.3.4",null,"5.3.4.2",null,"PCI DSS, ISO 27002: 2013 Sec. 11.1","5.3.4.2.1",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.4.3.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.4","","5.3.4.2",null,0,"5.3.4.2.2","5.3.4.2.2: Are logs maintained of people entering the mobile money data centre and kept for at least three months?\n","1)  Access control standard or security policy or similar document\n- Check there is a process to log all people that access the mobile money data-centres.\n- Check the log is kept for at least three months.\n\n2) Access log \n- Review log to confirm that logs are maintained of people entering the mobile money data centre and kept for at least three months.\n\n",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.4","","5.3.4.2",null,null,"5.3.4.2.2","5.3.4.3.3","Are logs maintained of people entering the mobile money data centre and kept for at least three months?","1)  Access control standard or security policy or similar document\n- Check there is a process to log all people that access the mobile money data-centres.\n- Check the log is kept for at least three months.\n\n2) Access log \n- Review log to confirm that logs are maintained of people entering the mobile money data centre and kept for at least three months.\n\n",null,"Urgent Required","Required","TechOps",null,null,"5","5.3","5.3.4","","5.3.4.2",0,0,"5.3.4.2.2","existe-t-il un registre des personnes entrant dans le centre de données de l'argent mobile et ce registre est-il conservé pendant au moins trois mois ?","1) Norme de contrôle des accès ou politique de sécurité ou document similaire\n- Vérifier qu’un processus a été mis en place afin d’établir un registre des personnes entrant dans les centres de données de l’argent mobile.\n- Vérifier que ce registre est conservé pendant au moins trois mois.\n2) Registre d’accès\n- Analyser le registre d'accès afin de confirmer que ce registre est conservé sur les personnes qui entrent dans le centre de données de l'argent mobile, et conservé pendant au moins trois mois.\n",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.3","5.3.4","","5.3.4.2",null,0,"5.3.4.2.2","¿Se mantienen registros de las personas que ingresan al centro de datos del dinero móvil y se conservan por, al menos, tres meses?","1) Estándar de control de acceso, política de seguridad o documento similar\n- Verificar que exista un proceso para registrar a todas las personas que ingresan a los centros de datos del dinero móvil.\n- Verificar que el registro se conserve durante, al menos, tres meses.\n\n2) Registro de acceso\n- Revisar el registro para confirmar que se mantengan registros de las personas que ingresan al centro de datos del dinero móvil y que se conserven durante, al menos, tres meses.\n\n",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.3","5.3.4",null,"5.3.4.2",null,0,"5.3.4.2.2",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.4.3.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.4","","5.3.4.2",null,0,"5.3.4.2.3","5.3.4.2.3: Have controls been implemented in the mobile money data centre to restrict access to network points and telecommunication lines?\n","1) Access control standard or security policy or similar document\n- Check that there are security controls that restrict access to network points and telecommunication lines.",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.4","","5.3.4.2",null,null,"5.3.4.2.3","5.3.4.3.4","Have controls been implemented in the mobile money data centre to restrict access to network points and telecommunication lines?","1) Access control standard or security policy or similar document\n- Check that there are security controls that restrict access to network points and telecommunication lines.",null,"Standard Required","Required","TechOps",null,null,"5","5.3","5.3.4","","5.3.4.2",0,0,"5.3.4.2.3","des mesures de contrôle sont-elles en place au sein du centre de données de l'argent mobile pour empêcher l'accès aux points de réseau et aux lignes de télécommunication ?","1) Norme de contrôle des accès ou politique de sécurité ou document similaire\n- Vérifier que des mesures de contrôle de sécurité sont en place afin d’empêcher l’accès aux points de réseau et aux lignes de télécommunication.",null,"Requis Normal","Requis","TechOps",null,null,"5","5.3","5.3.4","","5.3.4.2",null,0,"5.3.4.2.3","¿Se implementaron controles en el centro de datos del dinero móvil para restringir el acceso a los puntos de red y líneas de telecomunicaciones?","1) Estándar de control de acceso, política de seguridad o documento similar \n- Verificar que existan controles de seguridad que restrinjan el acceso a los puntos de red y líneas de telecomunicaciones.",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.3","5.3.4",null,"5.3.4.2",null,0,"5.3.4.2.3",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.4.3.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.4","","5.3.4.2",null,0,"5.3.4.2.4","5.3.4.2.4: Is entry to the mobile money data centre controlled with locked doors and mechanisms to avoid tailgating (unauthorized people following authorized users into the area)?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.4","","5.3.4.2",null,null,"5.3.4.2.4","5.3.4.3.2","Is entry to the mobile money data centre controlled with locked doors and mechanisms to avoid tailgating (unauthorized people following authorized users into the area)?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.4","","5.3.4.2",null,null,"5.3.4.2.4","l'accès au centre de données de l'argent mobile est-il contrôlé au moyen de portes verrouillées et de mécanismes empêchant des personnes non autorisées de se faufiler à la suite d’utilisateurs autorisés?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.4","","5.3.4.2",null,null,"5.3.4.2.4","¿El ingreso al centro de datos del dinero móvil es controlado con puertas cerradas con llave y mecanismos para evitar infiltraciones (personas no autorizadas que ingresan al área siguiendo a usuarios autorizados)?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.4",null,"5.3.4.2",null,null,"5.3.4.2.4",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.4.3.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.4","","5.3.4.3",{"$f":"AZ105&\": \"&CHOOSE(LanguageNumber,BA105,BR105,CH105,CX105)","v":"5.3.4.3: PHYSICAL ACCESS - VISITORS/ EXTERNAL PERSONS\nProviders should implement procedures to identify and authorize visitors/ external persons. Providers should ensure that:\n- visitors are authorized before entering - and escorted at all times within - areas where customer data is processed or maintained;\n- visitors are identified and given a badge or other identification that expires and that visibly distinguishes the visitors from onsite personnel;\n- visitors are asked to surrender the badge or identification before leaving the facility or at the date of expiration; and\n- a visitor log is used to maintain a physical audit trail of visitor activity to the facility as well as computer rooms and data centres where customer and financial data is stored or transmitted."},"PCI DSS, ISO 27002: 2013 Sec. 11.1","5.3.4.3.1","5.3.4.3.1: Are there procedures defined for identifying and authorizing datacentre visitors / external persons and ensuring that they can be distinguished from onsite personnel?\n","1) Access control standard or security policy or similar document\n- Check there are process to identify and authorise external persons visiting the mobile money datacentres\n- Check there is a process to distinguish external persons from onsite datacentre personnel\n(Note: if practical, visit the datacentre to assess if the above is operational)\n",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.4","","5.3.4.3","PHYSICAL ACCESS - VISITORS/ EXTERNAL PERSONS\nProviders should implement procedures to identify and authorize visitors/ external persons. Providers should ensure that:\n- visitors are authorized before entering - and escorted at all times within - areas where customer data is processed or maintained;\n- visitors are identified and given a badge or other identification that expires and that visibly distinguishes the visitors from onsite personnel;\n- visitors are asked to surrender the badge or identification before leaving the facility or at the date of expiration; and\n- a visitor log is used to maintain a physical audit trail of visitor activity to the facility as well as computer rooms and data centres where customer and financial data is stored or transmitted.","PCI DSS, ISO 27002: 2013 Sec. 11.1","5.3.4.3.1","5.3.4.4.1","Are there procedures defined for identifying and authorizing datacentre visitors / external persons and ensuring that they can be distinguished from onsite personnel?","1) Access control standard or security policy or similar document\n- Check there are process to identify and authorise external persons visiting the mobile money datacentres\n- Check there is a process to distinguish external persons from onsite datacentre personnel\n(Note: if practical, visit the datacentre to assess if the above is operational)\n",null,"Standard Required","Required","TechOps",null,null,"5","5.3","5.3.4","","5.3.4.3","ACCÈS PHYSIQUE DES VISITEURS\nLes prestataires doivent mettre en place des procédures d’identification et d’autorisation des visiteurs  garantissant que :\n- les visiteurs aient une autorisation avant d’entrer et soient accompagnés à tout moment dans les zones où des données concernant les clients sont traitées ou conservées ;\n- l’identité des visiteurs soit vérifiée et qu’un badge ou autre moyen d’identification temporaire leur soit donné pour les distinguer du personnel du site ;\n- il soit demandé aux visiteurs de rendre leur badge ou autre moyen d’identification avant de quitter les lieux ou à la date de l’expiration de celui-ci ;\n- un registre des visiteurs soit conservé pour garder une piste d’audit des visites effectuées sur le site et dans les salles informatiques et centres de données où des données financières ou concernant les clients sont conservées ou transmises.",{"$f":"BB105","v":"PCI DSS, ISO 27002: 2013 Sec. 11.1"},"5.3.4.3.1","existe-t-il des procédures définies d’identification et d’autorisation des visiteurs des centres de données permettant de les distinguer du personnel du site ?","1) Norme de contrôle des accès ou politique de sécurité ou document similaire\n- Vérifier que des processus ont été mis en place au sein des centres de données de l’argent mobile afin d’identifier et d’autoriser les visiteurs externes\n- Vérifier qu’un processus a été mis en place afin de distinguer les personnes externes du personnel du centre de données présent sur le site\n(Remarque : si possible, effectuer une visite du centre de données afin d’évaluer si ce processus est opérationnel)\n",null,"Requis Normal","Requis","TechOps",null,null,"5","5.3","5.3.4","","5.3.4.3","ACCESO FÍSICO - VISITANTES / PERSONAS EXTERNAS\nLos proveedores deben implementar procedimientos para identificar y autorizar visitantes / personas externas. Los proveedores deben garantizar que:\n- los visitantes cuenten con autorización antes de ingresar - y estén en todo momento acompañados, en las áreas donde se procesa o se mantienen datos de los clientes;\n- los visitantes sean identificados y se les entregue una credencial u otra identificación con vencimiento y que distinga visiblemente al visitante del personal del lugar;\n- se solicite a los visitantes que entreguen la credencial o identificación antes de dejar las instalaciones o en la fecha de vencimiento; y\n- se utilice un registro de visitantes para mantener una pista de auditoría física de la actividad de los visitantes en la instalación, así como en las salas de computadoras y centros de datos donde se almacenan o transmiten datos de los clientes o financieros.",{"$f":"BB105","v":"PCI DSS, ISO 27002: 2013 Sec. 11.1"},"5.3.4.3.1","¿Se definieron procedimientos para identificar y autorizar visitantes /personas externas a los centros de datos y garantizar que puedan ser distinguidos del personal del lugar?","1) Estándar de control de acceso, política de seguridad o documento similar\n- Verificar que exista un proceso para identificar y autorizar a personas externas que visitan los centros de datos del dinero móvil\n- Verificar que exista un proceso para distinguir a personas externas del personal del centro de datos del lugar\n(Nota: si es posible, visitar el centro de datos para evaluar si esto está funcionando)\n",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.3","5.3.4",null,"5.3.4.3",null,{"$f":"BB105","v":"PCI DSS, ISO 27002: 2013 Sec. 11.1"},"5.3.4.3.1",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.4.4.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.4","","5.3.4.3",null,0,"5.3.4.3.2","5.3.4.3.2: Are external persons accompanied whenever visiting computer rooms and data centres where customer and financial data is stored or transmitted?\n","",0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.4","","5.3.4.3",null,null,"5.3.4.3.2","5.3.4.4.2","Are external persons accompanied whenever visiting computer rooms and data centres where customer and financial data is stored or transmitted?","",null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.4","","5.3.4.3",0,0,"5.3.4.3.2","les visiteurs extérieurs sont-ils accompagnés lors des visites dans les salles informatiques et centres de données où des données financières ou concernant les clients sont conservées ou transmises ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.4","","5.3.4.3",null,0,"5.3.4.3.2","¿Las personas externas están acompañadas siempre que visitan las salas de computadores y centros de datos donde se almacenan o transmiten datos de los clientes o financieros?","",null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.4",null,"5.3.4.3",null,0,"5.3.4.3.2",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.4.4.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.5","5.3.5: Providers shall ensure correct and secure operations of information processing","5.3.5.1","5.3.5.1: MALWARE PROTECTION\nUp-to-date malware detection and anti-virus prevention software should be run regularly on any Windows components of the mobile money system.\n\nThe following controls should be implemented on staff devices that have access to the mobile money system (Windows computers and smartphones):\n- regularly run up-to-date malware detection and anti-virus prevention software;\n- prevent the use of unauthorized software;\n- prevent or detect the use of known or suspected malicious websites.","ISO 27002:2013 Sec. 12.2 \nPCI DSS ","5.3.5.1.1","5.3.5.1.1: Is up-to-date malware detection and anti-virus prevention software run regularly on Windows components of the mobile money system?\n","1) Security Operations Manual or Technical Operations documentation\n- Check that there is a process to run malware detection and anti-virus prevention on the mobile money system\n- Check that the process includes the regular updating of the software\n- Check that the process is scheduled to run regularly\n- Check the date of the last malware and anti-virus screen is recent\n\n2) Malware update logs\n- Confirm that anti-malware software is run regularly on Windows components of the mobile money system. Note: if there are no Windows system components, mark this as N/A.",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.5","5.3.5: Providers shall ensure correct and secure operations of information processing","5.3.5.1","MALWARE PROTECTION\nUp-to-date malware detection and anti-virus prevention software should be run regularly on any Windows components of the mobile money system.\n\nThe following controls should be implemented on staff devices that have access to the mobile money system (Windows computers and smartphones):\n- regularly run up-to-date malware detection and anti-virus prevention software;\n- prevent the use of unauthorized software;\n- prevent or detect the use of known or suspected malicious websites.","ISO 27002:2013 Sec. 12.2 \nPCI DSS ","5.3.5.1.1","5.3.5.3.1","Is up-to-date malware detection and anti-virus prevention software run regularly on Windows components of the mobile money system?","1) Security Operations Manual or Technical Operations documentation\n- Check that there is a process to run malware detection and anti-virus prevention on the mobile money system\n- Check that the process includes the regular updating of the software\n- Check that the process is scheduled to run regularly\n- Check the date of the last malware and anti-virus screen is recent\n\n2) Malware update logs\n- Confirm that anti-malware software is run regularly on Windows components of the mobile money system. Note: if there are no Windows system components, mark this as N/A.",null,"Standard Required","Required","TechOps",null,null,"5","5.3","5.3.5","5.3.5: Les prestataires doivent s’assurer du fonctionnement correct et sécurisé du traitement des informations.","5.3.5.1","PROTECTION CONTRE LES LOGICIELS MALVEILLANTS\nDes programmes de détection des logiciels malveillants et de prévention anti-virus doivent être maintenus à jour sur tout composant Windows du système de l’argent mobile.\n\nLes mesures de contrôle suivantes doivent être mises en œuvre sur les appareils du personnel connectés au système de l’argent mobile (ordinateurs sous Windows et smartphones) :\n- installation de programmes de détection des logiciels malveillants et de prévention anti-virus tenus à jour ;\n- interdiction d’utilisation/blocage des logiciels non autorisés ;\n- prévention et détection de l’utilisation de sites Web malveillants connus ou soupçonnés.","ISO 27002:2013 Sec. 12.2 \nPCI DSS ","5.3.5.1.1","des programmes de détection des logiciels malveillants et de prévention anti-virus sont-ils maintenus à jour sur tous les composants Windows du système de l’argent mobile ?","1) Manuel des opérations de sécurité ou Documentation relative aux opérations techniques\n- Vérifier qu’un processus de détection des logiciels malveillants et de prévention antivirus sur le système d’argent mobile a été mis en place\n- Vérifier que ce processus inclut la mise à jour régulière des logiciels\n- Vérifier que ce processus est programmé pour s’activer régulièrement\n- Vérifier que le dernier contrôle anti-logiciels malveillants et antivirus a été effectué récemment\n2) Consulter les registres de mise à jour pour confirme des programmes de détection des logiciels malveillants et de prévention anti-virus sont-ils maintenus à jour sur tous les composants Windows du système de l’argent mobile \nRemarque : si le système ne comporte aucun composant Windows, inscrivez la mention N/A.",null,"Requis Normal","Requis","TechOps",null,null,"5","5.3","5.3.5","5.3.5: Los proveedores deben garantizar operaciones de procesamiento de la información correctas y seguras","5.3.5.1","PROTECCIÓN CONTRA SOFTWARE MALICIOSO\nSe debe ejecutar periódicamente un software actualizado de detección de software malicioso y prevención antivirus en todos los componentes Windows del sistema del dinero móvil.\n\nSe deben implementar los siguientes controles en los dispositivos del personal con acceso al sistema del dinero móvil (computadoras y smartphones Windows):\n- ejecutar periódicamente un software actualizado de detección de software malicioso y prevención antivirus;\n- prevenir el uso de software no autorizado;\n- prevenir o detectar el uso de sitios web maliciosos conocidos o bajo sospecha.","ISO 27002:2013 Sec. 12.2 \nPCI DSS ","5.3.5.1.1","¿Periódicamente se ejecuta un software actualizado de detección de software malicioso y prevención antivirus en todos los componentes Windows del sistema del dinero móvil?","1) Manual de Operaciones de Seguridad o documentación de Operaciones Técnicas\n- Verificar que exista un proceso para ejecutar la detección de software malicioso y prevención antivirus en el sistema del dinero móvil\n- Verificar que el proceso incluya la actualización periódica del software\n- Verificar que el proceso esté programado para ejecutarse periódicamente\n- Verificar que la fecha del último análisis contra software malicioso y virus sea reciente\n\n2) Registros de actualización de software maliciosos\n- Confirmar que el software contra software malicioso sea ejecutado periódicamente en los componentes Windows del sistema del dinero móvil. Nota: si no existen componentes del sistema Windows, marcar como N/A.",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.3","5.3.5",null,"5.3.5.1",null,"ISO 27002:2013 Sec. 12.2 \nPCI DSS ","5.3.5.1.1",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.5.3.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.5","","5.3.5.1",null,0,"5.3.5.1.2","5.3.5.1.2: Is up-to-date malware detection and anti-virus prevention software run regularly on Windows computers that staff use to access to the mobile money system?\n","1) Security Operations Manual or Technical Operations documentation\n- Check that there is a process to regularly run malware detection and anti-virus prevention on Windows computers that staff use to access to the mobile money system.\n- Check that the process includes the regular updating of the software.\n- Check the date of the last malware and anti-virus screen is recent.\n\n2) Malware update logs\n- Confirm that anti-malware software is run regularly on Windows computers that staff use to access to the mobile money system.",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.5","","5.3.5.1",null,null,"5.3.5.1.2","5.3.5.3.2","Is up-to-date malware detection and anti-virus prevention software run regularly on Windows computers that staff use to access to the mobile money system?","1) Security Operations Manual or Technical Operations documentation\n- Check that there is a process to regularly run malware detection and anti-virus prevention on Windows computers that staff use to access to the mobile money system.\n- Check that the process includes the regular updating of the software.\n- Check the date of the last malware and anti-virus screen is recent.\n\n2) Malware update logs\n- Confirm that anti-malware software is run regularly on Windows computers that staff use to access to the mobile money system.",null,"Standard Required","Required","TechOps",null,null,"5","5.3","5.3.5",null,"5.3.5.1",0,0,"5.3.5.1.2","des programmes de détection des logiciels malveillants et de prévention anti-virus sont-ils maintenus à jour sur tous les ordinateurs Windows utilisés par le personne pour accéder au système de l'argent mobile ?","1) Manuel des opérations de sécurité ou Documentation relative aux opérations techniques\n- Vérifier qu’un processus régulier de détection des logiciels malveillants et de prévention antivirus a été mis en place sur les ordinateurs Windows qu’utilise le personnel afin d’accéder au système d’argent mobile .\n- Vérifier que ce processus inclut la mise à jour régulière des logiciels.\n- Vérifier que le dernier contrôle anti-logiciels malveillants et antivirus a été effectué récemment.\n2) Registres de mise à jour contre les logiciels malveillants\n- Consulter les registres de mise à jour pour confirme des programmes de détection des logiciels malveillants et de prévention anti-virus sont-ils maintenus à jour sur tous les ordinateurs Windows utilisés par le personne pour accéder au système de l'argent mobile.",null,"Requis Normal","Requis","TechOps",null,null,"5","5.3","5.3.5","","5.3.5.1",null,0,"5.3.5.1.2","¿Periódicamente se ejecuta un software actualizado de detección de software malicioso y prevención antivirus en las computadoras Windows utilizadas por el personal para acceder al sistema del dinero móvil?","1) Manual de Operaciones de Seguridad o documentación de Operaciones Técnicas\n- Verificar que exista un proceso para ejecutar periódicamente la detección de software malicioso y prevención antivirus en las computadoras Windows utilizadas por el personal para acceder al sistema del dinero móvil.\n- Verificar que el proceso incluya la actualización periódica del software.\n- Verificar que la fecha del último análisis contra software malicioso y virus sea reciente.\n\n2) Registros de actualización de software malicioso\n- Confirmar que el software contra software malicioso sea ejecutado periódicamente en las computadoras Windows utilizadas por el personal para acceder al sistema del dinero móvil.",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.3","5.3.5",null,"5.3.5.1",null,0,"5.3.5.1.2",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.5.3.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.5","","5.3.5.1",null,0,"5.3.5.1.3","5.3.5.1.3: Are controls implemented on staff devices that have access to the mobile money system to prevent the use of unauthorized software and prevent or detect the use of known or suspected malicious websites?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.5","","5.3.5.1",null,null,"5.3.5.1.3","5.3.5.3.3","Are controls implemented on staff devices that have access to the mobile money system to prevent the use of unauthorized software and prevent or detect the use of known or suspected malicious websites?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.5","","5.3.5.1",0,0,"5.3.5.1.3","des mesures de contrôles sont-elles mises en œuvre sur les appareils du personnel connectés au système de l’argent mobilepour empêcher l'utilisation de logiciels non autorisés et empêcher/détecter l’utilisation de sites Web malveillants connus ou soupçonnés ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.5","","5.3.5.1",null,0,"5.3.5.1.3","¿Se implementan controles en los dispositivos del personal con acceso al sistema del dinero móvil para prevenir el uso de software no autorizado y prevenir o detectar el uso de sitios web maliciosos conocidos o bajo sospecha?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.5",null,"5.3.5.1",null,0,"5.3.5.1.3",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.5.3.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.5","","5.3.5.2","5.3.5.2: INTRUSION DETECTION\nIntrusion-detection and/or intrusion-prevention systems should be implemented to detect and/or prevent intrusions into the network. \n\nAll traffic should be monitored at the perimeter of the user data environment as well as at critical points in the user data environment. Alerts should be raised when there is a suspicion that a system may be compromised.\n\nIntrusion detection/ prevention systems should be configured, maintained, and updated per vendor instructions to ensure optimal protection.","ISO 27002:2013 Sec. 12.5, PCI DSS ","5.3.5.2.1","5.3.5.2.1: Are intrusion detection/ prevention systems in use, such that all traffic at the perimeter of the data environment as well as at critical points in the service data environment is monitored for intrusion attempts?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.5","","5.3.5.2","INTRUSION DETECTION\nIntrusion-detection and/or intrusion-prevention systems should be implemented to detect and/or prevent intrusions into the network. \n\nAll traffic should be monitored at the perimeter of the user data environment as well as at critical points in the user data environment. Alerts should be raised when there is a suspicion that a system may be compromised.\n\nIntrusion detection/ prevention systems should be configured, maintained, and updated per vendor instructions to ensure optimal protection.","ISO 27002:2013 Sec. 12.5, PCI DSS ","5.3.5.2.1","5.3.5.4.1","Are intrusion detection/ prevention systems in use, such that all traffic at the perimeter of the data environment as well as at critical points in the service data environment is monitored for intrusion attempts?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.5","","5.3.5.2","DÉTECTION DES INTRUSIONS\nDes systèmes de détection/prévention des intrusions doivent être mis en œuvre pour repérer et/ou empêcher les intrusions au sein du réseau. \nTout le trafic doit être surveillé au seuil de l’environnement des données utilisateurs ainsi qu’au niveau des points critiques de cet environnement. Des signaux d’alerte doivent être activés en cas de suspicion qu’un système ait pu être compromis. \nLes systèmes de détection/prévention doivent être configurés, entretenus et mis à jour conformément aux instructions du fournisseur pour garantir une protection optimale.","ISO 27002:2013 Sec. 12.5, PCI DSS ","5.3.5.2.1","des systèmes de détection/prévention des intrusions sont-ils utilisés pour surveiller l'ensemble du trafic au seuil de l'environnement des données ainsi qu'au niveau des points critiques de cet environnement afin de repérer les tentatives d'intrusion ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.5","","5.3.5.2","DETECCIÓN DE INTRUSIONES\nSe deben implementar sistemas de detección de intrusiones y/o prevención de intrusiones para detectar y/o prevenir intrusiones a la red. \n\nSe debe monitorear todo el tráfico en el perímetro del entorno de datos de los usuarios, así como también en los puntos críticos en el entorno de datos de los usuarios. Se deben disparar alertas cuando existe la sospecha de que un sistema podría estar comprometido.\n\nLos sistemas de detección / prevención de intrusiones se deben configurar, mantener y actualizar conforme a las instrucciones del proveedor para garantizar una protección óptima.","ISO 27002:2013 Sec. 12.5, PCI DSS ","5.3.5.2.1","¿Se utilizan sistemas de detección / prevención de intrusiones, de modo que se monitoreen los intentos de intrusión en todo el tráfico en el perímetro del entorno de datos, así como también en los puntos críticos en el entorno de datos del servicio?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.5",null,"5.3.5.2",null,"ISO 27002:2013 Sec. 12.5, PCI DSS ","5.3.5.2.1",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.5.4.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.5","","5.3.5.2",null,0,"5.3.5.2.2","5.3.5.2.2: Are intrusion detection/ prevention systems configured to raise alerts whenever there is a suspicion that a system may be compromised?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.5","","5.3.5.2",null,null,"5.3.5.2.2","5.3.5.4.2","Are intrusion detection/ prevention systems configured to raise alerts whenever there is a suspicion that a system may be compromised?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.5","","5.3.5.2",0,0,"5.3.5.2.2","les systèmes de détection/prévention des intrusions sont-ils configurés de façon à émettre un signal d'alerte à chaque soupçon de compromission d’un système ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.5","","5.3.5.2",null,0,"5.3.5.2.2","¿Los sistemas de detección / prevención de intrusiones están configurados para disparar alertas siempre que exista la sospecha de que un sistema podría estar comprometido?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.5",null,"5.3.5.2",null,0,"5.3.5.2.2",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.5.4.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.5","","5.3.5.3","5.3.5.3: MOBILE DEVICES AND TELEWORKING\nMobile devices (e.g., laptops, phones, tablets) that can connect to the mobile money system remotely or which contain sensitive customer data present a security risk. Such devices may be used by developers or by system support staff to provide remote operational support, for example. Particular care should be taken by sagents and by staff with privileged roles that can be accessed via handsets.\n\nAll such devices should be password-protected and sensitive customer data should be encrypted. Firewall software should be set up on the devices. Mobile devices should also be physically protected against theft and should be locked away when not in use.\n\nA procedure should be established for cases of theft or loss of mobile devices that (1) can connect to the mobile money system remotely or (2) which contain sensitive data. \n\nA policy should be documented for teleworking, indicating which staff may connect remotely to the system and the controls that should be implemented.\n\nStaff using mobile devices to connect to the mobile money system should be trained regarding (1) the risks that these devices present and (2) the controls that should be implemented.","ISO 27002:2013 Sec. 6.2","5.3.5.3.1","5.3.5.3.1: Is data encryption and password protection enabled on all mobile devices (e.g., laptops, phones, tablets) that can connect to the mobile money system remotely or which contain sensitive customer data?\n",0,0,"Recommended","Recommended","TechOps",{"$f":"CHOOSE(LanguageNumber,BK112,CA112,CQ112,DG112)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.5","","5.3.5.3","MOBILE DEVICES AND TELEWORKING\nMobile devices (e.g., laptops, phones, tablets) that can connect to the mobile money system remotely or which contain sensitive customer data present a security risk. Such devices may be used by developers or by system support staff to provide remote operational support, for example. Particular care should be taken by sagents and by staff with privileged roles that can be accessed via handsets.\n\nAll such devices should be password-protected and sensitive customer data should be encrypted. Firewall software should be set up on the devices. Mobile devices should also be physically protected against theft and should be locked away when not in use.\n\nA procedure should be established for cases of theft or loss of mobile devices that (1) can connect to the mobile money system remotely or (2) which contain sensitive data. \n\nA policy should be documented for teleworking, indicating which staff may connect remotely to the system and the controls that should be implemented.\n\nStaff using mobile devices to connect to the mobile money system should be trained regarding (1) the risks that these devices present and (2) the controls that should be implemented.","ISO 27002:2013 Sec. 6.2","5.3.5.3.1","5.3.5.5.1","Is data encryption and password protection enabled on all mobile devices (e.g., laptops, phones, tablets) that can connect to the mobile money system remotely or which contain sensitive customer data?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.5","","5.3.5.3","APPAREILS PORTABLES ET TÉLÉTRAVAIL\nLes appareils portables (ordinateurs portables, téléphones, tablettes, etc.) pouvant se connecter à distance au système de l’argent mobile ou contenant des données sensibles concernant les clients présentent un risque de sécurité. Ces appareils sont par exemple utilisés par les programmeurs ou le personnel de support technique pour assurer le support opérationnel à distance. Les agents et les membres du personnel disposant de privilèges accessibles via téléphone doivent faire preuve de la plus grande prudence.\n\nTous ces appareils doivent être protégés par un mot de passe et les données sensibles concernant les clients doivent être cryptées. Les logiciels pare-feu doivent être installés sur ces appareils, qui doivent également être physiquement protégés contre le vol et conservés sous clé lorsqu’ils ne sont pas utilisés.\n\nUne procédure doit être en place en cas de vol ou de perte d’appareils portables (1) pouvant se connecter à distance au système de l’argent mobile ou (2) contenant des données sensibles. \n\nUne politique documentée doit également être mise en place pour le télétravail, définissant le personnel autorisé à se connecter à distance au système et les mesures de contrôle à mettre en œuvre.\n\nLe personnel utilisant des appareils portables pour se connecter au système de l’argent mobile doit être formé (1) aux risques propres à ces appareils et (2) aux mesures de contrôle à mettre en œuvre.","ISO 27002:2013 Sec. 6.2","5.3.5.3.1","le cryptage des données et la protection par mot de passe sont-ils activés sur tous les appareils portables (ex. ordinateurs portables, téléphones, tablettes) pouvant se connecter à distance au système de l’argent mobile ou contenant des données sensibles concernant les clients ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.5","","5.3.5.3","DISPOSITIVOS MÓVILES Y TRABAJO A DISTANCIA\nLos dispositivos móviles (por ej., laptops, teléfonos, tablets) que se pueden conectar al sistema del dinero móvil de forma remota o que contienen datos sensibles de los clientes presentan un riesgo a la seguridad. Estos dispositivos pueden ser utilizados, por ejemplo, por los desarrolladores o por el personal de soporte para brindar soporte operativo remoto. Los agentes y el personal con funciones con roles privilegios a las cuales pueden acceder desde los dispositivos deben tener especial cuidado.\n\nDichos dispositivos deben estar protegidos con contraseñas y los datos sensibles de los clientes deben estar encriptados. Se debe configurar un software de firewall en los dispositivos. Los dispositivos móviles también deben estar protegidos físicamente contra robo y cuando no están en uso deben permanecer bloqueados.\n\nSe debe establecer un procedimiento para los casos de robo o pérdida de dispositivos móviles que (1) se pueden conectar al sistema del dinero móvil de forma remota o (2) que contienen datos sensibles de los clientes. \n\nSe debe documentar una política de trabajo a distancia, indicando cuál es el personal que se puede conectar de forma remota al sistema y qué controles se deben implementar.\n\nEl personal que utiliza dispositivos móviles para conectarse al sistema del dinero móvil debe recibir capacitación relacionada con (1) los riesgos que presentan estos dispositivos y (2) los controles que se deben implementar.","ISO 27002:2013 Sec. 6.2","5.3.5.3.1","¿La encriptación de datos y protección con contraseña están habilitadas en todos los dispositivos móviles (por ej., laptops, teléfonos, tablets) que se pueden conectar al sistema del dinero móvil de forma remota o que contienen datos sensibles de los clientes?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.5",null,"5.3.5.3",null,"ISO 27002:2013 Sec. 6.2","5.3.5.3.1",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.5.5.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.5","","5.3.5.3",null,0,"5.3.5.3.2","5.3.5.3.2: Is firewall software set up on all mobile devices that can connect to the mobile money system remotely or which contain sensitive customer data?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.5","","5.3.5.3",null,null,"5.3.5.3.2","5.3.5.5.2","Is firewall software set up on all mobile devices that can connect to the mobile money system remotely or which contain sensitive customer data?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.5","","5.3.5.3",0,0,"5.3.5.3.2","des logiciels pare-feu sont-ils installés sur tous les appareils portables pouvant se connecter à distance au système de l’argent mobile ou contenant des données sensibles concernant les clients ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.5","","5.3.5.3",null,0,"5.3.5.3.2","¿Todos los dispositivos móviles que se pueden conectar al sistema del dinero móvil de forma remota o que contienen datos sensibles de los clientes tienen configurado un software de firewall?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.5",null,"5.3.5.3",null,0,"5.3.5.3.2",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.5.5.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.5","","5.3.5.3",null,0,"5.3.5.3.3","5.3.5.3.3: Are specific procedures established for cases of theft or loss of mobile devices that can connect to the mobile money system remotely or which contain sensitive customer data?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.5","","5.3.5.3",null,null,"5.3.5.3.3","5.3.5.5.3","Are specific procedures established for cases of theft or loss of mobile devices that can connect to the mobile money system remotely or which contain sensitive customer data?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.5","","5.3.5.3",0,0,"5.3.5.3.3","existe-t-il des procédures spécifiques en place en cas de perte ou de vol d’appareils portables pouvant se connecter à distance au système de l’argent mobile ou contenant des données sensibles ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.5","","5.3.5.3",null,0,"5.3.5.3.3","¿Se establecieron procedimientos específicos para los casos de robo o pérdida de dispositivos móviles que se pueden conectar al sistema del dinero móvil de forma remota o que contienen datos sensibles de los clientes?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.5",null,"5.3.5.3",null,0,"5.3.5.3.3",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.5.5.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.5","","5.3.5.3",null,0,"5.3.5.3.4","5.3.5.3.4: Has a policy been documented for teleworking, indicating which staff may connect remotely to the system and the controls that should be implemented?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.5","","5.3.5.3",null,null,"5.3.5.3.4","5.3.5.5.4","Has a policy been documented for teleworking, indicating which staff may connect remotely to the system and the controls that should be implemented?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.5","","5.3.5.3",0,0,"5.3.5.3.4","existe-t-il une politique documentée de télétravail, qui définit le personnel ayant le droit de connecter à distance au système et les mesures de contrôle devant être mises en œuvre ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.5","","5.3.5.3",null,0,"5.3.5.3.4","¿Se documentó una política de trabajo a distancia, indicando cuál es el personal que se puede conectar de forma remota al sistema y qué controles se deben implementar?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.5",null,"5.3.5.3",null,0,"5.3.5.3.4",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.5.5.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.5","","5.3.5.3",null,0,"5.3.5.3.5","5.3.5.3.5: Have staff using mobile devices to connect to the mobile money system been trained regarding (1) the risks that these devices present and (2) the controls that should be implemented?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.5","","5.3.5.3",null,null,"5.3.5.3.5","5.3.5.5.5","Have staff using mobile devices to connect to the mobile money system been trained regarding (1) the risks that these devices present and (2) the controls that should be implemented?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.5","","5.3.5.3",0,0,"5.3.5.3.5","le personnel utilisant des appareils portables pour se connecter au système de l’argent mobile est-il formé (a) aux risques propres à ces appareils et (b) aux mesures de contrôle à mettre en œuvre  ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.5","","5.3.5.3",null,0,"5.3.5.3.5","¿Se brindó capacitación al personal que utiliza dispositivos móviles para conectarse al sistema del dinero móvil relacionada con (1) los riesgos que presentan estos dispositivos y (2) los controles que se deben implementar?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.5",null,"5.3.5.3",null,0,"5.3.5.3.5",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.5.5.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.6","5.3.6: Providers shall develop processes to ensure that all transactions and user activities are logged with appropriate audit trails.","5.3.6.1","5.3.6.1: LOGGING: MOBILE MONEY SYSTEM COMPONENTS \nLogging should be set up on all mobile money system components to track all important events. Logging should include the following events:\n- all actions by administrators (i.e. people with root or administrative privileges);\n- all logical access attempts (e.g. log-on and log-off, whether successful or failed);\n- creation, modification, and deletion of system-level objects and configuration;\n- access to audit trails;\n- all access to customer data; and\n- key system activities/ events.\n\nFor each event the following should be included in the log, when relevant:\n- user ID;\n- date & time;\n- device identity/ location/ network address;\n- type of event;\n- success or failure of the event; and\n- origination of event.","ISO 27002: 2013 Sec. 12.4 \nPCI DSS","5.3.6.1.1","5.3.6.1.1: Has logging been set up on all mobile money system components to track all important events?\n","1) Monitoring / logging specification\n- Check that system-level logging has been set up on all mobile money system components.",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.6","5.3.6: Providers shall develop processes to ensure that all transactions and user activities are logged with appropriate audit trails.","5.3.6.1","LOGGING: MOBILE MONEY SYSTEM COMPONENTS \nLogging should be set up on all mobile money system components to track all important events. Logging should include the following events:\n- all actions by administrators (i.e. people with root or administrative privileges);\n- all logical access attempts (e.g. log-on and log-off, whether successful or failed);\n- creation, modification, and deletion of system-level objects and configuration;\n- access to audit trails;\n- all access to customer data; and\n- key system activities/ events.\n\nFor each event the following should be included in the log, when relevant:\n- user ID;\n- date & time;\n- device identity/ location/ network address;\n- type of event;\n- success or failure of the event; and\n- origination of event.","ISO 27002: 2013 Sec. 12.4 \nPCI DSS","5.3.6.1.1","5.3.6.1.1","Has logging been set up on all mobile money system components to track all important events?","1) Monitoring / logging specification\n- Check that system-level logging has been set up on all mobile money system components.",null,"Urgent Required","Required","TechOps",null,null,"5","5.3","5.3.6","5.3.6: Les prestataires doivent mettre en place des processus garantissant l’enregistrement de toutes les opérations et actions des utilisateurs avec des pistes d’audit appropriées.","5.3.6.1","HISTORIQUE DES ÉVÉNEMENTS : COMPOSANTS DU SYSTÈME DE L’ARGENT MOBILE \nDes journaux d'événements (logging/journalisation) doivent être mis en place sur tous les composants du système de l’argent mobile pour garder trace de tous les évènements importants. Ces journaux doivent enregistrer les événements suivants : \n- toutes les actions des administrateurs (personnes ayant des « privilèges root » ou des privilèges administratif) ;\n- toutes les tentatives d’accès logique (ex. ouvertures/fermetures de session, réussies ou avortées) ;\n- création, modification et suppression d’objets et de configurations système ; \n- accès aux pistes d’audit ;\n- tout accès aux données concernant des clients ; et\n- actions/événements clés dans le système.\n\nPour chaque événement, il convient le cas échéant de conserver les informations suivantes dans le journal :\n- identifiant de l’utilisateur ;\n- date & heure ;\n- identification/lieu/adresse réseau de l’appareil utilisé ;\n- type d’événement ;\n- réussite/échec de l’événement ; \n- origine de l’événement.\n","ISO 27002: 2013 Sec. 12.4 \nPCI DSS","5.3.6.1.1","existe-t-il des journaux d'événements (logging/journalisation) dans tous les composants du système de l’argent mobile pour garder trace de tous les évènements importants ?","1) Spécification relative au suivi/à la journalisation (logging)\n- Vérifier qu’un processus de journalisation a été mis en place au niveau du système, pour toutes les composantes du système de l’argent mobile.",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.3","5.3.6","5.3.6: Los proveedores deben desarrollar procesos para garantizar que todas las transacciones y las actividades de los usuarios sean registradas con las pistas de auditoría correspondientes.","5.3.6.1","REGISTRO: COMPONENTES DEL SISTEMA DEL DINERO MÓVIL\nSe debe configurar un registro de todos los componentes del sistema del dinero móvil para rastrear todos los eventos importantes. El registro debe incluir los siguientes eventos:\n- todas las acciones realizadas por los administradores (es decir, personas con privilegios de acceso root o administrativos);\n- todos los intentos de acceso lógico (por ej., inicio y cierre de sesión, ya sea exitoso o fallido);\n- creación, modificación y eliminación de objetos y configuraciones a nivel del sistema;\n- acceso a las pistas de auditoría;\n- todos los accesos a los datos de los clientes; y\n- las actividades/eventos clave del sistema.\n\nEl registro debe incluir lo siguiente para cada evento, cuando corresponda:\n- ID de usuario;\n- fecha y hora;\n- identidad del dispositivo / ubicación / dirección de red;\n- tipo de evento;\n- éxito o fracaso del evento; y \n- origen del evento.","ISO 27002: 2013 Sec. 12.4 \nPCI DSS","5.3.6.1.1","¿Se configuró un registro de todos los componentes del sistema del dinero móvil para rastrear todos los eventos importantes?","1) Especificación de monitoreo / registro\n- Verificar que se haya configurado un registro a nivel del sistema de todos los componentes del sistema del dinero móvil.",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.3","5.3.6",null,"5.3.6.1",null,"ISO 27002: 2013 Sec. 12.4 \nPCI DSS","5.3.6.1.1",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.6.1.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.6",0,"5.3.6.1",null,0,"5.3.6.1.2","5.3.6.1.2: Does mobile money system-level logging include all actions by administrators, all logical access attempts, creation/ modification/ deletion of system objects and configuration, access to logs, access to customer data, and key system events?\n","1) Monitoring / logging specification\n- Check that mobile money system level logging includes all the following:\na) Actions by administrators\nb) Logical access attempts, \nc) creation/ modification/ deletion of system objects and configuration, \nd) access to audit trails, \ne) access to customer data, \nf) key system events",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.6",null,"5.3.6.1",null,null,"5.3.6.1.2","5.3.6.1.2","Does mobile money system-level logging include all actions by administrators, all logical access attempts, creation/ modification/ deletion of system objects and configuration, access to logs, access to customer data, and key system events?","1) Monitoring / logging specification\n- Check that mobile money system level logging includes all the following:\na) Actions by administrators\nb) Logical access attempts, \nc) creation/ modification/ deletion of system objects and configuration, \nd) access to audit trails, \ne) access to customer data, \nf) key system events",null,"Urgent Required","Required","TechOps",null,null,"5","5.3","5.3.6",0,"5.3.6.1",0,0,"5.3.6.1.2","les journaux d’événements du système de l’argent mobile enregistrent-ils toutes les actions des administrateurs, toutes les tentatives d’accès logique, toutes les créations, modifications et suppressions d’objets et de configurations système, les accès aux journaux d'évènements, aux données concernant les clients et les événements clés dans le système ?","1) Spécification relative au suivi/à la journalisation (logging)\n- Vérifier que le processus de journalisation mis en place au niveau du système de l’argent mobile, inclut l'ensemble des éléments suivants :\na) Les actions des administrateurs\nb) Les tentatives d’accès logique, \nc) La création/modification/suppression d’objets et de configurations système, \nd) Les accès aux pistes d’audit, \ne) Les accès aux données concernant les clients, \nf) Les évènements clés dans le système",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.3","5.3.6",null,"5.3.6.1",null,0,"5.3.6.1.2","¿El registro a nivel del sistema del dinero móvil incluye todas las acciones realizadas por los administradores, todos los intentos de acceso lógico, la creación / modificación / eliminación de objetos y configuraciones del sistema, el acceso a registros, el acceso a los datos de los clientes y los eventos clave del sistema?","1) Especificación de monitoreo / registro \n- Verificar que el registro a nivel del sistema del dinero móvil incluya todas las siguientes acciones:\na) Acciones realizadas por los administradores,\nb) Intentos de acceso lógico, \nc) creación / modificación / eliminación de objetos y configuraciones del sistema, \nd) acceso a las pistas de auditoría, \ne) acceso a los datos de los clientes, \nf) todos los eventos clave del sistema.",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.3","5.3.6",null,"5.3.6.1",null,0,"5.3.6.1.2",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.6.1.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.6","","5.3.6.1",null,0,"5.3.6.1.3","5.3.6.1.3: For each event in the mobile money system-level log is the following logged (as relevant): user ID, date & time, device identity/ location/ network address, type of event, success or failure of the event, and origination of event?\n","1) Monitoring / logging specification\n- Check that mobile money system level logging captures the following for each event:\na) The user ID, \nb) Date & time,\nc)  Device identity/ location/ network address, \nd) Type of event, \ne) Success or failure of the event, \nf) Origination of the event\n\n",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.6","","5.3.6.1",null,null,"5.3.6.1.3","5.3.6.1.3","For each event in the mobile money system-level log is the following logged (as relevant): user ID, date & time, device identity/ location/ network address, type of event, success or failure of the event, and origination of event?","1) Monitoring / logging specification\n- Check that mobile money system level logging captures the following for each event:\na) The user ID, \nb) Date & time,\nc)  Device identity/ location/ network address, \nd) Type of event, \ne) Success or failure of the event, \nf) Origination of the event\n\n",null,"Urgent Required","Required","TechOps",null,null,"5","5.3","5.3.6","","5.3.6.1",0,0,"5.3.6.1.3","pour chaque événement, le journal du système de l’argent mobile enregistre-t-il (le cas échéant) l’identifiant de l’utilisateur, la date et l’heure, l’identification/lieu/adresse réseau de l’appareil utilisé, le type d’événement, sa réussite ou son échec et son origine ?","1) Spécification relative au suivi/à la journalisation (logging)\n- Vérifier que le processus de journalisation mis en place au niveau du système de l’argent mobile inclut la conservation des éléments suivants pour chaque évènement :\na) Identifiant de l’utilisateur, \nb) Date & heure,\nc) Identification/localisation/adresse réseau de l’appareil utilisé, \nd) Type d’évènement, \ne) Réussite ou échec de l’évènement, \nf) Origine de l’évènement\n\n",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.3","5.3.6","","5.3.6.1",null,0,"5.3.6.1.3","¿Se registra lo siguiente para cada evento en el registro a nivel del sistema del dinero móvil (según corresponda): ID de usuario, fecha y hora, identidad del dispositivo / ubicación / dirección de red, tipo de evento, éxito o fracaso del evento y origen del evento?","1) Especificación de monitoreo / registro \n- Verificar que el registro a nivel del sistema del dinero móvil incluya registrar lo siguiente para cada evento:\na) El ID de usuario, \nb) Fecha y hora,\nc)  Identidad del dispositivo / ubicación / dirección de red, \nd) Tipo de evento, \ne) Éxito o fracaso del evento, \nf) Origen del evento ",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.3","5.3.6",null,"5.3.6.1",null,0,"5.3.6.1.3",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.6.1.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.6","","5.3.6.2","5.3.6.2: AUDIT TRAIL: MOBILE MONEY APPLICATION\nFull audit trails should be implemented in the mobile money system in order to be able to track all transactions and events in the mobile money application.\n\nThe following events should be included in the audit trail:\n- all transactions initiated by any party (including failed transactions and automated transactions);\n- all logical access attempts (e.g. log-on and log-off, whether successful or failed);\n- creation, deletion and modification of operator accounts;\n- access to audit trails;\n- all access to customer data by service operators (e.g. customer service operators, finance operators); and\n- key system activities/ events.\n\nFor each event the following should be included in the audit trail, when relevant:\n- date & time;\n- credit party and debit party account details;\n- transaction/event ID;\n- transaction/event initiator (ID of customer/ agent/ operator/ system process that initiates transaction/event);\n- type of event/ transaction; and\n- success or failure of the event/ transaction.","ECB RSMP, ISO 27002:2013 Sec. 12.4 ","5.3.6.2.1","5.3.6.2.1: Does the mobile money audit trail include all transactions initiated by any party (including failed transactions and automated transactions)?\n","1) Monitoring / logging / audit trail specification\n- Check that the process to log all event includes capturing all transactions initiated by any party (including failed transactions and automated transactions)\n\n",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.6","","5.3.6.2","AUDIT TRAIL: MOBILE MONEY APPLICATION\nFull audit trails should be implemented in the mobile money system in order to be able to track all transactions and events in the mobile money application.\n\nThe following events should be included in the audit trail:\n- all transactions initiated by any party (including failed transactions and automated transactions);\n- all logical access attempts (e.g. log-on and log-off, whether successful or failed);\n- creation, deletion and modification of operator accounts;\n- access to audit trails;\n- all access to customer data by service operators (e.g. customer service operators, finance operators); and\n- key system activities/ events.\n\nFor each event the following should be included in the audit trail, when relevant:\n- date & time;\n- credit party and debit party account details;\n- transaction/event ID;\n- transaction/event initiator (ID of customer/ agent/ operator/ system process that initiates transaction/event);\n- type of event/ transaction; and\n- success or failure of the event/ transaction.","ECB RSMP, ISO 27002:2013 Sec. 12.4 ","5.3.6.2.1","5.3.6.2.1","Does the mobile money audit trail include all transactions initiated by any party (including failed transactions and automated transactions)?","1) Monitoring / logging / audit trail specification\n- Check that the process to log all event includes capturing all transactions initiated by any party (including failed transactions and automated transactions)\n\n",null,"Urgent Required","Required","TechOps",null,null,"5","5.3","5.3.6","","5.3.6.2","PISTES D'AUDIT : APPLICATION DE L'ARGENT MOBILE\nDes pistes d’audit complètes doivent être mises en place au sein du système de l’argent mobile afin de pouvoir reconstituer toutes les opérations et événements intervenus dans l’application d’argent mobile.\n\nLes événements suivants doivent être inclus dans la piste d’audit : \n- toutes les transactions (y compris les transactions avortées et les transactions automatiques) ;\n- tous les mouvements d’argent ;\n- toutes les tentatives d’accès logique (ex. ouvertures/fermetures de session, réussies ou avortées) ;\n- création, suppression et modification de comptes d’opérateurs ;\n- accès aux pistes d’audit ;\n- tous les accès à des données concernant les clients par des opérateurs du service (ex. opérateurs du service client, opérateurs du service financier) ; \n- activités/événements clés dans le système.\n\nPour chaque événement, il convient le cas échéant de conserver les informations suivantes dans la piste d’audit :\n- date & heure ;\n- informations relatives au compte de la partie débitée et de la partie créditée ;\n- identification de la transaction ou de l’événement ;\n- initiateur de la transaction ou de l’événement (identifiant du client/agent/opérateur/processus du système ayant initié la transaction ou l’événement) ;\n- type d’événement ou de transaction ;\n- réussite/échec de l’événement ou de la transaction. \n","ECB RSMP, ISO 27002:2013 Sec. 12.4 ","5.3.6.2.1","des pistes d’audit complètes sont-elles mises en œuvre dans le système de l’argent mobile pour pouvoir reconstituer toutes les opérations et événements clés de l’application d’argent mobile ?","1) Spécification relative au suivi/à la journalisation (logging)/aux pistes d’audit\n- Vérifier que le processus de journalisation des évènements inclut la journalisation de l’ensemble des transactions initiées par une partie quelconque (y compris les transactions avortées et automatiques)\n\n",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.3","5.3.6","","5.3.6.2","PISTA DE AUDITORÍA: APLICACIÓN DEL DINERO MÓVIL\nSe deben implementar las pistas de auditoría completas en el sistema del dinero móvil para poder rastrear todas las transacciones y eventos en la aplicación del dinero móvil.\n\nSe deben incluir los siguientes eventos en la pista de auditoría:\n- todas las transacciones iniciadas por cualquier parte (inclusive las transacciones fallidas y las transacciones automáticas);\n- todos los intentos de acceso lógico (por ej., inicio y cierre de sesión, ya sea exitoso o fallido);\n- creación, eliminación y modificación de cuentas de los operadores;\n- acceso a las pistas de auditoría;\n- todo acceso a los datos de los clientes por parte de los operadores del servicio (por ej., operadores de atención al cliente, operadores financieros); y\n- actividades / eventos clave del sistema.\n\nLa pista de auditoría debe incluir lo siguiente para cada evento, cuando corresponda:\n- fecha y hora;\n- detalles de la cuenta de la parte beneficiaria y de la parte que paga;\n- ID de la transacción/evento;\n- iniciador de la transacción/evento (ID del cliente / agente / operador / proceso del sistema que inicia la transacción/evento);\n- tipo de evento / transacción; y\n- éxito o fracaso del evento / transacción.","ECB RSMP, ISO 27002:2013 Sec. 12.4 ","5.3.6.2.1","¿La pista de auditoría del dinero móvil incluye todas las transacciones iniciadas por cualquier parte (inclusive las transacciones fallidas y las transacciones automáticas)?","1) Especificación de monitoreo / registro / pista de auditoría\n- Verificar que el proceso para registrar todos los eventos incluya registrar todas las transacciones iniciadas por cualquier parte (inclusive las transacciones fallidas y las transacciones automáticas)\n\n",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.3","5.3.6",null,"5.3.6.2",null,"ECB RSMP, ISO 27002:2013 Sec. 12.4 ","5.3.6.2.1",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.6.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.6","","5.3.6.2",null,0,"5.3.6.2.2","5.3.6.2.2: Does the mobile money audit trail include all actions on the mobile money system (logical access attempts, creation/ deletion/ modification of operator accounts, access to audit trails, access to customer data, and key system activities/ events)?\n","1) Monitoring / logging / audit trail specification\n- Check that there is an audit trail of the all actions on the mobile money system including:\na) Logical access attempts, \nb) Creation/ deletion/ modification of operator accounts, \nc) Access to audit trails, \nd) Access to customer data, \ne) Key system activities/ events\n\n\n\n",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.6","","5.3.6.2",null,null,"5.3.6.2.2","5.3.6.2.2","Does the mobile money audit trail include all actions on the mobile money system (logical access attempts, creation/ deletion/ modification of operator accounts, access to audit trails, access to customer data, and key system activities/ events)?","1) Monitoring / logging / audit trail specification\n- Check that there is an audit trail of the all actions on the mobile money system including:\na) Logical access attempts, \nb) Creation/ deletion/ modification of operator accounts, \nc) Access to audit trails, \nd) Access to customer data, \ne) Key system activities/ events\n\n\n\n",null,"Urgent Required","Required","TechOps",null,null,"5","5.3","5.3.6","","5.3.6.2",0,0,"5.3.6.2.2","la piste d’audit de l’argent mobile contient-elle toutes les transactions, tous les autres mouvements d’argent, toutes les tentatives d’accès logique, toutes les créations, suppressions ou modifications de comptes d’opérateurs, les accès aux pistes d’audit, les accès aux données concernant les clients et les activités/événements clés du système ?","1) Spécification relative au suivi/à la journalisation (logging)/aux pistes d’audit\n- Vérifier qu’une piste d’audit est établie pour toutes les actions effectuées sur le système d’argent mobile, y compris :\na) Les tentatives d’accès logique, \nb) La création/suppression/modification de comptes d’opérateurs, \nc) Les accès aux pistes d’audit, \nd) Les accès aux données concernant des clients, \ne) Les activités/évènements clés du système\n\n\n\n",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.3","5.3.6","","5.3.6.2",null,0,"5.3.6.2.2","¿La pista de auditoría del dinero móvil incluye todas las acciones en el sistema del dinero móvil (intentos de acceso lógico, creación/ eliminación/ modificación de las cuentas de los operadores, acceso a las pistas de auditoría, accesos a los datos de los clientes y actividades / eventos clave del sistema)?","1) Especificación de monitoreo / registro / pista de auditoría\n- Verificar que exista una pista de auditoría de todas las acciones en el sistema del dinero móvil incluyendo:\na) Intentos de acceso lógico, \nb) Creación / eliminación / modificación de las cuentas de los operadores, \nc) Acceso a las pistas de auditoría, \nd) Acceso a los datos de los clientes, \ne) Actividades / eventos clave del sistema\n\n\n\n",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.3","5.3.6",null,"5.3.6.2",null,0,"5.3.6.2.2",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.6.2.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.6","","5.3.6.2",null,0,"5.3.6.2.3","5.3.6.2.3: For each event in the mobile money audit trail, is the following logged (as relevant): credit and debit party, transaction ID, date & time, initiator ID (i.e. operator/ customer/ agent/ system ID), type of event, and success or failure of the event?\n","1) Monitoring / logging / audit trail specification\n- Check that for each event in the audit trail the following is captured:\na) Credit and debit party,\nb) Transaction ID, \nc) Date & time, \nd) Initiator ID (i.e. operator/ customer/ agent/ system ID), \ne) Type of event,  \nf) Success or failure of the event\n\n\n\n\n",0,"Urgent Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.6","","5.3.6.2",null,null,"5.3.6.2.3","5.3.6.2.3","For each event in the mobile money audit trail, is the following logged (as relevant): credit and debit party, transaction ID, date & time, initiator ID (i.e. operator/ customer/ agent/ system ID), type of event, and success or failure of the event?","1) Monitoring / logging / audit trail specification\n- Check that for each event in the audit trail the following is captured:\na) Credit and debit party,\nb) Transaction ID, \nc) Date & time, \nd) Initiator ID (i.e. operator/ customer/ agent/ system ID), \ne) Type of event,  \nf) Success or failure of the event\n\n\n\n\n",null,"Urgent Required","Required","TechOps",null,null,"5","5.3","5.3.6","","5.3.6.2",0,0,"5.3.6.2.3","pour chaque événement, la piste d’audit de l’argent mobile enregistre-t-elle (le cas échéant) les parties débitées et créditées, la référence de la transaction, la date et l’heure, l’identifiant de la partie initiatrice (opérateur/client/agent/système), le type d’événement, sa réussite ou son échec ?","1) Spécification relative au suivi/à la journalisation (logging)/aux pistes d’audit\n- Vérifier que les éléments suivants sont enregistrés pour chaque évènement dans la piste d’audit :\na) Parties créditées et débitées,\nb) Référence de la transaction, \nc) Date & heure, \nd) Identifiant de la partie initiatrice (identifiant de l’opérateur/du client/de l’agent/du système), \ne) Type d’évènement, \nf) Réussite ou échec de l’évènement\n\n\n\n\n",null,"Requis Prioritaire","Requis","TechOps",null,null,"5","5.3","5.3.6","","5.3.6.2",null,0,"5.3.6.2.3","¿Para cada evento en la pista de auditoría del dinero móvil se registra lo siguiente (según corresponda): parte beneficiaria y parte que paga, ID de la transacción, fecha y hora, ID del iniciador (es decir, ID del operador / cliente/ agente/ sistema), tipo de evento y éxito o fracaso del evento?","1) Especificación de monitoreo / registro / pista de auditoría\n- Verificar que para cada evento en la pista de auditoría se registre lo siguiente:\na) Parte beneficiaria y parte que paga,\nb) ID de la transacción,\nc) Fecha y hora, \nd) ID del iniciador (es decir, ID del operador / cliente / agente / sistema), \ne) Tipo de evento,  \nf) Éxito o fracaso del evento\n\n\n\n\n",null,"Obligatorio urgente","Obligatorio","TechOps",null,null,"5","5.3","5.3.6",null,"5.3.6.2",null,0,"5.3.6.2.3",null,null,null,"ReqU4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.6.2.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.6","","5.3.6.3","5.3.6.3: PROTECTION OF LOGS & AUDIT TRAILS\nMobile money system logs and application audit trails should be protected to prevent tampering by users and administrators to cover their tracks. \nControls should include:\n- prevention of alterations to the message types that are recorded in system log files and application audit trails;\n- prevention of edits or deletions to system log files and application audit trails; \n- steps to avoid exceeding the storage capacity of the log file media, resulting in either the failure to record events or over-writing of past recorded events;\n- ensuring only individuals who have a job-related need can view logs and audit trail files (see 5.3.3);\n- using file-integrity monitoring or change-detection software for logs and audit trail files; and\n- real-time copying of logs and audit trails to a separate secure logging system, particularly for external-facing systems.\n\nIt is recommended that a centralised log storage system be used.\n\nProviders should retain logs and audit trails for at least one year, with a minimum of three months immediately available online for analysis.","ISO 27002: 2013 Sec. 12.4, \nPCI DSS","5.3.6.3.1","5.3.6.3.1: Are system logs and application audit trails protected to restrict access, to prevent alterations to the message types that are recorded, and to prevent edits or deletions to the log files themselves?\n","1) Monitoring / logging / audit trail specification\n- Check that there are controls in place to restrict access to logs, to prevent alterations to the message types that are recorded, and to prevent edits or deletions to the log files themselves.\n\n\n\n\n",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.6","","5.3.6.3","PROTECTION OF LOGS & AUDIT TRAILS\nMobile money system logs and application audit trails should be protected to prevent tampering by users and administrators to cover their tracks. \nControls should include:\n- prevention of alterations to the message types that are recorded in system log files and application audit trails;\n- prevention of edits or deletions to system log files and application audit trails; \n- steps to avoid exceeding the storage capacity of the log file media, resulting in either the failure to record events or over-writing of past recorded events;\n- ensuring only individuals who have a job-related need can view logs and audit trail files (see 5.3.3);\n- using file-integrity monitoring or change-detection software for logs and audit trail files; and\n- real-time copying of logs and audit trails to a separate secure logging system, particularly for external-facing systems.\n\nIt is recommended that a centralised log storage system be used.\n\nProviders should retain logs and audit trails for at least one year, with a minimum of three months immediately available online for analysis.","ISO 27002: 2013 Sec. 12.4, \nPCI DSS","5.3.6.3.1","5.3.6.3.1","Are system logs and application audit trails protected to restrict access, to prevent alterations to the message types that are recorded, and to prevent edits or deletions to the log files themselves?","1) Monitoring / logging / audit trail specification\n- Check that there are controls in place to restrict access to logs, to prevent alterations to the message types that are recorded, and to prevent edits or deletions to the log files themselves.\n\n\n\n\n",null,"Standard Required","Required","TechOps",null,null,"5","5.3","5.3.6","","5.3.6.3","PROTECTION DES JOURNAUX ET DES PISTES D’AUDIT\nLes journaux du système de l’argent mobile et les pistes d’audit de l’application doivent être protégés pour empêcher toute altération par des utilisateurs ou des administrateurs souhaitant effacer leurs traces. \nLes mesures de contrôle doivent :\n- prévenir les altérations au moyen de message types enregistrés dans les journaux du système et les pistes d’audit de l’application;\n- empêcher la correction ou la suppression de données dans les journaux du système de l’argent mobile et les pistes d’audit de l’application ; \n- éviter le dépassement des capacités de stockage des supports de journalisation afin d’éviter l’absence d’enregistrement ou l’écrasement d’événements précédemment enregistrés ;\n- garantir que seules les personnes qui en ont besoin pour leur travail peuvent consulter les fichiers journaux et les pistes d’audit (cf. 5.3.3) ;\n- utiliser des logiciels de surveillance de l’intégrité des fichiers et de détection des modifications pour les fichiers journaux et les pistes d’audit ; et\n- copier en temps réel les journaux et pistes d’audit dans un système de journalisation séparé et sécurisé, notamment pour les systèmes ouverts vers l’extérieur.\n\nIl est recommandé d’utiliser un système centralisé de stockage des fichiers journaux.\n\nLes journaux et pistes d’audit doivent être conservés pendant une durée minimum d’un an, avec accès immédiat en ligne pour analyse pendant au moins trois mois.","ISO 27002: 2013 Sec. 12.4, \nPCI DSS","5.3.6.3.1","Les journaux du système et les pistes d’audit de l’application sont-ils protégés pour empêcher tout accès non autorisé, toute altération des messages type enregistrés ainsi que la modification ou la suppression des fichiers journaux proprement dits ?","1) Spécification relative au suivi/à la journalisation (logging)/aux pistes d’audit\n-Vérifier que des contrôles ont été mis en place pour empêcher tout accès non autorisé aux journaux, toute altération des messages type enregistrés ainsi que la modification ou la suppression des fichiers journaux proprement dits\n\n\n\n",null,"Requis Normal","Requis","TechOps",null,null,"5","5.3","5.3.6","","5.3.6.3","PROTECCIÓN DE REGISTROS Y PISTAS DE AUDITORÍA\nSe deben proteger los registros y las pistas de auditoría de la aplicación del dinero móvil para evitar que sean alteradas por los usuarios y administradores con el fin de ocultar sus rastros. \nLos controles deben incluir:\n- prevención contra alteraciones de los tipos de mensajes registrados en los archivos de registro del sistema y en las pistas de auditoría de la aplicación;\n- prevención contra ediciones o eliminaciones en los archivos de registro del sistema y en las pistas de auditoría de la aplicación; \n- pasos para evitar superar la capacidad de almacenamiento de los medios de almacenamiento de archivos de registro, que podría imposibilitar el registro de eventos o  sobreescribir eventos pasados registrados;\n- garantizar que solo las personas con necesidad específica relacionada con su trabajo puedan visualizar los registros y archivos de pistas de auditoría (ver 5.3.3);\n- utilización de un software de monitoreo de integridad de los archivos o de detección de cambios para los registros y archivos de pistas de auditoría ; y\n- copiado en tiempo real de los registros y las pistas de auditoría en un sistema de registro seguro por separado, especialmente para sistemas externos.\n\nSe recomienda la utilización de un sistema de almacenamiento de registros centralizado.\n\nLos proveedores deben conservar los registros y las pistas de auditoría durante, al menos, un año, y los registros de tres meses, como mínimo, deben estar inmediatamente disponibles en línea, para fines de análisis.","ISO 27002: 2013 Sec. 12.4, \nPCI DSS","5.3.6.3.1","¿Los registros del sistema y las pistas de auditoría de la aplicación están protegidos para restringir el acceso, para prevenir alteraciones de los tipos de mensajes registrados y para prevenir ediciones o eliminación de los archivos de registro? ","1) Especificación de monitoreo / registro / pista de auditoría\n- Verificar que se hayan implementado controles para  restringir el acceso a los registros, prevenir alteraciones de los tipos de mensajes registrados y prevenir ediciones o eliminaciones de los archivos de registro.\n\n\n\n",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.3","5.3.6",null,"5.3.6.3",null,"ISO 27002: 2013 Sec. 12.4, \nPCI DSS","5.3.6.3.1",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.6.3.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",{"$f":"COUNTIF($DS123:$DV123,EH$3)","v":0},0,0,0,0,1,""]
[null,"5","5.3","5.3.6","","5.3.6.3",null,0,"5.3.6.3.2","5.3.6.3.2: Are there controls in place that protect against exceeding the storage capacity of the log file media?\n","1) Monitoring / logging / audit trail specification\n- Check that there are controls in place to protect against exceeding the storage capacity of the log file media\n\n\n\n\n",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.6","","5.3.6.3",null,null,"5.3.6.3.2","5.3.6.3.2","Are there controls in place that protect against exceeding the storage capacity of the log file media?","1) Monitoring / logging / audit trail specification\n- Check that there are controls in place to protect against exceeding the storage capacity of the log file media\n\n\n\n\n",null,"Standard Required","Required","TechOps",null,null,"5","5.3","5.3.6","","5.3.6.3",0,0,"5.3.6.3.2","existe-t-il des mesures de contrôle pour éviter le dépassement des capacités de stockage des supports de journalisation ?","1) Spécification relative au suivi/à la journalisation (logging)/aux pistes d’audit\n- Vérifier que des contrôles ont été mis en place pour éviter le dépassement des capacités de stockage des supports de journalisation\n\n\n\n\n",null,"Requis Normal","Requis","TechOps",null,null,"5","5.3","5.3.6","","5.3.6.3",null,0,"5.3.6.3.2","¿Se implementaron controles de protección para evitar exceder la capacidad de almacenamiento de los medios de almacenamiento de archivos de registro?","1) Especificación de monitoreo / registro / pista de auditoría\n- Verificar que se hayan implementado controles de protección para evitar exceder la capacidad de almacenamiento de los medios de almacenamiento de archivos de registros\n\n\n\n\n",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.3","5.3.6",null,"5.3.6.3",null,0,"5.3.6.3.2",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.6.3.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.6",0,"5.3.6.3",null,null,null,"5.3.6.3.3: Has a centralized log storage system been implemented?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.6",null,"5.3.6.3",null,null,"5.3.6.3.3",{"$f":"DO125","v":0},"Has a centralized log storage system been implemented?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.6",null,"5.3.6.3",null,null,"5.3.6.3.3","Un système centralisé de stockage des journaux a-t-il été mis en place ? ",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.6",null,"5.3.6.3",null,null,"5.3.6.3.3","¿Se implementó un sistema de almacenamiento de registros centralizado?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.6",null,"5.3.6.3",null,null,{"$f":"$BC125","v":"5.3.6.3.3"},null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,"NEW"]
[null,"5","5.3","5.3.6",{"$f":"CHOOSE(LanguageNumber,AY126,BP126,CF126,CV126)","v":""},"5.3.6.3",null,{"$f":"BB126","v":0},{"$f":"BC126","v":"5.3.6.3.4"},"5.3.6.3.4: Is file-integrity monitoring or change-detection software in use for logs and audit trail files?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.6","","5.3.6.3",null,null,"5.3.6.3.4","5.3.6.3.4","Is file-integrity monitoring or change-detection software in use for logs and audit trail files?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.6","",{"$f":"$AZ126","v":"5.3.6.3"},0,{"$f":"BB126","v":0},"5.3.6.3.4","est-ce que des logiciels de surveillance de l’intégrité des fichiers et de détection des modifications sont utilisés pour les fichiers journaux et les pistes d’audit ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.6","","5.3.6.3",null,{"$f":"BB126","v":0},{"$f":"$BC126","v":"5.3.6.3.4"},"¿Se utiliza un software de monitoreo de la integridad de los archivos o de detección de cambios para los registros y archivos de pistas de auditoría?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.6",null,{"$f":"$AZ126","v":"5.3.6.3"},null,{"$f":"BB126","v":0},"5.3.6.3.4",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.6.3.4",null,null,null,{"$f":"IF(OR($EA126=0,$EA126=2),VLOOKUP(DO126,INDIRECT(ED126),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP126),\"\",VLOOKUP(DP126,INDIRECT(EE126),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ126),\"\",VLOOKUP(DQ126,INDIRECT(EF126),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR126),\"\",VLOOKUP(DR126,INDIRECT(EG126),7,FALSE))","v":""},{"$f":"IF(OR($EA126=0,$EA126=2),VLOOKUP(DO126,INDIRECT(ED126),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP126),\"\",VLOOKUP(DP126,INDIRECT(EE126),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ126),\"\",VLOOKUP(DQ126,INDIRECT(EF126),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR126),\"\",VLOOKUP(DR126,INDIRECT(EG126),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN126,3)=\"NEW\")+2*AND(LEFT(DN126,3)=\"MER\")+3*AND(LEFT(DN126,3)=\"MOV\")+4*AND(LEFT(DN126,3)=\"SWA\")","v":0},{"$f":"IF(EA126=0,DS126,EN126)","v":{"$error":"#REF!"}},{"$f":"IF(EA126=0,IF(DW126=0,\"\",DW126),CHOOSE(EA126,\"New indicator\",CONCATENATE(DW126,CarriageReturn,DX126,CarriageReturn,DY126,CarriageReturn,DZ126)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO126,1)","v":"OriginalComplianceP5"},{"$f":"\"OriginalComplianceP\"&LEFT(DP126,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ126,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR126,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,""]
[null,"5","5.3","5.3.6","","5.3.6.3",null,0,"5.3.6.3.5","5.3.6.3.5: Are logs and audit trails copied in real time to a separate secure logging system, particularly for external-facing systems?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.6","","5.3.6.3",null,null,"5.3.6.3.5","5.3.6.3.5","Are logs and audit trails copied in real time to a separate secure logging system, particularly for external-facing systems?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.6","","5.3.6.3",0,0,"5.3.6.3.5","les fichiers journaux et les pistes d’audit sont-ils copiés en temps réel dans un système de journalisation séparé et sécurisé, notamment pour les systèmes ouverts vers l’extérieur ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.6","","5.3.6.3",null,0,"5.3.6.3.5","¿Los registros y las pistas de auditorías son copiadas en tiempo real a un sistema de registro seguro por separado, especialmente para sistemas externos?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.6",null,"5.3.6.3",null,0,"5.3.6.3.5",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.6.3.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.6","","5.3.6.3",null,0,"5.3.6.3.6",{"$f":"BC128&\": \"&CHOOSE(LanguageNumber,BE128,BU128,CK128,DA128)&CarriageReturn","v":"5.3.6.3.6: Are logs and audit trail files retained for at least one year, with at least three months of logs available online for analysis?\n"},{"$f":"CHOOSE(LanguageNumber,BF128,BV128,CL128,DB128)","v":0},0,{"$f":"CHOOSE(LanguageNumber,BH128,BX128,CN128,DD128)","v":"Recommended"},{"$f":"CHOOSE(LanguageNumber,BI128,BY128,CO128,DE128)","v":"Recommended"},"TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.6","","5.3.6.3",null,null,"5.3.6.3.6","5.3.6.3.6","Are logs and audit trail files retained for at least one year, with at least three months of logs available online for analysis?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.6","","5.3.6.3",0,0,"5.3.6.3.6","Les fichiers journaux et pistes d’audit sont-ils conservés pendant au moins un an, avec accès immédiat en ligne pour analyse pendant au moins trois mois ?",null,null,{"$f":"VLOOKUP($BH128,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},{"$f":"VLOOKUP($BI128,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},"TechOps",null,null,"5","5.3","5.3.6","","5.3.6.3",null,0,"5.3.6.3.6","¿Los registros y archivos de pistas de auditoría se conservan durante, al menos, un año y los registros de tres meses, como mínimo, están disponibles en línea, para fines de análisis?",null,null,{"$f":"VLOOKUP($BH128,CategoryTranslationTable,3,FALSE)","v":"Recomendado"},{"$f":"VLOOKUP($BI128,CategoryTranslationTable,3,FALSE)","v":"Recomendado"},"TechOps",null,null,"5","5.3","5.3.6","","5.3.6.3",null,0,"5.3.6.3.6",null,null,null,{"$f":"VLOOKUP($BH128,CategoryTranslationTable,4,FALSE)","v":"Rec4"},{"$f":"VLOOKUP($BI128,CategoryTranslationTable,4,FALSE)","v":"Rec4"},"TechOps",null,null,null,null,null,null,null,null,"5.3.6.3.6",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.7","5.3.7: Providers shall regularly test security systems and processes.","5.3.7.1",{"$f":"AZ129&\": \"&CHOOSE(LanguageNumber,BA129,BR129,CH129,CX129)","v":"5.3.7.1: VULNERABILITY SCANS\nVulnerability scans should be performed on the mobile money system to search for security weaknesses. Vulnerability scans should be performed at least every three months and after any significant change to the mobile money system or the network supporting it.\n\nVulnerability scans should include:\n - System: scans of the mobile money application.\n - Network: internal and external (public API) scans on the network supporting the mobile money system;\n\nRemedial actions should be determined and prioritized according to criticality. Additional scans should be run to ensure that the fixes have been implemented correctly.\n\nVulnerability scans should be performed by qualified internal personnel or a qualified external third party, and the organizational independence of the tester should be assured.\n\nFor more information, please refer to security testing in the definitions."},"ISO 27002:2013 Sec. 12.6, PCI DSS","5.3.7.1.1","5.3.7.1.1: Are vulnerability scans of the mobile money system performed at least every six months and after any significant change to the mobile money system?\n","1) Security testing process documentation\n- Check that there is a process to perform vulnerability scans of the mobile money system.\n- Check that the process schedules scans at least every six months.\n- Check that the process requires a scan after any significant change to the mobile money platform.\n- Check that a scan has been completed in the last six months (and if not, look for evidence that the process will be run in future).",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.7","5.3.7: Providers shall regularly test security systems and processes.","5.3.7.1","VULNERABILITY SCANS\nVulnerability scans should be performed on the mobile money system to search for security weaknesses. Vulnerability scans should be performed at least every three months and after any significant change to the mobile money system or the network supporting it.\n\nVulnerability scans should include:\n - System: scans of the mobile money application.\n - Network: internal and external (public API) scans on the network supporting the mobile money system;\n\nRemedial actions should be determined and prioritized according to criticality. Additional scans should be run to ensure that the fixes have been implemented correctly.\n\nVulnerability scans should be performed by qualified internal personnel or a qualified external third party, and the organizational independence of the tester should be assured.\n\nFor more information, please refer to security testing in the definitions.","ISO 27002:2013 Sec. 12.6, PCI DSS","5.3.7.1.1","5.3.7.1.1","Are vulnerability scans of the mobile money system performed at least every six months and after any significant change to the mobile money system?","1) Security testing process documentation\n- Check that there is a process to perform vulnerability scans of the mobile money system.\n- Check that the process schedules scans at least every six months.\n- Check that the process requires a scan after any significant change to the mobile money platform.\n- Check that a scan has been completed in the last six months (and if not, look for evidence that the process will be run in future).",null,"Standard Required","Required","TechOps",null,null,"5","5.3","5.3.7","5.3.7: Les prestataires doivent effectuer des tests périodiques de leurs systèmes et de leurs procédures de sécurité.","5.3.7.1","ANALYSES DE VULNERABILITÉ\nDes analyses de vulnérabilité du système de l’argent mobile doivent être effectuées pour identifier les éventuelles failles de sécurité, au minimum tous les trois mois et après tout changement significatif dans le système de l’argent mobile ou le réseau utilisé par le système.\n\nCes analyses de vulnérabilité doivent couvrir :\n - le système : analyses de l’application d’argent mobile\n - le réseau : analyses internes et externes (API publique) du réseau utilisé par le système de l’argent mobile ;\n\nLes mesures correctives doivent être identifiées et classées par ordre de priorité selon leur degré d’urgence. Des analyses supplémentaires doivent être effectuées pour vérifier que les correctifs ont été mis en œuvre de manière appropriée.\n\nLes analyses de vulnérabilité doivent être effectuées par du personnel qualifié, que ce soit en interne ou par le biais d’un prestataire externe, et l’indépendance organisationnelle des personnes effectuant les tests doit être garantie.\n\nPour plus d’informations, se référer à la définition de test de sécurité.","ISO 27002:2013 Sec. 12.6, PCI DSS","5.3.7.1.1","des analyses de vulnérabilité du système de l’argent mobile sont-elles effectuées au moins tous les six mois et après tout changement significatif dans le système de l’argent mobile ?","1) Documentation du processus de test de sécurité\n\r- Vérifier qu’un processus a été mis en place pour effectuer des analyses de vulnérabilité du système de l'argent mobile.\n\r- Vérifier que le processus prévoit d’effectuer une analyse au moins tous les six mois.\n\r- Vérifier que le processus prévoit l’obligation d’effectuer une analyse après tout changement significatif de la plateforme d’argent mobile.\n\r- Vérifier qu’une analyse a été effectuée au cours des six derniers mois (dans le cas contraire, rechercher des éléments prouvant que le processus sera mis en œuvre ultérieurement).\r",null,"Requis Normal","Requis","TechOps",null,null,"5","5.3","5.3.7","5.3.7: Los proveedores deben probar habitualmente los sistemas y procesos de seguridad.","5.3.7.1","ANÁLISIS DE VULNERABILIDADES\nSe deben realizar análisis de vulnerabilidades en el sistema del dinero móvil para buscar debilidades de la seguridad. Los análisis de vulnerabilidades deben realizarse, al menos, una vez cada tres meses y después de cualquier cambio significativo al sistema del dinero móvil o a la red que lo soporta.\n\nLos análisis de vulnerabilidades deben incluir:\n - Sistema: análisis de la aplicación del dinero móvil;\n - Red: análisis interno y externo (API pública) de la red que soporta el sistema del dinero móvil.\n\nSe deben determinar y priorizar las medidas correctivas según la criticidad. Se deben ejecutar análisis adicionales para garantizar que las correcciones hayan sido implementadas como corresponde.\n\nLos análisis de vulnerabilidad deben ser realizados por personal interno calificado o por un tercero externo calificado, y se debe garantizar la independencia organizacional del evaluador.\n\nPara más información, por favor consultar las pruebas de seguridad en las definiciones.","ISO 27002:2013 Sec. 12.6, PCI DSS","5.3.7.1.1","¿Se realizan análisis de vulnerabilidades del sistema del dinero móvil, al menos, una vez cada seis meses y después de cualquier cambio significativo al sistema del dinero móvil?  ","1) Documentación del proceso de pruebas de seguridad\n- Verificar que exista un proceso para realizar análisis de vulnerabilidades del sistema del dinero móvil.\n- Verificar que el proceso programe el análisis, al menos, cada seis meses.\n- Verificar que el proceso requiera un análisis después de cualquier cambio significativo a la plataforma del dinero móvil.\n- Verificar que se haya completado un análisis en los últimos seis meses (de lo contrario, buscar evidencias de que el proceso se ejecutará en el futuro).",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.3","5.3.7",null,"5.3.7.1",null,"ISO 27002:2013 Sec. 12.6, PCI DSS","5.3.7.1.1",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,"MERGE","5.3.7.1.1","5.3.7.1.2",null,null,{"$error":"#REF!"},{"$error":"#REF!"},"","",{"$error":"#REF!"},{"$error":"#REF!"},"","",2,"",{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,2,""]
[null,"5","5.3","5.3.7","","5.3.7.1",null,0,"5.3.7.1.2","5.3.7.1.2: Are remedial actions prioritized and dealt with according to criticality?\n","1) Security testing process documentation\n- Check there is a process to address remedial issues identified by scans\n- Check these are prioritised using a risk-based approach\n\n",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.7","","5.3.7.1",null,null,"5.3.7.1.2","5.3.7.1.3","Are remedial actions prioritized and dealt with according to criticality?","1) Security testing process documentation\n- Check there is a process to address remedial issues identified by scans\n- Check these are prioritised using a risk-based approach\n\n",null,"Standard Required","Required","TechOps",null,null,"5","5.3","5.3.7","","5.3.7.1",0,0,"5.3.7.1.2","les mesures correctives sont-elles classées et effectuées par ordre de priorité en fonction de leur degré d’urgence ?","1) Documentation du processus de test de sécurité\n- Vérifier qu’un processus a été mis en place afin de traiter les mesures correctives identifiées par les analyses\n- Vérifier que ces mesures sont classées par ordre de priorité dans le cadre d’une approche basée sur les risques\n\n",null,"Requis Normal","Requis","TechOps",null,null,"5","5.3","5.3.7","","5.3.7.1",null,0,"5.3.7.1.2","¿Se priorizan y tratan las medidas correctivas según la criticidad?","1) Documentación del proceso de pruebas de seguridad\n- Verificar que exista un proceso para abordar las medidas correctivas identificadas en los análisis\n- Verificar que se prioricen empleando un enfoque basado en riesgos\n\n",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.3","5.3.7",null,"5.3.7.1",null,0,"5.3.7.1.2",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.7.1.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.7","","5.3.7.2","5.3.7.2: PENETRATION TESTING\nPenetration testing of the mobile money system should be performed annually and whenever a significant change is made to the mobile money system (e.g. a major release). Testing should be done on all external interfaces to the system.\n\nThe methodology for penetration testing should:\n- be based on industry-accepted penetration testing approaches (for example, NIST SP800-115);\n- include all system components involved in providing the mobile money service (application servers, databases, gateways, etc.);\n- include handset and other terminals such as smartphones and PoS devices;\n- test the network segmentation that separates mobile money from other systems in the network;\n- include both application-layer tests (using real accounts) and network-layer penetration testing; and\n- include consideration of threats and vulnerabilities experienced in the last 12 months.\n\nRemedial actions should be determined and prioritized according to criticality. The actions should be tracked and followed up to ensure completion.\n\nPenetration testing should be performed by a qualified internal resource(s) or qualified external third party, and the independence of the tester should be assured.\n\nFor more information, please refer to security testing in the definitions.","PCI DSS ","5.3.7.2.1","5.3.7.2.1: Is penetration testing of the mobile money system performed annually and after any significant changes, using all external interfaces?\n","1) Security testing process documentation\n-  Check there is a process to perform penetration testing of the mobile money application system annually and after any significant changes to the mobile money platform.\n\n2) Header page of penetration test report or purchase prder for penetration testing\n- Review document to confirm penetration testing has been conducted in the last year",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.7","","5.3.7.2","PENETRATION TESTING\nPenetration testing of the mobile money system should be performed annually and whenever a significant change is made to the mobile money system (e.g. a major release). Testing should be done on all external interfaces to the system.\n\nThe methodology for penetration testing should:\n- be based on industry-accepted penetration testing approaches (for example, NIST SP800-115);\n- include all system components involved in providing the mobile money service (application servers, databases, gateways, etc.);\n- include handset and other terminals such as smartphones and PoS devices;\n- test the network segmentation that separates mobile money from other systems in the network;\n- include both application-layer tests (using real accounts) and network-layer penetration testing; and\n- include consideration of threats and vulnerabilities experienced in the last 12 months.\n\nRemedial actions should be determined and prioritized according to criticality. The actions should be tracked and followed up to ensure completion.\n\nPenetration testing should be performed by a qualified internal resource(s) or qualified external third party, and the independence of the tester should be assured.\n\nFor more information, please refer to security testing in the definitions.","PCI DSS ","5.3.7.2.1","5.3.7.2.1","Is penetration testing of the mobile money system performed annually and after any significant changes, using all external interfaces?","1) Security testing process documentation\n-  Check there is a process to perform penetration testing of the mobile money application system annually and after any significant changes to the mobile money platform.\n\n2) Header page of penetration test report or purchase prder for penetration testing\n- Review document to confirm penetration testing has been conducted in the last year",null,"Standard Required","Required","TechOps",null,null,"5","5.3","5.3.7","","5.3.7.2","TESTS D’INTRUSION\nDes tests d’intrusion doivent être effectués au moins une fois par an et après tout changement significatif dans le système de l’argent mobile (mise en production d’une nouvelle version majeure par exemple). Les tests doivent être réalisés sur l’ensemble des interfaces externes du système.\n\nLa méthodologie de test d’intrusion doit :\n- être fondée sur des méthodes acceptées dans le secteur (ex. NIST SP800-115) ;\n- couvrir tous les composants du système utilisés par le service d’argent mobile (serveurs d’application, bases de données, passerelles, etc.) ;\n- couvrir les appareils téléphoniques et autres terminaux (smartphones, terminaux de point de vente) ;\n- tester la segmentation de réseau séparant le système de l’argent mobile des autres systèmes sur le réseau ;\n- inclure à la fois des tests d’intrusion par couche applicative (utilisant des comptes réels) et par couche de réseau ;\n- tenir compte des menaces et vulnérabilités rencontrées au cours des 12 mois écoulés.\n\nLes mesures correctives doivent être identifiées et classées par ordre de priorité selon leur degré d’urgence. Elles doivent être suivies et surveillées pour s’assurer de leur mise en œuvre.\n\nLes tests d’intrusion doivent être effectués par du personnel qualifié, que ce soit en interne ou par le biais d’un prestataire externe, et l’indépendance organisationnelle des personnes effectuant les tests doit être garantie.\n\nPour plus d’informations, se référer à la définition de test de sécurité.","PCI DSS ","5.3.7.2.1","des tests d’intrusion sont-ils effectués au moins une fois par an et après tout changement significatif dans le système de l’argent mobile, y compris sur l’ensemble des interfaces externes ?","1) Documentation de processus de tests de sécurité\n- Vérifier qu’un processus a été mis en place pour effectuer des tests d’intrusion sur le système d’application d’argent mobile au moins une fois par an et après tout changement significatif de la plateforme d'argent mobile\n\n2) Page d'en-tête du rapport de test d'intrusion ou bon de commande pour test d’intrusion\n- Analyser le document afin de confirmer que le test d’intrusion a bien été effectué au cours de l'année passée",null,"Requis Normal","Requis","TechOps",null,null,"5","5.3","5.3.7","","5.3.7.2","PRUEBAS DE PENETRACIÓN\nSe deben realizar pruebas de penetración del sistema del dinero móvil una vez al año y siempre que se realice un cambio significativo al sistema del dinero móvil (por ej., una versión principal). Las pruebas se deben realizar en todas las interfaces externas al sistema.\n\nLa metodología de las pruebas de penetración debe:\n- estar basada en los enfoques de pruebas de penetración aceptados por la industria (por ejemplo, NIST SP800-115);\n- incluir todos los componentes del sistema involucrados en la prestación del servicio del dinero móvil (servidores de la aplicación, bases de datos, gateways, etc.);\n- incluir dispositivos y otros terminales, tales como smartphones y dispositivos PoS;\n- probar la segmentación de la red que separa el dinero móvil de los demás sistemas en la red;\n- incluir pruebas de capas de la aplicación (usando cuentas reales) y pruebas de penetración por capas de la red; e\n- incluir la consideración de las amenazas y las vulnerabilidades experimentadas en los últimos 12 meses.\n\nSe deben determinar y priorizar las medidas correctivas según la criticidad. Se deben rastrear y se debe realizar un seguimiento de las acciones para garantizar que sean completadas.\n\nLas pruebas de penetración deben ser realizadas por recurso(s) interno(s) calificado(s) o por un tercero externo calificado, y se debe garantizar la independencia organizacional del evaluador.\n\nPara más información, por favor consultar las pruebas de seguridad en las definiciones.","PCI DSS ","5.3.7.2.1","¿Las pruebas de penetración del sistema del dinero móvil se realizan una vez al año y después de cualquier cambio significativo, usando todas las interfaces externas?","1) Documentación del proceso de pruebas de seguridad\n- Verificar que exista un proceso para realizar pruebas de penetración del sistema de la aplicación del dinero móvil  una vez al año y después de cualquier cambio significativo a la plataforma del dinero móvil\n2) Página de encabezado del informe de pruebas de penetración u orden de compra para las pruebas de penetración\n- Revisar el documento para confirmar que se hayan realizado las pruebas de penetración en el último año",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.3","5.3.7",null,"5.3.7.2",null,"PCI DSS ","5.3.7.2.1",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,"MERGE","5.3.7.2.1","5.3.7.2.3",null,null,{"$error":"#REF!"},{"$error":"#REF!"},"","",{"$error":"#REF!"},{"$error":"#REF!"},"","",2,"",{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,2,""]
[null,{"$f":"$AV132","v":"5"},{"$f":"$AW132","v":"5.3"},{"$f":"$AX132","v":"5.3.7"},"",{"$f":"AZ132","v":"5.3.7.2"},null,0,"5.3.7.2.2","5.3.7.2.2: Are remedial actions prioritized according to criticality and actions tracked and followed up to ensure completion?\n","1) Security Testing Process Documentation\n- Check there is a process to address remedial issues identified by scans\n- Check these are prioritised using a risk-based approach\n- Check there is a process to track actions until they are closed\n",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.7","","5.3.7.2",null,null,"5.3.7.2.2",{"$f":"DO132","v":"5.3.7.2.7"},"Are remedial actions prioritized according to criticality and actions tracked and followed up to ensure completion?","1) Security Testing Process Documentation\n- Check there is a process to address remedial issues identified by scans\n- Check these are prioritised using a risk-based approach\n- Check there is a process to track actions until they are closed\n",null,"Standard Required","Required","TechOps",null,null,{"$f":"$AV132","v":"5"},{"$f":"$AW132","v":"5.3"},{"$f":"$AX132","v":"5.3.7"},"",{"$f":"$AZ132","v":"5.3.7.2"},null,null,{"$f":"BC132","v":"5.3.7.2.2"},"les mesures correctives sont-elles classées par ordre de priorité en fonction de leur degré d’urgence et les actions suivies et surveillées pour garantir leur réalisation ?","1) Documentation de processus de tests de sécurité\n- Vérifier qu’un processus a été mis en place afin de traiter les mesures correctives identifiées par les analyses\n- Vérifier que ces mesures sont classées par ordre de priorité dans le cadre d’une approche basée sur les risques\n- Vérifier qu’un processus a été mis en place pour surveiller les actions jusqu’à leur réalisation\n",null,"Requis Normal","Requis","TechOps",null,null,"5","5.3","5.3.7","","5.3.7.2",null,null,{"$f":"$BC132","v":"5.3.7.2.2"},"¿Las medidas correctivas se priorizan según la criticidad y se rastrean y se realiza un seguimiento de las acciones para garantizar que sean completadas?","1) Documentación del Proceso de Pruebas de Seguridad\n- Verificar que exista un proceso para abordar las medidas correctivas identificadas en los análisis\n- Verificar que se prioricen empleando un enfoque basado en riesgos\n- Verificar que exista un proceso para rastrear las acciones hasta que sean cerradas\n",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.3","5.3.7",null,{"$f":"$AZ132","v":"5.3.7.2"},null,null,{"$f":"$BC132","v":"5.3.7.2.2"},null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.7.2.7",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.7","","5.3.7.2",null,0,"5.3.7.2.3","5.3.7.2.3: Are penetration tests performed by qualified internal resource(s) or a qualified external third party, and is the independence of the tester assured?\n","1) Security Testing Process Documentation\n- Check the penetration tests are carried out by qualified person(s)\n- Check there are controls in place to assure the independence of the tester\n\n2) Purchase Order for penetration testing\n- Check purchase order to confirm the above\n",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.7","","5.3.7.2",null,null,"5.3.7.2.3","5.3.7.2.8","Are penetration tests performed by qualified internal resource(s) or a qualified external third party, and is the independence of the tester assured?","1) Security Testing Process Documentation\n- Check the penetration tests are carried out by qualified person(s)\n- Check there are controls in place to assure the independence of the tester\n\n2) Purchase Order for penetration testing\n- Check purchase order to confirm the above\n",null,"Standard Required","Required","TechOps",null,null,"5","5.3","5.3.7","","5.3.7.2",null,null,"5.3.7.2.3","les tests d’intrusion sont-ils effectués par du personnel qualifié, que ce soit en interne ou par le biais d’un prestataire externe, et l’indépendance des personnes effectuant les tests est-elle garantie ?","1) Documentation de processus de tests de sécurité\n- Vérifier que les tests d’intrusion sont effectués par du personnel qualifié\n- Vérifier que des contrôles ont été mis en place afin de garantir l’indépendance des personnes effectuant les tests\n\n2) Bon de commande pour test d’intrusion\n- Vérifier le bon de commande afin de confirmer ce qui précède\n",null,"Requis Normal","Requis","TechOps",null,null,"5","5.3","5.3.7","","5.3.7.2",null,null,"5.3.7.2.3","¿Las pruebas de penetración son realizadas por recurso(s) interno(s) calificado(s) o por un tercero externo calificado, y se garantiza la independencia organizacional del evaluador?","1) Documentación del Proceso de Pruebas de Seguridad\n- Verificar que las pruebas de penetración sean realizadas por (una) persona(s) calificada(s)\n- Verificar que se hayan implementado controles para garantizar la independencia del evaluador\n2) Orden de Compra para las pruebas de penetración\n- Verificar la orden de compra para confirmar lo anterior\n",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.3","5.3.7",null,"5.3.7.2",null,null,"5.3.7.2.3",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,null,"5.3.7.2.8",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,{"$f":"COUNTIF($DO133:$DR133,\"*?\")","v":1},""]
[null,"5","5.3","5.3.7","","5.3.7.2",null,0,"5.3.7.2.4","5.3.7.2.4: Does penetration testing validate the network segmentation that separates mobile money from other systems in the network?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.7","","5.3.7.2",null,null,"5.3.7.2.4",{"$f":"DO134","v":"5.3.7.2.4"},"Does penetration testing validate the network segmentation that separates mobile money from other systems in the network?",null,null,"Recommended","Recommended",{"$f":"$O134","v":"TechOps"},null,null,"5","5.3","5.3.7","",{"$f":"$AZ134","v":"5.3.7.2"},0,{"$f":"BB134","v":0},"5.3.7.2.4","les tests d'intrusion valident-ils la segmentation de réseau séparant le système de l'argent mobile des autres systèmes sur le réseau?",null,null,"Recommandé","Recommandé",{"$f":"$O134","v":"TechOps"},null,null,{"$f":"$AV134","v":"5"},{"$f":"$AW134","v":"5.3"},{"$f":"$AX134","v":"5.3.7"},"","5.3.7.2",null,{"$f":"BB134","v":0},{"$f":"$BC134","v":"5.3.7.2.4"},"¿Las pruebas de penetración validan la segmentación de la red que separa al dinero móvil de los demás sistemas en la red?",null,null,"Recomendado","Recomendado",{"$f":"$O134","v":"TechOps"},null,null,{"$f":"$AV134","v":"5"},{"$f":"$AW134","v":"5.3"},{"$f":"$AX134","v":"5.3.7"},null,{"$f":"$AZ134","v":"5.3.7.2"},null,{"$f":"BB134","v":0},{"$f":"$BC134","v":"5.3.7.2.4"},null,null,null,"Rec4","Rec4",{"$f":"$O134","v":"TechOps"},null,null,null,null,null,null,null,null,"5.3.7.2.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,{"$f":"IF(OR(AND(EH134>0,SUM(EI134:EL134)>0),EK134>0),\"Partial\",IF(EH134=EM134,\"Yes\",IF(EI134=EM134,\"No\",IF(EJ134=EM134,\"N/A\",IF(EK134=EM134,\"Partial\",IF(EL134=EM134,\"\",\"\"))))))","v":""}]
[null,"5","5.3","5.3.7","","5.3.7.2",null,0,"5.3.7.2.5","5.3.7.2.5: Does penetration testing include both application-layer tests (using real accounts) and network-layer penetration testing?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.7","","5.3.7.2",null,null,"5.3.7.2.5","5.3.7.2.5","Does penetration testing include both application-layer tests (using real accounts) and network-layer penetration testing?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.7","",{"$f":"$AZ135","v":"5.3.7.2"},0,0,"5.3.7.2.5","les tests d'intrusion comprennent-ils à la fois des tests d’intrusion par couche applicative (utilisant des comptes réels) et par couche de réseau ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.7","","5.3.7.2",null,0,{"$f":"$BC135","v":"5.3.7.2.5"},"¿Las pruebas de penetración incluyen pruebas de las capas de la aplicación (usando cuentas reales) y pruebas de penetración en las capas de la red?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.7",null,{"$f":"$AZ135","v":"5.3.7.2"},null,0,{"$f":"$BC135","v":"5.3.7.2.5"},null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.7.2.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.7","","5.3.7.2",null,0,"5.3.7.2.6","5.3.7.2.6: Does penetration testing include consideration of threats and vulnerabilities experienced in the last 12 months?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.7","","5.3.7.2",null,null,"5.3.7.2.6","5.3.7.2.6","Does penetration testing include consideration of threats and vulnerabilities experienced in the last 12 months?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.7","",{"$f":"$AZ136","v":"5.3.7.2"},0,0,"5.3.7.2.6","les tests d'intrusion tiennent-ils compte des menaces et vulnérabilités rencontrées au cours des 12 mois précédents ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.7","","5.3.7.2",null,0,{"$f":"$BC136","v":"5.3.7.2.6"},"¿Las pruebas de penetración incluyen la consideración de las amenazas y las vulnerabilidades experimentadas en los últimos 12 meses?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.7",null,{"$f":"$AZ136","v":"5.3.7.2"},null,0,{"$f":"$BC136","v":"5.3.7.2.6"},null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.7.2.6",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.8","5.3.8: Providers shall ensure continuity of information security.","5.3.8.1",{"$f":"AZ137&\": \"&CHOOSE(LanguageNumber,BA137,BR137,CH137,CX137)","v":"5.3.8.1: SECURITY AND DISASTER RECOVERY\nIt is important that security is maintained in a crisis situation, especially one in which the Disaster Recovery Plan is implemented.\n\nThe security team should provide input into the Disaster Recovery Plan to ensure that security is maintained in the case of each threat identified in the Business Continuity risk assessment. \nIn particular:\n- The disaster recovery site should have the same standard of physical security controls as the primary datacentre;\n- Entities providing outsourced services should be included in the disaster recovery plan to ensure that they maintain security levels following major service failures or disasters."},"ISO 27002:2013 Sec. 17.1 ","5.3.8.1.1","5.3.8.1.1: Are the physical security controls at the disaster recovery site the same standard as those at the the primary datacentre?\n","1) Disaster recovery plan\n- Check the the physical security controls at the disaster recovery site are the same standard as those at the the primary datacentre.",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.8","5.3.8: Providers shall ensure continuity of information security.","5.3.8.1","SECURITY AND DISASTER RECOVERY\nIt is important that security is maintained in a crisis situation, especially one in which the Disaster Recovery Plan is implemented.\n\nThe security team should provide input into the Disaster Recovery Plan to ensure that security is maintained in the case of each threat identified in the Business Continuity risk assessment. \nIn particular:\n- The disaster recovery site should have the same standard of physical security controls as the primary datacentre;\n- Entities providing outsourced services should be included in the disaster recovery plan to ensure that they maintain security levels following major service failures or disasters.","ISO 27002:2013 Sec. 17.1 ","5.3.8.1.1","5.3.8.1.1","Are the physical security controls at the disaster recovery site the same standard as those at the the primary datacentre?","1) Disaster recovery plan\n- Check the the physical security controls at the disaster recovery site are the same standard as those at the the primary datacentre.",null,"Standard Required","Required","TechOps",null,null,"5","5.3","5.3.8","5.3.8: Les prestataires doivent assurer une sécurité continue des informations.","5.3.8.1","SÉCURITÉ ET REPRISE APRÈS SINISTRE\nIl est important que la sécurité soit préservée en situation de crise, notamment lorsque le plan de reprise après sinistre est activé.\n\nL’équipe chargée de la sécurité doit participer à l’élaboration du plan de reprise après sinistre afin de garantir le maintien de la sécurité pour chaque menace recensée dans l’évaluation des risques affectant la continuité de l’activité. \nEn particulier :\n- le site de reprise après sinistre doit appliquer les mêmes normes de contrôle de sécurité physique que le centre de données principal ;\n- les entités assurant des services de sous-traitance doivent être intégrées au plan de reprise après sinistre pour s’assurer qu’elles maintiennent les niveaux de sécurité attendus après tout sinistre ou toute défaillance majeure du service.","ISO 27002:2013 Sec. 17.1 ","5.3.8.1.1","Les normes régissant les contrôles de sécurité physique du site de reprise après sinistre sont-elles identiques à celles régissant les contrôles de sécurité physique du centre de données principal ?","1) Plan de reprise après sinistre\n- Vérifier que les normes régissant les contrôles de sécurité physique du site de reprise après sinistre sont identiques à celles régissant les contrôles de sécurité physique du centre de données principal.",null,"Requis Normal","Requis","TechOps",null,null,"5","5.3","5.3.8","5.3.8: Los proveedores deben garantizar la continuidad de la seguridad de la información.","5.3.8.1","SEGURIDAD Y RECUPERACIÓN ANTE DESASTRES\nEs importante que la seguridad se mantenga en una situación de crisis, especialmente cuando se implementa el Plan de Recuperación ante Desastres.\n\nEl equipo de seguridad debe brindar aportes al Plan de Recuperación ante Desastres para garantizar que se mantenga la seguridad ante cada amenaza identificada en la evaluación de riesgos de la Continuidad del Negocio. \nEn particular:\n- El sitio de recuperación ante desastres debe tener el mismo nivel de controles de seguridad física que el centro de datos primario;\n- Las entidades que prestan servicios tercerizados deben estar incluidas en el plan de recuperación ante desastres para garantizar que mantengan los mismos niveles de seguridad después de fallas importantes del servicio o desastres. ","ISO 27002:2013 Sec. 17.1 ","5.3.8.1.1","¿El nivel de los controles de seguridad física en el sitio de recuperación ante desastres es el mismo que en el centro de datos primario?","1) Plan de recuperación ante desastres\n- Verificar que el nivel de los controles de seguridad física en el sitio de recuperación ante desastres sea el mismo que en el centro de datos primario. ",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.3","5.3.8",null,"5.3.8.1",null,"ISO 27002:2013 Sec. 17.1 ","5.3.8.1.1",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,"MERGE","5.3.8.1.1","5.3.8.1.2",null,null,{"$error":"#REF!"},{"$error":"#REF!"},"","",{"$error":"#REF!"},{"$error":"#REF!"},"","",2,"",{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,2,""]
[null,"5","5.3","5.3.8","","5.3.8.1",null,0,"5.3.8.1.2","5.3.8.1.2: Are entities providing outsourced services included in the disaster recovery plan to ensure that they maintain security levels following major service failures or disasters?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.8","","5.3.8.1",null,null,"5.3.8.1.2","5.3.8.1.3","Are entities providing outsourced services included in the disaster recovery plan to ensure that they maintain security levels following major service failures or disasters?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.8","","5.3.8.1",0,0,"5.3.8.1.2","les entités assurant des services de sous-traitance sont-elles intégrées au plan de reprise après sinistre pour garantir qu’elles maintiennent les niveaux de sécurité attendus après tout sinistre ou défaillance majeure du service ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.8","","5.3.8.1",null,0,"5.3.8.1.2","¿Las entidades que prestan servicios tercerizados están incluidas en el plan de recuperación ante desastres para garantizar que mantengan los niveles de seguridad después de fallas  importantes del servicio o desastres?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.8",null,"5.3.8.1",null,0,"5.3.8.1.2",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.8.1.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.9","5.3.9: Providers shall develop a process to identify, address, and monitor security incidents and security-related complaints.","5.3.9.1","5.3.9.1: REPORTING SECURITY INCIDENTS\nSecurity incidents may be detected by system monitoring, but often they are reported by users. Processes to enable reporting of security incidents should be implemented.\n\nAll mobile money employees, agents, and third parties should be educated on reporting security incidents, including:\n- their contractual responsibility to report security events as quickly as possible;\n- the procedure for reporting information security events, including noting all details of the incident such as names, data and messages on the screen; and\n- deferring all action and communication to the security incident team.\n\nExamples of security events that could be reported include:\n- ineffective security control;\n- breach of information integrity, confidentiality or availability expectations;\n- non-compliance with regulation;\n- breach of logical or physical security arrangements; and\n- uncontrolled system changes.\n\nProviders should prepare security event reporting forms to help the person reporting to remember all necessary actions in case of an information security event.\n\nThere should be a channel for staff to anonymously report security incidents and violations of information security policies or procedures (i.e., 'whistle blowing').","ISO 27002: 2013 Sec. 16 ","5.3.9.1.1","5.3.9.1.1: Are employees, agents, and third parties aware of their responsibility to report information security events as quickly as possible?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.9","5.3.9: Providers shall develop a process to identify, address, and monitor security incidents and security-related complaints.","5.3.9.1","REPORTING SECURITY INCIDENTS\nSecurity incidents may be detected by system monitoring, but often they are reported by users. Processes to enable reporting of security incidents should be implemented.\n\nAll mobile money employees, agents, and third parties should be educated on reporting security incidents, including:\n- their contractual responsibility to report security events as quickly as possible;\n- the procedure for reporting information security events, including noting all details of the incident such as names, data and messages on the screen; and\n- deferring all action and communication to the security incident team.\n\nExamples of security events that could be reported include:\n- ineffective security control;\n- breach of information integrity, confidentiality or availability expectations;\n- non-compliance with regulation;\n- breach of logical or physical security arrangements; and\n- uncontrolled system changes.\n\nProviders should prepare security event reporting forms to help the person reporting to remember all necessary actions in case of an information security event.\n\nThere should be a channel for staff to anonymously report security incidents and violations of information security policies or procedures (i.e., 'whistle blowing').","ISO 27002: 2013 Sec. 16 ","5.3.9.1.1","5.3.9.1.1","Are employees, agents, and third parties aware of their responsibility to report information security events as quickly as possible?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.9","5.3.9: Les prestataires doivent mettre en place un processus de détection, de traitement et de surveillance des incidents de sécurité et des réclamations liées à la sécurité.","5.3.9.1","SIGNALEMENT DES INCIDENTS DE SÉCURITÉ\nLes incidents de sécurité peuvent être détectés par la surveillance du système, mais souvent, ils sont signalés par les utilisateurs. Des processus de signalement des incidents de sécurité doivent donc être mis en place. \nTous les employés, agents et prestataires du service d’argent mobile doivent être informés du mode de signalement des incidents de sécurité, et notamment de:\n- leur responsabilité contractuelle de signaler les incidents de sécurité dans les meilleurs délais ; \n- la procédure de signalement des événements affectant la sécurité des informations, avec notamment la consigne de noter tous les détails de l’incident tels que noms, données et messages à l’écran ; et\n- de déférer toutes les actions et communications à l’équipe chargée de gérer les incidents de sécurité.\n\nLes exemples d’incidents de sécurité à signaler comprennent : \n- les mesures de contrôle de sécurité inefficaces ;\n- les atteintes à l’intégrité, la confidentialité ou la disponibilité attendue des informations ; \n- les infractions réglementaires ; \n- les violations des dispositifs logiques ou physiques de sécurité ; \n- les modifications non contrôlées du système.\n\nLes prestataires doivent préparer des formulaires de signalement des incidents de sécurité pour aider les personnes concernées à se rappeler toutes les mesures à prendre dans l’éventualité d’un événement affectant la sécurité des informations.\n\nUn canal de déclaration anonyme des incidents de sécurité et des infractions aux politiques et procédures de sécurité de l’information doit être mis à la disposition du personnel. ","ISO 27002: 2013 Sec. 16 ","5.3.9.1.1","les employés, agents et prestataires du service d’argent mobile sont-ils informés de leur responsabilité de signaler les incidents de sécurité dans les meilleurs délais ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.9","5.3.9: Los proveedores deben desarrollar un proceso para identificar, abordar y monitorear los incidentes de seguridad y los reclamos relacionados con la seguridad.","5.3.9.1","INCIDENTES DE SEGURIDAD INFORMADOS\nSi bien los incidentes de seguridad pueden ser detectados por el monitoreo del sistema, generalmente, son informados por los usuarios. Se deben implementar procesos para permitir informar los incidentes de seguridad.\n\nTodos los empleados, agentes y terceros del dinero móvil deben ser capacitados sobre cómo informar incidentes de seguridad, incluyendo:\n- su responsabilidad contractual de informar eventos de seguridad tan pronto como sea posible;\n- el procedimiento para informar eventos de seguridad, incluyendo tomar nota de todos los detalles del incidente, tales como nombres, datos y mensajes en la pantalla; y\n- delegar todas las acciones y comunicaciones al equipo de incidentes de seguridad.\n\nLos ejemplos de eventos de seguridad que podrían ser informados incluyen:\n- control de seguridad ineficaz;\n- incumplimiento de las expectativas de integridad, confidencialidad o disponibilidad de la información;\n- incumplimiento de las regulaciones;\n- incumplimiento de los arreglos de seguridad lógica o física; y\n- cambios no controlados al sistema.\n\nLos proveedores deben preparar formularios de informe de eventos de seguridad para ayudar al informante a recordar todas las acciones necesarias en caso de un evento de seguridad de la información.\n\nDebe existir un canal para que el personal pueda informar, de manera anónima, incidentes de seguridad y violaciones a las políticas y procedimientos de seguridad de la información (es decir, 'denuncia de irregularidades').","ISO 27002: 2013 Sec. 16 ","5.3.9.1.1","¿Los empleados, agentes y terceros conocen su responsabilidad de informar eventos de seguridad de la información tan rápido como sea posible?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.9",null,"5.3.9.1",null,"ISO 27002: 2013 Sec. 16 ","5.3.9.1.1",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.9.1.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.9",0,"5.3.9.1",null,0,"5.3.9.1.2","5.3.9.1.2: Have employees, agents, and third parties been educated in the procedure for reporting security incidents, including (1) noting all details of the incident such as names, data and messages on the screen; (2) deferring all action and communication to the security incident team?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.9",null,"5.3.9.1",null,null,"5.3.9.1.2","5.3.9.1.2","Have employees, agents, and third parties been educated in the procedure for reporting security incidents, including (1) noting all details of the incident such as names, data and messages on the screen; (2) deferring all action and communication to the security incident team?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.9",0,"5.3.9.1",0,0,"5.3.9.1.2","les employés, agents et prestataires de l’argent mobile sont-ils informés de la procédure de signalement des événements affectant la sécurité des informations, avec notamment la consigne de (1) noter tous les détails de l’incident tels que noms, données et messages à l’écran et (2) déférer toutes les actions et communications à l’équipe chargée de gérer les incidents de sécurité ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.9",null,"5.3.9.1",null,0,"5.3.9.1.2","¿Los empleados, agentes y terceros fueron capacitados en relación con el procedimiento para informar incidentes de seguridad, incluyendo (1) tomar nota de todos los detalles del incidente, tales como nombres, datos y mensajes en la pantalla; (2) delegar todas las acciones y comunicaciones al equipo de incidentes de seguridad?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.9",null,"5.3.9.1",null,0,"5.3.9.1.2",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.9.1.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.9","","5.3.9.1",null,0,"5.3.9.1.3","5.3.9.1.3: Are employees, agents, and third parties provided with an anonymous reporting channel to report security incidents or violations of security policies or procedures (i.e. 'whistle blowing')?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.9","","5.3.9.1",null,null,"5.3.9.1.3","5.3.9.1.3","Are employees, agents, and third parties provided with an anonymous reporting channel to report security incidents or violations of security policies or procedures (i.e. 'whistle blowing')?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.9","","5.3.9.1",0,0,"5.3.9.1.3","un canal de déclaration anonyme des incidents de sécurité ou des infractions aux politiques et procédures de sécurité est-il mis à la disposition du personnel ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.9","","5.3.9.1",null,0,"5.3.9.1.3","¿Se brinda a los empleados, agentes y terceros un canal para informar de manera anónima los incidentes de seguridad o las violaciones a las políticas o procedimientos de seguridad (es decir, 'denuncia de irregularidades')?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.9",null,"5.3.9.1",null,0,"5.3.9.1.3",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.9.1.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.9","5.3.9: Providers shall develop a process to identify, address, and monitor security incidents and security-related complaints.","5.3.9.2","5.3.9.2: RESPONSE TO SECURITY INCIDENTS\nProviders should implement a documented procedure for responding to major security incidents. The response should include the following:\n- collecting evidence as soon as possible after the occurrence;\n- conducting information security forensics analysis;\n- escalation of the incident, as required;\n- ensuring that all response activities are logged;\n- communicating the information security incident to internal and external people or organizations with a need to know;\n- recovering systems and data that may have been damaged by the incident;\n- addressing information security weaknesses found to cause or contribute to the incident; \n- once the incident has been successfully addressed, formally closing and recording it.\n\nIn the event of a major security incident, a nominated point of contact in the provider should report information security incidents as quickly as possible, through appropriate management channels, to relevant authorities. The security incident procedure should specify which security incidents should be reported (e.g. if intrusion has been detected, systemic risks have been created, and/or it is suspected that laws may have been broken) and how to report them promptly.","ISO 27002: 2013 \nSec. 16\nSec. 6.1","5.3.9.2.1","5.3.9.2.1: Is there a documented procedure for managing and responding to security incidents (including escalation when required) and fixing the root cause?\n","1) Security incident response plan \n- Check that there is process for managing and responding to security incidents and fixing the root cause.\n- Check that the process is documented.\n- Check that the process includes escalation steps, including when and incident should be escalated and to whom.",0,"Standard Required","Required","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.9","5.3.9: Providers shall develop a process to identify, address, and monitor security incidents and security-related complaints.","5.3.9.2","RESPONSE TO SECURITY INCIDENTS\nProviders should implement a documented procedure for responding to major security incidents. The response should include the following:\n- collecting evidence as soon as possible after the occurrence;\n- conducting information security forensics analysis;\n- escalation of the incident, as required;\n- ensuring that all response activities are logged;\n- communicating the information security incident to internal and external people or organizations with a need to know;\n- recovering systems and data that may have been damaged by the incident;\n- addressing information security weaknesses found to cause or contribute to the incident; \n- once the incident has been successfully addressed, formally closing and recording it.\n\nIn the event of a major security incident, a nominated point of contact in the provider should report information security incidents as quickly as possible, through appropriate management channels, to relevant authorities. The security incident procedure should specify which security incidents should be reported (e.g. if intrusion has been detected, systemic risks have been created, and/or it is suspected that laws may have been broken) and how to report them promptly.","ISO 27002: 2013 \nSec. 16\nSec. 6.1","5.3.9.2.1","5.3.9.2.1","Is there a documented procedure for managing and responding to security incidents (including escalation when required) and fixing the root cause?","1) Security incident response plan \n- Check that there is process for managing and responding to security incidents and fixing the root cause.\n- Check that the process is documented.\n- Check that the process includes escalation steps, including when and incident should be escalated and to whom.",null,"Standard Required","Required","TechOps",null,null,"5","5.3","5.3.9","5.3.9: Les prestataires doivent mettre en place un processus de détection, de traitement et de surveillance des incidents de sécurité et des réclamations liées à la sécurité.","5.3.9.2","RÉPONSE EN CAS D’INCIDENT DE SÉCURITÉ\nLes prestataires doivent se doter d’une procédure documentée de réponse aux incidents de sécurité majeurs couvrant les aspects suivants :\n- collecte des éléments de preuve aussi rapidement que possible après l’incident ;\n- analyse des circonstances de l'incident ;\n- remontée de l’incident si nécessaire ;\n- enregistrement de l’ensemble des activités de réponse ;\n- communication de l’incident aux personnes physiques et morales (internes et externes) qui doivent en être informées ;\n- récupération des systèmes et données susceptibles d’avoir été endommagés par l’incident ;\n- correction des failles de sécurité jugées responsables de l’incident ou y ayant contribué ; \n- après résolution, clôture formelle et enregistrement de l’incident.\n\nDans le cas d’un incident de sécurité majeur, un point de contact doit être désigné chez le prestataire pour transmettre les incidents affectant la sécurité de l’information aussi rapidement que possible aux autorités compétentes par la voie hiérarchique appropriée. La procédure de réponse aux incidents de sécurité doit spécifier quels incidents doivent être signalés (par ex. si une intrusion a été détectée, des risques sismiques se sont présentés, et/ou si des lois ont pu être enfreintes) et les façons appropriées de les signaler. ","ISO 27002: 2013 \nSec. 16\nSec. 6.1","5.3.9.2.1","existe-t-il une procédure documentée de réponse aux incidents de sécurité (avec remontée des incidents si nécessaire) qui permet d’en résoudre les causes sous-jacentes ?","1) Plan de réponse en cas d’incident de sécurité\n- Vérifier qu’un processus a été mis en place pour gérer les incidents de sécurité, y répondre et corriger leur cause profonde.\n- Vérifier que le processus est documenté.\n- Vérifier que le processus inclut les étapes à suivre pour remonter l’incident, et indique quand et à qui remonter l’incident.",null,"Requis Normal","Requis","TechOps",null,null,"5","5.3","5.3.9","5.3.9: Los proveedores deben desarrollar un proceso para identificar, abordar y monitorear los incidentes de seguridad y los reclamos relacionados con la seguridad.","5.3.9.2","RESPUESTA ANTE INCIDENTES DE SEGURIDAD \nLos proveedores deben implementar un procedimiento documentado para responder ante incidentes de seguridad importantes. La respuesta debe incluir lo siguiente:\n- recolectar evidencia tan pronto como sea posible después de la ocurrencia;\n- realizar un análisis pericial de la seguridad de la información;\n- escalar el incidente, según sea requerido;\n- garantizar el registro de todas las actividades de respuesta;\n- comunicar el incidente de seguridad al personal interno y externo o a las organizaciones, según sea necesario;\n- recuperar sistemas y datos que podrían haberse dañado con el incidente;\n- abordar las debilidades de seguridad de información que causaron o contribuyeron al incidente; \n- una vez que el incidente haya sido abordado con éxito, cerrarlo y registrarlo formalmente.\n\nEn caso de un incidente de seguridad importante, un punto de contacto designado del proveedor debe informar los incidentes de seguridad de la información a las autoridades correspondientes tan pronto como sea posible, mediante los canales de gestión adecuados. El procedimiento de incidentes de seguridad debe especificar qué incidentes de seguridad se deben informar (por ej., si se detectó una intrusión, si se crearon riesgos sistémicos, y/o si existe la sospecha de que se podrían haber violado las leyes) y cómo informarlos de  inmediato.","ISO 27002: 2013 \nSec. 16\nSec. 6.1","5.3.9.2.1","¿Existe un procedimiento documentado para gestionar y responder ante incidentes de seguridad (incluyendo escalarlo cuando sea requerido) y corregir la causa raíz?","1) Plan de respuesta ante incidentes de seguridad\n- Verificar que exista un proceso para gestionar y responder ante los incidentes de seguridad y para corregir la causa raíz.\n- Verificar que el proceso esté documentado.\n- Verificar que el proceso incluya pasos de escalamiento, que incluya cuándo un incidente debe ser escalado y a quién.",null,"Obligatorio estándar","Obligatorio","TechOps",null,null,"5","5.3","5.3.9",null,"5.3.9.2",null,"ISO 27002: 2013 \nSec. 16\nSec. 6.1","5.3.9.2.1",null,null,null,"ReqS4","Req4","TechOps",null,null,null,null,null,null,null,"MERGE","5.3.9.2.1","5.3.9.2.5",null,null,{"$error":"#REF!"},{"$error":"#REF!"},"","",{"$error":"#REF!"},{"$error":"#REF!"},"","",2,"",{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,2,""]
[null,"5","5.3","5.3.9","","5.3.9.2",null,0,"5.3.9.2.2","5.3.9.2.2: Does the response to security incidents require collecting evidence as soon as possible after the occurrence and conducting information security forensics analysis?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.9","","5.3.9.2",null,null,"5.3.9.2.2","5.3.9.2.2","Does the response to security incidents require collecting evidence as soon as possible after the occurrence and conducting information security forensics analysis?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.9",0,"5.3.9.2",null,0,"5.3.9.2.2","la réponse aux incidents de sécurité prévoit-elle de collecter les éléments de preuve aussi rapidement que possible après l’incident et d'effectuer une analyse des circonstances de l'incident ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.9",null,"5.3.9.2",null,0,"5.3.9.2.2","¿La respuesta ante incidentes de seguridad requiere la recolección de evidencia tan pronto como sea posible después de la ocurrencia y la realización de un análisis pericial de la seguridad de la información?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.9",null,"5.3.9.2",null,0,"5.3.9.2.2",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.9.2.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.9","","5.3.9.2",null,0,"5.3.9.2.3","5.3.9.2.3: Are all activities in response to a security incident properly logged?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.9","","5.3.9.2",null,null,"5.3.9.2.3","5.3.9.2.3","Are all activities in response to a security incident properly logged?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.9","","5.3.9.2",null,0,"5.3.9.2.3","les activités effectuées en réponse à un incident de sécurité sont-elles correctement enregistrées ?",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.9","","5.3.9.2",null,0,"5.3.9.2.3","¿Se registran correctamente todas las actividades de respuesta ante un incidente de seguridad?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.9",null,"5.3.9.2",null,0,"5.3.9.2.3",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.9.2.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.3","5.3.9","","5.3.9.2",null,0,"5.3.9.2.4","5.3.9.2.4: Does the security and fraud incident procedure include a communications plan that addresses internal and external communications?\n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.3","5.3.9","","5.3.9.2",null,null,"5.3.9.2.4","5.3.9.2.4","Does the security and fraud incident procedure include a communications plan that addresses internal and external communications?",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.3","5.3.9","","5.3.9.2",null,0,"5.3.9.2.4","les procédures de réponse aux incidents de sécurité prévoient-elles un plan de communication couvrant les communications internes et externes. ",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.3","5.3.9","","5.3.9.2",null,0,"5.3.9.2.4","¿El procedimiento de incidentes de seguridad incluye un plan de comunicaciones para abordar las comunicaciones internas y externas?",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.3","5.3.9",null,"5.3.9.2",null,0,"5.3.9.2.4",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.3.9.2.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"5","5.1","5.1.1","","5.1.1.3",null,0,"5.3.9.2.5","5.3.9.2.5: Does the information security policy specify which security incidents should be reported to the relevant authorities and how to report them promptly?\n(e.g. if intrusion has been detected, systemic risks have been created, and/or it is suspected that laws may have been broken) \n",0,0,"Recommended","Recommended","TechOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5","5.1","5.1.1","","5.1.1.3",null,null,"5.3.9.2.5","5.1.1.3.2","Does the information security policy specify which security incidents should be reported to the relevant authorities and how to report them promptly?\n(e.g. if intrusion has been detected, systemic risks have been created, and/or it is suspected that laws may have been broken) ",null,null,"Recommended","Recommended","TechOps",null,null,"5","5.1","5.1.1","","5.1.1.3",null,0,"5.3.9.2.5","la politique de sécurité du service d’argent mobile spécifie-t-elle les incidents devant être déclarés aux autorités compétentes et la manière de les déclarer dans les meilleurs délais ? (ex. détection d’une intrusion, création de risques systémiques et/ou suspicion d’infractions à la loi) ",null,null,"Recommandé","Recommandé","TechOps",null,null,"5","5.1","5.1.1","","5.1.1.3",null,0,"5.3.9.2.5","¿La política de seguridad de la información especifica qué incidentes de seguridad se deben informar a las autoridades correspondientes y cómo informarlas de inmediato?\n(por ej., si se detectó una intrusión, si se crearon riesgos sistémicos, y/o si existe la sospecha de que se podrían haber violado las leyes) ",null,null,"Recomendado","Recomendado","TechOps",null,null,"5","5.1","5.1.1",null,"5.1.1.3",null,0,"5.3.9.2.5",null,null,null,"Rec4","Rec4","TechOps",null,null,null,null,null,null,null,null,"5.1.1.3.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP5","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,null,null,null,null,".",".",".",".","."]

{"sheet":"6","index":7,"n_rows":42,"n_cols":144,"rows_kept":42,"cut":false,"hidden":false,"merged":[[18,7,19,7],[23,6,29,6],[23,7,29,7],[4,4,7,4],[4,6,7,6],[4,7,7,7],[10,6,13,6],[10,7,13,7],[15,6,17,6],[18,6,19,6],[38,6,39,6],[38,7,39,7],[34,7,35,7],[36,6,37,6],[30,6,31,6],[30,7,31,7],[32,6,33,6],[32,7,33,7],[34,6,35,6],[23,50,29,50],[23,52,29,52],[23,53,29,53],[30,52,31,52],[30,53,31,53],[10,52,13,52],[10,53,13,53],[15,52,17,52],[4,50,7,50],[4,52,7,52],[4,53,7,53],[18,52,19,52],[18,53,19,53],[38,52,39,52],[38,53,39,53],[32,52,33,52],[32,53,33,53],[34,53,35,53],[34,52,35,52],[23,67,29,67],[23,69,29,69],[36,69,37,69],[38,69,39,69],[10,69,13,69],[10,70,13,70],[15,69,17,69],[4,67,7,67],[4,69,7,69],[4,70,7,70],[18,69,19,69],[18,70,19,70],[36,52,37,52],[38,70,39,70],[32,69,33,69],[32,70,33,70],[34,70,35,70],[34,69,35,69],[23,83,29,83],[23,85,29,85],[23,86,29,86],[30,85,31,85],[30,86,31,86],[38,85,39,85],[38,86,39,86],[23,70,29,70],[30,69,31,69],[30,70,31,70],[10,85,13,85],[10,86,13,86],[15,85,17,85],[4,83,7,83],[4,85,7,85],[4,86,7,86],[18,85,19,85],[18,86,19,86],[36,85,37,85],[32,85,33,85],[32,86,33,86],[34,86,35,86],[34,85,35,85],[3,88,3,90],[36,101,37,101],[38,101,39,101],[38,102,39,102],[30,101,31,101],[30,102,31,102],[32,101,33,101],[32,102,33,102],[34,102,35,102],[34,101,35,101],[15,101,17,101],[18,100,19,100],[18,101,19,101],[18,102,19,102],[23,99,29,99],[23,101,29,101],[23,102,29,102],[4,99,7,99],[4,101,7,101],[4,102,7,102],[10,101,13,101],[10,102,13,102]]}
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,"x",null,null,null,null,"x",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"x"]
[null,null,null,null,null,null,{"$f":"UPPER(Introduction!B28)","v":"6. TRANSPARENCY:  COMMUNICATE FEES, T&CS AND INFORMATION TRANSPARENTLY TO CUSTOMERS"},null,null,null,null,null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,Drivers!K18,Drivers!L18,Drivers!M18,Drivers!N18)","v":"SELF-ASSESSMENT"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,Drivers!K34,Drivers!L34,Drivers!M34,Drivers!N34)","v":"EXTERNAL ASSESSMENT"},null,null,null,null,null,"SCHEME OPERATOR REVIEW",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,16,null,17,null,null,3,null,null,4,5,null,9,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Change types: NEW, MERGE, MOVE, SWAP","Don't edit the Indicator ID",null,null,null,"*** Don't edit any cell from AB and onwards *** Ignore #NAME errors; these will disappear during migration",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Counts for computed Compliance calc"]
[null,{"$f":"CHOOSE(LanguageNumber,AV3,BM3,CC3,CS3)","v":"Principle"},"Sub-principle","Sub-sub-principle","Sub-sub-principle ","Practice ID","Practice","Practice data source","Indicator ID",{"$f":"CHOOSE(LanguageNumber,BE3,BU3,CK3,DA3)","v":"Indicator"},"Evidence required","[SPARE]","Detailed indicator category","Indicator category","Function","[SPARE]",{"$f":"CHOOSE(LanguageNumber,Drivers!K19,Drivers!L19,Drivers!M19,Drivers!N19)","v":"Compliance"},{"$f":"CHOOSE(LanguageNumber,Drivers!K20,Drivers!L20,Drivers!M20,Drivers!N20)","v":"Evidence document (specify document name, section number and page number)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K21,Drivers!L21,Drivers!M21,Drivers!N21)","v":"Comments \n(include notes on how the practice is implemented)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K22,Drivers!L22,Drivers!M22,Drivers!N22)","v":"Action"},{"$f":"CHOOSE(LanguageNumber,Drivers!K23,Drivers!L23,Drivers!M23,Drivers!N23)","v":"Reviewer name"},{"$f":"CHOOSE(LanguageNumber,Drivers!K24,Drivers!L24,Drivers!M24,Drivers!N24)","v":"Evidence sent to Assessor?"},{"$f":"CHOOSE(LanguageNumber,Drivers!K25,Drivers!L25,Drivers!M25,Drivers!N25)","v":"Spare 2"},{"$f":"CHOOSE(LanguageNumber,Drivers!K26,Drivers!L26,Drivers!M26,Drivers!N26)","v":"Spare 3"},{"$f":"CHOOSE(LanguageNumber,Drivers!K27,Drivers!L27,Drivers!M27,Drivers!N27)","v":"Spare 4"},{"$f":"CHOOSE(LanguageNumber,Drivers!K28,Drivers!L28,Drivers!M28,Drivers!N28)","v":"Spare 5"},{"$f":"CHOOSE(LanguageNumber,Drivers!K29,Drivers!L29,Drivers!M29,Drivers!N29)","v":"Spare 6"},{"$f":"CHOOSE(LanguageNumber,Drivers!K30,Drivers!L30,Drivers!M30,Drivers!N30)","v":"Spare 7"},{"$f":"CHOOSE(LanguageNumber,Drivers!K31,Drivers!L31,Drivers!M31,Drivers!N31)","v":"Spare 8"},{"$f":"CHOOSE(LanguageNumber,Drivers!K32,Drivers!L32,Drivers!M32,Drivers!N32)","v":"Spare 9"},{"$f":"CHOOSE(LanguageNumber,Drivers!K33,Drivers!L33,Drivers!M33,Drivers!N33)","v":"Spare 10"},{"$f":"CHOOSE(LanguageNumber,Drivers!K35,Drivers!L35,Drivers!M35,Drivers!N35)","v":"Compliance"},{"$f":"CHOOSE(LanguageNumber,Drivers!K36,Drivers!L36,Drivers!M36,Drivers!N36)","v":"Evidence document (specify document name, section number and page number)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K37,Drivers!L37,Drivers!M37,Drivers!N37)","v":"Comments \n(include notes on how the practice is implemented)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K38,Drivers!L38,Drivers!M38,Drivers!N38)","v":"Recommendation to Provider"},{"$f":"CHOOSE(LanguageNumber,Drivers!K39,Drivers!L39,Drivers!M39,Drivers!N39)","v":"Reviewer name"},{"$f":"CHOOSE(LanguageNumber,Drivers!K40,Drivers!L40,Drivers!M40,Drivers!N40)","v":"Guidance notes for Assessor"},{"$f":"CHOOSE(LanguageNumber,Drivers!K41,Drivers!L41,Drivers!M41,Drivers!N41)","v":"Scheme Operator comments"},{"$f":"CHOOSE(LanguageNumber,Drivers!K42,Drivers!L42,Drivers!M42,Drivers!N42)","v":"Assessor's response to Scheme Operator"},{"$f":"CHOOSE(LanguageNumber,Drivers!K43,Drivers!L43,Drivers!M43,Drivers!N43)","v":"Scheme Operator conclusion"},{"$f":"CHOOSE(LanguageNumber,Drivers!K44,Drivers!L44,Drivers!M44,Drivers!N44)","v":"Spare 15"},{"$f":"CHOOSE(LanguageNumber,Drivers!K45,Drivers!L45,Drivers!M45,Drivers!N45)","v":"Spare 16"},{"$f":"CHOOSE(LanguageNumber,Drivers!K46,Drivers!L46,Drivers!M46,Drivers!N46)","v":"Spare 17"},{"$f":"CHOOSE(LanguageNumber,Drivers!K47,Drivers!L47,Drivers!M47,Drivers!N47)","v":"Spare 18"},{"$f":"CHOOSE(LanguageNumber,Drivers!K48,Drivers!L48,Drivers!M48,Drivers!N48)","v":"Spare 19"},{"$f":"CHOOSE(LanguageNumber,Drivers!K49,Drivers!L49,Drivers!M49,Drivers!N49)","v":"Spare 20"},null,"Principle","Sub-principle","Sub-sub-principle","Sub-sub-principle ","Practice ID","Practice","Practice data source","Indicator ID","ORIGINAL ID","Indicator","Evidence required","[SPARE]","Detailed indicator category","Indicator category","Function","[SPARE]",null,"Principe","Sous-principe","Sous-sous-principe","Description du sous-sous-principe","Pratique ID","Pratique","Source de données pratique","Indicateur ID","Indicateur","Documents généralement requis","[SPARE]","Catégorie détaillée d’indicateur","Catégorie d’indicateur","Fonction","[SPARE]",null,"Principio","Sub-principio","Sub-sub-principio","Sub-sub-principio","Nro. de Práctica","Práctica","Origen de datos de Práctica","Nro. de Indicador","Indicador","Documentación obligatoria","[SPARE]","Categoría indicador detallada","Categoría de Indicador","Función","[SPARE]",null,"Principle","Sub-principle","Sub-sub-principle","Sub-sub-principle Description","Practice ID","Practice","Practice data source","Indicator","Indicator","Evidence required","[SPARE]","Detailed indicator category","Indicator category","Function","[SPARE]",null,null,null,null,null,null,"Change type","Original Indicator ID","Merged indicator #1","Merged indicator #2","Merged indicator #3","v1 Compliance rating Original Indicator ID","v1 Compliance rating Merged indicator #1","v1 Compliance rating Merged indicator #2","v1 Compliance rating Merged indicator #3","v1 Comment Original Indicator ID","v1 Comment Merged indicator #1  ","v1 Comment Merged indicator #2","v1 Comment Merged indicator #3","v2 Computed change type","v2 Computed compliance rating","v2 Computed comment","rangename1","rangename2","rangename3","rangename4","Yes","No","N/A","Partial","No Response","how many","calc"]
[null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!C28,\": \",Introduction!D28))","v":"6.1: EFFECTIVE DISCLOSURE AND TRANSPARENCY"},null,null,null,null,{"$f":"Introduction!E28","v":"Providers shall ensure that users are provided with clear, prominent, and timely information regarding fees and terms and conditions"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$28,\": \",Introduction!$L$28))","v":"6.1: EFFECTIVE DISCLOSURE AND TRANSPARENCY"},null,null,null,null,null,{"$f":"Introduction!$M$28","v":"Providers shall ensure that users are provided with clear, prominent, and timely information regarding fees and terms and conditions"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!$U$28,\": \",Introduction!$V$28))","v":"6.1: DIVULGACIÓN Y TRANSPARENCIA EFICACES"},null,null,0,null,{"$f":"Introduction!W28","v":"El proveedor garantizará la provisión de información clara, visible y oportuna sobre tarifas y términos y condiciones a los clientes"},null,null,null,null,null,null,null,null,null,null,null,0,null,0]
[null,{"$f":"$AV5","v":"6"},{"$f":"$AW5","v":"6.1"},{"$f":"AX5","v":"6.1.1"},{"$f":"CHOOSE(LanguageNumber,AY5,BP5,CF5,CV5)","v":"6.1.1: Providers shall ensure that customers are provided with clear, prominent, and timely information regarding fees and terms and conditions."},{"$f":"AZ5","v":"6.1.1.1"},{"$f":"AZ5&\": \"&CHOOSE(LanguageNumber,BA5,BR5,CH5,CX5)","v":"6.1.1.1: INFORM CUSTOMERS OF ALL FEES AND TERMS & CONDITIONS \nFees: Customers should be informed of all applicable fees, including transaction-based fees, non-transaction-based fees and exceptional fees In-scope services may include the following, depending on the provider.\n1. Transaction-based fees (The fee schedule should make clear the factors that determine the rates, such as transaction size):\n   • Transfers on-net (to registered and unregistered users)\n   • Transfers off-net (e.g. to interoperability partners & banks)\n   • Transfers internationally (IMT)\n   • Deposits/withdrawals at agent or ATM\n   • Bill payments (as payment channel only)\n   • Merchant payments (as payment channel only)\n2. Non-transaction-based fees:\n   • Balance enquiry or mini statement\n   • Recurring charges \n   • PIN change\n   • Loan / savings / insurance offered as part of mobile money\n3. Fees for exceptional events:\n   • Penalty fees (e.g. for non-repayment of loan)\n   • Additional SMS charges for service use while roaming\n\nT&Cs: Customers should be provided with the T&Cs in an accessible manner (e.g. physical copy, or summary on posters) before they start using mobile money services. Good practice is to make a summary of key points from the T&Cs available on posters or handouts.\n\nGood practice is to make key information available to customers via handset menus. This should ideally include fees, key points from T&Cs, FAQs, how to use the service, and how to contact customer support."},{"$f":"BB5","v":0},{"$f":"BC5","v":"6.1.1.1.1"},{"$f":"BC5&\": \"&CHOOSE(LanguageNumber,BE5,BU5,CK5,DA5)&CarriageReturn","v":"6.1.1.1.1: Are customers informed of complete fee schedules before using the service, including transaction-based, non-transaction-based and exceptional fees (e.g. at agents, on leaflets, posters etc.)?\n"},{"$f":"CHOOSE(LanguageNumber,BF5,BV5,CL5,DB5)","v":"1) Point of sale (agent) material or publicity material or handset interface or other mechanism for informing customers of fees (different services could have different mechanisms)\n- Check that customers are informed of all fees before using the service, including the following examples, where applicable:\n1. Transaction-based fees:\n   • Transfers on-net (to registered and unregistered users)\n   • Transfers off-net (e.g. to interoperability partners & banks)\n   • Transfers internationally (IMT)\n   • Deposits/withdrawals at agent or ATM\n   • Bill payments (as payment channel only)\n   • Merchant payments (as payment channel only)\n2. Non-transaction-based fees:\n   • Balance enquiry or mini statement\n   • Recurring charges \n   • PIN change\n   • Loan / savings / insurance offered as part of mobile money\n3. Fees for exceptional events:\n   • Penalty fees (e.g. for non-repayment of loan)\n   • Additional SMS charges for service use while roaming\n\nNote: in-scope services are defined in the Definitions - see \"Mobile Money Services in scope of MMC\"\nNote: fees could be viewed by customer as part of acceptance process when signing up to the service."},0,{"$f":"CHOOSE(LanguageNumber,BH5,BX5,CN5,DD5)","v":"Urgent Required"},"Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.1","6.1.1","6.1.1: Providers shall ensure that customers are provided with clear, prominent, and timely information regarding fees and terms and conditions.","6.1.1.1","INFORM CUSTOMERS OF ALL FEES AND TERMS & CONDITIONS \nFees: Customers should be informed of all applicable fees, including transaction-based fees, non-transaction-based fees and exceptional fees In-scope services may include the following, depending on the provider.\n1. Transaction-based fees (The fee schedule should make clear the factors that determine the rates, such as transaction size):\n   • Transfers on-net (to registered and unregistered users)\n   • Transfers off-net (e.g. to interoperability partners & banks)\n   • Transfers internationally (IMT)\n   • Deposits/withdrawals at agent or ATM\n   • Bill payments (as payment channel only)\n   • Merchant payments (as payment channel only)\n2. Non-transaction-based fees:\n   • Balance enquiry or mini statement\n   • Recurring charges \n   • PIN change\n   • Loan / savings / insurance offered as part of mobile money\n3. Fees for exceptional events:\n   • Penalty fees (e.g. for non-repayment of loan)\n   • Additional SMS charges for service use while roaming\n\nT&Cs: Customers should be provided with the T&Cs in an accessible manner (e.g. physical copy, or summary on posters) before they start using mobile money services. Good practice is to make a summary of key points from the T&Cs available on posters or handouts.\n\nGood practice is to make key information available to customers via handset menus. This should ideally include fees, key points from T&Cs, FAQs, how to use the service, and how to contact customer support.",null,"6.1.1.1.1",{"$f":"DO5","v":"6.1.1.1.1"},"Are customers informed of complete fee schedules before using the service, including transaction-based, non-transaction-based and exceptional fees (e.g. at agents, on leaflets, posters etc.)?","1) Point of sale (agent) material or publicity material or handset interface or other mechanism for informing customers of fees (different services could have different mechanisms)\n- Check that customers are informed of all fees before using the service, including the following examples, where applicable:\n1. Transaction-based fees:\n   • Transfers on-net (to registered and unregistered users)\n   • Transfers off-net (e.g. to interoperability partners & banks)\n   • Transfers internationally (IMT)\n   • Deposits/withdrawals at agent or ATM\n   • Bill payments (as payment channel only)\n   • Merchant payments (as payment channel only)\n2. Non-transaction-based fees:\n   • Balance enquiry or mini statement\n   • Recurring charges \n   • PIN change\n   • Loan / savings / insurance offered as part of mobile money\n3. Fees for exceptional events:\n   • Penalty fees (e.g. for non-repayment of loan)\n   • Additional SMS charges for service use while roaming\n\nNote: in-scope services are defined in the Definitions - see \"Mobile Money Services in scope of MMC\"\nNote: fees could be viewed by customer as part of acceptance process when signing up to the service.",null,"Urgent Required","Required",{"$f":"$O5","v":"BizOps"},null,null,{"$f":"$AV5","v":"6"},{"$f":"$AW5","v":"6.1"},{"$f":"$AX5","v":"6.1.1"},"6.1.1: Les prestataires doivent s’assurer que des informations claires, visibles et opportunes soient fournies aux clients concernant la tarification et les conditions générales du service.",{"$f":"$AZ5","v":"6.1.1.1"},"TRANSMISSION AUX CLIENTS DE L'ENSEMBLE DES FRAIS ET DES CONDITIONS GÉNÉRALES\nFrais : Les clients doivent être informés de tous les frais applicables, notamment les frais liés aux transactions, les frais non liés aux transactions et les frais exceptionnels. Les services entrant dans le champ d'application peuvent inclure les éléments suivants, selon le prestataire :\n1. Frais liés aux transactions (le barème tarifaire doit clairement indiquer les facteurs servant de base au calcul des taux, par exemple le volume de la transaction) :\n   • Transferts sur réseau (aux utilisateurs enregistrés et non enregistrés)\n   • Transferts hors réseau (par ex. aux partenaires d'interopérabilité et aux banques)\n   • Transferts internationaux (IMT)\n   • Dépôts/retraits auprès d'un agent ou par le biais d'un GAB\n   • Paiement de factures (comme canal de paiement uniquement)\n   • Paiement de commerçants (comme canal de paiement uniquement)\n2. Frais non liés aux transactions :\n   • Consultation du compte du solde ou mini relevé de compte\n   • Frais récurrents\n   • Changement de code confidentiel\n   • Service de prêt/d'épargne/d'assurance offert dans le cadre du service d'argent mobile\n3. Frais appliqués pour des événements exceptionnels :\n  • Pénalités (par ex. non remboursement du prêt)\n  • Frais supplémentaires pour l'envoi de SMS dans le cadre de l'utilisation du service en itinérance.\n\nConditions générales : Les conditions générales doivent être transmises aux clients dans un format accessible (par ex. copie sur un support concret, ou vue d'ensemble sur des affiches) préalablement à l'utilisation des services d'argent mobile. Une bonne pratique consiste à résumer les points clés des conditions générales sur des affiches ou des brochures.\n\nUne bonne pratique consiste à mettre les informations clés à disposition des clients par le biais de menus téléphoniques comprenant les barèmes tarifaires, les points clés des conditions générales, les questions/réponses les plus fréquentes, le mode d’emploi du service et les modes de contact du service client.",{"$f":"BB5","v":0},"6.1.1.1.1","les barèmes tarifaires complets sont-ils mis à la disposition des clients préalablement à l'utilisation du service, y compris les frais liés aux transactions, les frais non liés aux transactions et les frais exceptionnels (par ex. chez les agents, sur des brochures, des affiches, etc.) ?","1) Supports de point de vente (agent) ou support publicitaire ou interface sur l'appareil mobile ou autre mécanisme permettant d'informer les clients des frais appliqués (différents services peuvent employer différents mécanismes)\n- Vérifier que les clients sont informés de tous les frais applicables préalablement à l'utilisation du service, y compris les frais applicables aux opérations suivantes, le cas échéant :\n1. Frais liés aux transactions :\n   • Transferts sur réseau (aux utilisateurs enregistrés  et non enregistrés)\n   • Transferts hors réseau (par ex. aux partenaires d'interopérabilité et aux banques)\n   • Transferts internationaux (IMT)\n   • Dépôts/retraits auprès d'un agent ou par le biais d'un GAB\n   • Paiement de factures (en tant que canal de paiement uniquement)\n   • Paiement de commerçants (en tant que canal de paiement uniquement)\n2. Frais non liés aux transactions :\n  • Consultation du compte du solde ou mini relevé de compte\n   • Frais récurrents\n   • Changement de code confidentiel\n   • Service de prêt/d'épargne/d'assurance offert dans le cadre du service d'argent mobile\n3. Frais appliqués pour des événements exceptionnels :\n  • Pénalités (par ex. non remboursement du prêt)\n  • Frais supplémentaires pour l'envoi de SMS dans le cadre de l'utilisation du service en itinérance\nRemarque : les services entrant dans le champ d'application sont définis dans l'onglet Définitions - voir \"Services de l'argent mobile entrant dans le champ d'application de la MMC\"\nRemarque : les frais peuvent être transmis au client dans le cadre du processus de validation, lors de la souscription du service.",null,{"$f":"VLOOKUP($BH5,CategoryTranslationTable,2,FALSE)","v":"Requis Prioritaire"},{"$f":"VLOOKUP($BI5,CategoryTranslationTable,2,FALSE)","v":"Requis"},{"$f":"$O5","v":"BizOps"},0,null,{"$f":"$AV5","v":"6"},{"$f":"$AW5","v":"6.1"},{"$f":"$AX5","v":"6.1.1"},"6.1.1: Los proveedores deben garantizar que los clientes reciban información clara, importante y oportuna respecto de las tarifas y los términos y condiciones.",{"$f":"$AZ5","v":"6.1.1.1"},"INFORMAR A LOS CLIENTES SOBRE TODAS LAS TARIFAS, LOS TÉRMINOS Y CONDICIONES\nTarifas: Se deben informar a los clientes todas las tarifas aplicables, incluidas las tarifas basadas en transacciones, tarifas no basadas en transacciones y tarifas excepcionales. Los servicios incluidos en el alcance pueden incluir lo siguiente, dependiendo del proveedor.\n1. Tarifas basadas en las transacciones (El régimen tarifario debe aclarar los factores que determinan las tarifas, como por ejemplo, el volumen de transacciones):\n   • Transferencias en la red (a usuarios registrados y no registrados)\n   • Transferencias fuera de la red (por ej., a socios de interoperabilidad y bancos)\n   • Transferencias internacionales (IMT)\n   • Depósitos/retiros en el agente o en cajeros automáticos\n   • Pagos de facturas (como canal de pagos solamente) \n   • Pagos a comerciantes (como canal de pagos solamente)\n2. Tarifas no basadas en las transacciones:\n   • Consulta de saldo o mini resumen de cuenta\n   • Cargos recurrentes \n   • Cambio de PIN\n   • Préstamo / ahorro / seguro ofrecido como parte del dinero móvil\n3. Tarifas por eventos excepcionales:\n   • Penalidades (por ej., por falta de pago de un préstamo)\n   • Cargos por SMS adicionales por uso de servicios durante roaming\n\nTérminos y Condiciones: se debe proporcionar a los clientes los términos y condiciones (T&C) de forma accesible (por ej., copia física o resumen en carteles) antes de comenzar a utilizar los servicios del dinero móvil. Una buena práctica es resumir los puntos clave de los términos y condiciones en carteles o folletos.\n\nUna buena práctica es poner información clave a disposición de los clientes a través del menú de los dispositivos. Idealmente se deberían incluir las tarifas, los puntos clave de los términos y condiciones con los clientes, preguntas frecuentes, cómo utilizar el servicio y cómo contactarse con soporte al cliente.\n",{"$f":"BB5","v":0},{"$f":"$BC5","v":"6.1.1.1.1"},"¿Se informan a los clientes todos los regímenes tarifarios  antes de comenzar a utilizar el, incluidas las tarifas basadas en transacciones, tarifas no basadas en transacciones y tarifas excepcionales (por ej., en los agentes, folletos, carteles, etc.)? ","1) Material del punto de venta (agente), material de publicidad, interfaz del dispositivo u otro mecanismo para informar las tarifas a los clientes (cada servicio puede tener diferentes mecanismos)\n- Verificar que se informen todas las tarifas a los clientes antes de usar el servicio, incluyendo los siguientes ejemplos, cuando corresponda:\n1. Tarifas basadas en transaccioness:\n   • Transferencias en la red (a usuarios registrados y no registrados)\n   • Transferencias fuera de la red (por ej., a socios de interoperabilidad y bancos)\n   • Transferencias internacionales (IMT)\n   • Depósitos/retiros en el agente o en cajeros automáticos\n   •  Pagos de facturas (como canal de pagos solamente)\n   • Pagos a comerciantes (como canal de pagos solamente)\n2. Tarifas no basadas en transacciones:\n   • Consulta de saldo o mini resumen de cuenta\n   • Cargos recurrentes \n   • Cambio de PIN\n   • Préstamo / ahorro / seguro ofrecido como parte del dinero móvil\n3. Tarifas por eventos excepcionales:\n   • Tarifas por sanciones (por ej., por no pagar un préstamo)\n   • Cargos por SMS adicionales por uso de servicios durante el roaming\n\nNota: los servicios dentro del alcance se definen en las Definiciones - consultar \"Servicios del DInero Móvil dentro del alcance de MMC\"\nNota: las tarifas se pueden visualizar por cliente como parte del proceso de aceptación al suscribirse al servicio.    ",null,{"$f":"VLOOKUP($BH5,CategoryTranslationTable,3,FALSE)","v":"Obligatorio urgente"},{"$f":"VLOOKUP($BI5,CategoryTranslationTable,3,FALSE)","v":"Obligatorio"},{"$f":"$O5","v":"BizOps"},null,null,{"$f":"$AV5","v":"6"},{"$f":"$AW5","v":"6.1"},{"$f":"$AX5","v":"6.1.1"},null,{"$f":"$AZ5","v":"6.1.1.1"},null,{"$f":"BB5","v":0},{"$f":"$BC5","v":"6.1.1.1.1"},null,null,null,{"$f":"VLOOKUP($BH5,CategoryTranslationTable,4,FALSE)","v":"ReqU4"},{"$f":"VLOOKUP($BI5,CategoryTranslationTable,4,FALSE)","v":"Req4"},{"$f":"$O5","v":"BizOps"},null,null,null,null,null,null,null,"MERGE","6.1.1.1.1","6.1.1.2.1",null,null,{"$f":"IF(OR($EA5=0,$EA5=2),VLOOKUP(DO5,INDIRECT(ED5),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP5),\"\",VLOOKUP(DP5,INDIRECT(EE5),7,FALSE))","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DQ5),\"\",VLOOKUP(DQ5,INDIRECT(EF5),7,FALSE))","v":""},"",{"$f":"IF(OR($EA5=0,$EA5=2),VLOOKUP(DO5,INDIRECT(ED5),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP5),\"\",VLOOKUP(DP5,INDIRECT(EE5),8,FALSE))","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DQ5),\"\",VLOOKUP(DQ5,INDIRECT(EF5),8,FALSE))","v":""},"",{"$f":"1*AND(LEFT(DN5,3)=\"NEW\")+2*AND(LEFT(DN5,3)=\"MER\")+3*AND(LEFT(DN5,3)=\"MOV\")+4*AND(LEFT(DN5,3)=\"SWA\")","v":2},{"$f":"IF(EA5=0,DS5,EN5)","v":""},{"$f":"IF(EA5=0,IF(DW5=0,\"\",DW5),CHOOSE(EA5,\"New indicator\",CONCATENATE(DW5,CarriageReturn,DX5,CarriageReturn,DY5,CarriageReturn,DZ5)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO5,1)","v":"OriginalComplianceP6"},{"$f":"\"OriginalComplianceP\"&LEFT(DP5,1)","v":"OriginalComplianceP6"},"OriginalComplianceP","OriginalComplianceP",{"$f":"COUNTIF($DS5:$DV5,EH$3)","v":0},0,0,0,0,{"$f":"COUNTIF($DO5:$DR5,\"*?\")","v":2},{"$f":"IF(OR(AND(EH5>0,SUM(EI5:EL5)>0),EK5>0),\"Partial\",IF(EH5=EM5,\"Yes\",IF(EI5=EM5,\"No\",IF(EJ5=EM5,\"N/A\",IF(EK5=EM5,\"Partial\",IF(EL5=EM5,\"\",\"\"))))))","v":""}]
[null,{"$f":"$AV6","v":"6"},{"$f":"$AW6","v":"6.1"},{"$f":"$AX6","v":"6.1.1"},0,{"$f":"AZ6","v":"6.1.1.1"},null,{"$f":"CHOOSE(LanguageNumber,BB6,BS6,CI6,CY6)","v":0},{"$f":"BC6","v":"6.1.1.1.2"},"6.1.1.1.2: Are the T&Cs provided to customers in an accessible manner (e.g. physical copy, or summary on posters) before using the service?\n","Point of sale (agent) material or publicity material or handset interface or other mechanism for informing customers of T&Cs\n- Check the T&Cs are provided to customers in an accessible manner (e.g. physical copy, or summary on posters) before using the service.\nNote: Different services may have separate T&Cs (e.g. loans/savings), which should also be provided to customers before using the service.",0,"Urgent Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.1","6.1.1",null,"6.1.1.1",null,null,"6.1.1.1.2",{"$f":"DO6","v":"6.1.1.1.2"},"Are the T&Cs provided to customers in an accessible manner (e.g. physical copy, or summary on posters) before using the service?","Point of sale (agent) material or publicity material or handset interface or other mechanism for informing customers of T&Cs\n- Check the T&Cs are provided to customers in an accessible manner (e.g. physical copy, or summary on posters) before using the service.\nNote: Different services may have separate T&Cs (e.g. loans/savings), which should also be provided to customers before using the service.",null,"Urgent Required","Required",{"$f":"$O6","v":"BizOps"},null,null,{"$f":"$AV6","v":"6"},{"$f":"$AW6","v":"6.1"},{"$f":"$AX6","v":"6.1.1"},0,{"$f":"$AZ6","v":"6.1.1.1"},0,0,"6.1.1.1.2","Les conditions générales sont-elles transmises aux clients dans un format accessible (par ex. copie sur un support concret, ou vue d'ensemble sur des affiches) préalablement à l'utilisation du service ?","1) Supports de point de vente (agent) ou support publicitaire ou interface sur l'appareil mobile ou autre mécanisme permettant d'informer les clients  des conditions générales\n- Vérifier que les conditions générales sont transmises aux clients dans un format accessible (par ex. copie sur un support concret, ou vue d'ensemble sur des affiches) préalablement à l'utilisation du service\nRemarque : Différents services peuvent être soumis à des conditions générales différentes (par ex. prêts/épargnes), qui doivent également être transmises aux clients préalablement à l'utilisation du service.",null,"Requis Prioritaire","Requis","BizOps",0,null,{"$f":"$AV6","v":"6"},{"$f":"$AW6","v":"6.1"},{"$f":"$AX6","v":"6.1.1"},null,{"$f":"$AZ6","v":"6.1.1.1"},null,0,{"$f":"$BC6","v":"6.1.1.1.2"},"¿Los clientes recibien los términos y condiciones de una forma accesible (por ej., copia física o resumen en carteles) antes de comenzar a utilizar el servicio?","Material del punto de venta (agente), material de publicidad, interfaz del dispositivo u otro mecanismo para informar los Términos y Condiciones a los  clientes\n- Verificar que los clientes reciban los términos y condiciones de una forma accesible (por ej., copia física, resumen, carteles) antes de comenzar a utilizar el servicio..\nNota: Diferentes servicios pueden tener términos y condiciones separados (por ej., préstamos/ahorros), que también se deben entregar a los clientes antes de utilizar el servicio.",null,"Obligatorio urgente","Obligatorio","BizOps",null,null,{"$f":"$AV6","v":"6"},{"$f":"$AW6","v":"6.1"},{"$f":"$AX6","v":"6.1.1"},null,{"$f":"$AZ6","v":"6.1.1.1"},null,0,{"$f":"$BC6","v":"6.1.1.1.2"},null,null,null,"ReqU4","Req4","BizOps",null,null,null,null,null,null,null,null,"6.1.1.1.2",null,null,null,{"$f":"IF(OR($EA6=0,$EA6=2),VLOOKUP(DO6,INDIRECT(ED6),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP6),\"\",VLOOKUP(DP6,INDIRECT(EE6),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ6),\"\",VLOOKUP(DQ6,INDIRECT(EF6),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR6),\"\",VLOOKUP(DR6,INDIRECT(EG6),7,FALSE))","v":""},{"$f":"IF(OR($EA6=0,$EA6=2),VLOOKUP(DO6,INDIRECT(ED6),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP6),\"\",VLOOKUP(DP6,INDIRECT(EE6),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ6),\"\",VLOOKUP(DQ6,INDIRECT(EF6),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR6),\"\",VLOOKUP(DR6,INDIRECT(EG6),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN6,3)=\"NEW\")+2*AND(LEFT(DN6,3)=\"MER\")+3*AND(LEFT(DN6,3)=\"MOV\")+4*AND(LEFT(DN6,3)=\"SWA\")","v":0},{"$error":"#REF!"},{"$f":"IF(EA6=0,IF(DW6=0,\"\",DW6),CHOOSE(EA6,\"New indicator\",CONCATENATE(DW6,CarriageReturn,DX6,CarriageReturn,DY6,CarriageReturn,DZ6)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO6,1)","v":"OriginalComplianceP6"},{"$f":"\"OriginalComplianceP\"&LEFT(DP6,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ6,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR6,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,{"$f":"IF(OR(AND(EH6>0,SUM(EI6:EL6)>0),EK6>0),\"Partial\",IF(EH6=EM6,\"Yes\",IF(EI6=EM6,\"No\",IF(EJ6=EM6,\"N/A\",IF(EK6=EM6,\"Partial\",IF(EL6=EM6,\"\",\"\"))))))","v":""}]
[null,"6","6.1","6.1.1",0,"6.1.1.1",null,{"$f":"CHOOSE(LanguageNumber,BB7,BS7,CI7,CY7)","v":0},"6.1.1.1.3","6.1.1.1.3: Is a summary of key points from the T&Cs clarified to customers on posters or handouts?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.1","6.1.1",null,"6.1.1.1",null,null,"6.1.1.1.3","6.1.1.1.3","Is a summary of key points from the T&Cs clarified to customers on posters or handouts?",null,null,"Recommended","Recommended","BizOps",null,null,"6","6.1","6.1.1",0,"6.1.1.1",0,0,"6.1.1.1.3","Existe-t-il un procédé pour que les clients puissent lire / recevoir / obtenir une explication des points clés des CGU lors de leur enregistrement et les acceptent ?","1) Processus d’enregistrement des nouveaux clients\n- Vérifier qu’un processus a été mis en place afin de permettre aux clients de consulter/de recevoir/d’obtenir de plus amples informations sur les points clés des CGU au moment de leur enregistrement et d’accepter ces dernières.\n",null,"Recommandé","Recommandé","BizOps",0,null,"6","6.1","6.1.1",null,"6.1.1.1",null,0,"6.1.1.1.3","¿Existe un proceso para que los clientes visualicen / reciban / se les expliquen y acepten los puntos clave de los términos y condiciones al momento del registro?","1) Proceso de registro de clientes\n- Verificar que exista un proceso para que los clientes visualicen / reciban / se les expliquen y acepten los puntos clave de los términos y condiciones al momento del registro\n",null,"Recomendado","Recomendado","BizOps",null,null,"6","6.1","6.1.1",null,"6.1.1.1",null,0,"6.1.1.1.3",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"6.1.1.1.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"6","6.1","6.1.1",0,"6.1.1.1",null,{"$f":"CHOOSE(LanguageNumber,BB8,BS8,CI8,CY8)","v":0},"6.1.1.1.4","6.1.1.1.4: Are fees, T&Cs, FAQ, and contact information for customer support available to customers via handset menus?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.1","6.1.1",null,"6.1.1.1",null,null,"6.1.1.1.4","6.1.1.1.4","Are fees, T&Cs, FAQ, and contact information for customer support available to customers via handset menus?",null,null,"Recommended","Recommended","BizOps",null,null,"6","6.1","6.1.1",0,"6.1.1.1",0,0,"6.1.1.1.4","les tarifs, les CGU, les questions/réponses les plus courantes et les coordonnées du service clients sont-ils à la disposition des clients par le biais d'un menu téléphonique ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"6","6.1","6.1.1",null,"6.1.1.1",null,0,"6.1.1.1.4","¿Se ponen a disposición del cliente mediante el menú de los dispositivos las tarifas, los términos y condiciones, las preguntas frecuentes y la información de contacto de atención al cliente?",null,null,"Recomendado","Recomendado","BizOps",null,null,"6","6.1","6.1.1",null,"6.1.1.1",null,0,"6.1.1.1.4",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"6.1.1.1.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"6","6.1","6.1.1",0,"6.1.1.2",{"$f":"AZ9&\": \"&CHOOSE(LanguageNumber,BA9,BR9,CH9,CX9)","v":"6.1.1.2: PROPERLY ORGANISE AND FORMAT TERMS & CONDITIONS AND FEE SCHEDULES\nProviders should ensure that T&Cs and fees schedules are structured such that they reflect proper subject issues, e.g. fees, customer care, consumer rights, processes to follow in case of problems, etc."},{"$f":"BB9","v":0},"6.1.1.2.1","6.1.1.2.1: Have the T&Cs and the fee schedule been properly organised and structured under clear and appropriate subject headings?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.1","6.1.1",null,"6.1.1.2","PROPERLY ORGANISE AND FORMAT TERMS & CONDITIONS AND FEE SCHEDULES\nProviders should ensure that T&Cs and fees schedules are structured such that they reflect proper subject issues, e.g. fees, customer care, consumer rights, processes to follow in case of problems, etc.",null,"6.1.1.2.1","6.1.1.3.1","Have the T&Cs and the fee schedule been properly organised and structured under clear and appropriate subject headings?",null,null,"Recommended","Recommended","BizOps",null,null,"6","6.1","6.1.1",0,"6.1.1.2","PRÉSENTATION ADAPTÉE DES CONDITIONS GÉNÉRALES D'UTILISATION ET DES TARIFS DU SERVICE\nLes prestataires doivent veiller à ce que la présentation des CGU et des tarifs soit organisée sous forme de rubriques reflétant les centres d’intérêt des clients: frais, assistance à la clientèle, droits des consommateurs, procédures à suivre en cas de problème, etc.\n",0,"6.1.1.2.1","la présentation des CGU et du barème des tarifs est-elle organisée sous forme de rubriques claires et appropriées ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"6","6.1","6.1.1",null,"6.1.1.2","ORGANIZAR ADECUADAMENTE Y DAR FORMATO A LOS TÉRMINOS Y CONDICIONES Y A LOS REGÍMENES TARIFARIOS\nLos proveedores deben garantizar que los términos y condiciones y los regímenes tarifarios sean estructurados de forma tal que reflejen las cuestiones correspondientes al tema, por ej., tarifas, atención al cliente, procesos a seguir en caso de problemas, etc.",0,"6.1.1.2.1","¿Se organizaron y estructuraron los términos y condiciones y el régimen de tarifas bajo encabezados claros y correspondientes al tema?",null,null,"Recomendado","Recomendado","BizOps",null,null,"6","6.1","6.1.1",null,"6.1.1.2",null,0,"6.1.1.2.1",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"6.1.1.3.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"6","6.1","6.1.1",0,"6.1.1.3",{"$f":"AZ10&\": \"&CHOOSE(LanguageNumber,BA10,BR10,CH10,CX10)","v":"6.1.1.3: PUBLISH T&CS IN PLAIN LANGUAGE WHERE POSSIBLE\nProviders should ensure that all T&Cs should be written in plain language as much as possible, unless specific sections and wording are required by law & regulation to be written in a specific legalistic way.\n\nThe information should be presented in ways that the customers can be expected to comprehend, taking due account of the literacy and numeracy constraints of the customer base. For example, providers may wish to use diagrams where feasible."},0,"6.1.1.3.1","6.1.1.3.1: Have the T&Cs been written in plain language to the greatest extent possible, while both complying with regulatory requirements and taking due account of the literacy and numeracy constraints of the customer base?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.1","6.1.1",null,"6.1.1.3","PUBLISH T&CS IN PLAIN LANGUAGE WHERE POSSIBLE\nProviders should ensure that all T&Cs should be written in plain language as much as possible, unless specific sections and wording are required by law & regulation to be written in a specific legalistic way.\n\nThe information should be presented in ways that the customers can be expected to comprehend, taking due account of the literacy and numeracy constraints of the customer base. For example, providers may wish to use diagrams where feasible.",null,"6.1.1.3.1","6.1.1.4.1","Have the T&Cs been written in plain language to the greatest extent possible, while both complying with regulatory requirements and taking due account of the literacy and numeracy constraints of the customer base?",null,null,"Recommended","Recommended","BizOps",null,null,"6","6.1","6.1.1",0,"6.1.1.3","RÉDACTION DES CGU DANS UN LANGAGE SIMPLE\nLes prestataires doivent veiller à ce que l’intégralité des CGU soit rédigée dans un langage aussi simple que possible, sous réserve des dispositions et mentions pour lesquelles les lois et réglementation imposent une formulation spécifique. \n\nLes informations doivent être présentées d’une manière à pouvoir être comprises par les clients, en tenant compte du niveau d’alphabétisation de la base de clientèle. Les prestataires peuvent par exemple avoir intérêt à utiliser des schémas et visuels dans la mesure du possible.",0,"6.1.1.3.1","les CGU sont-elles rédigées dans un langage aussi clair et accessible que possible, compte-tenu à la fois des obligations réglementaires et du niveau d'alphabétisation de la clientèle cible ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"6","6.1","6.1.1",null,"6.1.1.3","PUBLICAR LOS TÉRMINOS Y CONDICIONES EN LENGUAJE SENCILLO CUANDO SEA POSIBLE\nLos proveedores deben garantizar que todos los términos y condiciones se escriban en el lenguaje más sencillo posible, salvo las secciones específicas y la terminología que la ley y la regulación requieran que se redacte con vocabulario jurídico específico.\n\nLa información debe presentarse de forma tal que los clientes puedan comprenderla, teniendo en cuenta la alfabetización y las limitaciones matemáticas de la base de clientes. Por ejemplo, es posible que los proveedores deseen usar diagramas cuando sea factible.",0,"6.1.1.3.1","¿Los términos y condiciones fueron redactados en el lenguaje más sencillo posible, en cumplimiento de los requisitos regulatorios y teniendo en cuenta la alfabetización y las limitaciones matemáticas de la base de clientes?",null,null,"Recomendado","Recomendado","BizOps",null,null,"6","6.1","6.1.1",null,"6.1.1.3",null,0,"6.1.1.3.1",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"6.1.1.4.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"6","6.1","6.1.1",0,"6.1.1.4",{"$f":"AZ11&\": \"&CHOOSE(LanguageNumber,BA11,BR11,CH11,CX11)","v":"6.1.1.4: NOTIFY CUSTOMERS IN ADVANCE OF CHANGES TO TERMS & CONDITIONS OR FEE SCHEDULES\nProviders should notify customers of any changes to T&Cs or fee schedules before these take effect, with an appropriate notice period. The notification should be pushed to customers (for example, in the form of an SMS or notification through a mobile app). The method of notifying customer should take account of the significance of the change; major changes to fees and/or T&Cs also should be advertised through methods such as posters and/or media campaigns.\n\nProviders should have internal processes in place to ensure that updated materials are developed and disseminated prior to the implementation of new T&Cs or fee schedules. Materials should be updated at all agents and retail outlets where services are provided."},0,"6.1.1.4.1","6.1.1.4.1: Are customers notified of any changes to the T&Cs or fee schedules?\n","1) Process for changes to fees & T&Cs, or customer communication plan\n- Check there is a process for notifying customers of changes to T&Cs and/or fee schedules.\n- Check that the process includes timescales for the customer to be notified with appropriate notice.\n",0,"Standard Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.1","6.1.1",null,"6.1.1.4","NOTIFY CUSTOMERS IN ADVANCE OF CHANGES TO TERMS & CONDITIONS OR FEE SCHEDULES\nProviders should notify customers of any changes to T&Cs or fee schedules before these take effect, with an appropriate notice period. The notification should be pushed to customers (for example, in the form of an SMS or notification through a mobile app). The method of notifying customer should take account of the significance of the change; major changes to fees and/or T&Cs also should be advertised through methods such as posters and/or media campaigns.\n\nProviders should have internal processes in place to ensure that updated materials are developed and disseminated prior to the implementation of new T&Cs or fee schedules. Materials should be updated at all agents and retail outlets where services are provided.",null,"6.1.1.4.1","6.1.1.5.1","Are customers notified of any changes to the T&Cs or fee schedules?","1) Process for changes to fees & T&Cs, or customer communication plan\n- Check there is a process for notifying customers of changes to T&Cs and/or fee schedules.\n- Check that the process includes timescales for the customer to be notified with appropriate notice.\n",null,"Standard Required","Required","BizOps",null,null,"6","6.1","6.1.1",0,"6.1.1.4","PRÉAVIS D’INFORMATION POUR LES MODIFICATIONS DE CGU ET DE TARIF \nLes prestataires doivent informer les clients de toute modification des CGU ou des tarifs avant que ces changements ne prennent effet, avec un préavis approprié. L’avis d’information doit être fourni d’office aux clients (sous forme par exemple d’un SMS ou d’une notification dans l’application mobile). Le mode d’information des clients doit également tenir compte de l’importance du changement, avec communication complémentaire par voie d'affichage ou de campagnes médiatiques en cas de changement significatif des tarifs ou des CGU. \n\nLes prestataires doivent se doter de processus internes garantissant que toute la documentation du service soit mise à jour et distribuée avant l’application de nouvelles CGU ou de nouveaux tarifs. Les documents doivent être à jour au niveau de tous les points de service d’agents offrant le service d’argent mobile.\n",0,"6.1.1.4.1","les clients sont-ils directement avisés, avec un préavis approprié, de tout changement des CGU ou des tarifs avant que ces changements ne soient effectifs ?","1) Processus de modifications de tarif et de CGU, ou plan de communication aux clients\n- Vérifier qu’un processus a été mis en place afin d’aviser les clients des modifications apportées aux CGU et/ou aux barèmes tarifaires.\n- Vérifier que le processus prévoit des délais suffisants pour permettre au client d’être avisé de ces modifications avec un préavis approprié.\n",null,"Requis Normal","Requis","BizOps",0,null,"6","6.1","6.1.1",null,"6.1.1.4","NOTIFICAR A LOS CLIENTES CON ANTERIORIDAD LOS CAMBIOS A LOS TÉRMINOS Y CONDICIONES O AL RÉGIMEN TARIFARIO\nLos proveedores deben notificar a los clientes todos los cambios a los términos y condiciones o a los regímenes tarifarios con un período de antelación adecuado antes de que entren en vigencia. La notificación debe ser enviada a los clientes (por ejemplo, en un SMS o en una notificación a través de una app móvil). El método de notificación a los clientes debe tener en cuenta la importancia del cambio. Los cambios importantes a las tarifas y/o a los términos y condiciones también se deben publicar usando métodos tales como carteles y/o campañas en los medios.\n\nLos proveedores deben contar con procesos internos para garantizar que se desarrollan y distribuyen los materiales actualizados antes de la implementación de los nuevos términos y condiciones o regímenes tarifarios. Los materiales deben ser actualizados en todos los agentes y comercios minoristas donde se ofrecen los servicios.",0,"6.1.1.4.1","¿Se notifican a los clientes todos los cambios a los términos y condiciones o a los regímenes tarifarios?","1) Proceso para cambios a las tarifas y a los términos y condiciones, o plan de comunicación a los clientes\n- Verificar que exista un proceso para notificar a los clientes los cambios a los términos y condiciones y/o a los regímenes tarifarios.\n- Verificar que el proceso incluya plazos de notificación al cliente con una antelación adecuada.\n",null,"Obligatorio estándar","Obligatorio","BizOps",null,null,"6","6.1","6.1.1",null,"6.1.1.4",null,0,"6.1.1.4.1",null,null,null,"ReqS4","Req4","BizOps",null,null,null,null,null,null,null,null,"6.1.1.5.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"6","6.1","6.1.1",0,"6.1.1.4",null,null,"6.1.1.4.2","6.1.1.4.2: Are customers given advance notice of any changes to the T&Cs or fee schedules before these changes take effect, with an appropriate notice period?\n",0,0,{"$f":"CHOOSE(LanguageNumber,BH12,BX12,CN12,DD12)","v":"Recommended"},{"$f":"CHOOSE(LanguageNumber,BI12,BY12,CO12,DE12)","v":"Recommended"},"BizOps",{"$f":"CHOOSE(LanguageNumber,BK12,CA12,CQ12,DG12)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.1","6.1.1",null,"6.1.1.4",null,null,"6.1.1.4.2",0,"Are customers given advance notice of any changes to the T&Cs or fee schedules before these changes take effect, with an appropriate notice period?",null,null,"Recommended","Recommended","BizOps",null,null,"6","6.1","6.1.1",null,"6.1.1.4",null,null,{"$f":"BC12","v":"6.1.1.4.2"},"Les clients sont-ils informés de toute modification des CGU ou des tarifs avant que ces changements ne prennent effet, avec un préavis approprié ?",null,null,"Recommandé","Recommandé","BizOps",null,null,"6","6.1","6.1.1",null,"6.1.1.4",null,null,"6.1.1.4.2","¿Se notifican a los clientes todos los cambios a los términos y condiciones o regímenes tarifarios con un período de antelación adecuado antes de que entren en vigencia?",null,null,"Recomendado","Recomendado","BizOps",null,null,"6","6.1","6.1.1",null,"6.1.1.4",null,null,"6.1.1.4.2",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,"NEW"]
[null,"6","6.1","6.1.1",{"$f":"CHOOSE(LanguageNumber,AY13,BP13,CF13,CV13)","v":0},"6.1.1.4",null,0,"6.1.1.4.3","6.1.1.4.3: Are major changes to fees and/or T&Cs also advertised through methods such as posters and/or media campaigns?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.1","6.1.1",null,"6.1.1.4",null,null,"6.1.1.4.3","6.1.1.5.2","Are major changes to fees and/or T&Cs also advertised through methods such as posters and/or media campaigns?",null,null,"Recommended","Recommended","BizOps",null,null,"6","6.1","6.1.1",0,"6.1.1.4",0,{"$f":"BB13","v":0},"6.1.1.4.3","les changements majeurs des CGU ou des tarifs font-ils également l'objet de campagnes de communication comprenant affiches et/ou campagnes médiatiques ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"6","6.1","6.1.1",null,"6.1.1.4",null,{"$f":"BB13","v":0},"6.1.1.4.3","¿Los cambios importantes a las tarifas y/o a los términos y condiciones también son publicados usando métodos tales como carteles y/o campañas en los medios?",null,null,"Recomendado","Recomendado","BizOps",null,null,"6","6.1","6.1.1",null,"6.1.1.4",null,{"$f":"BB13","v":0},"6.1.1.4.3",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"6.1.1.5.2",null,null,null,{"$f":"IF(OR($EA13=0,$EA13=2),VLOOKUP(DO13,INDIRECT(ED13),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP13),\"\",VLOOKUP(DP13,INDIRECT(EE13),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ13),\"\",VLOOKUP(DQ13,INDIRECT(EF13),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR13),\"\",VLOOKUP(DR13,INDIRECT(EG13),7,FALSE))","v":""},{"$f":"IF(OR($EA13=0,$EA13=2),VLOOKUP(DO13,INDIRECT(ED13),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP13),\"\",VLOOKUP(DP13,INDIRECT(EE13),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ13),\"\",VLOOKUP(DQ13,INDIRECT(EF13),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR13),\"\",VLOOKUP(DR13,INDIRECT(EG13),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN13,3)=\"NEW\")+2*AND(LEFT(DN13,3)=\"MER\")+3*AND(LEFT(DN13,3)=\"MOV\")+4*AND(LEFT(DN13,3)=\"SWA\")","v":0},{"$error":"#REF!"},{"$f":"IF(EA13=0,IF(DW13=0,\"\",DW13),CHOOSE(EA13,\"New indicator\",CONCATENATE(DW13,CarriageReturn,DX13,CarriageReturn,DY13,CarriageReturn,DZ13)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO13,1)","v":"OriginalComplianceP6"},{"$f":"\"OriginalComplianceP\"&LEFT(DP13,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ13,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR13,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,""]
[null,"6","6.1","6.1.1",0,"6.1.1.4",null,0,"6.1.1.4.4","6.1.1.4.4: Are internal processes in place to ensure that updated T&C or fee schedule materials have been developed and disseminated prior to the implementation of the new T&Cs or fee schedules?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.1","6.1.1",null,"6.1.1.4",null,null,"6.1.1.4.4","6.1.1.5.3","Are internal processes in place to ensure that updated T&C or fee schedule materials have been developed and disseminated prior to the implementation of the new T&Cs or fee schedules?",null,null,"Recommended","Recommended","BizOps",null,null,"6","6.1","6.1.1",0,"6.1.1.4",0,0,"6.1.1.4.4","existe-t-il des processus internes garantissant que tous les documents de CGU ou de tarifs soient mis à jour et distribués avant la prise d'effet de tout changement des CGU ou tarifs ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"6","6.1","6.1.1",null,"6.1.1.4",null,0,"6.1.1.4.4","¿Se implementaron procesos internos para garantizar que se desarrollen y distribuyan los términos y condiciones o el régimen tarifario actualizado antes de la implementación de los nuevos términos y condiciones o regímenes tarifarios?",null,null,"Recomendado","Recomendado","BizOps",null,null,"6","6.1","6.1.1",null,"6.1.1.4",null,0,"6.1.1.4.4",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"6.1.1.5.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"6","6.1","6.1.1",0,"6.1.1.5",{"$f":"AZ15&\": \"&CHOOSE(LanguageNumber,BA15,BR15,CH15,CX15)","v":"6.1.1.5: USE OFFICIAL AND LOCAL LANGUAGES\nWhere feasible, information for customers should be available in the official language(s) and/or other commonly spoken languages (including regional languages). All channels through which information is made available (leaflets, posters, media campaigns, handset menus, etc.) should support the customer's language preferences. \n\nNOTE:  It may not be feasible or commercially sustainable to provide information in the official language(s) and/or other commonly spoken languages. Where feasible and commercially sustainable, however, providers should make a reasonable effort to communicate in languages that can be comprehended by people from different regions and with varying levels of education."},0,"6.1.1.5.1","6.1.1.5.1: Are fees, T&Cs, FAQs, contact information for customer support, media campaigns, and other relevant information communicated in languages that can be comprehended by people from different regions and with varying levels of education?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.1","6.1.1",null,"6.1.1.5","USE OFFICIAL AND LOCAL LANGUAGES\nWhere feasible, information for customers should be available in the official language(s) and/or other commonly spoken languages (including regional languages). All channels through which information is made available (leaflets, posters, media campaigns, handset menus, etc.) should support the customer's language preferences. \n\nNOTE:  It may not be feasible or commercially sustainable to provide information in the official language(s) and/or other commonly spoken languages. Where feasible and commercially sustainable, however, providers should make a reasonable effort to communicate in languages that can be comprehended by people from different regions and with varying levels of education.",null,"6.1.1.5.1","6.1.1.6.1","Are fees, T&Cs, FAQs, contact information for customer support, media campaigns, and other relevant information communicated in languages that can be comprehended by people from different regions and with varying levels of education?",null,null,"Recommended","Recommended","BizOps",null,null,"6","6.1","6.1.1",0,"6.1.1.5","UTILISATION DES LANGUES OFFICIELLES ET LOCALES \nDans la mesure du possible, les informations destinées aux clients doivent être rédigées dans la ou les langues officielles du pays et/ou les autres langues couramment parlées (y compris les langues régionales). Tous les canaux de mise à disposition de ces informations (brochures, affiches, campagnes médias, menus téléphoniques, etc.) doivent tenir compte les préférences linguistiques des clients. \n\nREMARQUE : il n’est pas toujours possible, ou commercialement viable, de fournir les informations dans la ou les langues officielles du pays et/ou les autres langues couramment parlées. Mais lorsque cela est possible et commercialement viable, les prestataires doivent s’efforcer de communiquer dans des langues comprises par les personnes de différentes régions et de différents niveaux d’éducation.",0,"6.1.1.5.1","est-ce que les tarifs, les CGU, les questions/réponses les plus courantes, les coordonnées du service client, les campagnes médiatiques et autres informations utiles aux clients sont communiqués dans des langues comprises par des personnes de différentes régions et de différents niveaux de scolarisation ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"6","6.1","6.1.1",null,"6.1.1.5","USO DE IDIOMAS OFICIALES Y LOCALES\nCuando sea factible, la información también debe estar disponible para los clientes en el(los) idioma(s) oficial(es) y/u otros idiomas comúnmente hablados (incluyendo idiomas regionales). Todos los canales a través de los cuales la información es puesta a disposición (folletos, carteles, campañas en los medios, menú de los dispositivos, etc.) deben soportar las preferencias de idioma del cliente. \n\nNOTA:  Es posible que no sea factible o comercialmente sostenible brindar información en el(los) idioma(s) oficial(es) y/u otros idiomas comúnmente hablados. No obstante, cuando sea factible y comercialmente sostenible, los empleados deben realizar los esfuerzos razonables para comunicar en los idiomas que puedan comprender las personas de distintas regiones y con diferentes niveles educativos.",0,"6.1.1.5.1","¿Las tarifas, los términos y condiciones, las preguntas frecuentes, la información de contacto para soporte al cliente, las campañas en los medios y demás información relevante es comunicada en idiomas que pueden ser comprendidos por las personas de distintas regiones y con diferentes niveles educativos?",null,null,"Recomendado","Recomendado","BizOps",null,null,"6","6.1","6.1.1",null,"6.1.1.5",null,0,"6.1.1.5.1",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"6.1.1.6.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"6","6.1","6.1.1",0,"6.1.1.6","6.1.1.6: INFORM CUSTOMERS OF EXPECTED DOWNTIME AND COMMUNICATE UNEXPECTED OUTAGES\nProviders should inform customers if the mobile money system is experiencing an extended outage or processing delays. \n\nProviders should inform customers of periods of scheduled downtime, particularly for extended outages. Providers should give sufficient notice of scheduled downtime to ensure that customers can plan accordingly.\n\nIn case of a complete outage, users should receive a 'system down' message on their handset and transactions should not accepted. Handset messages should also be used in the case of significant delays. This will help to avoid problems due to a lack of clarity regarding whether a transaction has gone through.\n\nCustomers should be educated on what to do if a transaction confirmation message is not received (for example, the customer could be advised to check their account balance and to contact customer care prior to repeating the transaction).\n",0,"6.1.1.6.1","6.1.1.6.1: Are customers given advance notice of scheduled downtime?\n","1)  Customer communication plan / materal\n- Check there is a process for notifying customers of planned system downtime (e.g. MM system messages or other mechanism)\n- Check that the process includes timescales for the customer to be notified with appropriate notice \n",0,"Standard Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.1","6.1.1",null,"6.1.1.6","INFORM CUSTOMERS OF EXPECTED DOWNTIME AND COMMUNICATE UNEXPECTED OUTAGES\nProviders should inform customers if the mobile money system is experiencing an extended outage or processing delays. \n\nProviders should inform customers of periods of scheduled downtime, particularly for extended outages. Providers should give sufficient notice of scheduled downtime to ensure that customers can plan accordingly.\n\nIn case of a complete outage, users should receive a 'system down' message on their handset and transactions should not accepted. Handset messages should also be used in the case of significant delays. This will help to avoid problems due to a lack of clarity regarding whether a transaction has gone through.\n\nCustomers should be educated on what to do if a transaction confirmation message is not received (for example, the customer could be advised to check their account balance and to contact customer care prior to repeating the transaction).\n",null,"6.1.1.6.1","6.1.1.7.1","Are customers given advance notice of scheduled downtime?","1)  Customer communication plan / materal\n- Check there is a process for notifying customers of planned system downtime (e.g. MM system messages or other mechanism)\n- Check that the process includes timescales for the customer to be notified with appropriate notice \n",null,"Standard Required","Required","BizOps",null,null,"6","6.1","6.1.1",0,"6.1.1.6","INFORMATION DES CLIENTS RELATIVE AUX ARRÊTS PROGRAMMÉS DU SERVICE ET COMMUNICATION EN CAS DE PANNE IMPRÉVUE\nLes prestataires doivent informer les clients lorsque le système de l’argent mobile subit un arrêt prolongé ou des retards de traitement. \n\nLes prestataires doivent informer les clients de toute période d'arrêt programmé, notamment en cas d'arrêt prolongé. Les prestataires doivent notifier les clients suffisamment à l’avance pour que ceux-ci puissent s’organiser en fonction des arrêts.\n\nEn cas d'arrêt total, les utilisateurs doivent recevoir un avis de « panne de système » sur leur téléphone et ne pas accepter de transactions. Les avis sur téléphone doivent également être envoyés lors de retards de traitement importants. Les tentatives de transaction doivent être bloquées aussi rapidement que possible afin d’éviter tout problème lié à des transactions restées en suspens.\n\nLes clients doivent être informés des mesures à prendre lorsqu’un message de confirmation de transaction n’est pas reçu (par exemple, le client peut se voir conseiller de vérifier son solde de compte et contacter le service client avant de relancer la transaction).\n",0,"6.1.1.6.1","les clients sont-ils informés à l'avance des arrêts programmés du service ?","1) Plan/supports de communication aux clients\n\r- Vérifier qu’un processus a été mis en place pour informer les clients des arrêts programmés du système (par ex. messages du système de l’argent mobile ou autre mécanisme)\r\n- Vérifier que le processus prévoit des délais suffisants pour permettre au client d’être avisé de ces arrêts avec un préavis approprié ",null,"Requis Normal","Requis","BizOps",0,null,"6","6.1","6.1.1",null,"6.1.1.6","INFORMAR A LOS CLIENTES LOS TIEMPOS DE INACTIVIDAD ESPERADOS Y COMUNICAR LAS INTERRUPCIONES INESPERADAS\nLos proveedores deben informar al cliente si el sistema del dinero móvil está experimentando una interrupción prolongada o procesando demoras. \n\nLos proveedores deben informar a los clientes los períodos de inactividad programados, especialmente para interrupciones prolongadas. Los proveedores deben notificar a los clientes los tiempos de inactividad programados con suficiente antelación para garantizar que los clientes puedan planificar en base a ello.\n\nEn el caso de una interrupción total, los usuarios deben recibir un mensaje de 'sistema inactivo' en su dispositivo y no se deben aceptar las transacciones. Los mensajes en los dispositivos también deben ser utilizados en caso de demoras significativas. Esto ayudará a evitar problemas por falta de claridad respecto de si una transacción fue realizada o no.\n\nSe debe educar a los clientes sobre qué hacer cuando no se recibe el mensaje de confirmación de una transacción (por ejemplo, se podría recomendar al cliente que verifique el saldo de su cuenta o que se contacte con atención al cliente antes de repetir la transacción).\n",0,"6.1.1.6.1","¿Se notifica a los clientes con anterioridad a los tiempos de inactividad programados?","1)  Plan / material de comunicación al cliente\n- Verificar que exista un proceso para notificar a los clientes los tiempos de inactividad planificados del sistema (por ej., mensaje del dinero móvil u otro mecanismo)\n- Verificar que el proceso incluya plazos para notificar al cliente con una antelación adecuada \n",null,"Obligatorio estándar","Obligatorio","BizOps",null,null,"6","6.1","6.1.1",null,"6.1.1.6",null,0,"6.1.1.6.1",null,null,null,"ReqS4","Req4","BizOps",null,null,null,null,null,null,null,null,"6.1.1.7.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"6","6.1","6.1.1",0,"6.1.1.6",null,0,"6.1.1.6.2","6.1.1.6.2: In the event of an extended unexpected system outage, do users receive a 'system down' message via the handset?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.1","6.1.1",null,"6.1.1.6",null,null,"6.1.1.6.2","6.1.1.7.2","In the event of an extended unexpected system outage, do users receive a 'system down' message via the handset?",null,null,"Recommended","Recommended","BizOps",null,null,"6","6.1","6.1.1",0,"6.1.1.6",0,0,"6.1.1.6.2","en cas de panne prolongée imprévue, les utilisateurs reçoivent-ils un avis de « panne de système » sur leur téléphone et les opérations en cours sont-elles rapidement annulées ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"6","6.1","6.1.1",null,"6.1.1.6",null,0,"6.1.1.6.2","¿En el caso de una interrupción del sistema inesperada y prolongada, los usuarios reciben un mensaje de 'sistema inactivo' en su dispositivo?",null,null,"Recomendado","Recomendado","BizOps",null,null,"6","6.1","6.1.1",null,"6.1.1.6",null,0,"6.1.1.6.2",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"6.1.1.7.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"6","6.1","6.1.1",0,"6.1.1.6",null,0,"6.1.1.6.3","6.1.1.6.3: Are customers told what to do if a transaction confirmation is not received, such as check their account balance and contact customer care prior to repeating the transaction?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.1","6.1.1",null,"6.1.1.6",null,null,"6.1.1.6.3","6.1.1.8.2","Are customers told what to do if a transaction confirmation is not received, such as check their account balance and contact customer care prior to repeating the transaction?",null,null,"Recommended","Recommended","BizOps",null,null,"6","6.1","6.1.1",0,"6.1.1.6",0,0,"6.1.1.6.3","les clients sont-ils avisés de la conduite à tenir en cas de non réception d’un avis d’opéré, avec par exemple le conseil de vérifier leur relevé de compte et de contacter le service client avant de recommencer l’opération ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"6","6.1","6.1.1",null,"6.1.1.6",null,0,"6.1.1.6.3","¿Se le informa a los clientes qué hacer si no reciben el mensaje de confirmación de una transacción, como por ejemplo verificar el saldo de su cuenta y contactarse con atención al cliente antes de repetir la transacción?",null,null,"Recomendado","Recomendado","BizOps",null,null,"6","6.1","6.1.1",null,"6.1.1.6",null,0,"6.1.1.6.3",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"6.1.1.8.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"6","6.1","6.1.1",0,"6.1.1.7","6.1.1.7: TRAIN CUSTOMER SERVICE PERSONNEL IN TERMS & CONDITIONS AND THE FEE SCHEDULE\nProviders should ensure that first-level customer service personnel have sufficient access to T&Cs and fee schedules and are trained to provide the information accurately and efficiently to customers.\n\nProviders should ensure that customer service personnel are properly trained to understand changes to T&Cs or fee schedules and the potential impacts of these changes. This training should be completed before any changes are made.",0,"6.1.1.7.1","6.1.1.7.1: Do customer service personnel have access to information so that they can provide customers with accurate information on T&Cs and the full set of fees?\n","1) Training plan / material for customer service staff, or customer service process documentation\n- Check that customer care are provided with information on T&Cs and the full set of fees.\n",0,"Standard Required","Required","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.1","6.1.1",null,"6.1.1.7","TRAIN CUSTOMER SERVICE PERSONNEL IN TERMS & CONDITIONS AND THE FEE SCHEDULE\nProviders should ensure that first-level customer service personnel have sufficient access to T&Cs and fee schedules and are trained to provide the information accurately and efficiently to customers.\n\nProviders should ensure that customer service personnel are properly trained to understand changes to T&Cs or fee schedules and the potential impacts of these changes. This training should be completed before any changes are made.",null,"6.1.1.7.1","6.1.1.9.2","Do customer service personnel have access to information so that they can provide customers with accurate information on T&Cs and the full set of fees?","1) Training plan / material for customer service staff, or customer service process documentation\n- Check that customer care are provided with information on T&Cs and the full set of fees.\n",null,"Standard Required","Required","CustServ",null,null,"6","6.1","6.1.1",0,"6.1.1.7","FORMATION DES ÉQUIPES D’ASSISTANCE À LA CLIENTÈLE SUR LES CGU ET LES TARIFS\nLes prestataires doivent s’assurer que les équipes du service client aient facilement accès aux CGU et tarifs et soient suffisamment formées pour communiquer ces informations clairement et précisément aux clients.\n\nLes prestataires doivent s’assurer que les équipes du service client soient  correctement formées pour bien comprendre les changements de CGU et de tarif et l’impact potentiel de ces changements. Cette formation doit être effectuée avant l'entrée en vigueur des changements.",0,"6.1.1.7.1","Les équipes du service client disposent-elles des informations nécessaires pour communiquer aux clients des informations précises sur les conditions générales et sur le barème tarifaire dans son intégralité ?","1) Plan de formation/support de formation des équipes du service client, ou documentation du processus du service client\n- Vérifier que les équipes du service client disposent d'informations sur les conditions générales et le barème tarifaire dans son intégralité.",null,"Requis Normal","Requis","CustServ","Exemple de solution : un portail de connaissance destiné au service client contenant des questions/réponses actualisées sur la base des questions posées par les clients. ",null,"6","6.1","6.1.1",null,"6.1.1.7","BRINDAR CAPACITACIÓN AL PERSONAL DE ATENCIÓN AL CLIENTE SOBRE LOS TÉRMINOS Y CONDICIONES Y EL RÉGIMEN TARIFARIO\nLos proveedores deben garantizar que el personal de atención al cliente del primer nivel tenga suficiente acceso a los términos y condiciones y a los regímenes tarifarios y reciba capacitación para brindar la información de forma precisa y eficiente a los clientes.\n\nLos proveedores deben garantizar que el personal de atención al cliente sea correctamente capacitado para comprender los cambios a los términos y condiciones o a los regímenes tarifarios y el impacto potencial de estos cambios. Esta capacitación se debe completar antes de realizar cualquier cambio.",0,"6.1.1.7.1","¿El personal de atención al cliente tiene acceso a información para que pueda brindar a los clientes información precisa sobre los términos y condiciones y todos los regímenes tarifarios?","1) Material para el personal de atención al cliente\n- Verificar que atención al cliente reciba información sobre los términos y condiciones y todos los regímenes tarifarios.\n",null,"Obligatorio estándar","Obligatorio","CustServ",null,null,"6","6.1","6.1.1",null,"6.1.1.7",null,0,"6.1.1.7.1",null,null,null,"ReqS4","Req4","CustServ",null,null,null,null,null,null,null,"MERGE","6.1.1.9.2","6.1.1.9.1","6.1.1.9.2",null,{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},"",{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},"",2,"",{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP6","OriginalComplianceP6","OriginalComplianceP",0,0,0,0,0,3,""]
[null,"6","6.1","6.1.1",0,"6.1.1.7",null,0,"6.1.1.7.2","6.1.1.7.2: When changes are made to to T&Cs or fee schedules, are customer service personnel briefed to understand the impact of these changes before the changes are made?\n","1) Training plan / material for customer service staff, or customer service process documentation\n- Check that when changes are made to T&Cs / fees, the process requires a briefing to be given to customer care personnel prior to any changes being made.",0,"Standard Required","Required","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.1","6.1.1",null,"6.1.1.7",null,null,"6.1.1.7.2","6.1.1.9.3","When changes are made to to T&Cs or fee schedules, are customer service personnel briefed to understand the impact of these changes before the changes are made?","1) Training plan / material for customer service staff, or customer service process documentation\n- Check that when changes are made to T&Cs / fees, the process requires a briefing to be given to customer care personnel prior to any changes being made.",null,"Standard Required","Required","CustServ",null,null,"6","6.1","6.1.1",0,"6.1.1.7",0,0,"6.1.1.7.2","Lorsque des changements sont apportés aux conditions générales ou au barème tarifaire, les équipes du service client sont-elles correctement formées pour bien comprendre l’impact potentiel de ces changements avant qu’ils ne soient mis en oeuvre ?","1) Plan de formation/support de formation des équipes du service client, ou documentation du processus du service client\n- Vérifier que le processus nécessite de former les équipes d’assistance à la clientèle avant d’effectuer toute modification de CGU/de tarifs.",null,"Requis Normal","Requis","CustServ",0,null,"6","6.1","6.1.1",null,"6.1.1.7",null,0,"6.1.1.7.2","Cuando se realizan cambios a los términos y condiciones o a los regímenes tarifarios, ¿se informa al personal de atención al cliente para que comprenda el impacto de estos cambios antes de que sean realizados?","1) Plan de capacitación / material para el personal de atención al cliente, o documentación de procesos de atención al cliente\n- Verificar que cuando se realizan cambios a los términos y condiciones / tarifas, el proceso requiera que se informe al personal de atención al cliente antes de realizar cualquier cambio.",null,"Obligatorio estándar","Obligatorio","CustServ",null,null,"6","6.1","6.1.1",null,"6.1.1.7",null,0,"6.1.1.7.2",null,null,null,"ReqS4","Req4","CustServ",null,null,null,null,null,null,null,null,"6.1.1.9.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"6","6.1","6.1.1",0,"6.1.1.8","6.1.1.8: INFORM CUSTOMERS OF KYC REQUIREMENTS FOR OPENING ACCOUNTS IN DIFFERENT KYC TIERS\nProviders should ensure that customers are made aware of all KYC requirements for opening an account, and where relevant, the KYC requirements for different KYC tiers. These requirements should be included in the T&Cs or be available on request from agents or customer care.\n\nAccount transaction / balance limits for each KYC tier should be made explicit in the T&Cs. If additional KYC verification must be carried out by the provider then this should be explained, especially if the customer's ability to use the service is limited until the KYC verification is completed.",0,"6.1.1.8.1","6.1.1.8.1: Are the KYC requirements for opening an account and for different KYC tiers made clear to customers, and particularly at the point of registration?\n","1) Point of sale (agent) material / customer T&Cs / customer service training material / customer communication material\n- Check that registering agents have material to give customers full information on the KYC requirements for opening an account.\n- Check the material includes the KYC requirements for opening an account/different KYC tiers.\n",0,"Urgent Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.1","6.1.1",null,"6.1.1.8","INFORM CUSTOMERS OF KYC REQUIREMENTS FOR OPENING ACCOUNTS IN DIFFERENT KYC TIERS\nProviders should ensure that customers are made aware of all KYC requirements for opening an account, and where relevant, the KYC requirements for different KYC tiers. These requirements should be included in the T&Cs or be available on request from agents or customer care.\n\nAccount transaction / balance limits for each KYC tier should be made explicit in the T&Cs. If additional KYC verification must be carried out by the provider then this should be explained, especially if the customer's ability to use the service is limited until the KYC verification is completed.",null,"6.1.1.8.1","6.1.1.10.1","Are the KYC requirements for opening an account and for different KYC tiers made clear to customers, and particularly at the point of registration?","1) Point of sale (agent) material / customer T&Cs / customer service training material / customer communication material\n- Check that registering agents have material to give customers full information on the KYC requirements for opening an account.\n- Check the material includes the KYC requirements for opening an account/different KYC tiers.\n",null,"Urgent Required","Required","BizOps",null,null,"6","6.1","6.1.1",0,"6.1.1.8","INFORMATION DES CLIENTS SUR LES FORMALITÉS DE VÉRIFICATION D'IDENTITÉ PAR TYPE DE COMPTE\nLes prestataires doivent s’assurer que les clients sont informés des obligations de vérification d’identité (KYC) à l’ouverture des comptes, et le cas échéant, des formalités applicables à chaque niveau de compte. Les formalités doivent figurer dans les CGU ou être disponibles sur demande auprès des agents ou du service client \n\nLes plafonds d’opération et de solde des comptes correspondant à chaque niveau de vérification d’identité doivent être clairement expliqués dans les CGU. Lorsque le prestataire doit effectuer des vérifications supplémentaires, cela doit être clairement expliqué, notamment si le client n’a pas possibilité d’utiliser complètement le service tant que ces vérifications ne sont pas effectuées.\n",0,"6.1.1.8.1","les exigences de vérification d'identité pour l'ouverture d'un compte et pour les différents niveaux de compte sont-elles clairement communiquées aux clients, notamment lors de leur enregistrement ?","1) Supports de point de vente (agent)/CGU clients/support de formation au service client/supports de communication aux clients\n- Vérifier que les agents chargés de l’enregistrement des clients disposent des supports appropriés afin de donner aux clients toutes les informations nécessaires concernant les exigences de vérification d’identité pour l’ouverture d’un compte.\n- Vérifier que ces supports couvrent les exigences de vérification d’identité pour l’ouverture d’un compte/pour chaque niveau de compte.\n",null,"Requis Prioritaire","Requis","BizOps",0,null,"6","6.1","6.1.1",null,"6.1.1.8","INFORMAR A LOS CLIENTES LOS REQUISITOS DE REGISTROS DE CONOCIMIENTO DEL CLIENTE (CSC) PARA ABRIR CUENTAS EN LAS DIFERENTES CAPAS DE CSC\nLos proveedores deben garantizar que se informen a los clientes todos los requisitos de CSC para la apertura de cuentas y, cuando corresponda, los requisitos de CSC para las diferentes capas de CSC. Estos requisitos deben estar incluidos en los términos y condiciones o puestos a disposición a solicitud por parte de los agentes o de atención al cliente.\n\nLos términos y condiciones deben establecer explícitamente los límites de transacciones / saldo por cuenta para cada capa de CSC. Si el proveedor debe llevar a cabo una verificación de CSC adicional, esto se deben explicar, especialmente si la capacidad del cliente para utilizar el servicio se ve limitada hasta que se complete la verificación de CSC.",0,"6.1.1.8.1","¿Se aclaran los requisitos de CSC para abrir una cuenta y para las diferentes capas de CSC a los clientes, y particularmente, en el punto de registro?","1) Material del punto de venta (agente) / términos y condiciones del cliente / material de capacitación de atención al cliente / material de comunicación al cliente\n- Verificar que los puntos de registro cuenten con material para brindar a los clientes información completa acerca de los requisitos de CSC para abrir una cuenta.\n- Verificar que el material incluya los requisitos de CSC para abrir una cuenta/las diferentes capas de CSC.\n",null,"Obligatorio urgente","Obligatorio","BizOps",null,null,"6","6.1","6.1.1",null,"6.1.1.8",null,0,"6.1.1.8.1",null,null,null,"ReqU4","Req4","BizOps",null,null,null,null,null,null,null,null,"6.1.1.10.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",{"$f":"COUNTIF($DS21:$DV21,EH$3)","v":0},0,0,0,0,1,""]
[null,"6","6.1","6.1.1",0,"6.1.1.9","6.1.1.9: HELP CUSTOMERS TO LOCATE AGENTS, SERVICE CENTRES, AND OTHER RETAIL LOCATIONS\nProviders should provide tools to help customers locate agents, service centres, and other retail locations. These tools should be tailored to the needs of the target market.\n\nSuitable resources may include posters, customer care personnel and/or handset menus.",0,"6.1.1.9.1","6.1.1.9.1: Are customers provided with tools to locate agents, service centres, and other retail locations (e.g. posters, customer care personnel and/or handset menus)?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.1","6.1.1",null,"6.1.1.9","HELP CUSTOMERS TO LOCATE AGENTS, SERVICE CENTRES, AND OTHER RETAIL LOCATIONS\nProviders should provide tools to help customers locate agents, service centres, and other retail locations. These tools should be tailored to the needs of the target market.\n\nSuitable resources may include posters, customer care personnel and/or handset menus.",null,"6.1.1.9.1","6.1.1.11.1","Are customers provided with tools to locate agents, service centres, and other retail locations (e.g. posters, customer care personnel and/or handset menus)?",null,null,"Recommended","Recommended","BizOps",null,null,"6","6.1","6.1.1",0,"6.1.1.9","LOCALISATION DES AGENTS, DES CENTRES DE SERVICE ET AUTRES POINTS DE VENTE \nLes prestataires doivent mettre à disposition des clients des outils de localisation des agents, centres de service et autres points de vente. Ces outils doivent être adaptés aux besoins de la cible de clientèle.  \n\nLes ressources utilisables peuvent prendre la forme d’affiches, de menus téléphoniques, et/ou concerner les équipes du service client.\n",0,"6.1.1.9.1","est-ce que des outils de localisation des agents, des centres de service et autres points de vente sont mis à la disposition des clients (par le biais par exemple d'affiches, des équipes du service client et/ou de menus téléphoniques) ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"6","6.1","6.1.1",null,"6.1.1.9","AYUDAR A LOS CLIENTES A LOCALIZAR AGENTES, CENTROS DE ATENCIÓN AL CLIENTE, Y OTROS ESTABLECIMIENTOS MINORISTAS\nLos proveedores deben ofrecer herramientas para ayudar a los clientes a localizar agentes, centros de atención al cliente y otros establecimientos minoristas. Estas herramientas se deben ajustar a las necesidades del mercado objetivo.\n\nLos recursos adecuados pueden incluir carteles, personal de atención al cliente y/o menú de los dispositivos.",0,"6.1.1.9.1","¿Se ofrecen herramientas a los clientes para que localicen agentes, centros de atención al cliente y otros establecimientos minoristas (por ej., carteles, personal de atención al cliente y/o menú de los dispositivos)?",null,null,"Recomendado","Recomendado","BizOps",null,null,"6","6.1","6.1.1",null,"6.1.1.9",null,0,"6.1.1.9.1",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"6.1.1.11.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"6",0,0,{"$f":"UPPER(CONCATENATE(Introduction!C29,\": \",Introduction!D29))","v":"6.2: EDUCATION OF CUSTOMERS ABOUT SAFETY AND SECURITY"},null,null,0,0,{"$f":"Introduction!E29","v":"Providers shall educate customers about how to use mobile money services safely and securely"},null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,BK23,CA23,CQ23,DG23)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6",null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$29,\": \",Introduction!$L$29))","v":"6.2: EDUCATION OF CUSTOMERS ABOUT SAFETY AND SECURITY"},null,null,null,null,null,{"$f":"Introduction!$M$29","v":"Providers shall educate customers about how to use mobile money services safely and securely"},null,null,null,null,0,null,null,"6",0,0,null,0,null,0,0,"",null,null,null,null,0,null,null,"6",0,0,{"$f":"UPPER(CONCATENATE(Introduction!$U$29,\": \",Introduction!$V$29))","v":"6.2: EDUCACIÓN DE LOS CLIENTES SOBRE LA SEGURIDAD"},null,null,0,0,{"$f":"Introduction!W29","v":"El proveedor entrenará a los clientes sobre cómo utilizar los servicios del dinero móvil de manera segura"},null,null,null,null,0,null,null,"6",0,0,null,0,null,0,0,null,null,null,null,null,0]
[null,"6","6.2","6.2.1",{"$f":"CHOOSE(LanguageNumber,AY24,BP24,CF24,CV24)","v":"6.2.1: Providers shall educate customers about how to use mobile money services safely and securely"},"6.2.1.1",{"$f":"AZ24&\": \"&CHOOSE(LanguageNumber,BA24,BR24,CH24,CX24)","v":"6.2.1.1: EDUCATE CUSTOMERS ON HOW TO USE THE SERVICE SECURELY\nProviders should educate customers on how to use the mobile money service securely. Additional guidance may be required for customers who are not familiar with financial services. Guidance should include at least the following advice:\n- Lock phones with a code and do not leave phones unattended or accessible by other people;\n- Choose security credentials (PIN, password and/or any other credentials) that are difficult to guess;\n- Do not share security credentials with anyone, including customer care agents and mobile money agents;\n- Do not store security credentials in a manner that would allow them to easily be read by another person (e.g., taped to phone, on home screen, etc.); \n- Change security credentials if they may have compromised; and\n- Be aware of the risks of social engineering, such as phishing.\n\nProviders should inform customers that it is their responsibility to safeguard access to their account. Providers should also inform customers of any liability that they may assume for losses resulting from their failure to protect their security credentials and/or safeguard access to their accounts.\n\nPossible delivery channels include electronic content included in welcome messages, verbal explanations from agents or staff during account opening, physical documentation (e.g., brochures), and in the T&Cs."},0,"6.2.1.1.1",{"$f":"BC24&\": \"&CHOOSE(LanguageNumber,BE24,BU24,CK24,DA24)&CarriageReturn","v":"6.2.1.1.1: Are customers advised not to share security credentials (PIN) with anyone, including customer care agents and mobile money agents?\n"},{"$f":"CHOOSE(LanguageNumber,BF24,BV24,CL24,DB24)","v":"1) Customer communication plan / material\n- Check there is an awareness program for customers informing them not to share security credentials i.e. PIN\n- Check the program includes reference to not sharing PINs with customer care staff and agents."},{"$f":"CHOOSE(LanguageNumber,BG24,BW24,CM24,DC24)","v":0},{"$f":"CHOOSE(LanguageNumber,BH24,BX24,CN24,DD24)","v":"Standard Required"},{"$f":"CHOOSE(LanguageNumber,BI24,BY24,CO24,DE24)","v":"Required"},"BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.2","6.2.1","6.2.1: Providers shall educate customers about how to use mobile money services safely and securely","6.2.1.1","EDUCATE CUSTOMERS ON HOW TO USE THE SERVICE SECURELY\nProviders should educate customers on how to use the mobile money service securely. Additional guidance may be required for customers who are not familiar with financial services. Guidance should include at least the following advice:\n- Lock phones with a code and do not leave phones unattended or accessible by other people;\n- Choose security credentials (PIN, password and/or any other credentials) that are difficult to guess;\n- Do not share security credentials with anyone, including customer care agents and mobile money agents;\n- Do not store security credentials in a manner that would allow them to easily be read by another person (e.g., taped to phone, on home screen, etc.); \n- Change security credentials if they may have compromised; and\n- Be aware of the risks of social engineering, such as phishing.\n\nProviders should inform customers that it is their responsibility to safeguard access to their account. Providers should also inform customers of any liability that they may assume for losses resulting from their failure to protect their security credentials and/or safeguard access to their accounts.\n\nPossible delivery channels include electronic content included in welcome messages, verbal explanations from agents or staff during account opening, physical documentation (e.g., brochures), and in the T&Cs.",null,"6.2.1.1.1","6.2.1.1.3","Are customers advised not to share security credentials (PIN) with anyone, including customer care agents and mobile money agents?","1) Customer communication plan / material\n- Check there is an awareness program for customers informing them not to share security credentials i.e. PIN\n- Check the program includes reference to not sharing PINs with customer care staff and agents.",null,"Standard Required","Required","BizOps",null,null,"6","6.2","6.2.1","6.2.1 : Les prestataires doivent conseiller les clients sur la façon d’utiliser le service d’argent mobile en toute sécurité.","6.2.1.1","CONSEILLER LES CLIENTS SUR LA FAÇON D’UTILISER LE SERVICE EN TOUTE SÉCURITÉ\nLes prestataires doivent conseiller les clients sur la façon d’utiliser le service d’argent mobile en toute sécurité. Il peut être nécessaire de fournir des directives supplémentaires aux clients qui ne connaissent pas les services financiers. Ces directives doivent inclurent au minimum les conseils suivants :\n- Protéger son téléphone au moyen d’un code confidentiel et ne pas le laisser sans surveillance ou à la disposition d’autres personnes ;\n- Choisir des identifiants de sécurité (code confidentiel, mot de passe et/ou autres identifiants) difficiles à deviner ;\n- Ne pas communiquer ses identifiants de sécurité à qui que ce soit, y compris le personnel du service client ou les agents de l’argent mobile :\n- Ne pas conserver ses identifiants de sécurité à portée d’autres personnes (par ex. scotchés sur le téléphone, sur l’écran d’accueil, etc.) ; \n- Changer ses identifiants de sécurité si ceux-ci ont été possiblement compromis ; et\n- Être conscient des risques de manipulation sociale, comme le \"hameçonnage\".\n\nLes prestataires doivent informer les clients du fait qu’il incombe à ces derniers de protéger l’accès à leur compte. Les prestataires doivent informer les clients de leur responsabilité en cas de perte résultant d’un défaut de protection de leurs identifiants de sécurité et/ou de l’accès à leur compte.\n\nLes canaux de livraison incluent le contenu électronique des messages d’accueil, les explications transmises oralement par les agents ou le personnel lors de l’ouverture du compte, la documentation physique (par exemple, les brochures) et les CGU.",0,"6.2.1.1.1","est-il conseillé aux clients de ne pas communiquer leurs identifiants de sécurité (code confidentiel) à qui que ce soit, y compris le personnel du service client ou les agents de l’argent mobile ?","1) Plan/supports de communication aux clients\n- Vérifier qu’un programme de sensibilisation a été mis en œuvre auprès des clients afin de leur conseiller de ne pas communiquer leurs identifiants de sécurité (code confidentiel)\n- Vérifier que le programme informe également les clients de l’importance de ne pas communiquer leur code confidentiel au personnel du service client et aux agents.",null,{"$f":"VLOOKUP($BH24,CategoryTranslationTable,2,FALSE)","v":"Requis Normal"},{"$f":"VLOOKUP($BI24,CategoryTranslationTable,2,FALSE)","v":"Requis"},"BizOps",0,null,"6","6.2","6.2.1","6.2.1: Los proveedores deben educar a los clientes sobre cómo utilizar los servicios del dinero móvil de forma segura.","6.2.1.1","EDUCAR A LOS CLIENTES SOBRE CÓMO UTILIZAR EL SERVICIO DE FORMA SEGURA\nLos proveedores deben educar a los clientes sobre cómo utilizar el servicio del dinero móvil de forma segura. Se puede requerir orientación adicional para los clientes que no están familiarizados con los servicios financieros. La orientación debe incluir, al menos, las siguientes recomendaciones:\n- Bloquear los teléfonos con un código y no dejarlos desatendidos o al alcance de otras personas;\n- Elegir credenciales de seguridad (PIN, contraseña y/u otras credenciales) difíciles de adivinar;\n- No compartir las credenciales de seguridad con nadie, ni siquiera con los agentes de atención al cliente y los agentes del dinero móvil;\n- No almacenar las credenciales de seguridad de manera que puedan ser fácilmente leídas por otra persona (por ej., grabadas en el teléfono, en la pantalla principal, etc.); \n- Cambiar las credenciales de seguridad que puedan estar comprometidas; y\n- Conocer los riesgos de ingeniería social, como suplantación de identidad.\n\nLos proveedores deben informar a los clientes que son responsables de proteger el acceso a su cuenta. Los proveedores también deben informar a los clientes sobre toda responsabilidad en la que pueden incurrir por pérdidas resultantes de la falta de protección de sus credenciales de seguridad y/o falta de protección de acceso a sus cuentas.\n\nLos canales de entrega posibles incluyen el contenido electrónico en los mensajes de bienvenida, explicaciones verbales de los agentes o el personal durante la apertura de la cuenta, documentación física (por ej., folletos) y en los términos y condiciones.",0,"6.2.1.1.1","¿Se recomienda a los clientes que no compartan las credenciales de seguridad (PIN) con nadie, ni siquiera con los agentes de atención al cliente y agentes del dinero móvil?","1) Plan / material de comunicación al cliente\n- Verificar que exista un programa de concientización para informar a los clientes que no deben compartir las credenciales de seguridad, es decir, el PIN\n- Verificar que el programa haga referencia a no compartir los PIN con el personal y los agentes de atención al cliente.",null,{"$f":"VLOOKUP($BH24,CategoryTranslationTable,3,FALSE)","v":"Obligatorio estándar"},{"$f":"VLOOKUP($BI24,CategoryTranslationTable,3,FALSE)","v":"Obligatorio"},"BizOps",null,null,"6","6.2","6.2.1",null,"6.2.1.1",null,0,"6.2.1.1.1",null,null,null,{"$f":"VLOOKUP($BH24,CategoryTranslationTable,4,FALSE)","v":"ReqS4"},{"$f":"VLOOKUP($BI24,CategoryTranslationTable,4,FALSE)","v":"Req4"},"BizOps",null,null,null,null,null,null,null,null,"6.2.1.1.3",null,null,null,{"$f":"IF(OR($EA24=0,$EA24=2),VLOOKUP(DO24,INDIRECT(ED24),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP24),\"\",VLOOKUP(DP24,INDIRECT(EE24),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ24),\"\",VLOOKUP(DQ24,INDIRECT(EF24),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR24),\"\",VLOOKUP(DR24,INDIRECT(EG24),7,FALSE))","v":""},{"$f":"IF(OR($EA24=0,$EA24=2),VLOOKUP(DO24,INDIRECT(ED24),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP24),\"\",VLOOKUP(DP24,INDIRECT(EE24),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ24),\"\",VLOOKUP(DQ24,INDIRECT(EF24),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR24),\"\",VLOOKUP(DR24,INDIRECT(EG24),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN24,3)=\"NEW\")+2*AND(LEFT(DN24,3)=\"MER\")+3*AND(LEFT(DN24,3)=\"MOV\")+4*AND(LEFT(DN24,3)=\"SWA\")","v":0},{"$error":"#REF!"},{"$f":"IF(EA24=0,IF(DW24=0,\"\",DW24),CHOOSE(EA24,\"New indicator\",CONCATENATE(DW24,CarriageReturn,DX24,CarriageReturn,DY24,CarriageReturn,DZ24)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO24,1)","v":"OriginalComplianceP6"},{"$f":"\"OriginalComplianceP\"&LEFT(DP24,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ24,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR24,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,""]
[null,"6","6.2","6.2.1",0,"6.2.1.1",null,0,"6.2.1.1.2","6.2.1.1.2: Are customers advised not to store security credentials (PIN) in a manner that would allow them to easily be read by another person (e.g. taped to phone, on home screen, etc.)?\n","1) Customer communication plan / material\n- Check there is an awareness program for customers informing them not to write/store security credentials  (i.e. PIN) in a way that can be easily read by another person.",0,"Standard Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.2","6.2.1",null,"6.2.1.1",null,null,"6.2.1.1.2","6.2.1.1.4","Are customers advised not to store security credentials (PIN) in a manner that would allow them to easily be read by another person (e.g. taped to phone, on home screen, etc.)?","1) Customer communication plan / material\n- Check there is an awareness program for customers informing them not to write/store security credentials  (i.e. PIN) in a way that can be easily read by another person.",null,"Standard Required","Required","BizOps",null,null,"6","6.2","6.2.1",0,"6.2.1.1",null,0,"6.2.1.1.2","est-il conseillé aux clients de ne pas conserver leurs identifiants de sécurité (code confidentiel) à portée d’autres personnes (par ex. scotchés sur le téléphone, sur l’écran d’accueil, etc.) ?","1) Plan/supports de communication aux clients\n- Vérifier qu’un programme de sensibilisation a été mis en œuvre auprès des clients afin de leur conseiller de ne pas noter par écrit/stocker leurs identifiants de sécurité (code confidentiel) sur des supports ou dans des endroits facilement accessibles par d’autres personnes.",null,"Requis Normal","Requis","BizOps",0,null,"6","6.2","6.2.1",null,"6.2.1.1",null,0,"6.2.1.1.2","¿Se advierte a los clientes que no almacenen las credenciales de seguridad (PIN) de manera que puedan ser fácilmente leídas por otra persona (por ej., grabadas en el teléfono, en la pantalla principal, etc.?","1) Plan / material de comunicación al cliente\n- Verificar que exista un programa de concientización para informar a los clientes que no escriban/almacenen las credenciales de seguridad (es decir, el PIN) de manera que puedan ser fácilmente leídas por otra persona.",null,"Obligatorio estándar","Obligatorio","BizOps",null,null,"6","6.2","6.2.1",null,"6.2.1.1",null,0,"6.2.1.1.2",null,null,null,"ReqS4","Req4","BizOps",null,null,null,null,null,null,null,null,"6.2.1.1.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"6","6.2","6.2.1",0,"6.2.1.1",null,0,"6.2.1.1.3","6.2.1.1.3: Are customers advised to change security credentials (PIN) if they may be compromised?\n",{"$f":"CHOOSE(LanguageNumber,BF26,BV26,CL26,DB26)","v":"1) Customer communication plan / material\n- Check there is an awareness program for customers informing them change security credentials (i.e. PIN) if they think they have been compromised."},0,"Standard Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.2","6.2.1",null,"6.2.1.1",null,null,"6.2.1.1.3","6.2.1.1.5","Are customers advised to change security credentials (PIN) if they may be compromised?","1) Customer communication plan / material\n- Check there is an awareness program for customers informing them change security credentials (i.e. PIN) if they think they have been compromised.",null,"Standard Required","Required","BizOps",null,null,"6","6.2","6.2.1",0,"6.2.1.1",null,0,"6.2.1.1.3","est-il conseillé aux clients de changer leurs identifiants de sécurité (code confidentiel) si ceux-ci ont été possiblement compromis ?","1) Plan/supports de communication aux clients\n- Vérifier qu’un programme de sensibilisation a été mis en œuvre auprès des clients afin de leur conseiller de changer leurs identifiants (code confidentiel) s’ils pensent que ceux-ci ont été compris.",null,"Requis Normal","Requis","BizOps",0,null,"6","6.2","6.2.1",null,"6.2.1.1",null,0,"6.2.1.1.3","¿Se advierte a los clientes que cambien las credenciales de seguridad (PIN) si pudieran estar comprometidas?","1) Plan / material de comunicación al cliente\n- Verificar que exista un programa de concientización para informar a los clientes que cambien las credenciales de seguridad (es decir, PIN) si creen que podrían estar comprometidas.",null,"Obligatorio estándar","Obligatorio","BizOps",null,null,"6","6.2","6.2.1",null,"6.2.1.1",null,0,"6.2.1.1.3",null,null,null,"ReqS4","Req4","BizOps",null,null,null,null,null,null,null,null,"6.2.1.1.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"6","6.2","6.2.1",{"$f":"CHOOSE(LanguageNumber,AY27,BP27,CF27,CV27)","v":0},"6.2.1.1",null,null,{"$f":"BC27","v":"6.2.1.1.4"},"6.2.1.1.4: Have customers been informed of any liability that they may assume for losses resulting from their failure to protect their security credentials and/or safeguard access to their accounts.\n",{"$f":"CHOOSE(LanguageNumber,BF27,BV27,CL27,DB27)","v":"1) Customer communication plan / material \n- Check there are communication materials (or clause in the T&Cs) to tell customers that they could lose money if their PIN is not protected."},0,{"$f":"CHOOSE(LanguageNumber,BH27,BX27,CN27,DD27)","v":"Standard Required"},{"$f":"CHOOSE(LanguageNumber,BI27,BY27,CO27,DE27)","v":"Required"},"BizOps",{"$f":"CHOOSE(LanguageNumber,BK27,CA27,CQ27,DG27)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.2","6.2.1",null,"6.2.1.1",null,null,"6.2.1.1.4","6.2.1.1.7","Have customers been informed of any liability that they may assume for losses resulting from their failure to protect their security credentials and/or safeguard access to their accounts.","1) Customer communication plan / material \n- Check there are communication materials (or clause in the T&Cs) to tell customers that they could lose money if their PIN is not protected.",null,"Standard Required","Required","BizOps",null,null,"6","6.2","6.2.1",null,"6.2.1.1",null,null,{"$f":"BC27","v":"6.2.1.1.4"},"les clients sont-ils informés de leur responsabilité en cas de perte résultant d’un défaut, de leur part, de protection de leurs identifiants de sécurité et/ou de l’accès à leur compte ?","1) Plan/supports de communication aux clients \n- Vérifier que des supports de communication (ou une clause dans les conditions générales) informent les clients qu'ils risquent de perdre de l'argent si leur code confidentiel n'est pas protégé.",null,"Requis Normal","Requis","BizOps",0,null,"6","6.2","6.2.1",null,"6.2.1.1",null,null,"6.2.1.1.4","¿Se informó a los clientes sobre toda responsabilidad en la que podrían incurrir por pérdidas resultantes de la falta de protección de sus credenciales de seguridad y/o falta de protección de acceso a sus cuentas?","1) Plan / material de comunicación al cliente\n- Verificar que existan materiales de comunicación (o cláusulas en los términos y condiciones) para informar a los clientes que podrían perder dinero si no protegen su PIN.",null,"Obligatorio estándar","Obligatorio","BizOps",null,null,"6","6.2","6.2.1",null,"6.2.1.1",null,null,"6.2.1.1.4",null,null,null,"ReqS4","Req4","BizOps",null,null,null,null,null,null,null,null,"6.2.1.1.7",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"6","6.2","6.2.1",{"$f":"CHOOSE(LanguageNumber,AY28,BP28,CF28,CV28)","v":0},"6.2.1.1",null,null,{"$f":"BC28","v":"6.2.1.1.5"},"6.2.1.1.5: Are customers advised to lock their phones with a code and not to leave their phone unattended or accessible by other people?\n",{"$f":"CHOOSE(LanguageNumber,BF28,BV28,CL28,DB28)","v":0},0,{"$f":"CHOOSE(LanguageNumber,BH28,BX28,CN28,DD28)","v":"Recommended"},{"$f":"CHOOSE(LanguageNumber,BI28,BY28,CO28,DE28)","v":"Recommended"},"BizOps",{"$f":"CHOOSE(LanguageNumber,BK28,CA28,CQ28,DG28)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.2","6.2.1",null,"6.2.1.1",null,null,"6.2.1.1.5","6.2.1.1.1","Are customers advised to lock their phones with a code and not to leave their phone unattended or accessible by other people?",null,null,"Recommended","Recommended","BizOps",null,null,"6","6.2","6.2.1",null,"6.2.1.1",null,null,{"$f":"BC28","v":"6.2.1.1.5"},"est-il conseillé aux clients de protéger leur téléphone au moyen d’un code confidentiel et de ne pas le laisser sans surveillance ou à la disposition d’autres personnes ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"6","6.2","6.2.1",null,"6.2.1.1",null,null,"6.2.1.1.5","¿Se recomienda a los clientes que bloqueen sus teléfonos con un código y que no los dejen desatendidos o al alcance de otras personas?",null,null,"Recomendado","Recomendado","BizOps",null,null,"6","6.2","6.2.1",null,"6.2.1.1",null,null,"6.2.1.1.5",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"6.2.1.1.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"6","6.2","6.2.1",0,"6.2.1.1",null,null,"6.2.1.1.6","6.2.1.1.6: Are customers advised to choose security credentials (PIN, password and/or any other credentials) that are difficult to guess?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.2","6.2.1",null,"6.2.1.1",null,null,"6.2.1.1.6","6.2.1.1.2","Are customers advised to choose security credentials (PIN, password and/or any other credentials) that are difficult to guess?",null,null,"Recommended","Recommended","BizOps",null,null,"6","6.2","6.2.1",null,"6.2.1.1",null,null,"6.2.1.1.6","est-il conseillé aux clients de choisir des identifiants de sécurité (code confidentiel, mot de passe et/ou autres identifiants) difficiles à deviner ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"6","6.2","6.2.1",null,"6.2.1.1",null,null,"6.2.1.1.6","¿Se recomienda a los clientes que elijan credenciales de seguridad (PIN, contraseña y/u otras credenciales) difíciles de adivinar?",null,null,"Recomendado","Recomendado","BizOps",null,null,"6","6.2","6.2.1",null,"6.2.1.1",null,null,"6.2.1.1.6",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"6.2.1.1.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"6","6.2","6.2.1",0,"6.2.1.1",null,0,{"$f":"BC30","v":"6.2.1.1.7"},"6.2.1.1.7: Are customers advised to be aware of the risks of social engineering, such as phishing?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.2","6.2.1",null,"6.2.1.1",null,null,"6.2.1.1.7","6.2.1.1.6","Are customers advised to be aware of the risks of social engineering, such as phishing?",null,null,"Recommended","Recommended","BizOps",null,null,"6","6.2","6.2.1",0,"6.2.1.1",null,0,"6.2.1.1.7","les clients sont-ils avertis des risques de manipulation sociale, comme par exemple le « hameçonnage » (phishing) ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"6","6.2","6.2.1",null,"6.2.1.1",null,0,"6.2.1.1.7","¿Se informan a los clientes los riesgos de ingeniería social, como por ejemplo suplantación de identidad?",null,null,"Recomendado","Recomendado","BizOps",null,null,"6","6.2","6.2.1",null,"6.2.1.1",null,0,"6.2.1.1.7",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"6.2.1.1.6",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"6","6.2","6.2.1",0,"6.2.1.2","6.2.1.2: INFORM CUSTOMERS OF MOBILE MONEY FRAUD THREATS\nProviders should run information campaigns to inform customers of prevailing fraud threats (e.g. social engineering frauds, identity theft, or unsolicited offers etc.). Information should be distributed:\n- through the media; and/or\n- through direct contact with customers, e.g. by SMS or via agents.\n\nCampaigns should, where possible, be localized to areas or situations where fraudsters are known to be active.",0,"6.2.1.2.1","6.2.1.2.1: Are customers informed of prevailing mobile money fraud threats?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.2","6.2.1",null,"6.2.1.2","INFORM CUSTOMERS OF MOBILE MONEY FRAUD THREATS\nProviders should run information campaigns to inform customers of prevailing fraud threats (e.g. social engineering frauds, identity theft, or unsolicited offers etc.). Information should be distributed:\n- through the media; and/or\n- through direct contact with customers, e.g. by SMS or via agents.\n\nCampaigns should, where possible, be localized to areas or situations where fraudsters are known to be active.",null,"6.2.1.2.1","6.2.1.2.1","Are customers informed of prevailing mobile money fraud threats?",null,null,"Recommended","Recommended","BizOps",null,null,"6","6.2","6.2.1",0,"6.2.1.2","INFORMER LES CLIENTS DES RISQUES DE FRAUDE LIÉS À L’ARGENT MOBILE\nLes prestataires doivent mener des campagnes d’information pour sensibiliser les clients aux risques courants de fraude (ex. fraude par manipulation sociale, vol d’identité, offres non sollicitées, etc.). L’information+ doit être diffusée :\n- par le biais des médias\n- et/ou de contacts directs avec les clients, par exemple via SMS ou par l’intermédiaire des agents. \n\nDans la mesure du possible, ces campagnes doivent se concentrer autour des zones et des situations dans lesquelles des cas de fraude sont enregistrés.\n",0,"6.2.1.2.1","les clients sont-ils informés des risques les plus courants de fraude liée à l'argent mobile ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"6","6.2","6.2.1",null,"6.2.1.2","INFORMAR A LOS CLIENTES LAS AMENAZAS DE FRAUDE DEL DINERO MÓVIL\nLos proveedores deben realizar campañas de información para advertir a los clientes las principales amenazas de fraude (por ej., fraudes de ingeniería social, robo de identidad, u ofertas no solicitadas, etc.). La información debe ser distribuida:\n- a través de los medios de comunicación; y/o\n- por contacto directo con los clientes, por ej., por SMS o a través de los agentes.\n\nCuando sea posible, las campañas se deben localizar en áreas o situaciones en las que es sabido que los defraudadores están activos.",0,"6.2.1.2.1","¿Se informan a los clientes las principales amenazas de fraude del dinero móvil?",null,null,"Recomendado","Recomendado","BizOps",null,null,"6","6.2","6.2.1",null,"6.2.1.2",null,0,"6.2.1.2.1",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"6.2.1.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"6","6.2","6.2.1",0,"6.2.1.2",null,0,"6.2.1.2.2","6.2.1.2.2: Are information campaigns localized to inform customers of threats where fraudsters are known to be active?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.2","6.2.1",null,"6.2.1.2",null,null,"6.2.1.2.2","6.2.1.2.2","Are information campaigns localized to inform customers of threats where fraudsters are known to be active?",null,null,"Recommended","Recommended","BizOps",null,null,"6","6.2","6.2.1",0,"6.2.1.2",0,0,"6.2.1.2.2","les campagnes d'information sont-elles localisées de façon à informer les clients des menaces de fraude connues ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"6","6.2","6.2.1",null,"6.2.1.2",null,0,"6.2.1.2.2","¿Las campañas de información son localizadas para advertir las amenazas a los clientes donde es sabido que los defraudadores están activos?",null,null,"Recomendado","Recomendado","BizOps",null,null,"6","6.2","6.2.1",null,"6.2.1.2",null,0,"6.2.1.2.2",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"6.2.1.2.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"6","6.2","6.2.1",0,"6.2.1.3","6.2.1.3: EMERGENCY CONTACT DETAILS FOR LOSS OF HANDSET/SIM OR SUSPICIOUS ACTIVITY\nProviders should give customers emergency contact numbers for reporting (i) loss or theft of handset or SIM or (ii) suspicious or potentially illegal activity relating to the mobile money service. Where possible, providers should ensure that contact numbers are toll-free in order to reduce any barriers that customers may face when they need to call the emergency contact service, particularly when reporting loss or theft of a handset or SIM.",0,"6.2.1.3.1","6.2.1.3.1: Have contact numbers for reporting (i) loss or theft of handset or SIM or (ii) suspicious or illegal activity relating to the service been provided to customers?\n","1) Customer communication plan / material\n- Check there is a contact number for customers to call in the event of:\na) Loss or theft of handset/SIM\nb) Suspicious or potentially illegal activity relating to the service\n",0,"Standard Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.2","6.2.1",null,"6.2.1.3","EMERGENCY CONTACT DETAILS FOR LOSS OF HANDSET/SIM OR SUSPICIOUS ACTIVITY\nProviders should give customers emergency contact numbers for reporting (i) loss or theft of handset or SIM or (ii) suspicious or potentially illegal activity relating to the mobile money service. Where possible, providers should ensure that contact numbers are toll-free in order to reduce any barriers that customers may face when they need to call the emergency contact service, particularly when reporting loss or theft of a handset or SIM.",null,"6.2.1.3.1","6.2.1.3.1","Have contact numbers for reporting (i) loss or theft of handset or SIM or (ii) suspicious or illegal activity relating to the service been provided to customers?","1) Customer communication plan / material\n- Check there is a contact number for customers to call in the event of:\na) Loss or theft of handset/SIM\nb) Suspicious or potentially illegal activity relating to the service\n",null,"Standard Required","Required","BizOps",null,null,"6","6.2","6.2.1",0,"6.2.1.3","CONTACTS D’URGENCE EN CAS DE PERTE DE TÉLÉPHONE/CARTE SIM OU D’ACTIVITÉ SUSPECTE \nLes prestataires doivent communiquer aux clients des numéros d’appel d’urgence pour la déclaration (a) de la perte ou du vol de leur téléphone ou de leur carte SIM ou (b) de toute activité suspecte ou illicite liée au service d’argent mobile. Dans la mesure du possible, les prestataires doivent veiller à ce que l’appel de ces numéros soit gratuit afin de lever toute barrière susceptible d’empêcher les clients d’appeler, notamment en cas de perte ou de vol de leur téléphone ou de leur carte SIM.",0,"6.2.1.3.1","des numéros d'appel sont-ils fournis aux clients pour déclarer (a) la perte ou le vol de leur téléphone portable ou de leur carte SIM ou (b) les activités suspectes ou illégales liées au service d’argent mobile ?","1) Plan/supports de communication aux clients\n- Vérifier qu’un numéro d’appel est fourni aux clients pour déclarer :\na) La perte ou le vol de leur téléphone portable/de leur carte SIM\nb) Les activités suspectes ou potentiellement illégales liées au service\n",null,"Requis Normal","Requis","BizOps",0,null,"6","6.2","6.2.1",null,"6.2.1.3","DETALLES DE CONTACTO DE EMERGENCIA POR PÉRDIDA DEL DISPOSITIVO/SIM O ACTIVIDAD SOSPECHOSA\nLos proveedores deben brindar a los clientes números de contacto de emergencia para informar (i) la pérdida o robo del dispositivo o SIM o (ii) una actividad sospechosa o potencialmente ilegal relacionada con el servicio del dinero móvil. Cuando sea posible, los proveedores deben garantizar que los números de contacto sean gratuitos a fin de reducir todas las barreras con las que los clientes se podrían enfrentar cuando necesiten llamar al servicio de contacto de emergencia, especialmente para informar la pérdida o robo de un dispositivo o SIM.",0,"6.2.1.3.1","¿Se proporcionaron a los clientes números de contacto para informar (i) la pérdida o robo de un dispositivo o SIM o (ii) una actividad sospechosa o ilegal relacionada con el servicio?","1) Plan / material de comunicación al cliente\n- Verificar que exista un número de contacto para que los clientes llamen en caso de:\na) Pérdida a robo del dispositivo/SIM\nb) Actividad sospechosa o potencialmente ilegal relacionada con el servicio\n",null,"Obligatorio estándar","Obligatorio","BizOps",null,null,"6","6.2","6.2.1",null,"6.2.1.3",null,0,"6.2.1.3.1",null,null,null,"ReqS4","Req4","BizOps",null,null,null,null,null,null,null,null,"6.2.1.3.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"6","6.2","6.2.1",0,"6.2.1.3",null,0,"6.2.1.3.2","6.2.1.3.2: Has a national toll-free number been provided to customers for reporting lost or stolen handsets or SIMs?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.2","6.2.1",null,"6.2.1.3",null,null,"6.2.1.3.2","6.2.1.3.2","Has a national toll-free number been provided to customers for reporting lost or stolen handsets or SIMs?",null,null,"Recommended","Recommended","BizOps",null,null,"6","6.2","6.2.1",0,"6.2.1.3",0,0,"6.2.1.3.2","un numéro d'appel gratuit national est-il mis à la disposition des clients pour déclarer la perte ou le vol de leur téléphone portable ou de leur carte SIM ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"6","6.2","6.2.1",null,"6.2.1.3",null,0,"6.2.1.3.2","¿Se proporcionó a los clientes un número nacional gratuito para que informen la pérdida o robo de sus dispositivos o SIM?",null,null,"Recomendado","Recomendado","BizOps",null,null,"6","6.2","6.2.1",null,"6.2.1.3",null,0,"6.2.1.3.2",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"6.2.1.3.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"6","6.2","6.2.1",0,"6.2.1.4","6.2.1.4: ENTERING SECURITY CREDENTIALS AND RESETTING ACCOUNT ACCESS\nCustomers should be: \n- instructed on how to properly input security credentials;\n- informed of the impact of incorrectly inputting security credentials (e.g., account access locked).\n\nCustomer service personnel should be trained in how to reset PINs securely when a customer's account has been locked because security credentials have been incorrectly input a certain number of times.",0,"6.2.1.4.1","6.2.1.4.1: Are customers informed of the impact of incorrectly entering security credentials (e.g. account access locked)?\n","1) Customer communication plan / material\n- Check there is some customer communication to make customers aware of the impact of entering security credentials incorrectly (e.g. T&Cs, system message).",0,"Standard Required","Required","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.2","6.2.1",null,"6.2.1.4","ENTERING SECURITY CREDENTIALS AND RESETTING ACCOUNT ACCESS\nCustomers should be: \n- instructed on how to properly input security credentials;\n- informed of the impact of incorrectly inputting security credentials (e.g., account access locked).\n\nCustomer service personnel should be trained in how to reset PINs securely when a customer's account has been locked because security credentials have been incorrectly input a certain number of times.",null,"6.2.1.4.1","6.2.1.4.2","Are customers informed of the impact of incorrectly entering security credentials (e.g. account access locked)?","1) Customer communication plan / material\n- Check there is some customer communication to make customers aware of the impact of entering security credentials incorrectly (e.g. T&Cs, system message).",null,"Standard Required","Required","CustServ",null,null,"6","6.2","6.2.1",0,"6.2.1.4","SAISIE DES IDENTIFIANTS DE SÉCURITÉ ET RÉINITIALISATION DE L’ACCÈS AU COMPTE\nLes clients doivent être informés : \n- de la manière correcte de saisir leurs identifiants de sécurité ;\n- des conséquences d’une mauvaise saisie de leurs identifiants de sécurité (ex. blocage de l'accès au compte) ;\n\nLes équipes du service client doivent être formées à la réinitialisation sécurisée des codes confidentiels lorsque le compte de client a été bloqué car des identifiants de sécurité erronés ont été saisis un certain nombre de fois.",0,"6.2.1.4.1","les clients sont-ils informés des conséquences d’une mauvaise saisie de leurs identifiants de sécurité (ex. blocage de l'accès au compte)?","1) Plan/supports de communication aux clients\n- Vérifier que les clients sont informés des conséquences d’une mauvaise saisie de leurs identifiants de sécurité (par exemple, CGU, message du système).",null,"Requis Normal","Requis","CustServ",0,null,"6","6.2","6.2.1",null,"6.2.1.4","INGRESAR CREDENCIALES DE SEGURIDAD Y RESTABLECER EL ACCESO A LA CUENTA\nLos clientes deben ser: \n- instruidos sobre cómo ingresar correctamente las credenciales de seguridad;\n- informados acerca del impacto de ingresar incorrectamente las credenciales de seguridad (por ej., acceso a la cuenta bloqueado).\n\nEl personal de atención al cliente debe recibir capacitación sobre cómo restablecer los PIN de forma segura cuando la cuenta de un cliente ha sido bloqueada porque las credenciales de seguridad fueron ingresadas incorrectamente una cierta cantidad de veces.",0,"6.2.1.4.1","¿Se informa a los clientes el impacto de ingresar incorrectamente las credenciales de seguridad (por ej., acceso a la cuenta bloqueado)?","1) Plan / material de comunicación del cliente\n- Verificar que exista algún material para comunicar a los clientes el impacto de ingresar incorrectamente las credenciales de seguridad (por ej., términos y condiciones, mensajes del sistema).",null,"Obligatorio estándar","Obligatorio","CustServ",null,null,"6","6.2","6.2.1",null,"6.2.1.4",null,0,"6.2.1.4.1",null,null,null,"ReqS4","Req4","CustServ",null,null,null,null,null,null,null,null,"6.2.1.4.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"6","6.2","6.2.1",0,"6.2.1.4",null,0,"6.2.1.4.2","6.2.1.4.2: Are customer service staff trained in how to reset PINs securely when a customer's account has been locked?\n","1) Training plan / material for customer service staff, or customer service process documentation\n- Check that customer service personnel are trained in how to reset PINs securely when a customer's account has been locked.\n",0,"Urgent Required","Required","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.2","6.2.1",null,"6.2.1.4",null,null,"6.2.1.4.2","6.2.1.4.3","Are customer service staff trained in how to reset PINs securely when a customer's account has been locked?","1) Training plan / material for customer service staff, or customer service process documentation\n- Check that customer service personnel are trained in how to reset PINs securely when a customer's account has been locked.\n",null,"Urgent Required","Required","CustServ",null,null,"6","6.2","6.2.1",0,"6.2.1.4",null,0,"6.2.1.4.2","Les équipes du service client sont-elles formées à la réinitialisation sécurisées des codes confidentiels lorsqu’un compte client a été bloqué ?\n","1) Plan de formation/support de formation des équipes du service client, ou documentation du processus du service client\n- Vérifier que le personnel du service client est formé au processus sécurisé de réinitialisation des codes confidentiels lorsque le compte d’un client a été bloqué.\n",null,"Requis Prioritaire","Requis","CustServ",0,null,"6","6.2","6.2.1",null,"6.2.1.4",null,0,"6.2.1.4.2","¿El personal de atención al cliente recibe capacitación sobre cómo restablecer la cuenta de un cliente que ha sido bloqueada?\n","1) Plan de capacitación / material para el personal de atención al cliente, o documentación de procesos de atención al cliente\n- Verificar que el personal de atención al cliente reciba capacitación sobre cómo restablecer los PIN de forma segura cuando la cuenta de un cliente fue bloqueada.\n",null,"Obligatorio urgente","Obligatorio","CustServ",null,null,"6","6.2","6.2.1",null,"6.2.1.4",null,0,"6.2.1.4.2",null,null,null,"ReqU4","Req4","CustServ",null,null,null,null,null,null,null,null,"6.2.1.4.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"6","6.2","6.2.1",0,"6.2.1.5",{"$f":"AZ37&\": \"&CHOOSE(LanguageNumber,BA37,BR37,CH37,CX37)","v":"6.2.1.5: EXERCISING CAUTION WITH CASH-IN/-OUT TRANSACTIONS AT AGENTS\nProviders should advise customers on how to exercise caution when conducting cash-in or cash-out transactions at agent locations. Customers should confirm the following while still at the agent or other cash-in or cash-out location:\n- For cash-in transactions, confirm that the balance on their mobile money account includes the full amount that they have deposited (less any authorised fees); and\n- For cash-out transactions, confirm that they have the correct amount of cash, that the notes appear genuine, and that the remaining balance in their account is correct."},0,"6.2.1.5.1","6.2.1.5.1: For cash-in transactions, are customers advised to make sure that their transaction has completed successfully and that the balance on their mobile money account includes the full amount that they have deposited (less any authorised fees)?\n","1) Customer communication plan / material \n- Check there are communication mechanisms or T&Cs to make customers aware that they should:\n     a) Check their cash-in transaction has completed successfully;\n     b) Check the balance on their mobile money account includes the full amount that they have deposited (less any authorised fees).",0,"Urgent Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.2","6.2.1",null,"6.2.1.5","EXERCISING CAUTION WITH CASH-IN/-OUT TRANSACTIONS AT AGENTS\nProviders should advise customers on how to exercise caution when conducting cash-in or cash-out transactions at agent locations. Customers should confirm the following while still at the agent or other cash-in or cash-out location:\n- For cash-in transactions, confirm that the balance on their mobile money account includes the full amount that they have deposited (less any authorised fees); and\n- For cash-out transactions, confirm that they have the correct amount of cash, that the notes appear genuine, and that the remaining balance in their account is correct.",null,"6.2.1.5.1","6.2.1.5.1","For cash-in transactions, are customers advised to make sure that their transaction has completed successfully and that the balance on their mobile money account includes the full amount that they have deposited (less any authorised fees)?","1) Customer communication plan / material \n- Check there are communication mechanisms or T&Cs to make customers aware that they should:\n     a) Check their cash-in transaction has completed successfully;\n     b) Check the balance on their mobile money account includes the full amount that they have deposited (less any authorised fees).",null,"Urgent Required","Required","BizOps",null,null,"6","6.2","6.2.1",0,"6.2.1.5","PRÉCAUTIONS À PRENDRE LORS DES OPÉRATIONS DE DÉPÔT ET RETRAIT D’ESPÈCES CHEZ LES AGENTS\nLes prestataires doivent informer les clients des mesures de précaution à prendre lors des opérations de dépôt ou de retrait d’espèces chez des agents. Les clients doivent vérifier les éléments suivants avant de quitter le point de service de l’agent ou tout autre lieu de dépôt ou retrait d’espèces :\n- pour les dépôts d’espèces, vérifier que le solde de leur compte d’argent mobile inclut le montant total de leur dépôt (après déduction des commissions applicables) ;\n- pour les retraits d’espèces, vérifier le montant exact des espèces retirées, qu’il ne s’agit pas de monnaie contrefaite et que le solde restant sur leur compte est correct. ",0,"6.2.1.5.1","pour les opérations de dépôt d’espèces, est-il conseillé aux clients de vérifier que la transaction a bien été réalisée et que le solde de leur compte reflète le montant total du dépôt (moins les commissions applicables) ?","1) Plan/supports de communication aux clients\n\r- Vérifier que des mécanismes de communication ou des CGU ont été établi(e)s pour conseiller aux clients de \n:\ra) Vérifier, pour les opérations de dépôt d’espèces, que la transaction a bien été réalisée ;\r\nb) Vérifier que le solde de leur compte d’argent mobile reflète le montant total du dépôt (après soustraction des frais autorisés).",null,"Requis Prioritaire","Requis","BizOps",0,null,"6","6.2","6.2.1",null,"6.2.1.5","SER CAUTELOSO CON LAS TRANSACCIONES DE INGRESO/RETIRO DE EFECTIVO EN LOS AGENTES\nLos proveedores deben informar a los clientes cómo ser cautelosos a la hora de realizar transacciones de ingreso/retiros de efectivo en las ubicaciones de los agentes. Los clientes deben confirmar lo siguiente mientras se encuentran con el agente o en otra ubicación de ingreso o retiro de efectivo:\n- Para las transacciones de ingreso de efectivo, confirmar que el saldo en su cuenta del dinero móvil incluya el monto total que depositaron (menos las comisiones autorizadas); y\n- Para las transacciones de retiro de efectivo, confirmar que tienen el monto de efectivo correcto, que las notas parecen genuinas y que el saldo restante en su cuenta es correcto.",0,"6.2.1.5.1","Para las transacciones de ingreso de efectivo, ¿se recomienda a los clientes que se aseguren de que su transacción se ha completada con éxito y que el saldo en su cuenta del dinero móvil incluye el monto total que depositaron (menos las comisiones autorizadas)?","1)  Plan / material de comunicación al cliente \n- Verificar que existan mecanismos de comunicación o términos y condiciones para informar a los clientes que deben:\n     a) Verificar que sus transacciones de ingreso de efectivo se hayan completado con éxito;\nb) Verificar que el saldo en sus cuentas del dinero móvil incluya el monto total que depositaron (menos las comisiones autorizadas).",null,"Obligatorio urgente","Obligatorio","BizOps",null,null,"6","6.2","6.2.1",null,"6.2.1.5",null,0,"6.2.1.5.1",null,null,null,"ReqU4","Req4","BizOps",null,null,null,null,null,null,null,null,"6.2.1.5.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"6","6.2","6.2.1",0,"6.2.1.5",null,0,"6.2.1.5.2","6.2.1.5.2: For cash-out transactions, are customers advised to make sure that their transaction has completed successfully, that they have the correct amount of cash, and that the remaining balance in their account is correct?\n","1) Customer communication plan / material\n- Check there is a process to make customers aware they should check that their cash-out transaction has:\n     a) Completed successfully, \n     b) That they have the correct amount of cash, \n     c) That the remaining balance in their account is correct",0,"Urgent Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.2","6.2.1",null,"6.2.1.5",null,null,"6.2.1.5.2","6.2.1.5.2","For cash-out transactions, are customers advised to make sure that their transaction has completed successfully, that they have the correct amount of cash, and that the remaining balance in their account is correct?","1) Customer communication plan / material\n- Check there is a process to make customers aware they should check that their cash-out transaction has:\n     a) Completed successfully, \n     b) That they have the correct amount of cash, \n     c) That the remaining balance in their account is correct",null,"Urgent Required","Required","BizOps",null,null,"6","6.2","6.2.1",0,"6.2.1.5",0,0,"6.2.1.5.2","pour les opérations de retrait d’espèces, est-il conseillé aux clients de vérifier que la transaction a bien été enregistrée, et que le montant retiré et le solde du compte sont corrects ?","1) Plan/supports de communication aux clients\r\n- Vérifier qu’un processus a été mis en œuvre pour conseiller aux clients de vérifier, pour les opérations de retrait d’espèces :\r\na) Que la transaction a bien été réalisée, \r\nb) Que le montant retiré est correct, \n\rc) Que le solde du compte après la transaction est correct",null,"Requis Prioritaire","Requis","BizOps",0,null,"6","6.2","6.2.1",null,"6.2.1.5",null,0,"6.2.1.5.2","Para las transacciones de retiro de efectivo, ¿se recomienda a los clientes que se aseguren de que su transacción se haya completado con éxito, de que tengan el monto de efectivo correcto y de que el saldo restante en su cuenta sea correcto?","1) Plan / material de comunicación al cliente \n- Verificar que exista un proceso para informar a los clientes que deben verificar que su transacción de retiro de efectivo:\n     a) Se haya completado con éxito, \n     b) Que tengan el monto de efectivo correcto, \n     c) Que el saldo restante en su cuenta sea correcto",null,"Obligatorio urgente","Obligatorio","BizOps",null,null,"6","6.2","6.2.1",null,"6.2.1.5",null,0,"6.2.1.5.2",null,null,null,"ReqU4","Req4","BizOps",null,null,null,null,null,null,null,null,"6.2.1.5.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"6","6.2","6.2.1",0,"6.2.1.6",{"$f":"AZ39&\": \"&CHOOSE(LanguageNumber,BA39,BR39,CH39,CX39)","v":"6.2.1.6: PROVIDING ALERTS ON SUSPICIOUS ACTIVITY ON CUSTOMER ACCOUNTS\nProviders should provide customers with timely alerts on suspicious activity relating to their accounts. The alerts should be sent electronically to the customer's mobile device, through a direct call from customer care personnel, and/or via other relevant channels. Alerts should contain sufficient information to enable customers to react to the alert by checking their account details (e.g. confirm balance or transactions) and/or taking other steps to safeguard their accounts (e.g. call customer care, visit a service centre or agent, change PIN, etc.).\n\nNote: Providers should not necessarily contact the customer if an investigation is initiated (as this would be 'tipping off'). Detection of suspicious activity is detailed in other toolkits:\n - Money laundering/terrorist financing: 2.4\n - Fraud: 5.3.10"},0,"6.2.1.6.1","6.2.1.6.1: Do providers alert customers of suspicious activity in a timely fashion using one or more relevant channels (e.g., electronic communication to the customer's mobile device, direct call from customer care personnel, and/or other channels)?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.2","6.2.1",null,"6.2.1.6","PROVIDING ALERTS ON SUSPICIOUS ACTIVITY ON CUSTOMER ACCOUNTS\nProviders should provide customers with timely alerts on suspicious activity relating to their accounts. The alerts should be sent electronically to the customer's mobile device, through a direct call from customer care personnel, and/or via other relevant channels. Alerts should contain sufficient information to enable customers to react to the alert by checking their account details (e.g. confirm balance or transactions) and/or taking other steps to safeguard their accounts (e.g. call customer care, visit a service centre or agent, change PIN, etc.).\n\nNote: Providers should not necessarily contact the customer if an investigation is initiated (as this would be 'tipping off'). Detection of suspicious activity is detailed in other toolkits:\n - Money laundering/terrorist financing: 2.4\n - Fraud: 5.3.10",null,"6.2.1.6.1","6.2.1.6.1","Do providers alert customers of suspicious activity in a timely fashion using one or more relevant channels (e.g., electronic communication to the customer's mobile device, direct call from customer care personnel, and/or other channels)?",null,null,"Recommended","Recommended","CustServ",null,null,"6","6.2","6.2.1",0,"6.2.1.6","SIGNALEMENT DES ACTIVITÉS SUSPECTES SUR LES COMPTES DES CLIENTS \nLes prestataires doivent signaler dans les meilleurs délais aux clients les activités suspectes concernant leurs comptes. L’alerte doit être communiquée sous forme d’un message électronique envoyé sur le téléphone portable du client, au moyen d’un appel direct par l’équipe du service client et/ou par tout autre canal pertinent. Le message d’alerte doit contenir suffisamment d’informations pour permettre au client de réagir en vérifiant son compte (ex. vérification du solde ou des opérations) et/ou de prendre d’autres mesures de protection de celui-ci (ex. appeler le service client, se rendre chez un agent ou dans un centre de service, modifier son code confidentiel, etc.).\n\nRemarque : les prestataires ne doivent pas nécessairement contacter le client si une enquête est lancée (cela constituerait une instance de « divulgation »). La détection des activités suspectes est détaillée dans les autres outils : \n - blanchiment de capitaux/financement du terrorisme : 2.4\n - fraude : 5.3.10.",0,"6.2.1.6.1","les clients sont-ils informés dans les meilleurs délais de toute activité suspecte au moyen d'un ou plusieurs canaux d'information appropriés (message électronique sur le téléphone portable du client, appel direct par l’équipe du service client et/ou tout autre canal) ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"6","6.2","6.2.1",null,"6.2.1.6","BRINDAR ALERTAS DE ACTIVIDADES SOSPECHOSAS EN LAS CUENTAS DE LOS CLIENTES\nLos proveedores deben brindar a los clientes alertas oportunas de actividades sospechosas relacionadas con sus cuentas. Las alertas deben ser enviadas de forma electrónica al dispositivo móvil del cliente, mediante una llamada directa del personal de atención al cliente y/o mediante cualesquiera otros canales relevantes. Las alertas deben contener información suficiente para permitir que los clientes reaccionen ante la alerta verificando los detalles de su cuenta (por ej., confirmar el saldo o las transacciones) y/o tomando otras medidas para proteger sus cuentas (por ej., llamar a atención al cliente, acudir a un centro de atención al cliente o a un agente, cambiar el PIN, etc.).\n\nNota: Los proveedores no deben necesariamente contactar al cliente si se inicia una investigación (ya que esto sería 'alertar'). La detección de actividades sospechosas se detalla en otros kits de herramientas:\n - lavado de activos/financiamiento del terrorismo: 2.4\n - Fraude: 5.3.10",0,"6.2.1.6.1","¿Los proveedores alertan a los clientes de las actividades sospechosas de manera oportuna usando uno o más canales relevantes (por ej., comunicación electrónica al dispositivo móvil del cliente, llamada directa del personal de atención al cliente y/u otros canales)?",null,null,"Recomendado","Recomendado","CustServ",null,null,"6","6.2","6.2.1",null,"6.2.1.6",null,0,"6.2.1.6.1",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"6.2.1.6.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"6","6.2","6.2.1",0,"6.2.1.6",null,0,"6.2.1.6.2","6.2.1.6.2: Do alerts contain sufficient information to enable customers to react to the alert by checking their account details (e.g. confirm balance or transactions) and/or taking other steps to safeguard their accounts (e.g. call customer care, visit a service centre or agent, change PIN, etc.)?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.2","6.2.1",null,"6.2.1.6",null,null,"6.2.1.6.2","6.2.1.6.2","Do alerts contain sufficient information to enable customers to react to the alert by checking their account details (e.g. confirm balance or transactions) and/or taking other steps to safeguard their accounts (e.g. call customer care, visit a service centre or agent, change PIN, etc.)?",null,null,"Recommended","Recommended","CustServ",null,null,"6","6.2","6.2.1",0,"6.2.1.6",0,0,"6.2.1.6.2","les messages d’alerte contiennent-ils suffisamment d’informations pour permettre aux clients de réagir en vérifiant leur compte (ex. vérification du solde ou des opérations) et/ou de prendre d’autres mesures de protection de celui-ci (ex. appeler le service client, se rendre chez un agent ou dans un centre de service, modifier leur code confidentiel, etc.) ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"6","6.2","6.2.1",null,"6.2.1.6",null,0,"6.2.1.6.2","¿Las alertas contienen información suficiente para permitir que los clientes reaccionen ante la alerta verificando los detalles de su cuenta (por ej., confirmar el saldo o las transacciones) y/o tomando otras medidas para proteger sus cuentas (por ej., llamar a atención al cliente, acudir a un centro de atención al cliente o a un agente, cambiar el PIN, etc.)?",null,null,"Recomendado","Recomendado","CustServ",null,null,"6","6.2","6.2.1",null,"6.2.1.6",null,0,"6.2.1.6.2",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"6.2.1.6.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"6","6.2","6.2.1",0,"6.2.1.7",{"$f":"AZ41&\": \"&CHOOSE(LanguageNumber,BA41,BR41,CH41,CX41)","v":"6.2.1.7: ADVISING CUSTOMERS THAT USER INTERFACE WILL CHANGE\nProviders should inform customers when there is an upcoming major re-design of the user interface, e.g. a new menu hierarchy in the USSD service. Customers should be given advance notice, ideally 15-30 days before the change is made."},0,"6.2.1.7.1","6.2.1.7.1: Are customers provided with prior notice when there is an upcoming major re-design of the user interface for the mobile money service?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"6","6.2","6.2.1",null,"6.2.1.7","ADVISING CUSTOMERS THAT USER INTERFACE WILL CHANGE\nProviders should inform customers when there is an upcoming major re-design of the user interface, e.g. a new menu hierarchy in the USSD service. Customers should be given advance notice, ideally 15-30 days before the change is made.",null,"6.2.1.7.1","6.2.1.7.1","Are customers provided with prior notice when there is an upcoming major re-design of the user interface for the mobile money service?",null,null,"Recommended","Recommended","BizOps",null,null,"6","6.2","6.2.1",0,"6.2.1.7","INFORMATION DES CLIENTS EN CAS DE MODIFICATION DE L’INTERFACE UTILISATEUR\nLes prestataires doivent informer les clients de toute modification significative à venir de l’interface utilisateur, comme par exemple une modification de l’ordre des menus dans le service USSD. Un préavis doit être respecté, de 15 à 30 jours de préférence avant le changement.\n",0,"6.2.1.7.1","les clients sont-ils informés à l'avance de tout changement majeur de l'interface utilisateur du service d'argent mobile ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"6","6.2","6.2.1",null,"6.2.1.7","INFORMAR A LOS CLIENTES EL CAMBIO DE LA INTERFAZ DEL USUARIO\nLos proveedores deben informar a los clientes los próximos rediseños importantes de la interfaz del usuario, por ej., una nueva jerarquía del menú en el servicio USSD. Se debe notificar a los clientes, idealmente, 15-30 antes de la realización del cambio.",0,"6.2.1.7.1","¿Se notifica a los clientes con anterioridad a un próximo rediseño importante de la interfaz del usuario para el servicio del dinero móvil?",null,null,"Recomendado","Recomendado","BizOps",null,null,"6","6.2","6.2.1",null,"6.2.1.7",null,0,"6.2.1.7.1",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"6.2.1.8.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP6","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,null,null,null,null,".",".",".",".",".",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,null,0,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,0,null,null,null,null,null,null,null,null,null,null,null,null,0,null,0,0]

{"sheet":"7","index":8,"n_rows":68,"n_cols":144,"rows_kept":68,"cut":false,"hidden":false,"merged":[[55,100,56,100],[55,101,56,101],[55,102,56,102],[55,6,56,6],[55,52,56,52],[55,69,56,69],[55,70,56,70],[50,102,51,102],[52,6,53,6],[52,52,53,52],[52,69,53,69],[52,70,53,70],[52,85,53,85],[52,86,53,86],[52,100,53,100],[52,101,53,101],[52,102,53,102],[48,101,49,101],[50,6,51,6],[50,69,51,69],[50,70,51,70],[50,85,51,85],[50,86,51,86],[50,100,51,100],[50,101,51,101],[50,52,51,52],[48,6,49,6],[8,6,12,6],[13,6,14,6],[5,6,6,6],[28,6,29,6],[15,6,18,6],[63,70,64,70],[30,6,33,6],[34,6,36,6],[19,6,21,6],[15,52,18,52],[15,69,18,69],[15,70,18,70],[22,70,27,70],[5,52,6,52],[8,52,12,52],[19,52,21,52],[13,52,14,52],[13,70,14,70],[19,69,21,69],[19,70,21,70],[28,70,29,70],[40,70,42,70],[34,70,36,70],[37,70,39,70],[22,4,27,4],[22,6,27,6],[48,52,49,52],[46,67,47,67],[61,69,62,69],[46,4,47,4],[37,6,39,6],[40,6,42,6],[30,52,33,52],[40,52,42,52],[46,50,47,50],[22,50,27,50],[22,52,27,52],[37,52,39,52],[28,52,29,52],[34,52,36,52],[22,67,27,67],[22,69,27,69],[28,69,29,69],[30,69,33,69],[40,69,42,69],[37,69,39,69],[34,69,36,69],[65,69,66,69],[63,69,64,69],[65,6,66,6],[61,6,62,6],[63,6,64,6],[59,6,60,6],[65,52,66,52],[63,52,64,52],[59,52,60,52],[61,52,62,52],[40,86,42,86],[48,85,49,85],[46,83,47,83],[5,69,6,69],[5,70,6,70],[59,69,60,69],[59,70,60,70],[31,70,32,70],[8,69,12,69],[48,69,49,69],[55,85,56,85],[55,86,56,86],[22,83,27,83],[40,85,42,85],[8,70,12,70],[22,85,27,85],[22,86,27,86],[28,85,29,85],[28,86,29,86],[34,85,36,85],[34,86,36,86],[30,85,33,85],[31,86,32,86],[13,69,14,69],[37,86,39,86],[5,100,6,100],[5,101,6,101],[5,85,6,85],[5,86,6,86],[8,86,12,86],[19,86,21,86],[15,85,18,85],[15,100,18,100],[19,100,21,100],[19,85,21,85],[8,85,12,85],[13,85,14,85],[13,86,14,86],[59,101,60,101],[59,102,60,102],[63,85,64,85],[63,86,64,86],[59,85,60,85],[59,86,60,86],[61,85,62,85],[5,102,6,102],[13,101,14,101],[13,102,14,102],[8,102,12,102],[8,101,12,101],[19,101,21,101],[19,102,21,102],[15,101,18,101],[15,102,18,102],[22,101,27,101],[15,86,18,86],[22,99,27,99],[22,100,27,100],[8,100,12,100],[13,100,14,100],[34,100,36,100],[37,85,39,85],[3,88,3,89],[22,102,27,102],[34,101,36,101],[34,102,36,102],[37,100,39,100],[37,101,39,101],[37,102,39,102],[65,85,66,85],[28,100,29,100],[28,101,29,101],[28,102,29,102],[30,101,33,101],[31,100,32,100],[31,102,32,102],[40,100,42,100],[40,101,42,101],[40,102,42,102],[65,101,66,101],[61,101,62,101],[63,100,64,100],[63,101,64,101],[63,102,64,102],[46,99,47,99],[59,100,60,100]]}
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,"x",null,null,null,null,"x",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"x"]
[null,null,null,null,null,null,{"$f":"UPPER(Introduction!B30)","v":"7. CUSTOMER SERVICE:  EFFECTIVELY ADDRESS CUSTOMER SERVICE REQUESTS AND COMPLAINTS"},null,null,null,null,null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,Drivers!K18,Drivers!L18,Drivers!M18,Drivers!N18)","v":"SELF-ASSESSMENT"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,Drivers!K34,Drivers!L34,Drivers!M34,Drivers!N34)","v":"EXTERNAL ASSESSMENT"},null,null,null,null,null,"SCHEME OPERATOR REVIEW",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,16,null,17,null,null,3,null,null,4,5,null,9,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Change types: NEW, MERGE, MOVE, SWAP","Don't edit the Indicator ID",null,null,null,"*** Don't edit any cell from AB and onwards *** Ignore #NAME errors; these will disappear during migration",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Counts for computed Compliance calc"]
[null,{"$f":"CHOOSE(LanguageNumber,AV3,BM3,CC3,CS3)","v":"Principle"},"Sub-principle","Sub-sub-principle","Sub-sub-principle ","Practice ID","Practice","Practice data source","Indicator ID",{"$f":"CHOOSE(LanguageNumber,BE3,BU3,CK3,DA3)","v":"Indicator"},"Evidence required","[SPARE]","Detailed indicator category","Indicator category","Function","[SPARE]",{"$f":"CHOOSE(LanguageNumber,Drivers!K19,Drivers!L19,Drivers!M19,Drivers!N19)","v":"Compliance"},{"$f":"CHOOSE(LanguageNumber,Drivers!K20,Drivers!L20,Drivers!M20,Drivers!N20)","v":"Evidence document (specify document name, section number and page number)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K21,Drivers!L21,Drivers!M21,Drivers!N21)","v":"Comments \n(include notes on how the practice is implemented)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K22,Drivers!L22,Drivers!M22,Drivers!N22)","v":"Action"},{"$f":"CHOOSE(LanguageNumber,Drivers!K23,Drivers!L23,Drivers!M23,Drivers!N23)","v":"Reviewer name"},{"$f":"CHOOSE(LanguageNumber,Drivers!K24,Drivers!L24,Drivers!M24,Drivers!N24)","v":"Evidence sent to Assessor?"},{"$f":"CHOOSE(LanguageNumber,Drivers!K25,Drivers!L25,Drivers!M25,Drivers!N25)","v":"Spare 2"},{"$f":"CHOOSE(LanguageNumber,Drivers!K26,Drivers!L26,Drivers!M26,Drivers!N26)","v":"Spare 3"},{"$f":"CHOOSE(LanguageNumber,Drivers!K27,Drivers!L27,Drivers!M27,Drivers!N27)","v":"Spare 4"},{"$f":"CHOOSE(LanguageNumber,Drivers!K28,Drivers!L28,Drivers!M28,Drivers!N28)","v":"Spare 5"},{"$f":"CHOOSE(LanguageNumber,Drivers!K29,Drivers!L29,Drivers!M29,Drivers!N29)","v":"Spare 6"},{"$f":"CHOOSE(LanguageNumber,Drivers!K30,Drivers!L30,Drivers!M30,Drivers!N30)","v":"Spare 7"},{"$f":"CHOOSE(LanguageNumber,Drivers!K31,Drivers!L31,Drivers!M31,Drivers!N31)","v":"Spare 8"},{"$f":"CHOOSE(LanguageNumber,Drivers!K32,Drivers!L32,Drivers!M32,Drivers!N32)","v":"Spare 9"},{"$f":"CHOOSE(LanguageNumber,Drivers!K33,Drivers!L33,Drivers!M33,Drivers!N33)","v":"Spare 10"},{"$f":"CHOOSE(LanguageNumber,Drivers!K35,Drivers!L35,Drivers!M35,Drivers!N35)","v":"Compliance"},{"$f":"CHOOSE(LanguageNumber,Drivers!K36,Drivers!L36,Drivers!M36,Drivers!N36)","v":"Evidence document (specify document name, section number and page number)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K37,Drivers!L37,Drivers!M37,Drivers!N37)","v":"Comments \n(include notes on how the practice is implemented)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K38,Drivers!L38,Drivers!M38,Drivers!N38)","v":"Recommendation to Provider"},{"$f":"CHOOSE(LanguageNumber,Drivers!K39,Drivers!L39,Drivers!M39,Drivers!N39)","v":"Reviewer name"},{"$f":"CHOOSE(LanguageNumber,Drivers!K40,Drivers!L40,Drivers!M40,Drivers!N40)","v":"Guidance notes for Assessor"},{"$f":"CHOOSE(LanguageNumber,Drivers!K41,Drivers!L41,Drivers!M41,Drivers!N41)","v":"Scheme Operator comments"},{"$f":"CHOOSE(LanguageNumber,Drivers!K42,Drivers!L42,Drivers!M42,Drivers!N42)","v":"Assessor's response to Scheme Operator"},{"$f":"CHOOSE(LanguageNumber,Drivers!K43,Drivers!L43,Drivers!M43,Drivers!N43)","v":"Scheme Operator conclusion"},{"$f":"CHOOSE(LanguageNumber,Drivers!K44,Drivers!L44,Drivers!M44,Drivers!N44)","v":"Spare 15"},{"$f":"CHOOSE(LanguageNumber,Drivers!K45,Drivers!L45,Drivers!M45,Drivers!N45)","v":"Spare 16"},{"$f":"CHOOSE(LanguageNumber,Drivers!K46,Drivers!L46,Drivers!M46,Drivers!N46)","v":"Spare 17"},{"$f":"CHOOSE(LanguageNumber,Drivers!K47,Drivers!L47,Drivers!M47,Drivers!N47)","v":"Spare 18"},{"$f":"CHOOSE(LanguageNumber,Drivers!K48,Drivers!L48,Drivers!M48,Drivers!N48)","v":"Spare 19"},{"$f":"CHOOSE(LanguageNumber,Drivers!K49,Drivers!L49,Drivers!M49,Drivers!N49)","v":"Spare 20"},null,"Principle","Sub-principle","Sub-sub-principle","Sub-sub-principle ","Practice ID","Practice","Practice data source","Indicator ID","ORIGINAL ID","Indicator","Evidence required","[SPARE]","Detailed indicator category","Indicator category","Function","[SPARE]",null,"Principe","Sous-principe","Sous-sous-principe","Description du sous-sous-principe","Pratique ID","Pratique","Source de données pratique","Indicateur ID","Indicateur","Documents généralement requis","[SPARE]","Catégorie détaillée d’indicateur","Catégorie d’indicateur","Fonction","[SPARE]",null,"Principio","Sub-principio","Sub-sub-principio","Sub-sub-principio","Nro. de Práctica","Práctica","Origen de datos de Práctica","Nro. de Indicador","Indicador","Documentación obligatoria","[SPARE]","Categoría indicador detallada","Categoría de Indicador","Función","[SPARE]",null,"Principle","Sub-principle","Sub-sub-principle","Sub-sub-principle Description","Practice ID","Practice","Practice data source","Indicator","Indicator","Evidence required","[SPARE]","Detailed indicator category","Indicator category","Function","[SPARE]",null,null,null,null,null,null,"Change type","Original Indicator ID","Merged indicator #1","Merged indicator #2","Merged indicator #3","v1 Compliance rating Original Indicator ID","v1 Compliance rating Merged indicator #1","v1 Compliance rating Merged indicator #2","v1 Compliance rating Merged indicator #3","v1 Comment Original Indicator ID","v1 Comment Merged indicator #1  ","v1 Comment Merged indicator #2","v1 Comment Merged indicator #3","v2 Computed change type","v2 Computed compliance rating","v2 Computed comment","rangename1","rangename2","rangename3","rangename4","Yes","No","N/A","Partial","No Response","how many","calc"]
[null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!C30,\": \",Introduction!D30))","v":"7.1: CUSTOMER SERVICE POLICIES AND PROCEDURES"},null,null,null,null,{"$f":"Introduction!E30","v":"Providers shall develop and publish customer service policies and procedures"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!K30,\": \",Introduction!L30))","v":"7.1: CUSTOMER SERVICE POLICIES AND PROCEDURES"},null,null,null,null,null,{"$f":"Introduction!$M$30","v":"Providers shall develop and publish customer service policies and procedures"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!U30,\": \",Introduction!V30))","v":"7.1: POLÍTICAS Y PROCEDIMIENTOS DE SERVICIO AL CLIENTE"},null,null,0,null,{"$f":"Introduction!W30","v":"El proveedor desarrollará y publicar políticas y procedimientos para la gestión de servicio del cliente"},null,null,null,null,null,null,null,null,null,null,null,0,null,0]
[{"$f":"IF(D5=D4,TRUE,FALSE)","v":false},{"$f":"$AV5","v":"7"},{"$f":"$AW5","v":"7.1"},{"$f":"$AX5","v":"7.1.1"},{"$f":"CHOOSE(LanguageNumber,AY5,BP5,CF5,CV5)","v":"7.1.1: Providers shall develop customer service policies and procedures"},{"$f":"AZ5","v":"7.1.1.1"},{"$f":"AZ5&\": \"&CHOOSE(LanguageNumber,BA5,BR5,CH5,CX5)","v":"7.1.1.1: PROCESS FOR CUSTOMERS TO FILE COMPLAINTS\nProviders should document procedures for handling requests and complaints from mobile money customers. Processes should include:\n- acceptance/lodging of complaints/requests;\n- processing/investigation of complaints/requests;\n- measures to reduce the risk of fraud in the customer service process (e.g. vetting customers when they call customer service);\n- resolution of complaints/requests, including scenarios where refunds / reversals are made;\n- an escalation process in case complaints cannot be resolved;\n- external recourse once the complaints and escalation process with the provider has been exhausted;\n- management of the complaints/requests process.\n\nThe policy detail should include all aspects of the complaints management process and should be regularly updated to incorporate feedback from analysis of records of customer complaints. \n\nThe customer service procedures should be made known to all customer service staff."},{"$f":"BB5","v":0},{"$f":"BC5","v":"7.1.1.1.1"},{"$f":"BC5&\": \"&CHOOSE(LanguageNumber,BE5,BU5,CK5,DA5)&CarriageReturn","v":"7.1.1.1.1: Are all procedures for handling requests and complaints from mobile money customers documented?\n"},{"$f":"CHOOSE(LanguageNumber,BF5,BV5,CL5,DB5)","v":"1) Customer service process documentation, \n- Check that it contains at least:\n     a) Customer call logging \n     b) a Closing process\n- Verify that the customer service process is documented satisfactorily \n\nAlso see: \n7.1.1.3 (escalation)\n7.1.1.4 (off-net transactions)\n7.1.1.5 (customer identity verification)"},0,{"$f":"CHOOSE(LanguageNumber,BH5,BX5,CN5,DD5)","v":"Urgent Required"},{"$f":"CHOOSE(LanguageNumber,BI5,BY5,CO5,DE5)","v":"Required"},"CustServ",{"$f":"CHOOSE(LanguageNumber,BK5,CA5,CQ5,DG5)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.1","7.1.1: Providers shall develop customer service policies and procedures","7.1.1.1","PROCESS FOR CUSTOMERS TO FILE COMPLAINTS\nProviders should document procedures for handling requests and complaints from mobile money customers. Processes should include:\n- acceptance/lodging of complaints/requests;\n- processing/investigation of complaints/requests;\n- measures to reduce the risk of fraud in the customer service process (e.g. vetting customers when they call customer service);\n- resolution of complaints/requests, including scenarios where refunds / reversals are made;\n- an escalation process in case complaints cannot be resolved;\n- external recourse once the complaints and escalation process with the provider has been exhausted;\n- management of the complaints/requests process.\n\nThe policy detail should include all aspects of the complaints management process and should be regularly updated to incorporate feedback from analysis of records of customer complaints. \n\nThe customer service procedures should be made known to all customer service staff.",null,"7.1.1.1.1",{"$f":"DO5","v":"7.1.1.1.1"},"Are all procedures for handling requests and complaints from mobile money customers documented?","1) Customer service process documentation, \n- Check that it contains at least:\n     a) Customer call logging \n     b) a Closing process\n- Verify that the customer service process is documented satisfactorily \n\nAlso see: \n7.1.1.3 (escalation)\n7.1.1.4 (off-net transactions)\n7.1.1.5 (customer identity verification)",null,"Urgent Required","Required",{"$f":"$O5","v":"CustServ"},null,null,{"$f":"$AV5","v":"7"},{"$f":"$AW5","v":"7.1"},{"$f":"$AX5","v":"7.1.1"},"7.1.1: Les prestataires doivent mettre en place des politiques et procédures du service clientèle",{"$f":"$AZ5","v":"7.1.1.1"},"PROCÉDURE DE TRAITEMENT DES RÉCLAMATION DES CLIENTS\nLes prestataires doivent se doter de procédures documentées pour le traitement des requêtes et des réclamations des clients du service de l’argent mobile. Les processus doivent comprendre :\n- la réception/l’enregistrement des réclamations/des requêtes ;\n- le traitement des réclamations/des requêtes et les recherches nécessaires ;\n- les mesures visant à réduire le risque de fraude lié au processus du service client (ex. vérification des clients appelant le service client) ;\n- la résolution des réclamations/des requêtes, y compris les cas nécessitant un remboursement ou une annulation ;\n- le processus de remontée des réclamations des prestataires lorsqu’elles ne peuvent être résolues ;\n- les recours externes en cas d’échec des procédures internes de traitement et de remontée des réclamations et litiges ;\n- gestions du processus des réclamations/des requêtes\n\nLa politique doit détailler tous les aspects du processus de traitement des réclamations. Elle doit être régulièrement actualisée sur la base des leçons tirées de l’analyse des dossiers de réclamation des clients. \n\nLes procédures du service client doivent être connues de l’ensemble du personnel concerné. ",{"$f":"BB5","v":0},{"$f":"BC5","v":"7.1.1.1.1"},"Existe-t-il une documentation pour toutes les procédures de traitement des requêtes et des réclamations des clients d'argent mobile ?","1) Documentation du processus du service client \n- Vérifier que les documents contiennent, au minimum :\na) Le journal d’appels du client \nb) un processus de clôture\n- Vérifier que le processus du service client est documenté de manière appropriée \n\nVoir également : \n7.1.1.3 (remontée)\n7.1.1.4 (transactions hors réseau)\n7.1.1.5 (vérification de l’identité des clients)",null,{"$f":"VLOOKUP($BH5,CategoryTranslationTable,2,FALSE)","v":"Requis Prioritaire"},{"$f":"VLOOKUP($BI5,CategoryTranslationTable,2,FALSE)","v":"Requis"},{"$f":"$O5","v":"CustServ"},0,null,{"$f":"$AV5","v":"7"},{"$f":"$AW5","v":"7.1"},{"$f":"$AX5","v":"7.1.1"},"7.1.1: Desarrollar políticas y procedimientos para la gestión de servicio del cliente",{"$f":"$AZ5","v":"7.1.1.1"},"PROCESO PARA QUE LOS CLIENTES PRESENTEN RECLAMOS\nLos proveedores deben documentar procedimientos para el manejo de las solicitudes y los reclamos por parte de los clientes del dinero móvil. Los procesos deben incluir:\n- aceptación/presentación de reclamos/solicitudes;\n- procesamiento/investigación de reclamos/solicitudes;\n- medidas para reducir el riesgo de fraude en el proceso de atención al cliente (por ej., verificación de los clientes cuando llaman a atención al cliente);\n- resolución de reclamos/solicitudes, incluyendo los escenarios donde se realizan reintegros / reversiones;\n- un proceso de escalamiento en caso de que los reclamos no puedan ser resueltos;\n- recurso externo una vez agotados los procesos de reclamos y escalamiento con el proveedor;\n- gestión del proceso de reclamos/solicitudes.\n\nEl detalle de la política debe incluir todos los aspectos del proceso de gestión de reclamos y se debe actualizar con regularidad para incorporar la retroalimentación del análisis de los registros de los reclamos de los clientes. \n\nTodo el personal de atención al cliente debe conocer los procedimientos de atención al cliente.",{"$f":"BB5","v":0},{"$f":"$BC5","v":"7.1.1.1.1"},"¿Están documentados todos los procedimientos para manejar solicitudes y reclamos por parte de los clientes del dinero móvil?","1) Documentación de procesos de atención al cliente, \n- Verificar que contenga, al menos:\n     a) Registro de llamadas de los clientes\n     b) un proceso de Cierre\n- Verificar que el proceso de atención al cliente esté satisfactoriamente documentado\n\nVer también: \n7.1.1.3 (escalamiento)\n7.1.1.4 (transacciones fuera de la red)\n7.1.1.5 (verificación de identidad del cliente)",null,{"$f":"VLOOKUP($BH5,CategoryTranslationTable,3,FALSE)","v":"Obligatorio urgente"},{"$f":"VLOOKUP($BI5,CategoryTranslationTable,3,FALSE)","v":"Obligatorio"},{"$f":"$O5","v":"CustServ"},null,null,{"$f":"$AV5","v":"7"},{"$f":"$AW5","v":"7.1"},{"$f":"$AX5","v":"7.1.1"},null,{"$f":"$AZ5","v":"7.1.1.1"},null,{"$f":"BB5","v":0},{"$f":"$BC5","v":"7.1.1.1.1"},null,null,null,{"$f":"VLOOKUP($BH5,CategoryTranslationTable,4,FALSE)","v":"ReqU4"},{"$f":"VLOOKUP($BI5,CategoryTranslationTable,4,FALSE)","v":"Req4"},{"$f":"$O5","v":"CustServ"},null,null,null,null,null,null,null,null,"7.1.1.1.1",null,null,null,{"$f":"IF(OR($EA5=0,$EA5=2),VLOOKUP(DO5,INDIRECT(ED5),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP5),\"\",VLOOKUP(DP5,INDIRECT(EE5),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ5),\"\",VLOOKUP(DQ5,INDIRECT(EF5),7,FALSE))","v":""},"",{"$f":"IF(OR($EA5=0,$EA5=2),VLOOKUP(DO5,INDIRECT(ED5),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP5),\"\",VLOOKUP(DP5,INDIRECT(EE5),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ5),\"\",VLOOKUP(DQ5,INDIRECT(EF5),8,FALSE))","v":""},"",{"$f":"1*AND(LEFT(DN5,3)=\"NEW\")+2*AND(LEFT(DN5,3)=\"MER\")+3*AND(LEFT(DN5,3)=\"MOV\")+4*AND(LEFT(DN5,3)=\"SWA\")","v":0},{"$f":"IF(EA5=0,DS5,EN5)","v":{"$error":"#REF!"}},{"$f":"IF(EA5=0,IF(DW5=0,\"\",DW5),CHOOSE(EA5,\"New indicator\",CONCATENATE(DW5,CarriageReturn,DX5,CarriageReturn,DY5,CarriageReturn,DZ5)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO5,1)","v":"OriginalComplianceP7"},{"$f":"\"OriginalComplianceP\"&LEFT(DP5,1)","v":"OriginalComplianceP"},"OriginalComplianceP","OriginalComplianceP",{"$f":"COUNTIF($DS5:$DV5,EH$3)","v":0},0,0,0,0,{"$f":"COUNTIF($DO5:$DR5,\"*?\")","v":1},{"$f":"IF(OR(AND(EH5>0,SUM(EI5:EL5)>0),EK5>0),\"Partial\",IF(EH5=EM5,\"Yes\",IF(EI5=EM5,\"No\",IF(EJ5=EM5,\"N/A\",IF(EK5=EM5,\"Partial\",IF(EL5=EM5,\"\",\"\"))))))","v":""}]
[null,{"$f":"$AV6","v":"7"},{"$f":"$AW6","v":"7.1"},{"$f":"$AX6","v":"7.1.1"},"",{"$f":"AZ6","v":"7.1.1.2"},"7.1.1.2: REFERENCE NUMBER AND RESOLUTION TIME FOR COMPLAINTS\nComplaints lodged by customers should be given reference/ticket numbers. Tickets would normally be system-generated (e.g. by CRM or mobile money system).\n\nThe complaints management policy should define timeframes for both the investigation and the resolution of complaints. Timeframes should be tailored to the type of complaint and should consider both the urgency of the complaint and the procedures required to resolve it. For example, timeframes may be longer for complaints involving off-net transactions (see 7.1.1.6 below).\n\nIt is good practice for the system to guide customer service staff through the process and monitor response times against the SLA. Staff can be alerted before the response SLA is breached.",0,"7.1.1.2.1","7.1.1.2.1: When a complaint is received by the mobile money provider, are customers provided with reference/ticket numbers for their complaint?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.1","","7.1.1.2","REFERENCE NUMBER AND RESOLUTION TIME FOR COMPLAINTS\nComplaints lodged by customers should be given reference/ticket numbers. Tickets would normally be system-generated (e.g. by CRM or mobile money system).\n\nThe complaints management policy should define timeframes for both the investigation and the resolution of complaints. Timeframes should be tailored to the type of complaint and should consider both the urgency of the complaint and the procedures required to resolve it. For example, timeframes may be longer for complaints involving off-net transactions (see 7.1.1.6 below).\n\nIt is good practice for the system to guide customer service staff through the process and monitor response times against the SLA. Staff can be alerted before the response SLA is breached.",null,"7.1.1.2.1","7.1.1.2.1","When a complaint is received by the mobile money provider, are customers provided with reference/ticket numbers for their complaint?",null,null,"Recommended","Recommended",{"$f":"$O6","v":"CustServ"},null,null,{"$f":"$AV6","v":"7"},{"$f":"$AW6","v":"7.1"},{"$f":"$AX6","v":"7.1.1"},"",{"$f":"$AZ6","v":"7.1.1.2"},"NUMÉRO DE RÉFÉRENCE ET DÉLAI DE RÉSOLUTION DES RÉCLAMATIONS\nUn numéro de référence/dossier doit être attribué aux réclamations soumises par les clients. Les numéros sont habituellement générés par informatique (par ex. via CRM ou le système de l’argent mobile).\n\nLa politique de traitement des réclamations doit définir des délais de recherche et de résolution des réclamations. Ces délais doivent être adaptés à la nature de la réclamation et tenir compte à la fois de son degré d’urgence et des procédures requises pour sa résolution. Les délais peuvent par exemple être plus longs pour les réclamations concernant des transactions hors réseau (cf. 7.1.1. ci-dessous).\n\nUne bonne pratique consiste à guider le personnel du service client tout au long du processus et à surveiller les délais de réponse par rapport à la convention de niveau de service. Le personnel doit être alerté lorsque les délais de réponse prévus par la convention de niveau de service ne sont pas respectés.",0,"7.1.1.2.1","lorsque les clients soumettent une réclamation, recoivent-ils systématiquement un numéro de référence/dossier pour leur réclamation ?",null,null,"Recommandé","Recommandé",{"$f":"$O6","v":"CustServ"},0,null,{"$f":"$AV6","v":"7"},{"$f":"$AW6","v":"7.1"},{"$f":"$AX6","v":"7.1.1"},"",{"$f":"$AZ6","v":"7.1.1.2"},"NÚMERO DE REFERENCIA Y TIEMPO DE RESOLUCIÓN DE RECLAMOS\nSe debe otorgar un número de referencia/número de ticket para los reclamos presentados por los clientes. Normalmente, los tickets serían generados por el sistema (por ej., por CRM o el sistema del dinero móvil).\n\nLa política de gestión de reclamos debe definir los plazos para la investigación y la resolución de reclamos. Los plazos deben ajustarse al tipo de reclamos y deben considerar tanto la urgencia del reclamo como los procedimientos requeridos para solucionarlo. Por ejemplo, los plazos pueden ser mayores para reclamos que involucran transacciones fuera de la red (ver 7.1.1.6 a continuación).\n\nEs una buena práctica que el sistema guíe al personal de atención al cliente a través del proceso y monitoree los tiempos de respuesta contra el SLA. Se puede alertar al personal antes de que incumplan el SLA de respuesta.",0,{"$f":"$BC6","v":"7.1.1.2.1"},"Cuando el proveedor del dinero móvil recibe un reclamo, ¿le proporciona a los clientes un número de referencia/ticket para el reclamo?",null,null,"Recomendado","Recomendado",{"$f":"$O6","v":"CustServ"},null,null,{"$f":"$AV6","v":"7"},{"$f":"$AW6","v":"7.1"},{"$f":"$AX6","v":"7.1.1"},null,{"$f":"$AZ6","v":"7.1.1.2"},null,0,{"$f":"$BC6","v":"7.1.1.2.1"},null,null,null,"Rec4","Rec4",{"$f":"$O6","v":"CustServ"},null,null,null,null,null,null,null,null,"7.1.1.2.1",null,null,null,{"$f":"IF(OR($EA6=0,$EA6=2),VLOOKUP(DO6,INDIRECT(ED6),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP6),\"\",VLOOKUP(DP6,INDIRECT(EE6),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ6),\"\",VLOOKUP(DQ6,INDIRECT(EF6),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR6),\"\",VLOOKUP(DR6,INDIRECT(EG6),7,FALSE))","v":""},{"$f":"IF(OR($EA6=0,$EA6=2),VLOOKUP(DO6,INDIRECT(ED6),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP6),\"\",VLOOKUP(DP6,INDIRECT(EE6),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ6),\"\",VLOOKUP(DQ6,INDIRECT(EF6),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR6),\"\",VLOOKUP(DR6,INDIRECT(EG6),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN6,3)=\"NEW\")+2*AND(LEFT(DN6,3)=\"MER\")+3*AND(LEFT(DN6,3)=\"MOV\")+4*AND(LEFT(DN6,3)=\"SWA\")","v":0},{"$error":"#REF!"},{"$f":"IF(EA6=0,IF(DW6=0,\"\",DW6),CHOOSE(EA6,\"New indicator\",CONCATENATE(DW6,CarriageReturn,DX6,CarriageReturn,DY6,CarriageReturn,DZ6)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO6,1)","v":"OriginalComplianceP7"},{"$f":"\"OriginalComplianceP\"&LEFT(DP6,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ6,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR6,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,{"$f":"IF(OR(AND(EH6>0,SUM(EI6:EL6)>0),EK6>0),\"Partial\",IF(EH6=EM6,\"Yes\",IF(EI6=EM6,\"No\",IF(EJ6=EM6,\"N/A\",IF(EK6=EM6,\"Partial\",IF(EL6=EM6,\"\",\"\"))))))","v":""}]
[null,"7","7.1","7.1.1","","7.1.1.2",null,0,"7.1.1.2.2","7.1.1.2.2: Are complaint resolution timeframes (which may be tailored to the type and urgency of complaint) defined and the customer informed of expected complaint resolution time?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.1","","7.1.1.2","",null,"7.1.1.2.2","7.1.1.2.2","Are complaint resolution timeframes (which may be tailored to the type and urgency of complaint) defined and the customer informed of expected complaint resolution time?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.1","7.1.1","","7.1.1.2","",0,"7.1.1.2.2","les délais de traitement des réclamations (qui peuvent être adaptés à leur nature et à leur degré d’urgence) sont-ils définis et le prestataire connaît-il le temps nécessaire au règlement des réclamations) ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.1","7.1.1","","7.1.1.2","",0,"7.1.1.2.2","¿Se definen los plazos de resolución de reclamos (que pueden ajustarse al tipo y a la urgencia del reclamo) y se informa al cliente el tiempo estimado de resolución del reclamo?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.1","7.1.1",null,"7.1.1.2",null,0,"7.1.1.2.2",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.1.1.2.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.1","","7.1.1.3","7.1.1.3: CUSTOMER COMPLAINTS ESCALATION PROCESS\nProviders should offer a complaints escalation process, which may be invoked if customers are not satisfied with the initial outcome of the complaints process.\n\nStaff should be allocated to support the escalation process and trained accordingly.",0,"7.1.1.3.1","7.1.1.3.1: Has the provider defined a complaints escalation process, which may be invoked if customers are not satisfied with the initial outcome of the complaints process?\n","1) Customer service process documentation, containing at least:\n-  Verify that the customer service process documentation contains at least the customer call escalation process to second-level support or call centre supervisor.",0,"Urgent Required","Required","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.1","","7.1.1.3","CUSTOMER COMPLAINTS ESCALATION PROCESS\nProviders should offer a complaints escalation process, which may be invoked if customers are not satisfied with the initial outcome of the complaints process.\n\nStaff should be allocated to support the escalation process and trained accordingly.",null,"7.1.1.3.1","7.1.1.4.1","Has the provider defined a complaints escalation process, which may be invoked if customers are not satisfied with the initial outcome of the complaints process?","1) Customer service process documentation, containing at least:\n-  Verify that the customer service process documentation contains at least the customer call escalation process to second-level support or call centre supervisor.",null,"Urgent Required","Required","CustServ",null,null,"7","7.1","7.1.1","","7.1.1.3","PROCESSUS DE REMONTÉE DES RÉCLAMATIONS DES CLIENTS \nLes prestataires doivent prévoir un processus de remontée des réclamations pour les clients non satisfaits du résultat initial de la procédure de traitement de leur réclamation.\n\nDes collaborateurs doivent être affectés à ce processus de remontée et formés en conséquence.",0,"7.1.1.3.1","le prestataire a-t-il défini un processus de remontée des réclamations pouvant être utilisé par les clients non satisfaits du résultat initial de la procédure de traitement de leur réclamation ?","1) Documentation du processus du service client contenant au minimum :\n- Vérifier que la documentation du processus du service client contient au minimum le processus de remontée des appels des clients à une assistance de deuxième niveau ou au superviseur du centre d’appels.",null,"Requis Prioritaire","Requis","CustServ",0,null,"7","7.1","7.1.1","","7.1.1.3","PROCESO DE ESCALAMIENTO DE RECLAMOS DE LOS CLIENTES\nLos proveedores deben ofrecer un proceso de escalamiento de reclamos, que se puede invocar si los clientes no están satisfechos con el resultado inicial del proceso de reclamos.\n\nSe debe asignar el personal para soporte del proceso de escalamiento y deben recibir la capacitación correspondiente.",0,"7.1.1.3.1","¿El proveedor definió un proceso de escalamiento de reclamos, que se puede invocar si los clientes no están satisfechos con el resultado inicial del proceso de reclamos?","1) Documentación de procesos de atención al cliente, que contenga al menos:\n-  Verificar que la documentación de procesos de atención al cliente contenga, al menos, el proceso de escalamiento de las llamadas de los clientes a un soporte de segundo nivel o al supervisor del centro atención telefónica.",null,"Obligatorio urgente","Obligatorio","CustServ",null,null,"7","7.1","7.1.1",null,"7.1.1.3",null,0,"7.1.1.3.1",null,null,null,"ReqU4","Req4","CustServ",null,null,null,null,null,null,null,null,"7.1.1.4.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.1","","7.1.1.4","7.1.1.4: CUSTOMER COMPLAINTS INVOLVING OFF-NET TRANSACTIONS\nThe provider should always be the single point for its customers to raise complaints when they send transactions to banks / other providers (domestic and international). \n\nATM complaints may be more efficiently handled by the ATM provider. However, the provider must efficiently support customers who call them instead of the ATM provider.\n\nA service level agreement and procedure should be agreed with each financial ecosystem partner for resolving customer complaints related to transactions between the provider and partner.\n\nProviders should ensure that, where possible, the process for resolving complaints regarding off-net transactions should be identical (from the customer's perspective) to the process for resolving complaints regarding on-net transactions; in addition, providers should make every effort to keep the service level similar (with the understanding that timeframes for resolution may be significantly longer). \n\nWhere any complaint about an off-net transaction is raised, providers should communicate to the customer:\n- The expected timeframe for resolution of the issue;\n- Potential outcomes;\n- Any limitations on the scope of resolution due to its being an off-net transaction (for example, some off-net transactions may be irreversible).",0,"7.1.1.4.1","7.1.1.4.1: Is the provider always the single point for its customers to raise complaints when they send transactions to banks / other providers (domestic and international)?\n","1) Customer service process documentation, containing at least:\n -  Resolution process for transactions to banks or other providers\n- Verify from the customer service process documentation that the provider is always the single point of contact for its customers when they send transactions to banks / other providers (domestic and international).\n",0,"Urgent Required","Required","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.1","","7.1.1.4","CUSTOMER COMPLAINTS INVOLVING OFF-NET TRANSACTIONS\nThe provider should always be the single point for its customers to raise complaints when they send transactions to banks / other providers (domestic and international). \n\nATM complaints may be more efficiently handled by the ATM provider. However, the provider must efficiently support customers who call them instead of the ATM provider.\n\nA service level agreement and procedure should be agreed with each financial ecosystem partner for resolving customer complaints related to transactions between the provider and partner.\n\nProviders should ensure that, where possible, the process for resolving complaints regarding off-net transactions should be identical (from the customer's perspective) to the process for resolving complaints regarding on-net transactions; in addition, providers should make every effort to keep the service level similar (with the understanding that timeframes for resolution may be significantly longer). \n\nWhere any complaint about an off-net transaction is raised, providers should communicate to the customer:\n- The expected timeframe for resolution of the issue;\n- Potential outcomes;\n- Any limitations on the scope of resolution due to its being an off-net transaction (for example, some off-net transactions may be irreversible).",null,"7.1.1.4.1","7.1.1.6.1","Is the provider always the single point for its customers to raise complaints when they send transactions to banks / other providers (domestic and international)?","1) Customer service process documentation, containing at least:\n -  Resolution process for transactions to banks or other providers\n- Verify from the customer service process documentation that the provider is always the single point of contact for its customers when they send transactions to banks / other providers (domestic and international).\n",null,"Urgent Required","Required","CustServ",null,null,"7","7.1","7.1.1","","7.1.1.4","RÉCLAMATIONS DE CLIENTS CONCERNANT DES TRANSACTIONS HORS RÉSEAU\nLe prestataire doit rester l'interlocuteur unique de ses clients en cas de réclamation lors de transactions vers des banques/d'autres prestataires (nationales et internationales).\n\nLes réclamations concernant les GAB peuvent être traitées plus efficacement par le prestataire du GAB. Toutefois, lorsque les clients contactent le prestataire au lieu du prestataire du GAB, le prestataire doit les assister de manière efficace.\n\nUne convention et une procédure de niveau de service doivent être convenues avec chaque partenaire de l’écosystème financier pour résoudre les réclamations des clients liées aux transactions entre le prestataire et le partenaire.\n\nDans la mesure du possible, les prestataires doivent s’assurer que le processus de résolution des réclamations relatives à des transactions hors réseau est identique (du point de vue du client) à celui des réclamations concernant les transactions sur réseau. Les prestataires doivent en outre faire tout leur possible pour offrir un niveau de service similaire (étant entendu que les délais de résolution peuvent être sensiblement plus longs). \n\nEn cas de réclamation concernant une transaction hors réseau, les prestataires doivent communiquer au client : \n- le délai prévisible de résolution du problème ; \n- les issues possibles ;\n- toute restriction applicable dans le cadre de la résolution du problème liée à la nature même des transactions hors réseau (certaines transactions hors réseau peuvent par exemple ne pas être annulables).\n",0,"7.1.1.4.1","le prestataire est-il toujours l'interlocuteur unique de ses clients en cas de réclamation concernant des transactions vers des banques/ d'autres prestataires (nationales et internationales) ?","1) Documentation du processus du service client contenant au minimum :\n - Le processus de résolution pour les transactions vers des banques ou d’autres prestataires\n- Consulter la documentation du processus du service client afin de vérifier que le prestataire est toujours l'interlocuteur unique de ses clients lorsqu’ils effectuent des transactions vers des banques/d'autres prestataires (nationales et internationales).",null,"Requis Prioritaire","Requis","CustServ",0,null,"7","7.1","7.1.1","","7.1.1.4","RECLAMOS DE CLIENTES QUE INVOLUCRAN TRANSACCIONES FUERA DE LA RED\nEl proveedor siempre debe ser el único punto para que sus clientes presenten reclamos cuando envían transacciones hacia bancos / otros proveedores (nacionales e internacionales).\n\nEl proveedor de cajeros automáticos puede manejar con mayor eficiencia los reclamos sobre cajeros automáticos. Sin embargo, el proveedor debe brindar soporte eficiente a los clientes que lo llaman en lugar de contactarse con el proveedor de cajeros automáticos.\n\nSe debe celebrar un acuerdo de nivel de servicio y acordar un procedimiento con cada socio del ecosistema financiero para resolver los reclamos de los clientes relacionados con transacciones entre el proveedor y el socio.\n\nLos proveedores deben garantizar que, cuando sea posible, el proceso para resolver reclamos relacionados con transacciones fuera de la red debe ser idéntico (desde la perspectiva del cliente) al proceso para resolver reclamos relacionados con transacciones en la red; además, los proveedores deben realizar sus mayores esfuerzos para mantener un nivel de servicio similar (entendiendo que los plazos de resolución pueden ser significativamente mayores). \n\nCuando se presenta un reclamo sobre alguna transacción fuera de la red, los proveedores deben comunicar al cliente:\n- el plazo estimado para la resolución del problema;\n- los potenciales resultados;\n- todas las limitaciones al alcance de resolución dado que se trata de una transacción fuera de la red (por ej., algunas transacciones fuera de la red pueden ser irreversibles).  ",0,"7.1.1.4.1","¿El proveedor es siempre el único punto para que sus clientes presenten reclamos cuando envían transacciones hacia bancos / otros proveedores (nacionales e internacionales)?","1) Documentación de procesos de atención al cliente, que contenga al menos:\n -  Proceso de resolución para las transacciones hacia bancos u otros proveedores\n- Verificar en la documentación de procesos de atención al cliente que el proveedor siempre sea el único punto de contacto para sus clientes cuando envían transacciones hacia bancos /otros proveedores (nacionales e internacionales).",null,"Obligatorio urgente","Obligatorio","CustServ",null,null,"7","7.1","7.1.1",null,"7.1.1.4",null,0,"7.1.1.4.1",null,null,null,"ReqU4","Req4","CustServ",null,null,null,null,null,null,null,null,"7.1.1.6.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.1","","7.1.1.4",null,0,"7.1.1.4.2","7.1.1.4.2: Are reciprocal mechanisms in place with each financial ecosystem partner to resolve issues raised by customers related to off-net transactions?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.1","","7.1.1.4","",null,"7.1.1.4.2","7.1.1.6.2","Are reciprocal mechanisms in place with each financial ecosystem partner to resolve issues raised by customers related to off-net transactions?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.1","7.1.1","","7.1.1.4","",0,"7.1.1.4.2","des mécanismes de réciprocité sont-ils en place avec chaque partenaire de l’écosystème financier pour la résolution des problèmes soulevés par des clients concernant les transactions hors réseau ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.1","7.1.1","","7.1.1.4","",0,"7.1.1.4.2","¿Se implementaron mecanismos recíprocos con cada socio del ecosistema financiero para resolver los problemas presentados por los clientes relacionados con transacciones fuera de la red?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.1","7.1.1",null,"7.1.1.4",null,0,"7.1.1.4.2",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.1.1.6.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.1","","7.1.1.4",null,0,"7.1.1.4.3","7.1.1.4.3: Is a service level agreement in place with each financial ecosystem partner for responding to and resolving customer complaints?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.1","","7.1.1.4","",null,"7.1.1.4.3","7.1.1.6.3","Is a service level agreement in place with each financial ecosystem partner for responding to and resolving customer complaints?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.1","7.1.1","","7.1.1.4","",0,"7.1.1.4.3","une convention de niveau de service est-elle en place avec chaque partenaire de l’écosystème financier pour répondre aux réclamations des clients et les résoudre ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.1","7.1.1","","7.1.1.4","",0,"7.1.1.4.3","¿Se celebró un acuerdo de nivel de servicio con cada socio del ecosistema financiero para responder y resolver los reclamos de los clientes?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.1","7.1.1",null,"7.1.1.4",null,0,"7.1.1.4.3",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.1.1.6.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.1","","7.1.1.4",null,0,"7.1.1.4.4","7.1.1.4.4: Is the process for resolving complaints regarding off-net transactions identical (from the customer's perspective) to the process for resolving complaints regarding on-net transactions (with the understanding that timeframes for resolution may be significantly longer)?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.1","","7.1.1.4","",null,"7.1.1.4.4","7.1.1.6.4","Is the process for resolving complaints regarding off-net transactions identical (from the customer's perspective) to the process for resolving complaints regarding on-net transactions (with the understanding that timeframes for resolution may be significantly longer)?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.1","7.1.1","","7.1.1.4","",0,"7.1.1.4.4","le processus de résolution des réclamations concernant des transactions hors réseau est-il identique (du point de vue du client) à celui des réclamations concernant les transactions intra-réseau (étant entendu que les délais de résolution peuvent être sensiblement plus longs) ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.1","7.1.1","","7.1.1.4","",0,"7.1.1.4.4","¿El proceso para resolver reclamos relacionados con transacciones fuera de la red es idéntico (desde la perspectiva del cliente) al proceso para resolver reclamos relacionados con transacciones en la red (entendiendo que los plazos de resolución pueden ser significativamente mayores)?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.1","7.1.1",null,"7.1.1.4",null,0,"7.1.1.4.4",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.1.1.6.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.1","","7.1.1.4",null,0,"7.1.1.4.5","7.1.1.4.5: When any complaint about an off-net transaction is raised, are customers notified of the expected timeframe for resolution of the issue, potential outcomes, and any limitations on the scope of resolution due to its being an off-net transaction?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.1","","7.1.1.4","",null,"7.1.1.4.5","7.1.1.6.5","When any complaint about an off-net transaction is raised, are customers notified of the expected timeframe for resolution of the issue, potential outcomes, and any limitations on the scope of resolution due to its being an off-net transaction?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.1","7.1.1","","7.1.1.4","",0,"7.1.1.4.5","en cas de réclamation concernant une transaction hors réseau, les clients sont-ils informés du délai prévisible de résolution du problème, des issues possibles et des éventuelles restrictions applicables aux transactions hors réseau ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.1","7.1.1","","7.1.1.4","",0,"7.1.1.4.5","Cuando se presenta un reclamo sobre una transacción fuera de la red, ¿se notifica a los clientes el plazo estimado de resolución del problema, los potenciales resultados, y todas las limitaciones al alcance de la resolución dado que se trata de una transacción fuera de la red?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.1","7.1.1",null,"7.1.1.4",null,0,"7.1.1.4.5",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.1.1.6.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.1","","7.1.1.5","7.1.1.5: VERIFICATION OF CUSTOMER IDENTITY\nWhen customers call to lodge complaints, their identity should be verified to mitigate fraud risk. Support staff should be trained to verify customer identity properly (e.g. with a secret word or other information that only the customer should know) and to use alternate processes to verify customers who are unable to provide the requested information to verify identity.",0,"7.1.1.5.1","7.1.1.5.1: Are customer support staff trained to verify the identity of customers who make complaints using a secret word or other information that only the customer should know?\n","1. Customer service process documentation \n - Check the customer service process documentation contains at least the customer call verification procedure.\n- Check the customer verification procedure uses a secret word or other information that only the customer should know\n\n2. Customer service training documentation\n- Confirm that the training documentation covers at least customer verification procedure",0,"Urgent Required","Required","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.1","","7.1.1.5","VERIFICATION OF CUSTOMER IDENTITY\nWhen customers call to lodge complaints, their identity should be verified to mitigate fraud risk. Support staff should be trained to verify customer identity properly (e.g. with a secret word or other information that only the customer should know) and to use alternate processes to verify customers who are unable to provide the requested information to verify identity.",null,"7.1.1.5.1","7.1.1.9.1","Are customer support staff trained to verify the identity of customers who make complaints using a secret word or other information that only the customer should know?","1. Customer service process documentation \n - Check the customer service process documentation contains at least the customer call verification procedure.\n- Check the customer verification procedure uses a secret word or other information that only the customer should know\n\n2. Customer service training documentation\n- Confirm that the training documentation covers at least customer verification procedure",null,"Urgent Required","Required","CustServ",null,null,"7","7.1","7.1.1","","7.1.1.5","VÉRIFICATION DE L’IDENTITÉ DES CLIENTS\nLorsque les clients appellent pour faire une réclamation, leur identité doit être vérifiée pour limiter le risque de fraude. Le personnel du service client doit être formé au processus de vérification de l’identité des clients (au moyen par exemple d’un mot secret que seul le client est censé connaître) ainsi qu’aux processus alternatifs de vérification d'identité pour les clients incapables de fournir les informations normalement demandées pour la confirmation de leur identité.",0,"7.1.1.5.1","le personnel du service client est-il formé à vérifier l’identité des clients qui soumettent des réclamations, au moyen par exemple d’un mot secret ou d'un autre renseignement que seul le client est censé connaître ?","1. Documentation du processus du service client, \n - Vérifier que la documentation du processus du service client contient au minimum la procédure de vérification des appels des clients\n- Vérifier que la procédure de vérification de l’identité du client utilise un mot secret ou un autre renseignement que seul le client est sensé connaître\n\n2. Documentation de formation au service client\n- Confirmer que la documentation de formation couvre au minimum la procédure de vérification de l’identité du client",null,"Requis Prioritaire","Requis","CustServ",0,null,"7","7.1","7.1.1","","7.1.1.5","VERIFICACIÓN DE IDENTIDAD DEL CLIENTE\nCuando los clientes llaman para presentar reclamos, se debe verificar su identidad para mitigar el riesgo de fraude. Se debe capacitar al personal de soporte para que verifiquen adecuadamente la identidad del cliente (por ej., con una palabra secreta u otra información que solo el cliente debe saber) y para que utilicen procesos alternativos a fin de verificar la identidad de los clientes que no pueden brindar la información de verificación de identidad solicitada.",0,"7.1.1.5.1","¿Se capacita al personal de soporte para que verifique la identidad de los clientes que presentan reclamos utilizando una palabra secreta u otra información que solo el cliente debe saber?","1. Documentación de procesos de atención al cliente, \n - Verificar que la documentación de procesos de atención al cliente contenga, al menos, el procedimiento de verificación de llamadas de los clientes.\n- Verificar que el procedimiento de verificación del cliente utilice una palabra secreta u otra información que solo el cliente debe saber\n\n2. Documentación de capacitación de atención al cliente\n- Confirmar que la documentación de capacitación contemple, al menos, el procedimiento de verificación del cliente",null,"Obligatorio urgente","Obligatorio","CustServ",null,null,"7","7.1","7.1.1",null,"7.1.1.5",null,0,"7.1.1.5.1",null,null,null,"ReqU4","Req4","CustServ",null,null,null,null,null,null,null,null,"7.1.1.9.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.1","","7.1.1.5",null,0,"7.1.1.5.2","7.1.1.5.2: Are alternate processes established to verify customer identity if the customer is unable to provide the requested information to verify identity?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.1","","7.1.1.5",null,null,"7.1.1.5.2","7.1.1.9.2","Are alternate processes established to verify customer identity if the customer is unable to provide the requested information to verify identity?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.1","7.1.1","","7.1.1.5",0,0,"7.1.1.5.2","existe-t-il d'autres processus de vérification de l'identité des clients incapables de fournir les informations demandées pour confirmer leur identité ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.1","7.1.1","","7.1.1.5",null,0,"7.1.1.5.2","¿Se establecen procesos alternativos para verificar la identidad del cliente cuando el cliente no puede proporcionar la información de verificación de identidad solicitada?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.1","7.1.1",null,"7.1.1.5",null,0,"7.1.1.5.2",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.1.1.9.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.1","","7.1.1.6","7.1.1.6: TRAIN CUSTOMER SERVICE STAFF \nProviders should ensure that customer service staff are fully trained to handle the wide range of issues that customers may complain about. Training should be designed to encompass the full lifecycle of complaint management:\n- initial contact with complainants (verify identity, confirm complaint should be logged, etc.);\n- initiate investigation;\n- resolve (including informing customer of resolution); and\n- close complaint (log complaint resolution, etc.).\n\nA knowledge portal can be a good resource for customer service staff, containing FAQs that are updated based upon questions received from customers.\n\nCustomer service staff training should be repeated periodically, and the content of the training course should be updated as the service changes and evolves. \n\nComplex issues requiring higher levels of support should be addressed through second-level customer service personnel, who should have more advanced training - refer to 7.2.1.2.\n\nTo ensure effective complaint management, providers should monitor the performance of staff in addressing and resolving customer complaints.",0,"7.1.1.6.1","7.1.1.6.1: Are customer service staff trained to deal with a range of issues that customers may complain about?\n","1) Customer service training documentation\n - Check that records of trained customer service staff show that all have been trained).\n - Check that training dates are within the last two years\n - Check that training covers a range of issues that customers may complain about.",0,"Standard Required","Required","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.1","","7.1.1.6","TRAIN CUSTOMER SERVICE STAFF \nProviders should ensure that customer service staff are fully trained to handle the wide range of issues that customers may complain about. Training should be designed to encompass the full lifecycle of complaint management:\n- initial contact with complainants (verify identity, confirm complaint should be logged, etc.);\n- initiate investigation;\n- resolve (including informing customer of resolution); and\n- close complaint (log complaint resolution, etc.).\n\nA knowledge portal can be a good resource for customer service staff, containing FAQs that are updated based upon questions received from customers.\n\nCustomer service staff training should be repeated periodically, and the content of the training course should be updated as the service changes and evolves. \n\nComplex issues requiring higher levels of support should be addressed through second-level customer service personnel, who should have more advanced training - refer to 7.2.1.2.\n\nTo ensure effective complaint management, providers should monitor the performance of staff in addressing and resolving customer complaints.",null,"7.1.1.6.1",{"$f":"DO16","v":"7.1.1.3.1"},"Are customer service staff trained to deal with a range of issues that customers may complain about?","1) Customer service training documentation\n - Check that records of trained customer service staff show that all have been trained).\n - Check that training dates are within the last two years\n - Check that training covers a range of issues that customers may complain about.",null,"Standard Required","Required","CustServ",null,null,"7","7.1","7.1.1","","7.1.1.6","FORMATION DU PERSONNEL DU SERVICE CLIENT \nLes prestataires doivent veiller à ce que le personnel du service client soit dûment formé pour gérer le large éventail de situations susceptibles de faire l’objet de réclamations de la part des clients. La formation doit couvrir le cycle complet du traitement des réclamations :\n- contact initial avec le client (vérification de l’identité du client, confirmation de l’enregistrement de la réclamation, etc.) ;\n- lancement des recherches ;\n- résolution (information du client comprise) ;\n- clôture du dossier de réclamation (enregistrement, etc.).\n\nUn portail de connaissances contenant des questions/réponses mises à jour avec les questions posées par les clients peut constituer une bonne ressource pour le personnel du service client.\n\nLa formation doit faire l’objet de rappels réguliers et être actualisée en fonction des changements et de l’évolution du service. \n\nLes problèmes complexes nécessitant un soutien plus important doivent être traités par des collaborateurs du service client ayant des connaissances plus avancées – cf. 7.2.1.2.\n\nPour garantir l’efficacité du traitement des réclamations, les prestataires doivent surveiller la performance des équipes concernées en matière de réponse aux réclamations des clients et de résolution de celles-ci.",0,"7.1.1.6.1","Le personnel chargé du traitement des réclamations des clients sont-il correctement formé pour faire face au large éventail de problèmes susceptibles de faire l’objet de réclamations ?","1) Documentation de formation au service client\n - Vérifier que les registres du personnel de centre d’appels qualifié incluent l’ensemble du personnel du service client.\n - Vérifier que le personnel a été formé au cours des deux dernières années\n - Vérifier que la formation couvre un éventail de problèmes susceptibles de faire l’objet de réclamations de la part des clients.",null,"Requis Normal","Requis","CustServ",0,null,"7","7.1","7.1.1","","7.1.1.6","CAPACITAR AL PERSONAL DE ATENCIÓN AL CLIENTE\nLos proveedores deben garantizar que el personal de atención al cliente esté plenamente capacitado para manejar la amplia variedad de problemas por los cuales los clientes podrían presentar reclamos. La capacitación debe estar diseñada para abarcar todo el ciclo de vida de la gestión de reclamos:\n- contacto inicial con quienes reclaman (verificar la identidad, confirmar que el reclamo debe ser registrado, etc.);\n- iniciar la investigación;\n- resolver (incluyendo informar la resolución al cliente); y\n- cerrar el reclamo (registrar la resolución del reclamo, etc.).\n\nUn portal de conocimientos, que contenga preguntas frecuentes actualizadas en base a las consultas recibidas por parte de los clientes, podría ser un buen recurso para el personal de atención al cliente.\n\nLa capacitación del personal de atención al cliente se debe repetir de forma periódica, y el contenido del curso de capacitación debe ser actualizado a medida que el servicio cambia y evoluciona. \n\nLos problemas complejos que requieren mayores niveles de soporte deben ser abordados por el personal de atención al cliente del segundo nivel, que debe recibir una capacitación más avanzada - ver 7.2.1.2.\n\nA fin de garantizar una efectiva gestión de reclamos, los proveedores deben monitorear el desempeño del personal para abordar y resolver los reclamos de los clientes.",0,"7.1.1.6.1","¿Se capacita al personal de atención al cliente para que trate la amplia variedad de problemas por los que los clientes podrían presentar reclamos?\n","1) Documentación de capacitación de atención al cliente\n - Verificar que los registros de capacitación del personal del centro de llamadas telefónicas incluyan a todo el personal de atención al cliente.\n - Verificar que las fechas de capacitación sean dentro de los últimos dos años\n - Verificar que la capacitación contemple una amplia variedad de problemas por los cuales los clientes podrían presentar reclamos.",null,"Obligatorio estándar","Obligatorio","CustServ",null,null,"7","7.1","7.1.1",null,"7.1.1.6",null,0,"7.1.1.6.1",null,null,null,"ReqS4","Req4","CustServ",null,null,null,null,null,null,null,null,"7.1.1.3.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.1","","7.1.1.6",null,0,"7.1.1.6.2","7.1.1.6.2: Does training for complaints management staff encompass the full lifecycle of complaint management, including initial contact with complainants, analysis of the complaint, resolution, logging the call and closure?\n","1) Customer service training documentation \n- Check it contains training at least:\na) initial contact with complainants, \nb) initiating analysis of complaints \nc) resolution, \nd) logging the call and closure",0,"Standard Required","Required","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.1","","7.1.1.6","",null,"7.1.1.6.2","7.1.1.3.2","Does training for complaints management staff encompass the full lifecycle of complaint management, including initial contact with complainants, analysis of the complaint, resolution, logging the call and closure?","1) Customer service training documentation \n- Check it contains training at least:\na) initial contact with complainants, \nb) initiating analysis of complaints \nc) resolution, \nd) logging the call and closure",null,"Standard Required","Required","CustServ",null,null,"7","7.1","7.1.1","","7.1.1.6","",0,"7.1.1.6.2","la formation du personnel chargé du traitement des réclamations couvre-t-elle le cycle complet du traitement des réclamations (premier contact avec le client, étude de la réclamation, résolution et clôture du dossier) ?","1) Documentation de formation au service client\n- Vérifier qu’elle contient au minimum :\na) le premier contact avec la personne à l’origine de la réclamation, \nb) le lancement des recherches relatives à la réclamation \nc) la résolution, \nd) la journalisation de l’appel et la clôture du dossier",null,"Requis Normal","Requis","CustServ",0,null,"7","7.1","7.1.1","","7.1.1.6",null,0,"7.1.1.6.2","¿La capacitación del personal de gestión de reclamos abarca todo el ciclo de vida de la gestión de reclamos, incluyendo el contacto inicial con quienes hacen los reclamos, el análisis del reclamo, resolución, registro de la llamada y cierre?","1) Documentación de capacitación de atención al cliente\n- Verificar que la capacitación contenga, al menos:\na) contacto inicial con quienes hacen los reclamos, \nb) inicio del análisis de los reclamos\nc) resolución, \nd) registro de la llamada y cierre",null,"Obligatorio estándar","Obligatorio","CustServ",null,null,"7","7.1","7.1.1",null,"7.1.1.6",null,0,"7.1.1.6.2",null,null,null,"ReqS4","Req4","CustServ",null,null,null,null,null,null,null,null,"7.1.1.3.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.1","","7.1.1.6",null,0,"7.1.1.6.3","7.1.1.6.3: Is staff training repeated periodically, with training content updated as the service changes and evolves?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.1","","7.1.1.6","",null,"7.1.1.6.3","7.1.1.3.3","Is staff training repeated periodically, with training content updated as the service changes and evolves?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.1","7.1.1","","7.1.1.6","",0,"7.1.1.6.3","la formation du personnel fait-elle l’objet de rappels périodiques et son contenu est-il actualisé en fonction des changements et de l’évolution du service ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.1","7.1.1","","7.1.1.6",null,0,"7.1.1.6.3","¿La capacitación del personal se repite de forma periódica, y el contenido de la capacitación es actualizado a medida que el servicio cambia y evoluciona?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.1","7.1.1",null,"7.1.1.6",null,0,"7.1.1.6.3",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.1.1.3.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.1","","7.1.1.6",null,0,"7.1.1.6.4","7.1.1.6.4: Is the performance of complaints management staff regularly monitored?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.1","","7.1.1.6","",null,"7.1.1.6.4","7.1.1.3.4","Is the performance of complaints management staff regularly monitored?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.1","7.1.1","","7.1.1.6","",0,"7.1.1.6.4","la performance du personnel chargé du traitement des réclamations fait-elle l'objet d'un suivi régulier ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.1","7.1.1","","7.1.1.6",null,0,"7.1.1.6.4","¿Se monitorea regularmente el desempeño del personal de gestión de reclamos?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.1","7.1.1",null,"7.1.1.6",null,0,"7.1.1.6.4",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.1.1.3.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.1","","7.1.1.7","7.1.1.7: RECORDING COMPLAINTS\nProviders should keep detailed records of complaints made by customers, including\n- detailed information about the nature of the complaint;\n- actions taken to address the complaint; \n- any escalations raised during the complaints process; and \n- how the complaint was ultimately resolved. \n\nThe head of customer service should receive reports on customer complaints to analyse complaints and resolutions according to the type of complaint.",0,"7.1.1.7.1","7.1.1.7.1: Are detailed records of customer complaints maintained?\n","1) Customer service call records for the last month.\n- Check that the customer service call records for the last month exist and appear complete.",0,"Standard Required","Required","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.1","","7.1.1.7","RECORDING COMPLAINTS\nProviders should keep detailed records of complaints made by customers, including\n- detailed information about the nature of the complaint;\n- actions taken to address the complaint; \n- any escalations raised during the complaints process; and \n- how the complaint was ultimately resolved. \n\nThe head of customer service should receive reports on customer complaints to analyse complaints and resolutions according to the type of complaint.",null,"7.1.1.7.1","7.1.1.10.1","Are detailed records of customer complaints maintained?","1) Customer service call records for the last month.\n- Check that the customer service call records for the last month exist and appear complete.",null,"Standard Required","Required","CustServ",null,null,"7","7.1","7.1.1","","7.1.1.7","ENREGISTREMENT DES RÉCLAMATIONS\nLes prestataires doivent conserver des registres détaillés des réclamations faites par les clients, comprenant les éléments suivants :\n- renseignements détaillés sur la nature de la réclamation ;\n- mesures prises suite à la réclamation ; \n- toute aggravation de la situation enregistrée pendant le traitement de la réclamation ; \n- mode de résolution finale de la réclamation.\n\nIl doit être possible de produire des rapports relatifs aux réclamations des clients en vue de les analyser en fonction du type de réclamation. \n",0,"7.1.1.7.1","des registres détaillés des réclamations soumises par les clients sont-ils conservés ?","1) Registres des réclamations soumises par les clients pour le dernier mois\n- Vérifier que des registres des réclamations soumises par les clients pour le dernier mois sont conservés et semblent suffisamment détaillés.",null,"Requis Normal","Requis","CustServ",0,null,"7","7.1","7.1.1","","7.1.1.7","REGISTRO DE RECLAMOS\nLos proveedores deben mantener registros completos de los reclamos presentados por los clientes, incluyendo\n- información detallada sobre la naturaleza del reclamo;\n- las acciones realizadas para abordar el reclamo; \n- todos los escalamientos realizados durante el proceso de reclamos; y \n- cómo se resolvió finalmente el reclamo. \n\n\nDebe ser posible ejecutar informes sobre los reclamos de los clientes para analizar los reclamos según el tipo.",0,"7.1.1.7.1","¿Se mantienen registros detallados de los reclamos de los clientes?","1) Registros de llamadas a atención al cliente del último mes.\n- Verificar que existan y estén completos los registros de llamadas a atención al cliente del último mes.",null,"Obligatorio estándar","Obligatorio","CustServ",null,null,"7","7.1","7.1.1",null,"7.1.1.7",null,0,"7.1.1.7.1",null,null,null,"ReqS4","Req4","CustServ",null,null,null,null,null,null,null,null,"7.1.1.10.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.1","","7.1.1.7",null,0,"7.1.1.7.2","7.1.1.7.2: Do complaint records include all of the following\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.1","","7.1.1.7","",null,"7.1.1.7.2","7.1.1.10.2","Do complaint records include all of the following",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.1","7.1.1","","7.1.1.7","",0,"7.1.1.7.2","les registres de réclamations contiennent-ils tous les éléments suivants",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.1","7.1.1","","7.1.1.7",null,0,"7.1.1.7.2","¿Los registros de reclamos incluyen todo lo siguiente?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.1","7.1.1",null,"7.1.1.7",null,0,"7.1.1.7.2",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.1.1.10.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",{"$f":"COUNTIF($DS21:$DV21,EH$3)","v":0},0,0,0,0,1,""]
[null,"7","7.1","7.1.1","","7.1.1.7",null,0,"7.1.1.7.3","7.1.1.7.3: Does the head of customer service receive reports on customer complaints to analyse complaints and resolutions according to the type of complaint?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.1","","7.1.1.7","",null,"7.1.1.7.3","7.1.1.10.3","Does the head of customer service receive reports on customer complaints to analyse complaints and resolutions according to the type of complaint?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.1","7.1.1","","7.1.1.7","",0,"7.1.1.7.3","Le gestionnaire du service clientèle reçoit-il des rapports de réclamation des clients pour analyser les réclamations et les résolutions en fonction du type de réclamation?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.1","7.1.1","","7.1.1.7",null,0,"7.1.1.7.3","¿El jefe de atención al cliente recibe informes sobre quejas de clientes para analizar quejas y resoluciones de acuerdo con el tipo de queja?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.1","7.1.1",null,"7.1.1.7",null,0,"7.1.1.7.3",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.1.1.10.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.2","7.1.2: Providers shall inform customers of customer service policies and procedures","7.1.2.1","7.1.2.1: INFORMING CUSTOMERS OF COMPLAINT POLICIES AND PROCEDURES\nThe methods for contacting customer care (e.g. phone number, electronic communication) should be advertised at agents and other points of service (e.g. on posters, brochures, etc.) and through the customer's mobile phone, for example as a separate menu item on USSD, Web & STK menus.\n\nAgents and staff involved in account opening should be trained to inform customers of complaint and escalation procedures both upon account opening and in the event of a complaint.\n\nCustomer care staff should be trained to inform customers of the quality of service that they should expect in the management of their complaints. (For example, providers should describe how the complaint will be addressed and specify the maximum time that customers should expect to wait for a response.)\n",0,"7.1.2.1.1","7.1.2.1.1: Are the methods for contacting customer care clearly advertised to customers - e.g. at agents and other points of service, or on posters?\n",{"$f":"CHOOSE(LanguageNumber,BF23,BV23,CL23,DB23)","v":"1) Agent outlet advertising plan or customer communications plan\n- Check the agent/comms/point of sale material includes details of how customer can contact customer care\n- Check there is a process to ensure agents have all appropriate point of sale material\n"},0,"Urgent Required","Required","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.2","7.1.2: Providers shall inform customers of customer service policies and procedures","7.1.2.1","INFORMING CUSTOMERS OF COMPLAINT POLICIES AND PROCEDURES\nThe methods for contacting customer care (e.g. phone number, electronic communication) should be advertised at agents and other points of service (e.g. on posters, brochures, etc.) and through the customer's mobile phone, for example as a separate menu item on USSD, Web & STK menus.\n\nAgents and staff involved in account opening should be trained to inform customers of complaint and escalation procedures both upon account opening and in the event of a complaint.\n\nCustomer care staff should be trained to inform customers of the quality of service that they should expect in the management of their complaints. (For example, providers should describe how the complaint will be addressed and specify the maximum time that customers should expect to wait for a response.)\n",null,"7.1.2.1.1","7.1.2.1.1","Are the methods for contacting customer care clearly advertised to customers - e.g. at agents and other points of service, or on posters?","1) Agent outlet advertising plan or customer communications plan\n- Check the agent/comms/point of sale material includes details of how customer can contact customer care\n- Check there is a process to ensure agents have all appropriate point of sale material\n",null,"Urgent Required","Required","CustServ",null,null,"7","7.1","7.1.2","7.1.2: Informer les clients des politiques et procédures du service clientèle","7.1.2.1","INFORMATION DES CLIENTS SUR LES POLITIQUES ET PROCÉDURES RELATIVES AUX RÉCLAMATIONS\nLes différents moyens de contacter le service client (ex. numéro de téléphone, communication électronique) doivent être mis en avant chez les agents et dans les autres points de service (sur les affiches, dans les brochures, etc.) et par le biais du téléphone des clients, sous forme par exemple d’une option distincte dans les menus USSD, internet et STK.\n\nLes agents et le personnel impliqués dans l'ouverture des comptes doivent avoir suivi une formation concernant la manière d'informer les clients des procédures de réclamation et de remontée tant au moment de l’ouverture du compte que dans l’éventualité d’une réclamation.\n\nLe personnel du service client doit avoir suivi une formation concernant la manière de communiquer aux clients le niveau de service à attendre pour la gestion de leurs réclamations. (Les prestataires doivent par exemple décrire la manière dont la réclamation sera traitée et indiquer le délai maximum prévisible de réponse pour le client.)",0,"7.1.2.1.1","Les coordonnées du service client sont-elles mise en avant pour les clients - par ex. chez les agents et dans d'autres points de service, ou sur des affiches ?","1) Plan de publicité dans les magasins des agents ou plan de communication aux clients\n- Vérifier que les supports des agents/du service de communication/en point de vente indiquent la manière dont le client peut joindre le service client\n- Vérifier qu’un processus a été mis en place afin de s’assurer que les agents disposent des supports appropriés dans leurs points de vente \n",null,"Requis Prioritaire","Requis","CustServ",0,null,"7","7.1","7.1.2","7.1.2: Informar a los clientes las políticas y procedimientos para la gestión de servicio del cliente","7.1.2.1","INFORMAR A LOS CLIENTES LAS POLÍTICAS Y PROCEDIMIENTOS DE RECLAMOS\nLos métodos para contactarse con atención al cliente (por ej., número de teléfono, comunicación electrónica) deben ser publicados en los sitios de los agentes y otros puntos de atención (por ej., en carteles, folletos, etc.) y a través del teléfono móvil del cliente, por ejemplo, como un elemento del menú por separado en los menú de USSD, Web y STK.\n\nLos agentes y el personal involucrado en la apertura de cuentas deben recibir capacitación para informar a los clientes los procedimientos de reclamo y escalamiento tanto en la apertura de cuenta como en el caso de un reclamo.\n\nEl personal de atención al cliente debe estar capacitado para informar a los clientes lo siguiente:\n - cómo y cuándo escalar los reclamos al personal jerárquico;\n - la calidad de servicio que deben esperar en la gestión de sus reclamos. (Por ejemplo, los proveedores deben describir cómo se abordará el reclamo y especificar el tiempo máximo estipulado para que los clientes esperen una respuesta).\n\nSe debe capacitar al personal jerárquico para informar a los clientes sus opciones de recursos externos si el cliente sigue insatisfecho después de agotar el proceso de resolución del proveedor.",0,"7.1.2.1.1","¿Los métodos para que los clientes se contacten con atención al cliente están publicados con claridad - por ej., en los sitios de los agentes y otros puntos de atención, o en carteles?","1) Plan de publicidad en el comercio del agente o plan de comunicación al cliente\n- Verificar que el material del agente/comercio/punto de venta incluya detalles sobre cómo los clientes se pueden contactar con atención al cliente\n- Verificar que exista un proceso para garantizar que los agentes cuenten con todo el material del punto de venta correspondiente\n",null,"Obligatorio urgente","Obligatorio","CustServ",null,null,"7","7.1","7.1.2",null,"7.1.2.1",null,0,"7.1.2.1.1",null,null,null,"ReqU4","Req4","CustServ",null,null,null,null,null,null,null,null,"7.1.2.1.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.2",0,"7.1.2.1",null,0,"7.1.2.1.2","7.1.2.1.2: Are customers informed of customer service channels / procedures upon account opening?\n","1) Registering-agent training materials or customer registration handout\n- Check that customers are informed of customer service channels / procedures upon account opening.",0,"Standard Required","Required","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.2",null,"7.1.2.1",null,null,"7.1.2.1.2","7.1.2.1.3","Are customers informed of customer service channels / procedures upon account opening?","1) Registering-agent training materials or customer registration handout\n- Check that customers are informed of customer service channels / procedures upon account opening.",null,"Standard Required","Required","CustServ",null,null,"7","7.1","7.1.2",0,"7.1.2.1",0,0,"7.1.2.1.2","Les clients sont-ils informés, au moment de l'ouverture du compte, des différents canaux/des différentes procédures utilisables pour contacter le service client ?","1) Supports de formation des agents impliqués dans le processus d'enregistrement ou documents remis au client lors de l'enregistrement\n- Vérifier que les clients sont informés, au moment de l'ouverture du compte, des canaux/procédures utilisables pour contacter le service client.",null,"Requis Normal","Requis","CustServ",0,null,"7","7.1","7.1.2",null,"7.1.2.1",null,0,"7.1.2.1.2","¿Se informan a los clientes los canales de atención al cliente / procedimientos al momento de la apertura de la cuenta?","1) Registrar los materiales de capacitación de agentes o el folleto de registro de clientes\n- Verificar que los clientes estén informados sobre los canales de atención al cliente / procedimientos al momento de la apertura de la cuenta.",null,"Obligatorio estándar","Obligatorio","CustServ",null,null,"7","7.1","7.1.2",null,"7.1.2.1",null,0,"7.1.2.1.2",null,null,null,"ReqS4","Req4","CustServ",null,null,null,null,null,null,null,null,"7.1.2.1.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.2","","7.1.2.1",null,0,"7.1.2.1.3","7.1.2.1.3: Is a description of the external recourse options included in the customer terms & conditions or customer contract?\n","1) Customer T&Cs or customer contract\n- Check the document includes when and how to escalate complaints to external authorities after exhausting the provider's resolution process.",0,"Standard Required","Required","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.2","","7.1.2.1","",null,"7.1.2.1.3","7.1.2.1.5","Is a description of the external recourse options included in the customer terms & conditions or customer contract?","1) Customer T&Cs or customer contract\n- Check the document includes when and how to escalate complaints to external authorities after exhausting the provider's resolution process.",null,"Standard Required","Required","CustServ",null,null,"7","7.1","7.1.2","","7.1.2.1","",0,"7.1.2.1.3","la description des options de recours externe figure-t-elle dans les conditions générales clients ou le contrat client ?","1) Conditions générales clients ou contrat client \n- Vérifier que ces documents indiquent quand et comment faire remonter les réclamations aux autorités externes une fois les voies de résolution du prestataire épuisées.",null,"Requis Normal","Requis","CustServ","Le terme « recours externe » fait référence aux possibilités externes de résolution des litiges pouvant être utilisées par les clients qui ne sont pas satisfaits du résultat du processus interne de résolution des réclamations du prestataire. Les exemples varient selon les pays et peuvent inclure des procédures judiciaires et/ou une médiation externe.",null,"7","7.1","7.1.2","","7.1.2.1",null,0,"7.1.2.1.3","¿Se incluye una descripción de las opciones de recursos externos en los términos y condiciones para el cliente o el contrato del cliente?","1) Términos y condiciones para el cliente o contrato del cliente \n- Verificar que el documento incluya cuándo y cómo escalar los reclamos a las autoridades externas después de haber agotado el proceso de resolución del proveedor.",null,"Obligatorio estándar","Obligatorio","CustServ",null,null,"7","7.1","7.1.2",null,"7.1.2.1",null,0,"7.1.2.1.3",null,null,null,"ReqS4","Req4","CustServ",null,null,null,null,null,null,null,null,"7.1.2.1.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.2",null,"7.1.2.1",null,{"$f":"BB26","v":0},{"$f":"BC26","v":"7.1.2.1.4"},"7.1.2.1.4: Do handset menus provide contact details for customer support?\n",{"$f":"CHOOSE(LanguageNumber,BF26,BV26,CL26,DB26)","v":0},0,{"$f":"CHOOSE(LanguageNumber,BH26,BX26,CN26,DD26)","v":"Recommended"},{"$f":"CHOOSE(LanguageNumber,BI26,BY26,CO26,DE26)","v":"Recommended"},"CustServ",{"$f":"CHOOSE(LanguageNumber,BK26,CA26,CQ26,DG26)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.2",null,"7.1.2.1",null,null,"7.1.2.1.4",{"$f":"DO26","v":"7.1.2.1.2"},"Do handset menus provide contact details for customer support?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.1","7.1.2",null,"7.1.2.1",null,null,{"$f":"BC26","v":"7.1.2.1.4"},"les menus téléphoniques donnent-ils les coordonnées du service client ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.1","7.1.2",null,"7.1.2.1",null,null,"7.1.2.1.4","¿El menú de los dispositivos brinda detalles de contacto para soporte al cliente?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.1","7.1.2",null,null,null,null,"7.1.2.1.4",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.1.2.1.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.2",null,"7.1.2.1",null,{"$f":"BB27","v":0},{"$f":"BC27","v":"7.1.2.1.5"},"7.1.2.1.5: Are customers informed how and when to escalate complaints to more senior staff?\n",{"$f":"CHOOSE(LanguageNumber,BF27,BV27,CL27,DB27)","v":0},0,{"$f":"CHOOSE(LanguageNumber,BH27,BX27,CN27,DD27)","v":"Recommended"},{"$f":"CHOOSE(LanguageNumber,BI27,BY27,CO27,DE27)","v":"Recommended"},"CustServ",{"$f":"CHOOSE(LanguageNumber,BK27,CA27,CQ27,DG27)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.2",null,"7.1.2.1",null,null,"7.1.2.1.5",{"$f":"DO27","v":"7.1.2.1.4"},"Are customers informed how and when to escalate complaints to more senior staff?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.1","7.1.2",null,"7.1.2.1",null,null,{"$f":"BC27","v":"7.1.2.1.5"},"les clients savent-ils quand et comment faire remonter les réclamations au niveau hiérarchique supérieur ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.1","7.1.2",null,"7.1.2.1",null,null,"7.1.2.1.5","¿Se informa a los cliente cómo y cuándo escalar los reclamos al personal jerárquico?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.1","7.1.2",null,null,null,null,"7.1.2.1.5",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.1.2.1.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.2",0,"7.1.2.1",null,{"$f":"BB28","v":0},{"$f":"BC28","v":"7.1.2.1.6"},"7.1.2.1.6: Do customer care staff make clear to customers the quality of service that they should expect in the management of their complaints, including how the complaint will be addressed and the maximum time that customers should expect to wait for a resolution?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.2",null,"7.1.2.1",null,null,"7.1.2.1.6","7.1.2.1.6","Do customer care staff make clear to customers the quality of service that they should expect in the management of their complaints, including how the complaint will be addressed and the maximum time that customers should expect to wait for a resolution?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.1","7.1.2","","7.1.2.1","",0,"7.1.2.1.6","le personnel du service client communique-t-il clairement aux clients le niveau de service à attendre pour la gestion de leurs réclamations, et notamment le mode de traitement et le délai maximum prévisible de résolution ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.1","7.1.2",null,"7.1.2.1",null,0,"7.1.2.1.6","¿El personal de atención al cliente aclara a los clientes la calidad del servicio que deben esperar en la gestión de sus reclamos, incluyendo cómo se abordará el reclamo y el tiempo máximo estipulado para que el cliente espere una resolución?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.1","7.1.2",null,"7.1.2.1",null,0,"7.1.2.1.6",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.1.2.1.6",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.2","","7.1.2.2","7.1.2.2: CHANGES TO COMPLAINT PROCEDURES\nAll changes to complaint handling procedures and timeframes should be updated in the Terms & Conditions and clearly communicated to customers before the changes take effect.",0,"7.1.2.2.1","7.1.2.2.1: Are all changes to complaint handling procedures and timeframes updated in the T&Cs?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.2","","7.1.2.2","CHANGES TO COMPLAINT PROCEDURES\nAll changes to complaint handling procedures and timeframes should be updated in the Terms & Conditions and clearly communicated to customers before the changes take effect.",null,"7.1.2.2.1","7.1.2.3.1","Are all changes to complaint handling procedures and timeframes updated in the T&Cs?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.1","7.1.2","","7.1.2.2","MODIFICATION DES PROCÉDURES DE RÉCLAMATION\nTout changement dans les procédures de traitement des réclamations doit être reflété dans les conditions générales d’utilisation du service et clairement communiqué aux clients avant sa prise d’effet.\n",0,"7.1.2.2.1","les modifications des procédures ou délais de traitement des réclamations sont-elles systématiquement reflétées dans les CGU ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.1","7.1.2","","7.1.2.2","CAMBIOS A LOS PROCEDIMIENTOS DE RECLAMOS\nTodos los cambios a los procedimientos y plazos para manejar reclamos deben ser actualizados en los Términos y Condiciones y comunicados con claridad a los clientes antes de que entren en vigencia.",0,"7.1.2.2.1","¿Todos los cambios a los procedimientos y plazos para manejar reclamos son actualizados en los términos y condiciones?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.1","7.1.2",null,"7.1.2.2",null,0,"7.1.2.2.1",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.1.2.3.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.2","","7.1.2.2",null,0,"7.1.2.2.2","7.1.2.2.2: Are all changes to complaint handling procedures and timeframes communicated to customers before they take effect?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.2","","7.1.2.2","",null,"7.1.2.2.2","7.1.2.3.2","Are all changes to complaint handling procedures and timeframes communicated to customers before they take effect?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.1","7.1.2","","7.1.2.2","",0,"7.1.2.2.2","les modifications des procédures ou délais de traitement des réclamations sont-elles systématiquement communiquées aux clients avant leur prise d'effet ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.1","7.1.2","","7.1.2.2",null,0,"7.1.2.2.2","¿Todos los cambios a los procedimientos y plazos para manejar reclamos son comunicados a los clientes antes de que entren en vigencia?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.1","7.1.2",null,"7.1.2.2",null,0,"7.1.2.2.2",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.1.2.3.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.3","7.1.3: Providers shall develop specific policies for handling reversals","7.1.3.1","7.1.3.1: TRANSACTION REVERSALS - POLICY\nProviders should develop a detailed policy for the management of transaction reversals, including:\n- the scenarios and transaction types which are valid for reversal\n- the procedures for handling transaction reversals; \n- the rules that apply to reversals (e.g. whether to refund fees).\n\nThe policy should be regularly updated to ensure:\n- compliance with applicable regulations, which may change over time; and\n- that customers are satisfied with the transaction reversal process.\n\nPolicy should specify that reversals will be authorised where the provider is at fault for a transaction that should not have occurred.","GSMA RMT","7.1.3.1.1","7.1.3.1.1: Is there a policy for the management of transaction reversals, and is it kept updated as new transaction types are developed?\n","1) Reversals policy or process\n- Check there is a  policy/process for the management of reversals,\n- Check the policy/process has been revised in the last 24 months.",0,"Urgent Required","Required","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.3","7.1.3: Providers shall develop specific policies for handling reversals","7.1.3.1","TRANSACTION REVERSALS - POLICY\nProviders should develop a detailed policy for the management of transaction reversals, including:\n- the scenarios and transaction types which are valid for reversal\n- the procedures for handling transaction reversals; \n- the rules that apply to reversals (e.g. whether to refund fees).\n\nThe policy should be regularly updated to ensure:\n- compliance with applicable regulations, which may change over time; and\n- that customers are satisfied with the transaction reversal process.\n\nPolicy should specify that reversals will be authorised where the provider is at fault for a transaction that should not have occurred.","GSMA RMT","7.1.3.1.1","7.1.3.1.1","Is there a policy for the management of transaction reversals, and is it kept updated as new transaction types are developed?","1) Reversals policy or process\n- Check there is a  policy/process for the management of reversals,\n- Check the policy/process has been revised in the last 24 months.",null,"Urgent Required","Required","CustServ",null,null,"7","7.1","7.1.3","7.1.3: Mettre en place des politiques spécifiques pour le traitement des annulations d’opération.","7.1.3.1","ANNULATIONS D’OPÉRATION - POLITIQUE\nLes prestataires doivent définir une politique précise de gestion des annulations d’opérations, couvrant :\n- les scénarios et les types de transactions valables pour annulation\n- les procédures de traitement des annulations ; \n- les règles qui s'appliquent lors des annulations (par ex. remboursement des frais).\n\nCette politique doit être régulièrement actualisée pour garantir :\n- le respect des réglementations applicables, qui peuvent changer dans le temps;\n- la satisfaction des clients quant au processus d’annulation des opérations.\n\nLa politique doit spécifier que les annulations sont autorisées lorsque le prestataire est responsable d’une transaction qui n’aurait pas du se produire.","GSMA RMT","7.1.3.1.1","Existe-il une politique pour la gestion des annulations de transactions, et est-elle mise à jour à mesure que de nouveaux types de transactions se développent ?","1) Politique ou processus d’annulation\n- Vérifier qu’une politique/un processus pour la gestion des annulations d’opération a été mis(e) en place,\n- Vérifier que cette politique/ce processus a été examiné(e) au cours des 24 derniers mois.",null,"Requis Prioritaire","Requis","CustServ",0,null,"7","7.1","7.1.3","7.1.3: Desarrollar políticas específicas para el manejo de reversiones.","7.1.3.1","REVERSIONES DE TRANSACCIONES - POLÍTICA\nLos proveedores deben desarrollar una política detallada para la gestión de reversiones de transacciones, que incluya:\n- los escenarios y tipos de transacciones válidos para la reversión\n- los procedimientos para manejar las reversiones de transacciones; \n- las reglas aplicables a las reversiones (por ej., si se reintegran las tarifas o no).\n\nLa política debe ser actualizada regularmente para garantizar:\n- el cumplimiento de las regulaciones aplicables, que pueden ser modificadas con el tiempo; y\n- que los clientes estén satisfechos con el proceso de reversión de transacciones.\n\nLa política debe especificar que las reversiones serán autorizadas cuando el proveedor sea el culpable de una transacción que no debería haber ocurrido.","GSMA RMT","7.1.3.1.1","¿Existe una política para la gestión de reversiones de transacciones, que se mantiene actualizada a medida que se desarrollan nuevos tipos de transacciones?","1) Política o proceso de reversiones\n- Verificar que exista una política/proceso para la gestión de reversiones,\n- Verificar que la política/proceso se haya revisado en los últimos 24 meses.",null,"Obligatorio urgente","Obligatorio","CustServ",null,null,"7","7.1","7.1.3",null,"7.1.3.1",null,"GSMA RMT","7.1.3.1.1",null,null,null,"ReqU4","Req4","CustServ",null,null,null,null,null,null,null,null,"7.1.3.1.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.3","","7.1.3.1",null,0,"7.1.3.1.2","7.1.3.1.2: Is there a list of all transaction types can be reversed, explaining conditions for the reversal to be completed (e.g. time limit for raising reversal; funds available to be reversed)?\n","1) Reversals policy or process\n- Check the policy/process identifies all customer transactions that may be reversed (and those that cannot be reversed).\n- Check the policy/process identifies all business transactions that may be reversed.\n- Check that the process includes conditions where transactions may be reversed, including time limits and how reversals are handled if the funds are no longer available.",0,"Urgent Required","Required","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.3","","7.1.3.1",null,null,"7.1.3.1.2","7.1.3.4.1","Is there a list of all transaction types can be reversed, explaining conditions for the reversal to be completed (e.g. time limit for raising reversal; funds available to be reversed)?","1) Reversals policy or process\n- Check the policy/process identifies all customer transactions that may be reversed (and those that cannot be reversed).\n- Check the policy/process identifies all business transactions that may be reversed.\n- Check that the process includes conditions where transactions may be reversed, including time limits and how reversals are handled if the funds are no longer available.",null,"Urgent Required","Required","CustServ",null,null,"7","7.1","7.1.3","","7.1.3.1","7.1.3.4 - TRANSACTIONS ANNULABLES\nLes prestataires doivent définir les règles déterminant les transactions pouvant être annulées ou non. Ces règles doivent : \n- définir les catégories d’opérations automatiquement annulables (ex. DAB en panne d’argent : l’annulation automatique est prévue par le cadre d’interface ISO 8583) ; \n- définir les catégories de transactions non annulables ; \n- définir si les frais / commissions / taxes seront annulés ou non dans le cadre de l’annulation de chaque catégorie de transaction ; et\n- définir une politique relative à l’annulation des paiements de facture, en fonction (1) du contrat avec le bénéficiaire des paiements ; (2) du fait que la demande d’annulation intervient ou non pendant la fenêtre de déclaration/paiements périodiques.",0,"7.1.3.1.2","Existe-t-il une liste de l'ensemble des types de transactions pouvant faire l'objet d'une annulation, définissant les conditions devant être respectées afin de mener à bien l'annulation (par ex. délai maximal pour la demande d'annulation ; fonds disponibles pour l'annulation) ? ","1) Politique ou processus d’annulation\n- Vérifier que la politique/le processus identifie l’ensemble des transactions clients pouvant être annulées (et celles ne pouvant pas l'être).\n- Vérifier que la politique/le processus identifie l’ensemble des transactions commerciales pouvant être annulées.\n- Vérifier que le processus définit les conditions selon lesquelles une transaction peut être annulée, y compris les délais maximums et la façon dont les annulations sont traitées lorsque les fonds ne sont plus disponibles.",null,"Requis Prioritaire","Requis","CustServ",0,null,"7","7.1","7.1.3","","7.1.3.1",null,0,"7.1.3.1.2","¿Existe una lista de todos los tipos de transacciones que pueden ser revertidos, explicando las condiciones para completar la reversión (por ej., límite de tiempo para elevar la reversión; fondos disponibles para ser revertidos?","1) Política o proceso de reversiones\n- Verificar que la política/proceso identifique todas las transacciones de clientes que pueden ser revertidas (y aquellas que no pueden ser revertidas).\n- Verificar que la política/proceso identifique todas las transacciones comerciales que pueden ser revertidas.\n- Verificar que el proceso incluya las condiciones bajo las cuales las transacciones pueden ser revertidas, incluyendo los límites de tiempo y cómo se manejan las reversiones si ya no existen fondos disponibles. ",null,"Obligatorio urgente","Obligatorio","CustServ",null,null,"7","7.1","7.1.3",null,"7.1.3.1",null,0,"7.1.3.1.2",null,null,null,"ReqU4","Req4","CustServ",null,null,null,null,null,null,null,null,"7.1.3.4.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.3","","7.1.3.1",null,0,"7.1.3.1.3","7.1.3.1.3: Has it been determined whether fees/ commissions/ taxes will be reversed as part of each reversible transaction?\n","1) Reversals policy or process\n- Check the policy/process identifies what, if any, fees/commissions/taxes are to be included in each reversal.",0,"Standard Required","Required","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.3","","7.1.3.1",null,null,"7.1.3.1.3","7.1.3.4.2","Has it been determined whether fees/ commissions/ taxes will be reversed as part of each reversible transaction?","1) Reversals policy or process\n- Check the policy/process identifies what, if any, fees/commissions/taxes are to be included in each reversal.",null,"Standard Required","Required","CustServ",null,null,"7","7.1","7.1.3","","7.1.3.1","",0,"7.1.3.1.3","pour chaque type d'opération annulable, est-il précisé si les frais / commissions / taxes sont également annulables ?","1) Politique ou processus d’annulation\n- Vérifier que la politique/le processus précise, le cas échéant, quels frais/quelles commissions/quelles taxes doivent être inclus(es) dans chaque annulation d’opération.",null,"Requis Normal","Requis","CustServ",0,null,"7","7.1","7.1.3","","7.1.3.1",null,0,"7.1.3.1.3","¿Se determinó si las tarifas/comisiones/impuestos serán revertidos como parte de cada transacción sujeta a reversión?","1) Política o proceso de reversiones\n- Verificar que la política/proceso identifique qué tarifas/comisiones/impuestos, si hubiese, serán incluidos en cada reversión.",null,"Obligatorio estándar","Obligatorio","CustServ",null,null,"7","7.1","7.1.3",null,"7.1.3.1",null,0,"7.1.3.1.3",null,null,null,"ReqS4","Req4","CustServ",null,null,null,null,null,null,null,null,"7.1.3.4.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.3",0,"7.1.3.1",null,0,"7.1.3.1.4","7.1.3.1.4: Does the reversals policy specify that the provider will correct mistakes where the provider is at fault for a debit or transaction that should not have occurred (e.g. mistake by customer service staff or system error)?\n","1) Reversals policy or process / Customer service process\n- Check the policy/process specifies that the provider will correct mistakes where the provider is at fault for a debit or transaction that should not have occurred (e.g. mistake by customer service staff or system error)",0,"Standard Required","Required","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.3",null,"7.1.3.1",null,null,"7.1.3.1.4","7.1.3.2.5","Does the reversals policy specify that the provider will correct mistakes where the provider is at fault for a debit or transaction that should not have occurred (e.g. mistake by customer service staff or system error)?","1) Reversals policy or process / Customer service process\n- Check the policy/process specifies that the provider will correct mistakes where the provider is at fault for a debit or transaction that should not have occurred (e.g. mistake by customer service staff or system error)",null,"Standard Required","Required","CustServ",null,null,"7","7.1","7.1.3",0,"7.1.3.1",0,0,"7.1.3.1.4","La politique d'annulation spécifie-t-elle que le prestataire sera chargé de corriger toute erreur lorsqu'il est responsable d'un débit ou d'une transaction qui n’aurait pas dû se produire (par ex. erreur commise par le service client ou erreur du système) ?","1) Politique ou processus d’annulation / Processus appliqué par le service client\n- Vérifier que la politique/le processus prévoit, pour le prestataire, l'obligation de corriger toute erreur lorsqu'il est responsable d'un débit ou d'une transaction qui n’aurait pas dû se produire (par ex. erreur commise par le service client ou erreur du système) ?",null,"Requis Normal","Requis","CustServ",0,null,"7","7.1","7.1.3",null,"7.1.3.1",null,0,"7.1.3.1.4","¿La política especifica que el proveedor corregirá los errores cuando es culpable de un débito o una transacción que no debería haber ocurrido (por ej., error del personal de atención al cliente o error del sistema)?","1) Política o proceso de reversiones / proceso de atención al cliente\n- Verificar que la política/proceso establezca que el proveedor corregirá los errores cuando es culpable de un débito o una transacción que no debería haber ocurrido  (por ej., error del personal de atención al cliente o error del sistema).",null,"Obligatorio estándar","Obligatorio","CustServ",null,null,"7","7.1","7.1.3",null,"7.1.3.1",null,0,"7.1.3.1.4",null,null,null,"ReqS4","Req4","CustServ",null,null,null,null,null,null,null,null,"7.1.3.2.5",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.3","","7.1.3.2","7.1.3.2: TRANSACTION REVERSALS - PROCESS\nThe mobile money provider should implement the policy for handling transaction reversal requests from customers, agents, merchants, or other parties. This should be backed up by system workflow and business processes for common scenarios in which users may request a transaction to be reversed. \nThe following controls within the policy should be implemented:\n- Staff responsible for managing reversals should confirm that the transaction actually happened before reversal; \n- Providers should determine the appropriate reversal mechanism for cases where the amount sent or the receiver was mistyped;\n- Providers should approve by default reversal of transactions made to suspended/dormant/inactive accounts (because the sending party cannot directly obtain refund from the receiving party);\n- Providers should reverse transactions where the provider is at fault for a transaction that should not have occurred (e.g. system error);\n- Providers should take steps to avoid fraudulent reversals, particularly those related to agent and merchant transactions where cash or goods are exchanged (e.g. contact recipient to agree the reversal).\n\nProviders should set a budget for bearing the cost of reversals where the value is unrecoverable - It is often not possible for the provider to avoid absorbing the cost of making a reversal, so there should be a budget set for unrecoverable reversals.\n\nA process should be defined for when the reversals process cannot be resolved to the satisfaction of the customer, agent, merchant, or other party; this may require closing the case or referring the aggrieved party to external recourse mechanisms (see 7.3).","GSMA RMT","7.1.3.2.1","7.1.3.2.1: Are processes defined for customer service staff to conduct reversals?\n","1) Reversals business process\n- Check a reversal process is defined.\n- Check the reversal process includes all common transactions for which customers, agents, merchants, or other parties may request a reversal.",0,"Standard Required","Required","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.3","","7.1.3.2","TRANSACTION REVERSALS - PROCESS\nThe mobile money provider should implement the policy for handling transaction reversal requests from customers, agents, merchants, or other parties. This should be backed up by system workflow and business processes for common scenarios in which users may request a transaction to be reversed. \nThe following controls within the policy should be implemented:\n- Staff responsible for managing reversals should confirm that the transaction actually happened before reversal; \n- Providers should determine the appropriate reversal mechanism for cases where the amount sent or the receiver was mistyped;\n- Providers should approve by default reversal of transactions made to suspended/dormant/inactive accounts (because the sending party cannot directly obtain refund from the receiving party);\n- Providers should reverse transactions where the provider is at fault for a transaction that should not have occurred (e.g. system error);\n- Providers should take steps to avoid fraudulent reversals, particularly those related to agent and merchant transactions where cash or goods are exchanged (e.g. contact recipient to agree the reversal).\n\nProviders should set a budget for bearing the cost of reversals where the value is unrecoverable - It is often not possible for the provider to avoid absorbing the cost of making a reversal, so there should be a budget set for unrecoverable reversals.\n\nA process should be defined for when the reversals process cannot be resolved to the satisfaction of the customer, agent, merchant, or other party; this may require closing the case or referring the aggrieved party to external recourse mechanisms (see 7.3).","GSMA RMT","7.1.3.2.1",{"$f":"DO35","v":"7.1.3.2.1"},"Are processes defined for customer service staff to conduct reversals?","1) Reversals business process\n- Check a reversal process is defined.\n- Check the reversal process includes all common transactions for which customers, agents, merchants, or other parties may request a reversal.",null,"Standard Required","Required","CustServ",null,null,"7","7.1","7.1.3","","7.1.3.2","ANNULATIONS D’OPÉRATION - PROCESSUS\nLe prestataire d’argent mobile doit se doter d’une politique de traitement des annulations d’opération demandées par les clients, les agents, les commerçants ou d’autres parties. Cette politique doit être appuyée par des procédures et un processus dans le système couvrant les scénarios courants pour lesquels les utilisateurs sont susceptible de demander l’annulation d’une transaction. \nLa politique doit prévoir les mesures de contrôle suivantes :\n- le personnel chargé du traitement des annulations doit en premier lieu vérifier que l’opération a bien eu lieu avant de procéder à son annulation ; \n- les prestataires doivent déterminer quel est le mécanisme le plus adapté pour les annulations résultant d'une erreur de saisie du montant de l'opération ou du nom du bénéficiaire ;\n- les prestataires doivent autoriser l’annulation par défaut des transactions concernant des comptes suspendus/dormants/inactifs car le donneur d’ordre ne peut obtenir de lui-même le remboursement de la part du bénéficiaire ;\n- les prestataires doivent annuler les transactions lorsque ceux-ci sont responsables d'une transaction qui n’aurait pas du se produire (par ex. erreur du système) ;\n- les prestataires doivent prévoir des mesures de prévention des annulations frauduleuses, notamment en ce qui concerne les transactions d’agents ou de commerçants donnant lieu à un échange d’argent ou de marchandises (par ex. contacter le bénéficiaire pour confirmer l'annulation).\n\nLes prestataires doivent prévoir un budget pour imputer le coût des annulations lorsque le montant concerné ne peut pas être recouvré - dans la plupart des cas, le prestataire doit absorber les coûts d’une annulation, un budget doit donc être prévu pour amortir les annulations non recouvrables.\n\nUn processus doit être mis en place pour les demandes d’annulation ne pouvant être effectuées à la satisfaction du client, de l’agent, du commerçant ou d’un autre tiers, pouvant inclure la clôture du dossier ou le renvoi de la partie lésée vers des mécanismes de recours externes (cf. 7.3).","GSMA RMT","7.1.3.2.1","Des processus ont-ils été définis afin d'encadrer les opérations d'annulation réalisées par le service client ?","1) Processus d’entreprise pour l’annulation d’opérations\n- Vérifier qu'un processus d'annulation a été défini.\n- Vérifier que le processus d'annulation inclut l’ensemble des transactions courantes pouvant faire l'objet d'une demande d'annulation par des clients, des agents, des commerçants ou d’autres parties.",null,"Requis Normal","Requis","CustServ",0,null,"7","7.1","7.1.3","","7.1.3.2","REVERSIONES DE TRANSACCIONES - PROCESO\nEl proveedor del dinero móvil debe implementar la política para manejar las solicitudes de reversión de transacciones por parte de los clientes, agentes, comercios u otras partes. Esta política debe estar respaldada por el flujo de trabajo del sistema y los procesos del negocio para los escenarios comunes en los que los usuarios pueden solicitar la reversión de una transacción. \nLa política debe implementar los siguientes controles:\n- Antes de la reversión, el personal responsable de gestionar las reversiones debe confirmar que la transacción realmente se realizó; \n- Los proveedores deben determinar el mecanismo de reversión adecuado para los casos de errores de escritura del monto enviado o del receptor;\n- Los proveedores deben aprobar por defecto las reversiones de transacciones realizadas a cuentas suspendidas/inactivas (porque el remitente no puede obtener directamente el reintegro por parte del receptor);\n- Los proveedores deben revertir las transacciones cuando el proveedor es culpable de una transacción que no debería haber ocurrido (por ej., error del sistema);\n- Los proveedores deben tomar medidas para evitar las reversiones fraudulentas, especialmente aquellas relacionadas con las transacciones de los agentes y comercios donde se intercambian bienes o efectivo (por ej., contactarse con el receptor para que acepte la reversión).\n\nLos proveedores deben fijar un presupuesto para asumir el costo de las reversiones cuando el valor es irrecuperable. Con frecuencia, no es posible que el proveedor evite absorber el costo de una reversión, por lo que debe establecerse un presupuesto para reversiones irrecuperables.\n\nSe debe definir un proceso para cuando no se puede resolver el proceso de reversión en forma satisfactoria para el cliente, agente, comercio u otra parte. Esto podría requerir cerrar el caso o derivar la parte perjudicada a mecanismos de recursos externos (ver 7.3).","GSMA RMT","7.1.3.2.1","¿Se definieron procesos para que el personal de atención al cliente realice reversiones?","1) Proceso de reversiones del negocio \n- Verificar que exista un proceso de reversión definido.\n- Verificar que el proceso de reversión incluya todas las transacciones comunes en los que los clientes, agentes, comercios u otras partes pueden solicitar una reversión.  \n",null,"Obligatorio estándar","Obligatorio","CustServ",null,null,"7","7.1","7.1.3",null,"7.1.3.2",null,"GSMA RMT","7.1.3.2.1",null,null,null,"ReqS4","Req4","CustServ",null,null,null,null,null,null,null,null,"7.1.3.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.3","","7.1.3.2",null,0,"7.1.3.2.2","7.1.3.2.2: Are steps taken to avoid fraudulent reversals, particularly those related to agent and merchant transactions where cash or goods are exchanged (e.g. contact recipient to agree the reversal)?\n","1) Reversals business process\n- Check the process includes steps to avoid fraudulent reversals, for example by calling the recipient to get agreement for the reversal.",0,"Urgent Required","Required","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.3","","7.1.3.2","",null,"7.1.3.2.2","7.1.3.2.6","Are steps taken to avoid fraudulent reversals, particularly those related to agent and merchant transactions where cash or goods are exchanged (e.g. contact recipient to agree the reversal)?","1) Reversals business process\n- Check the process includes steps to avoid fraudulent reversals, for example by calling the recipient to get agreement for the reversal.",null,"Urgent Required","Required","CustServ",null,null,"7","7.1","7.1.3","","7.1.3.2","",0,"7.1.3.2.2","existe-t-il des mesures de prévention des annulations frauduleuses, notamment en ce qui concerne les transactions d’agents ou de commerçants donnant lieu à un échange d’argent ou de marchandises (par ex. contacter le bénéficiaire pour confirmer l'annulation) ?","1) Processus d’entreprise pour l’annulation d’opérations\n- Vérifier que le processus inclut des mesures de prévention des annulations frauduleuses, en appelant par exemple le destinataire afin d’obtenir l’autorisation d’annuler la transaction.",null,"Requis Prioritaire","Requis","CustServ",0,null,"7","7.1","7.1.3","","7.1.3.2","",0,"7.1.3.2.2","¿Se toman medidas para evitar las reversiones fraudulentas, especialmente aquellas relacionadas con las transacciones de los agentes y comercios donde se intercambian bienes o efectivo (por ej., contactarse con el receptor para que acepte la reversión)?","1) Proceso de reversiones del negocio \n- Verificar que el proceso incluya medidas para evitar reversiones fraudulentas, como por ejemplo llamar al receptor para que acepte la reversión.",null,"Obligatorio urgente","Obligatorio","CustServ",null,null,"7","7.1","7.1.3",null,"7.1.3.2",null,0,"7.1.3.2.2",null,null,null,"ReqU4","Req4","CustServ",null,null,null,null,null,null,null,"MERGE","7.1.3.2.6","7.1.3.2.3",null,null,{"$error":"#REF!"},{"$error":"#REF!"},"","",{"$error":"#REF!"},{"$error":"#REF!"},"","",2,"",{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,2,""]
[null,"7","7.1","7.1.3","","7.1.3.2",null,0,"7.1.3.2.3","7.1.3.2.3: Is a budget set for bearing the costs of reversals?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.3","","7.1.3.2","",null,"7.1.3.2.3","7.1.3.2.7","Is a budget set for bearing the costs of reversals?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.1","7.1.3","","7.1.3.2","",{"$f":"BB37","v":0},{"$f":"BC37","v":"7.1.3.2.3"},"un budget est-il prévu pour imputer le coût éventuel des annulations (cf. note explicative) ?",null,null,"Recommandé","Recommandé","CustServ","Il est fréquent que le prestataire doive supporter le coût de certaines annulations. Un budget doit donc être prévu pour les annulations non recouvrables. ",null,"7","7.1","7.1.3","","7.1.3.2","",{"$f":"BB37","v":0},"7.1.3.2.3","¿Se fijó un presupuesto para asumir los costos de las reversiones?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.1","7.1.3",null,"7.1.3.2",null,{"$f":"BB37","v":0},"7.1.3.2.3",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.1.3.2.7",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.3","","7.1.3.3","7.1.3.3: TRANSACTION REVERSALS IN THE MOBILE MONEY SYSTEM\nThe provider should implement functions within the mobile money system to support the reversal procedures:\n- System workflow should guide customer care staff through the reversal procedures;\n- System should hold funds in a reserved state while investigations are conducted; and\n- System functionality should reduce the likelihood of mistakes requiring reversal (e.g. phone address book for customer; recipient name look-up and confirmation; making customer enter recipient’s number twice).\n\nNOTE: Transaction reversals should be completed as soon as possible after the reversal is approved by the responsible officer (ideally within one business day). Providers should also consider implementing a \"sweep\" process in the system to collect the reversal payment from the customer when they next add funds to their account.","GSMA RMT","7.1.3.3.1","7.1.3.3.1: Does the mobile money system implement workflow to guide customer care staff through the reversal procedures?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.3","","7.1.3.3","TRANSACTION REVERSALS IN THE MOBILE MONEY SYSTEM\nThe provider should implement functions within the mobile money system to support the reversal procedures:\n- System workflow should guide customer care staff through the reversal procedures;\n- System should hold funds in a reserved state while investigations are conducted; and\n- System functionality should reduce the likelihood of mistakes requiring reversal (e.g. phone address book for customer; recipient name look-up and confirmation; making customer enter recipient’s number twice).\n\nNOTE: Transaction reversals should be completed as soon as possible after the reversal is approved by the responsible officer (ideally within one business day). Providers should also consider implementing a \"sweep\" process in the system to collect the reversal payment from the customer when they next add funds to their account.","GSMA RMT","7.1.3.3.1","7.1.3.3.1","Does the mobile money system implement workflow to guide customer care staff through the reversal procedures?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.1","7.1.3","","7.1.3.3","ANNULATIONS D’OPÉRATION DANS LE SYSTÈME DE L'ARGENT MOBILE\nLe prestataire doit mettre en place des fonctionnalités au sein du système de l’argent mobile à l’appui des procédures d’annulation : \n- le déroulement des opérations dans le système doit guider le personnel du service client tout au long des procédures d’annulation ; \n- le système doit permettre de réserver les fonds pendant la durée des recherches nécessaires ; et \n- les fonctionnalités du système doivent réduire le risque d’erreurs entraînant des annulations (ex. carnet d’adresse téléphonique pour le client ; recherche du nom du bénéficiaire et validation ; double saisie obligatoire du numéro de téléphone du bénéficiaire). \n\nREMARQUE : les annulations d’opérations doivent être effectuées aussi rapidement que possible après autorisation hiérarchique de l’annulation (de préférence pendant la même journée). Les prestataires doivent également envisager de mettre en place un processus de compensation (« sweep ») dans le système de façon à recouvrer le paiement annulé lorsque le client verse à nouveau des fonds sur son compte. ","GSMA RMT","7.1.3.3.1","le déroulement des opérations dans le système de l'argent mobile guide-t-il le personnel du service client tout au long des procédures d’annulation ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.1","7.1.3","","7.1.3.3","REVERSIONES DE TRANSACCIONES EN EL SISTEMA DEL DINERO MÓVIL\nEl proveedor debe implementar funciones dentro del sistema del dinero móvil para soportar los procedimientos de reversión:\n- El flujo de trabajo del sistema debe guiar al personal de atención al cliente a través de los procedimientos de reversión;\n- El sistema debe mantener los fondos en un estado de reserva mientras se realizan las investigaciones; y\n- Las funcionalidades del sistema deben reducir las probabilidades de errores al solicitar la reversión (por ej., guía de teléfonos y direcciones para clientes; búsqueda y confirmación del nombre del receptor; hacer que el cliente ingrese dos veces el número del receptor).\n\nNOTA: Las reversiones de transacciones se deben completar lo antes posible después de la aprobación de la reversión por parte del funcionario responsable (idealmente dentro de un día hábil). Los proveedores también deben considerar la implementación de un proceso de \"recolección\" en el sistema para cobrar el pago de la reversión al cliente la próxima vez que agregue fondos a su cuenta.","GSMA RMT","7.1.3.3.1","¿El sistema del dinero móvil implementa un flujo de trabajo para guiar al personal de atención al cliente a través de los procedimientos de reversión?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.1","7.1.3",null,"7.1.3.3",null,"GSMA RMT","7.1.3.3.1",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.1.3.3.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.3","","7.1.3.3",null,0,"7.1.3.3.2","7.1.3.3.2: Does the system hold funds in a reserved state while investigations are conducted?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.3","","7.1.3.3","",null,"7.1.3.3.2","7.1.3.3.2","Does the system hold funds in a reserved state while investigations are conducted?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.1","7.1.3","","7.1.3.3","",0,"7.1.3.3.2","le système permet-il de réserver les fonds pendant la durée des recherches nécessaires ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.1","7.1.3","","7.1.3.3","",0,"7.1.3.3.2","¿El sistema mantiene los fondos en estado de reserva mientras se realizan las investigaciones?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.1","7.1.3",null,"7.1.3.3",null,0,"7.1.3.3.2",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.1.3.3.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.3","","7.1.3.3",null,0,"7.1.3.3.3","7.1.3.3.3: Are mechanisms implemented to reduce the likelihood of mistakes requiring reversal (e.g. phone address book for customer; recipient name look-up and confirmation; making customer enter recipient’s number twice)?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.3","","7.1.3.3","",null,"7.1.3.3.3","7.1.3.3.3","Are mechanisms implemented to reduce the likelihood of mistakes requiring reversal (e.g. phone address book for customer; recipient name look-up and confirmation; making customer enter recipient’s number twice)?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.1","7.1.3","","7.1.3.3","",0,"7.1.3.3.3","des mécanismes sont-ils en place pour réduire le risque d’erreurs entraînant des annulations (ex. carnet d’adresse téléphonique pour le client ; recherche du nom du bénéficiaire et validation ; double saisie obligatoire du numéro de téléphone du bénéficiaire) ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.1","7.1.3","","7.1.3.3","",0,"7.1.3.3.3","¿Se implementan mecanismos para reducir la probabilidad de errores que requieran una reversión (por ej., guía de teléfonos y direcciones para clientes; búsqueda y confirmación del nombre del receptor; hacer que el cliente ingrese dos veces el número del receptor)?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.1","7.1.3",null,"7.1.3.3",null,0,"7.1.3.3.3",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.1.3.3.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.3","","7.1.3.4","7.1.3.4: OFF-NET TRANSACTION REVERSALS\nProviders should develop additional controls for off-net reversals, including transactions with financial ecosystem partners such as other interoperable mobile money systems, international money transfer providers, banks, and ATM networks. \nThe following controls should be implemented:\n- A service-level agreement for responding to and resolving off-net reversals should be agreed with financial ecosystem partners;\n- Process for reversals and returning failed payments should be agreed with financial ecosystem partners. The process should include the role of a processor (hub/ clearing house), if used;\n- Process for determining the validity of reversal requests should be agreed with financial ecosystem partners, including details of which party will conduct investigations and how information and notifications will be shared. Depending on local regulation, providers may not be allowed to contact the customers of other providers, in which case a joint investigation process should be agreed;\n- Extending recipient name look-up functionality to include off-net customer name lookup for domestic interoperability; and\n- The system should hold funds in a reserved state for off-net transactions while investigations are conducted, particularly in the case of a dispute.\n",0,"7.1.3.4.1","7.1.3.4.1: Have detailed procedures been defined with each financial partner to accommodate off-net transaction reversals?\n","1) Reversals business process\n- Check that detailed procedures have been defined with each financial partner to accommodate off-net transaction reversals.\n",0,"Standard Required","Required","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.3","","7.1.3.4","OFF-NET TRANSACTION REVERSALS\nProviders should develop additional controls for off-net reversals, including transactions with financial ecosystem partners such as other interoperable mobile money systems, international money transfer providers, banks, and ATM networks. \nThe following controls should be implemented:\n- A service-level agreement for responding to and resolving off-net reversals should be agreed with financial ecosystem partners;\n- Process for reversals and returning failed payments should be agreed with financial ecosystem partners. The process should include the role of a processor (hub/ clearing house), if used;\n- Process for determining the validity of reversal requests should be agreed with financial ecosystem partners, including details of which party will conduct investigations and how information and notifications will be shared. Depending on local regulation, providers may not be allowed to contact the customers of other providers, in which case a joint investigation process should be agreed;\n- Extending recipient name look-up functionality to include off-net customer name lookup for domestic interoperability; and\n- The system should hold funds in a reserved state for off-net transactions while investigations are conducted, particularly in the case of a dispute.\n",null,"7.1.3.4.1","7.1.3.5.1","Have detailed procedures been defined with each financial partner to accommodate off-net transaction reversals?","1) Reversals business process\n- Check that detailed procedures have been defined with each financial partner to accommodate off-net transaction reversals.\n",null,"Standard Required","Required","CustServ",null,null,"7","7.1","7.1.3","","7.1.3.4","ANNULATIONS DE TRANSACTIONS HORS RÉSEAU\nLes prestataires doivent mettre en place des mesures de contrôle supplémentaires pour les annulations de transactions hors réseau, et notamment les transactions avec des partenaires de l’écosystème financier tels que les autres systèmes d’argent mobile interopérables, les prestataires de services de transferts internationaux, les banques et les réseaux de DAG/GAB. \nLes mesures de contrôle suivantes doivent être mises en œuvre : \n- une convention de niveau de service doit être mise en place avec les partenaires de l’écosystème financier pour la réception et le traitement des annulations hors réseau ; \n- un processus d’annulation et de retour des paiements avortés doit être convenu avec les partenaires de l’écosystème financier et doit préciser le cas échéant le rôle du processeur (plateforme / chambre de compensation) ;\n- un processus de détermination de la validité des demandes d’annulation doit être convenu avec les partenaires de l’écosystème financier, en précisant la partie responsable des recherches et la manière dont les informations et les notifications seront échangées. Selon la réglementation locale, les prestataires peuvent ne pas avoir le droit de contacter les clients d’autres prestataires, auquel cas un processus commun d’enquête doit être convenu ;\n- la fonctionnalité de recherche de nom doit être élargie aux clients hors réseau pour l’interopérabilité nationale ; et \n- le système doit réserver les fonds de la transaction hors réseau concernée pendant la durée des recherches, notamment en cas de litige. \n",0,"7.1.3.4.1","existe-t-il des procédures détaillées d'annulation des transactions hors réseau avec chaque partenaire concerné de l'écosystème financier ?","1) Processus d’entreprise pour l’annulation d’opérations\n- Vérifier que des procédures détaillées ont été définies avec chaque partenaire de l’écosystème financier concerné afin de gérer les annulations de transactions hors réseau.\n",null,"Requis Normal","Requis","CustServ",0,null,"7","7.1","7.1.3","","7.1.3.4","REVERSIONES DE TRANSACCIONES FUERA DE LA RED\nLos proveedores deben desarrollar controles adicionales para las reversiones fuera de la red, incluyendo transacciones con los socios del ecosistema financiero, como por ejemplo otros sistemas del dinero móvil interoperables, proveedores de transferencias de dinero internacionales, bancos y redes de cajeros automáticos. \nSe deben implementar los siguientes controles:\n- Se debe celebrar con los socios del ecosistema financiero un acuerdo de nivel de servicio para responder y resolver reversiones fuera de la red;\n- Se debe acordar con los socios del ecosistema financiero un proceso para reversiones y para devolver pagos fallidos. El proceso debe incluir el rol de un procesador (hub/ cámara compensadora), si se utiliza;\n- Se debe acordar con los socios del ecosistema financiero un proceso para determinar la validez de las solicitudes de reversión, que detalle qué parte realizará las investigaciones y cómo se compartirán la información y las notificaciones. Dependiendo de la regulación local, es posible que los proveedores no tengan permitido contactarse con los clientes de otros proveedores, en cuyo caso se debe acordar un proceso de investigación conjunta;\n- Extender la funcionalidad de búsqueda del nombre del receptor para incluir la búsqueda de nombres de clientes fuera de la red para interoperabilidad nacional; y\n- El sistema debe mantener los fondos en estado de reserva mientras se realizan las investigaciones, particularmente en el caso de una controversia.\n",0,"7.1.3.4.1","¿Se definieron procedimientos detallados con cada socio financiero para incluir reversiones de transacciones fuera de la red?","1) Proceso de reversiones del negocio\n- Verificar que se hayan definido los procedimientos con cada socio financiero para incluir reversiones fuera de la red.\n",null,"Obligatorio estándar","Obligatorio","CustServ",null,null,"7","7.1","7.1.3",null,"7.1.3.4",null,0,"7.1.3.4.1",null,null,null,"ReqS4","Req4","CustServ",null,null,null,null,null,null,null,null,"7.1.3.5.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.3","","7.1.3.4",null,0,"7.1.3.4.2","7.1.3.4.2: Has a service-level agreement for responding to and resolving off-net reversals been agreed with each financial ecosystem partner?\n","1) Reversals business process\n- Check that there is a service level agreement for responding to and resolving off-net reversals\n- Check that this has been agreed with ecosystem partners",0,"Standard Required","Required","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.3","","7.1.3.4",null,null,"7.1.3.4.2","7.1.3.5.2","Has a service-level agreement for responding to and resolving off-net reversals been agreed with each financial ecosystem partner?","1) Reversals business process\n- Check that there is a service level agreement for responding to and resolving off-net reversals\n- Check that this has been agreed with ecosystem partners",null,"Standard Required","Required","CustServ",null,null,"7","7.1","7.1.3","","7.1.3.4",0,0,"7.1.3.4.2","une convention de niveau de service est-elle en place avec chaque partenaire de l’écosystème financier pour la réception et le traitement des annulations hors réseau ?","1) Processus d’entreprise pour l’annulation d’opérations\n- Vérifier qu’une convention de niveau de service a été mise en place pour la réception et le traitement des annulations hors réseau\n- Vérifier que cette convention a été mise en place d’un commun accord avec les partenaires de l’écosystème financier concernées",null,"Requis Normal","Requis","CustServ",0,null,"7","7.1","7.1.3","","7.1.3.4",null,0,"7.1.3.4.2","¿Se celebró con cada socio del ecosistema financiero un acuerdo de nivel de servicio para responder y resolver las reversiones fuera de la red?","1) Proceso de reversiones del negocio\n- Verificar que exista un acuerdo de nivel de servicio para responder y resolver reversiones fuera de la red\n- Verificar que haya sido acordado con los socios del ecosistema",null,"Obligatorio estándar","Obligatorio","CustServ",null,null,"7","7.1","7.1.3",null,"7.1.3.4",null,0,"7.1.3.4.2",null,null,null,"ReqS4","Req4","CustServ",null,null,null,null,null,null,null,null,"7.1.3.5.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.3","","7.1.3.4",null,0,"7.1.3.4.3","7.1.3.4.3: Does the system hold funds in a reserved state for off-net transactions while investigations are conducted?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.3","","7.1.3.4",null,null,"7.1.3.4.3","7.1.3.5.3","Does the system hold funds in a reserved state for off-net transactions while investigations are conducted?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.1","7.1.3","","7.1.3.4",0,0,"7.1.3.4.3","le système permet-il de réserver les fonds de la transaction hors réseau concernée pendant la durée des recherches ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.1","7.1.3","","7.1.3.4",null,0,"7.1.3.4.3","¿El sistema mantiene los fondos en estado de reserva para las transacciones fuera de la red mientras se realizan las investigaciones?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.1","7.1.3",null,"7.1.3.4",null,0,"7.1.3.4.3",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.1.3.5.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.3","","7.1.3.5","7.1.3.5: MULTI-CURRENCY REVERSALS\nFor international money transfers (or domestic multi-currency transactions), there is a risk of currency fluctuations during the period between the initial transaction and the reversal. Options for mitigating this include:\n- Use of a third party to manage currency exchange and ensuring that this party bears the risk of exchange rate fluctuations during reversals;\n- Passing the risk of currency fluctuations on to the customer in case of reversals (if clearly stated in the T&Cs); and\n- Including sufficient exchange rate margin to allow for fluctuations in the case of reversals.",0,"7.1.3.5.1","7.1.3.5.1: For international money transfers (or domestic multi-currency transactions), have steps been taken to mitigate exchange rate risk (i.e. currency fluctuations during the period between the initial transaction and the reversal)?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.3","","7.1.3.5","MULTI-CURRENCY REVERSALS\nFor international money transfers (or domestic multi-currency transactions), there is a risk of currency fluctuations during the period between the initial transaction and the reversal. Options for mitigating this include:\n- Use of a third party to manage currency exchange and ensuring that this party bears the risk of exchange rate fluctuations during reversals;\n- Passing the risk of currency fluctuations on to the customer in case of reversals (if clearly stated in the T&Cs); and\n- Including sufficient exchange rate margin to allow for fluctuations in the case of reversals.",null,"7.1.3.5.1","7.1.3.6.1","For international money transfers (or domestic multi-currency transactions), have steps been taken to mitigate exchange rate risk (i.e. currency fluctuations during the period between the initial transaction and the reversal)?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.1","7.1.3","","7.1.3.5","ANNULATIONS MULTIDEVISES\nEn matière de transferts internationaux (ou de transactions multidevises nationales), il existe un risque de fluctuation du taux de change entre le moment de la transaction initiale et celui de l’annulation. Il existe plusieurs possibilités pour atténuer ce risque :\n- recours à un intervenant extérieur pour la gestion du taux de change en s’assurant que l’intervenant assume le risque de change en cas d’annulation des opérations ; \n- répercussion du risque de change au client en cas d’annulation (si clairement indiqué dans les CGU) ; \n- appliquer une marge suffisante sur les transactions pour absorber les fluctuations de cours en cas d’annulation. ",0,"7.1.3.5.1","concernant les transferts internationaux (ou les transactions multidevises nationales), des mesures ont-elles été prises pour limiter le risque de change lié aux annulations (à savoir les fluctuations du taux de change entre le moment de la transaction initiale et celui de l’annulation) ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.1","7.1.3","","7.1.3.5","REVERSIONES EN MÚLTIPLES DIVISAS\nPara las transferencias internacionales de dinero (o transacciones nacionales en múltiples divisas), existe un riesgo de fluctuaciones en el tipo de cambio durante el período entre la transacción inicial y la reversión. Las opciones para mitigar esto incluyen:\n- Utilizar un tercero para gestionar el cambio de divisas y garantizar que esta parte asuma el riesgo de fluctuaciones en el tipo de cambio durante las reversiones;\n- Trasladar el riesgo de fluctuaciones en el tipo de cambio al cliente en el caso de reversiones (si se establece con claridad en los términos y condiciones); e\n- Incluir suficiente margen del tipo de cambio como para permitir fluctuaciones en el caso de reversiones.",0,"7.1.3.5.1","Para las transferencias internacionales de dinero (o transacciones nacionales en múltiples divisas), ¿se tomaron medidas para mitigar el riesgo del tipo de cambio (es decir, fluctuaciones en el tipo de cambio durante el período entre la transacción inicial y la reversión?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.1","7.1.3",null,"7.1.3.5",null,0,"7.1.3.5.1",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.1.3.6.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.1","7.1.3","","7.1.3.6","7.1.3.6: CUSTOMER AWARENESS OF TRANSACTION REVERSALS\nProviders should inform customers of the rules governing transaction reversals, including:\n- how reversal requests may be initiated; \n- criteria for approving a reversal;\n- the list of reversible transactions (refer to 7.1.3.4);\n- reversal procedures and anticipated timeframes for investigating and resolving reversal requests;\n- conditions that apply to the refund of transaction fees in case of mistake or dispute; \n- customer recourse in the event that a transaction cannot be reversed because the funds are no longer in the recipient's wallet;\n- reversal procedures for merchant payment transactions (if applicable); \n- reversal procedures for bill payment transactions (if applicable); \n- reversal procedures for off-net transactions (if applicable), including information on:\n     - The expected timescale for resolution;\n     - Potential outcomes; and\n     - Any limitations on the scope of any reversal due to its being an off-net transaction.\n\nThe information on the rules governing transaction reversals should be made clear to customers through the T&Cs or on request from agents or customer care.",0,"7.1.3.6.1","7.1.3.6.1: Is information on how and when transactions can be reversed made clear to customers through the T&Cs or available on request from agents or customer care?\n","1) Customer T&Cs and/or agent point of sale materials\n- Check how and when transactions can be reversed are included in the T&Cs or available on request from agents or customer care.\n- Check it is set out in clear language.",0,"Urgent Required","Required","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.1","7.1.3","","7.1.3.6","CUSTOMER AWARENESS OF TRANSACTION REVERSALS\nProviders should inform customers of the rules governing transaction reversals, including:\n- how reversal requests may be initiated; \n- criteria for approving a reversal;\n- the list of reversible transactions (refer to 7.1.3.4);\n- reversal procedures and anticipated timeframes for investigating and resolving reversal requests;\n- conditions that apply to the refund of transaction fees in case of mistake or dispute; \n- customer recourse in the event that a transaction cannot be reversed because the funds are no longer in the recipient's wallet;\n- reversal procedures for merchant payment transactions (if applicable); \n- reversal procedures for bill payment transactions (if applicable); \n- reversal procedures for off-net transactions (if applicable), including information on:\n     - The expected timescale for resolution;\n     - Potential outcomes; and\n     - Any limitations on the scope of any reversal due to its being an off-net transaction.\n\nThe information on the rules governing transaction reversals should be made clear to customers through the T&Cs or on request from agents or customer care.",null,"7.1.3.6.1","7.1.3.7.1","Is information on how and when transactions can be reversed made clear to customers through the T&Cs or available on request from agents or customer care?","1) Customer T&Cs and/or agent point of sale materials\n- Check how and when transactions can be reversed are included in the T&Cs or available on request from agents or customer care.\n- Check it is set out in clear language.",null,"Urgent Required","Required","CustServ",null,null,"7","7.1","7.1.3","","7.1.3.6","INFORMATION DES CLIENTS CONCERNANT LES ANNULATIONS\nLes prestataires doivent informer leurs clients des règles régissant les annulations d’opérations, concernant notamment les aspects suivants :\n- manière d’initier une demande d’annulation ; \n- critères d’approbation des annulations ;\n- liste des transactions annulables (cf. 7.1.3.4) ;\n- procédures d’annulation et délais prévisibles de recherche et de traitement des demandes d’annulation ;\n- conditions applicables au remboursement des frais d’opération en cas d’erreur ou de litige ; \n- recours à la disposition du client lorsque la transaction ne peut être annulée parce que les fonds ne sont plus disponibles sur le compte du bénéficiaire ;\n- procédures d’annulation applicables aux paiements marchands (le cas échéant) ; \n- procédures d’annulation applicables aux paiements de facture (le cas échéant) ; \n- procédures d’annulation applicables aux transactions hors réseau (le cas échéant), y compris les informations concernant :\n     - le délai prévisible de résolution ;\n     - le résultat potentiel ;\n     - les restrictions éventuellement applicables à ces annulations du fait de leur caractère « hors réseau ».\n\nLes informations concernant les règles applicables aux annulations d'opérations doivent être clairement expliquées aux clients dans les CGU ou sur demande des agents ou du service client.",0,"7.1.3.6.1","Les clients sont-ils informés, dans les CGU ou sur demande des agents ou du service client, des façons et des conditions pour annuler une transaction ?","1) CGU clients et/ou supports de point de vente des agents\n- Vérifier que les CGU ou, sur demande, les agents ou le service client, indiquent aux clients quand et comment les transactions peuvent être annulées.\n- Vérifier que ces indications sont claires et précises.",null,"Requis Prioritaire","Requis","CustServ",0,null,"7","7.1","7.1.3","","7.1.3.6","CONCIENTIZACIÓN DE LOS CLIENTES SOBRE LAS REVERSIONES DE TRANSACCIONES\nLos proveedores deben informar a los clientes las reglas que rigen las reversiones de transacciones, incluyendo:\n- cómo se pueden iniciar las solicitudes de reversiones; \n- los criterios para aprobar una reversión;\n- la lista de transacciones sujetas a reversión (ver 7.1.3.4);\n- los procedimientos de reversión y los plazos anticipados para investigar y resolver solicitudes de reversión;\n- las condiciones aplicables al reintegro de las comisiones de las transacciones en caso de error o controversia; \n- los recursos del cliente en el caso de que una transacción no pueda ser revertida porque los fondos ya no se encuentran en la billetera del receptor;\n- los procedimientos de reversión para las transacciones de pago al comercio (si corresponde); \n- los procedimientos de reversión para las transacciones de pago de facturas (si corresponde); \n- los procedimientos de reversión para las transacciones fuera de la red (si corresponde), incluyendo información sobre:\n     - El plazo estimado de resolución;\n     - Los resultados potenciales; y\n     - Todas las limitaciones al alcance de cualquier reversión dado que se trata de una transacción fuera de la red.\n\nSe debe aclarar a los clientes la información acerca de las reglas que rigen las reversiones de transacciones mediante los términos y condiciones o mediante solicitud a los agentes o atención al cliente.",0,"7.1.3.6.1","¿Se aclara a los clientes la información acerca de cómo y cuándo se pueden revertir las transacciones mediante los términos y condiciones o la información está disponible mediante solicitud a los agentes o atención al cliente?","1) Términos y condiciones para el cliente y/o materiales del punto de venta del agente\n- Verificar que los términos y condiciones incluyan cómo y cuándo se pueden revertir las transacciones o que esta información esté disponible mediante solicitud a los agentes o atención al cliente.\n- Verificar que se establezca en lenguaje claro.",null,"Obligatorio urgente","Obligatorio","CustServ",null,null,"7","7.1","7.1.3",null,"7.1.3.6",null,0,"7.1.3.6.1",null,null,null,"ReqU4","Req4","CustServ",null,null,null,null,null,null,null,null,"7.1.3.7.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7",0,0,{"$f":"UPPER(CONCATENATE(Introduction!C31,\": \",Introduction!D31))","v":"7.2: AVAILABILITY OF CUSTOMER SERVICE SUPPORT"},null,null,0,0,{"$f":"Introduction!E31","v":"Providers shall provide an appropriate mechanism for customers to address questions and problems"},null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,BK46,CA46,CQ46,DG46)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7",null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$31,\": \",Introduction!$L$31))","v":"7.2: AVAILABILITY OF CUSTOMER SERVICE SUPPORT"},null,null,null,null,0,{"$f":"Introduction!$M$31","v":"Providers shall provide an appropriate mechanism for customers to address questions and problems"},null,null,null,null,0,null,null,"7",0,0,null,0,null,0,0,null,null,null,null,null,0,null,null,"7",0,0,{"$f":"UPPER(CONCATENATE(Introduction!$U$31,\": \",Introduction!$V$31))","v":"7.2: DISPONIBILIDAD DE SOPORTE DE ATENCIÓN AL CLIENTE"},null,null,0,0,{"$f":"Introduction!W31","v":"El proveedor proporcionará mecanismos adecuados para que el cliente resuelva preguntas y problemas."},null,null,null,null,0,null,null,"7",0,0,null,0,null,0,0,null,null,null,null,null,0]
[null,"7","7.2","7.2.1",{"$f":"CHOOSE(LanguageNumber,AY47,BP47,CF47,CV47)","v":"7.2.1: Providers shall provide an appropriate mechanism to address customers' questions and problems"},"7.2.1.1",{"$f":"AZ47&\": \"&CHOOSE(LanguageNumber,BA47,BR47,CH47,CX47)","v":"7.2.1.1: ACCESS TO DEDICATED CUSTOMER SUPPORT\nProviders should have a customer care team dedicated to providing customer support for mobile money. A dedicated mobile money support team will be able to deal with the complexities and risks surrounding mobile money."},0,"7.2.1.1.1",{"$f":"BC47&\": \"&CHOOSE(LanguageNumber,BE47,BU47,CK47,DA47)&CarriageReturn","v":"7.2.1.1.1: Is there a dedicated mobile money support team (not shared with other telco customer support)\n"},{"$f":"CHOOSE(LanguageNumber,BF47,BV47,CL47,DB47)","v":0},{"$f":"CHOOSE(LanguageNumber,BG47,BW47,CM47,DC47)","v":0},{"$f":"CHOOSE(LanguageNumber,BH47,BX47,CN47,DD47)","v":"Recommended"},"Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.2","7.2.1","7.2.1: Providers shall provide an appropriate mechanism to address customers' questions and problems","7.2.1.1","ACCESS TO DEDICATED CUSTOMER SUPPORT\nProviders should have a customer care team dedicated to providing customer support for mobile money. A dedicated mobile money support team will be able to deal with the complexities and risks surrounding mobile money.",null,"7.2.1.1.1","7.2.1.1.1","Is there a dedicated mobile money support team (not shared with other telco customer support)",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.2","7.2.1","7.2.1: Mettre un mécanisme approprié à la disposition de la clientèle pour répondre aux questions et problèmes de celle-ci.","7.2.1.1","ACCÈS À UN SERVICE CLIENT DÉDIÉ\nLes prestataires doivent se doter d’un service client dédié à la clientèle de l’argent mobile, capable de gérer la complexité de cette activité et les risque qui s’y rattachent.",0,"7.2.1.1.1","existe-t-il une équipe d'assistance à la clientèle propre à l'argent mobile (non partagée avec d'autres fonctions d'assistance à la clientèle du prestataire) ?",null,null,{"$f":"VLOOKUP($BH47,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},{"$f":"VLOOKUP($BI47,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},"CustServ",0,null,"7","7.2","7.2.1","7.2.1: Proporcionar un mecanismo adecuado para abordar las preguntas y los problemas de los clientes.","7.2.1.1","ACCESO A SOPORTE DEDICADO AL CLIENTE\nLos proveedores deben contar con un equipo de atención al cliente dedicado a brindar soporte al cliente para el dinero móvil. Un equipo de soporte del dinero móvil dedicado podrá tratar las complejidades y los riesgos en torno al dinero móvil.",0,"7.2.1.1.1","¿Existe un equipo de soporte del dinero móvil dedicado (no compartido con otro soporte al cliente de telecomunicaciones)?",null,null,{"$f":"VLOOKUP($BH47,CategoryTranslationTable,3,FALSE)","v":"Recomendado"},{"$f":"VLOOKUP($BI47,CategoryTranslationTable,3,FALSE)","v":"Recomendado"},"CustServ",null,null,"7","7.2","7.2.1",null,"7.2.1.1",null,0,"7.2.1.1.1",null,null,null,{"$f":"VLOOKUP($BH47,CategoryTranslationTable,4,FALSE)","v":"Rec4"},{"$f":"VLOOKUP($BI47,CategoryTranslationTable,4,FALSE)","v":"Rec4"},"CustServ",null,null,null,null,null,null,null,null,"7.2.1.1.1",null,null,null,{"$f":"IF(OR($EA47=0,$EA47=2),VLOOKUP(DO47,INDIRECT(ED47),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP47),\"\",VLOOKUP(DP47,INDIRECT(EE47),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ47),\"\",VLOOKUP(DQ47,INDIRECT(EF47),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR47),\"\",VLOOKUP(DR47,INDIRECT(EG47),7,FALSE))","v":""},{"$f":"IF(OR($EA47=0,$EA47=2),VLOOKUP(DO47,INDIRECT(ED47),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP47),\"\",VLOOKUP(DP47,INDIRECT(EE47),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ47),\"\",VLOOKUP(DQ47,INDIRECT(EF47),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR47),\"\",VLOOKUP(DR47,INDIRECT(EG47),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN47,3)=\"NEW\")+2*AND(LEFT(DN47,3)=\"MER\")+3*AND(LEFT(DN47,3)=\"MOV\")+4*AND(LEFT(DN47,3)=\"SWA\")","v":0},{"$error":"#REF!"},{"$f":"IF(EA47=0,IF(DW47=0,\"\",DW47),CHOOSE(EA47,\"New indicator\",CONCATENATE(DW47,CarriageReturn,DX47,CarriageReturn,DY47,CarriageReturn,DZ47)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO47,1)","v":"OriginalComplianceP7"},{"$f":"\"OriginalComplianceP\"&LEFT(DP47,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ47,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR47,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,""]
[null,"7","7.2","7.2.1",0,"7.2.1.2","7.2.1.2: ADDRESSING COMPLEX OR HIGH-RISK ISSUES \nComplex and/or high-risk issues requiring more detailed support should be addressed by a second-level customer service team which has more in-depth training. Examples of complex issues could include transaction errors, bulk payments or complaint escalations.",0,"7.2.1.2.1","7.2.1.2.1: Does the provider's customer care capability include a second level of support trained to deal with complex and/or high-risk issues?\n","1) Customer service organization chart / customer service process documentation / customer service training plan\n- Check there is a process to escalete complex and/or high-risk issues to second level of customer care\n- Check that the chart includes a second level of customer care that deals with complex and/or high-risk issues \n- Check that the second level of customer service receive additional training to manage complex and/or high-risk issues",0,"Standard Required","Required","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.2","7.2.1",null,"7.2.1.2","ADDRESSING COMPLEX OR HIGH-RISK ISSUES \nComplex and/or high-risk issues requiring more detailed support should be addressed by a second-level customer service team which has more in-depth training. Examples of complex issues could include transaction errors, bulk payments or complaint escalations.",null,"7.2.1.2.1","7.2.1.2.1","Does the provider's customer care capability include a second level of support trained to deal with complex and/or high-risk issues?","1) Customer service organization chart / customer service process documentation / customer service training plan\n- Check there is a process to escalete complex and/or high-risk issues to second level of customer care\n- Check that the chart includes a second level of customer care that deals with complex and/or high-risk issues \n- Check that the second level of customer service receive additional training to manage complex and/or high-risk issues",null,"Standard Required","Required","CustServ",null,null,"7","7.2","7.2.1",0,"7.2.1.2","GESTION DES PROBLÈMES COMPLEXES OU À HAUT RISQUE \nLes problèmes complexes ou à haut risque qui nécessitent une assistance plus spécifique doivent être pris en charge par une équipe d’assistance à la clientèle de second niveau possédant une formation plus approfondie. Ces problèmes plsu complexes peuvent par exemple concerner des erreurs de transaction, des paiements groupés ou la remontée de réclamations. \n",0,"7.2.1.2.1","La capacité du service client du prestataire comprend-elle un niveau de soutien plus important formé pour traiter les problèmes complexes et/ou à haut niveau de risque ?","1) Organigramme du service client/documentation du processus du service client/plan de formation au service client \n- Vérifier qu’un processus a été mis en place pour faire remonter les problèmes complexes et/ou à haut risque jusqu’à une équipe d’assistance à la clientèle de second niveau\n- Vérifier que l’organigramme inclut une équipe d’assistance à la clientèle de second niveau prenant en charge les problèmes complexes et/ou à haut risque \n- Vérifier qu’une formation supplémentaire pour la gestion des problèmes complexes et/ou à haut risque est dispensée à l’équipe d’assistance à la clientèle de second niveau ",null,"Requis Normal","Requis","CustServ",0,null,"7","7.2","7.2.1",null,"7.2.1.2","ABORDAR PROBLEMAS COMPLEJOS O DE ALTO RIESGO\nLos problemas complejos y/o de alto riesgo que requieren un soporte más detallado deben ser abordados por un equipo de atención al cliente de segundo nivel más capacitado. Los ejemplos de transacciones complejas podrían incluir errores de transacciones, pagos globales o escalamiento de reclamos.",0,"7.2.1.2.1","¿La capacidad de atención al cliente del proveedor incluye un soporte de segundo nivel capacitado para tratar problemas complejos y/o de alto riesgo?","1) Organigrama de atención al cliente / documentación de procesos de atención al cliente / plan de capacitación de atención al cliente\n- Verificar que exista un proceso para escalar los problemas complejos y/o de alto riesgo al segundo nivel de atención al cliente\n- Verificar que el organigrama incluya un segundo nivel de atención al cliente que trate problemas complejos y/o de alto riesgo\n- Verificar que el segundo nivel de atención al cliente reciba capacitación adicional para manejar problemas complejos y/o de alto riesgo",null,"Obligatorio estándar","Obligatorio","CustServ",null,null,"7","7.2","7.2.1",null,"7.2.1.2",null,0,"7.2.1.2.1",null,null,null,"ReqS4","Req4","CustServ",null,null,null,null,null,null,null,null,"7.2.1.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.2","7.2.1",0,"7.2.1.3",{"$f":"AZ49&\": \"&CHOOSE(LanguageNumber,BA49,BR49,CH49,CX49)","v":"7.2.1.3: CLOSING MOBILE MONEY ACCOUNTS\nCustomers should be able to close their mobile money accounts and withdraw all remaining funds using one or more convenient mechanisms such as the following:\n- self-help, using tools available within the mobile money service;\n- with assistance from customer care personnel; and/or\n- at agents or other retail outlets.\n\nProviders should also have formal procedures in place for closing a relative’s account in case of death. "},0,"7.2.1.3.1","7.2.1.3.1: Are customers able to close their mobile money accounts and withdraw all remaining funds using one or more convenient mechanisms?\n",{"$f":"CHOOSE(LanguageNumber,BF49,BV49,CL49,DB49)","v":0},0,{"$f":"CHOOSE(LanguageNumber,BH49,BX49,CN49,DD49)","v":"Recommended"},"Recommended","CustServ",{"$f":"CHOOSE(LanguageNumber,BK49,CA49,CQ49,#REF!)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.2","7.2.1",null,"7.2.1.3","CLOSING MOBILE MONEY ACCOUNTS\nCustomers should be able to close their mobile money accounts and withdraw all remaining funds using one or more convenient mechanisms such as the following:\n- self-help, using tools available within the mobile money service;\n- with assistance from customer care personnel; and/or\n- at agents or other retail outlets.\n\nProviders should also have formal procedures in place for closing a relative’s account in case of death. ",null,"7.2.1.3.1","7.2.1.3.1","Are customers able to close their mobile money accounts and withdraw all remaining funds using one or more convenient mechanisms?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.2","7.2.1",0,"7.2.1.3","CLÔTURE DES COMPTES D’ARGENT MOBILE\nLes clients doivent pouvoir clôturer leur compte d’argent mobile et retirer le solde du compte au moyen d’un ou plusieurs mécanismes pratiques tels que :\n- des outils disponibles en libre-service au sein du service d’argent mobile ;\n- l’assistance de l’équipe du service client ; et/ou \n- l’assistance des agents ou d’autres points de vente.\n\nLes prestataires doivent également se doter de procédures formalisées pour la clôture des comptes en cas de décès du titulaire. ",{"$f":"BB49","v":0},"7.2.1.3.1","les clients ont-ils la possibilité de clôturer leur compte et d'en retirer le solde au moyen d’un ou plusieurs mécanismes faciles d'accès ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.2","7.2.1",null,"7.2.1.3","CIERRE DE CUENTAS DEL DINERO MÓVIL\nLos clientes deben poder cerrar sus cuentas del dinero móvil y retirar los fondos restantes usando uno o más mecanismos convenientes, como por ejemplo:\n- autoayuda, usando herramientas disponibles dentro del servicio del dinero móvil;\n- con asistencia del personal de atención al cliente; y/o\n- en los agentes u otros comercios minoristas.\n\nLos proveedores también deben implementar procedimientos formales para poder cerrar la cuenta de un familiar en caso de fallecimiento. ",{"$f":"BB49","v":0},"7.2.1.3.1","¿Los clientes pueden cerrar sus cuentas del dinero móvil y retirar los fondos restantes usando uno o más mecanismos convenientes?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.2","7.2.1",null,"7.2.1.3",null,{"$f":"BB49","v":0},"7.2.1.3.1",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.2.1.3.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.2","7.2.1",0,"7.2.1.3",null,0,"7.2.1.3.2","7.2.1.3.2: Are formal procedures in place for closing a relative’s account in case of death?\n",0,0,"Recommended","Recommended","CustServ",{"$f":"CHOOSE(LanguageNumber,BK50,CA50,CQ50,#REF!)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.2","7.2.1",null,"7.2.1.3",null,null,"7.2.1.3.2","7.2.1.3.2","Are formal procedures in place for closing a relative’s account in case of death?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.2","7.2.1",0,"7.2.1.3",0,0,"7.2.1.3.2","existe-t-il des procédures formelles de clôture des comptes en cas de décès du titulaire ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.2","7.2.1",null,"7.2.1.3",null,0,"7.2.1.3.2","¿Se implementaron procedimientos formales para poder cerrar la cuenta de un familiar en caso de fallecimiento?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.2","7.2.1",null,"7.2.1.3",null,0,"7.2.1.3.2",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.2.1.3.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.2","7.2.1",0,"7.2.1.4","7.2.1.4: ACCESS TO ALL NECESSARY CUSTOMER DATA\nProviders should ensure that customer care personnel have access to relevant customer data, including transaction details and notes from previous contact with the provider. \n\nCustomers should not be required to repeat the details of issues unnecessarily when they need to contact customer care personnel more than once or are passed from one customer care team to another.\n\nTo facilitate this, each customer should be assigned a reference/ticket number for their call, and this number should be shared with customers.",0,"7.2.1.4.1","7.2.1.4.1: Do customer care personnel have access to relevant customer data, including transaction details and notes from previous contact with the provider?\n","1) Customer service system - customer service screens\n- Check customer care personnel have access to customer information, including transaction details and notes from previous contact with the provider.\n[Notes from previous calls could be tracked manually]",0,"Standard Required","Required","CustServ",{"$f":"CHOOSE(LanguageNumber,BK51,CA51,CQ51,#REF!)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.2","7.2.1",null,"7.2.1.4","ACCESS TO ALL NECESSARY CUSTOMER DATA\nProviders should ensure that customer care personnel have access to relevant customer data, including transaction details and notes from previous contact with the provider. \n\nCustomers should not be required to repeat the details of issues unnecessarily when they need to contact customer care personnel more than once or are passed from one customer care team to another.\n\nTo facilitate this, each customer should be assigned a reference/ticket number for their call, and this number should be shared with customers.",null,"7.2.1.4.1","7.2.1.4.1","Do customer care personnel have access to relevant customer data, including transaction details and notes from previous contact with the provider?","1) Customer service system - customer service screens\n- Check customer care personnel have access to customer information, including transaction details and notes from previous contact with the provider.\n[Notes from previous calls could be tracked manually]",null,"Standard Required","Required","CustServ",null,null,"7","7.2","7.2.1",0,"7.2.1.4","ACCÈS À TOUTES LES DONNÉES NÉCESSAIRES CONCERNANT LES CLIENTS\nLes prestataires doivent s’assurer que les collaborateurs du service client aient accès à toutes les données utiles concernant les clients, y compris celles relatives aux précédents contacts du client avec le service client, afin de pouvoir répondre à chaque demande. \n\nLes clients ne doivent pas avoir à répéter sans nécessité le détail de leur problème lorsqu’ils ont besoin de contacter le service client plus d'une fois ou qu'ils sont transférés d’une équipe à l’autre au sein du service client. \n\nPour ce faire, un numéro de référence/dossier doit être attribué et communiqué à chaque client en relation avec leur appel.",0,"7.2.1.4.1","le personnel du service client a-t-il accès à toutes les données utiles concernant les clients, y compris celles relatives aux précédents contacts du client avec le service client, afin de pouvoir répondre à chaque demande ?","1) Système du service client - analyses du service client\n- Vérifier que le personnel du service client a accès aux données concernant les clients, y compris le détail des transactions et les notes relatives aux précédents contacts avec le prestataire.\n[Les notes relatives aux précédents appels peuvent faire l'objet d'un suivi manuel]",null,"Requis Normal","Requis","CustServ",0,null,"7","7.2","7.2.1",null,"7.2.1.4","ACCESO A TODOS LOS DATOS DE CLIENTES NECESARIOS\nLos proveedores deben garantizar que el personal de atención al cliente tenga acceso a los datos relevantes de los clientes, incluyendo detalles de las transacciones y notas de contactos previos con el proveedor. \n\nNo se debe solicitar a los clientes que repitan los detalles del problema innecesariamente cuando deben contactarse con el personal de atención al cliente más de una vez o cuando son transferidos de un equipo de atención al cliente a otro.\n\nPara facilitar esto, se debe asignar un número de referencia/ticket de la llamada a cada cliente  y compartir este número con los clientes.",0,"7.2.1.4.1","¿El personal de atención al cliente tiene acceso a los datos relevantes de los clientes, incluyendo los detalles de las transacciones y notas de contactos previos con el proveedor?","1) Sistema de atención al cliente  - pantallas de atención al cliente\n- Verificar que el personal de atención al cliente tenga acceso a la información de los clientes, incluyendo los detalles de las transacciones y notas de contactos previos con el proveedor.  \n[Las notas de llamadas previas se pueden rastrear en forma manual].",null,"Obligatorio estándar","Obligatorio","CustServ",null,null,"7","7.2","7.2.1",null,"7.2.1.4",null,0,"7.2.1.4.1",null,null,null,"ReqS4","Req4","CustServ",null,null,null,null,null,null,null,null,"7.2.1.4.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.2","7.2.1",0,"7.2.1.4",null,0,"7.2.1.4.2","7.2.1.4.2: Are mechanisms in place to avoid requiring customers to repeat the details of issues unnecessarily when they need to contact customer care personnel more than once or are passed from one customer care team to another (such as assigning a reference/ticket number to each call by a customer)?\n",0,0,"Recommended","Recommended","CustServ",{"$f":"CHOOSE(LanguageNumber,BK52,CA52,CQ52,#REF!)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.2","7.2.1",0,"7.2.1.4","",null,"7.2.1.4.2","7.2.1.4.2","Are mechanisms in place to avoid requiring customers to repeat the details of issues unnecessarily when they need to contact customer care personnel more than once or are passed from one customer care team to another (such as assigning a reference/ticket number to each call by a customer)?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.2","7.2.1",0,"7.2.1.4","",0,"7.2.1.4.2","des mécanismes sont-ils en place pour éviter que les clients aient à répéter sans nécessité le détail de leur problème à répéter sans nécessité le détail de leur problème lorsqu’ils ont besoin de contacter le service client plus d'une fois ou qu'ils sont transférés d’une équipe à l’autre au sein du service client (enattribuant par exemple un numéro de référence/dossier à chaque appel des clients) ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.2","7.2.1",0,"7.2.1.4","",0,"7.2.1.4.2","¿Se implementaron mecanismos para evitar tener que solicitar a los clientes que repitan los detalles de los problemas innecesariamente cuando deben contactarse con al personal de atención al cliente más de una vez o cuando son transferidos de un equipo de atención al cliente a otro (como por ejemplo asignar un número de referencia/ticket a cada llamada de un cliente)?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.2","7.2.1",null,"7.2.1.4",null,0,"7.2.1.4.2",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.2.1.4.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.2","7.2.1",0,"7.2.1.5","7.2.1.5: AVAILABILITY OF CUSTOMER CARE SUPPORT\nProviders should ensure that customer care personnel are available during business hours at minimum and ideally 24 hours a day, 7 days a week. \n\nSecond-level customer service staff who address complex and/or high-risk issues (see 7.2.1.2) should be available during business hours, at a minimum.",0,"7.2.1.5.1","7.2.1.5.1: Are customer care personnel available 24 hours a day, 7 days a week?\n",0,0,"Recommended","Recommended","CustServ",{"$f":"CHOOSE(LanguageNumber,BK53,CA53,CQ53,#REF!)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.2","7.2.1",null,"7.2.1.5","AVAILABILITY OF CUSTOMER CARE SUPPORT\nProviders should ensure that customer care personnel are available during business hours at minimum and ideally 24 hours a day, 7 days a week. \n\nSecond-level customer service staff who address complex and/or high-risk issues (see 7.2.1.2) should be available during business hours, at a minimum.",null,"7.2.1.5.1","7.2.1.6.1","Are customer care personnel available 24 hours a day, 7 days a week?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.2","7.2.1",0,"7.2.1.5","DISPONIBILITÉ DU SERVICE D’ASSISTANCE À LA CLIENTÈLE\nLes prestataires doivent veiller à ce que les équipes du service client soient au minimum disponibles pendant les heures de bureau et dans l’idéal, 24 heures sur 24, 7 jours sur 7. \n\nLe personnel du service client de second niveau s’occupant des problèmes complexes ou à haut risque (cf. 7.2.1.2) doit au minimum être disponible pendant les heures habituelles de bureau. ",0,"7.2.1.5.1","le personnel du service client est-il disponible 24 heures sur 24, 7 jours sur 7 ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.2","7.2.1",null,"7.2.1.5","DISPONIBILIDAD DE SOPORTE AL CLIENTE\nLos proveedores deben garantizar que el personal de atención al cliente esté disponible, como mínimo, en horas hábiles e, idealmente, las 24 horas del día, los 7 días de la semana. \n\nEl personal de atención al cliente del segundo nivel que trata problemas complejos y/o de alto riesgo (ver 7.2.1.2) debe estar disponible, como mínimo, en horas hábiles.",0,"7.2.1.5.1","¿El personal de atención al cliente está disponible las 24 horas del día, los 7 días de la semana?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.2","7.2.1",null,"7.2.1.5",null,0,"7.2.1.5.1",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.2.1.6.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.2","7.2.1",0,"7.2.1.5",null,0,"7.2.1.5.2","7.2.1.5.2: Are first- and  second-level customer service staff available during business hours, at a minimum?\n","1) Customer service process documentation\n- Check the working times of the first- and second-level customer support staff cover standard business hours at a minimum.",0,"Standard Required","Required","CustServ",{"$f":"CHOOSE(LanguageNumber,BK54,CA54,CQ54,#REF!)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.2","7.2.1",null,"7.2.1.5",null,null,"7.2.1.5.2","7.2.1.6.3","Are first- and  second-level customer service staff available during business hours, at a minimum?","1) Customer service process documentation\n- Check the working times of the first- and second-level customer support staff cover standard business hours at a minimum.",null,"Standard Required","Required","CustServ",null,null,"7","7.2","7.2.1",0,"7.2.1.5","",0,"7.2.1.5.2","le personnel du service client de second niveau (s’occupant des problèmes complexes ou à haut risque) est-il au minimum disponible pendant les heures habituelles de bureau ?","1) Documentation du processus du service client\n- Vérifier que le personnel du service client du premier et second niveau est au minimum disponible pendant les heures habituelles de bureau.",null,"Requis Normal","Requis","CustServ",0,null,"7","7.2","7.2.1",null,"7.2.1.5","",0,"7.2.1.5.2","¿El personal de atención al cliente de primer y segundo nivel está disponible, como mínimo, en horas hábiles?","1) Documentación de procesos de atención al cliente\n- Verificar que las horas laborales del personal de atención al cliente de primer y segundo nivel abarquen, como mínimo, las horas hábiles estándar.",null,"Obligatorio estándar","Obligatorio","CustServ",null,null,"7","7.2","7.2.1",null,"7.2.1.5",null,0,"7.2.1.5.2",null,null,null,"ReqS4","Req4","CustServ",null,null,null,null,null,null,null,null,"7.2.1.6.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.2","7.2.1",0,"7.2.1.6","7.2.1.6: ACCESS TO CUSTOMER CARE IN DIFFERENT LANGUAGES\nWhere feasible, customer care support should be available in the official language(s) and/or other commonly spoken languages (including regional languages) for all stages of the complaints process.\n\nNOTE:  It may not be feasible or commercially sustainable to provide customer care support in all official languages and/or other commonly spoken languages for all stages of the complaints process. Where feasible and commercially sustainable, however, providers should make a reasonable effort to communicate in languages that can be comprehended by people from different regions and with varying levels of education.\n",0,"7.2.1.6.1","7.2.1.6.1: Do customers have access to customer care personnel who speak all official languages and/or commonly-spoken languages (including regional languages) for all stages of the complaints process?\n",0,0,"Recommended","Recommended","CustServ",{"$f":"CHOOSE(LanguageNumber,BK55,CA55,CQ55,#REF!)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.2","7.2.1",0,"7.2.1.6","ACCESS TO CUSTOMER CARE IN DIFFERENT LANGUAGES\nWhere feasible, customer care support should be available in the official language(s) and/or other commonly spoken languages (including regional languages) for all stages of the complaints process.\n\nNOTE:  It may not be feasible or commercially sustainable to provide customer care support in all official languages and/or other commonly spoken languages for all stages of the complaints process. Where feasible and commercially sustainable, however, providers should make a reasonable effort to communicate in languages that can be comprehended by people from different regions and with varying levels of education.\n",null,"7.2.1.6.1","7.2.1.7.1","Do customers have access to customer care personnel who speak all official languages and/or commonly-spoken languages (including regional languages) for all stages of the complaints process?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.2","7.2.1",0,"7.2.1.6","ACCÈS AU SERVICE CLIENT EN PLUSIEURS LANGUES\nDans la mesure du possible, l’assistance à la clientèle doit être offerte dans la ou les langues officielles du pays et/ou les autres langues couramment parlées (y compris les langues régionales) à tous les stades du processus de réclamation. \n\nREMARQUE : il n’est pas toujours possible, ou commercialement viable, d’offrir une assistance à la clientèle dans la ou les langues officielles du pays et/ou les autres langues couramment parlées à tous les stades du processus de réclamation. Mais lorsque cela est possible et commercialement viable, les prestataires doivent s’efforcer de communiquer dans des langues comprises par les personnes de différentes régions et de différents niveaux d’éducation.\n\n",0,"7.2.1.6.1","les clients ont-ils accès à des collaborateurs du service client parlant toutes les langues officielles et/ou couramment parlées (y compris les langues régionales) à tous les stades du processus de réclamation ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.2","7.2.1",0,"7.2.1.6","ACCESO A ATENCIÓN AL CLIENTE EN DISTINTOS IDIOMAS\nCuando sea factible, el soporte al cliente debe estar disponible en el(los) idioma(s) oficial(es) y/u otros idiomas comúnmente hablados (incluidos los idiomas regionales) para todas las etapas del proceso de reclamos.\n\nNOTA:  Es posible que no sea factible o comercialmente sostenible ofrecer soporte al cliente en todos los idiomas oficiales y/u otros idiomas comúnmente hablados durante todas las etapas del proceso de reclamos. No obstante, cuando sea factible y comercialmente sostenible, los empleados deben realizar los esfuerzos razonables para comunicarse en los idiomas que puedan comprender las personas de distintas regiones y con diferentes niveles educativos.\n",0,"7.2.1.6.1","¿Los clientes tienen acceso al personal de atención al cliente que hable los idiomas oficiales y/o los idiomas comúnmente hablados (incluidos los idiomas regionales) en todas las etapas del proceso de reclamos?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.2","7.2.1",null,"7.2.1.6",null,0,"7.2.1.6.1",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.2.1.7.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.2","7.2.1",0,"7.2.1.7","7.2.1.7: SECURE COMMUNICATION WITH CUSTOMERS\nProviders should offer at least one secure channel for communicating with customers and addressing issues related to the use of the service (see definition). The choice of channel (e.g. call centre, in-person, secure messaging) should be appropriate for the target market. Providers should inform customers about this channel and explain that any other channels for communicating with the provider (such as e-mail) may not be secure.\n\nProviders should enable customers to verify that calls or messages from the provider are legitimate by using a published number or another reliable method to facilitate identification of the provider. This is an important action in tackling social engineering fraud.","ECB RSMP","7.2.1.7.1","7.2.1.7.1: Are customers advised of how to contact customer service securely (e.g. call centre, in-person, secure messaging) and that other channels (such as e-mail) may not be secure?\n",0,0,"Recommended","Recommended","CustServ",{"$f":"CHOOSE(LanguageNumber,BK56,CA56,CQ56,#REF!)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.2","7.2.1",null,"7.2.1.7","SECURE COMMUNICATION WITH CUSTOMERS\nProviders should offer at least one secure channel for communicating with customers and addressing issues related to the use of the service (see definition). The choice of channel (e.g. call centre, in-person, secure messaging) should be appropriate for the target market. Providers should inform customers about this channel and explain that any other channels for communicating with the provider (such as e-mail) may not be secure.\n\nProviders should enable customers to verify that calls or messages from the provider are legitimate by using a published number or another reliable method to facilitate identification of the provider. This is an important action in tackling social engineering fraud.","ECB RSMP","7.2.1.7.1","7.2.1.8.2","Are customers advised of how to contact customer service securely (e.g. call centre, in-person, secure messaging) and that other channels (such as e-mail) may not be secure?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.2","7.2.1",0,"7.2.1.7","COMMUNICATION SÉCURISÉE AVEC LES CLIENTS\nLes prestataires doivent offrir au moins un canal sécurisé de communication avec les clients et de traitement des problèmes liés à l’utilisation du service (voir définition). Le canal retenu (ex. centre d’appels, messagerie sécurisée ou en personne) doit être adapté au marché cible. Les prestataires doivent informer les clients de l’existence de ce canal et expliquer pourquoi les autres canaux de communication avec le prestataire (email par exemple) ne sont pas forcément sûrs.\n\nLe prestataire doit permettre aux clients de vérifier que ses appels ou messages sont légitimes en utilisant un numéro publié ou une autre méthode fiable permettant de l’identifier. Il s’agit d’une action importante permettant de lutter contre la fraude à la manipulation sociale.","ECB RSMP","7.2.1.7.1","les clients savent-ils comment contacter le service client de façon sécurité (ex. centre d’appels, messagerie sécurisée ou en personne) que les autres canaux de communication avec le prestataire (email par exemple) ne sont pas forcément sûrs ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.2","7.2.1",null,"7.2.1.7","COMUNICACIÓN SEGURA CON LOS CLIENTES\nLos proveedores deben ofrecer, al menos, un canal seguro para comunicarse con los clientes y abordar los problemas relacionados con el uso del servicio (ver definición). La elección del canal (por ej., centro de atención telefónica, atención personal, mensajería segura) debe ser adecuada para el mercado objetivo. Los proveedores deben informar a los clientes acerca de este canal y explicarles que los demás canales para comunicarse con el proveedor (como el correo electrónico) pueden no ser seguros.\n\nLos proveedores deben permitir a los clientes verificar que las llamadas o mensajes de los proveedores sean legítimos utilizando un número publicado u otro método confiable para facilitar la identificación del proveedor. Esta es una acción importante para abordar el fraude por ingeniería social.","ECB RSMP","7.2.1.7.1","¿Se informa a los clientes cómo contactarse con atención al cliente de forma segura (por ej., centro de atención telefónica, atención personal, mensajería segura) y que los demás canales (como el correo electrónico) pueden no ser seguros?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.2","7.2.1",null,"7.2.1.7",null,"ECB RSMP","7.2.1.7.1",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.2.1.8.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.2","7.2.1",0,"7.2.1.7",null,0,"7.2.1.7.2","7.2.1.7.2: Does the provider enable customers to verify that calls / messages from the provider are legitimate by using a published number?\n",0,0,"Recommended","Recommended","CustServ",{"$f":"CHOOSE(LanguageNumber,BK57,CA57,CQ57,#REF!)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.2","7.2.1",null,"7.2.1.7","",null,"7.2.1.7.2","7.2.1.8.3","Does the provider enable customers to verify that calls / messages from the provider are legitimate by using a published number?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.2","7.2.1",0,"7.2.1.7","",0,"7.2.1.7.2","le prestataire permet-il à ses clients de vérifier que ses appels / messages sont légitimes en utilisant un numéro publié ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.2","7.2.1",null,"7.2.1.7","",0,"7.2.1.7.2","¿El proveedor permite a los clientes verificar que las llamadas / mensajes del proveedor son legítimos usando un número publicado?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.2","7.2.1",null,"7.2.1.7",null,0,"7.2.1.7.2",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.2.1.8.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.2","7.2.1",0,"7.2.1.8","7.2.1.8: TESTING CUSTOMER SUPPORT\nProviders should test customer support (e.g., using mystery callers) for all possible customer complaints to ensure that customer care personnel, including the second-level customer service team (see 7.2.1.2), are able to address and resolve specific complaints and requests raised by customers. ",0,"7.2.1.8.1","7.2.1.8.1: Has customer support been tested for all possible mobile money issues to ensure that customer care personnel are able to address and resolve specific complaints and requests raised by customers?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.2","7.2.1",null,"7.2.1.8","TESTING CUSTOMER SUPPORT\nProviders should test customer support (e.g., using mystery callers) for all possible customer complaints to ensure that customer care personnel, including the second-level customer service team (see 7.2.1.2), are able to address and resolve specific complaints and requests raised by customers. ",null,"7.2.1.8.1","7.2.1.9.1","Has customer support been tested for all possible mobile money issues to ensure that customer care personnel are able to address and resolve specific complaints and requests raised by customers?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.2","7.2.1",0,"7.2.1.8","CONTRÔLE DU SERVICE CLIENT\nLes prestataires doivent tester leur service client (au moyen par exemple d’appels mystères) sur tous les problèmes possibles se rapportant à l'argent mobile afin de veerifier que le personnel du service client, y compris le service client de second niveau (cf. 7.2.1.2), est capable de répondre à des demandes et des réclamations spécifiques de la part des clients. ",0,"7.2.1.8.1","le service client est-il testé sur tous les problèmes possibles se rapportant à l'argent mobile afin de vérifier que le personnel du service client est capable de répondre à des demandes et des réclamations spécifiques de la part des client?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.2","7.2.1",null,"7.2.1.8","PRUEBAS DE SOPORTE AL CLIENTE \nLos proveedores deben probar el soporte al cliente (por ej., empleando clientes incógnitos) para todos los reclamos posibles de los clientes a fin de garantizar que el personal de atención al cliente, incluido el equipo de atención al cliente de segundo nivel (ver 7.2.1.2), pueda abordar y resolver los reclamos y solicitudes específicas presentadas por los clientes. ",0,"7.2.1.8.1","¿Se probó atención al  cliente para todos los problemas posibles del dinero móvil a fin de garantizar que el personal de atención al cliente pueda abordar y resolver los reclamos y solicitudes específicas presentadas por los clientes?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.2","7.2.1",null,"7.2.1.8",null,0,"7.2.1.8.1",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.2.1.9.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7",0,0,{"$f":"UPPER(CONCATENATE(Introduction!C32,\": \",Introduction!D32))","v":"7.3: EXTERNAL RECOURSE MECHANISMS"},null,null,0,0,{"$f":"Introduction!E32","v":"Providers shall specify how disputes can be resolved if internal resolution fails"},null,null,null,null,null,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7",null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$32,\": \",Introduction!$L$32))","v":"7.3: EXTERNAL RECOURSE MECHANISMS"},null,null,null,null,0,{"$f":"Introduction!$M$32","v":"Providers shall specify how disputes can be resolved if internal resolution fails"},null,null,null,null,0,null,null,"7",0,0,null,0,null,0,0,null,null,null,null,null,0,null,null,"7",0,0,{"$f":"UPPER(CONCATENATE(Introduction!$U$32,\": \",Introduction!$V$32))","v":"7.3: MECANISMOS EXTERNOS DE RESOLUCIÓN DE CONTROVERSIAS"},null,null,0,0,{"$f":"Introduction!W32","v":"El proveedor establecerá un proceso para la resolución de controversias en los casos en que no es posible resolverlas internamente"},null,null,null,null,0,null,null,"7",0,0,null,0,null,0,0,null,null,null,null,null,0]
[null,"7","7.3","7.3.1",{"$f":"CHOOSE(LanguageNumber,AY60,BP60,CF60,CV60)","v":"7.3.1: Providers shall specify how disputes can be resolved if internal resolution fails"},"7.3.1.1",{"$f":"AZ60&\": \"&CHOOSE(LanguageNumber,BA60,BR60,CH60,CX60)","v":"7.3.1.1: INFORM CUSTOMERS OF THEIR RIGHT TO EXTERNAL RECOURSE\nProviders should ensure that customers are informed of the external recourse options available to them if the provider's internal complaints and escalation process fails to resolve the complaint to the customer's satisfaction. External recourse should not be initiated by the customer until efforts to resolve the issue using the provider's internal complaint and dispute process has been exhausted. \n\nMechanisms for informing customers of external recourse could include:\n- awareness campaigns such as posters / advertising / bulk messaging.\n- training customer service second level support (team leaders / supervisors) to know about external recourse options and when to tell customers about them.\nNote: including external recourse options in customer Terms & Conditions is important but not sufficient on its own."},0,"7.3.1.1.1",{"$f":"BC60&\": \"&CHOOSE(LanguageNumber,BE60,BU60,CK60,DA60)&CarriageReturn","v":"7.3.1.1.1: Are customers informed how and when to escalate complaints to external recourse after exhausting the provider's resolution process?\n"},{"$f":"CHOOSE(LanguageNumber,BF60,BV60,CL60,DB60)","v":"1) Customer service training materials / posters/leaflets / advertising materials \nCheck that:\n- EITHER customers are made aware of external recourse options through awareness campaigns such as posters / advertising / bulk messaging.\n- OR customer service second level support (team leaders / supervisors) are trained to know about external recourse options and when to tell customers about them.\nNote: including external recourse options in T&Cs is not sufficient."},0,{"$f":"CHOOSE(LanguageNumber,BH60,BX60,CN60,DD60)","v":"Standard Required"},{"$f":"CHOOSE(LanguageNumber,BI60,BY60,CO60,DE60)","v":"Required"},"CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.3","7.3.1","7.3.1: Providers shall specify how disputes can be resolved if internal resolution fails","7.3.1.1","INFORM CUSTOMERS OF THEIR RIGHT TO EXTERNAL RECOURSE\nProviders should ensure that customers are informed of the external recourse options available to them if the provider's internal complaints and escalation process fails to resolve the complaint to the customer's satisfaction. External recourse should not be initiated by the customer until efforts to resolve the issue using the provider's internal complaint and dispute process has been exhausted. \n\nMechanisms for informing customers of external recourse could include:\n- awareness campaigns such as posters / advertising / bulk messaging.\n- training customer service second level support (team leaders / supervisors) to know about external recourse options and when to tell customers about them.\nNote: including external recourse options in customer Terms & Conditions is important but not sufficient on its own.",null,"7.3.1.1.1","7.3.1.2.1","Are customers informed how and when to escalate complaints to external recourse after exhausting the provider's resolution process?","1) Customer service training materials / posters/leaflets / advertising materials \nCheck that:\n- EITHER customers are made aware of external recourse options through awareness campaigns such as posters / advertising / bulk messaging.\n- OR customer service second level support (team leaders / supervisors) are trained to know about external recourse options and when to tell customers about them.\nNote: including external recourse options in T&Cs is not sufficient.",null,"Standard Required","Required","CustServ",null,null,"7","7.3","7.3.1","7.3.1: Les prestataires doivent spécifier un mode de résolution des litiges en cas d’échec des mécanismes internes.","7.3.1.1","INFORMER LES CLIENTS DE LEUR DROIT À UN RECOURS EXTERNE \nLes prestataires doivent s’assurer que les clients sont informés des possibilités de recours externe à leur disposition lorsque les processus internes de réclamation et de remontée mis en place par le prestataire n'ont pas permis de résoudre la réclamation à l'entière satisfaction du client. Le recours externe ne doit être sollicité par le client que lorsque tous les efforts de résolution du conflit à l'aide du processus de réclamation et de litige interne du prestataire ont échoué.\n\nLes mécanismes permettant d'informer le client des recours externes à sa disposition peuvent inclure :\n- des campagnes d'information par le biais d'affiches/de communiqués/de messages groupés ;\n- des formations destinées aux membres des équipes de service client de deuxième niveau (responsables/superviseurs de l'équipe) concernant les possibilités de recours externes et le moment approprié pour informer les clients de ces recours.\nRemarque : le fait d'inclure les possibilités de recours externes dans les conditions générales client est important mais n'est en lui-même pas suffisant.",0,"7.3.1.1.1","les clients sont-ils informés de la manière d'utiliser un recours externe une fois que le processus de résolution du prestataire a échoué ainsi que du moment auquel utiliser ce recours ?","1. Supports de formation du service client / affiches/brochures/supports publicitaires\nVérifier que l'UNE DES DEUX exigences ci-dessous est respectée :\n- les clients sont informés des recours externes mis à leur disposition par le biais de campagnes d'information, à l'aide d'affiches/de communiqués/de messages groupés ; ou\n- les membres des équipes de service client de deuxième niveau (responsables/superviseurs de l'équipe) reçoivent des formations concernant les possibilités de recours externes et le moment approprié pour informer les clients de ces recours.\nRemarque : le fait d'inclure les possibilités de recours externes dans les conditions générales n'est pas suffisant.",null,{"$f":"VLOOKUP($BH60,CategoryTranslationTable,2,FALSE)","v":"Requis Normal"},{"$f":"VLOOKUP($BI60,CategoryTranslationTable,2,FALSE)","v":"Requis"},"CustServ",0,null,"7","7.3","7.3.1","7.3.1: Los proveedores deben especificar cómo se pueden resolver las controversias si falla la resolución interna.","7.3.1.1","INFORMAR A LOS CLIENTES SU DERECHO A UN RECURSO EXTERNO\nLos proveedores deben garantizar que se informe a los clientes acerca de las opciones de recursos externos a su disposición si el proceso de reclamos y escalamiento interno del proveedor no resuelve el reclamo en forma satisfactoria para el cliente. El cliente no debe iniciar un recurso externo hasta que no se hayan agotado todos los esfuerzos por resolver el problema utilizando el proceso de reclamos y controversias interno del proveedor.\n\nLos mecanismos para informar a los clientes sobre el recurso externo podrían incluir:\n- campañas de concientización, como carteles / publicidad / mensajería masiva.\n- capacitación para el soporte de segundo nivel de atención al cliente (líderes de equipos / supervisores) para que conozca las opciones de recursos externos y cuándo informar a los clientes sobre las mismas.\nNota: incluir opciones de recursos externos en los Términos y Condiciones para el cliente es importante pero no suficiente por sí solo.",0,"7.3.1.1.1","¿Los clientes están informados sobre cómo y cuándo escalar reclamos a un recurso externo una vez agotado el proceso de resolución del proveedor?","1. Proceso de atención al cliente / términos y condiciones para el cliente / capacitación de atención al cliente\n- Verificar que \n- O se informa a los clientes las opciones de recursos externos a través de campañas de concientización, como carteles / publicidad / mensajería masiva.\n- O se capacita al soporte de segundo nivel de atención al cliente (líderes de equipos / supervisores) para que conozca las opciones de recursos externos y cuándo informar a los clientes sobre las mismas.\nNota: incluir opciones de recursos externos en los Términos y Condiciones no es suficiente.\n",null,{"$f":"VLOOKUP($BH60,CategoryTranslationTable,3,FALSE)","v":"Obligatorio estándar"},{"$f":"VLOOKUP($BI60,CategoryTranslationTable,3,FALSE)","v":"Obligatorio"},"CustServ",null,null,"7","7.3","7.3.1",null,"7.3.1.1",null,0,"7.3.1.1.1",null,null,null,{"$f":"VLOOKUP($BH60,CategoryTranslationTable,4,FALSE)","v":"ReqS4"},{"$f":"VLOOKUP($BI60,CategoryTranslationTable,4,FALSE)","v":"Req4"},"CustServ",null,null,null,null,null,null,null,null,"7.3.1.2.1",null,null,null,{"$f":"IF(OR($EA60=0,$EA60=2),VLOOKUP(DO60,INDIRECT(ED60),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP60),\"\",VLOOKUP(DP60,INDIRECT(EE60),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ60),\"\",VLOOKUP(DQ60,INDIRECT(EF60),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR60),\"\",VLOOKUP(DR60,INDIRECT(EG60),7,FALSE))","v":""},{"$f":"IF(OR($EA60=0,$EA60=2),VLOOKUP(DO60,INDIRECT(ED60),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP60),\"\",VLOOKUP(DP60,INDIRECT(EE60),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ60),\"\",VLOOKUP(DQ60,INDIRECT(EF60),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR60),\"\",VLOOKUP(DR60,INDIRECT(EG60),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN60,3)=\"NEW\")+2*AND(LEFT(DN60,3)=\"MER\")+3*AND(LEFT(DN60,3)=\"MOV\")+4*AND(LEFT(DN60,3)=\"SWA\")","v":0},{"$error":"#REF!"},{"$f":"IF(EA60=0,IF(DW60=0,\"\",DW60),CHOOSE(EA60,\"New indicator\",CONCATENATE(DW60,CarriageReturn,DX60,CarriageReturn,DY60,CarriageReturn,DZ60)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO60,1)","v":"OriginalComplianceP7"},{"$f":"\"OriginalComplianceP\"&LEFT(DP60,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ60,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR60,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,""]
[null,"7","7.3","7.3.1",0,"7.3.1.1",null,0,"7.3.1.1.2","7.3.1.1.2: Is a description of the external recourse options included in the customer contract,Terms & Conditions or other customer documentation?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.3","7.3.1",null,"7.3.1.1","",null,"7.3.1.1.2","7.3.1.2.2","Is a description of the external recourse options included in the customer contract,Terms & Conditions or other customer documentation?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.3","7.3.1",0,"7.3.1.1","",0,"7.3.1.1.2","la description des options et procédures de recours externe figure-t-elle dans le contrat d’utilisateur et/ou les conditions générales d’utilisation du service ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.3","7.3.1",null,"7.3.1.1","",0,"7.3.1.1.2","¿Se incluye una descripción de las opciones de recursos externos en el contrato con el cliente, los términos y condiciones u otra documentación del cliente?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.3","7.3.1",null,"7.3.1.1",null,0,"7.3.1.1.2",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.3.1.2.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.3","7.3.1",0,"7.3.1.2","7.3.1.2: WHETHER CUSTOMERS CAN BRING LEGAL COUNSEL TO EXTERNAL DISPUTE PROCEEDINGS\nProviders should inform customers whether they may bring legal counsel and/or other assistance to any external dispute resolution proceeding.\n\nCustomer care personnel should be able to communicate this information to customers, and it should be included in the customer contract and/or Terms & Conditions.",0,"7.3.1.2.1","7.3.1.2.1: Are customer care personnel trained to inform customers whether they may bring legal counsel and/or other assistance to any alternative dispute resolution proceeding?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.3","7.3.1",null,"7.3.1.2","WHETHER CUSTOMERS CAN BRING LEGAL COUNSEL TO EXTERNAL DISPUTE PROCEEDINGS\nProviders should inform customers whether they may bring legal counsel and/or other assistance to any external dispute resolution proceeding.\n\nCustomer care personnel should be able to communicate this information to customers, and it should be included in the customer contract and/or Terms & Conditions.",null,"7.3.1.2.1","7.3.1.3.1","Are customer care personnel trained to inform customers whether they may bring legal counsel and/or other assistance to any alternative dispute resolution proceeding?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.3","7.3.1",0,"7.3.1.2","PRÉSENCE D'UN AVOCAT DANS LES PROCÉDURES DE RECOURS EXTERNE\nLes prestataires doivent indiquer aux clients s’ils peuvent se faire accompagner d’un avocat ou autre conseiller dans les procédures de résolution externe des litiges. \n\nLe personnel du service client doit être capable de communiquer ces informations aux clients. Elles doivent également figurer dans le contrat d’utilisateur et/ou les conditions générales d’utilisation du service. ",0,"7.3.1.2.1","le personnel du service client est-il formé pour indiquer aux clients s’ils peuvent se faire accompagner d’un avocat ou d'un autre conseiller dans les procédures de résolution externe des litiges ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.3","7.3.1",null,"7.3.1.2","DETERMINAR SI LOS CLIENTES PUEDEN PRESENTAR UN ASESOR LEGAL EN PROCEDIMIENTOS EXTERNOS DE RESOLUCIÓN DE CONTROVERSIAS\nLos proveedores deben informar a los clientes si pueden presentar un asesor legal y/u otra asistencia en algún procedimiento externo de resolución de controversias.\n\nEl personal de atención al cliente debe poder comunicar esta información a los clientes, y debe estar incluida en el contrato con el cliente y/o en los Términos y Condiciones.",0,"7.3.1.2.1","¿El personal de atención al cliente está capacitado para informar a los clientes si pueden presentar un asesor legal y/u otra asistencia en cualquier procedimiento alternativo de resolución de controversias?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.3","7.3.1",null,"7.3.1.2",null,0,"7.3.1.2.1",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.3.1.3.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.3","7.3.1",0,"7.3.1.2",null,0,"7.3.1.2.2","7.3.1.2.2: Is information on whether customers may bring legal counsel and/or other assistance to any alternative dispute resolution proceeding included in the customer contract and/or Terms & Conditions?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.3","7.3.1",null,"7.3.1.2",null,null,"7.3.1.2.2","7.3.1.3.2","Is information on whether customers may bring legal counsel and/or other assistance to any alternative dispute resolution proceeding included in the customer contract and/or Terms & Conditions?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.3","7.3.1",0,"7.3.1.2",0,0,"7.3.1.2.2","l'information selon laquelle les clients peuvent ou non se faire accompagner d’un avocat ou d'un autre conseiller dans les procédures de résolution externe figure-t-elle dans le contrat d’utilisateur et/ou les conditions générales d’utilisation du service ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.3","7.3.1",null,"7.3.1.2",null,0,"7.3.1.2.2","¿Se incluye en el contrato con el cliente y/o en los Términos y Condiciones la información sobre si los clientes pueden presentar un asesor legal y/u otra asistencia en cualquier procedimiento alternativo de resolución de controversias?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.3","7.3.1",null,"7.3.1.2",null,0,"7.3.1.2.2",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.3.1.3.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.3","7.3.1",0,"7.3.1.3","7.3.1.3: INFORM CUSTOMERS OF LIABILITY FOR COSTS\nIf applicable, providers should inform customers that the losing party in external recourse proceedings may be liable for some or all of the winning party's costs:\n - if the customer loses, the customer may be liable for some or all of the provider's legal fees and/or other expenses; and\n - if the provider loses, the provider may be liable for some or all of the customer's legal fees and/or other expenses.\n\nCustomer care personnel should be able to communicate this information to customers, and it should be included in the customer contract and/or Terms & Conditions.\n",0,"7.3.1.3.1","7.3.1.3.1: If applicable, are customer care personnel trained to inform customers that the losing party in external recourse proceedings may be liable for some or all of the winning party's costs?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.3","7.3.1",null,"7.3.1.3","INFORM CUSTOMERS OF LIABILITY FOR COSTS\nIf applicable, providers should inform customers that the losing party in external recourse proceedings may be liable for some or all of the winning party's costs:\n - if the customer loses, the customer may be liable for some or all of the provider's legal fees and/or other expenses; and\n - if the provider loses, the provider may be liable for some or all of the customer's legal fees and/or other expenses.\n\nCustomer care personnel should be able to communicate this information to customers, and it should be included in the customer contract and/or Terms & Conditions.\n",null,"7.3.1.3.1","7.3.1.4.1","If applicable, are customer care personnel trained to inform customers that the losing party in external recourse proceedings may be liable for some or all of the winning party's costs?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.3","7.3.1",0,"7.3.1.3","INFORMER LES CLIENTS DE LEUR RESPONSABILITÉ RELATIVE AUX FRAIS ENGAGÉS\nLe cas échéant (cf. note explicative), le prestataire doit informer les clients du fait que la partie perdante peut avoir à assumer tout ou partie des frais de la partie gagnante dans le cadre des procédures de recours externe :\n - si le client perd, il peut être responsable de tout ou partie des honoraires d’avocat et/ou autres frais engagés par le prestataire ; \n - si le prestataire perd, il peut être responsable de tout ou partie des honoraires d’avocat et/ou autres frais engagés par le client ; \n\nLe personnel du service client doit être capable de communiquer ces informations aux clients. Elles doivent également figurer dans le contrat d’utilisateur et/ou les conditions générales d’utilisation du service. \n",0,"7.3.1.3.1","le cas échéant, le personnel du service client est-il formé pour informer les clients que la partie perdante de la procédure de recours externe peut avoir à assumer tout ou partie des frais engagés par la partie gagnante ?",null,null,"Recommandé","Recommandé","CustServ","Dans certains pays, la partie perdante d’une affaire judiciaire peut avoir à payer tout ou partie des honoraires d’avocat et/ou autres frais engagés par la partie gagnante. Lorsque cela est le cas, les prestataires doivent en informer les clients. En ce qui concerne les prestataires de pays dans lesquels chacune des partie assume ses propres frais juridiques quelle que soit l’issue de la procédure judiciaire, sélectionner « N/A » et en faire la mention dans la colonne « commentaires ». ",null,"7","7.3","7.3.1",null,"7.3.1.3","INFORMAR A LOS CLIENTES LA RESPONSABILIDAD POR LOS COSTOS\nSi corresponde, los proveedores deben informar a los clientes que la parte vencida en los procedimientos de recursos externos puede ser responsable de todo o parte de los costos de la parte vencedora:\n - si el cliente resulta vencido, puede ser responsable de todo o parte de las costas legales y/u otros gastos del proveedor; y\n - si el proveedor resulta vencido, puede ser responsable de todo o parte de las costas legales y/u otros gastos del cliente.\n\nEl personal de atención al cliente debe poder comunicar esta información a los clientes, y debe estar incluida en el contrato con el cliente y/o en los Términos y Condiciones.\n",0,"7.3.1.3.1","¿Si corresponde, el personal de atención al cliente está capacitado para informar a los clientes que la parte vencida en los procedimientos de recursos externos puede ser responsable de todo o parte de los costos de la parte vencedora?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.3","7.3.1",null,"7.3.1.3",null,0,"7.3.1.3.1",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.3.1.4.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.3","7.3.1",0,"7.3.1.3",null,0,"7.3.1.3.2","7.3.1.3.2: Is information on liability for the legal costs of external recourse included in the customer contract and/or Terms & Conditions?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.3","7.3.1",null,"7.3.1.3","",null,"7.3.1.3.2","7.3.1.4.2","Is information on liability for the legal costs of external recourse included in the customer contract and/or Terms & Conditions?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.3","7.3.1",0,"7.3.1.3","",{"$f":"BB65","v":0},"7.3.1.3.2","les informations relatives à la responsabilité des frais juridiques liés au recours externe figurent-elle dans le contrat d’utilisateur et/ou les conditions générales d’utilisation du service ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.3","7.3.1",null,"7.3.1.3","",0,"7.3.1.3.2","¿La información sobre la responsabilidad de las costas legales de los recursos externos está incluida en el contrato con el cliente y/o en los Términos y Condiciones?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.3","7.3.1",null,"7.3.1.3",null,0,"7.3.1.3.2",null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.3.1.4.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.3","7.3.1",0,"7.3.1.4","7.3.1.4: TERMS OR CONDITIONS THAT AFFECT POSSIBILITY OF CUSTOMER SUCCESS IN EXTERNAL DISPUTE RESOLUTION\nProviders should inform customers of any terms or conditions that may affect the possibility of customer success in external dispute resolution proceedings. For example, the Terms & Conditions may include a clause stating that the provider is not liable for customer losses under certain circumstances (such as some instances of fraud).\n\nCustomer care personnel should be able to communicate this information to customers, and it should be included in the customer contract and/or Terms & Conditions.",0,"7.3.1.4.1","7.3.1.4.1: Are customer care personnel trained to inform customers of any terms or conditions that may affect the possibility of customer success in external dispute resolution proceedings?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.3","7.3.1",null,"7.3.1.4","TERMS OR CONDITIONS THAT AFFECT POSSIBILITY OF CUSTOMER SUCCESS IN EXTERNAL DISPUTE RESOLUTION\nProviders should inform customers of any terms or conditions that may affect the possibility of customer success in external dispute resolution proceedings. For example, the Terms & Conditions may include a clause stating that the provider is not liable for customer losses under certain circumstances (such as some instances of fraud).\n\nCustomer care personnel should be able to communicate this information to customers, and it should be included in the customer contract and/or Terms & Conditions.",null,"7.3.1.4.1","7.3.1.5.1","Are customer care personnel trained to inform customers of any terms or conditions that may affect the possibility of customer success in external dispute resolution proceedings?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.3","7.3.1",0,{"$f":"$AZ66","v":"7.3.1.4"},"CONDITIONS GÉNÉRALES AFFECTANT LES POSSIBILITÉS DE SUCCÈS DU CLIENT DANS LE CADRE DE LA RÉSOLUTION EXTERNE DES LITIGES \nLes prestataires doivent informer leurs clients de toute disposition des conditions générales susceptible d’affecter les chances de réussite du client dans le cadre d’une procédure externe de règlement des litiges. Les conditions générales peuvent par exemple inclure une clause statuant que le prestataire décline toute responsabilité relative aux pertes subies par le client dans certaines circonstances (comme par exemple certains cas de fraude). \n\nLe personnel du service client doit être capable de communiquer ces informations aux clients. Elles doivent également figurer dans le contrat d’utilisateur et/ou les conditions générales d’utilisation du service. ",0,"7.3.1.4.1","le personnel du service client est-il formé pour informer les clients de toute disposition des conditions générales susceptible d’affecter leurs chances de réussite dans le cadre d’une procédure externe de règlement des litiges ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.3","7.3.1",null,{"$f":"$AZ66","v":"7.3.1.4"},"TÉRMINOS O CONDICIONES QUE AFECTAN LA POSIBILIDAD DE ÉXITO DEL CLIENTE EN LA RESOLUCIÓN DE CONTROVERSIA EXTERNA\nLos proveedores deben informar a los clientes los términos o condiciones que podrían afectar la posibilidad de éxito del cliente en los procedimientos externos de resolución de controversias. Por ejemplo, los Términos y Condiciones pueden incluir una cláusula que establezca que el proveedor no se hace responsable de las pérdidas del cliente bajo ciertas circunstancias (como algunas instancias de fraude).\n\nEl personal de atención al cliente debe poder comunicar esta información a los clientes, y debe estar incluida en el contrato con el cliente y/o en los Términos y Condiciones.",0,{"$f":"$BC66","v":"7.3.1.4.1"},"¿El personal de atención al cliente está capacitado para informar a los clientes los términos y condiciones que podrían afectar la posibilidad de éxito del cliente en los procedimientos externos de resolución de controversias?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.3","7.3.1",null,{"$f":"$AZ66","v":"7.3.1.4"},null,0,{"$f":"$BC66","v":"7.3.1.4.1"},null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.3.1.5.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"7","7.3","7.3.1",0,"7.3.1.4",null,0,"7.3.1.4.2","7.3.1.4.2: Is information on any terms or conditions that may affect the possibility of customer success in external dispute resolution proceedings included in the customer contract and/or Terms & Conditions?\n",0,0,"Recommended","Recommended","CustServ",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"7","7.3","7.3.1",null,"7.3.1.4",null,null,"7.3.1.4.2","7.3.1.5.2","Is information on any terms or conditions that may affect the possibility of customer success in external dispute resolution proceedings included in the customer contract and/or Terms & Conditions?",null,null,"Recommended","Recommended","CustServ",null,null,"7","7.3","7.3.1",0,{"$f":"$AZ67","v":"7.3.1.4"},0,0,"7.3.1.4.2","les informations relatives aux dispositions susceptibles d’affecter les chances de réussite du client dans le cadre d’une procédure externe de règlement des litiges figurent-elle dans le contrat d’utilisateur et/ou les conditions générales d’utilisation du service ?",null,null,"Recommandé","Recommandé","CustServ",0,null,"7","7.3","7.3.1",null,{"$f":"$AZ67","v":"7.3.1.4"},null,0,{"$f":"$BC67","v":"7.3.1.4.2"},"¿La información sobre los términos y condiciones que podrían afectar la posibilidad de éxito del cliente en los procedimientos externos de resolución de controversias está incluida en el contrato con el cliente y/o en los Términos y Condiciones?",null,null,"Recomendado","Recomendado","CustServ",null,null,"7","7.3","7.3.1",null,{"$f":"$AZ67","v":"7.3.1.4"},null,0,{"$f":"$BC67","v":"7.3.1.4.2"},null,null,null,"Rec4","Rec4","CustServ",null,null,null,null,null,null,null,null,"7.3.1.5.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP7","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,null,null,null,null,".",".",".",".",".",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"$AZ68","v":0},null,0,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,{"$f":"$BC68","v":0},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"$AZ68","v":0},null,0,{"$f":"$BC68","v":0}]

{"sheet":"8","index":9,"n_rows":40,"n_cols":144,"rows_kept":40,"cut":false,"hidden":false,"merged":[[6,85,8,85],[6,86,8,86],[9,85,10,85],[9,86,10,86],[11,85,13,85],[11,86,13,86],[6,6,8,6],[6,7,8,7],[17,69,20,69],[29,85,32,85],[29,86,32,86],[17,52,20,52],[17,53,20,53],[6,69,8,69],[6,52,8,52],[23,67,26,67],[23,52,26,52],[23,53,26,53],[29,52,32,52],[29,53,32,53],[6,53,8,53],[9,52,10,52],[9,69,10,69],[11,69,13,69],[14,58,15,58],[14,52,15,52],[14,53,15,53],[14,69,15,69],[36,85,37,85],[29,69,32,69],[36,69,37,69],[23,69,26,69],[27,72,27,73],[33,72,33,73],[23,83,26,83],[23,85,26,85],[22,72,22,73],[36,52,37,52],[36,53,37,53],[36,86,37,86],[9,6,10,6],[9,7,10,7],[11,6,13,6],[11,7,13,7],[36,6,37,6],[36,7,37,7],[29,6,32,6],[29,7,32,7],[23,50,26,50],[9,53,10,53],[11,52,13,52],[11,53,13,53],[23,4,26,4],[23,6,26,6],[23,7,26,7],[14,6,15,6],[14,7,15,7],[17,6,20,6],[17,7,20,7],[36,101,37,101],[36,102,37,102],[6,101,8,101],[6,102,8,102],[9,101,10,101],[9,102,10,102],[11,101,13,101],[11,102,13,102],[14,106,15,106],[17,101,20,101],[17,102,20,102],[23,99,26,99],[23,101,26,101],[23,102,26,102],[14,101,15,101],[14,102,15,102],[22,104,22,105],[23,86,26,86],[14,85,15,85],[14,86,15,86],[14,74,15,74],[17,85,20,85],[17,86,20,86],[33,104,33,105],[3,104,3,105],[3,88,3,90],[22,88,22,90],[27,88,27,90],[33,88,33,90],[29,101,32,101],[29,102,32,102],[14,90,15,90]]}
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,"x",null,null,null,null,null,"x",null,null,null,null,null,null,null,null,null,"x",null,null,null,null,"x",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"x"]
[null,null,null,null,null,null,{"$f":"UPPER(Introduction!B33)","v":"8. DATA PRIVACY:  PROTECT CUSTOMERS’ PERSONAL DATA"},null,null,null,null,null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,Drivers!K18,Drivers!L18,Drivers!M18,Drivers!N18)","v":"SELF-ASSESSMENT"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,Drivers!K34,Drivers!L34,Drivers!M34,Drivers!N34)","v":"EXTERNAL ASSESSMENT"},null,null,null,null,null,"SCHEME OPERATOR REVIEW",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,16,null,17,null,null,3,null,null,4,5,null,9,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Change types: NEW, MERGE, MOVE, SWAP","Don't edit the Indicator ID",null,null,null,"*** Don't edit any cell from AB and onwards *** Ignore #NAME errors; these will disappear during migration",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Counts for computed Compliance calc"]
[null,{"$f":"CHOOSE(LanguageNumber,AV3,BM3,CC3,CS3)","v":"Principle"},"Sub-principle","Sub-sub-principle","Sub-sub-principle ","Practice ID","Practice","Practice data source","Indicator ID",{"$f":"CHOOSE(LanguageNumber,BE3,BU3,CK3,DA3)","v":"Indicator"},"Evidence required","[SPARE]","Detailed indicator category","Indicator category","Function","[SPARE]",{"$f":"CHOOSE(LanguageNumber,Drivers!K19,Drivers!L19,Drivers!M19,Drivers!N19)","v":"Compliance"},{"$f":"CHOOSE(LanguageNumber,Drivers!K20,Drivers!L20,Drivers!M20,Drivers!N20)","v":"Evidence document (specify document name, section number and page number)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K21,Drivers!L21,Drivers!M21,Drivers!N21)","v":"Comments \n(include notes on how the practice is implemented)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K22,Drivers!L22,Drivers!M22,Drivers!N22)","v":"Action"},{"$f":"CHOOSE(LanguageNumber,Drivers!K23,Drivers!L23,Drivers!M23,Drivers!N23)","v":"Reviewer name"},{"$f":"CHOOSE(LanguageNumber,Drivers!K24,Drivers!L24,Drivers!M24,Drivers!N24)","v":"Evidence sent to Assessor?"},{"$f":"CHOOSE(LanguageNumber,Drivers!K25,Drivers!L25,Drivers!M25,Drivers!N25)","v":"Spare 2"},{"$f":"CHOOSE(LanguageNumber,Drivers!K26,Drivers!L26,Drivers!M26,Drivers!N26)","v":"Spare 3"},{"$f":"CHOOSE(LanguageNumber,Drivers!K27,Drivers!L27,Drivers!M27,Drivers!N27)","v":"Spare 4"},{"$f":"CHOOSE(LanguageNumber,Drivers!K28,Drivers!L28,Drivers!M28,Drivers!N28)","v":"Spare 5"},{"$f":"CHOOSE(LanguageNumber,Drivers!K29,Drivers!L29,Drivers!M29,Drivers!N29)","v":"Spare 6"},{"$f":"CHOOSE(LanguageNumber,Drivers!K30,Drivers!L30,Drivers!M30,Drivers!N30)","v":"Spare 7"},{"$f":"CHOOSE(LanguageNumber,Drivers!K31,Drivers!L31,Drivers!M31,Drivers!N31)","v":"Spare 8"},{"$f":"CHOOSE(LanguageNumber,Drivers!K32,Drivers!L32,Drivers!M32,Drivers!N32)","v":"Spare 9"},{"$f":"CHOOSE(LanguageNumber,Drivers!K33,Drivers!L33,Drivers!M33,Drivers!N33)","v":"Spare 10"},{"$f":"CHOOSE(LanguageNumber,Drivers!K35,Drivers!L35,Drivers!M35,Drivers!N35)","v":"Compliance"},{"$f":"CHOOSE(LanguageNumber,Drivers!K36,Drivers!L36,Drivers!M36,Drivers!N36)","v":"Evidence document (specify document name, section number and page number)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K37,Drivers!L37,Drivers!M37,Drivers!N37)","v":"Comments \n(include notes on how the practice is implemented)"},{"$f":"CHOOSE(LanguageNumber,Drivers!K38,Drivers!L38,Drivers!M38,Drivers!N38)","v":"Recommendation to Provider"},{"$f":"CHOOSE(LanguageNumber,Drivers!K39,Drivers!L39,Drivers!M39,Drivers!N39)","v":"Reviewer name"},{"$f":"CHOOSE(LanguageNumber,Drivers!K40,Drivers!L40,Drivers!M40,Drivers!N40)","v":"Guidance notes for Assessor"},{"$f":"CHOOSE(LanguageNumber,Drivers!K41,Drivers!L41,Drivers!M41,Drivers!N41)","v":"Scheme Operator comments"},{"$f":"CHOOSE(LanguageNumber,Drivers!K42,Drivers!L42,Drivers!M42,Drivers!N42)","v":"Assessor's response to Scheme Operator"},{"$f":"CHOOSE(LanguageNumber,Drivers!K43,Drivers!L43,Drivers!M43,Drivers!N43)","v":"Scheme Operator conclusion"},{"$f":"CHOOSE(LanguageNumber,Drivers!K44,Drivers!L44,Drivers!M44,Drivers!N44)","v":"Spare 15"},{"$f":"CHOOSE(LanguageNumber,Drivers!K45,Drivers!L45,Drivers!M45,Drivers!N45)","v":"Spare 16"},{"$f":"CHOOSE(LanguageNumber,Drivers!K46,Drivers!L46,Drivers!M46,Drivers!N46)","v":"Spare 17"},{"$f":"CHOOSE(LanguageNumber,Drivers!K47,Drivers!L47,Drivers!M47,Drivers!N47)","v":"Spare 18"},{"$f":"CHOOSE(LanguageNumber,Drivers!K48,Drivers!L48,Drivers!M48,Drivers!N48)","v":"Spare 19"},{"$f":"CHOOSE(LanguageNumber,Drivers!K49,Drivers!L49,Drivers!M49,Drivers!N49)","v":"Spare 20"},null,"Principle","Sub-principle","Sub-sub-principle","Sub-sub-principle ","Practice ID","Practice","Practice data source","Indicator ID","ORIGINAL ID","Indicator","Evidence required","[SPARE]","Detailed indicator category","Indicator category","Function","[SPARE]",null,"Principe","Sous-principe","Sous-sous-principe","Description du sous-sous-principe","Pratique ID","Pratique","Source de données pratique","Indicateur ID","Indicateur","Documents généralement requis","[SPARE]","Catégorie détaillée d’indicateur","Catégorie d’indicateur","Fonction","[SPARE]",null,"Principio","Sub-principio","Sub-sub-principio","Sub-sub-principio","Nro. de Práctica","Práctica","Origen de datos de Práctica","Nro. de Indicador","Indicador","Documentación obligatoria","[SPARE]","Categoría indicador detallada","Categoría de Indicador","Función","[SPARE]",null,"Principle","Sub-principle","Sub-sub-principle","Sub-sub-principle Description","Practice ID","Practice","Practice data source","Indicator","Indicator","Evidence required","[SPARE]","Detailed indicator category","Indicator category","Function","[SPARE]",null,null,null,null,null,null,"Change type","Original Indicator ID","Merged indicator #1","Merged indicator #2","Merged indicator #3","v1 Compliance rating Original Indicator ID","v1 Compliance rating Merged indicator #1","v1 Compliance rating Merged indicator #2","v1 Compliance rating Merged indicator #3","v1 Comment Original Indicator ID","v1 Comment Merged indicator #1  ","v1 Comment Merged indicator #2","v1 Comment Merged indicator #3","v2 Computed change type","v2 Computed compliance rating","v2 Computed comment","rangename1","rangename2","rangename3","rangename4","Yes","No","N/A","Partial","No Response","how many","calc"]
[null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!C33,\": \",Introduction!D33))","v":"8.1: GOVERNANCE OF DATA PRIVACY"},null,null,null,null,{"$f":"Introduction!E33","v":"Providers shall comply with good practices and relevant regulations governing customer data privacy"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$33,\": \",Introduction!$L$33))","v":"8.1: GOVERNANCE OF DATA PRIVACY"},null,null,null,null,null,{"$f":"Introduction!$M$33","v":"Providers shall comply with good practices and relevant regulations governing customer data privacy"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"Introduction!$R$33","v":"Les prestataires doivent se conformer aux bonnes pratiques et aux réglementations applicables en matière de protection des données personnelles des clients."},null,null,null,null,null,null,null,null,null,null,{"$f":"UPPER(CONCATENATE(Introduction!$U$33,\": \",Introduction!$V$33))","v":"8.1: GOBERNANZA DE LA PRIVACIDAD DE DATOS"},null,null,0,null,{"$f":"Introduction!W33","v":"El proveedor cumplirá con las buenas prácticas y la regulación pertinente que rigen la privacidad de los datos del cliente"},null,null,null,null,null,null,null,null,null,null,null,0,null,0,null,{"$f":"Introduction!$AB$33","v":0}]
[null,{"$f":"$AV5","v":"8"},{"$f":"$AW5","v":"8.1"},{"$f":"$AX5","v":"8.1.1"},{"$f":"CHOOSE(LanguageNumber,AY5,BP5,CF5,CV5)","v":"8.1.1: Providers shall comply with good practices and relevant regulations governing customer data privacy.\n"},{"$f":"AZ5","v":"8.1.1.1"},{"$f":"AZ5&\": \"&CHOOSE(LanguageNumber,BA5,BR5,CH5,CX5)","v":"8.1.1.1: DATA PRIVACY POLICY\nProviders should define and implement a data privacy policy. The policy should, at minimum: \n- commit to fair usage of personal data;\n- commit to protection of personal data; \n- outline the approach to identifying and managing personal data (through IPAs and PIAs - see 8.1.1.3);\n- identify the approach for responding to data privacy breaches (8.1.1.7);\n- specify principles for data privacy rules of behaviour (8.1.1.4); and\n- define requirements for maintaining data quality (8.1.1.6).\n\nThe data privacy policy should be communicated to employees and entities providing outsourced services, as appropriate. The policy should take account of relevant laws and other regulatory mandates.\n\nData Privacy protects customers personal data from misuse by the provider or other parties. Personal Data is private information of a customer that is held by the provider. Examples include KYC data, identity data and credit history. \nMisuse of personal data could include:\n  - fraud on the customer's account - impersonation of the customer may be facilitated by the use of the customer's personal data;\n  - identity theft - false accounts could be opened in the customer's name using their personal data;\n  - unwanted marketing - the customer could be sent unwanted marketing material (phone calls, SMS messages, emails or letters)."},{"$f":"BB5","v":0},{"$f":"BC5","v":"8.1.1.1.1"},{"$f":"BC5&\": \"&CHOOSE(LanguageNumber,BE5,BU5,CK5,DA5)&CarriageReturn","v":"8.1.1.1.1: Does the provider have a data privacy policy that commits to fair usage and protection of personal data?\n"},{"$f":"CHOOSE(LanguageNumber,BF5,BV5,CL5,DB5)","v":"1) Data privacy policy or data privacy rules of behaviour document\n- Check that the document includes a commitment to fair usage of personal data\n-Check that the document includes details of how personal data is protected"},0,{"$f":"CHOOSE(LanguageNumber,BH5,BX5,CN5,DD5)","v":"Standard Required"},{"$f":"CHOOSE(LanguageNumber,BI5,BY5,CO5,DE5)","v":"Required"},"BizOps",{"$f":"CHOOSE(LanguageNumber,BK5,CA5,CQ5,DG5)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8","8.1","8.1.1","8.1.1: Providers shall comply with good practices and relevant regulations governing customer data privacy.\n","8.1.1.1","DATA PRIVACY POLICY\nProviders should define and implement a data privacy policy. The policy should, at minimum: \n- commit to fair usage of personal data;\n- commit to protection of personal data; \n- outline the approach to identifying and managing personal data (through IPAs and PIAs - see 8.1.1.3);\n- identify the approach for responding to data privacy breaches (8.1.1.7);\n- specify principles for data privacy rules of behaviour (8.1.1.4); and\n- define requirements for maintaining data quality (8.1.1.6).\n\nThe data privacy policy should be communicated to employees and entities providing outsourced services, as appropriate. The policy should take account of relevant laws and other regulatory mandates.\n\nData Privacy protects customers personal data from misuse by the provider or other parties. Personal Data is private information of a customer that is held by the provider. Examples include KYC data, identity data and credit history. \nMisuse of personal data could include:\n  - fraud on the customer's account - impersonation of the customer may be facilitated by the use of the customer's personal data;\n  - identity theft - false accounts could be opened in the customer's name using their personal data;\n  - unwanted marketing - the customer could be sent unwanted marketing material (phone calls, SMS messages, emails or letters).",null,"8.1.1.1.1",{"$f":"DO5","v":"8.1.1.1.1"},"Does the provider have a data privacy policy that commits to fair usage and protection of personal data?","1) Data privacy policy or data privacy rules of behaviour document\n- Check that the document includes a commitment to fair usage of personal data\n-Check that the document includes details of how personal data is protected",null,"Standard Required","Required",{"$f":"$O5","v":"BizOps"},null,null,{"$f":"$AV5","v":"8"},{"$f":"$AW5","v":"8.1"},{"$f":"$AX5","v":"8.1.1"},"8.1.1: Les prestataires doivent se conformer aux bonnes pratiques et aux réglementations applicables en matière de protection des données personnelles des clients",{"$f":"$AZ5","v":"8.1.1.1"},"POLITIQUE RELATIVE À LA CONFIDENTIALITÉ DES DONNÉES\nLes prestataires doivent définir et mettre en œuvre une politique relative à la confidentialité des données. Cette politique doit au minimum : \n- refléter un engagement d’utilisation équitable des données à caractère personnel,\n- refléter un engagement de protection des données à caractère personnel, \n- définir l’approche d’identification et de gestion des données à caractère personnel (dans le cadre d’EPC/EIVP – cf. 8.1.1.3),\n- préciser le mode de réponse aux violations de la confidentialité de ces données (cf. 8.1.1.7),\n- définir les règles de conduite en matière de confidentialité des données (cf. 8.1.1.4), et\n- définir les exigences de maintien de la qualité des données (cf. 8.1.1.6).\n\nLa politique sur la confidentialité des données doit être communiquée au personnel et aux entités assurant des services en sous-traitance, le cas échéant. Elle prendre en compte les lois applicables et autres obligations réglementaires.\n\nLa confidentialité des données protège les données personnelles des clients en cas de mauvaise utilisation par le prestataire ou d'autres parties. Les données personnelles sont les renseignements propres à un client et détenues par le prestataire. Parmi les exemples de données figurent les renseignements d’identité, les vérification de ces dernières et l’historique de crédit. \nExemples de mauvaise utilisation des données :\n  - fraude du compte du client -  l’utilisation des données personnelles du client facilite l’usurpation de son identité ;\n  - usurpation d’identité - l’utilisation des données personnelles du client permet d’ouvrir de faux comptes à son nom ;\n  - prospection commerciale non sollicitée - le client peut faire l’objet de démarchage commercial inopportun (appels téléphoniques, SMS, e-mails ou lettres).",{"$f":"BB5","v":0},{"$f":"BC5","v":"8.1.1.1.1"},"le prestataire possède-t-il une politique en matière de confidentialité des données qui l'engage à protéger et à utiliser de manière équitable les données à caractère personnel ?","1) Politique relative à la confidentialité des données ou document énonçant les règles de conduite relatives à la confidentialité des données\n- Vérifier que le document reflète un engagement d’utilisation équitable des données à caractère personnel\n-Vérifier que le document inclut des informations concernant la manière dont les données à caractère personnel sont protégées",null,{"$f":"VLOOKUP($BH5,CategoryTranslationTable,2,FALSE)","v":"Requis Normal"},{"$f":"VLOOKUP($BI5,CategoryTranslationTable,2,FALSE)","v":"Requis"},{"$f":"$O5","v":"BizOps"},null,null,{"$f":"$AV5","v":"8"},{"$f":"$AW5","v":"8.1"},{"$f":"$AX5","v":"8.1.1"},"8.1.1: Los proveedores deben cumplir con las buenas prácticas y las regulaciones relevantes que rigen la privacidad de los datos de los clientes",{"$f":"$AZ5","v":"8.1.1.1"},"POLÍTICA DE PRIVACIDAD DE DATOS\nLos proveedores deben definir e implementar una política de privacidad de datos. La política debe, como mínimo: \n- exigir el uso razonable de los datos personales;\n- exigir la protección de los datos personales; \n- detallar el enfoque para identificar y gestionar los datos personales (a través de IPA y PIA - ver 8.1.1.3);\n- identificar el enfoque para responder ante las violaciones a la privacidad de los datos (8.1.1.7);\n- especificar los principios de las reglas de conducta de privacidad de los datos (8.1.1.4); y\n- definir los requisitos para mantener la calidad de los datos (8.1.1.6).\n\nLa política de privacidad de datos debe ser comunicada a los empleados y entidades que prestan servicios tercerizados, según corresponda. La política debe tener en cuenta las leyes y demás mandatos regulatorios relevantes.\n\nLa privacidad de datos protege los datos personales de los clientes contra el uso indebido por parte del proveedor u otras partes. Los datos personales son información privada de un cliente que está en posesión del proveedor. Los ejemplos incluyen los datos de registros de conocimiento del cliente (CSC), los datos de identidad y el historial de crédito. \nEl uso indebido de los datos personales podría incluir:\n  - fraude en la cuenta del cliente - se puede facilitar la suplantación de identidad del cliente mediante el uso de sus datos personales;\n  - robo de identidad - se podrían abrir cuentas falsas a nombre del cliente usando sus datos personales;\n  - marketing indeseado - el cliente podría enviar materiales de marketing indeseados (llamadas telefónicas, SMS, correos electrónicos o cartas).",{"$f":"BB5","v":0},{"$f":"$BC5","v":"8.1.1.1.1"},"¿El proveedor cuenta con una política de privacidad de datos que exige el uso razonable y la protección de los datos personales?","1) Política de privacidad de datos o documento de reglas de conductas de privacidad\n- Verificar que el documento incluya un compromiso con el uso razonable de los datos personales\n-Verificar que el documento incluya detalles de cómo se protegen los datos personales",null,{"$f":"VLOOKUP($BH5,CategoryTranslationTable,3,FALSE)","v":"Obligatorio estándar"},{"$f":"VLOOKUP($BI5,CategoryTranslationTable,3,FALSE)","v":"Obligatorio"},{"$f":"$O5","v":"BizOps"},null,null,{"$f":"$AV5","v":"8"},{"$f":"$AW5","v":"8.1"},{"$f":"$AX5","v":"8.1.1"},null,{"$f":"$AZ5","v":"8.1.1.1"},null,{"$f":"BB5","v":0},{"$f":"$BC5","v":"8.1.1.1.1"},null,null,null,{"$f":"VLOOKUP($BH5,CategoryTranslationTable,4,FALSE)","v":"ReqS4"},{"$f":"VLOOKUP($BI5,CategoryTranslationTable,4,FALSE)","v":"Req4"},{"$f":"$O5","v":"BizOps"},null,null,null,null,null,null,null,null,"8.1.1.1.1",null,null,null,{"$f":"IF(OR($EA5=0,$EA5=2),VLOOKUP(DO5,INDIRECT(ED5),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP5),\"\",VLOOKUP(DP5,INDIRECT(EE5),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ5),\"\",VLOOKUP(DQ5,INDIRECT(EF5),7,FALSE))","v":""},"",{"$f":"IF(OR($EA5=0,$EA5=2),VLOOKUP(DO5,INDIRECT(ED5),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP5),\"\",VLOOKUP(DP5,INDIRECT(EE5),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ5),\"\",VLOOKUP(DQ5,INDIRECT(EF5),8,FALSE))","v":""},"",{"$f":"1*AND(LEFT(DN5,3)=\"NEW\")+2*AND(LEFT(DN5,3)=\"MER\")+3*AND(LEFT(DN5,3)=\"MOV\")+4*AND(LEFT(DN5,3)=\"SWA\")","v":0},{"$f":"IF(EA5=0,DS5,EN5)","v":{"$error":"#REF!"}},{"$f":"IF(EA5=0,IF(DW5=0,\"\",DW5),CHOOSE(EA5,\"New indicator\",CONCATENATE(DW5,CarriageReturn,DX5,CarriageReturn,DY5,CarriageReturn,DZ5)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO5,1)","v":"OriginalComplianceP8"},{"$f":"\"OriginalComplianceP\"&LEFT(DP5,1)","v":"OriginalComplianceP"},"OriginalComplianceP","OriginalComplianceP",{"$f":"COUNTIF($DS5:$DV5,EH$3)","v":0},0,0,0,0,{"$f":"COUNTIF($DO5:$DR5,\"*?\")","v":1},{"$f":"IF(OR(AND(EH5>0,SUM(EI5:EL5)>0),EK5>0),\"Partial\",IF(EH5=EM5,\"Yes\",IF(EI5=EM5,\"No\",IF(EJ5=EM5,\"N/A\",IF(EK5=EM5,\"Partial\",IF(EL5=EM5,\"\",\"\"))))))","v":""}]
[null,{"$f":"$AV6","v":"8"},{"$f":"$AW6","v":"8.1"},{"$f":"$AX6","v":"8.1.1"},0,{"$f":"AZ6","v":"8.1.1.2"},{"$f":"AZ6&\": \"&CHOOSE(LanguageNumber,BA6,BR6,CH6,CX6)","v":"8.1.1.2: ASSIGN RESPONSIBILITY FOR CUSTOMER DATA PRIVACY\nProviders should assign responsibility for overseeing the implementation of processes and technology to meet the data privacy policy. An individual or a team could be assigned this responsibility. If a team is assigned the responsibility for data privacy then the manager should be assigned overall responsibility.\n\nIn providers that are part of a group of companies, data privacy responsibility could be assigned at group level instead of in the local company.\n"},{"$f":"BB6","v":"IS029100 4.2"},{"$f":"BC6","v":"8.1.1.2.1"},"8.1.1.2.1: Has responsibility been assigned for overseeing the implementation of the data privacy policy?\n","1) Organisation chart indicating Data Privacy responsibility (could be group-level or local-level organization)\n- Check that the data protection responsibilities are included in the organisation chart or role/team description, including the responsibility for overseeing implementation of the data privacy policy.\n- If a team is assigned the responsibility for data privacy then check that the manager has been assigned overall responsibility. ",0,"Standard Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8","8.1","8.1.1",null,"8.1.1.2","ASSIGN RESPONSIBILITY FOR CUSTOMER DATA PRIVACY\nProviders should assign responsibility for overseeing the implementation of processes and technology to meet the data privacy policy. An individual or a team could be assigned this responsibility. If a team is assigned the responsibility for data privacy then the manager should be assigned overall responsibility.\n\nIn providers that are part of a group of companies, data privacy responsibility could be assigned at group level instead of in the local company.\n","IS029100 4.2","8.1.1.2.1","8.1.1.2.1","Has responsibility been assigned for overseeing the implementation of the data privacy policy?","1) Organisation chart indicating Data Privacy responsibility (could be group-level or local-level organization)\n- Check that the data protection responsibilities are included in the organisation chart or role/team description, including the responsibility for overseeing implementation of the data privacy policy.\n- If a team is assigned the responsibility for data privacy then check that the manager has been assigned overall responsibility. ",null,"Standard Required","Required",{"$f":"$O6","v":"BizOps"},null,null,{"$f":"$AV6","v":"8"},{"$f":"$AW6","v":"8.1"},{"$f":"$AX6","v":"8.1.1"},0,{"$f":"$AZ6","v":"8.1.1.2"},"DÉSIGNER UNE PERSONNE RESPONSABLE DE LA CONFIDENTIALITÉ DES DONNÉES RELATIVES AUX CLIENTS\nLes prestataires doivent désigner un responsable chargé de contrôler la mise en œuvre des procédures et technologies requises pour l’application de la politique de confidentialité des données. Cette responsabilité peut être attribuée à un individu ou à une équipe. Si une équipe est désignée comme étant responsable de la confidentialité des données, le responsable de l'équipe se verra assigner la responsabilité globale. \n\nPour les prestataires faisant partie d’un groupe de sociétés, la responsabilité de la confidentialité des données peut être assignée au niveau du groupe plutôt qu’au niveau de l’entreprise.\n","IS029100 4.2","8.1.1.2.1","Un responsable chargé de contrôler la mise en place de la politique de confidentialité des données a-t-il été nommé ?","1) Organigramme désignant le responsable chargé de la confidentialité des données (organisation au niveau du groupe ou organisation locale)\n- Vérifier que l’organigramme ou le descriptif du poste/de la fonction désigne un responsable de la protection des données (y compris la responsabilité de contrôler la mise en place de la politique de confidentialité des données).\n- Si une équipe est désignée comme étant responsable de la confidentialité des données, vérifier que le responsable de l'équipe s'est vu assigner la responsabilité globale.",null,"Requis Normal","Requis",{"$f":"$O6","v":"BizOps"},0,null,{"$f":"$AV6","v":"8"},{"$f":"$AW6","v":"8.1"},{"$f":"$AX6","v":"8.1.1"},null,{"$f":"$AZ6","v":"8.1.1.2"},"ASIGNAR LA RESPONSABILIDAD DE LA PRIVACIDAD DE LOS DATOS DEL CLIENTE\nLos proveedores deben asignar la responsabilidad de supervisar la implementación de los procesos y la tecnología para cumplir con la política de privacidad de datos. Se puede asignar a una persona o a un equipo. Si se asigna a un equipo como responsable de la privacidad de los datos, se asignará al gerente la responsabilidad general.\n\nEn los proveedores que son parte de un grupo de compañías, la responsabilidad de la privacidad de los datos podría asignarse a nivel del grupo en lugar de en la compañía local.\n","IS029100 4.2",{"$f":"$BC6","v":"8.1.1.2.1"},"¿Se asignó la responsabilidad de supervisar la implementación de la política de privacidad de datos?","1) Organigrama que indica la responsabilidad de la Privacidad de los Datos (podría ser una organización a nivel del grupo o a nivel local)\n- Verificar que las responsabilidades de protección de datos estén incluidas en el organigrama o en la descripción del rol/equipo, incluyendo la responsabilidad de supervisar la implementación de la política de privacidad de datos.\n-  Si se asigna a un equipo como responsable de la privacidad de los datos, verificar que se haya asignado al gerente la responsabilidad general.",null,"Obligatorio estándar","Obligatorio",{"$f":"$O6","v":"BizOps"},null,null,{"$f":"$AV6","v":"8"},{"$f":"$AW6","v":"8.1"},{"$f":"$AX6","v":"8.1.1"},null,{"$f":"$AZ6","v":"8.1.1.2"},null,"IS029100 4.2",{"$f":"$BC6","v":"8.1.1.2.1"},null,null,null,"ReqS4","Req4",{"$f":"$O6","v":"BizOps"},null,null,null,null,null,null,null,null,"8.1.1.2.1",null,null,null,{"$f":"IF(OR($EA6=0,$EA6=2),VLOOKUP(DO6,INDIRECT(ED6),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP6),\"\",VLOOKUP(DP6,INDIRECT(EE6),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ6),\"\",VLOOKUP(DQ6,INDIRECT(EF6),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR6),\"\",VLOOKUP(DR6,INDIRECT(EG6),7,FALSE))","v":""},{"$f":"IF(OR($EA6=0,$EA6=2),VLOOKUP(DO6,INDIRECT(ED6),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP6),\"\",VLOOKUP(DP6,INDIRECT(EE6),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ6),\"\",VLOOKUP(DQ6,INDIRECT(EF6),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR6),\"\",VLOOKUP(DR6,INDIRECT(EG6),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN6,3)=\"NEW\")+2*AND(LEFT(DN6,3)=\"MER\")+3*AND(LEFT(DN6,3)=\"MOV\")+4*AND(LEFT(DN6,3)=\"SWA\")","v":0},{"$error":"#REF!"},{"$f":"IF(EA6=0,IF(DW6=0,\"\",DW6),CHOOSE(EA6,\"New indicator\",CONCATENATE(DW6,CarriageReturn,DX6,CarriageReturn,DY6,CarriageReturn,DZ6)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO6,1)","v":"OriginalComplianceP8"},{"$f":"\"OriginalComplianceP\"&LEFT(DP6,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ6,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR6,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,{"$f":"IF(OR(AND(EH6>0,SUM(EI6:EL6)>0),EK6>0),\"Partial\",IF(EH6=EM6,\"Yes\",IF(EI6=EM6,\"No\",IF(EJ6=EM6,\"N/A\",IF(EK6=EM6,\"Partial\",IF(EL6=EM6,\"\",\"\"))))))","v":""}]
[null,"8","8.1","8.1.1",0,"8.1.1.3",{"$f":"AZ7&\": \"&CHOOSE(LanguageNumber,BA7,BR7,CH7,CX7)","v":"8.1.1.3: IDENTIFY ALL PERSONAL DATA AND MANAGE PRIVACY RISKS\nA data privacy assessment process should be implemented to manage data privacy risks. The process should include two key steps: an Initial Privacy Assessment (IPA) to identify personal data, and a Privacy Impact Assessment (PIA) to manage risks to personal data.\n\nThe Initial Privacy Assessment (IPA) should identify all personal data that is stored and processed in the mobile money system. Business, technical, security and risk management teams should collaborate to complete the IPA.\n\nThe Privacy Impact Assessment (PIA) determines and mitigates privacy risks during collection and processing of personal data, more specifically: \n- identifies risks associated with mobile money customers' data that is being held, considering how the data is stored and transmitted and the people that have access to it; and\n- identifies protection processes for handling customers' data to mitigate privacy risks.\n\nData privacy risks identified by the PIA should be entered into the mobile money risk matrix (see 4.6.1.2).\n\nIPAs and PIAs should be conducted whenever changes are made to the mobile money service or system."},{"$f":"BB7","v":"NIST 4.2.2\nIS029100 4.5"},{"$f":"BC7","v":"8.1.1.3.1"},"8.1.1.3.1: Does the data privacy assessment process include steps to identify all personal data that is stored and processed by mobile money (i.e. an Initial Privacy Assessment - IPA)?\n","1) Data privacy assessment process\n- Check that the provider has conducted steps to identify all personal data that is stored and processed by mobile money (initial privacy assessment (IPA) process).\n- Check that data that is processed and stored has been documented.",0,"Standard Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8","8.1","8.1.1",null,"8.1.1.3","IDENTIFY ALL PERSONAL DATA AND MANAGE PRIVACY RISKS\nA data privacy assessment process should be implemented to manage data privacy risks. The process should include two key steps: an Initial Privacy Assessment (IPA) to identify personal data, and a Privacy Impact Assessment (PIA) to manage risks to personal data.\n\nThe Initial Privacy Assessment (IPA) should identify all personal data that is stored and processed in the mobile money system. Business, technical, security and risk management teams should collaborate to complete the IPA.\n\nThe Privacy Impact Assessment (PIA) determines and mitigates privacy risks during collection and processing of personal data, more specifically: \n- identifies risks associated with mobile money customers' data that is being held, considering how the data is stored and transmitted and the people that have access to it; and\n- identifies protection processes for handling customers' data to mitigate privacy risks.\n\nData privacy risks identified by the PIA should be entered into the mobile money risk matrix (see 4.6.1.2).\n\nIPAs and PIAs should be conducted whenever changes are made to the mobile money service or system.","NIST 4.2.2\nIS029100 4.5","8.1.1.3.1","8.1.1.3.1","Does the data privacy assessment process include steps to identify all personal data that is stored and processed by mobile money (i.e. an Initial Privacy Assessment - IPA)?","1) Data privacy assessment process\n- Check that the provider has conducted steps to identify all personal data that is stored and processed by mobile money (initial privacy assessment (IPA) process).\n- Check that data that is processed and stored has been documented.",null,"Standard Required","Required","BizOps",null,null,"8","8.1","8.1.1",0,"8.1.1.3","IDENTIFIER TOUTES LES DONNÉES À CARACTÈRE PERSONNEL ET GÉRER LES RISQUES CORRESPONDANTS\nLes prestataires doivent réaliser une évaluation préalable de confidentialité (EPC) pour recenser les points de stockage et de traitement des données à caractère personnel dans le système de l’argent mobile. Cette EPC doit être réalisée en collaboration entre les équipes fonctionnelles, techniques, de sécurité et de gestion des risques du prestataire.\n\nLes prestataires doivent également réaliser une évaluation de l'impact sur la vie privée (EIVP) pour identifier et prévenir les risques d'atteinte à la vie privée lors de la collecte et du traitement de données à caractère personnel, et plus spécifiquement, pour:\n- identifier les risques liés à la conservation de données se rapportant aux clients de l’argent mobile, en examinant la manière dont ces données sont stockées et transmises et les personnes y ayant accès ; \n- identifier les procédures de protection applicables au traitement des données des clients afin de réduire les risques d’atteinte à la confidentialité de ces données. \n\nLes risques relatifs à la confidentialité des données identifiés par l’EIVP doit être intégrés à la matrice des risques de l’argent mobile (cf. 4.6.1.2).\n\nLes EPC et EIVP doivent être réalisées à chaque changement dans le système ou le service de l’argent mobile. \n","NIST 4.2.2\nIS029100 4.5","8.1.1.3.1","Le processus d'évaluation de la confidentialité des données prévoit-il des étapes pour identifier toutes les données personnelles stockées et traitées par l’activité d'argent mobile (c.a.d. via une évaluation de l’impact sur la vie privée - EIVP) ?","1) Processus d’évaluation de la confidentialité des données\n\r- Vérifier que le prestataire a suivi toutes les étapes nécessaires pour identifier les données à caractère personnel stockées et traitées dans le système d’argent mobile (processus d’évaluation préalable de confidentialité (EPC)).\r\n- Vérifier que les données traitées et stockées sont documentées.",null,"Requis Normal","Requis","BizOps",0,null,"8","8.1","8.1.1",null,"8.1.1.3","IDENTIFICAR TODOS LOS DATOS PERSONALES Y GESTIONAR LOS RIESGOS A LA PRIVACIDAD\nSe debe implementar un proceso de evaluación de privacidad de los datos para gestionar los riesgos a la privacidad de los datos. El proceso debe incluir dos pasos clave: una Evaluación de Privacidad Inicial (IPA) para identificar los datos personales y una Evaluación de Impactos a la Privacidad (PIA) para gestionar los riesgos a los datos personales.\n\nLa Evaluación de Privacidad Inicial (IPA) debe identificar todos los datos personales almacenados y procesados en el sistema del dinero móvil. Los equipos comerciales, técnicos, de seguridad y gestión de riesgos deben colaborar para completar la IPA.\n\nLa Evaluación de Impactos a la Privacidad (PIA) determina y mitiga los riesgos a la privacidad durante la recolección y el procesamiento de los datos personales, y más específicamente: \n- identifica los riesgos asociados a los datos de los clientes del dinero móvil, considerando cómo se almacenan y transmiten los datos y las personas con acceso a los mismos; e\n- identifica los procesos de protección al manejar los datos de los clientes para mitigar los riesgos a la privacidad.\n\nLos riesgos a la privacidad de los datos identificados por el PIA deben ser ingresados a la matriz de riesgos del dinero móvil (ver 4.6.1.2).\n\nSe deben llevar a cabo IPA y PIA siempre que se realizan cambios al servicio o sistema del dinero móvil.","NIST 4.2.2\nIS029100 4.5","8.1.1.3.1","¿El proceso de evaluación de privacidad de los datos incluye pasos para identificar todos los datos personales almacenados y procesados por el dinero móvil (es decir, una Evaluación de Privacidad Inicial - IPA)?","1) Proceso de evaluación de privacidad de los datos \n- Verificar que el proveedor haya tomado medidas para identificar todos los datos personales almacenados y procesados por el dinero móvil (proceso de evaluación de privacidad inicial - IPA).\n- Verificar que los datos procesados y almacenados hayan sido documentados.",null,"Obligatorio estándar","Obligatorio","BizOps",null,null,"8","8.1","8.1.1",null,"8.1.1.3",null,"NIST 4.2.2\nIS029100 4.5","8.1.1.3.1",null,null,null,"ReqS4","Req4","BizOps",null,null,null,null,null,null,null,null,"8.1.1.3.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP8","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"8","8.1","8.1.1",0,"8.1.1.3",null,0,"8.1.1.3.2","8.1.1.3.2: Does the data privacy assessment process include steps to determine and mitigate risks to data privacy (i.e. a Privacy Impact Assessment - PIA)?\n","1) Data privacy assessment process\n- Check that the provider has conducted a process to determine and mitigate risks to data privacy within mobile money (privacy impact assessment (PIA) process).\n- Check that the risks and mitigations have been documented.",0,"Standard Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8","8.1","8.1.1",null,"8.1.1.3",null,null,"8.1.1.3.2","8.1.1.3.2","Does the data privacy assessment process include steps to determine and mitigate risks to data privacy (i.e. a Privacy Impact Assessment - PIA)?","1) Data privacy assessment process\n- Check that the provider has conducted a process to determine and mitigate risks to data privacy within mobile money (privacy impact assessment (PIA) process).\n- Check that the risks and mitigations have been documented.",null,"Standard Required","Required","BizOps",null,null,"8","8.1","8.1.1",0,"8.1.1.3",null,0,"8.1.1.3.2","Le processus d'évaluation de la confidentialité des données prévoit-il des étapes pour déterminer et diminuer les risques liées à la confidentialité des données (c.a.d. via une évaluation de l’impact sur la vie privée - EIVP) ?","1) Processus d’évaluation de la confidentialité des données\n- Vérifier que le prestataire a mis en œuvre un processus visant à identifier et réduire les risques d’atteinte à la confidentialité des données dans le système d’argent mobile (processus d’évaluation de l’impact sur la vie privée (EIVP)).\n\r- Vérifier que les risques et les mesures de réduction des risques ont été documentés.",null,"Requis Normal","Requis","BizOps",0,null,"8","8.1","8.1.1",null,"8.1.1.3",null,0,"8.1.1.3.2","¿El proceso de evaluación de privacidad de los datos incluye pasos para determinar y mitigar los riesgos asociados a la privacidad de los datos (es decir, una Evaluación de Impactos a la Privacidad - PIA)?","1) Proceso de evaluación de privacidad de los datos\n- Verificar que el proveedor haya llevado a cabo un proceso para determinar y mitigar los riesgos a la privacidad de los datos dentro del dinero móvil (proceso de evaluación de impactos a la privacidad - PIA).\n- Verificar que se hayan documentado los riesgos y las mitigaciones.",null,"Obligatorio estándar","Obligatorio","BizOps",null,null,"8","8.1","8.1.1",null,"8.1.1.3",null,0,"8.1.1.3.2",null,null,null,"ReqS4","Req4","BizOps",null,null,null,null,null,null,null,null,"8.1.1.3.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP8","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"8","8.1","8.1.1",0,"8.1.1.3",null,0,"8.1.1.3.3","8.1.1.3.3: Are IPAs and PIAs conducted whenever changes are made to the mobile money service or system?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8","8.1","8.1.1",null,"8.1.1.3",null,null,"8.1.1.3.3","8.1.1.3.3","Are IPAs and PIAs conducted whenever changes are made to the mobile money service or system?",null,null,"Recommended","Recommended","BizOps",null,null,"8","8.1","8.1.1",0,"8.1.1.3",null,0,"8.1.1.3.3","des EPC et EIVP sont-elles réalisées à chaque changement dans le système ou le service de l’argent mobile ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"8","8.1","8.1.1",null,"8.1.1.3",null,0,"8.1.1.3.3","¿Se llevan a cabo IPA y PIA siempre que se realizan cambios al servicio o sistema del dinero móvil?",null,null,"Recomendado","Recomendado","BizOps",null,null,"8","8.1","8.1.1",null,"8.1.1.3",null,0,"8.1.1.3.3",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"8.1.1.3.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP8","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"8","8.1","8.1.1",0,"8.1.1.4",{"$f":"AZ10&\": \"&CHOOSE(LanguageNumber,BA10,BR10,CH10,CX10)","v":"8.1.1.4: DATA PRIVACY RULES OF BEHAVIOUR\nUsing the results of the IPA and PIA, the provider should define data privacy rules of behaviour, which define controls for the handling of personal data. The privacy rules of behaviour should include:\n- Access rules for personal data;\n- Limitations on the collection, disclosure, sharing, and use of personal data;\n- Personal data retention schedules and procedures;\n- Data privacy in the system development lifecycle process; and\n- Consequences for failure to follow privacy rules of behaviour."},"NIST 4.1.1\nISO 29100:2011:2011 4.6","8.1.1.4.1","8.1.1.4.1: Has the provider defined data privacy rules of behaviour that govern access, collection, disclosure, sharing, retention, and use of personal data?\n","1) Data privacy rules of behaviour document\n- Check that the document defines data privacy rules of behaviour that govern how personal data is:\na) Accessed\nb) Collected \nc) Disclosed \nd) Shared \ne) Retained \nf) Used",0,"Standard Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8","8.1","8.1.1",null,"8.1.1.4","DATA PRIVACY RULES OF BEHAVIOUR\nUsing the results of the IPA and PIA, the provider should define data privacy rules of behaviour, which define controls for the handling of personal data. The privacy rules of behaviour should include:\n- Access rules for personal data;\n- Limitations on the collection, disclosure, sharing, and use of personal data;\n- Personal data retention schedules and procedures;\n- Data privacy in the system development lifecycle process; and\n- Consequences for failure to follow privacy rules of behaviour.","NIST 4.1.1\nISO 29100:2011:2011 4.6","8.1.1.4.1","8.1.1.4.1","Has the provider defined data privacy rules of behaviour that govern access, collection, disclosure, sharing, retention, and use of personal data?","1) Data privacy rules of behaviour document\n- Check that the document defines data privacy rules of behaviour that govern how personal data is:\na) Accessed\nb) Collected \nc) Disclosed \nd) Shared \ne) Retained \nf) Used",null,"Standard Required","Required","BizOps",null,null,"8","8.1","8.1.1",0,"8.1.1.4","RÈGLES DE CONDUITE RELATIVES À LA CONFIDENTIALITÉ DES DONNÉES\nSur la base des résultats de l’EPC et de l’EIVP, le prestataire doit établir des règles de conduite relatives à la confidentialité des données, afin de définir les mesures de prévention applicables au traitement des donnés à caractère personnel. Ces règles de conduite doivent couvrir les aspects suivants : \n- règles d’accès aux données à caractère personnel ; \n- limitations applicables à la collecte, la communication, le partage et l’utilisation des données à caractère personnel ;\n- calendriers et procédures de conservation des données à caractère personnel ;\n- confidentialité des données dans le processus de cycle de vie du développement du système ;\n- conséquences du non respect des règles de conduite relatives à la confidentialité des données.\n","NIST 4.1.1\nISO 29100:2011:2011 4.6","8.1.1.4.1","le prestataire a-t-il défini des règles de conduite relatives à la confidentialité des données qui régissent l'accès à ces données, leur collecte, leur communication, leur partage, leur conservation et leur utilisation ?","1) Document énonçant les règles de conduite relatives à la confidentialité des données\n- Vérifier que le document définit les règles de conduite relatives à la confidentialité des données régissant :\na) L’accès\nb) La collecte \nc) La communication \nd) Le partage \ne) La conservation \nf) L’utilisation des données à caractère personnel",null,"Requis Normal","Requis","BizOps",0,null,"8","8.1","8.1.1",null,"8.1.1.4","REGLAS DE CONDUCTA DE PRIVACIDAD DE LOS DATOS\nUsando los resultados de IPA y PIA, el proveedor debe definir las reglas de conducta de privacidad de los datos, que establecen los controles para el manejo de los datos personales. Las reglas de conducta de privacidad deben incluir:\n- Reglas de acceso a los datos personales;\n- Limitaciones en la recolección, divulgación, comunicación y uso de los datos personales;\n- Cronogramas y procedimientos de retención de los datos personales;\n- Privacidad de los datos en el proceso del ciclo de vida de desarrollo del sistema; y\n- Consecuencias del incumplimiento de las reglas de conducta de privacidad.","NIST 4.1.1\nISO 29100:2011:2011 4.6","8.1.1.4.1","¿El proveedor definió reglas de conducta de privacidad de los datos que rigen el acceso, recolección, comunicación, retención y uso de los datos personales?","1) Documento de reglas de conducta de privacidad de los datos\n- Verificar que el documento defina las reglas de conducta de privacidad de los datos que rijan lo siguiente respecto de los datos personales:\na) Acceso\nb) Recolección\nc) Divulgación\nd) Comunicación\ne) Retención\nf) Uso",null,"Obligatorio estándar","Obligatorio","BizOps",null,null,"8","8.1","8.1.1",null,"8.1.1.4",null,"NIST 4.1.1\nISO 29100:2011:2011 4.6","8.1.1.4.1",null,null,null,"ReqS4","Req4","BizOps",null,null,null,null,null,null,null,null,"8.1.1.4.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP8","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"8","8.1","8.1.1",0,"8.1.1.4",null,0,"8.1.1.4.2","8.1.1.4.2: Do the data privacy rules of behaviour discuss consequences for failure to follow these rules?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8","8.1","8.1.1",null,"8.1.1.4",null,null,"8.1.1.4.2","8.1.1.4.2","Do the data privacy rules of behaviour discuss consequences for failure to follow these rules?",null,null,"Recommended","Recommended","BizOps",null,null,"8","8.1","8.1.1",0,"8.1.1.4",null,0,"8.1.1.4.2","les règles de conduite relatives à la confidentialité des données mentionnent-elle les conséquences du non respect de ces règles ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"8","8.1","8.1.1",null,"8.1.1.4",null,0,"8.1.1.4.2","¿Las reglas de conducta de privacidad de los datos analizan las consecuencias del incumplimiento de estas reglas?",null,null,"Recomendado","Recomendado","BizOps",null,null,"8","8.1","8.1.1",null,"8.1.1.4",null,0,"8.1.1.4.2",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"8.1.1.4.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP8","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"8","8.1","8.1.1",0,"8.1.1.5",{"$f":"AZ12&\": \"&CHOOSE(LanguageNumber,BA12,BR12,CH12,CX12)","v":"8.1.1.5: DATA PRIVACY POLICIES OF THIRD PARTIES\nWritten agreements governing data privacy should be in place with all third parties that either process personal data or have access to personal data. This includes:\n(1) processing or transfer of personal data through third party systems;\n(2) sharing of personal data with third parties such as financial ecosystem partners or entities providing outsourced services.\n\nRelevant third parties could include:\n - suppliers, such as technical platform provider or agent management company;\n - financial partners, such ATM providers and banks.\n\nThese agreements should cover:\n- the third party's responsibility to ensure data privacy;\n- restrictions on further sharing of personal data;\n- notification requirements in case of a breach."},"NIST 4.1.1\nISO 29100:2011:2011 4.6","8.1.1.5.1","8.1.1.5.1: Where necessary, do agreements with external parties cover responsibilities for data privacy and restrictions on further sharing of personal data?\n","1) Data privacy policy or data privacy rules of behaviour document\n- Check that the document requires data privacy responsibilities to be contractually assigned to third parties with data access.\n\n2) Sample agreement with an external party that has access to customer data\n- Check that the agreement includes the 3rd party's responsibility for ensuring data privacy.\n- Check that the agreement prevents further sharing of customer data.",0,"Standard Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8","8.1","8.1.1",null,"8.1.1.5","DATA PRIVACY POLICIES OF THIRD PARTIES\nWritten agreements governing data privacy should be in place with all third parties that either process personal data or have access to personal data. This includes:\n(1) processing or transfer of personal data through third party systems;\n(2) sharing of personal data with third parties such as financial ecosystem partners or entities providing outsourced services.\n\nRelevant third parties could include:\n - suppliers, such as technical platform provider or agent management company;\n - financial partners, such ATM providers and banks.\n\nThese agreements should cover:\n- the third party's responsibility to ensure data privacy;\n- restrictions on further sharing of personal data;\n- notification requirements in case of a breach.","NIST 4.1.1\nISO 29100:2011:2011 4.6","8.1.1.5.1","8.1.1.5.1","Where necessary, do agreements with external parties cover responsibilities for data privacy and restrictions on further sharing of personal data?","1) Data privacy policy or data privacy rules of behaviour document\n- Check that the document requires data privacy responsibilities to be contractually assigned to third parties with data access.\n\n2) Sample agreement with an external party that has access to customer data\n- Check that the agreement includes the 3rd party's responsibility for ensuring data privacy.\n- Check that the agreement prevents further sharing of customer data.",null,"Standard Required","Required","BizOps",null,null,"8","8.1","8.1.1",0,"8.1.1.5","POLITIQUES DE TIERS RELATIVES À LA CONFIDENTIALITÉ DES DONNÉES\nDes accords écrits régissant la protection de la confidentialité des données doivent être mis en place avec l’ensemble des intervenants extérieurs assurant le traitement de données à caractère personnel ou ayant accès à de telles données. Ces accords doivent couvrir :\n(1) le traitement ou le transfert de données à caractère personnel par le biais de systèmes de tiers ; \n(2) le partage des données à caractère personnel avec des tiers tels que les partenaires de l’écosystème financier ou les entités assurant des services de sous-traitance. \n\nLes tiers concernés peuvent inclure :\n- des prestataires, par exemple un fournisseur de plateformes techniques ou une société chargée de la gestion d'agents ;\n- des partenaires financiers, comme les prestataires de GAB et les banques.\n\nIl est également souhaitable que ces accords précisent : \n- les responsabilités des tiers en matière de protection de la confidentialité des données ;\n- les restrictions applicables à tout autre partage des données à caractère personnel ;\n- les exigences en matière de signalement des violations.\n","NIST 4.1.1\nISO 29100:2011:2011 4.6","8.1.1.5.1","les accords avec des intervenants extérieurs définissent-ils, le cas échéant, les responsabilités en matière de protection de la confidentialité des données et des restrictions sur le partage supplémentaire des données personnelles ?","1) Politique relative à la confidentialité des données ou document énonçant les règles de conduite relatives à la confidentialité des données\n- Vérifier que le document prévoit l’obligation d’assigner de manière contractuelle les responsabilités en matière de confidentialité des données aux tiers ayant accès aux données en question.\n\n2) Modèle d’accord avec un tiers extérieur ayant accès aux données concernant les clients\n- Vérifier que l’accord définit les responsabilités des tiers en matière de confidentialité des données.\n- Vérifier que l’accord définit les restrictions applicables à tout autre partage des données concernant les clients.",null,"Requis Normal","Requis","BizOps",0,null,"8","8.1","8.1.1",null,"8.1.1.5","POLÍTICAS DE PRIVACIDAD DE DATOS DE TERCEROS\nSe deben celebrar acuerdos por escrito que rijan la privacidad de los datos con todos los terceros que procesan datos personales o tienen acceso a los datos personales. Esto incluye:\n(1) procesar o transferir datos personales a través de sistemas de terceros;\n(2) compartir datos personales con terceros, como por ejemplo socios del ecosistema financiero o entidades que prestan servicios tercerizados.\n\nLos terceros relevantes podrían incluir:\n - proveedores, tales como el proveedor de la plataforma técnica o la compañía de gestión de agentes;\n - socios financieros, como prpoveedores de cajeros automáticos y bancos.\n\nEstos acuerdos deben contemplar:\n- la responsabilidad de los terceros para garanticar la privacidad de los datos;\n- las restricciones a la hora de compartir los datos personales; \n- los requisitos de notificación en caso de incumplimiento.","NIST 4.1.1\nISO 29100:2011:2011 4.6","8.1.1.5.1","Cuando es necesario, ¿los acuerdos con partes externas contemplan las responsabilidades de privacidad de los datos y las restricciones a la hora de compartir datos personales?","1) Política de privacidad de datos o documento de reglas de conducta de privacidad de los datos\n- Verificar que el documento requiera que las responsabilidades de privacidad de los datos sean contractualmente asignadas a terceros con acceso a los datos.\n\n2) Acuerdo modelo con una parte externa con acceso a los datos de los clientes\n- Verificar que el acuerdo incluya la responsabilidad del tercero de garantizar la privacidad de los datos.\n- Verificar que el acuerdo evite que se sigan compartiendo los datos de los clientes.",null,"Obligatorio estándar","Obligatorio","BizOps",null,null,"8","8.1","8.1.1",null,"8.1.1.5",null,"NIST 4.1.1\nISO 29100:2011:2011 4.6","8.1.1.5.1",null,null,null,"ReqS4","Req4","BizOps",null,null,null,null,null,null,null,"MERGE","8.1.1.5.1","8.1.1.5.2",null,null,{"$error":"#REF!"},{"$error":"#REF!"},"","",{"$error":"#REF!"},{"$error":"#REF!"},"","",2,"",{"$error":"#REF!"},"OriginalComplianceP8","OriginalComplianceP8","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,2,""]
[null,"8","8.1","8.1.1",0,"8.1.1.5",null,0,"8.1.1.5.2","8.1.1.5.2: Do agreements with all external parties describe notification requirements in case of a breach?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8","8.1","8.1.1",null,"8.1.1.5",null,null,"8.1.1.5.2","8.1.1.5.3","Do agreements with all external parties describe notification requirements in case of a breach?",null,null,"Recommended","Recommended","BizOps",null,null,"8","8.1","8.1.1",0,"8.1.1.5",null,0,"8.1.1.5.2","les accords avec des intervenants extérieurs précisent-ils tous les obligations de notification en cas d’atteinte à la confidentialité des données ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"8","8.1","8.1.1",null,"8.1.1.5",null,0,"8.1.1.5.2","¿Los acuerdos con todas las partes externas describen los requisitos de notificación en caso de incumplimiento?",null,null,"Recomendado","Recomendado","BizOps",null,null,"8","8.1","8.1.1",null,"8.1.1.5",null,0,"8.1.1.5.2",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"8.1.1.5.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP8","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"8","8.1","8.1.1",0,"8.1.1.5",null,0,"8.1.1.5.3","8.1.1.5.3: Do agreements with all external parties describe minimum security controls to limit access to personal data?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8","8.1","8.1.1",null,"8.1.1.5",null,null,"8.1.1.5.3","8.1.1.5.4","Do agreements with all external parties describe minimum security controls to limit access to personal data?",null,null,"Recommended","Recommended","BizOps",null,null,"8","8.1","8.1.1",0,"8.1.1.5",null,0,"8.1.1.5.3","les accords avec des intervenants extérieurs décrivent-ils tous les mesures minimales de contrôle de l’accès aux données à caractère personnel ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"8","8.1","8.1.1",null,"8.1.1.5",null,0,"8.1.1.5.3","¿Los acuerdos con todas las partes externas describen los controles de seguridad mínimos para limitar el acceso a los datos personales?",null,null,"Recomendado","Recomendado","BizOps",null,null,"8","8.1","8.1.1",null,"8.1.1.5",null,0,"8.1.1.5.3",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"8.1.1.5.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP8","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"8","8.1","8.1.1",0,"8.1.1.6",{"$f":"AZ15&\": \"&CHOOSE(LanguageNumber,BA15,BR15,CH15,CX15)","v":"8.1.1.6: PERSONAL DATA QUALITY AND ACCURACY\nProviders should maintain the accuracy and quality of personal data by: \n- reviewing customers' personal data periodically to ensure it is complete and free of obvious errors; \n- ensuring the reliability of personal data collected from a source other than the customer (e.g. a marketing agency) before it is processed; and\n- verifying the validity of personal data provided by the customer, where it is appropriate to do so. (Note that 2.5.1 elaborates on verification of personal data collected for KYC purposes during registration.)\n\nThis practice refers to all data collected for a customer, not just KYC data. For instance, other personal data such as address details or credit history could be collected.\nExamples of personal data sources other than the customer include marketing agencies and the provider's own subsidiaries or affiliates."},"NIST Appendix D\nISO 29100:2011 5.7","8.1.1.6.1","8.1.1.6.1: Is customers' personal data reviewed periodically to ensure it is complete and free of obvious errors?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8","8.1","8.1.1",null,"8.1.1.6","PERSONAL DATA QUALITY AND ACCURACY\nProviders should maintain the accuracy and quality of personal data by: \n- reviewing customers' personal data periodically to ensure it is complete and free of obvious errors; \n- ensuring the reliability of personal data collected from a source other than the customer (e.g. a marketing agency) before it is processed; and\n- verifying the validity of personal data provided by the customer, where it is appropriate to do so. (Note that 2.5.1 elaborates on verification of personal data collected for KYC purposes during registration.)\n\nThis practice refers to all data collected for a customer, not just KYC data. For instance, other personal data such as address details or credit history could be collected.\nExamples of personal data sources other than the customer include marketing agencies and the provider's own subsidiaries or affiliates.","NIST Appendix D\nISO 29100:2011 5.7","8.1.1.6.1","8.1.1.6.1","Is customers' personal data reviewed periodically to ensure it is complete and free of obvious errors?",null,null,"Recommended","Recommended","BizOps",null,null,"8","8.1","8.1.1",0,"8.1.1.6","QUALITÉ ET EXACTITUDE DES DONNÉES À CARACTÈRE PERSONNEL \nLes prestataires doivent préserver la qualité et l’exactitude des données à caractère personnel au moyen de mesures suivantes : \n- examen périodique des données personnelles se rapportant aux clients pour vérifier qu’elles sont complètes et ne contiennent pas d’erreurs manifestes ; \n- vérification de la fiabilité des données à caractère personnel collectées auprès d’une autre source que le client (une agence marketing par exemple) avant leur traitement ; \n- vérification de la validité des données à caractère personnel fournies par le client, lorsqu’il est approprié de le faire. (Remarque : le sous-principe 2.5.1 précise les exigences de contrôle des données à caractère personnel aux fins de vérification de l’identité du client lors de l’enregistrement de celui-ci).\n\nSe référer à la note explicative pour de plus amples renseignements.","NIST Appendix D\nISO 29100:2011 5.7","8.1.1.6.1","les données à caractère personnel des clients font-elles l'objet",null,null,"Recommandé","Recommandé","BizOps","Cette pratique s’applique à toutes les données collectées à propos d’un client, et pas seulement ses renseignements d’identité. Les données concernées peuvent par exemple inclure l’adresse du client ou son historique de crédit. \n\nLes autres sources de données personnelles concernant le client peuvent inclure des agences de marketing ou les filiales ou autres sociétés affiliées du prestataires. \n",null,"8","8.1","8.1.1",null,"8.1.1.6","CALIDAD Y PRECISIÓN DE LOS DATOS PERSONALES\nLos proveedores deben mantener la precisión y calidad de los datos personales al: \n- revisar periódicamente los datos personales de los clientes para garantizar que estén completos y libres de errores evidentes; \n- garantizar la confiabilidad de los datos personales recolectados de una fuente distinta del cliente (por ej., una agencia de marketing) antes de procesarlos; y\n- verificar la validez de los datos personales suministrados por el cliente, cuando corresponda. (Nótese que 2.5.1 aborda la verificación de los datos personales recolectados para fines del registros de conocimiento del cliente (CSC) durante el registro).\n\nEsta práctica se refiere a todos los datos recolectados para un cliente, no solo a los datos de CSC. Por ejemplo, se podrían recolectar otros datos personales tales como el domicilio o el historial de créditos.\nLos ejemplos de fuentes de datos personales distintas del cliente incluyen las agencias de marketing y las propias subsidiarias o afiliadas del proveedor.","NIST Appendix D\nISO 29100:2011 5.7","8.1.1.6.1","¿Los datos personales de los clientes son revisados periódicamente para garantizar que estén completos y libres de errores evidentes?",null,null,"Recomendado","Recomendado","BizOps",null,null,"8","8.1","8.1.1",null,"8.1.1.6",null,"NIST Appendix D\nISO 29100:2011 5.7","8.1.1.6.1",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"8.1.1.6.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP8","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"8","8.1","8.1.1",0,"8.1.1.6",null,0,"8.1.1.6.2","8.1.1.6.2: Is the reliability of personal data collected from a source other than the customer confirmed before it is processed?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8","8.1","8.1.1",null,"8.1.1.6",null,null,"8.1.1.6.2","8.1.1.6.2","Is the reliability of personal data collected from a source other than the customer confirmed before it is processed?",null,null,"Recommended","Recommended","BizOps",null,null,"8","8.1","8.1.1",0,"8.1.1.6",null,0,"8.1.1.6.2","la fiabilité des données à caractère personnel collectées auprès d’une autre source que le client est-elle vérifiée avant leur utilisation (cf. note explicative) ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"8","8.1","8.1.1",null,"8.1.1.6",null,0,"8.1.1.6.2","¿Se confirma la confiabilidad de los datos personales recolectados de una fuente distinta del cliente antes de su procesamiento?",null,null,"Recomendado","Recomendado","BizOps",null,null,"8","8.1","8.1.1",null,"8.1.1.6",null,0,"8.1.1.6.2",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"8.1.1.6.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP8","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"8","8.1","8.1.1",0,"8.1.1.7",{"$f":"AZ17&\": \"&CHOOSE(LanguageNumber,BA17,BR17,CH17,CX17)","v":"8.1.1.7: TRAINING AND EDUCATION ON DATA PRIVACY\nProviders should put in place a data protection training and awareness plan. The plan should (1) specify the content of the data protection training, (2) assign responsibility for its implementation, and (3) be tailored to the different roles receiving the training. All staff (and agents and entities providing outsourced services, if applicable) with access to personal data should be trained in data protection, with periodic refresher training.\n\nProviders should focus attention on the protection and fair usage of personal data. Training should include: \n- informing staff of new scams that are being used to steal identities; \n- providing updates on privacy items in the news such as government data breaches and their effect on individuals and the organization;\n- providing examples of how staff  have been held accountable for inappropriate actions; and \n- providing examples of recommended privacy practices. \nThe goal of training is to build knowledge and skills that will enable staff to protect personal data."},"NIST 4.1.2","8.1.1.7.1","8.1.1.7.1: Is there a data protection training and awareness plan for educating staff and agents on the protection and fair usage of personal data?\n","1) Staff training programme, 2) Agent training programme.\n- Check that the training/briefing  for employees and agents includes details on the protection and fair usage of personal data.",0,"Standard Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8","8.1","8.1.1",null,"8.1.1.7","TRAINING AND EDUCATION ON DATA PRIVACY\nProviders should put in place a data protection training and awareness plan. The plan should (1) specify the content of the data protection training, (2) assign responsibility for its implementation, and (3) be tailored to the different roles receiving the training. All staff (and agents and entities providing outsourced services, if applicable) with access to personal data should be trained in data protection, with periodic refresher training.\n\nProviders should focus attention on the protection and fair usage of personal data. Training should include: \n- informing staff of new scams that are being used to steal identities; \n- providing updates on privacy items in the news such as government data breaches and their effect on individuals and the organization;\n- providing examples of how staff  have been held accountable for inappropriate actions; and \n- providing examples of recommended privacy practices. \nThe goal of training is to build knowledge and skills that will enable staff to protect personal data.","NIST 4.1.2","8.1.1.7.1",{"$f":"DO17","v":"8.1.1.8.1"},"Is there a data protection training and awareness plan for educating staff and agents on the protection and fair usage of personal data?","1) Staff training programme, 2) Agent training programme.\n- Check that the training/briefing  for employees and agents includes details on the protection and fair usage of personal data.",null,"Standard Required","Required","BizOps",null,null,"8","8.1","8.1.1",0,"8.1.1.7","FORMATION ET ÉDUCATION CONCERNANT LA CONFIDENTIALITÉ DES DONNÉES\nLes prestataires doivent mettre en place un programme de formation et de sensibilisation à la protection des données. Ce programme doit (1) spécifier le contenu de la formation, (2) assigner la responsabilité de sa mise en œuvre et (3) être adapté aux différentes fonctions recevant la formation. Tous les collaborateurs (ainsi que les agents et entités assurant des services en sous-traitance, le cas échéant) ayant accès à des données à caractère personnel doivent être formés à la protection des données, avec des formations régulières de rappel.\n\nLes prestataires doivent prêter attention à la protection et à l'utilisation équitable des données à caractère personnel. La formation doit : \n- informer le personnel des nouvelles méthodes frauduleuses utilisées pour le vol d’identité ; \n- faire le point sur les sujets d’actualité relatifs à la confidentialité des données, comme par exemple les atteintes à la confidentialité des données détenues par les pouvoirs publics et leurs conséquences pour les particuliers et les organisations ;\n- donner des exemples de situations dans lesquelles les collaborateurs ont été tenus responsables d’actions inappropriées ; \n- donner des exemples de pratiques recommandées de protection de la confidentialité des données. \nLa formation doit avoir pour objectif d’améliorer les connaissances et les compétences permettant aux personnel de protéger les données à caractère personnel.","NIST 4.1.2","8.1.1.7.1","existe-t-il un programme de formation et de sensibilisation à la protection des données pour éduquer le personnel et les agents sur la protection et l'utilisation équitable des données à caractère personnel ?","1) Programme de formation du personnel, 2) Programme de formation des agents.\n- Vérifier que les formations/les informations dispensées aux salariés et aux agents incluent des informations détaillées concernant la protection et l’utilisation équitable des données à caractère personnel.",null,"Requis Normal","Requis","BizOps",0,null,"8","8.1","8.1.1",null,"8.1.1.7","CAPACITACIÓN Y EDUCACIÓN SOBRE PRIVACIDAD DE LOS DATOS\nLos proveedores deben implementar un plan de capacitación y concientización en materia de protección de datos. El plan debe (1) especificar el contenido de la capacitación en materia de protección de datos, (2) asignar la responsabilidad de su implementación y (3) ajustarse a los diferentes roles que reciben la capacitación. Todo el personal (y agentes y entidades que prestan servicios tercerizados, si corresponde) con acceso a los datos personales deben recibir capacitación en materia de protección de datos, con actualizaciones de capacitación periódicas.\n\nLos proveedores deben poner foco en la protección y el uso razonable de los datos personales. La capacitación debe incluir: \n- informar al personal sobre las nuevas estafas utilizadas para robar identidades; \n- incluir en las noticias actualizaciones sobre los asuntos de privacidad, como por ejemplo violaciones a los datos del gobierno y su efecto en las personas y en la organización;\n- brindar ejemplos de cómo se ha responsabilizado al personal de acciones inadecuadas; y\n- brindar ejemplos de las prácticas de privacidad recomendadas. \nEl objetivo de la capacitación es desarrollar conocimientos y habilidades que permitan al personal proteger los datos personales.","NIST 4.1.2","8.1.1.7.1","¿Existe un plan de capacitación y concientización en materia de protección de datos para educar al personal y a los agentes acerca de la protección y el uso razonable de los datos personales?","1) Programa de capacitación del personal, 2) Programa de capacitación de los agentes.\n- Verificar que la capacitación/información para los empleados y agentes incluya detalles acerca de la protección y el uso razonable de los datos personales.",null,"Obligatorio estándar","Obligatorio","BizOps",null,null,"8","8.1","8.1.1",null,"8.1.1.7",null,"NIST 4.1.2","8.1.1.7.1",null,null,null,"ReqS4","Req4","BizOps",null,null,null,null,null,null,null,null,"8.1.1.8.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP8","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"8","8.1","8.1.1",0,"8.1.1.8",{"$f":"AZ18&\": \"&CHOOSE(LanguageNumber,BA18,BR18,CH18,CX18)","v":"8.1.1.8: DATA PRIVACY INCIDENT-HANDLING\nProviders should develop procedures to handle breaches that involve personal data. \n\n1. Employees, agents, and entities providing outsourced services should be told what constitutes a breach involving personal data, how to report the breach to the provider (e.g. a form), and what information needs to be reported (e.g. what data was lost; which customers were affected; how and when the data was lost).\n\n2. A breach involving personal data may require notification to external entities such as law enforcement, affected customers, the media, and the public.  Therefore, providers should plan in advance how, when, and to whom notifications should be provided. They should also conduct training sessions on how to address incidents when interacting with the media and other external parties. \n\n3. Providers should determine the circumstances under which remedial assistance should be provided to customers affected by data privacy breaches. The impact of a data breach can be reduced by swift communication with the customers whose data was lost. Explicit instructions should be given on steps that the customers should take (e.g. changing PINs, if they have been made public).\n\nIf the data privacy incident is caused by a security incident, also see section 5.3.9.\n\nData breaches can be serious. Customers' personal data can be used by criminals for impersonation fraud or identity theft. Public disclosure of customers' personal data causes reputational damage and possibly financial loss if the provider is held liability for fraud committed using the data. For example, in April 2015, 15,000 files were leaked from Qatar National Bank. The leaked data included passwords, PINs and payment card data for hundreds of thousands of customer accounts."},"NIST 5.0","8.1.1.8.1","8.1.1.8.1: Have incident response plans been developed to address breaches involving personal data?\n","1) Data privacy incident response plan\n- Check that the response plan has been developed for breaches in personal data protection requirements ",0,"Standard Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8","8.1","8.1.1",null,"8.1.1.8","DATA PRIVACY INCIDENT-HANDLING\nProviders should develop procedures to handle breaches that involve personal data. \n\n1. Employees, agents, and entities providing outsourced services should be told what constitutes a breach involving personal data, how to report the breach to the provider (e.g. a form), and what information needs to be reported (e.g. what data was lost; which customers were affected; how and when the data was lost).\n\n2. A breach involving personal data may require notification to external entities such as law enforcement, affected customers, the media, and the public.  Therefore, providers should plan in advance how, when, and to whom notifications should be provided. They should also conduct training sessions on how to address incidents when interacting with the media and other external parties. \n\n3. Providers should determine the circumstances under which remedial assistance should be provided to customers affected by data privacy breaches. The impact of a data breach can be reduced by swift communication with the customers whose data was lost. Explicit instructions should be given on steps that the customers should take (e.g. changing PINs, if they have been made public).\n\nIf the data privacy incident is caused by a security incident, also see section 5.3.9.\n\nData breaches can be serious. Customers' personal data can be used by criminals for impersonation fraud or identity theft. Public disclosure of customers' personal data causes reputational damage and possibly financial loss if the provider is held liability for fraud committed using the data. For example, in April 2015, 15,000 files were leaked from Qatar National Bank. The leaked data included passwords, PINs and payment card data for hundreds of thousands of customer accounts.","NIST 5.0","8.1.1.8.1",{"$f":"DO18","v":"8.1.1.7.1"},"Have incident response plans been developed to address breaches involving personal data?","1) Data privacy incident response plan\n- Check that the response plan has been developed for breaches in personal data protection requirements ",null,"Standard Required","Required","BizOps",null,null,"8","8.1","8.1.1",0,"8.1.1.8","GESTION DES INCIDENTS CONCERNANT LES DONNÉES PERSONNELLES\nLes prestataires doivent développer des procédures de gestion des incidents concernant des données à caractère personnel. \n\n1. Le personnel, les agents et les entités assurant des services en sous-traitance doivent être informés de ce qui constitue une atteinte à la confidentialité des données à caractère personnel, du mode de signalement de ces incidents au prestataire (par ex. un formulaire) et des informations devant lui être communiquées (par ex. quelles données ont été perdues, quels clients ont été concernés, dans quelles conditions les données ont été perdues).\n\n2. Les atteintes à la confidentialité des données à caractère doivent dans certains cas faire l’objet de déclarations à des entités externes, telles que les forces de l’ordre, les clients concernés, les médias et le public.  Les prestataires doivent par conséquent planifier à l’avance quand, comment et à qui ces déclarations doivent être adressées. Ils doivent également organiser des sessions de formation sur la manière de gérer ces incidents dans le cadre des contacts avec les médias et d’autres parties externes. \n\n3. Les prestataires doivent identifier les cas dans lesquels une assistance spécifique doit être apportée aux clients touchés par de tels incidents. Les impacts d’une atteinte à la confidentialité des données peuvent être mitigés à travers une prise de contact rapide avec les clients dont les données ont été perdues. Des instructions claires doivent être données aux clients concernant les mesures à prendre (par ex. changement de codes confidentiels si ceux-ci ont été rendus publics).\n\nSi l’incident relatif à la confidentialité des données résulte d’un incident de sécurité, se référer à la section 5.3.9.\n\nDes atteintes à la confidentialité des données peuvent entraîner de graves conséquences. Les données personnelles des clients peuvent être utilisées par des criminels à des fins de fraude ou d’usurpation d'identité. La divulgation publique de données personnelles peut causer une atteinte à la réputation et des pertes financières si le prestataire est tenu responsable de la fraude commise en utilisant les données. Par exemple, en avril 2015, plus de 15 000 fichiers de la Qatar National Bank ont fuité. Les données comprenaient les mots de passe, codes confidentiels et données de carte de paiement de plusieurs centaines de milliers de comptes client.","NIST 5.0","8.1.1.8.1","existe-t-il un plan de réponse aux incidents affectant la confidentialité des données ?","1) Plan de réponse aux incidents affectant la confidentialité des données\n- Vérifier qu’un plan de réponse a été établi en cas de non-respect des exigences en matière de protection des données à caractère personnel ",null,"Requis Normal","Requis","BizOps","Les atteintes à la confidentialité des données peuvent avoir de graves conséquences. Les données personnelles du client peuvent être utilisées à des fins criminelles telles que les fraudes par usurpation ou vol d’identité. La divulgation publique de données personnelles des clients porte préjudice à la réputation du prestataire et peut entraîner une perte financière s’il est tenu responsable des fraudes commises au moyen de ces données.\n\nEn avril 2015 par exemple, la Banque nationale du Qatar a subi une fuite de 15 000 fichiers contenant les mots de passe, codes confidentiels et données de cartes de paiement de plusieurs centaines de milliers de comptes clients.\n",null,"8","8.1","8.1.1",null,"8.1.1.8","MANEJO DE INCIDENTES DE PRIVACIDAD DE LOS DATOS\nLos proveedores deben desarrollar procedimientos para manejar las violaciones que involucran datos personales. \n\n1. Se debe informar a los empleados, agentes y entidades que prestan servicios tercerizados qué constituye una violación que involucra datos personales, cómo informar la violación al proveedor (por ej., un formulario), y qué información se debe informar (por ej., qué datos se perdieron; qué clientes se vieron afectados; cómo y cuándo se perdieron los datos).\n\n2. Una violación que involucra datos personales puede requerir la notificación a entidades externas, como los organismos de aplicación de la ley, los clientes afectados, los medios y el público en general.  Por ende, los proveedores deben planificar de antemano cómo, cuándo y a quién se deben enviar las notificaciones. También deben llevar a cabo sesiones de capacitación sobre cómo abordar los incidentes al interactuar con los medios u otras partes externas. \n\n3. Los proveedores deben determinar las circunstancias bajo las cuales se debe brindar asistencia para reparación y protección a los clientes afectados por las violaciones a la privacidad. Se puede reducir el impacto de la violación a los datos  mediante una rápida comunicación con el cliente cuyos datos se perdieron. Se deben dar instrucciones explícitas sobre los pasos que el cliente debe realizar (por ej., cambiar los PIN, si fueron divulgados).\n\nSi un incidente de seguridad causa un incidente de privacidad de los datos, ver también 5.3.9.\n\nLas violaciones a los datos pueden ser graves. Los datos personales de los clientes pueden ser utilizados por los delincuentes para cometer fraude de suplantación de identidad o robo de identidad. La divulgación pública de los datos personales del cliente causa daños a la reputación y posibles pérdidas financieras si el proveedor es considerado responsable del fraude cometido utilizando los datos. Por ejemplo, en abril de 2015, se filtraron 15.000 archivos de Qatar National Bank. Los datos filtrados incluyeron contraseñas, PIN y datos de tarjetas de crédito de cientos de miles de cuentas de clientes.","NIST 5.0","8.1.1.8.1","¿Se habrán desarrollado planes de respuesta ante incidentes para responder ante  violaciones a los datos personales?","1) Plan de respuesta ante incidentes de privacidad de los datos\n- Verificar que se haya desarrollado el plan de respuesta para violaciones a los requisitos de protección de los datos personales ",null,"Obligatorio estándar","Obligatorio","BizOps",null,null,"8","8.1","8.1.1",null,"8.1.1.8",null,"NIST 5.0","8.1.1.8.1",null,null,null,"ReqS4","Req4","BizOps",null,null,null,null,null,null,null,null,"8.1.1.7.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP8","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"8","8.1","8.1.1",0,"8.1.1.8",null,0,"8.1.1.8.2","8.1.1.8.2: Have employees been told what constitutes a breach involving personal data, how to report the breach, and what information needs to be reported?\n","1) Staff training programme\n- Check that the training/briefing  for employees includes:\na)  what constitutes a breach involving personal data.\nb) how to report the breach to the provider,\nc) what information needs to be reported\n\n2) Data Privacy Policy or data privacy rules of behaviour document\n- Check that there is a channel / mechanism for employees to report data privacy breaches.",0,"Standard Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8","8.1","8.1.1",null,"8.1.1.8",null,null,"8.1.1.8.2","8.1.1.7.2","Have employees been told what constitutes a breach involving personal data, how to report the breach, and what information needs to be reported?","1) Staff training programme\n- Check that the training/briefing  for employees includes:\na)  what constitutes a breach involving personal data.\nb) how to report the breach to the provider,\nc) what information needs to be reported\n\n2) Data Privacy Policy or data privacy rules of behaviour document\n- Check that there is a channel / mechanism for employees to report data privacy breaches.",null,"Standard Required","Required","BizOps",null,null,"8","8.1","8.1.1",0,"8.1.1.8",null,0,"8.1.1.8.2","Le personnel est-il informé de ce qui constitue une atteinte à la confidentialité des données à caractère personnel, du mode de signalement de ces incidents et des informations devant être communiquées ?","1) Programme de formation du personnel\n\r- Vérifier que les formations/les informations dispensées aux salariés incluent :\r\na) une définition de ce qui constitue une atteinte à la confidentialité des données.\n\rb) le mode de signalement de ces incidents au prestataire,\n\rc) les informations devant être communiquées\r\n\n2) Politique relative à la confidentialité des données ou document énonçant les règles de conduite relatives à la confidentialité des données\r\n- Vérifier qu’un canal/mécanisme a été mis en place pour permettre aux salariés de signaler les atteintes à la confidentialité des données.\r",null,"Requis Normal","Requis","BizOps","Les informations à consigner en cas d’incident affectant la confidentialité des données comprennent par exemple les renseignements suivants :\n- détail des données perdues ;\n- liste des clients concernés ;\n- raison de la perte des données (vol, accident, etc.) :\n- date de la perte des donnés.\n",null,"8","8.1","8.1.1",null,"8.1.1.8",null,0,"8.1.1.8.2","¿Se informó a los empleados qué constituye una violación que involucra datos personales, cómo informar la violación y qué información se debe informar?","1) Programa de capacitación del personal\n- Verificar que la capacitación/información para los empleados incluya:\na) qué constituye una violación que involucra datos personales.\nb) cómo informar una violación al proveedor,\nc) qué información se debe informar\n\n2) Política de Privacidad de Datos o documento de reglas de conducta de privacidad de los datos\n- Verificar que exista un canal / mecanismo para que los empleados informen las violaciones a la privacidad de los datos.",null,"Obligatorio estándar","Obligatorio","BizOps",null,null,"8","8.1","8.1.1",null,"8.1.1.8",null,0,"8.1.1.8.2",null,null,null,"ReqS4","Req4","BizOps",null,null,null,null,null,null,null,null,"8.1.1.7.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP8","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"8","8.1","8.1.1",0,"8.1.1.8",null,0,"8.1.1.8.3","8.1.1.8.3: Is there a plan for notifying external entities such as law enforcement, affected customers, the media, and the public of personal data privacy breaches?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8","8.1","8.1.1",null,"8.1.1.8",null,null,"8.1.1.8.3","8.1.1.7.3","Is there a plan for notifying external entities such as law enforcement, affected customers, the media, and the public of personal data privacy breaches?",null,null,"Recommended","Recommended","BizOps",null,null,"8","8.1","8.1.1",0,"8.1.1.8",null,0,"8.1.1.8.3","existe-t-il un plan de communication à destination des entités externes, telles que les forces de l’ordre, les clients concernés, les médias et le public, pour les informer des incidents affectant la confidentalité des données à caractère personnel ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"8","8.1","8.1.1",null,"8.1.1.8",null,0,"8.1.1.8.3","¿Existe un plan para notificar las violaciones a la privacidad de los datos personales a las entidades externas, como por ejemplo los organismos de aplicación de la ley, los clientes afectados, los medios y el público en general?",null,null,"Recomendado","Recomendado","BizOps",null,null,"8","8.1","8.1.1",null,"8.1.1.8",null,0,"8.1.1.8.3",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"8.1.1.7.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP8","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"8","8.1","8.1.1",0,"8.1.1.8",null,0,"8.1.1.8.4","8.1.1.8.4: Is a process in place to determine any remedial assistance that should be provided to individuals or entities affected by data privacy breaches?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8","8.1","8.1.1",null,"8.1.1.8",null,null,"8.1.1.8.4","8.1.1.7.4","Is a process in place to determine any remedial assistance that should be provided to individuals or entities affected by data privacy breaches?",null,null,"Recommended","Recommended","BizOps",null,null,"8","8.1","8.1.1",0,"8.1.1.8",null,0,"8.1.1.8.4","un processus est-il en place pour déterminer si une assistance corrective doit être apportée aux personnes physiques et morales affectées par une atteinte à la confidentialité des données ?",null,null,"Recommandé","Recommandé","BizOps","Les conséquences d’un incident affectant la confidentialité des données peuvent être réduites grâce à l’information rapide des parties concernées, à savoir les clients dont les données ont été perdues. Des instructions claires doivent leur être données concernant les mesures à prendre (ex. changement des codes confidentiels en cas de divulgation de ceux-ci).",null,"8","8.1","8.1.1",null,"8.1.1.8",null,0,"8.1.1.8.4","¿Se implementó un proceso para determinar la asistencia para reparación y protección que se debe ofrecer a las personas o entidades afectadas por las violaciones a la privacidad de los datos?",null,null,"Recomendado","Recomendado","BizOps",null,null,"8","8.1","8.1.1",null,"8.1.1.8",null,0,"8.1.1.8.4",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"8.1.1.7.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP8","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",{"$f":"COUNTIF($DS21:$DV21,EH$3)","v":0},0,0,0,0,1,""]
[null,"8","8.1","8.1.1",0,"8.1.1.9",{"$f":"AZ22&\": \"&CHOOSE(LanguageNumber,BA22,BR22,CH22,CX22)","v":"8.1.1.9: DE-IDENTIFYING AND ANONYMISING PERSONAL DATA\nWhenever possible, providers should de-identify or anonymise personal data when full data records are not necessary, such as when performing certain types of research, analysing resource requirements, examining correlations and trends, and/or conducting system or application testing. \n\n\"De-identify\" means to remove, obscure, mask or obfuscate enough personal data from a record such that an individual can not be identified. De-identified information can be aggregated for the purposes of statistical analysis, such as making comparisons, analysing trends, or identifying patterns. De-identified information can be re-identified by using a code, algorithm, or pseudonym that is assigned to individual records.\n\n\"Anonymise\" means to take de-identified information and destroy any code or other association that would allow re-identification. Anonymising information usually involves the application of statistical disclosure limitation techniques to ensure that the data cannot be re-identified. Not all data can be readily anonymised (for example, biometric data)."},"NIST 4.2.3","8.1.1.9.1","8.1.1.9.1: Is personal data de-identified or anonymised when full data records are not necessary, such as when performing certain types of research, analysing resource requirements, examining correlations and trends, and conducting system testing?\n",0,0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8","8.1","8.1.1",null,"8.1.1.9","DE-IDENTIFYING AND ANONYMISING PERSONAL DATA\nWhenever possible, providers should de-identify or anonymise personal data when full data records are not necessary, such as when performing certain types of research, analysing resource requirements, examining correlations and trends, and/or conducting system or application testing. \n\n\"De-identify\" means to remove, obscure, mask or obfuscate enough personal data from a record such that an individual can not be identified. De-identified information can be aggregated for the purposes of statistical analysis, such as making comparisons, analysing trends, or identifying patterns. De-identified information can be re-identified by using a code, algorithm, or pseudonym that is assigned to individual records.\n\n\"Anonymise\" means to take de-identified information and destroy any code or other association that would allow re-identification. Anonymising information usually involves the application of statistical disclosure limitation techniques to ensure that the data cannot be re-identified. Not all data can be readily anonymised (for example, biometric data).","NIST 4.2.3","8.1.1.9.1","8.1.1.9.1","Is personal data de-identified or anonymised when full data records are not necessary, such as when performing certain types of research, analysing resource requirements, examining correlations and trends, and conducting system testing?",null,null,"Recommended","Recommended","BizOps",null,null,"8","8.1","8.1.1",0,"8.1.1.9","DÉPERSONNALISATION ET ANONYMISATION DES DONNÉES À CARACTÈRE PERSONNEL\nDans la mesure du possible, les prestataires doivent dépersonnaliser ou rendre anonymes les données à caractère personnel lorsque les renseignements complets ne sont pas nécessaires, pour la réalisation par exemple de certaines études, l’analyse des besoins en ressources, l’examen des corrélations et tendances et/ou la réalisation de tests du système ou de l’application. \n\nLa « dépersonnalisation » consiste à supprimer, masquer ou brouiller suffisamment de données personnelles dans un fichier pour empêcher l’identification des personnes concernées. Les informations dépersonnalisées peuvent être agrégées à des fins d’analyses statistiques, pour effectuer par exemple des comparaisons, analyser des tendances ou identifier des comportements. Les informations dépersonnalisées peuvent être ré-identifiées au moyen d’un code, d’un algorithme ou d’un pseudonyme affecté à ligne de données individuelles.\n\nL’« anonymisation » consiste à prendre des informations dépersonnalisées et à détruire tout code ou autre association qui permettraient de les ré-identifier. Cette anonymisation des informations passe généralement par l’application de méthodes statistiques de limitation de la divulgation pour garantir que les données ne puissent pas être ré-identifiées. Elle peut être difficile à réaliser pour certains types de données (biométriques par exemple).","NIST 4.2.3","8.1.1.9.1","les données à caractère personnel sont-elles dépersonnalisées ou rendues anonymes lorsque les renseignements complets ne sont pas nécessaires, pour la réalisation par exemple de certaines études, l’analyse des besoins en ressources, l’examen des corrélations et tendances et/ou la réalisation de tests du système ?",null,null,"Recommandé","Recommandé","BizOps",0,null,"8","8.1","8.1.1",null,"8.1.1.9","DESIDENTIFICACIÓN Y ANONIMIZACIÓN DE DATOS PERSONALES\nSiempre que sea posible, los proveedores deben  eliminar la identificación o anonimizar los datos personales, cuando no sea necesario contar con registros de datos completos, como por ejemplo cuando se realizan ciertos tipos de búsquedas, se analizan requisitos de recursos, se examinan correlaciones y tendencias, y/o se realizan pruebas del sistema o la aplicación. \n\nLa \"desidentificación\" significa eliminar, ocultar, esconder o disimular suficientes datos personales de un registro como para que no se pueda identificar a la persona. La información sin identificación puede ser consolidada para los fines de análisis estadístico, como para hacer comparaciones, analizar tendencias o identificar patrones. La información sin identificación puede ser identificada nuevamente utilizando un código, algoritmo o pseudónimo asignado a los registros individuales.\n\n\"Anonimizar\" significa tomar la información sin identificación y destruir todos los códigos o cualquier otra asociación que permita volver a identificarla. Anonimizar la información generalmente involucra la aplicación de técnicas de limitación de divulgación estadística para garantizar que los datos no puedan ser nuevamente identificados. No todos los datos pueden ser fácilmente anonimizados (por ejemplo, los datos biométricos).","NIST 4.2.3","8.1.1.9.1","¿Se elimina la identificación o anonimizan los datos personales cuando no es necesario contar con registros de datos completos, como por ejemplo cuando se realizan ciertos tipos de búsquedas, se analizan requisitos de recursos, se examinan correlaciones y tendencias, y/o se realizan pruebas del sistema?",null,null,"Recomendado","Recomendado","BizOps",null,null,"8","8.1","8.1.1",null,"8.1.1.9",null,"NIST 4.2.3","8.1.1.9.1",null,null,null,"Rec4","Rec4","BizOps",null,null,null,null,null,null,null,null,"8.1.1.9.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP8","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"8",0,0,{"$f":"UPPER(CONCATENATE(Introduction!C34,\": \",Introduction!D34))","v":"8.2: DATA PRIVACY TRANSPARENCY"},null,null,0,0,{"$f":"CHOOSE(LanguageNumber,BE23,BU23,CK23,DA23)","v":"Providers shall ensure that users are provided with clear, prominent, and timely information regarding their data privacy practices"},null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,BK23,CA23,CQ23,DG23)","v":0},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8",null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$34,\": \",Introduction!$L$34))","v":"8.2: DATA PRIVACY TRANSPARENCY"},null,null,null,null,0,{"$f":"Introduction!$M$34","v":"Providers shall ensure that users are provided with clear, prominent, and timely information regarding their data privacy practices"},null,null,null,null,0,null,null,"8",0,0,null,0,null,0,0,{"$f":"Introduction!$R$34","v":"Les prestataires doivent veiller à ce que des informations claires, visibles et opportunes soient fournies aux clients sur les pratiques de protection de leurs données personnelles."},null,null,null,null,0,null,null,"8",0,0,{"$f":"UPPER(CONCATENATE(Introduction!$U$34,\": \",Introduction!$V$34))","v":"8.2: TRANSPARENCIA DE LA PRIVACIDAD DE DATOS"},null,null,0,0,{"$f":"Introduction!W34","v":"El proveedor garantizará la provisión de información clara, visible y oportuna al usuario respecto de las prácticas de privacidad de datos"},null,null,null,null,0,null,null,"8",0,0,null,0,null,0,0,{"$f":"Introduction!AB34","v":0},null,null,{"$f":"$BJ23","v":0},0,0]
[null,"8","8.2","8.2.1",{"$f":"CHOOSE(LanguageNumber,AY24,BP24,CF24,CV24)","v":"8.2.1: Providers shall ensure that users are provided with clear, prominent, and timely information regarding their data privacy practices."},"8.2.1.1",{"$f":"AZ24&\": \"&CHOOSE(LanguageNumber,BA24,BR24,CH24,CX24)","v":"8.2.1.1: TRANSPARENCY REGARDING DATA PRIVACY PRACTICES\nProviders should publish a statement of their commitment to data privacy. In particular the statement should make clear that data will be kept secure and not shared with third parties unless  explicitly agreed with the customer.\n\nThe statement could be published in the T&Cs, on posters, on handouts, or via the website.\n\nIn addition, it is good practice for providers to publish a summary of their data privacy practices available to customers, along with official address and contact details for customers interested in obtaining additional information. The summary could include:\n- the personal data required;\n- the purpose for personal data collection (e.g. to assess eligibility for other financial or non-financial services, for legal compliance, etc.);\n- the personal data retention and disposal policy.\n"},"NIST Appendix D\nISO 29100:2011 5.8\nISO 29100:2011 4.6","8.2.1.1.1",{"$f":"BC24&\": \"&CHOOSE(LanguageNumber,BE24,BU24,CK24,DA24)&CarriageReturn","v":"8.2.1.1.1: Is a statement of the provider's commitment to data privacy practices made available to customers (e.g. in the T&Cs, on posters, on handouts, or via the website)?\n"},{"$f":"CHOOSE(LanguageNumber,BF24,BV24,CL24,DB24)","v":0},{"$f":"CHOOSE(LanguageNumber,BG24,BW24,CM24,DC24)","v":0},{"$f":"CHOOSE(LanguageNumber,BH24,BX24,CN24,DD24)","v":"Recommended"},"Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8","8.2","8.2.1","8.2.1: Providers shall ensure that users are provided with clear, prominent, and timely information regarding their data privacy practices.","8.2.1.1","TRANSPARENCY REGARDING DATA PRIVACY PRACTICES\nProviders should publish a statement of their commitment to data privacy. In particular the statement should make clear that data will be kept secure and not shared with third parties unless  explicitly agreed with the customer.\n\nThe statement could be published in the T&Cs, on posters, on handouts, or via the website.\n\nIn addition, it is good practice for providers to publish a summary of their data privacy practices available to customers, along with official address and contact details for customers interested in obtaining additional information. The summary could include:\n- the personal data required;\n- the purpose for personal data collection (e.g. to assess eligibility for other financial or non-financial services, for legal compliance, etc.);\n- the personal data retention and disposal policy.\n","NIST Appendix D\nISO 29100:2011 5.8\nISO 29100:2011 4.6","8.2.1.1.1","8.2.1.1.1","Is a statement of the provider's commitment to data privacy practices made available to customers (e.g. in the T&Cs, on posters, on handouts, or via the website)?",null,null,"Recommended","Recommended","BizOps",null,null,"8","8.2","8.2.1","8.2.1: Les prestataires doivent veiller à ce que des informations claires, visibles et opportunes soient fournies aux clients sur les pratiques de protection de leurs données personnelles","8.2.1.1","TRANSPARENCE DES PRATIQUES EN MATIÈRE DE CONFIDENTIALITÉ DES DONNÉES\nLes prestataires doivent mettre à disposition des clients une synthèse de leurs pratiques en matière de confidentialité des données, en y incluant l’adresses officielle et les coordonnées auxquelles les clients qui le souhaitent peuvent obtenir des informations supplémentaires. \n\nDans cette synthèse de leurs pratiques en matière de confidentialité des données, les prestataires doivent décrire leurs pratiques de traitement des données à caractère personnel avec suffisamment de détail pour permettre au client de comprendre : \n- les données à caractère personnel demandées ;\n- la raison pour laquelle ces données sont collectées (ex. vérification des critères d’accès  à d’autres services financiers ou non financiers, respect des obligations légales, etc.) ; \n- que sauf accord exprès du client, ses données personnelles ne seront pas communiquées à des tiers ;\n- la politique de conservation et de suppression des données à caractère personnel.\n\nLa synthèse des pratiques relatives à la confidentialité des données doit figurer dans les conditions générales d’utilisation (CGU) du service, dans un menu téléphonique ou sous toute autre forme facilement accessible aux clients.\n","NIST Appendix D\nISO 29100:2011 5.8\nISO 29100:2011 4.6","8.2.1.1.1","une synthèse des pratiques du prestataire en matière de confidentialité des données est-elle à la disposition des clients (dans les CU par exemple) ?",null,null,{"$f":"VLOOKUP($BH24,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},{"$f":"VLOOKUP($BI24,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},"BizOps",0,null,"8","8.2","8.2.1","8.2.1: Los proveedores deben garantizar que los usuarios reciban información clara, importante y oportuna respecto de las prácticas de privacidad de sus datos","8.2.1.1","TRANSPARENCIA RESPECTO DE LAS PRÁCTICAS DE PRIVACIDAD DE LOS DATOS\nLos proveedores deben publicar una declaración de su compromiso con la privacidad de los datos. En particular, la declaración debe dejar en claro que los datos se mantendrán seguros y no serán compartidos con terceros, salvo sea explícitamente acordado con el cliente.\n\nLa declaración podría ser publicada en los Términos y Condiciones, carteles, folletos o en el sitio web.\n\nAdemás, es una buena práctica que los proveedores publiquen un resumen de sus prácticas de privacidad de los datos que esté disponible para los clientes, junto con el domicilio oficial y los detalles de contacto para los clientes interesados en obtener más información. El resumen podría incluir:\n- los datos personales requeridos;\n- el fin de la recolección de los datos personales (por ej., para evaluar la elegibilidad para otros servicios financieros o no financieros, cumplimiento legal, etc.);\n- la política de retención y eliminación de los datos personales.\n","NIST Appendix D\nISO 29100:2011 5.8\nISO 29100:2011 4.6","8.2.1.1.1","¿Se encuentra a disposición de los clientes una declaración del compromiso del proveedor con las prácticas de privacidad de los datos (por ej., en los Términos y Condiciones, carteles, folletos o en el sitio web)?",null,null,"Rec3","Rec3","BizOps",null,null,"8","8.2","8.2.1",null,"8.2.1.1",null,"NIST Appendix D\nISO 29100:2011 5.8\nISO 29100:2011 4.6","8.2.1.1.1",null,null,null,{"$f":"VLOOKUP($BH24,CategoryTranslationTable,4,FALSE)","v":"Rec4"},{"$f":"VLOOKUP($BI24,CategoryTranslationTable,4,FALSE)","v":"Rec4"},"BizOps",null,null,null,null,null,null,null,null,"8.2.1.1.1",null,null,null,{"$f":"IF(OR($EA24=0,$EA24=2),VLOOKUP(DO24,INDIRECT(ED24),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP24),\"\",VLOOKUP(DP24,INDIRECT(EE24),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ24),\"\",VLOOKUP(DQ24,INDIRECT(EF24),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR24),\"\",VLOOKUP(DR24,INDIRECT(EG24),7,FALSE))","v":""},{"$f":"IF(OR($EA24=0,$EA24=2),VLOOKUP(DO24,INDIRECT(ED24),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP24),\"\",VLOOKUP(DP24,INDIRECT(EE24),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ24),\"\",VLOOKUP(DQ24,INDIRECT(EF24),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR24),\"\",VLOOKUP(DR24,INDIRECT(EG24),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN24,3)=\"NEW\")+2*AND(LEFT(DN24,3)=\"MER\")+3*AND(LEFT(DN24,3)=\"MOV\")+4*AND(LEFT(DN24,3)=\"SWA\")","v":0},{"$error":"#REF!"},{"$f":"IF(EA24=0,IF(DW24=0,\"\",DW24),CHOOSE(EA24,\"New indicator\",CONCATENATE(DW24,CarriageReturn,DX24,CarriageReturn,DY24,CarriageReturn,DZ24)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO24,1)","v":"OriginalComplianceP8"},{"$f":"\"OriginalComplianceP\"&LEFT(DP24,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ24,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR24,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,""]
[null,"8","8.2","8.2.1",0,"8.2.1.1",null,0,"8.2.1.1.2",{"$f":"BC25&\": \"&CHOOSE(LanguageNumber,BE25,BU25,CK25,DA25)&CarriageReturn","v":"8.2.1.1.2: Does the summary of data privacy practices inform customers of the personal data required from them?\n"},{"$f":"CHOOSE(LanguageNumber,BF25,BV25,CL25,DB25)","v":0},0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8","8.2","8.2.1",null,"8.2.1.1",null,null,"8.2.1.1.2","8.2.1.1.2","Does the summary of data privacy practices inform customers of the personal data required from them?",null,null,"Recommended","Recommended","BizOps",null,null,"8","8.2","8.2.1",0,"8.2.1.1",null,0,"8.2.1.1.2","est-ce que la synthèse des pratiques relatives à la confidentialité des données précise les données à caractère personnel demandées aux clients ?",null,null,{"$f":"VLOOKUP($BH25,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},{"$f":"VLOOKUP($BI25,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},"BizOps",0,null,"8","8.2","8.2.1",null,"8.2.1.1",null,0,"8.2.1.1.2","¿El resumen de las prácticas de privacidad de los datos informa a los clientes los datos personales requeridos?",null,null,"Rec3","Rec3","BizOps",null,null,"8","8.2","8.2.1",null,"8.2.1.1",null,0,"8.2.1.1.2",null,null,null,{"$f":"VLOOKUP($BH25,CategoryTranslationTable,4,FALSE)","v":"Rec4"},{"$f":"VLOOKUP($BI25,CategoryTranslationTable,4,FALSE)","v":"Rec4"},"BizOps",null,null,null,null,null,null,null,null,"8.2.1.1.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP8","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"8","8.2","8.2.1",0,"8.2.1.1",null,0,"8.2.1.1.3",{"$f":"BC26&\": \"&CHOOSE(LanguageNumber,BE26,BU26,CK26,DA26)&CarriageReturn","v":"8.2.1.1.3: Does the summary of data privacy practices inform customers of the purpose for collecting personal data from them?\n"},{"$f":"CHOOSE(LanguageNumber,BF26,BV26,CL26,DB26)","v":0},0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8","8.2","8.2.1",null,"8.2.1.1",null,null,"8.2.1.1.3","8.2.1.1.3","Does the summary of data privacy practices inform customers of the purpose for collecting personal data from them?",null,null,"Recommended","Recommended","BizOps",null,null,"8","8.2","8.2.1",0,"8.2.1.1",null,0,"8.2.1.1.3","est-ce que la synthèse des pratiques relatives à la confidentialité des données précise les raisons pour lesquelles ces données à caractère personnel sont demandées aux clients ?",null,null,{"$f":"VLOOKUP($BH26,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},{"$f":"VLOOKUP($BI26,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},"BizOps",0,null,"8","8.2","8.2.1",null,"8.2.1.1",null,0,"8.2.1.1.3","¿El resumen de las prácticas de privacidad de los datos informa a los clientes el fin de la recolección de los datos personales?",null,null,"Rec3","Rec3","BizOps",null,null,"8","8.2","8.2.1",null,"8.2.1.1",null,0,"8.2.1.1.3",null,null,null,{"$f":"VLOOKUP($BH26,CategoryTranslationTable,4,FALSE)","v":"Rec4"},{"$f":"VLOOKUP($BI26,CategoryTranslationTable,4,FALSE)","v":"Rec4"},"BizOps",null,null,null,null,null,null,null,null,"8.2.1.1.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP8","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"8","8.2","8.2.1",0,"8.2.1.1",null,0,"8.2.1.1.4",{"$f":"BC27&\": \"&CHOOSE(LanguageNumber,BE27,BU27,CK27,DA27)&CarriageReturn","v":"8.2.1.1.4: Does the summary of data privacy practices make it clear that data will not be shared with third parties unless explicitly agreed with the customer?\n"},{"$f":"CHOOSE(LanguageNumber,BF27,BV27,CL27,DB27)","v":0},0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8","8.2","8.2.1",null,"8.2.1.1",null,null,"8.2.1.1.4","8.2.1.1.4","Does the summary of data privacy practices make it clear that data will not be shared with third parties unless explicitly agreed with the customer?",null,null,"Recommended","Recommended","BizOps",null,null,"8","8.2","8.2.1",0,"8.2.1.1",null,0,"8.2.1.1.4","est-ce que la synthèse des pratiques relatives à la confidentialité des données précise que sauf accord exprès du client, ces données ne seront pas partagées avec des tiers ?",null,null,{"$f":"VLOOKUP($BH27,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},{"$f":"VLOOKUP($BI27,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},"BizOps",0,null,"8","8.2","8.2.1",null,"8.2.1.1",null,0,"8.2.1.1.4","¿El resumen de las prácticas de privacidad de los datos deja en claro que los datos no serán compartidos con terceros salvo sea explícitamente acordado con el cliente?",null,null,"Rec3","Rec3","BizOps",null,null,"8","8.2","8.2.1",null,"8.2.1.1",null,0,"8.2.1.1.4",null,null,null,{"$f":"VLOOKUP($BH27,CategoryTranslationTable,4,FALSE)","v":"Rec4"},{"$f":"VLOOKUP($BI27,CategoryTranslationTable,4,FALSE)","v":"Rec4"},"BizOps",null,null,null,null,null,null,null,null,"8.2.1.1.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP8","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"8",0,0,{"$f":"UPPER(CONCATENATE(Introduction!C35,\": \",Introduction!D35))","v":"8.3: CUSTOMERS' CONTROL OF THEIR PERSONAL DATA"},null,null,0,0,{"$f":"CHOOSE(LanguageNumber,BE28,BU28,CK28,DA28)","v":"Providers shall ensure that customers are informed of their rights and have control over the use of their personal information"},null,null,null,null,null,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8",null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$35,\": \",Introduction!$L$35))","v":"8.3: CUSTOMERS' CONTROL OF THEIR PERSONAL DATA"},null,null,null,null,0,{"$f":"Introduction!$M$35","v":"Providers shall ensure that customers are informed of their rights and have control over the use of their personal information"},null,null,null,null,0,null,null,"8",0,0,null,0,null,0,0,{"$f":"Introduction!R35","v":"Les prestataires doivent veiller à ce que les clients soient informés de leurs droits et qu’ils aient la possibilité d’exercer un véritable choix et contrôle sur les informations les concernant."},null,null,null,null,0,null,null,"8",0,0,{"$f":"UPPER(CONCATENATE(Introduction!$K$35,\": \",Introduction!$L$35))","v":"8.3: CUSTOMERS' CONTROL OF THEIR PERSONAL DATA"},null,null,0,0,{"$f":"Introduction!W35","v":"El proveedor garantizará que el cliente está informado sobre sus derechos y tiene control sobre el uso de su información personal"},null,null,null,null,null,null,null,"8",0,0,null,0,null,0,0,{"$f":"Introduction!AB35","v":0},null,null,0,0,0]
[null,"8","8.3","8.3.1",{"$f":"CHOOSE(LanguageNumber,AY29,BP29,CF29,CV29)","v":"8.3.1: Providers shall ensure that customers are informed of their rights and have opportunities to exercise meaningful choice and control over their personal information."},"8.3.1.1",{"$f":"AZ29&\": \"&CHOOSE(LanguageNumber,BA29,BR29,CH29,CX29)","v":"8.3.1.1: CUSTOMER CHOICE AND CONTROL OVER PROCESSING OF PERSONAL DATA\nProviders should offer customers choice and control over how their personal data is handled. Some personal data (e.g., data required for KYC purposes) must be provided and processed in order to use the service. However, for use of personal data that is not essential to the provision of the service (e.g. marketing messages), providers should (1) obtain opt-in consent for this use of the personal data; and (2) allow a customer to withdraw consent easily and free of charge.\n\nEven if consent is withdrawn, the provider might need to retain certain personal data for a period of time in order to comply with legal and/or contractual obligations (e.g. data retention, accountability). The customer should be informed that their data may be used or shared in accordance with such legal and/or contractual obligations."},"ISO 29100:2011, 5.2","8.3.1.1.1",{"$f":"BC29&\": \"&CHOOSE(LanguageNumber,BE29,BU29,CK29,DA29)&CarriageReturn","v":"8.3.1.1.1: For the use of personal data that is not essential to the provision of the mobile money service (e.g. marketing messages), does the provider (1) obtain opt-in consent from customers, and (2) allow a customer to withdraw consent easily and free of charge?\n"},{"$f":"CHOOSE(LanguageNumber,BF29,BV29,CL29,DB29)","v":0},0,{"$f":"CHOOSE(LanguageNumber,BH29,BX29,CN29,DD29)","v":"Recommended"},"Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8","8.3","8.3.1","8.3.1: Providers shall ensure that customers are informed of their rights and have opportunities to exercise meaningful choice and control over their personal information.","8.3.1.1","CUSTOMER CHOICE AND CONTROL OVER PROCESSING OF PERSONAL DATA\nProviders should offer customers choice and control over how their personal data is handled. Some personal data (e.g., data required for KYC purposes) must be provided and processed in order to use the service. However, for use of personal data that is not essential to the provision of the service (e.g. marketing messages), providers should (1) obtain opt-in consent for this use of the personal data; and (2) allow a customer to withdraw consent easily and free of charge.\n\nEven if consent is withdrawn, the provider might need to retain certain personal data for a period of time in order to comply with legal and/or contractual obligations (e.g. data retention, accountability). The customer should be informed that their data may be used or shared in accordance with such legal and/or contractual obligations.","ISO 29100:2011, 5.2","8.3.1.1.1","8.3.1.1.1","For the use of personal data that is not essential to the provision of the mobile money service (e.g. marketing messages), does the provider (1) obtain opt-in consent from customers, and (2) allow a customer to withdraw consent easily and free of charge?",null,null,"Recommended","Recommended","BizOps",null,null,"8","8.3","8.3.1","8.3.1: Les prestataires doivent veiller à ce que les clients soient informés de leurs droits et qu’ils aient la possibilité d’exercer un véritable choix et contrôle sur les informations les concernant","8.3.1.1","CHOIX ET CONTRÔLE DES CLIENTS SUR LE TRAITEMENT DE LEURS DONNÉES PERSONNELLES \nLes prestataires doivent permettre aux clients de faire des choix et d’exercer un contrôle sur la manière dont leurs données personnelles sont utilisées. Certaines données à caractère personnel (ex. les renseignements demandés pour l’identification des clients) doivent être fournies et traitées pour pouvoir utiliser le service. Toutefois, pour ce qui est de l’utilisation de données à caractère personnel à des fins non essentielles à la prestation de service (ex. communications marketing), les prestataires doivent (1) obtenir l’accord exprès des clients à cette utilisation de leurs données personnelles (cf. note explicative) et (2) permettre aux clients de retirer leur consentement facilement et gratuitement. \n\nSi un client retire son consentement, le prestataire peut avoir besoin de conserver certaines données à caractère personnel pendant un certain temps pour se conformer à des obligations légales et/ou contractuelles (ex. conservation des données, responsabilité). Le client doit être informé que ses données peuvent être utilisées ou partagées conformément à ces obligations légales et/ou contractuelles.\n","ISO 29100:2011, 5.2","8.3.1.1.1","concernant l’utilisation de données à caractère personnel à des fins non essentielles à la prestation du service d'argent mobile (ex. communications marketing), le prestataire (1) obtient-il l’accord exprès des clients à cette utilisation de leurs données personnelles (cf. note explicative) et (2) leur permet-il de retirer leur consentement facilement et gratuitement ?",null,null,{"$f":"VLOOKUP($BH29,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},{"$f":"VLOOKUP($BI29,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},"BizOps","L'autorisation expresse des messages marketing peut être proposée aux clients lors de l'activation de leur compte, en leur demandant de cliquer pour accepter ou refuser.",null,"8","8.3","8.3.1","8.3.1: Los proveedores deben garantizar que se informen a los clientes sus derechos y que tengan oportunidades de elección y control significativo sobre su información personal","8.3.1.1","ELECCIÓN Y CONTROL DEL CLIENTE SOBRE EL PROCESAMIENTO DE DATOS PERSONALES\nLos proveedores deben ofrecer a los clientes elección y control sobre cómo se manejan sus datos personales. Algunos datos personales (por ej., los datos requeridos para fines de registros de conocimiento del cliente - CSC) deben ser proporcionados y procesados para poder utilizar el servicio. No obstante, en el uso de datos personales no esenciales para la prestación del servicio (por ej., mensajes de marketing), los proveedores deben (1) obtener el consentimiento para usar estos datos personales; y (2) permitir al cliente que retire el consentimiento fácilmente y sin cargo alguno.\n\nIncluso si se retira el consentimiento, el proveedor podría necesitar retener ciertos datos personales durante un período de tiempo a fin de cumplir con las obligaciones legales y/o contractuales (por ej., retención de datos, responsabilidad). Se debe informar al cliente que sus datos podrían ser utilizados o compartidos de conformidad con dichas obligaciones legales y/o contractuales.","ISO 29100:2011, 5.2","8.3.1.1.1","En el uso de datos personales no esenciales para la prestación del servicio (por ej., mensajes de marketing), ¿el proveedor (1) obtiene el consentimiento de los clientes; y (2) permite al cliente retirar el consentimiento fácilmente y sin cargo alguno?",null,null,"Rec3","Rec3","BizOps",null,null,"8","8.3","8.3.1",null,"8.3.1.1",null,"ISO 29100:2011, 5.2","8.3.1.1.1",null,null,null,{"$f":"VLOOKUP($BH29,CategoryTranslationTable,4,FALSE)","v":"Rec4"},{"$f":"VLOOKUP($BI29,CategoryTranslationTable,4,FALSE)","v":"Rec4"},"BizOps",null,null,null,null,null,null,null,null,"8.3.1.1.1",null,null,null,{"$f":"IF(OR($EA29=0,$EA29=2),VLOOKUP(DO29,INDIRECT(ED29),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP29),\"\",VLOOKUP(DP29,INDIRECT(EE29),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ29),\"\",VLOOKUP(DQ29,INDIRECT(EF29),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR29),\"\",VLOOKUP(DR29,INDIRECT(EG29),7,FALSE))","v":""},{"$f":"IF(OR($EA29=0,$EA29=2),VLOOKUP(DO29,INDIRECT(ED29),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP29),\"\",VLOOKUP(DP29,INDIRECT(EE29),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ29),\"\",VLOOKUP(DQ29,INDIRECT(EF29),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR29),\"\",VLOOKUP(DR29,INDIRECT(EG29),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN29,3)=\"NEW\")+2*AND(LEFT(DN29,3)=\"MER\")+3*AND(LEFT(DN29,3)=\"MOV\")+4*AND(LEFT(DN29,3)=\"SWA\")","v":0},{"$error":"#REF!"},{"$f":"IF(EA29=0,IF(DW29=0,\"\",DW29),CHOOSE(EA29,\"New indicator\",CONCATENATE(DW29,CarriageReturn,DX29,CarriageReturn,DY29,CarriageReturn,DZ29)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO29,1)","v":"OriginalComplianceP8"},{"$f":"\"OriginalComplianceP\"&LEFT(DP29,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ29,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR29,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,""]
[null,"8","8.3","8.3.1",0,"8.3.1.2",{"$f":"AZ30&\": \"&CHOOSE(LanguageNumber,BA30,BR30,CH30,CX30)","v":"8.3.1.2: CUSTOMER RIGHTS TO REVIEW PERSONAL DATA\nProviders should grant customers the right to: \n- access and review their personal data (subject to proper verification of their identity);\n- challenge the accuracy and completeness of their personal data and have it amended or removed as appropriate; and \n- ensure that any amendment or removal is communicated to third parties to whom personal data has been disclosed.  \n\nCustomers should be informed of how they can access, review and request updates to their personal data.\n\nNOTE:  While this Practice applies to all mobile money services, customers may be particularly interested in reviewing personal data that is used to assess creditworthiness."},"ISO 29100:2011, 5.9","8.3.1.2.1",{"$f":"BC30&\": \"&CHOOSE(LanguageNumber,BE30,BU30,CK30,DA30)&CarriageReturn","v":"8.3.1.2.1: Can customers access and review their personal data?\n"},{"$f":"CHOOSE(LanguageNumber,BF30,BV30,CL30,DB30)","v":0},0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8","8.3","8.3.1",null,"8.3.1.2","CUSTOMER RIGHTS TO REVIEW PERSONAL DATA\nProviders should grant customers the right to: \n- access and review their personal data (subject to proper verification of their identity);\n- challenge the accuracy and completeness of their personal data and have it amended or removed as appropriate; and \n- ensure that any amendment or removal is communicated to third parties to whom personal data has been disclosed.  \n\nCustomers should be informed of how they can access, review and request updates to their personal data.\n\nNOTE:  While this Practice applies to all mobile money services, customers may be particularly interested in reviewing personal data that is used to assess creditworthiness.","ISO 29100:2011, 5.9","8.3.1.2.1","8.3.1.2.1","Can customers access and review their personal data?",null,null,"Recommended","Recommended","BizOps",null,null,"8","8.3","8.3.1",0,"8.3.1.2","DROIT D’ACCÈS DES CLIENTS À LEURS DONNÉES PERSONNELLES \nLes prestataires doivent accorder aux clients le droit de : \n- consulter et vérifier leurs données personnelles (sous réserve de vérification appropriée de leur identité) ; \n- contester l’exactitude ou l’exhaustivité de leurs données personnelles et en demander la modification ou la suppression le cas échéant ; \n- obtenir la garantie que toute modification ou suppression est communiquée aux tierces parties ayant eu communication des données personnelles en question. \n\nLes clients doivent être informés de la manière dont il peuvent consulter et vérifier leurs données personnelles et en demander la mise à jour. \n\nREMARQUE : bien que cette Pratique s’applique à tous les services d’argent mobile, les clients peuvent avoir un intérêt particulier à vérifier les données utilisées pour évaluer leur solvabilité. \n","ISO 29100:2011, 5.9","8.3.1.2.1","les clients ont-ils la possibilité de consulter et vérifier leurs données personnelles ?",null,null,{"$f":"VLOOKUP($BH30,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},{"$f":"VLOOKUP($BI30,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},"BizOps",0,null,"8","8.3","8.3.1",null,"8.3.1.2","DERECHOS DE LOS CLIENTES A REVISAR LOS DATOS PERSONALES\nLos proveedores deben otorgar a los clientes el derecho a: \n- acceder y revisar sus datos personales (sujeto a la adecuada verificación de identidad);\n- cuestionar la precisión e integridad de sus datos personales y procurar la modificación o eliminación, según corresponda; y \n- garantizar que toda modificación o eliminación sea comunicada a los terceros a quienes se hayan divulgado los datos personales.  \n\nSe debe informar a los clientes cómo pueden acceder, revisar y solicitar actualizaciones de sus datos personales.\n\nNOTA:  Si bien esta práctica aplica a todos los servicios del dinero móvil, los clientes pueden estar particularmente interesados en revisar los datos personales utilizados para evaluar la capacidad de pago.","ISO 29100:2011, 5.9","8.3.1.2.1","¿Pueden los clientes acceder a sus datos personales y revisarlos?",null,null,"Rec3","Rec3","BizOps",null,null,"8","8.3","8.3.1",null,"8.3.1.2",null,"ISO 29100:2011, 5.9","8.3.1.2.1",null,null,null,{"$f":"VLOOKUP($BH30,CategoryTranslationTable,4,FALSE)","v":"Rec4"},{"$f":"VLOOKUP($BI30,CategoryTranslationTable,4,FALSE)","v":"Rec4"},"BizOps",null,null,null,null,null,null,null,null,"8.3.1.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP8","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"8","8.3","8.3.1",0,"8.3.1.2",null,0,"8.3.1.2.2",{"$f":"BC31&\": \"&CHOOSE(LanguageNumber,BE31,BU31,CK31,DA31)&CarriageReturn","v":"8.3.1.2.2: Can customers challenge the accuracy and completeness of the personal data and have it amended or removed?\n"},{"$f":"CHOOSE(LanguageNumber,BF31,BV31,CL31,DB31)","v":0},0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8","8.3","8.3.1",null,"8.3.1.2",null,null,"8.3.1.2.2","8.3.1.2.2","Can customers challenge the accuracy and completeness of the personal data and have it amended or removed?",null,null,"Recommended","Recommended","BizOps",null,null,"8","8.3","8.3.1",0,"8.3.1.2",null,0,"8.3.1.2.2","les clients ont-ils la possibilité de contester l’exactitude ou l’exhaustivité de leurs données personnelles et d'en demander la modification ou la suppression ?",null,null,{"$f":"VLOOKUP($BH31,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},{"$f":"VLOOKUP($BI31,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},"BizOps",0,null,"8","8.3","8.3.1",null,"8.3.1.2",null,0,"8.3.1.2.2","¿Los clientes pueden cuestionar la precisión e integridad de los datos personales y procurar su modificación o eliminación?",null,null,"Rec3","Rec3","BizOps",null,null,"8","8.3","8.3.1",null,"8.3.1.2",null,0,"8.3.1.2.2",null,null,null,{"$f":"VLOOKUP($BH31,CategoryTranslationTable,4,FALSE)","v":"Rec4"},{"$f":"VLOOKUP($BI31,CategoryTranslationTable,4,FALSE)","v":"Rec4"},"BizOps",null,null,null,null,null,null,null,null,"8.3.1.2.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP8","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"8","8.3","8.3.1",0,"8.3.1.2",null,0,"8.3.1.2.3",{"$f":"BC32&\": \"&CHOOSE(LanguageNumber,BE32,BU32,CK32,DA32)&CarriageReturn","v":"8.3.1.2.3: Are third parties to whom personal data has been disclosed also informed of any amendment or removal of the personal data?\n"},{"$f":"CHOOSE(LanguageNumber,BF32,BV32,CL32,DB32)","v":0},0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8","8.3","8.3.1",null,"8.3.1.2",null,null,"8.3.1.2.3","8.3.1.2.3","Are third parties to whom personal data has been disclosed also informed of any amendment or removal of the personal data?",null,null,"Recommended","Recommended","BizOps",null,null,"8","8.3","8.3.1",0,"8.3.1.2",null,0,"8.3.1.2.3","les tierces parties ayant eu communication de données personnelles sont-elles informées de toute modification ou annulation de ces données ?",null,null,{"$f":"VLOOKUP($BH32,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},{"$f":"VLOOKUP($BI32,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},"BizOps",0,null,"8","8.3","8.3.1",null,"8.3.1.2",null,0,"8.3.1.2.3","¿Se informa también a los terceros a quienes fueron divulgados los datos personales toda modificación o eliminación de dichos datos personales?",null,null,"Rec3","Rec3","BizOps",null,null,"8","8.3","8.3.1",null,"8.3.1.2",null,0,"8.3.1.2.3",null,null,null,{"$f":"VLOOKUP($BH32,CategoryTranslationTable,4,FALSE)","v":"Rec4"},{"$f":"VLOOKUP($BI32,CategoryTranslationTable,4,FALSE)","v":"Rec4"},"BizOps",null,null,null,null,null,null,null,null,"8.3.1.2.3",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP8","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"8","8.3","8.3.1",0,"8.3.1.2",null,0,"8.3.1.2.4",{"$f":"BC33&\": \"&CHOOSE(LanguageNumber,BE33,BU33,CK33,DA33)&CarriageReturn","v":"8.3.1.2.4: Are customers informed of how they can access, review and request updates to their personal data?\n"},{"$f":"CHOOSE(LanguageNumber,BF33,BV33,CL33,DB33)","v":0},0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8","8.3","8.3.1",null,"8.3.1.2",null,null,"8.3.1.2.4","8.3.1.2.4","Are customers informed of how they can access, review and request updates to their personal data?",null,null,"Recommended","Recommended","BizOps",null,null,"8","8.3","8.3.1",0,"8.3.1.2",null,0,"8.3.1.2.4","les clients sont-ils informés de la manière dont il peuvent consulter et vérifier leurs données personnelles et en demander la mise à jour ?",null,null,{"$f":"VLOOKUP($BH33,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},{"$f":"VLOOKUP($BI33,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},"BizOps",0,null,"8","8.3","8.3.1",null,"8.3.1.2",null,0,"8.3.1.2.4","¿Se informa a los clientes cómo pueden acceder, revisar y solicitar actualizaciones de sus datos personales?",null,null,"Rec3","Rec3","BizOps",null,null,"8","8.3","8.3.1",null,"8.3.1.2",null,0,"8.3.1.2.4",null,null,null,{"$f":"VLOOKUP($BH33,CategoryTranslationTable,4,FALSE)","v":"Rec4"},{"$f":"VLOOKUP($BI33,CategoryTranslationTable,4,FALSE)","v":"Rec4"},"BizOps",null,null,null,null,null,null,null,null,"8.3.1.2.4",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP8","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"8",0,0,{"$f":"UPPER(CONCATENATE(Introduction!C36,\": \",Introduction!D36))","v":"8.4: MINIMISATION OF PERSONAL DATA COLLECTION AND RETENTION"},null,null,0,0,{"$f":"CHOOSE(LanguageNumber,BE34,BU34,CK34,DA34)","v":"Providers shall limit the personal information that is collected from customers and is retained, used, or shared"},null,null,null,null,null,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8",null,null,{"$f":"UPPER(CONCATENATE(Introduction!$K$36,\": \",Introduction!$L$36))","v":"8.4: MINIMISATION OF PERSONAL DATA COLLECTION AND RETENTION"},null,null,null,null,0,{"$f":"Introduction!$M$36","v":"Providers shall limit the personal information that is collected from customers and is retained, used, or shared"},null,null,null,null,0,null,null,"8",0,0,null,0,null,0,0,{"$f":"Introduction!R36","v":"Les prestataires doivent limiter les informations personnelles collectées auprès des clients et conservées, utilisées ou partagées."},null,null,null,null,0,null,null,"8",0,0,{"$f":"UPPER(CONCATENATE(Introduction!$U$36,\": \",Introduction!$V$36))","v":"8.4: MINIMIZACIÓN DE RECOLECCIÓN Y RETENCIÓN DE DATOS PERSONALES"},null,null,0,0,{"$f":"Introduction!W36","v":"El proveedor limitará la cantidad de información recabada de los clientes y la forma en que la retiene, usa o comparte"},null,null,null,null,0,null,null,"8",0,0,null,0,null,0,0,{"$f":"Introduction!AB36","v":0},null,null,0,0,0]
[null,"8",8.4,"8.4.1",{"$f":"CHOOSE(LanguageNumber,AY35,BP35,CF35,CV35)","v":"8.4.1: Providers shall limit the personal information that is collected from customers and is retained, used, or shared."},"8.4.1.1",{"$f":"AZ35&\": \"&CHOOSE(LanguageNumber,BA35,BR35,CH35,CX35)","v":"8.4.1.1: LIMIT PERSONAL DATA COLLECTION\nProviders should not collect personal data indiscriminately. By limiting personal data collection to the minimum necessary, providers may limit potential negative consequences in the event of a data breach involving personal data. Both the type and amount of personal data collected should be limited to that which is necessary to fulfil the well-defined, legitimate purpose(s). \n\nProviders should carefully consider what personal data will be needed to realize a particular purpose before proceeding with the collection of personal data. They should document the type of personal data collected, as well as their justification for doing so as part of their information-handling policies and practices."},"ISO 29100:2011, 5.4","8.4.1.1.1",{"$f":"BC35&\": \"&CHOOSE(LanguageNumber,BE35,BU35,CK35,DA35)&CarriageReturn","v":"8.4.1.1.1: Is the amount and type of personal data collected limited to that which is required, and unnecessary data not collected?\n"},{"$f":"CHOOSE(LanguageNumber,BF35,BV35,CL35,DB35)","v":0},0,{"$f":"CHOOSE(LanguageNumber,BH35,BX35,CN35,DD35)","v":"Recommended"},"Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8",8.4,"8.4.1","8.4.1: Providers shall limit the personal information that is collected from customers and is retained, used, or shared.","8.4.1.1","LIMIT PERSONAL DATA COLLECTION\nProviders should not collect personal data indiscriminately. By limiting personal data collection to the minimum necessary, providers may limit potential negative consequences in the event of a data breach involving personal data. Both the type and amount of personal data collected should be limited to that which is necessary to fulfil the well-defined, legitimate purpose(s). \n\nProviders should carefully consider what personal data will be needed to realize a particular purpose before proceeding with the collection of personal data. They should document the type of personal data collected, as well as their justification for doing so as part of their information-handling policies and practices.","ISO 29100:2011, 5.4","8.4.1.1.1","8.4.1.1.1","Is the amount and type of personal data collected limited to that which is required, and unnecessary data not collected?",null,null,"Recommended","Recommended","BizOps",null,null,"8",8.4,"8.4.1","8.4.1: Les prestataires doivent limiter les informations personnelles collectées auprès des clients et conservées, utilisées ou partagées","8.4.1.1","LIMITER LA COLLECTE DE DONNÉES À CARACTÈRE PERSONNEL\nLes prestataires ne doivent pas collecter des données à caractère personnel sans justification. En limitant la collecte de ces données au strict minimum, les prestataires peuvent limiter les conséquences négatives potentielles de toute atteinte à la confidentialité de ces données. La nature comme la quantité des données personnelles collectées doivent être limitées au minimum nécessaire pour accomplir le(s) objectif(s) définis et légitimes de cette collecte. \n\nLes prestataires doivent réfléchir soigneusement aux données personnelles nécessaires à l’accomplissement d’un objectif donné avant de procéder à leur collecte. Ils doivent documenter la nature et la justification des données personnelles collectées dans le cadre de leur politiques et pratiques de gestion de l’information. \n","ISO 29100:2011, 5.4","8.4.1.1.1","la nature et la quantité des données personnelles collectées sont-elles limitées su strict nécessaire, sans collecte de données inutiles ?",null,null,{"$f":"VLOOKUP($BH35,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},{"$f":"VLOOKUP($BI35,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},"BizOps",0,null,"8",8.4,"8.4.1","8.4.1: Los proveedores deben limitar la información personal solicitada a los clientes y retenida, utilizada o compartida","8.4.1.1","LIMITAR LA RECOLECCIÓN DE DATOS PERSONALES\nLos proveedores no deben recolectar datos personales de forma indiscriminada. Al limitar la recolección de datos personales al mínimo necesario, los proveedores pueden limitar potenciales consecuencias negativas en caso de una violación a los datos que involucre datos personales. Tanto el tipo como la cantidad de datos personales recolectados deben limitarse a lo estrictamente necesario para cumplir con el(los) fin(es) legítimo(s), bien definido(s). \n\nLos proveedores deben considerar cuidadosamente qué datos personales serán necesarios para un fin en particular antes de proceder a la recolección de los mismos. Deben documentar el tipo de datos personales recolectados, así como la justificación para su recolección como parte de sus políticas y prácticas de manejo de la información.","ISO 29100:2011, 5.4","8.4.1.1.1","¿El tipo y la cantidad de datos personales recolectados se limita a los estrictamente requerido, y no se recolectan datos innecesarios?",null,null,{"$f":"VLOOKUP($BH35,CategoryTranslationTable,3,FALSE)","v":"Recomendado"},{"$f":"VLOOKUP($BI35,CategoryTranslationTable,3,FALSE)","v":"Recomendado"},"BizOps",null,null,"8",8.4,"8.4.1",null,"8.4.1.1",null,"ISO 29100:2011, 5.4","8.4.1.1.1",null,null,null,{"$f":"VLOOKUP($BH35,CategoryTranslationTable,4,FALSE)","v":"Rec4"},{"$f":"VLOOKUP($BI35,CategoryTranslationTable,4,FALSE)","v":"Rec4"},"BizOps",null,null,null,null,null,null,null,null,"8.4.1.1.1",null,null,null,{"$f":"IF(OR($EA35=0,$EA35=2),VLOOKUP(DO35,INDIRECT(ED35),7,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP35),\"\",VLOOKUP(DP35,INDIRECT(EE35),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ35),\"\",VLOOKUP(DQ35,INDIRECT(EF35),7,FALSE))","v":""},{"$f":"IF(ISBLANK(DR35),\"\",VLOOKUP(DR35,INDIRECT(EG35),7,FALSE))","v":""},{"$f":"IF(OR($EA35=0,$EA35=2),VLOOKUP(DO35,INDIRECT(ED35),8,FALSE),)","v":{"$error":"#REF!"}},{"$f":"IF(ISBLANK(DP35),\"\",VLOOKUP(DP35,INDIRECT(EE35),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DQ35),\"\",VLOOKUP(DQ35,INDIRECT(EF35),8,FALSE))","v":""},{"$f":"IF(ISBLANK(DR35),\"\",VLOOKUP(DR35,INDIRECT(EG35),8,FALSE))","v":""},{"$f":"1*AND(LEFT(DN35,3)=\"NEW\")+2*AND(LEFT(DN35,3)=\"MER\")+3*AND(LEFT(DN35,3)=\"MOV\")+4*AND(LEFT(DN35,3)=\"SWA\")","v":0},{"$error":"#REF!"},{"$f":"IF(EA35=0,IF(DW35=0,\"\",DW35),CHOOSE(EA35,\"New indicator\",CONCATENATE(DW35,CarriageReturn,DX35,CarriageReturn,DY35,CarriageReturn,DZ35)))","v":{"$error":"#REF!"}},{"$f":"\"OriginalComplianceP\"&LEFT(DO35,1)","v":"OriginalComplianceP8"},{"$f":"\"OriginalComplianceP\"&LEFT(DP35,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DQ35,1)","v":"OriginalComplianceP"},{"$f":"\"OriginalComplianceP\"&LEFT(DR35,1)","v":"OriginalComplianceP"},0,0,0,0,0,1,""]
[null,"8",8.4,"8.4.1",0,"8.4.1.2",{"$f":"AZ36&\": \"&CHOOSE(LanguageNumber,BA36,BR36,CH36,CX36)","v":"8.4.1.2: LIMIT THE USE OF PERSONAL DATA\nProviders should limit the use of personal data to a specific purpose (e.g., performing KYC, assessing creditworthiness). Additional purposes may be required by law. The purpose should be specified before the data is collected and stored."},"ISO 29100:2011 5.6","8.4.1.2.1",{"$f":"BC36&\": \"&CHOOSE(LanguageNumber,BE36,BU36,CK36,DA36)&CarriageReturn","v":"8.4.1.2.1: Is the use of personal data limited to specified purposes (e.g. performing KYC, assessing creditworthiness)?\n"},{"$f":"CHOOSE(LanguageNumber,BF36,BV36,CL36,DB36)","v":0},0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8",8.4,"8.4.1",null,"8.4.1.2","LIMIT THE USE OF PERSONAL DATA\nProviders should limit the use of personal data to a specific purpose (e.g., performing KYC, assessing creditworthiness). Additional purposes may be required by law. The purpose should be specified before the data is collected and stored.","ISO 29100:2011 5.6","8.4.1.2.1","8.4.1.2.1","Is the use of personal data limited to specified purposes (e.g. performing KYC, assessing creditworthiness)?",null,null,"Recommended","Recommended","BizOps",null,null,"8",8.4,"8.4.1",0,"8.4.1.2","LIMITER L'UTILISATION DE DONNÉES À CARACTÈRE PERSONNEL\nLes prestataires doivent limiter l’utilisation des données personnelles à des fins spécifiques (ex. vérification de l’identité des clients, évaluation de leur solvabilité). D’autres utilisations peuvent relever l’obligations légales. L’objet doit en être spécifié avant que les données ne soient collectées et conservées.","ISO 29100:2011 5.6","8.4.1.2.1","l’utilisation des données à caractère personnel est-elle limitée à des fins spécifiques, telles que la vérification de l'identité des clients ou l'évaluation de leur solvabilité ?",null,null,{"$f":"VLOOKUP($BH36,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},{"$f":"VLOOKUP($BI36,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},"BizOps",0,null,"8",8.4,"8.4.1",null,"8.4.1.2","LIMITAR EL USO DE DATOS PERSONALES\nLos proveedores deben limitar el uso de los datos personales a un fin específico (por ej., realizar CSC, evaluar la capacidad de pago). La ley puede requerir fines adicionales. El fin debe especificarse antes de recolectar y almacenar los datos.","ISO 29100:2011 5.6","8.4.1.2.1","¿El uso de los datos personales se limita a los fines específicos (por ej., realizar CSC, evaluar la capacidad de pago)?",null,null,{"$f":"VLOOKUP($BH36,CategoryTranslationTable,3,FALSE)","v":"Recomendado"},{"$f":"VLOOKUP($BI36,CategoryTranslationTable,3,FALSE)","v":"Recomendado"},"BizOps",null,null,"8",8.4,"8.4.1",null,"8.4.1.2",null,"ISO 29100:2011 5.6","8.4.1.2.1",null,null,null,{"$f":"VLOOKUP($BH36,CategoryTranslationTable,4,FALSE)","v":"Rec4"},{"$f":"VLOOKUP($BI36,CategoryTranslationTable,4,FALSE)","v":"Rec4"},"BizOps",null,null,null,null,null,null,null,null,"8.4.1.2.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP8","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"8",8.4,"8.4.1",0,"8.4.1.3",{"$f":"AZ37&\": \"&CHOOSE(LanguageNumber,BA37,BR37,CH37,CX37)","v":"8.4.1.3: LIMIT THE RETENTION OF PERSONAL INFORMATION\nPersonal data should only be retained as long as necessary to fulfil the stated purposes and should thereafter be securely destroyed or anonymised.  \n\nIn addition, when it is no longer in use, personal data should be locked (i.e. archived, secured and exempted from further processing) for as long as required by law."},"ISO 29100:2011 5.6","8.4.1.3.1",{"$f":"BC37&\": \"&CHOOSE(LanguageNumber,BE37,BU37,CK37,DA37)&CarriageReturn","v":"8.4.1.3.1: Is personal data only retained as long as necessary to fulfil the stated purposes, and thereafter securely destroyed or anonymised?\n"},{"$f":"CHOOSE(LanguageNumber,BF37,BV37,CL37,DB37)","v":0},0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8",8.4,"8.4.1",null,"8.4.1.3","LIMIT THE RETENTION OF PERSONAL INFORMATION\nPersonal data should only be retained as long as necessary to fulfil the stated purposes and should thereafter be securely destroyed or anonymised.  \n\nIn addition, when it is no longer in use, personal data should be locked (i.e. archived, secured and exempted from further processing) for as long as required by law.","ISO 29100:2011 5.6","8.4.1.3.1","8.4.1.3.1","Is personal data only retained as long as necessary to fulfil the stated purposes, and thereafter securely destroyed or anonymised?",null,null,"Recommended","Recommended","BizOps",null,null,"8",8.4,"8.4.1",0,"8.4.1.3","LIMITER LA CONSERVATION DE DONNÉES À CARACTÈRE PERSONNEL\nLa durée de conservation des données à caractère personnel doit être limitée à ce qui est nécessaire pour la réalisation des objectifs déclarés. Les données doivent ensuite être détruites ou rendues anonymes de manière sécurisée. \n\nLorsqu’elles ne sont plus utilisées, elles doivent être « verrouillées » (archivées en sécurité et exemptées de tout autre traitement) aussi longtemps que la loi l’exige.\n","ISO 29100:2011 5.6","8.4.1.3.1","la durée de conservation des données à caractère personnel est-elle limitée à ce qui est nécessaire pour la réalisation des objectifs déclarés, et les données sont-elles ensuite détruites ou rendues anonymes de manière sécurisée ?",null,null,{"$f":"VLOOKUP($BH37,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},{"$f":"VLOOKUP($BI37,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},"BizOps",0,null,"8",8.4,"8.4.1",null,"8.4.1.3","LIMITAR LA RETENCIÓN DE INFORMACIÓN PERSONAL\nLos datos personales se deben retener durante el tiempo que sea necesario para cumplir con los fines establecidos y posteriormente deben ser eliminados de forma segura o anonimizados.  \n\nAdemás, cuando ya no son utilizados, los datos personales deben ser bloqueados (es decir, archivados, asegurados y exentos de procesamiento adicional) durante el tiempo requerido por la ley.","ISO 29100:2011 5.6","8.4.1.3.1","¿Los datos personales se retienen solo durante el tiempo necesario para cumplir con los fines establecidos y posteriormente son eliminados de forma segura o anonimizados?",null,null,{"$f":"VLOOKUP($BH37,CategoryTranslationTable,3,FALSE)","v":"Recomendado"},{"$f":"VLOOKUP($BI37,CategoryTranslationTable,3,FALSE)","v":"Recomendado"},"BizOps",null,null,"8",8.4,"8.4.1",null,"8.4.1.3",null,"ISO 29100:2011 5.6","8.4.1.3.1",null,null,null,{"$f":"VLOOKUP($BH37,CategoryTranslationTable,4,FALSE)","v":"Rec4"},{"$f":"VLOOKUP($BI37,CategoryTranslationTable,4,FALSE)","v":"Rec4"},"BizOps",null,null,null,null,null,null,null,null,"8.4.1.3.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP8","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"8",8.4,"8.4.1",0,"8.4.1.3",null,0,"8.4.1.3.2",{"$f":"BC38&\": \"&CHOOSE(LanguageNumber,BE38,BU38,CK38,DA38)&CarriageReturn","v":"8.4.1.3.2: When it is no longer in use, is personal data locked (i.e. archived, secured and exempted from further processing) for as long as required by law?\n"},{"$f":"CHOOSE(LanguageNumber,BF38,BV38,CL38,DB38)","v":0},0,"Recommended","Recommended","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8",8.4,"8.4.1",null,"8.4.1.3",null,null,"8.4.1.3.2","8.4.1.3.2","When it is no longer in use, is personal data locked (i.e. archived, secured and exempted from further processing) for as long as required by law?",null,null,"Recommended","Recommended","BizOps",null,null,"8",8.4,"8.4.1",0,"8.4.1.3",null,0,"8.4.1.3.2","lorsqu’elles ne sont plus utilisées, les données à caractère personnel sont-elles « verrouillées » (archivées en sécurité et exemptées de tout autre traitement) aussi longtemps que la loi l’exige ?",null,null,{"$f":"VLOOKUP($BH38,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},{"$f":"VLOOKUP($BI38,CategoryTranslationTable,2,FALSE)","v":"Recommandé"},"BizOps",0,null,"8",8.4,"8.4.1",null,"8.4.1.3",null,0,"8.4.1.3.2","Cuando ya no son utilizados, ¿los datos personales son bloqueados (es decir, archivados, asegurados y exentos de procesamiento adicional) durante el tiempo requerido por la ley?",null,null,{"$f":"VLOOKUP($BH38,CategoryTranslationTable,3,FALSE)","v":"Recomendado"},{"$f":"VLOOKUP($BI38,CategoryTranslationTable,3,FALSE)","v":"Recomendado"},"BizOps",null,null,"8",8.4,"8.4.1",null,"8.4.1.3",null,0,"8.4.1.3.2",null,null,null,{"$f":"VLOOKUP($BH38,CategoryTranslationTable,4,FALSE)","v":"Rec4"},{"$f":"VLOOKUP($BI38,CategoryTranslationTable,4,FALSE)","v":"Rec4"},"BizOps",null,null,null,null,null,null,null,null,"8.4.1.3.2",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP8","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,"8",8.4,"8.4.1",0,"8.4.1.4",{"$f":"AZ39&\": \"&CHOOSE(LanguageNumber,BA39,BR39,CH39,CX39)","v":"8.4.1.4: LIMIT THE DISCLOSURE OF PERSONAL INFORMATION\nWhen personal data is transferred internationally, providers should be aware of any regulations specific to cross-border transfer of personal data."},"ISO 29100:2011 5.6","8.4.1.4.1",{"$f":"BC39&\": \"&CHOOSE(LanguageNumber,BE39,BU39,CK39,DA39)&CarriageReturn","v":"8.4.1.4.1: Has an assessment been made to ensure that any international transfer of personal data (e.g. for data processing in another country) is compliant with regulations?\n"},{"$f":"CHOOSE(LanguageNumber,BF39,BV39,CL39,DB39)","v":"1) Data Privacy Policy or data privacy rules of behaviour document\n- For international transfer of personal data, check that an assessment has been made to confirm any transfers are compliant with regulations specific to cross-border transfer of personal data."},0,"Standard Required","Required","BizOps",0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"8",8.4,"8.4.1",null,"8.4.1.4","LIMIT THE DISCLOSURE OF PERSONAL INFORMATION\nWhen personal data is transferred internationally, providers should be aware of any regulations specific to cross-border transfer of personal data.","ISO 29100:2011 5.6","8.4.1.4.1","8.4.1.4.1","Has an assessment been made to ensure that any international transfer of personal data (e.g. for data processing in another country) is compliant with regulations?","1) Data Privacy Policy or data privacy rules of behaviour document\n- For international transfer of personal data, check that an assessment has been made to confirm any transfers are compliant with regulations specific to cross-border transfer of personal data.",null,"Standard Required","Required","BizOps",null,null,"8",8.4,"8.4.1",0,"8.4.1.4","LIMITER LA COMMUNICATION DE DONNÉES À CARACTÈRE PERSONNEL\nLorsque des données à caractère personnel sont transférées à l’étranger, les prestataires doivent tenir compte des réglementations applicables au transfert transfrontalier de ces données.","ISO 29100:2011 5.6","8.4.1.4.1","Une évaluation a-t-elle été réalisée afin de garantir que tout transfert international de données personnelles (par ex. à des fins de traitement dans un autre pays) est en conformité avec la réglementation ?","1) Politique relative à la confidentialité des données ou document énonçant les règles de conduite relatives à la confidentialité des données\n- Vérifier qu’une évaluation a été effectuée afin de confirmer que les éventuels transferts à l’étranger de données à caractère personnel respectent les réglementations applicables au transfert transfrontalier de ces données.",null,{"$f":"VLOOKUP($BH39,CategoryTranslationTable,2,FALSE)","v":"Requis Normal"},{"$f":"VLOOKUP($BI39,CategoryTranslationTable,2,FALSE)","v":"Requis"},"BizOps",0,null,"8",8.4,"8.4.1",null,"8.4.1.4","LIMITAR LA DIVULGACIÓN DE INFORMACIÓN PERSONAL\nCuando se transfieren internacionalmente los datos personales, los proveedores deben conocer todas las regulaciones específicas de la transferencia transfronteriza de datos personales.","ISO 29100:2011 5.6","8.4.1.4.1","¿Se realizó una evaluación para garantizar que todas las transferencias internacionales de datos personales (por ej., para procesamiento de datos en otro país) cumplan con las regulaciones?","1) Política de Privacidad de Datos o documento de reglas de conducta de privacidad de los datos \n- Para la transferencia internacional de datos personales, verificar que se haya realizado una evaluación para confirmar que todas las transferencias cumplan con las regulaciones específicas de transferencia transfronteriza de datos personales.",null,{"$f":"VLOOKUP($BH39,CategoryTranslationTable,3,FALSE)","v":"Obligatorio estándar"},{"$f":"VLOOKUP($BI39,CategoryTranslationTable,3,FALSE)","v":"Obligatorio"},"BizOps",null,null,"8",8.4,"8.4.1",null,"8.4.1.4",null,"ISO 29100:2011 5.6","8.4.1.4.1",null,null,null,{"$f":"VLOOKUP($BH39,CategoryTranslationTable,4,FALSE)","v":"ReqS4"},{"$f":"VLOOKUP($BI39,CategoryTranslationTable,4,FALSE)","v":"Req4"},"BizOps",null,null,null,null,null,null,null,null,"8.4.1.4.1",null,null,null,{"$error":"#REF!"},"","","",{"$error":"#REF!"},"","","",0,{"$error":"#REF!"},{"$error":"#REF!"},"OriginalComplianceP8","OriginalComplianceP","OriginalComplianceP","OriginalComplianceP",0,0,0,0,0,1,""]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,".",".",".",".",".",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,null,0,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,0,null,null,null,null,null,null,null,null,null,null,null,null,0,null,0,0]

{"sheet":"Self-assessment Summary","index":10,"n_rows":43,"n_cols":19,"rows_kept":43,"cut":false,"hidden":false,"merged":[[27,1,27,2],[2,1,2,11],[1,1,1,11],[3,1,3,11],[8,1,8,2]]}
[]
[null,{"$f":"UPPER(CHOOSE(LanguageNumber,O2,Q2,S2,U2))","v":"SUMMARY OF SELF-ASSESSMENT RESPONSES"},null,null,null,null,null,null,null,null,null,null,null,null,"Summary of self-assessment responses",null,"Synthèse des réponses à l'auto-évaluation          ",null,"Resumen de las respuestas de autoevaluación"]
[null,{"$f":"CHOOSE(LanguageNumber,O3,Q3,S3,U3)","v":"Instructions"},null,null,null,null,null,null,null,null,null,null,null,null,"Instructions",null,"Mode d'emploi",null,"Instrucciones"]
[null,{"$f":"CHOOSE(LanguageNumber,O4,Q4,S4,U4)","v":"This worksheet summarises compliance with all eight Principles of the Code of Conduct based on the self-assessment data. The charts and tables present a picture of overall compliance for both Required and Recommended Indicators. The pie charts demonstrate overall compliance, while the bar charts provide information both on overall compliance and each individual Principle."},null,null,null,null,null,null,null,null,null,null,null,null,"This worksheet summarises compliance with all eight Principles of the Code of Conduct based on the self-assessment data. The charts and tables present a picture of overall compliance for both Required and Recommended Indicators. The pie charts demonstrate overall compliance, while the bar charts provide information both on overall compliance and each individual Principle.",null,"Cette feuille de calcul résume la conformité aux huit Principes du Code de conduite en fonction des données obtenues suite à l’auto-évaluation. Les graphiques et tableaux dressent une vue d’ensemble de la conformité générale pour les Indicateurs Requis et Recommandés. Les diagrammes circulaires indiquent la conformité dans son ensemble, les diagrammes en barres indiquent à la fois la conformité générale et la conformité à chaque Principe.",null,"Esta planilla resume el cumplimiento con los ocho Principios del Código de Conducta en base a los datos de la autoevaluación. Los gráficos y las tablas presentan el panorama del cumplimiento total tanto para Indicadores Obligatorios como Recomendados. Los gráficos circulares muestran el cumplimiento total, mientras que los gráficos de barras proveen información tanto sobre el cumplimiento total como sobre cada Principio individual."]
[]
[null,{"$f":"TranslatedOverallCompliance&\" \"&TranslatedNA_indicators_excluded","v":"Overall compliance (N/A indicators excluded)"},null,null,null,null,{"$f":"TranslatedCompliance&\" \"&TranslatedNA_indicators_excluded","v":"Compliance (N/A indicators excluded)"}]
[]
[null,null,null,null,1,2,3,4,5,6,7,8]
[null,{"$f":"TranslatedAllPrinciples","v":"All Principles"},{"$f":"CHOOSE(LanguageNumber,#REF!,#REF!,#REF!,#REF!)","v":{"$error":"#REF!"}},{"$f":"TranslatedTotal","v":"Total"},1,2,3,4,5,6,7,8]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"SUM(E10:L10)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,E$8,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,F$8,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,G$8,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,H$8,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,I$8,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,J$8,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,K$8,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,L$8,All!$BA$4:$BA$682)","v":0}]
[null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"SUM(E11:L11)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,E$8,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,F$8,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,G$8,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,H$8,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,I$8,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,J$8,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,K$8,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,L$8,All!$BB$4:$BB$682)","v":0}]
[null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"SUM(E12:L12)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,E8,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,F8,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,G8,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,H8,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,I8,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,J8,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,K8,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,L8,All!$BC$4:$BC$682)","v":0}]
[null,null,{"$f":"TranslatedNA","v":"N/A"},{"$f":"SUM(E13:L13)","v":0},{"$f":"SUMIF(All!B4:B682,E8,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!B4:B682,F8,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!B4:B682,G8,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!B4:B682,H8,All!BD4:BD682)","v":0},{"$f":"SUMIF(All!B4:B682,I8,All!BD4:BD682)","v":0},{"$f":"SUMIF(All!B4:B682,J8,All!BD4:BD682)","v":0},{"$f":"SUMIF(All!B4:B682,K8,All!BD4:BD682)","v":0},{"$f":"SUMIF(All!B4:B682,L8,All!BD4:BD682)","v":0}]
[null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"SUM(E14:L14)","v":281},{"$f":"E15-SUM(E10:E13)","v":15},56,30,63,68,16,23,10]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D10:D14)","v":281},{"$f":"SUMIF(All!$B$4:$B$682,E$8,All!$AU$4:$AU$682)","v":15},{"$f":"SUMIF(All!$B$4:$B$682,F$8,All!$AU$4:$AU$682)","v":56},{"$f":"SUMIF(All!$B$4:$B$682,G$8,All!$AU$4:$AU$682)","v":30},{"$f":"SUMIF(All!$B$4:$B$682,H$8,All!$AU$4:$AU$682)","v":63},{"$f":"SUMIF(All!$B$4:$B$682,I$8,All!$AU$4:$AU$682)","v":68},{"$f":"SUMIF(All!$B$4:$B$682,J$8,All!$AU$4:$AU$682)","v":16},{"$f":"SUMIF(All!$B$4:$B$682,K$8,All!$AU$4:$AU$682)","v":23},{"$f":"SUMIF(All!$B$4:$B$682,L$8,All!$AU$4:$AU$682)","v":10}]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"SUM(E16:L16)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,E$8,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,F$8,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,G$8,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,H$8,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,I$8,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,J$8,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,K$8,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,L$8,All!$BE$4:$BE$682)","v":0}]
[null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"SUM(E17:L17)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,E$8,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,F$8,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,G$8,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,H$8,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,I$8,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,J$8,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,K$8,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,L$8,All!$BF$4:$BF$682)","v":0}]
[null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"SUM(E18:L18)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,E$8,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,F$8,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,G$8,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,H$8,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,I$8,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,J$8,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,K$8,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,L$8,All!$BG$4:$BG$682)","v":0}]
[null,null,{"$f":"TranslatedNA","v":"N/A"},{"$f":"SUM(E19:L19)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,E$8,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,F$8,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,G$8,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,H$8,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,I$8,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,J$8,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,K$8,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,L$8,All!$BH$4:$BH$682)","v":0}]
[null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"SUM(E20:L20)","v":335},{"$f":"E21-SUM(E16:E19)","v":8},55,51,69,72,20,38,22]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D16:D20)","v":335},{"$f":"SUMIF(All!$B$4:$B$682,E$8,All!$AV$4:$AV$682)","v":8},{"$f":"SUMIF(All!$B$4:$B$682,F$8,All!$AV$4:$AV$682)","v":55},{"$f":"SUMIF(All!$B$4:$B$682,G$8,All!$AV$4:$AV$682)","v":51},{"$f":"SUMIF(All!$B$4:$B$682,H$8,All!$AV$4:$AV$682)","v":69},{"$f":"SUMIF(All!$B$4:$B$682,I$8,All!$AV$4:$AV$682)","v":72},{"$f":"SUMIF(All!$B$4:$B$682,J$8,All!$AV$4:$AV$682)","v":20},{"$f":"SUMIF(All!$B$4:$B$682,K$8,All!$AV$4:$AV$682)","v":38},{"$f":"SUMIF(All!$B$4:$B$682,L$8,All!$AV$4:$AV$682)","v":22}]
[null,{"$f":"TranslatedAllCategories","v":"All Categories"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"D10+D16","v":0},{"$f":"SUM(E10,E16)","v":0},0,0,0,0,0,0,0]
[null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"D11+D17","v":0},0,0,0,0,0,0,0,0]
[null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"D12+D18","v":0},0,0,0,0,0,0,0,0]
[null,null,{"$f":"TranslatedNA","v":"N/A"},{"$f":"D13+D19","v":0},0,0,0,0,0,0,0,0]
[null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"D14+D20","v":616},23,111,81,132,140,36,61,32]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D22:D26)","v":616},23,111,81,132,140,36,61,32]
[null,"All Principles except N/A",null,"Total","P1","P2","P3","P4","P5","P6","P7","P8"]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"D10/(D$15-D$13)","v":0},0,0,0,0,0,0,0,0]
[null,"DO NOT DELETE THIS AREA",{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"D11/(D$15-D$13)","v":0},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$55","v":"No"},{"$f":"D12/(D$15-D$13)","v":0},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$57","v":"Other"},{"$f":"D14/(D$15-D$13)","v":1},1,1,1,1,1,1,1,1]
[null,{"$f":"\"Total \"&B29","v":"Total Required"},null,{"$f":"SUM(D29:D32)","v":1},1,1,1,1,1,1,1,1]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"D16/(D$21-D$19)","v":0},0,0,0,0,0,0,0,0]
[null,"DO NOT DELETE THIS AREA",{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"D17/(D$21-D$19)","v":0},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$55","v":"No"},{"$f":"D18/(D$21-D$19)","v":0},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$57","v":"Other"},{"$f":"D20/(D$21-D$19)","v":1},1,1,1,1,1,1,1,1]
[null,{"$f":"\"Total \"&B34","v":"Total Recommended"},null,{"$f":"SUM(D34:D37)","v":1},1,1,1,1,1,1,1,1]
[null,"All Categories",{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"D22/(D$27-D$25)","v":0},0,0,0,0,0,0,0,0]
[null,"DO NOT DELETE THIS AREA",{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"D23/(D$27-D$25)","v":0},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$55","v":"No"},{"$f":"D24/(D$27-D$25)","v":0},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$57","v":"Other"},{"$f":"D26/(D$27-D$25)","v":1},1,1,1,1,1,1,1,1]
[null,{"$f":"\"Total \"&B39","v":"Total All Categories"},null,{"$f":"SUM(D39:D42)","v":1},1,1,1,1,1,1,1,1]

{"sheet":"Self-assessment Charts","index":11,"n_rows":232,"n_cols":29,"rows_kept":232,"cut":false,"hidden":false,"merged":[[1,1,1,13],[2,1,2,13]]}
[]
[null,{"$f":"UPPER(CHOOSE(LanguageNumber,Y2,AA2,AC2,AE2))","v":"CHARTS OF SELF-ASSESSMENT COMPLIANCE"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Charts of self-assessment compliance",null,"Graphiques de conformité de l'auto-évaluation",null,"Gráficos de cumplimiento de la autoevaluación"]
[null,{"$f":"CHOOSE(LanguageNumber,Y3,AA3,AC3,AE3)","v":"This worksheet provides a detailed summary of Code of Conduct self-assessment compliance. \nThe pie charts give the compliance for each Principle (both required and recommended indicators) and the bar charts provide details of compliance for each sub-principle. Detailed data is included in tables for each Principle.\nNote that the pie charts and bar charts do not include N/A responses, as they focus on compliance with applicable Indicators only. "},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"This worksheet provides a detailed summary of Code of Conduct self-assessment compliance. \nThe pie charts give the compliance for each Principle (both required and recommended indicators) and the bar charts provide details of compliance for each sub-principle. Detailed data is included in tables for each Principle.\nNote that the pie charts and bar charts do not include N/A responses, as they focus on compliance with applicable Indicators only. ",null,"Cette feuille de calcul fournit un résumé détaillé de la conformité au Code de conduite après auto-évaluation. \nLes diagrammes circulaires indiquent la conformité à chaque Principe (indicateurs requis et recommandés) et les diagrammes en barres détaillent la conformité à chaque sous-principe. Des données détaillées figurent dans les tableaux pour chaque Principe.\nRemarque : les diagrammes circulaires et en barres n'incluent pas les réponses « n/d », car ils reflètent seulement la conformité aux Indicateurs applicables. ",null,"Esta planilla proporciona un resumen detallado del cumplimiento de la autoevaluación del Código de Conducta. \nLos gráficos circulares muestran el cumplimiento con cada Principio (tanto respecto de los Indicadores Obligatorios como de los Recomendados) y los gráficos de barras proveen información detallada sobre el cumplimiento con cada sub-principio. Los datos detallados se exhiben en las tablas para cada Principio.\nNota: Los gráficos circulares y de barras no incluyen las respuestas «N/A», ya que solo se enfocan en el cumplimiento de los Indicadores aplicables."]
[]
[null,{"$f":"TranslatedPrinciple&\" \"&C5","v":"Principle 1"},1]
[null,{"$f":"$B5&\" \"&LOWER(TranslatedOverallCompliance)&\" \"&TranslatedNA_indicators_excluded","v":"Principle 1 overall compliance (N/A indicators excluded)"},null,null,null,null,null,{"$f":"$B5&\" \"&LOWER(TranslatedCompliance)&\" \"&TranslatedNA_indicators_excluded","v":"Principle 1 compliance (N/A indicators excluded)"},null,null,null,null,{"$f":"TranslatedCompliance_by_Sub_Principle&\" \"&TranslatedNA_indicators_excluded","v":"Compliance by Sub-Principle (N/A indicators excluded)"}]
[]
[]
[null,{"$f":"TranslatedCompliance","v":"Compliance"}]
[null,{"$f":"B5","v":"Principle 1"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"$C5&\".1\"","v":"1.1"},{"$f":"$C5&\".2\"","v":"1.2"}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"SUM(E11:K11)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E10,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F10,All!$BA$4:$BA$682)","v":0}]
[null,{"$f":"TranslatedRequired&Spacer2&B5","v":"Required - Principle 1"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"SUM(E12:K12)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E10,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F10,All!$BB$4:$BB$682)","v":0},null,null,null,null,null,null,{"$f":"\"% \"&TranslatedCompliance&\" \"&TranslatedNA_indicators_excluded","v":"% Compliance (N/A indicators excluded)"}]
[null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"SUM(E13:K13)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E10,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F10,All!$BC$4:$BC$682)","v":0},null,null,null,null,null,null,{"$f":"B5","v":"Principle 1"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"E10","v":"1.1"},{"$f":"F10","v":"1.2"}]
[null,null,{"$f":"TranslatedNA","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E10,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F10,All!$BD$4:$BD$682)","v":0},null,null,null,null,null,null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D16=0,0,D11/(D16-D14))","v":0},{"$f":"IF(E16-E14=0,0,E11/(E16-E14))","v":0},{"$f":"IF(F16-F14=0,0,F11/(F16-F14))","v":0}]
[null,null,{"$f":"TranslatedOther","v":"Other"},15,{"$f":"E16-SUM(E11:E14)","v":8},{"$f":"F16-SUM(F11:F14)","v":7},null,null,null,null,null,null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D16=0,0,D12/(D16-D14))","v":0},{"$f":"IF(E16-E14=0,0,E12/(E16-E14))","v":0},{"$f":"IF(F16-F14=0,0,F12/(F16-F14))","v":0}]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D11:D15)","v":15},{"$f":"SUMIF(All!$C$4:$C$682,E10,All!$AU$4:$AU$682)","v":8},{"$f":"SUMIF(All!$C$4:$C$682,F10,All!$AU$4:$AU$682)","v":7},null,null,null,null,null,null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D16=0,0,D13/(D16-D14))","v":0},{"$f":"IF(E16-E14=0,0,E13/(E16-E14))","v":0},{"$f":"IF(F16-F14=0,0,F13/(F16-F14))","v":0}]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"SUM(E17:K17)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E10,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F10,All!$BE$4:$BE$682)","v":0},null,null,null,null,null,null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D16=0,0,D15/(D16-D14))","v":1},{"$f":"IF(E16-E14=0,0,E15/(E16-E14))","v":1},{"$f":"IF(F16-F14=0,0,F15/(F16-F14))","v":1}]
[null,{"$f":"TranslatedRecommended&Spacer2&B5","v":"Recommended - Principle 1"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"SUM(E18:K18)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E10,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F10,All!$BF$4:$BF$682)","v":0},null,null,null,null,null,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O14:O17)","v":1},{"$f":"SUM(P14:P17)","v":1},{"$f":"SUM(Q14:Q17)","v":1}]
[null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"SUM(E19:K19)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E10,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F10,All!$BG$4:$BG$682)","v":0},null,null,null,null,null,null,{"$f":"TranslatedRecommended","v":"Recommended"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D22=0,0,D17/(D22-D20))","v":0},{"$f":"IF(E22-E20=0,0,E17/(E22-E20))","v":0},{"$f":"IF(F22-F20=0,0,F17/(F22-F20))","v":0}]
[null,null,{"$f":"TranslatedNA","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E10,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F10,All!$BH$4:$BH$682)","v":0},null,null,null,null,null,null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D22=0,0,D18/(D22-D20))","v":0},{"$f":"IF(E22-E20=0,0,E18/(E22-E20))","v":0},{"$f":"IF(F22-F20=0,0,F18/(F22-F20))","v":0}]
[null,null,{"$f":"TranslatedOther","v":"Other"},8,{"$f":"E22-SUM(E17:E20)","v":3},{"$f":"F22-SUM(F17:F20)","v":5},null,null,null,null,null,null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D22=0,0,D19/(D22-D20))","v":0},{"$f":"IF(E22-E20=0,0,E19/(E22-E20))","v":0},{"$f":"IF(F22-F20=0,0,F19/(F22-F20))","v":0}]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D17:D21)","v":8},{"$f":"SUMIF(All!$C$4:$C$682,E10,All!$AV$4:$AV$682)","v":3},{"$f":"SUMIF(All!$C$4:$C$682,F10,All!$AV$4:$AV$682)","v":5},null,null,null,null,null,null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D22=0,0,D21/(D22-D20))","v":1},{"$f":"IF(E22-E20=0,0,E21/(E22-E20))","v":1},{"$f":"IF(F22-F20=0,0,F21/(F22-F20))","v":1}]
[null,{"$f":"TranslatedAllCategories","v":"All Categories"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"D11+D17","v":0},{"$f":"E11+E17","v":0},0,null,null,null,null,null,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O19:O22)","v":1},{"$f":"SUM(P19:P22)","v":1},{"$f":"SUM(Q19:Q22)","v":1}]
[null,{"$f":"TranslatedAllCategories&Spacer2&B5","v":"All Categories - Principle 1"},{"$f":"TranslatedPartial","v":"Partial"},0,0,0,null,null,null,null,null,null,{"$f":"TranslatedAllCategories","v":"All Categories"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D28=0,0,D23/(D28-D26))","v":0},{"$f":"IF(E28-E26=0,0,E23/(E28-E26))","v":0},{"$f":"IF(F28-F26=0,0,F23/(F28-F26))","v":0}]
[null,null,{"$f":"TranslatedNo","v":"No"},0,0,0,null,null,null,null,null,null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D28=0,0,D24/(D28-D26))","v":0},{"$f":"IF(E28-E26=0,0,E24/(E28-E26))","v":0},{"$f":"IF(F28-F26=0,0,F24/(F28-F26))","v":0}]
[null,null,{"$f":"TranslatedNA","v":"N/A"},0,0,0,null,null,null,null,null,null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D28=0,0,D25/(D28-D26))","v":0},{"$f":"IF(E28-E26=0,0,E25/(E28-E26))","v":0},{"$f":"IF(F28-F26=0,0,F25/(F28-F26))","v":0}]
[null,null,{"$f":"TranslatedOther","v":"Other"},23,11,12,null,null,null,null,null,null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D28=0,0,D27/(D28-D26))","v":1},{"$f":"IF(E28-E26=0,0,E27/(E28-E26))","v":1},{"$f":"IF(F28-F26=0,0,F27/(F28-F26))","v":1}]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D23:D27)","v":23},{"$f":"SUM(E23:E27)","v":11},{"$f":"SUM(F23:F27)","v":12},null,null,null,null,null,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O24:O27)","v":1},{"$f":"SUM(P24:P27)","v":1},{"$f":"SUM(Q24:Q27)","v":1}]
[]
[null,{"$f":"TranslatedPrinciple&\" \"&C30","v":"Principle 2"},2]
[null,{"$f":"$B30&\" \"&LOWER(TranslatedOverallCompliance)&\" \"&TranslatedNA_indicators_excluded","v":"Principle 2 overall compliance (N/A indicators excluded)"},null,null,null,null,null,{"$f":"$B30&\" \"&LOWER(TranslatedCompliance)&\" \"&TranslatedNA_indicators_excluded","v":"Principle 2 compliance (N/A indicators excluded)"},null,null,null,null,{"$f":"TranslatedCompliance_by_Sub_Principle&\" \"&TranslatedNA_indicators_excluded","v":"Compliance by Sub-Principle (N/A indicators excluded)"}]
[]
[]
[null,{"$f":"TranslatedCompliance","v":"Compliance"}]
[null,{"$f":"B30","v":"Principle 2"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"$C30&\".1\"","v":"2.1"},{"$f":"$C30&\".2\"","v":"2.2"},{"$f":"$C30&\".3\"","v":"2.3"},{"$f":"$C30&\".4\"","v":"2.4"},{"$f":"$C30&\".5\"","v":"2.5"},{"$f":"$C30&\".6\"","v":"2.6"},{"$f":"$C30&\".7\"","v":"2.7"}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"SUM(E36:K36)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E35,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F35,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G35,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H35,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I35,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J35,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K35,All!$BA$4:$BA$682)","v":0}]
[null,{"$f":"TranslatedRequired&Spacer2&B30","v":"Required - Principle 2"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"SUM(E37:K37)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E35,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F35,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G35,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H35,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I35,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J35,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K35,All!$BB$4:$BB$682)","v":0},null,{"$f":"\"% \"&TranslatedCompliance&\" \"&TranslatedNA_indicators_excluded","v":"% Compliance (N/A indicators excluded)"}]
[null,null,{"$f":"TranslatedNo","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E35,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F35,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G35,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H35,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I35,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J35,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K35,All!$BC$4:$BC$682)","v":0},null,{"$f":"B30","v":"Principle 2"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"E35","v":"2.1"},{"$f":"F35","v":"2.2"},{"$f":"G35","v":"2.3"},{"$f":"H35","v":"2.4"},"2.5","2.6","2.7"]
[null,null,{"$f":"TranslatedNA","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E35,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F35,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G35,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H35,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I35,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J35,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K35,All!$BD$4:$BD$682)","v":0},null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D41=0,0,D36/(D41-D39))","v":0},{"$f":"IF(E41-E39=0,0,E36/(E41-E39))","v":0},0,0,0,0,0,0]
[null,null,{"$f":"TranslatedOther","v":"Other"},56,{"$f":"E41-SUM(E36:E39)","v":10},{"$f":"F41-SUM(F36:F39)","v":6},5,3,15,5,12,null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D41=0,0,D37/(D41-D39))","v":0},{"$f":"IF(E41-E39=0,0,E37/(E41-E39))","v":0},0,0,0,0,0,0]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D36:D40)","v":56},{"$f":"SUMIF(All!$C$4:$C$682,E35,All!$AU$4:$AU$682)","v":10},{"$f":"SUMIF(All!$C$4:$C$682,F35,All!$AU$4:$AU$682)","v":6},{"$f":"SUMIF(All!$C$4:$C$682,G35,All!$AU$4:$AU$682)","v":5},{"$f":"SUMIF(All!$C$4:$C$682,H35,All!$AU$4:$AU$682)","v":3},{"$f":"SUMIF(All!$C$4:$C$682,I35,All!$AU$4:$AU$682)","v":15},{"$f":"SUMIF(All!$C$4:$C$682,J35,All!$AU$4:$AU$682)","v":5},{"$f":"SUMIF(All!$C$4:$C$682,K35,All!$AU$4:$AU$682)","v":12},null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D41=0,0,D38/(D41-D39))","v":0},{"$f":"IF(E41-E39=0,0,E38/(E41-E39))","v":0},0,0,0,0,0,0]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"SUM(E42:K42)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E35,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F35,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G35,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H35,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I35,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J35,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K35,All!$BE$4:$BE$682)","v":0},null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D41=0,0,D40/(D41-D39))","v":1},{"$f":"IF(E41-E39=0,0,E40/(E41-E39))","v":1},1,1,1,1,1,1]
[null,{"$f":"TranslatedRecommended&Spacer2&B30","v":"Recommended - Principle 2"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"SUM(E43:K43)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E35,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F35,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G35,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H35,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I35,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J35,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K35,All!$BF$4:$BF$682)","v":0},null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O39:O42)","v":1},{"$f":"SUM(P39:P42)","v":1},1,1,1,1,1,1]
[null,null,{"$f":"TranslatedNo","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E35,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F35,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G35,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H35,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I35,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J35,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K35,All!$BG$4:$BG$682)","v":0},null,{"$f":"TranslatedRecommended","v":"Recommended"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D47=0,0,D42/(D47-D45))","v":0},{"$f":"IF(E47-E45=0,0,E42/(E47-E45))","v":0},0,0,0,0,0,0]
[null,null,{"$f":"TranslatedNA","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E35,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F35,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G35,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H35,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I35,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J35,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K35,All!$BH$4:$BH$682)","v":0},null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D47=0,0,D43/(D47-D45))","v":0},{"$f":"IF(E47-E45=0,0,E43/(E47-E45))","v":0},0,0,0,0,0,0]
[null,null,{"$f":"TranslatedOther","v":"Other"},55,{"$f":"E47-SUM(E42:E45)","v":1},{"$f":"F47-SUM(F42:F45)","v":0},2,11,24,4,13,null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D47=0,0,D44/(D47-D45))","v":0},{"$f":"IF(E47-E45=0,0,E44/(E47-E45))","v":0},0,0,0,0,0,0]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D42:D46)","v":55},{"$f":"SUMIF(All!$C$4:$C$682,E35,All!$AV$4:$AV$682)","v":1},{"$f":"SUMIF(All!$C$4:$C$682,F35,All!$AV$4:$AV$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G35,All!$AV$4:$AV$682)","v":2},{"$f":"SUMIF(All!$C$4:$C$682,H35,All!$AV$4:$AV$682)","v":11},{"$f":"SUMIF(All!$C$4:$C$682,I35,All!$AV$4:$AV$682)","v":24},{"$f":"SUMIF(All!$C$4:$C$682,J35,All!$AV$4:$AV$682)","v":4},{"$f":"SUMIF(All!$C$4:$C$682,K35,All!$AV$4:$AV$682)","v":13},null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D47=0,0,D46/(D47-D45))","v":1},{"$f":"IF(E47-E45=0,0,E46/(E47-E45))","v":1},0,1,1,1,1,1]
[null,{"$f":"TranslatedAllCategories","v":"All Categories"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"D36+D42","v":0},{"$f":"E36+E42","v":0},{"$f":"F36+F42","v":0},0,0,0,0,0,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O44:O47)","v":1},{"$f":"SUM(P44:P47)","v":1},0,1,1,1,1,1]
[null,{"$f":"TranslatedAllCategories&Spacer2&B30","v":"All Categories - Principle 2"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"D37+D43","v":0},{"$f":"E37+E43","v":0},{"$f":"F37+F43","v":0},0,0,0,0,0,null,{"$f":"TranslatedAllCategories","v":"All Categories"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D53=0,0,D48/(D53-D51))","v":0},{"$f":"IF(E53-E51=0,0,E48/(E53-E51))","v":0},0,0,0,0,0,0]
[null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"D38+D44","v":0},{"$f":"E38+E44","v":0},{"$f":"F38+F44","v":0},0,0,0,0,0,null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D53=0,0,D49/(D53-D51))","v":0},{"$f":"IF(E53-E51=0,0,E49/(E53-E51))","v":0},0,0,0,0,0,0]
[null,null,{"$f":"TranslatedNA","v":"N/A"},{"$f":"D39+D45","v":0},{"$f":"E39+E45","v":0},{"$f":"F39+F45","v":0},0,0,0,0,0,null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D53=0,0,D50/(D53-D51))","v":0},{"$f":"IF(E53-E51=0,0,E50/(E53-E51))","v":0},0,0,0,0,0,0]
[null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"D40+D46","v":111},{"$f":"E40+E46","v":11},{"$f":"F40+F46","v":6},7,14,39,9,25,null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D53=0,0,D52/(D53-D51))","v":1},{"$f":"IF(E53-E51=0,0,E52/(E53-E51))","v":1},1,1,1,1,1,1]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D48:D52)","v":111},11,6,7,14,39,9,25,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O49:O52)","v":1},{"$f":"SUM(P49:P52)","v":1},1,1,1,1,1,1]
[]
[null,{"$f":"TranslatedPrinciple&\" \"&C55","v":"Principle 3"},3]
[null,{"$f":"$B55&\" \"&LOWER(TranslatedOverallCompliance)&\" \"&TranslatedNA_indicators_excluded","v":"Principle 3 overall compliance (N/A indicators excluded)"},null,null,null,null,null,{"$f":"$B55&\" \"&LOWER(TranslatedCompliance)&\" \"&TranslatedNA_indicators_excluded","v":"Principle 3 compliance (N/A indicators excluded)"},null,null,null,null,{"$f":"TranslatedCompliance_by_Sub_Principle&\" \"&TranslatedNA_indicators_excluded","v":"Compliance by Sub-Principle (N/A indicators excluded)"}]
[]
[]
[null,{"$f":"TranslatedCompliance","v":"Compliance"}]
[null,{"$f":"B55","v":"Principle 3"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"$C55&\".1\"","v":"3.1"},{"$f":"$C55&\".2\"","v":"3.2"},{"$f":"$C55&\".3\"","v":"3.3"},{"$f":"$C55&\".4\"","v":"3.4"}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"SUM(E61:K61)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E60,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F60,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G60,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H60,All!$BA$4:$BA$682)","v":0}]
[null,{"$f":"TranslatedRequired&Spacer2&B55","v":"Required - Principle 3"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"SUM(E62:K62)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E60,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F60,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G60,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H60,All!$BB$4:$BB$682)","v":0},null,null,null,null,{"$f":"\"% \"&TranslatedCompliance&\" \"&TranslatedNA_indicators_excluded","v":"% Compliance (N/A indicators excluded)"}]
[null,null,{"$f":"TranslatedNo","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E60,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F60,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G60,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H60,All!$BC$4:$BC$682)","v":0},null,null,null,null,{"$f":"B55","v":"Principle 3"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"E60","v":"3.1"},{"$f":"F60","v":"3.2"},{"$f":"G60","v":"3.3"},{"$f":"H60","v":"3.4"}]
[null,null,{"$f":"TranslatedNA","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E60,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F60,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G60,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H60,All!$BD$4:$BD$682)","v":0},null,null,null,null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D66=0,0,D61/(D66-D64))","v":0},{"$f":"IF(E66-E64=0,0,E61/(E66-E64))","v":0},{"$f":"IF(F66-F64=0,0,F61/(F66-F64))","v":0},{"$f":"IF(G66-G64=0,0,G61/(G66-G64))","v":0},{"$f":"IF(H66-H64=0,0,H61/(H66-H64))","v":0}]
[null,null,{"$f":"TranslatedOther","v":"Other"},30,{"$f":"E66-SUM(E61:E64)","v":11},6,2,11,null,null,null,null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D66=0,0,D62/(D66-D64))","v":0},{"$f":"IF(E66-E64=0,0,E62/(E66-E64))","v":0},{"$f":"IF(F66-F64=0,0,F62/(F66-F64))","v":0},{"$f":"IF(G66-G64=0,0,G62/(G66-G64))","v":0},{"$f":"IF(H66-H64=0,0,H62/(H66-H64))","v":0}]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D61:D65)","v":30},{"$f":"SUMIF(All!$C$4:$C$682,E60,All!$AU$4:$AU$682)","v":11},{"$f":"SUMIF(All!$C$4:$C$682,F60,All!$AU$4:$AU$682)","v":6},{"$f":"SUMIF(All!$C$4:$C$682,G60,All!$AU$4:$AU$682)","v":2},{"$f":"SUMIF(All!$C$4:$C$682,H60,All!$AU$4:$AU$682)","v":11},null,null,null,null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D66=0,0,D63/(D66-D64))","v":0},{"$f":"IF(E66-E64=0,0,E63/(E66-E64))","v":0},{"$f":"IF(F66-F64=0,0,F63/(F66-F64))","v":0},{"$f":"IF(G66-G64=0,0,G63/(G66-G64))","v":0},{"$f":"IF(H66-H64=0,0,H63/(H66-H64))","v":0}]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"SUM(E67:K67)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E60,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F60,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G60,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H60,All!$BE$4:$BE$682)","v":0},null,null,null,null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D66=0,0,D65/(D66-D64))","v":1},{"$f":"IF(E66-E64=0,0,E65/(E66-E64))","v":1},{"$f":"IF(F66-F64=0,0,F65/(F66-F64))","v":1},{"$f":"IF(G66-G64=0,0,G65/(G66-G64))","v":1},{"$f":"IF(H66-H64=0,0,H65/(H66-H64))","v":1}]
[null,{"$f":"TranslatedRecommended&Spacer2&B55","v":"Recommended - Principle 3"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"SUM(E68:K68)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E60,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F60,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G60,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H60,All!$BF$4:$BF$682)","v":0},null,null,null,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O64:O67)","v":1},{"$f":"SUM(P64:P67)","v":1},{"$f":"SUM(Q64:Q67)","v":1},{"$f":"SUM(R64:R67)","v":1},{"$f":"SUM(S64:S67)","v":1}]
[null,null,{"$f":"TranslatedNo","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E60,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F60,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G60,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H60,All!$BG$4:$BG$682)","v":0},null,null,null,null,{"$f":"TranslatedRecommended","v":"Recommended"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D72=0,0,D67/(D72-D70))","v":0},{"$f":"IF(E72-E70=0,0,E67/(E72-E70))","v":0},{"$f":"IF(F72-F70=0,0,F67/(F72-F70))","v":0},{"$f":"IF(G72-G70=0,0,G67/(G72-G70))","v":0},{"$f":"IF(H72-H70=0,0,H67/(H72-H70))","v":0}]
[null,null,{"$f":"TranslatedNA","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E60,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F60,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G60,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H60,All!$BH$4:$BH$682)","v":0},null,null,null,null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D72=0,0,D68/(D72-D70))","v":0},{"$f":"IF(E72-E70=0,0,E68/(E72-E70))","v":0},{"$f":"IF(F72-F70=0,0,F68/(F72-F70))","v":0},{"$f":"IF(G72-G70=0,0,G68/(G72-G70))","v":0},{"$f":"IF(H72-H70=0,0,H68/(H72-H70))","v":0}]
[null,null,{"$f":"TranslatedOther","v":"Other"},51,{"$f":"E72-SUM(E67:E70)","v":16},4,9,22,null,null,null,null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D72=0,0,D69/(D72-D70))","v":0},{"$f":"IF(E72-E70=0,0,E69/(E72-E70))","v":0},{"$f":"IF(F72-F70=0,0,F69/(F72-F70))","v":0},{"$f":"IF(G72-G70=0,0,G69/(G72-G70))","v":0},{"$f":"IF(H72-H70=0,0,H69/(H72-H70))","v":0}]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D67:D71)","v":51},{"$f":"SUMIF(All!$C$4:$C$682,E60,All!$AV$4:$AV$682)","v":16},{"$f":"SUMIF(All!$C$4:$C$682,F60,All!$AV$4:$AV$682)","v":4},{"$f":"SUMIF(All!$C$4:$C$682,G60,All!$AV$4:$AV$682)","v":9},{"$f":"SUMIF(All!$C$4:$C$682,H60,All!$AV$4:$AV$682)","v":22},null,null,null,null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D72=0,0,D71/(D72-D70))","v":1},{"$f":"IF(E72-E70=0,0,E71/(E72-E70))","v":1},{"$f":"IF(F72-F70=0,0,F71/(F72-F70))","v":1},{"$f":"IF(G72-G70=0,0,G71/(G72-G70))","v":1},{"$f":"IF(H72-H70=0,0,H71/(H72-H70))","v":1}]
[null,{"$f":"TranslatedAllCategories","v":"All Categories"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"D61+D67","v":0},0,0,0,0,null,null,null,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O69:O72)","v":1},{"$f":"SUM(P69:P72)","v":1},{"$f":"SUM(Q69:Q72)","v":1},{"$f":"SUM(R69:R72)","v":1},{"$f":"SUM(S69:S72)","v":1}]
[null,{"$f":"TranslatedAllCategories&Spacer2&B55","v":"All Categories - Principle 3"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"D62+D68","v":0},0,0,0,0,null,null,null,null,{"$f":"TranslatedAllCategories","v":"All Categories"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D78=0,0,D73/(D78-D76))","v":0},{"$f":"IF(E78-E76=0,0,E73/(E78-E76))","v":0},{"$f":"IF(F78-F76=0,0,F73/(F78-F76))","v":0},{"$f":"IF(G78-G76=0,0,G73/(G78-G76))","v":0},{"$f":"IF(H78-H76=0,0,H73/(H78-H76))","v":0}]
[null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"D63+D69","v":0},0,0,0,0,null,null,null,null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D78=0,0,D74/(D78-D76))","v":0},{"$f":"IF(E78-E76=0,0,E74/(E78-E76))","v":0},{"$f":"IF(F78-F76=0,0,F74/(F78-F76))","v":0},{"$f":"IF(G78-G76=0,0,G74/(G78-G76))","v":0},{"$f":"IF(H78-H76=0,0,H74/(H78-H76))","v":0}]
[null,null,{"$f":"TranslatedNA","v":"N/A"},{"$f":"D64+D70","v":0},0,0,0,0,null,null,null,null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D78=0,0,D75/(D78-D76))","v":0},{"$f":"IF(E78-E76=0,0,E75/(E78-E76))","v":0},{"$f":"IF(F78-F76=0,0,F75/(F78-F76))","v":0},{"$f":"IF(G78-G76=0,0,G75/(G78-G76))","v":0},{"$f":"IF(H78-H76=0,0,H75/(H78-H76))","v":0}]
[null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"D65+D71","v":81},27,10,11,33,null,null,null,null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D78=0,0,D77/(D78-D76))","v":1},{"$f":"IF(E78-E76=0,0,E77/(E78-E76))","v":1},{"$f":"IF(F78-F76=0,0,F77/(F78-F76))","v":1},{"$f":"IF(G78-G76=0,0,G77/(G78-G76))","v":1},{"$f":"IF(H78-H76=0,0,H77/(H78-H76))","v":1}]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D73:D77)","v":81},{"$f":"SUM(E73:E77)","v":27},{"$f":"SUM(F73:F77)","v":10},{"$f":"SUM(G73:G77)","v":11},{"$f":"SUM(H73:H77)","v":33},null,null,null,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O74:O77)","v":1},{"$f":"SUM(P74:P77)","v":1},{"$f":"SUM(Q74:Q77)","v":1},{"$f":"SUM(R74:R77)","v":1},{"$f":"SUM(S74:S77)","v":1}]
[]
[null,{"$f":"TranslatedPrinciple&\" \"&C80","v":"Principle 4"},4]
[null,{"$f":"$B80&\" \"&LOWER(TranslatedOverallCompliance)&\" \"&TranslatedNA_indicators_excluded","v":"Principle 4 overall compliance (N/A indicators excluded)"},null,null,null,null,null,{"$f":"$B80&\" \"&LOWER(TranslatedCompliance)&\" \"&TranslatedNA_indicators_excluded","v":"Principle 4 compliance (N/A indicators excluded)"},null,null,null,null,{"$f":"TranslatedCompliance_by_Sub_Principle&\" \"&TranslatedNA_indicators_excluded","v":"Compliance by Sub-Principle (N/A indicators excluded)"}]
[]
[]
[null,{"$f":"TranslatedCompliance","v":"Compliance"}]
[null,{"$f":"B80","v":"Principle 4"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"$C80&\".1\"","v":"4.1"},{"$f":"$C80&\".2\"","v":"4.2"},{"$f":"$C80&\".3\"","v":"4.3"},{"$f":"$C80&\".4\"","v":"4.4"},{"$f":"$C80&\".5\"","v":"4.5"},{"$f":"$C80&\".6\"","v":"4.6"},{"$f":"$C80&\".7\"","v":"4.7"}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"SUM(E86:K86)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E85,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F85,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G85,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H85,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I85,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J85,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K85,All!$BA$4:$BA$682)","v":0}]
[null,{"$f":"TranslatedRequired&Spacer2&B80","v":"Required - Principle 4"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"SUM(E87:K87)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E85,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F85,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G85,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H85,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I85,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J85,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K85,All!$BB$4:$BB$682)","v":0},null,{"$f":"\"% \"&TranslatedCompliance&\" \"&TranslatedNA_indicators_excluded","v":"% Compliance (N/A indicators excluded)"}]
[null,null,{"$f":"TranslatedNo","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E85,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F85,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G85,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H85,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I85,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J85,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K85,All!$BC$4:$BC$682)","v":0},null,{"$f":"B80","v":"Principle 4"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"E85","v":"4.1"},{"$f":"F85","v":"4.2"},{"$f":"G85","v":"4.3"},{"$f":"H85","v":"4.4"},"4.5","4.6","4.7"]
[null,null,{"$f":"TranslatedNA","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E85,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F85,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G85,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H85,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I85,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J85,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K85,All!$BD$4:$BD$682)","v":0},null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D91=0,0,D86/(D91-D89))","v":0},{"$f":"IF(E91-E89=0,0,E86/(E91-E89))","v":0},0,0,0,0,0,0]
[null,null,{"$f":"TranslatedOther","v":"Other"},63,{"$f":"E91-SUM(E86:E89)","v":6},14,6,3,10,9,15,null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D91=0,0,D87/(D91-D89))","v":0},{"$f":"IF(E91-E89=0,0,E87/(E91-E89))","v":0},0,0,0,0,0,0]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D86:D90)","v":63},{"$f":"SUMIF(All!$C$4:$C$682,E85,All!$AU$4:$AU$682)","v":6},{"$f":"SUMIF(All!$C$4:$C$682,F85,All!$AU$4:$AU$682)","v":14},{"$f":"SUMIF(All!$C$4:$C$682,G85,All!$AU$4:$AU$682)","v":6},{"$f":"SUMIF(All!$C$4:$C$682,H85,All!$AU$4:$AU$682)","v":3},{"$f":"SUMIF(All!$C$4:$C$682,I85,All!$AU$4:$AU$682)","v":10},{"$f":"SUMIF(All!$C$4:$C$682,J85,All!$AU$4:$AU$682)","v":9},{"$f":"SUMIF(All!$C$4:$C$682,K85,All!$AU$4:$AU$682)","v":15},null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D91=0,0,D88/(D91-D89))","v":0},{"$f":"IF(E91-E89=0,0,E88/(E91-E89))","v":0},0,0,0,0,0,0]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"SUM(E92:K92)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E85,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F85,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G85,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H85,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I85,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J85,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K85,All!$BE$4:$BE$682)","v":0},null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D91=0,0,D90/(D91-D89))","v":1},{"$f":"IF(E91-E89=0,0,E90/(E91-E89))","v":1},1,1,1,1,1,1]
[null,{"$f":"TranslatedRecommended&Spacer2&B80","v":"Recommended - Principle 4"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"SUM(E93:K93)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E85,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F85,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G85,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H85,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I85,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J85,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K85,All!$BF$4:$BF$682)","v":0},null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O89:O92)","v":1},{"$f":"SUM(P89:P92)","v":1},1,1,1,1,1,1]
[null,null,{"$f":"TranslatedNo","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E85,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F85,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G85,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H85,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I85,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J85,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K85,All!$BG$4:$BG$682)","v":0},null,{"$f":"TranslatedRecommended","v":"Recommended"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D97=0,0,D92/(D97-D95))","v":0},{"$f":"IF(E97-E95=0,0,E92/(E97-E95))","v":0},0,0,0,0,0,0]
[null,null,{"$f":"TranslatedNA","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E85,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F85,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G85,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H85,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I85,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J85,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K85,All!$BH$4:$BH$682)","v":0},null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D97=0,0,D93/(D97-D95))","v":0},{"$f":"IF(E97-E95=0,0,E93/(E97-E95))","v":0},0,0,0,0,0,0]
[null,null,{"$f":"TranslatedOther","v":"Other"},69,{"$f":"E97-SUM(E92:E95)","v":4},13,13,8,14,8,9,null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D97=0,0,D94/(D97-D95))","v":0},{"$f":"IF(E97-E95=0,0,E94/(E97-E95))","v":0},0,0,0,0,0,0]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D92:D96)","v":69},{"$f":"SUMIF(All!$C$4:$C$682,E85,All!$AV$4:$AV$682)","v":4},{"$f":"SUMIF(All!$C$4:$C$682,F85,All!$AV$4:$AV$682)","v":13},{"$f":"SUMIF(All!$C$4:$C$682,G85,All!$AV$4:$AV$682)","v":13},{"$f":"SUMIF(All!$C$4:$C$682,H85,All!$AV$4:$AV$682)","v":8},{"$f":"SUMIF(All!$C$4:$C$682,I85,All!$AV$4:$AV$682)","v":14},{"$f":"SUMIF(All!$C$4:$C$682,J85,All!$AV$4:$AV$682)","v":8},{"$f":"SUMIF(All!$C$4:$C$682,K85,All!$AV$4:$AV$682)","v":9},null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D97=0,0,D96/(D97-D95))","v":1},{"$f":"IF(E97-E95=0,0,E96/(E97-E95))","v":1},1,1,1,1,1,1]
[null,{"$f":"TranslatedAllCategories","v":"All Categories"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"D86+D92","v":0},0,0,0,0,0,0,0,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O94:O97)","v":1},{"$f":"SUM(P94:P97)","v":1},1,1,1,1,1,1]
[null,{"$f":"TranslatedAllCategories&Spacer2&B80","v":"All Categories - Principle 4"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"D87+D93","v":0},0,0,0,0,0,0,0,null,{"$f":"TranslatedAllCategories","v":"All Categories"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D103=0,0,D98/(D103-D101))","v":0},{"$f":"IF(E103-E101=0,0,E98/(E103-E101))","v":0},0,0,0,0,0,0]
[null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"D88+D94","v":0},0,0,0,0,0,0,0,null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D103=0,0,D99/(D103-D101))","v":0},{"$f":"IF(E103-E101=0,0,E99/(E103-E101))","v":0},0,0,0,0,0,0]
[null,null,{"$f":"TranslatedNA","v":"N/A"},{"$f":"D89+D95","v":0},0,0,0,0,0,0,0,null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D103=0,0,D100/(D103-D101))","v":0},{"$f":"IF(E103-E101=0,0,E100/(E103-E101))","v":0},0,0,0,0,0,0]
[null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"D90+D96","v":132},10,27,19,11,24,17,24,null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D103=0,0,D102/(D103-D101))","v":1},{"$f":"IF(E103-E101=0,0,E102/(E103-E101))","v":1},1,1,1,1,1,1]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D98:D102)","v":132},{"$f":"SUM(E98:E102)","v":10},{"$f":"SUM(F98:F102)","v":27},{"$f":"SUM(G98:G102)","v":19},{"$f":"SUM(H98:H102)","v":11},{"$f":"SUM(I98:I102)","v":24},{"$f":"SUM(J98:J102)","v":17},{"$f":"SUM(K98:K102)","v":24},null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O99:O102)","v":1},{"$f":"SUM(P99:P102)","v":1},1,1,1,1,1,1]
[]
[null,{"$f":"TranslatedPrinciple&\" \"&C105","v":"Principle 5"},5]
[null,{"$f":"$B105&\" \"&LOWER(TranslatedOverallCompliance)&\" \"&TranslatedNA_indicators_excluded","v":"Principle 5 overall compliance (N/A indicators excluded)"},null,null,null,null,null,{"$f":"$B105&\" \"&LOWER(TranslatedCompliance)&\" \"&TranslatedNA_indicators_excluded","v":"Principle 5 compliance (N/A indicators excluded)"},null,null,null,null,{"$f":"TranslatedCompliance_by_Sub_Principle&\" \"&TranslatedNA_indicators_excluded","v":"Compliance by Sub-Principle (N/A indicators excluded)"}]
[]
[]
[null,{"$f":"TranslatedCompliance","v":"Compliance"}]
[null,{"$f":"B105","v":"Principle 5"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"$C105&\".1\"","v":"5.1"},{"$f":"$C105&\".2\"","v":"5.2"},{"$f":"$C105&\".3\"","v":"5.3"}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"SUM(E111:K111)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E110,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F110,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G110,All!$BA$4:$BA$682)","v":0}]
[null,{"$f":"TranslatedRequired&Spacer2&B105","v":"Required - Principle 5"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"SUM(E112:K112)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E110,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F110,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G110,All!$BB$4:$BB$682)","v":0},null,null,null,null,null,{"$f":"\"% \"&TranslatedCompliance&\" \"&TranslatedNA_indicators_excluded","v":"% Compliance (N/A indicators excluded)"}]
[null,null,{"$f":"TranslatedNo","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E110,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F110,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G110,All!$BC$4:$BC$682)","v":0},null,null,null,null,null,{"$f":"B105","v":"Principle 5"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"E110","v":"5.1"},{"$f":"F110","v":"5.2"},{"$f":"G110","v":"5.3"}]
[null,null,{"$f":"TranslatedNA","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E110,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F110,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G110,All!$BD$4:$BD$682)","v":0},null,null,null,null,null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D116=0,0,D111/(D116-D114))","v":0},{"$f":"IF(E116-E114=0,0,E111/(E116-E114))","v":0},{"$f":"IF(F116-F114=0,0,F111/(F116-F114))","v":0},{"$f":"IF(G116-G114=0,0,G111/(G116-G114))","v":0}]
[null,null,{"$f":"TranslatedOther","v":"Other"},68,{"$f":"E116-SUM(E111:E114)","v":8},16,44,null,null,null,null,null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D116=0,0,D112/(D116-D114))","v":0},{"$f":"IF(E116-E114=0,0,E112/(E116-E114))","v":0},{"$f":"IF(F116-F114=0,0,F112/(F116-F114))","v":0},{"$f":"IF(G116-G114=0,0,G112/(G116-G114))","v":0}]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D111:D115)","v":68},{"$f":"SUMIF(All!$C$4:$C$682,E110,All!$AU$4:$AU$682)","v":8},{"$f":"SUMIF(All!$C$4:$C$682,F110,All!$AU$4:$AU$682)","v":16},{"$f":"SUMIF(All!$C$4:$C$682,G110,All!$AU$4:$AU$682)","v":44},null,null,null,null,null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D116=0,0,D113/(D116-D114))","v":0},{"$f":"IF(E116-E114=0,0,E113/(E116-E114))","v":0},{"$f":"IF(F116-F114=0,0,F113/(F116-F114))","v":0},{"$f":"IF(G116-G114=0,0,G113/(G116-G114))","v":0}]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"SUM(E117:K117)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E110,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F110,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G110,All!$BE$4:$BE$682)","v":0},null,null,null,null,null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D116=0,0,D115/(D116-D114))","v":1},{"$f":"IF(E116-E114=0,0,E115/(E116-E114))","v":1},{"$f":"IF(F116-F114=0,0,F115/(F116-F114))","v":1},{"$f":"IF(G116-G114=0,0,G115/(G116-G114))","v":1}]
[null,{"$f":"TranslatedRecommended&Spacer2&B105","v":"Recommended - Principle 5"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"SUM(E118:K118)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E110,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F110,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G110,All!$BF$4:$BF$682)","v":0},null,null,null,null,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O114:O117)","v":1},{"$f":"SUM(P114:P117)","v":1},{"$f":"SUM(Q114:Q117)","v":1},{"$f":"SUM(R114:R117)","v":1}]
[null,null,{"$f":"TranslatedNo","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E110,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F110,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G110,All!$BG$4:$BG$682)","v":0},null,null,null,null,null,{"$f":"TranslatedRecommended","v":"Recommended"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D122=0,0,D117/(D122-D120))","v":0},{"$f":"IF(E122-E120=0,0,E117/(E122-E120))","v":0},{"$f":"IF(F122-F120=0,0,F117/(F122-F120))","v":0},{"$f":"IF(G122-G120=0,0,G117/(G122-G120))","v":0}]
[null,null,{"$f":"TranslatedNA","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E110,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F110,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G110,All!$BH$4:$BH$682)","v":0},null,null,null,null,null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D122=0,0,D118/(D122-D120))","v":0},{"$f":"IF(E122-E120=0,0,E118/(E122-E120))","v":0},{"$f":"IF(F122-F120=0,0,F118/(F122-F120))","v":0},{"$f":"IF(G122-G120=0,0,G118/(G122-G120))","v":0}]
[null,null,{"$f":"TranslatedOther","v":"Other"},72,{"$f":"E122-SUM(E117:E120)","v":8},26,38,null,null,null,null,null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D122=0,0,D119/(D122-D120))","v":0},{"$f":"IF(E122-E120=0,0,E119/(E122-E120))","v":0},{"$f":"IF(F122-F120=0,0,F119/(F122-F120))","v":0},{"$f":"IF(G122-G120=0,0,G119/(G122-G120))","v":0}]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D117:D121)","v":72},{"$f":"SUMIF(All!$C$4:$C$682,E110,All!$AV$4:$AV$682)","v":8},{"$f":"SUMIF(All!$C$4:$C$682,F110,All!$AV$4:$AV$682)","v":26},{"$f":"SUMIF(All!$C$4:$C$682,G110,All!$AV$4:$AV$682)","v":38},null,null,null,null,null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D122=0,0,D121/(D122-D120))","v":1},{"$f":"IF(E122-E120=0,0,E121/(E122-E120))","v":1},{"$f":"IF(F122-F120=0,0,F121/(F122-F120))","v":1},{"$f":"IF(G122-G120=0,0,G121/(G122-G120))","v":1}]
[null,{"$f":"TranslatedAllCategories","v":"All Categories"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"D111+D117","v":0},0,0,0,null,null,null,null,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O119:O122)","v":1},{"$f":"SUM(P119:P122)","v":1},{"$f":"SUM(Q119:Q122)","v":1},{"$f":"SUM(R119:R122)","v":1}]
[null,{"$f":"TranslatedAllCategories&Spacer2&B105","v":"All Categories - Principle 5"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"D112+D118","v":0},0,0,0,null,null,null,null,null,{"$f":"TranslatedAllCategories","v":"All Categories"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D128=0,0,D123/(D128-D126))","v":0},{"$f":"IF(E128-E126=0,0,E123/(E128-E126))","v":0},{"$f":"IF(F128-F126=0,0,F123/(F128-F126))","v":0},{"$f":"IF(G128-G126=0,0,G123/(G128-G126))","v":0}]
[null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"D113+D119","v":0},0,0,0,null,null,null,null,null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D128=0,0,D124/(D128-D126))","v":0},{"$f":"IF(E128-E126=0,0,E124/(E128-E126))","v":0},{"$f":"IF(F128-F126=0,0,F124/(F128-F126))","v":0},{"$f":"IF(G128-G126=0,0,G124/(G128-G126))","v":0}]
[null,null,{"$f":"TranslatedNA","v":"N/A"},{"$f":"D114+D120","v":0},0,0,0,null,null,null,null,null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D128=0,0,D125/(D128-D126))","v":0},{"$f":"IF(E128-E126=0,0,E125/(E128-E126))","v":0},{"$f":"IF(F128-F126=0,0,F125/(F128-F126))","v":0},{"$f":"IF(G128-G126=0,0,G125/(G128-G126))","v":0}]
[null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"D115+D121","v":140},16,42,82,null,null,null,null,null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D128=0,0,D127/(D128-D126))","v":1},{"$f":"IF(E128-E126=0,0,E127/(E128-E126))","v":1},{"$f":"IF(F128-F126=0,0,F127/(F128-F126))","v":1},{"$f":"IF(G128-G126=0,0,G127/(G128-G126))","v":1}]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D123:D127)","v":140},{"$f":"SUM(E123:E127)","v":16},{"$f":"SUM(F123:F127)","v":42},{"$f":"SUM(G123:G127)","v":82},null,null,null,null,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O124:O127)","v":1},{"$f":"SUM(P124:P127)","v":1},{"$f":"SUM(Q124:Q127)","v":1},{"$f":"SUM(R124:R127)","v":1}]
[]
[null,{"$f":"TranslatedPrinciple&\" \"&C130","v":"Principle 6"},6]
[null,{"$f":"$B130&\" \"&LOWER(TranslatedOverallCompliance)&\" \"&TranslatedNA_indicators_excluded","v":"Principle 6 overall compliance (N/A indicators excluded)"},null,null,null,null,null,{"$f":"$B130&\" \"&LOWER(TranslatedCompliance)&\" \"&TranslatedNA_indicators_excluded","v":"Principle 6 compliance (N/A indicators excluded)"},null,null,null,null,{"$f":"TranslatedCompliance_by_Sub_Principle&\" \"&TranslatedNA_indicators_excluded","v":"Compliance by Sub-Principle (N/A indicators excluded)"}]
[]
[]
[null,{"$f":"TranslatedCompliance","v":"Compliance"}]
[null,{"$f":"B130","v":"Principle 6"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"$C130&\".1\"","v":"6.1"},{"$f":"$C130&\".2\"","v":"6.2"}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"SUM(E136:K136)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E135,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F135,All!$BA$4:$BA$682)","v":0}]
[null,{"$f":"TranslatedRequired&Spacer2&B130","v":"Required - Principle 6"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"SUM(E137:K137)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E135,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F135,All!$BB$4:$BB$682)","v":0},null,null,null,null,null,null,{"$f":"\"% \"&TranslatedCompliance&\" \"&TranslatedNA_indicators_excluded","v":"% Compliance (N/A indicators excluded)"}]
[null,null,{"$f":"TranslatedNo","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E135,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F135,All!$BC$4:$BC$682)","v":0},null,null,null,null,null,null,{"$f":"B130","v":"Principle 6"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"E135","v":"6.1"},{"$f":"F135","v":"6.2"}]
[null,null,{"$f":"TranslatedNA","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E135,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F135,All!$BD$4:$BD$682)","v":0},null,null,null,null,null,null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D141=0,0,D136/(D141-D139))","v":0},{"$f":"IF(E141-E139=0,0,E136/(E141-E139))","v":0},{"$f":"IF(F141-F139=0,0,F136/(F141-F139))","v":0}]
[null,null,{"$f":"TranslatedOther","v":"Other"},16,{"$f":"E141-SUM(E136:E139)","v":7},9,null,null,null,null,null,null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D141=0,0,D137/(D141-D139))","v":0},{"$f":"IF(E141-E139=0,0,E137/(E141-E139))","v":0},{"$f":"IF(F141-F139=0,0,F137/(F141-F139))","v":0}]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D136:D140)","v":16},{"$f":"SUMIF(All!$C$4:$C$682,E135,All!$AU$4:$AU$682)","v":7},{"$f":"SUMIF(All!$C$4:$C$682,F135,All!$AU$4:$AU$682)","v":9},null,null,null,null,null,null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D141=0,0,D138/(D141-D139))","v":0},{"$f":"IF(E141-E139=0,0,E138/(E141-E139))","v":0},{"$f":"IF(F141-F139=0,0,F138/(F141-F139))","v":0}]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"SUM(E142:K142)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E135,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F135,All!$BE$4:$BE$682)","v":0},null,null,null,null,null,null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D141=0,0,D140/(D141-D139))","v":1},{"$f":"IF(E141-E139=0,0,E140/(E141-E139))","v":1},{"$f":"IF(F141-F139=0,0,F140/(F141-F139))","v":1}]
[null,{"$f":"TranslatedRecommended&Spacer2&B130","v":"Recommended - Principle 6"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"SUM(E143:K143)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E135,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F135,All!$BF$4:$BF$682)","v":0},null,null,null,null,null,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O139:O142)","v":1},{"$f":"SUM(P139:P142)","v":1},{"$f":"SUM(Q139:Q142)","v":1}]
[null,null,{"$f":"TranslatedNo","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E135,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F135,All!$BG$4:$BG$682)","v":0},null,null,null,null,null,null,{"$f":"TranslatedRecommended","v":"Recommended"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D147=0,0,D142/(D147-D145))","v":0},{"$f":"IF(E147-E145=0,0,E142/(E147-E145))","v":0},{"$f":"IF(F147-F145=0,0,F142/(F147-F145))","v":0}]
[null,null,{"$f":"TranslatedNA","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E135,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F135,All!$BH$4:$BH$682)","v":0},null,null,null,null,null,null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D147=0,0,D143/(D147-D145))","v":0},{"$f":"IF(E147-E145=0,0,E143/(E147-E145))","v":0},{"$f":"IF(F147-F145=0,0,F143/(F147-F145))","v":0}]
[null,null,{"$f":"TranslatedOther","v":"Other"},20,{"$f":"E147-SUM(E142:E145)","v":11},9,null,null,null,null,null,null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D147=0,0,D144/(D147-D145))","v":0},{"$f":"IF(E147-E145=0,0,E144/(E147-E145))","v":0},{"$f":"IF(F147-F145=0,0,F144/(F147-F145))","v":0}]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D142:D146)","v":20},{"$f":"SUMIF(All!$C$4:$C$682,E135,All!$AV$4:$AV$682)","v":11},{"$f":"SUMIF(All!$C$4:$C$682,F135,All!$AV$4:$AV$682)","v":9},null,null,null,null,null,null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D147=0,0,D146/(D147-D145))","v":1},{"$f":"IF(E147-E145=0,0,E146/(E147-E145))","v":1},{"$f":"IF(F147-F145=0,0,F146/(F147-F145))","v":1}]
[null,{"$f":"TranslatedAllCategories","v":"All Categories"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"D136+D142","v":0},0,0,null,null,null,null,null,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O144:O147)","v":1},{"$f":"SUM(P144:P147)","v":1},{"$f":"SUM(Q144:Q147)","v":1}]
[null,{"$f":"TranslatedAllCategories&Spacer2&B130","v":"All Categories - Principle 6"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"D137+D143","v":0},0,0,null,null,null,null,null,null,{"$f":"TranslatedAllCategories","v":"All Categories"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D153=0,0,D148/(D153-D151))","v":0},{"$f":"IF(E153-E151=0,0,E148/(E153-E151))","v":0},{"$f":"IF(F153-F151=0,0,F148/(F153-F151))","v":0}]
[null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"D138+D144","v":0},0,0,null,null,null,null,null,null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D153=0,0,D149/(D153-D151))","v":0},{"$f":"IF(E153-E151=0,0,E149/(E153-E151))","v":0},{"$f":"IF(F153-F151=0,0,F149/(F153-F151))","v":0}]
[null,null,{"$f":"TranslatedNA","v":"N/A"},{"$f":"D139+D145","v":0},0,0,null,null,null,null,null,null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D153=0,0,D150/(D153-D151))","v":0},{"$f":"IF(E153-E151=0,0,E150/(E153-E151))","v":0},{"$f":"IF(F153-F151=0,0,F150/(F153-F151))","v":0}]
[null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"D140+D146","v":36},18,18,null,null,null,null,null,null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D153=0,0,D152/(D153-D151))","v":1},{"$f":"IF(E153-E151=0,0,E152/(E153-E151))","v":1},{"$f":"IF(F153-F151=0,0,F152/(F153-F151))","v":1}]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D148:D152)","v":36},{"$f":"SUM(E148:E152)","v":18},{"$f":"SUM(F148:F152)","v":18},null,null,null,null,null,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O149:O152)","v":1},{"$f":"SUM(P149:P152)","v":1},{"$f":"SUM(Q149:Q152)","v":1}]
[]
[null,{"$f":"TranslatedPrinciple&\" \"&C155","v":"Principle 7"},7]
[null,{"$f":"$B155&\" \"&LOWER(TranslatedOverallCompliance)&\" \"&TranslatedNA_indicators_excluded","v":"Principle 7 overall compliance (N/A indicators excluded)"},null,null,null,null,null,{"$f":"$B155&\" \"&LOWER(TranslatedCompliance)&\" \"&TranslatedNA_indicators_excluded","v":"Principle 7 compliance (N/A indicators excluded)"},null,null,null,null,{"$f":"TranslatedCompliance_by_Sub_Principle&\" \"&TranslatedNA_indicators_excluded","v":"Compliance by Sub-Principle (N/A indicators excluded)"}]
[]
[]
[null,{"$f":"TranslatedCompliance","v":"Compliance"}]
[null,{"$f":"B155","v":"Principle 7"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"$C155&\".1\"","v":"7.1"},{"$f":"$C155&\".2\"","v":"7.2"},{"$f":"$C155&\".3\"","v":"7.3"}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"SUM(E161:K161)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E160,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F160,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G160,All!$BA$4:$BA$682)","v":0}]
[null,{"$f":"TranslatedRequired&Spacer2&B155","v":"Required - Principle 7"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"SUM(E162:K162)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E160,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F160,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G160,All!$BB$4:$BB$682)","v":0},null,null,null,null,null,{"$f":"\"% \"&TranslatedCompliance&\" \"&TranslatedNA_indicators_excluded","v":"% Compliance (N/A indicators excluded)"}]
[null,null,{"$f":"TranslatedNo","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E160,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F160,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G160,All!$BC$4:$BC$682)","v":0},null,null,null,null,null,{"$f":"B155","v":"Principle 7"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"E160","v":"7.1"},{"$f":"F160","v":"7.2"},{"$f":"G160","v":"7.3"}]
[null,null,{"$f":"TranslatedNA","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E160,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F160,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G160,All!$BD$4:$BD$682)","v":0},null,null,null,null,null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D166=0,0,D161/(D166-D164))","v":0},{"$f":"IF(E166-E164=0,0,E161/(E166-E164))","v":0},{"$f":"IF(F166-F164=0,0,F161/(F166-F164))","v":0},{"$f":"IF(G166-G164=0,0,G161/(G166-G164))","v":0}]
[null,null,{"$f":"TranslatedOther","v":"Other"},23,{"$f":"E166-SUM(E161:E164)","v":19},3,1,null,null,null,null,null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D166=0,0,D162/(D166-D164))","v":0},{"$f":"IF(E166-E164=0,0,E162/(E166-E164))","v":0},{"$f":"IF(F166-F164=0,0,F162/(F166-F164))","v":0},{"$f":"IF(G166-G164=0,0,G162/(G166-G164))","v":0}]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D161:D165)","v":23},{"$f":"SUMIF(All!$C$4:$C$682,E160,All!$AU$4:$AU$682)","v":19},{"$f":"SUMIF(All!$C$4:$C$682,F160,All!$AU$4:$AU$682)","v":3},{"$f":"SUMIF(All!$C$4:$C$682,G160,All!$AU$4:$AU$682)","v":1},null,null,null,null,null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D166=0,0,D163/(D166-D164))","v":0},{"$f":"IF(E166-E164=0,0,E163/(E166-E164))","v":0},{"$f":"IF(F166-F164=0,0,F163/(F166-F164))","v":0},{"$f":"IF(G166-G164=0,0,G163/(G166-G164))","v":0}]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"SUM(E167:K167)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E160,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F160,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G160,All!$BE$4:$BE$682)","v":0},null,null,null,null,null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D166=0,0,D165/(D166-D164))","v":1},{"$f":"IF(E166-E164=0,0,E165/(E166-E164))","v":1},{"$f":"IF(F166-F164=0,0,F165/(F166-F164))","v":1},{"$f":"IF(G166-G164=0,0,G165/(G166-G164))","v":1}]
[null,{"$f":"TranslatedRecommended&Spacer2&B155","v":"Recommended - Principle 7"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"SUM(E168:K168)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E160,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F160,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G160,All!$BF$4:$BF$682)","v":0},null,null,null,null,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O164:O167)","v":1},{"$f":"SUM(P164:P167)","v":1},{"$f":"SUM(Q164:Q167)","v":1},{"$f":"SUM(R164:R167)","v":1}]
[null,null,{"$f":"TranslatedNo","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E160,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F160,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G160,All!$BG$4:$BG$682)","v":0},null,null,null,null,null,{"$f":"TranslatedRecommended","v":"Recommended"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D172=0,0,D167/(D172-D170))","v":0},{"$f":"IF(E172-E170=0,0,E167/(E172-E170))","v":0},{"$f":"IF(F172-F170=0,0,F167/(F172-F170))","v":0},{"$f":"IF(G172-G170=0,0,G167/(G172-G170))","v":0}]
[null,null,{"$f":"TranslatedNA","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E160,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F160,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G160,All!$BH$4:$BH$682)","v":0},null,null,null,null,null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D172=0,0,D168/(D172-D170))","v":0},{"$f":"IF(E172-E170=0,0,E168/(E172-E170))","v":0},{"$f":"IF(F172-F170=0,0,F168/(F172-F170))","v":0},{"$f":"IF(G172-G170=0,0,G168/(G172-G170))","v":0}]
[null,null,{"$f":"TranslatedOther","v":"Other"},38,{"$f":"E172-SUM(E167:E170)","v":22},9,7,null,null,null,null,null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D172=0,0,D169/(D172-D170))","v":0},{"$f":"IF(E172-E170=0,0,E169/(E172-E170))","v":0},{"$f":"IF(F172-F170=0,0,F169/(F172-F170))","v":0},{"$f":"IF(G172-G170=0,0,G169/(G172-G170))","v":0}]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D167:D171)","v":38},{"$f":"SUMIF(All!$C$4:$C$682,E160,All!$AV$4:$AV$682)","v":22},{"$f":"SUMIF(All!$C$4:$C$682,F160,All!$AV$4:$AV$682)","v":9},{"$f":"SUMIF(All!$C$4:$C$682,G160,All!$AV$4:$AV$682)","v":7},null,null,null,null,null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D172=0,0,D171/(D172-D170))","v":1},{"$f":"IF(E172-E170=0,0,E171/(E172-E170))","v":1},{"$f":"IF(F172-F170=0,0,F171/(F172-F170))","v":1},{"$f":"IF(G172-G170=0,0,G171/(G172-G170))","v":1}]
[null,{"$f":"TranslatedAllCategories","v":"All Categories"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"D161+D167","v":0},0,0,0,null,null,null,null,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O169:O172)","v":1},{"$f":"SUM(P169:P172)","v":1},{"$f":"SUM(Q169:Q172)","v":1},{"$f":"SUM(R169:R172)","v":1}]
[null,{"$f":"TranslatedAllCategories&Spacer2&B155","v":"All Categories - Principle 7"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"D162+D168","v":0},0,0,0,null,null,null,null,null,{"$f":"TranslatedAllCategories","v":"All Categories"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D178=0,0,D173/(D178-D176))","v":0},{"$f":"IF(E178-E176=0,0,E173/(E178-E176))","v":0},{"$f":"IF(F178-F176=0,0,F173/(F178-F176))","v":0},{"$f":"IF(G178-G176=0,0,G173/(G178-G176))","v":0}]
[null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"D163+D169","v":0},0,0,0,null,null,null,null,null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D178=0,0,D174/(D178-D176))","v":0},{"$f":"IF(E178-E176=0,0,E174/(E178-E176))","v":0},{"$f":"IF(F178-F176=0,0,F174/(F178-F176))","v":0},{"$f":"IF(G178-G176=0,0,G174/(G178-G176))","v":0}]
[null,null,{"$f":"TranslatedNA","v":"N/A"},{"$f":"D164+D170","v":0},0,0,0,null,null,null,null,null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D178=0,0,D175/(D178-D176))","v":0},{"$f":"IF(E178-E176=0,0,E175/(E178-E176))","v":0},{"$f":"IF(F178-F176=0,0,F175/(F178-F176))","v":0},{"$f":"IF(G178-G176=0,0,G175/(G178-G176))","v":0}]
[null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"D165+D171","v":61},41,12,8,null,null,null,null,null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D178=0,0,D177/(D178-D176))","v":1},{"$f":"IF(E178-E176=0,0,E177/(E178-E176))","v":1},{"$f":"IF(F178-F176=0,0,F177/(F178-F176))","v":1},{"$f":"IF(G178-G176=0,0,G177/(G178-G176))","v":1}]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D173:D177)","v":61},{"$f":"SUM(E173:E177)","v":41},{"$f":"SUM(F173:F177)","v":12},{"$f":"SUM(G173:G177)","v":8},null,null,null,null,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O174:O177)","v":1},{"$f":"SUM(P174:P177)","v":1},{"$f":"SUM(Q174:Q177)","v":1},{"$f":"SUM(R174:R177)","v":1}]
[]
[null,{"$f":"TranslatedPrinciple&\" \"&C180","v":"Principle 8"},8]
[null,{"$f":"$B180&\" \"&LOWER(TranslatedOverallCompliance)&\" \"&TranslatedNA_indicators_excluded","v":"Principle 8 overall compliance (N/A indicators excluded)"},null,null,null,null,null,{"$f":"$B180&\" \"&LOWER(TranslatedCompliance)&\" \"&TranslatedNA_indicators_excluded","v":"Principle 8 compliance (N/A indicators excluded)"},null,null,null,null,{"$f":"TranslatedCompliance_by_Sub_Principle&\" \"&TranslatedNA_indicators_excluded","v":"Compliance by Sub-Principle (N/A indicators excluded)"}]
[]
[]
[null,{"$f":"TranslatedCompliance","v":"Compliance"}]
[null,{"$f":"B180","v":"Principle 8"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"$C180&\".1\"","v":"8.1"},{"$f":"$C180&\".2\"","v":"8.2"},{"$f":"$C180&\".3\"","v":"8.3"},{"$f":"$C180&\".4\"","v":"8.4"}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"SUM(E186:K186)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E185,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F185,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G185,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H185,All!$BA$4:$BA$682)","v":0}]
[null,{"$f":"TranslatedRequired&Spacer2&B180","v":"Required - Principle 8"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"SUM(E187:K187)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E185,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F185,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G185,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H185,All!$BB$4:$BB$682)","v":0},null,null,null,null,{"$f":"\"% \"&TranslatedCompliance&\" \"&TranslatedNA_indicators_excluded","v":"% Compliance (N/A indicators excluded)"}]
[null,null,{"$f":"TranslatedNo","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E185,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F185,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G185,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H185,All!$BC$4:$BC$682)","v":0},null,null,null,null,{"$f":"B180","v":"Principle 8"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"E185","v":"8.1"},{"$f":"F185","v":"8.2"},{"$f":"G185","v":"8.3"},{"$f":"H185","v":"8.4"}]
[null,null,{"$f":"TranslatedNA","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E185,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F185,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G185,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H185,All!$BD$4:$BD$682)","v":0},null,null,null,null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D191=0,0,D186/(D191-D189))","v":0},{"$f":"IF(E191-E189=0,0,E186/(E191-E189))","v":0},{"$f":"IF(F191-F189=0,0,F186/(F191-F189))","v":0},{"$f":"IF(G191-G189=0,0,G186/(G191-G189))","v":0},{"$f":"IF(H191-H189=0,0,H186/(H191-H189))","v":0}]
[null,null,{"$f":"TranslatedOther","v":"Other"},10,{"$f":"E191-SUM(E186:E189)","v":9},0,0,1,null,null,null,null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D191=0,0,D187/(D191-D189))","v":0},{"$f":"IF(E191-E189=0,0,E187/(E191-E189))","v":0},{"$f":"IF(F191-F189=0,0,F187/(F191-F189))","v":0},{"$f":"IF(G191-G189=0,0,G187/(G191-G189))","v":0},{"$f":"IF(H191-H189=0,0,H187/(H191-H189))","v":0}]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D186:D190)","v":10},{"$f":"SUMIF(All!$C$4:$C$682,E185,All!$AU$4:$AU$682)","v":9},{"$f":"SUMIF(All!$C$4:$C$682,F185,All!$AU$4:$AU$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G185,All!$AU$4:$AU$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H185,All!$AU$4:$AU$682)","v":1},null,null,null,null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D191=0,0,D188/(D191-D189))","v":0},{"$f":"IF(E191-E189=0,0,E188/(E191-E189))","v":0},{"$f":"IF(F191-F189=0,0,F188/(F191-F189))","v":0},{"$f":"IF(G191-G189=0,0,G188/(G191-G189))","v":0},{"$f":"IF(H191-H189=0,0,H188/(H191-H189))","v":0}]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"SUM(E192:K192)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E185,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F185,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G185,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H185,All!$BE$4:$BE$682)","v":0},null,null,null,null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D191=0,0,D190/(D191-D189))","v":1},{"$f":"IF(E191-E189=0,0,E190/(E191-E189))","v":1},{"$f":"IF(F191-F189=0,0,F190/(F191-F189))","v":0},{"$f":"IF(G191-G189=0,0,G190/(G191-G189))","v":0},{"$f":"IF(H191-H189=0,0,H190/(H191-H189))","v":1}]
[null,{"$f":"TranslatedRecommended&Spacer2&B180","v":"Recommended - Principle 8"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"SUM(E193:K193)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E185,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F185,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G185,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H185,All!$BF$4:$BF$682)","v":0},null,null,null,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O189:O192)","v":1},{"$f":"SUM(P189:P192)","v":1},{"$f":"SUM(Q189:Q192)","v":0},{"$f":"SUM(R189:R192)","v":0},{"$f":"SUM(S189:S192)","v":1}]
[null,null,{"$f":"TranslatedNo","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E185,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F185,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G185,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H185,All!$BG$4:$BG$682)","v":0},null,null,null,null,{"$f":"TranslatedRecommended","v":"Recommended"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D197=0,0,D192/(D197-D195))","v":0},{"$f":"IF(E197-E195=0,0,E192/(E197-E195))","v":0},{"$f":"IF(F197-F195=0,0,F192/(F197-F195))","v":0},{"$f":"IF(G197-G195=0,0,G192/(G197-G195))","v":0},{"$f":"IF(H197-H195=0,0,H192/(H197-H195))","v":0}]
[null,null,{"$f":"TranslatedNA","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E185,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F185,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G185,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H185,All!$BH$4:$BH$682)","v":0},null,null,null,null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D197=0,0,D193/(D197-D195))","v":0},{"$f":"IF(E197-E195=0,0,E193/(E197-E195))","v":0},{"$f":"IF(F197-F195=0,0,F193/(F197-F195))","v":0},{"$f":"IF(G197-G195=0,0,G193/(G197-G195))","v":0},{"$f":"IF(H197-H195=0,0,H193/(H197-H195))","v":0}]
[null,null,{"$f":"TranslatedOther","v":"Other"},22,{"$f":"E197-SUM(E192:E195)","v":9},4,5,4,null,null,null,null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D197=0,0,D194/(D197-D195))","v":0},{"$f":"IF(E197-E195=0,0,E194/(E197-E195))","v":0},{"$f":"IF(F197-F195=0,0,F194/(F197-F195))","v":0},{"$f":"IF(G197-G195=0,0,G194/(G197-G195))","v":0},{"$f":"IF(H197-H195=0,0,H194/(H197-H195))","v":0}]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D192:D196)","v":22},{"$f":"SUMIF(All!$C$4:$C$682,E185,All!$AV$4:$AV$682)","v":9},{"$f":"SUMIF(All!$C$4:$C$682,F185,All!$AV$4:$AV$682)","v":4},{"$f":"SUMIF(All!$C$4:$C$682,G185,All!$AV$4:$AV$682)","v":5},{"$f":"SUMIF(All!$C$4:$C$682,H185,All!$AV$4:$AV$682)","v":4},null,null,null,null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D197=0,0,D196/(D197-D195))","v":1},{"$f":"IF(E197-E195=0,0,E196/(E197-E195))","v":1},{"$f":"IF(F197-F195=0,0,F196/(F197-F195))","v":1},{"$f":"IF(G197-G195=0,0,G196/(G197-G195))","v":1},{"$f":"IF(H197-H195=0,0,H196/(H197-H195))","v":1}]
[null,{"$f":"TranslatedAllCategories","v":"All Categories"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"D186+D192","v":0},0,0,0,0,null,null,null,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O194:O197)","v":1},{"$f":"SUM(P194:P197)","v":1},{"$f":"SUM(Q194:Q197)","v":1},{"$f":"SUM(R194:R197)","v":1},{"$f":"SUM(S194:S197)","v":1}]
[null,{"$f":"TranslatedAllCategories&Spacer2&B180","v":"All Categories - Principle 8"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"D187+D193","v":0},0,0,0,0,null,null,null,null,{"$f":"TranslatedAllCategories","v":"All Categories"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D203=0,0,D198/(D203-D201))","v":0},{"$f":"IF(E203-E201=0,0,E198/(E203-E201))","v":0},{"$f":"IF(F203-F201=0,0,F198/(F203-F201))","v":0},{"$f":"IF(G203-G201=0,0,G198/(G203-G201))","v":0},{"$f":"IF(H203-H201=0,0,H198/(H203-H201))","v":0}]
[null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"D188+D194","v":0},0,0,0,0,null,null,null,null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D203=0,0,D199/(D203-D201))","v":0},{"$f":"IF(E203-E201=0,0,E199/(E203-E201))","v":0},{"$f":"IF(F203-F201=0,0,F199/(F203-F201))","v":0},{"$f":"IF(G203-G201=0,0,G199/(G203-G201))","v":0},{"$f":"IF(H203-H201=0,0,H199/(H203-H201))","v":0}]
[null,null,{"$f":"TranslatedNA","v":"N/A"},{"$f":"D189+D195","v":0},0,0,0,0,null,null,null,null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D203=0,0,D200/(D203-D201))","v":0},{"$f":"IF(E203-E201=0,0,E200/(E203-E201))","v":0},{"$f":"IF(F203-F201=0,0,F200/(F203-F201))","v":0},{"$f":"IF(G203-G201=0,0,G200/(G203-G201))","v":0},{"$f":"IF(H203-H201=0,0,H200/(H203-H201))","v":0}]
[null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"D190+D196","v":32},18,4,5,5,null,null,null,null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D203=0,0,D202/(D203-D201))","v":1},{"$f":"IF(E203-E201=0,0,E202/(E203-E201))","v":1},{"$f":"IF(F203-F201=0,0,F202/(F203-F201))","v":1},{"$f":"IF(G203-G201=0,0,G202/(G203-G201))","v":1},{"$f":"IF(H203-H201=0,0,H202/(H203-H201))","v":1}]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D198:D202)","v":32},{"$f":"SUM(E198:E202)","v":18},{"$f":"SUM(F198:F202)","v":4},{"$f":"SUM(G198:G202)","v":5},{"$f":"SUM(H198:H202)","v":5},null,null,null,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O199:O202)","v":1},{"$f":"SUM(P199:P202)","v":1},{"$f":"SUM(Q199:Q202)","v":1},{"$f":"SUM(R199:R202)","v":1},{"$f":"SUM(S199:S202)","v":1}]
[]
[null,"Checksums",{"$f":"TranslatedPrinciple","v":"Principle"},{"$f":"TranslatedAll","v":"All"},".1",".2",".3",".4",".5",".6",".7"]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"C10","v":0},{"$f":"D16","v":15},{"$f":"E16","v":8},{"$f":"F16","v":7}]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},null,{"$f":"D22","v":8},{"$f":"E22","v":3},{"$f":"F22","v":5}]
[null,{"$f":"TranslatedTotal&\" \"&TranslatedPrinciple&\" \"&C206","v":"Total Principle 0"},null,{"$f":"D28","v":23},{"$f":"E28","v":11},12]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"C35","v":0},{"$f":"D41","v":56},{"$f":"E41","v":10},{"$f":"F41","v":6},{"$f":"G41","v":5},3,15,5,12]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},null,{"$f":"D47","v":55},{"$f":"E47","v":1},{"$f":"F47","v":0},{"$f":"G47","v":2},11,24,4,13]
[null,{"$f":"TranslatedTotal&\" \"&TranslatedPrinciple&\" \"&C209","v":"Total Principle 0"},null,{"$f":"D53","v":111},{"$f":"E53","v":11},{"$f":"F53","v":6},{"$f":"G53","v":7},14,39,9,25]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"C60","v":0},{"$f":"D66","v":30},{"$f":"E66","v":11},{"$f":"F66","v":6},{"$f":"G66","v":2},{"$f":"H66","v":11}]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},null,{"$f":"D72","v":51},{"$f":"E72","v":16},{"$f":"F72","v":4},{"$f":"G72","v":9},{"$f":"H72","v":22}]
[null,{"$f":"TranslatedTotal&\" \"&TranslatedPrinciple&\" \"&C212","v":"Total Principle 0"},null,{"$f":"D78","v":81},{"$f":"E78","v":27},{"$f":"F78","v":10},{"$f":"G78","v":11},{"$f":"H78","v":33}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"C85","v":0},{"$f":"D91","v":63},6,14,6,3,10,9,15]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},null,{"$f":"D97","v":69},4,13,13,8,14,8,9]
[null,{"$f":"TranslatedTotal&\" \"&TranslatedPrinciple&\" \"&C215","v":"Total Principle 0"},null,{"$f":"D103","v":132},10,27,19,11,24,17,24]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"C110","v":0},{"$f":"D116","v":68},{"$f":"E116","v":8},{"$f":"F116","v":16},{"$f":"G116","v":44}]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},null,{"$f":"D122","v":72},{"$f":"E122","v":8},{"$f":"F122","v":26},{"$f":"G122","v":38}]
[null,{"$f":"TranslatedTotal&\" \"&TranslatedPrinciple&\" \"&C218","v":"Total Principle 0"},null,{"$f":"D128","v":140},{"$f":"E128","v":16},{"$f":"F128","v":42},{"$f":"G128","v":82}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"C135","v":0},{"$f":"D141","v":16},{"$f":"E141","v":7},{"$f":"F141","v":9}]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},null,{"$f":"D147","v":20},{"$f":"E147","v":11},{"$f":"F147","v":9}]
[null,{"$f":"TranslatedTotal&\" \"&TranslatedPrinciple&\" \"&C221","v":"Total Principle 0"},null,{"$f":"D153","v":36},{"$f":"E153","v":18},{"$f":"F153","v":18}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"C160","v":0},{"$f":"D166","v":23},{"$f":"E166","v":19},{"$f":"F166","v":3},{"$f":"G166","v":1}]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},null,{"$f":"D172","v":38},{"$f":"E172","v":22},{"$f":"F172","v":9},{"$f":"G172","v":7}]
[null,{"$f":"TranslatedTotal&\" \"&TranslatedPrinciple&\" \"&C224","v":"Total Principle 0"},null,{"$f":"D178","v":61},{"$f":"E178","v":41},{"$f":"F178","v":12},{"$f":"G178","v":8}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"C185","v":0},{"$f":"D191","v":10},{"$f":"E191","v":9},{"$f":"F191","v":0},{"$f":"G191","v":0},{"$f":"H191","v":1}]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},null,{"$f":"D197","v":22},{"$f":"E197","v":9},{"$f":"F197","v":4},{"$f":"G197","v":5},{"$f":"H197","v":4}]
[null,{"$f":"TranslatedTotal&\" \"&TranslatedPrinciple&\" \"&C227","v":"Total Principle 0"},null,{"$f":"D203","v":32},{"$f":"E203","v":18},{"$f":"F203","v":4},{"$f":"G203","v":5},{"$f":"H203","v":5}]
[null,{"$f":"TranslatedRequired","v":"Required"},null,{"$f":"SUM(D206,D209,D212,D215,D218,D221,D224,D227)","v":281},78,61,58,18,25,14,27]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},null,335,74,70,74,45,38,12,22]
[null,{"$f":"TranslatedTotal&\" \"&TranslatedPrinciple&\" \"&C230","v":"Total Principle "},null,616,152,131,132,63,63,26,49]

{"sheet":"Self-assessment charts (pie)","index":12,"n_rows":203,"n_cols":68,"rows_kept":203,"cut":false,"hidden":true,"merged":[[1,1,1,21],[1,24,1,34],[1,36,1,46],[1,48,1,58],[1,60,1,70],[2,1,2,21],[2,24,2,34],[2,36,2,46],[2,48,2,58],[2,60,2,70]]}
[]
[null,{"$f":"CHOOSE(LanguageNumber,Y2,AK2,AW2,BI2)","v":"Charts of self-assessment responses"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Charts of self-assessment responses",null,null,null,null,null,null,null,null,null,null,null,"Synthèse des réponses à l'auto-évaluation"]
[null,{"$f":"CHOOSE(LanguageNumber,Y3,AK3,AW3,BI3)","v":"This worksheet provides a high-level summary of Code of Conduct compliance that is suitable for review by senior management. The data is automatically generated from the 'Compliant?' responses in Column M of each of the sub-Principle worksheets. Note that the pie charts and bar charts do not include N/A responses, as they focus on compliance with applicable Indicators only. Data in the table highlighted in orange can be used to complete the 'Overall Compliance' workbook, a separate Excel file that looks at compliance across all 8 Principles of the Code of Conduct. For more information, please see the Instructions."},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"This worksheet provides a high-level summary of Code of Conduct compliance that is suitable for review by senior management. The data is automatically generated from the 'Compliant?' responses in Column M of each of the sub-Principle worksheets. Note that the pie charts and bar charts do not include N/A responses, as they focus on compliance with applicable Indicators only. Data in the table highlighted in orange can be used to complete the 'Overall Compliance' workbook, a separate Excel file that looks at compliance across all 8 Principles of the Code of Conduct. For more information, please see the Instructions.",null,null,null,null,null,null,null,null,null,null,null,"Cette feuille de calcul fournit une synthèse générale de la conformité au Code de conduite ; cette synthèse est adaptée à un examen par la direction de l’entreprise. Ces informations sont générées de façon automatique à partir des réponses enregistrées dans la colonne \"Conforme ?\" (Colonne M) de chaque feuille de sous-principe. Il convient de noter que les diagrammes circulaires et les histogrammes ignorent les réponses \"n/a\" car ils portent uniquement sur le respect des indicateurs applicables. Les données figurant dans la partie orangée du premier tableau peuvent servir à compléter le fichier \"Conformité globale\", un fichier Excel distinct qui examine la conformité aux huit principes du Code de conduite. Pour de plus amples renseignements, se référer aux Instructions."]
[]
[null,{"$f":"TranslatedPrinciple&\" \"&C10","v":"Principle 1"}]
[null,{"$f":"CHOOSE(LanguageNumber,Y6,AK6,AW6,BI6)","v":"Principle 1 overall compliance (N/A Indicators excluded)"},null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,AC6,AO6,BA6,BM6)","v":"Principle 1 compliance (N/A excluded)"},null,null,null,null,{"$f":"CHOOSE(LanguageNumber,AF6,AR6,BD6,BT6)","v":"Compliance for Required Indicators (N/A Indicators excluded)"},null,null,null,null,null,null,null,null,null,null,null,"Principle 1 overall compliance (N/A Indicators excluded)",null,null,null,"Principle 1 compliance (N/A excluded)",null,null,"Compliance for Required Indicators (N/A Indicators excluded)",null,null,null,null,"Principe 1 conformité globale (hors indicateurs n/d)",null,null,null,"Principe 1 conformité (hors indicateurs n/d)",null,null,"FR Compliance for Required Indicators (N/A Indicators excluded)",null,null,null,null,"ES Principe 1 conformité globale (hors indicateurs n/d)",null,null,null,"ES Principe 1 conformité (hors indicateurs n/d)",null,null,"ES Compliance for Required Indicators (N/A Indicators excluded)",null,null,null,null,"YY Principe 1 conformité globale (hors indicateurs n/d)",null,null,null,"YY Principle 1 compliance (N/A excluded)",null,null,"YY Compliance for Required Indicators (N/A Indicators excluded)"]
[]
[]
[null,{"$f":"CHOOSE(LanguageNumber,Y9,AK9,AW9,BI9)","v":"Compliance"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Compliance",null,null,null,null,null,null,null,null,null,null,null,"Conformité",null,null,null,null,null,null,null,null,null,null,null,"ES Compliance",null,null,null,null,null,null,null,null,null,null,null,"YY Compliance"]
[null,{"$f":"B5","v":"Principle 1"},1,{"$f":"TranslatedAll","v":"All"},{"$f":"$C10&\".1\"","v":"1.1"},{"$f":"$C10&\".2\"","v":"1.2"},{"$f":"$C10&\".3\"","v":"1.3"},{"$f":"$C10&\".4\"","v":"1.4"},{"$f":"$C10&\".5\"","v":"1.5"},{"$f":"$C10&\".6\"","v":"1.6"},{"$f":"$C10&\".7\"","v":"1.7"}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"SUM(E11:K11)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E10,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F10,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G10,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H10,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I10,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J10,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K10,All!$BA$4:$BA$682)","v":0}]
[null,{"$f":"B11&Spacer2&B10","v":"Required - Principle 1"},{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"SUM(E12:K12)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E10,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F10,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G10,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H10,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I10,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J10,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K10,All!$BC$4:$BC$682)","v":0},null,{"$f":"CHOOSE(LanguageNumber,Y12,AK12,AW12,BI12)","v":"% Compliance (N/A Indicators excluded)"},null,null,null,null,null,null,null,null,null,null,null,"% Compliance (N/A Indicators excluded)",null,null,null,null,null,null,null,null,null,null,null,"% conformité (hors indicateurs n/d)",null,null,null,null,null,null,null,null,null,null,null,"ES % Compliance (N/A Indicators excluded)",null,null,null,null,null,null,null,null,null,null,null,"YY % Compliance (N/A Indicators excluded)"]
[null,null,{"$f":"Drivers!$G$55","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E10,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F10,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G10,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H10,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I10,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J10,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K10,All!$BB$4:$BB$682)","v":0},null,{"$f":"B10","v":"Principle 1"},null,{"$f":"D10","v":"All"},{"$f":"E10","v":"1.1"},{"$f":"F10","v":"1.2"}]
[null,null,{"$f":"Drivers!$G$56","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E10,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F10,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G10,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H10,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I10,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J10,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K10,All!$BD$4:$BD$682)","v":0},null,{"$f":"B12","v":"Required - Principle 1"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"IF(D16=0,0,D11/(D16-D14))","v":0},0,0]
[null,null,{"$f":"Drivers!$G$57","v":"Other"},15,{"$f":"E16-SUM(E11:E14)","v":8},7,0,0,0,0,0,null,null,{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"IF(D16=0,0,D12/(D16-D14))","v":0},0,0]
[null,null,{"$f":"TranslatedTotal&\" \"&B11","v":"Total Required"},{"$f":"SUM(D11:D15)","v":15},{"$f":"SUMIF(All!$C$4:$C$682,E10,All!$AU$4:$AU$682)","v":8},{"$f":"SUMIF(All!$C$4:$C$682,F10,All!$AU$4:$AU$682)","v":7},{"$f":"SUMIF(All!$C$4:$C$682,G10,All!$AU$4:$AU$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H10,All!$AU$4:$AU$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I10,All!$AU$4:$AU$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J10,All!$AU$4:$AU$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K10,All!$AU$4:$AU$682)","v":0},null,null,{"$f":"Drivers!$G$55","v":"No"},{"$f":"IF(D16=0,0,D13/(D16-D14))","v":0},0,0]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"SUM(E17:K17)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E10,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F10,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G10,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H10,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I10,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J10,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K10,All!$BE$4:$BE$682)","v":0},null,null,{"$f":"Drivers!$G$57","v":"Other"},{"$f":"IF(D16=0,0,D15/(D16-D14))","v":1},1,1]
[null,{"$f":"B17&Spacer2&B10","v":"Recommended - Principle 1"},{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"SUM(E18:K18)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E10,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F10,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G10,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H10,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I10,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J10,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K10,All!$BG$4:$BG$682)","v":0},null,null,{"$f":"TranslatedTotal&\" \"&M14","v":"Total Required - Principle 1"},{"$f":"SUM(O14:O17)","v":1},1,1]
[null,null,{"$f":"Drivers!$G$55","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E10,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F10,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G10,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H10,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I10,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J10,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K10,All!$BF$4:$BF$682)","v":0},null,{"$f":"B18","v":"Recommended - Principle 1"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"IF(D22=0,0,D17/(D22-D20))","v":0},0,0]
[null,null,{"$f":"Drivers!$G$56","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E10,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F10,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G10,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H10,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I10,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J10,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K10,All!$BH$4:$BH$682)","v":0},null,null,{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"IF(D22=0,0,D18/(D22-D20))","v":0},0,0]
[null,null,{"$f":"Drivers!$G$57","v":"Other"},8,{"$f":"E22-SUM(E17:E20)","v":3},5,0,0,0,0,0,null,null,{"$f":"Drivers!$G$55","v":"No"},{"$f":"IF(D22=0,0,D19/(D22-D20))","v":0},0,0]
[null,null,{"$f":"TranslatedTotal&\" \"&B17","v":"Total Recommended"},{"$f":"SUM(D17:D21)","v":8},{"$f":"SUMIF(All!$C$4:$C$682,E10,All!$AV$4:$AV$682)","v":3},{"$f":"SUMIF(All!$C$4:$C$682,F10,All!$AV$4:$AV$682)","v":5},{"$f":"SUMIF(All!$C$4:$C$682,G10,All!$AV$4:$AV$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H10,All!$AV$4:$AV$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I10,All!$AV$4:$AV$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J10,All!$AV$4:$AV$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K10,All!$AV$4:$AV$682)","v":0},null,null,{"$f":"Drivers!$G$57","v":"Other"},{"$f":"IF(D22=0,0,D21/(D22-D20))","v":1},1,1]
[null,{"$f":"CHOOSE(LanguageNumber,Y23,AK23,AW23,BI23)","v":"All Categories"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"D11+D17","v":0},0,0,0,0,0,0,0,null,null,{"$f":"TranslatedTotal&\" \"&M19","v":"Total Recommended - Principle 1"},{"$f":"SUM(O19:O22)","v":1},1,1,null,null,null,null,null,null,null,"All Categories",null,null,null,null,null,null,null,null,null,null,null,"Toutes catégories",null,null,null,null,null,null,null,null,null,null,null,"ES All Categories",null,null,null,null,null,null,null,null,null,null,null,"YY All Categories"]
[null,null,{"$f":"Drivers!$G$54","v":"Partial"},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$55","v":"No"},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$56","v":"N/A"},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$57","v":"Other"},23,11,12,0,0,0,0,0]
[null,null,{"$f":"TranslatedTotal&\" \"&B23","v":"Total All Categories"},{"$f":"SUM(D23:D27)","v":23},11,12,0,0,0,0,0]
[]
[null,{"$f":"TranslatedPrinciple&\" \"&C35","v":"Principle 2"}]
[null,{"$f":"CHOOSE(LanguageNumber,Y31,AK31,AW31,BI31)","v":"Principle 2 overall compliance (N/A Indicators excluded)"},null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,AC31,AO31,BA31,BM31)","v":"Principle 2 compliance (N/A excluded)"},null,null,null,null,{"$f":"CHOOSE(LanguageNumber,AF31,AR31,BD31,BT31)","v":"Compliance for Required Indicators (N/A Indicators excluded)"},null,null,null,null,null,null,null,null,null,null,null,"Principle 2 overall compliance (N/A Indicators excluded)",null,null,null,"Principle 2 compliance (N/A excluded)",null,null,"Compliance for Required Indicators (N/A Indicators excluded)",null,null,null,null,"Principe 2 conformité globale (hors indicateurs n/d)",null,null,null,"Principe 2 conformité (hors indicateurs n/d)",null,null,"FR Compliance for Required Indicators (N/A Indicators excluded)",null,null,null,null,"ES Principe 2 conformité globale (hors indicateurs n/d)",null,null,null,"ES Principe 2 conformité (hors indicateurs n/d)",null,null,"ES Compliance for Required Indicators (N/A Indicators excluded)",null,null,null,null,"YY Principe 2 conformité globale (hors indicateurs n/d)",null,null,null,"YY Principle 2 compliance (N/A excluded)",null,null,"YY Compliance for Required Indicators (N/A Indicators excluded)"]
[]
[]
[null,{"$f":"CHOOSE(LanguageNumber,Y34,AK34,AW34,BI34)","v":"Compliance"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Compliance",null,null,null,null,null,null,null,null,null,null,null,"Conformité",null,null,null,null,null,null,null,null,null,null,null,"ES Compliance",null,null,null,null,null,null,null,null,null,null,null,"YY Compliance"]
[null,{"$f":"B30","v":"Principle 2"},2,{"$f":"TranslatedAll","v":"All"},{"$f":"$C35&\".1\"","v":"2.1"},{"$f":"$C35&\".2\"","v":"2.2"},{"$f":"$C35&\".3\"","v":"2.3"},{"$f":"$C35&\".4\"","v":"2.4"},{"$f":"$C35&\".5\"","v":"2.5"},{"$f":"$C35&\".6\"","v":"2.6"},{"$f":"$C35&\".7\"","v":"2.7"}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"SUM(E36:K36)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E35,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F35,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G35,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H35,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I35,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J35,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K35,All!$BA$4:$BA$682)","v":0}]
[null,{"$f":"B36&Spacer2&B35","v":"Required - Principle 2"},{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"SUM(E37:K37)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E35,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F35,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G35,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H35,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I35,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J35,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K35,All!$BC$4:$BC$682)","v":0},null,{"$f":"CHOOSE(LanguageNumber,Y37,AK37,AW37,BI37)","v":"% Compliance (N/A Indicators excluded)"},null,null,null,null,null,null,null,null,null,null,null,"% Compliance (N/A Indicators excluded)",null,null,null,null,null,null,null,null,null,null,null,"% conformité (hors indicateurs n/d)",null,null,null,null,null,null,null,null,null,null,null,"ES % Compliance (N/A Indicators excluded)",null,null,null,null,null,null,null,null,null,null,null,"YY % Compliance (N/A Indicators excluded)"]
[null,null,{"$f":"Drivers!$G$55","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E35,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F35,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G35,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H35,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I35,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J35,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K35,All!$BB$4:$BB$682)","v":0},null,{"$f":"B35","v":"Principle 2"},null,{"$f":"D35","v":"All"},{"$f":"E35","v":"2.1"},{"$f":"F35","v":"2.2"},"2.3","2.4","2.5","2.6","2.7"]
[null,null,{"$f":"Drivers!$G$56","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E35,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F35,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G35,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H35,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I35,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J35,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K35,All!$BD$4:$BD$682)","v":0},null,{"$f":"B37","v":"Required - Principle 2"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"IF(D41=0,0,D36/(D41-D39))","v":0},0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$57","v":"Other"},56,{"$f":"E41-SUM(E36:E39)","v":10},6,5,3,15,5,12,null,null,{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"IF(D41=0,0,D37/(D41-D39))","v":0},0,0,0,0,0,0,0]
[null,null,{"$f":"TranslatedTotal&\" \"&B36","v":"Total Required"},{"$f":"SUM(D36:D40)","v":56},{"$f":"SUMIF(All!$C$4:$C$682,E35,All!$AU$4:$AU$682)","v":10},{"$f":"SUMIF(All!$C$4:$C$682,F35,All!$AU$4:$AU$682)","v":6},{"$f":"SUMIF(All!$C$4:$C$682,G35,All!$AU$4:$AU$682)","v":5},{"$f":"SUMIF(All!$C$4:$C$682,H35,All!$AU$4:$AU$682)","v":3},{"$f":"SUMIF(All!$C$4:$C$682,I35,All!$AU$4:$AU$682)","v":15},{"$f":"SUMIF(All!$C$4:$C$682,J35,All!$AU$4:$AU$682)","v":5},{"$f":"SUMIF(All!$C$4:$C$682,K35,All!$AU$4:$AU$682)","v":12},null,null,{"$f":"Drivers!$G$55","v":"No"},{"$f":"IF(D41=0,0,D38/(D41-D39))","v":0},0,0,0,0,0,0,0]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"SUM(E42:K42)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E35,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F35,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G35,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H35,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I35,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J35,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K35,All!$BE$4:$BE$682)","v":0},null,null,{"$f":"Drivers!$G$57","v":"Other"},{"$f":"IF(D41=0,0,D40/(D41-D39))","v":1},1,1,1,1,1,1,1]
[null,{"$f":"B42&Spacer2&B35","v":"Recommended - Principle 2"},{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"SUM(E43:K43)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E35,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F35,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G35,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H35,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I35,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J35,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K35,All!$BG$4:$BG$682)","v":0},null,null,{"$f":"TranslatedTotal&\" \"&M39","v":"Total Required - Principle 2"},{"$f":"SUM(O39:O42)","v":1},1,1,1,1,1,1,1]
[null,null,{"$f":"Drivers!$G$55","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E35,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F35,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G35,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H35,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I35,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J35,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K35,All!$BF$4:$BF$682)","v":0},null,{"$f":"B43","v":"Recommended - Principle 2"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"IF(D47=0,0,D42/(D47-D45))","v":0},0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$56","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E35,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F35,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G35,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H35,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I35,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J35,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K35,All!$BH$4:$BH$682)","v":0},null,null,{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"IF(D47=0,0,D43/(D47-D45))","v":0},0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$57","v":"Other"},55,{"$f":"E47-SUM(E42:E45)","v":1},0,2,11,24,4,13,null,null,{"$f":"Drivers!$G$55","v":"No"},{"$f":"IF(D47=0,0,D44/(D47-D45))","v":0},0,0,0,0,0,0,0]
[null,null,{"$f":"TranslatedTotal&\" \"&B42","v":"Total Recommended"},{"$f":"SUM(D42:D46)","v":55},{"$f":"SUMIF(All!$C$4:$C$682,E35,All!$AV$4:$AV$682)","v":1},{"$f":"SUMIF(All!$C$4:$C$682,F35,All!$AV$4:$AV$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G35,All!$AV$4:$AV$682)","v":2},{"$f":"SUMIF(All!$C$4:$C$682,H35,All!$AV$4:$AV$682)","v":11},{"$f":"SUMIF(All!$C$4:$C$682,I35,All!$AV$4:$AV$682)","v":24},{"$f":"SUMIF(All!$C$4:$C$682,J35,All!$AV$4:$AV$682)","v":4},{"$f":"SUMIF(All!$C$4:$C$682,K35,All!$AV$4:$AV$682)","v":13},null,null,{"$f":"Drivers!$G$57","v":"Other"},{"$f":"IF(D47=0,0,D46/(D47-D45))","v":1},1,0,1,1,1,1,1]
[null,{"$f":"CHOOSE(LanguageNumber,Y48,AK48,AW48,BI48)","v":"All Categories"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"D36+D42","v":0},0,0,0,0,0,0,0,null,null,{"$f":"TranslatedTotal&\" \"&M44","v":"Total Recommended - Principle 2"},{"$f":"SUM(O44:O47)","v":1},1,0,1,1,1,1,1,null,null,"All Categories",null,null,null,null,null,null,null,null,null,null,null,"Toutes catégories",null,null,null,null,null,null,null,null,null,null,null,"ES All Categories",null,null,null,null,null,null,null,null,null,null,null,"YY All Categories"]
[null,null,{"$f":"Drivers!$G$54","v":"Partial"},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$55","v":"No"},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$56","v":"N/A"},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$57","v":"Other"},111,11,6,7,14,39,9,25]
[null,null,{"$f":"TranslatedTotal&\" \"&B48","v":"Total All Categories"},{"$f":"SUM(D48:D52)","v":111},11,6,7,14,39,9,25]
[]
[null,{"$f":"TranslatedPrinciple&\" \"&C60","v":"Principle 3"}]
[null,{"$f":"CHOOSE(LanguageNumber,Y56,AK56,AW56,BI56)","v":"Principle 3 overall compliance (N/A Indicators excluded)"},null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,AC56,AO56,BA56,BM56)","v":"Principle 3 compliance (N/A excluded)"},null,null,null,null,{"$f":"CHOOSE(LanguageNumber,AF56,AR56,BD56,BT56)","v":"Compliance for Required Indicators (N/A Indicators excluded)"},null,null,null,null,null,null,null,null,null,null,null,"Principle 3 overall compliance (N/A Indicators excluded)",null,null,null,"Principle 3 compliance (N/A excluded)",null,null,"Compliance for Required Indicators (N/A Indicators excluded)",null,null,null,null,"Principe 3 conformité globale (hors indicateurs n/d)",null,null,null,"Principe 3 conformité (hors indicateurs n/d)",null,null,"FR Compliance for Required Indicators (N/A Indicators excluded)",null,null,null,null,"ES Principe 3 conformité globale (hors indicateurs n/d)",null,null,null,"ES Principe 3 conformité (hors indicateurs n/d)",null,null,"ES Compliance for Required Indicators (N/A Indicators excluded)",null,null,null,null,"YY Principe 3 conformité globale (hors indicateurs n/d)",null,null,null,"YY Principle 3 compliance (N/A excluded)",null,null,"YY Compliance for Required Indicators (N/A Indicators excluded)"]
[]
[]
[null,{"$f":"CHOOSE(LanguageNumber,Y59,AK59,AW59,BI59)","v":"Compliance"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Compliance",null,null,null,null,null,null,null,null,null,null,null,"Conformité",null,null,null,null,null,null,null,null,null,null,null,"ES Compliance",null,null,null,null,null,null,null,null,null,null,null,"YY Compliance"]
[null,{"$f":"B55","v":"Principle 3"},3,{"$f":"TranslatedAll","v":"All"},{"$f":"$C60&\".1\"","v":"3.1"},{"$f":"$C60&\".2\"","v":"3.2"},{"$f":"$C60&\".3\"","v":"3.3"},{"$f":"$C60&\".4\"","v":"3.4"},{"$f":"$C60&\".5\"","v":"3.5"},{"$f":"$C60&\".6\"","v":"3.6"},{"$f":"$C60&\".7\"","v":"3.7"}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"SUM(E61:K61)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E60,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F60,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G60,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H60,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I60,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J60,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K60,All!$BA$4:$BA$682)","v":0}]
[null,{"$f":"B61&Spacer2&B60","v":"Required - Principle 3"},{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"SUM(E62:K62)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E60,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F60,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G60,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H60,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I60,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J60,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K60,All!$BC$4:$BC$682)","v":0},null,{"$f":"CHOOSE(LanguageNumber,Y62,AK62,AW62,BI62)","v":"% Compliance (N/A Indicators excluded)"},null,null,null,null,null,null,null,null,null,null,null,"% Compliance (N/A Indicators excluded)",null,null,null,null,null,null,null,null,null,null,null,"% conformité (hors indicateurs n/d)",null,null,null,null,null,null,null,null,null,null,null,"ES % Compliance (N/A Indicators excluded)",null,null,null,null,null,null,null,null,null,null,null,"YY % Compliance (N/A Indicators excluded)"]
[null,null,{"$f":"Drivers!$G$55","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E60,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F60,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G60,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H60,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I60,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J60,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K60,All!$BB$4:$BB$682)","v":0},null,{"$f":"B60","v":"Principle 3"},null,{"$f":"D60","v":"All"},{"$f":"E60","v":"3.1"},{"$f":"F60","v":"3.2"},"3.3","3.4"]
[null,null,{"$f":"Drivers!$G$56","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E60,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F60,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G60,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H60,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I60,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J60,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K60,All!$BD$4:$BD$682)","v":0},null,{"$f":"B62","v":"Required - Principle 3"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"IF(D66=0,0,D61/(D66-D64))","v":0},0,0,0,0]
[null,null,{"$f":"Drivers!$G$57","v":"Other"},30,{"$f":"E66-SUM(E61:E64)","v":11},{"$f":"F66-SUM(F61:F64)","v":6},{"$f":"G66-SUM(G61:G64)","v":2},11,0,0,0,null,null,{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"IF(D66=0,0,D62/(D66-D64))","v":0},0,0,0,0]
[null,null,{"$f":"TranslatedTotal&\" \"&B61","v":"Total Required"},{"$f":"SUM(D61:D65)","v":30},{"$f":"SUMIF(All!$C$4:$C$682,E60,All!$AU$4:$AU$682)","v":11},{"$f":"SUMIF(All!$C$4:$C$682,F60,All!$AU$4:$AU$682)","v":6},{"$f":"SUMIF(All!$C$4:$C$682,G60,All!$AU$4:$AU$682)","v":2},{"$f":"SUMIF(All!$C$4:$C$682,H60,All!$AU$4:$AU$682)","v":11},{"$f":"SUMIF(All!$C$4:$C$682,I60,All!$AU$4:$AU$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J60,All!$AU$4:$AU$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K60,All!$AU$4:$AU$682)","v":0},null,null,{"$f":"Drivers!$G$55","v":"No"},{"$f":"IF(D66=0,0,D63/(D66-D64))","v":0},0,0,0,0]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"SUM(E67:K67)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E60,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F60,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G60,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H60,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I60,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J60,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K60,All!$BE$4:$BE$682)","v":0},null,null,{"$f":"Drivers!$G$57","v":"Other"},{"$f":"IF(D66=0,0,D65/(D66-D64))","v":1},1,1,1,1]
[null,{"$f":"B67&Spacer2&B60","v":"Recommended - Principle 3"},{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"SUM(E68:K68)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E60,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F60,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G60,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H60,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I60,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J60,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K60,All!$BG$4:$BG$682)","v":0},null,null,{"$f":"TranslatedTotal&\" \"&M64","v":"Total Required - Principle 3"},{"$f":"SUM(O64:O67)","v":1},{"$f":"SUM(P64:P67)","v":1},1,1,1]
[null,null,{"$f":"Drivers!$G$55","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E60,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F60,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G60,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H60,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I60,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J60,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K60,All!$BF$4:$BF$682)","v":0},null,{"$f":"B68","v":"Recommended - Principle 3"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"IF(D72=0,0,D67/(D72-D70))","v":0},0,0,0,0]
[null,null,{"$f":"Drivers!$G$56","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E60,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F60,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G60,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H60,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I60,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J60,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K60,All!$BH$4:$BH$682)","v":0},null,null,{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"IF(D72=0,0,D68/(D72-D70))","v":0},0,0,0,0]
[null,null,{"$f":"Drivers!$G$57","v":"Other"},51,{"$f":"E72-SUM(E67:E70)","v":16},{"$f":"F72-SUM(F67:F70)","v":4},{"$f":"G72-SUM(G67:G70)","v":9},22,0,0,0,null,null,{"$f":"Drivers!$G$55","v":"No"},{"$f":"IF(D72=0,0,D69/(D72-D70))","v":0},0,0,0,0]
[null,null,{"$f":"TranslatedTotal&\" \"&B67","v":"Total Recommended"},{"$f":"SUM(D67:D71)","v":51},{"$f":"SUMIF(All!$C$4:$C$682,E60,All!$AV$4:$AV$682)","v":16},{"$f":"SUMIF(All!$C$4:$C$682,F60,All!$AV$4:$AV$682)","v":4},{"$f":"SUMIF(All!$C$4:$C$682,G60,All!$AV$4:$AV$682)","v":9},{"$f":"SUMIF(All!$C$4:$C$682,H60,All!$AV$4:$AV$682)","v":22},{"$f":"SUMIF(All!$C$4:$C$682,I60,All!$AV$4:$AV$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J60,All!$AV$4:$AV$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K60,All!$AV$4:$AV$682)","v":0},null,null,{"$f":"Drivers!$G$57","v":"Other"},{"$f":"IF(D72=0,0,D71/(D72-D70))","v":1},1,1,1,1]
[null,{"$f":"CHOOSE(LanguageNumber,Y73,AK73,AW73,BI73)","v":"All Categories"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"D61+D67","v":0},0,0,0,0,0,0,0,null,null,{"$f":"TranslatedTotal&\" \"&M69","v":"Total Recommended - Principle 3"},{"$f":"SUM(O69:O72)","v":1},{"$f":"SUM(P69:P72)","v":1},1,1,1,null,null,null,null,null,"All Categories",null,null,null,null,null,null,null,null,null,null,null,"Toutes catégories",null,null,null,null,null,null,null,null,null,null,null,"ES All Categories",null,null,null,null,null,null,null,null,null,null,null,"YY All Categories"]
[null,null,{"$f":"Drivers!$G$54","v":"Partial"},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$55","v":"No"},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$56","v":"N/A"},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$57","v":"Other"},81,27,10,11,33,0,0,0]
[null,null,{"$f":"TranslatedTotal&\" \"&B73","v":"Total All Categories"},{"$f":"SUM(D73:D77)","v":81},{"$f":"SUM(E73:E77)","v":27},10,11,33,0,0,0]
[]
[null,{"$f":"TranslatedPrinciple&\" \"&C85","v":"Principle 4"}]
[null,{"$f":"CHOOSE(LanguageNumber,Y81,AK81,AW81,BI81)","v":"Principle 4 overall compliance (N/A Indicators excluded)"},null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,AC81,AO81,BA81,BM81)","v":"Principle 4 compliance (N/A excluded)"},null,null,null,null,{"$f":"CHOOSE(LanguageNumber,AF81,AR81,BD81,BT81)","v":"Compliance for Required Indicators (N/A Indicators excluded)"},null,null,null,null,null,null,null,null,null,null,null,"Principle 4 overall compliance (N/A Indicators excluded)",null,null,null,"Principle 4 compliance (N/A excluded)",null,null,"Compliance for Required Indicators (N/A Indicators excluded)",null,null,null,null,"Principe 4 conformité globale (hors indicateurs n/d)",null,null,null,"Principe 4 conformité (hors indicateurs n/d)",null,null,"FR Compliance for Required Indicators (N/A Indicators excluded)",null,null,null,null,"ES Principe 4 conformité globale (hors indicateurs n/d)",null,null,null,"ES Principe 4 conformité (hors indicateurs n/d)",null,null,"ES Compliance for Required Indicators (N/A Indicators excluded)",null,null,null,null,"YY Principe 4 conformité globale (hors indicateurs n/d)",null,null,null,"YY Principle 4 compliance (N/A excluded)",null,null,"YY Compliance for Required Indicators (N/A Indicators excluded)"]
[]
[]
[null,{"$f":"CHOOSE(LanguageNumber,Y84,AK84,AW84,BI84)","v":"Compliance"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Compliance",null,null,null,null,null,null,null,null,null,null,null,"Conformité",null,null,null,null,null,null,null,null,null,null,null,"ES Compliance",null,null,null,null,null,null,null,null,null,null,null,"YY Compliance"]
[null,{"$f":"B80","v":"Principle 4"},4,{"$f":"TranslatedAll","v":"All"},{"$f":"$C85&\".1\"","v":"4.1"},{"$f":"$C85&\".2\"","v":"4.2"},{"$f":"$C85&\".3\"","v":"4.3"},{"$f":"$C85&\".4\"","v":"4.4"},{"$f":"$C85&\".5\"","v":"4.5"},{"$f":"$C85&\".6\"","v":"4.6"},{"$f":"$C85&\".7\"","v":"4.7"}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"SUM(E86:K86)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E85,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F85,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G85,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H85,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I85,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J85,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K85,All!$BA$4:$BA$682)","v":0}]
[null,{"$f":"B86&Spacer2&B85","v":"Required - Principle 4"},{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"SUM(E87:K87)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E85,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F85,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G85,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H85,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I85,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J85,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K85,All!$BC$4:$BC$682)","v":0},null,{"$f":"CHOOSE(LanguageNumber,Y87,AK87,AW87,BI87)","v":"% Compliance (N/A Indicators excluded)"},null,null,null,null,null,null,null,null,null,null,null,"% Compliance (N/A Indicators excluded)",null,null,null,null,null,null,null,null,null,null,null,"% conformité (hors indicateurs n/d)",null,null,null,null,null,null,null,null,null,null,null,"ES % Compliance (N/A Indicators excluded)",null,null,null,null,null,null,null,null,null,null,null,"YY % Compliance (N/A Indicators excluded)"]
[null,null,{"$f":"Drivers!$G$55","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E85,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F85,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G85,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H85,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I85,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J85,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K85,All!$BB$4:$BB$682)","v":0},null,{"$f":"B85","v":"Principle 4"},null,{"$f":"D85","v":"All"},{"$f":"E85","v":"4.1"},{"$f":"F85","v":"4.2"},"4.3","4.4","4.5","4.6","4.7"]
[null,null,{"$f":"Drivers!$G$56","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E85,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F85,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G85,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H85,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I85,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J85,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K85,All!$BD$4:$BD$682)","v":0},null,{"$f":"B87","v":"Required - Principle 4"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"IF(D91=0,0,D86/(D91-D89))","v":0},0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$57","v":"Other"},63,{"$f":"E91-SUM(E86:E89)","v":6},{"$f":"F91-SUM(F86:F89)","v":14},{"$f":"G91-SUM(G86:G89)","v":6},3,10,9,15,null,null,{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"IF(D91=0,0,D87/(D91-D89))","v":0},0,0,0,0,0,0,0]
[null,null,{"$f":"TranslatedTotal&\" \"&B86","v":"Total Required"},{"$f":"SUM(D86:D90)","v":63},{"$f":"SUMIF(All!$C$4:$C$682,E85,All!$AU$4:$AU$682)","v":6},{"$f":"SUMIF(All!$C$4:$C$682,F85,All!$AU$4:$AU$682)","v":14},{"$f":"SUMIF(All!$C$4:$C$682,G85,All!$AU$4:$AU$682)","v":6},{"$f":"SUMIF(All!$C$4:$C$682,H85,All!$AU$4:$AU$682)","v":3},{"$f":"SUMIF(All!$C$4:$C$682,I85,All!$AU$4:$AU$682)","v":10},{"$f":"SUMIF(All!$C$4:$C$682,J85,All!$AU$4:$AU$682)","v":9},{"$f":"SUMIF(All!$C$4:$C$682,K85,All!$AU$4:$AU$682)","v":15},null,null,{"$f":"Drivers!$G$55","v":"No"},{"$f":"IF(D91=0,0,D88/(D91-D89))","v":0},0,0,0,0,0,0,0]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"SUM(E92:K92)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E85,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F85,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G85,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H85,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I85,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J85,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K85,All!$BE$4:$BE$682)","v":0},null,null,{"$f":"Drivers!$G$57","v":"Other"},{"$f":"IF(D91=0,0,D90/(D91-D89))","v":1},1,1,1,1,1,1,1]
[null,{"$f":"B92&Spacer2&B85","v":"Recommended - Principle 4"},{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"SUM(E93:K93)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E85,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F85,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G85,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H85,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I85,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J85,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K85,All!$BG$4:$BG$682)","v":0},null,null,{"$f":"TranslatedTotal&\" \"&M89","v":"Total Required - Principle 4"},{"$f":"SUM(O89:O92)","v":1},{"$f":"SUM(P89:P92)","v":1},1,1,1,1,1,1]
[null,null,{"$f":"Drivers!$G$55","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E85,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F85,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G85,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H85,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I85,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J85,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K85,All!$BF$4:$BF$682)","v":0},null,{"$f":"B93","v":"Recommended - Principle 4"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"IF(D97=0,0,D92/(D97-D95))","v":0},0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$56","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E85,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F85,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G85,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H85,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I85,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J85,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K85,All!$BH$4:$BH$682)","v":0},null,null,{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"IF(D97=0,0,D93/(D97-D95))","v":0},0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$57","v":"Other"},69,{"$f":"E97-SUM(E92:E95)","v":4},{"$f":"F97-SUM(F92:F95)","v":13},{"$f":"G97-SUM(G92:G95)","v":13},8,14,8,9,null,null,{"$f":"Drivers!$G$55","v":"No"},{"$f":"IF(D97=0,0,D94/(D97-D95))","v":0},0,0,0,0,0,0,0]
[null,null,{"$f":"TranslatedTotal&\" \"&B92","v":"Total Recommended"},{"$f":"SUM(D92:D96)","v":69},{"$f":"SUMIF(All!$C$4:$C$682,E85,All!$AV$4:$AV$682)","v":4},{"$f":"SUMIF(All!$C$4:$C$682,F85,All!$AV$4:$AV$682)","v":13},{"$f":"SUMIF(All!$C$4:$C$682,G85,All!$AV$4:$AV$682)","v":13},{"$f":"SUMIF(All!$C$4:$C$682,H85,All!$AV$4:$AV$682)","v":8},{"$f":"SUMIF(All!$C$4:$C$682,I85,All!$AV$4:$AV$682)","v":14},{"$f":"SUMIF(All!$C$4:$C$682,J85,All!$AV$4:$AV$682)","v":8},{"$f":"SUMIF(All!$C$4:$C$682,K85,All!$AV$4:$AV$682)","v":9},null,null,{"$f":"Drivers!$G$57","v":"Other"},{"$f":"IF(D97=0,0,D96/(D97-D95))","v":1},1,1,1,1,1,1,1]
[null,{"$f":"CHOOSE(LanguageNumber,Y98,AK98,AW98,BI98)","v":"All Categories"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"D86+D92","v":0},0,0,0,0,0,0,0,null,null,{"$f":"TranslatedTotal&\" \"&M94","v":"Total Recommended - Principle 4"},{"$f":"SUM(O94:O97)","v":1},{"$f":"SUM(P94:P97)","v":1},1,1,1,1,1,1,null,null,"All Categories",null,null,null,null,null,null,null,null,null,null,null,"Toutes catégories",null,null,null,null,null,null,null,null,null,null,null,"ES All Categories",null,null,null,null,null,null,null,null,null,null,null,"YY All Categories"]
[null,null,{"$f":"Drivers!$G$54","v":"Partial"},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$55","v":"No"},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$56","v":"N/A"},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$57","v":"Other"},132,10,27,19,11,24,17,24]
[null,null,{"$f":"TranslatedTotal&\" \"&B98","v":"Total All Categories"},{"$f":"SUM(D98:D102)","v":132},{"$f":"SUM(E98:E102)","v":10},27,19,11,24,17,24]
[]
[null,{"$f":"TranslatedPrinciple&\" \"&C110","v":"Principle 5"}]
[null,{"$f":"CHOOSE(LanguageNumber,Y106,AK106,AW106,BI106)","v":"Principle 5 overall compliance (N/A Indicators excluded)"},null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,AC106,AO106,BA106,BM106)","v":"Principle 5 compliance (N/A excluded)"},null,null,null,null,{"$f":"CHOOSE(LanguageNumber,AF106,AR106,BD106,BT106)","v":"Compliance for Required Indicators (N/A Indicators excluded)"},null,null,null,null,null,null,null,null,null,null,null,"Principle 5 overall compliance (N/A Indicators excluded)",null,null,null,"Principle 5 compliance (N/A excluded)",null,null,"Compliance for Required Indicators (N/A Indicators excluded)",null,null,null,null,"Principe 5 conformité globale (hors indicateurs n/d)",null,null,null,"Principe 5 conformité (hors indicateurs n/d)",null,null,"FR Compliance for Required Indicators (N/A Indicators excluded)",null,null,null,null,"ES Principe 5 conformité globale (hors indicateurs n/d)",null,null,null,"ES Principe 5 conformité (hors indicateurs n/d)",null,null,"ES Compliance for Required Indicators (N/A Indicators excluded)",null,null,null,null,"YY Principe 5 conformité globale (hors indicateurs n/d)",null,null,null,"YY Principle 5 compliance (N/A excluded)",null,null,"YY Compliance for Required Indicators (N/A Indicators excluded)"]
[]
[]
[null,{"$f":"CHOOSE(LanguageNumber,Y109,AK109,AW109,BI109)","v":"Compliance"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Compliance",null,null,null,null,null,null,null,null,null,null,null,"Conformité",null,null,null,null,null,null,null,null,null,null,null,"ES Compliance",null,null,null,null,null,null,null,null,null,null,null,"YY Compliance"]
[null,{"$f":"B105","v":"Principle 5"},5,{"$f":"TranslatedAll","v":"All"},{"$f":"$C110&\".1\"","v":"5.1"},{"$f":"$C110&\".2\"","v":"5.2"},{"$f":"$C110&\".3\"","v":"5.3"},{"$f":"$C110&\".4\"","v":"5.4"},{"$f":"$C110&\".5\"","v":"5.5"},{"$f":"$C110&\".6\"","v":"5.6"},{"$f":"$C110&\".7\"","v":"5.7"}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"SUM(E111:K111)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E110,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F110,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G110,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H110,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I110,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J110,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K110,All!$BA$4:$BA$682)","v":0}]
[null,{"$f":"B111&Spacer2&B110","v":"Required - Principle 5"},{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"SUM(E112:K112)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E110,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F110,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G110,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H110,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I110,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J110,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K110,All!$BC$4:$BC$682)","v":0},null,{"$f":"CHOOSE(LanguageNumber,Y112,AK112,AW112,BI112)","v":"% Compliance (N/A Indicators excluded)"},null,null,null,null,null,null,null,null,null,null,null,"% Compliance (N/A Indicators excluded)",null,null,null,null,null,null,null,null,null,null,null,"% conformité (hors indicateurs n/d)",null,null,null,null,null,null,null,null,null,null,null,"ES % Compliance (N/A Indicators excluded)",null,null,null,null,null,null,null,null,null,null,null,"YY % Compliance (N/A Indicators excluded)"]
[null,null,{"$f":"Drivers!$G$55","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E110,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F110,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G110,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H110,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I110,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J110,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K110,All!$BB$4:$BB$682)","v":0},null,{"$f":"B110","v":"Principle 5"},null,{"$f":"D110","v":"All"},{"$f":"E110","v":"5.1"},{"$f":"F110","v":"5.2"},"5.3"]
[null,null,{"$f":"Drivers!$G$56","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E110,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F110,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G110,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H110,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I110,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J110,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K110,All!$BD$4:$BD$682)","v":0},null,{"$f":"B112","v":"Required - Principle 5"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"IF(D116=0,0,D111/(D116-D114))","v":0},0,0,0]
[null,null,{"$f":"Drivers!$G$57","v":"Other"},68,{"$f":"E116-SUM(E111:E114)","v":8},{"$f":"F116-SUM(F111:F114)","v":16},{"$f":"G116-SUM(G111:G114)","v":44},0,0,0,0,null,null,{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"IF(D116=0,0,D112/(D116-D114))","v":0},0,0,0]
[null,null,{"$f":"TranslatedTotal&\" \"&B111","v":"Total Required"},{"$f":"SUM(D111:D115)","v":68},{"$f":"SUMIF(All!$C$4:$C$682,E110,All!$AU$4:$AU$682)","v":8},{"$f":"SUMIF(All!$C$4:$C$682,F110,All!$AU$4:$AU$682)","v":16},{"$f":"SUMIF(All!$C$4:$C$682,G110,All!$AU$4:$AU$682)","v":44},{"$f":"SUMIF(All!$C$4:$C$682,H110,All!$AU$4:$AU$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I110,All!$AU$4:$AU$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J110,All!$AU$4:$AU$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K110,All!$AU$4:$AU$682)","v":0},null,null,{"$f":"Drivers!$G$55","v":"No"},{"$f":"IF(D116=0,0,D113/(D116-D114))","v":0},0,0,0]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"SUM(E117:K117)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E110,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F110,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G110,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H110,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I110,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J110,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K110,All!$BE$4:$BE$682)","v":0},null,null,{"$f":"Drivers!$G$57","v":"Other"},{"$f":"IF(D116=0,0,D115/(D116-D114))","v":1},1,1,1]
[null,{"$f":"B117&Spacer2&B110","v":"Recommended - Principle 5"},{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"SUM(E118:K118)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E110,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F110,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G110,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H110,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I110,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J110,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K110,All!$BG$4:$BG$682)","v":0},null,null,{"$f":"TranslatedTotal&\" \"&M114","v":"Total Required - Principle 5"},{"$f":"SUM(O114:O117)","v":1},{"$f":"SUM(P114:P117)","v":1},1,1]
[null,null,{"$f":"Drivers!$G$55","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E110,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F110,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G110,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H110,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I110,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J110,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K110,All!$BF$4:$BF$682)","v":0},null,{"$f":"B118","v":"Recommended - Principle 5"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"IF(D122=0,0,D117/(D122-D120))","v":0},0,0,0]
[null,null,{"$f":"Drivers!$G$56","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E110,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F110,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G110,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H110,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I110,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J110,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K110,All!$BH$4:$BH$682)","v":0},null,null,{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"IF(D122=0,0,D118/(D122-D120))","v":0},0,0,0]
[null,null,{"$f":"Drivers!$G$57","v":"Other"},72,{"$f":"E122-SUM(E117:E120)","v":8},{"$f":"F122-SUM(F117:F120)","v":26},{"$f":"G122-SUM(G117:G120)","v":38},0,0,0,0,null,null,{"$f":"Drivers!$G$55","v":"No"},{"$f":"IF(D122=0,0,D119/(D122-D120))","v":0},0,0,0]
[null,null,{"$f":"TranslatedTotal&\" \"&B117","v":"Total Recommended"},{"$f":"SUM(D117:D121)","v":72},{"$f":"SUMIF(All!$C$4:$C$682,E110,All!$AV$4:$AV$682)","v":8},{"$f":"SUMIF(All!$C$4:$C$682,F110,All!$AV$4:$AV$682)","v":26},{"$f":"SUMIF(All!$C$4:$C$682,G110,All!$AV$4:$AV$682)","v":38},{"$f":"SUMIF(All!$C$4:$C$682,H110,All!$AV$4:$AV$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I110,All!$AV$4:$AV$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J110,All!$AV$4:$AV$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K110,All!$AV$4:$AV$682)","v":0},null,null,{"$f":"Drivers!$G$57","v":"Other"},{"$f":"IF(D122=0,0,D121/(D122-D120))","v":1},1,1,1]
[null,{"$f":"CHOOSE(LanguageNumber,Y123,AK123,AW123,BI123)","v":"All Categories"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"D111+D117","v":0},0,0,0,0,0,0,0,null,null,{"$f":"TranslatedTotal&\" \"&M119","v":"Total Recommended - Principle 5"},{"$f":"SUM(O119:O122)","v":1},{"$f":"SUM(P119:P122)","v":1},1,1,null,null,null,null,null,null,"All Categories",null,null,null,null,null,null,null,null,null,null,null,"Toutes catégories",null,null,null,null,null,null,null,null,null,null,null,"ES All Categories",null,null,null,null,null,null,null,null,null,null,null,"YY All Categories"]
[null,null,{"$f":"Drivers!$G$54","v":"Partial"},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$55","v":"No"},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$56","v":"N/A"},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$57","v":"Other"},140,16,42,82,0,0,0,0]
[null,null,{"$f":"TranslatedTotal&\" \"&B123","v":"Total All Categories"},{"$f":"SUM(D123:D127)","v":140},{"$f":"SUM(E123:E127)","v":16},42,82,0,0,0,0]
[]
[null,{"$f":"TranslatedPrinciple&\" \"&C135","v":"Principle 6"}]
[null,{"$f":"CHOOSE(LanguageNumber,Y131,AK131,AW131,BI131)","v":"Principle 6 overall compliance (N/A Indicators excluded)"},null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,AC131,AO131,BA131,BM131)","v":"Principle 6 compliance (N/A excluded)"},null,null,null,null,{"$f":"CHOOSE(LanguageNumber,AF131,AR131,BD131,BT131)","v":"Compliance for Required Indicators (N/A Indicators excluded)"},null,null,null,null,null,null,null,null,null,null,null,"Principle 6 overall compliance (N/A Indicators excluded)",null,null,null,"Principle 6 compliance (N/A excluded)",null,null,"Compliance for Required Indicators (N/A Indicators excluded)",null,null,null,null,"Principe 6 conformité globale (hors indicateurs n/d)",null,null,null,"Principe 6 conformité (hors indicateurs n/d)",null,null,"FR Compliance for Required Indicators (N/A Indicators excluded)",null,null,null,null,"ES Principe 6 conformité globale (hors indicateurs n/d)",null,null,null,"ES Principe 6 conformité (hors indicateurs n/d)",null,null,"ES Compliance for Required Indicators (N/A Indicators excluded)",null,null,null,null,"YY Principe 6 conformité globale (hors indicateurs n/d)",null,null,null,"YY Principle 6 compliance (N/A excluded)",null,null,"YY Compliance for Required Indicators (N/A Indicators excluded)"]
[]
[]
[null,{"$f":"CHOOSE(LanguageNumber,Y134,AK134,AW134,BI134)","v":"Compliance"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Compliance",null,null,null,null,null,null,null,null,null,null,null,"Conformité",null,null,null,null,null,null,null,null,null,null,null,"ES Compliance",null,null,null,null,null,null,null,null,null,null,null,"YY Compliance"]
[null,{"$f":"B130","v":"Principle 6"},6,{"$f":"TranslatedAll","v":"All"},{"$f":"$C135&\".1\"","v":"6.1"},{"$f":"$C135&\".2\"","v":"6.2"},{"$f":"$C135&\".3\"","v":"6.3"},{"$f":"$C135&\".4\"","v":"6.4"},{"$f":"$C135&\".5\"","v":"6.5"},{"$f":"$C135&\".6\"","v":"6.6"},{"$f":"$C135&\".7\"","v":"6.7"}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"SUM(E136:K136)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E135,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F135,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G135,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H135,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I135,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J135,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K135,All!$BA$4:$BA$682)","v":0}]
[null,{"$f":"B136&Spacer2&B135","v":"Required - Principle 6"},{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"SUM(E137:K137)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E135,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F135,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G135,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H135,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I135,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J135,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K135,All!$BC$4:$BC$682)","v":0},null,{"$f":"CHOOSE(LanguageNumber,Y137,AK137,AW137,BI137)","v":"% Compliance (N/A Indicators excluded)"},null,null,null,null,null,null,null,null,null,null,null,"% Compliance (N/A Indicators excluded)",null,null,null,null,null,null,null,null,null,null,null,"% conformité (hors indicateurs n/d)",null,null,null,null,null,null,null,null,null,null,null,"ES % Compliance (N/A Indicators excluded)",null,null,null,null,null,null,null,null,null,null,null,"YY % Compliance (N/A Indicators excluded)"]
[null,null,{"$f":"Drivers!$G$55","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E135,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F135,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G135,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H135,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I135,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J135,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K135,All!$BB$4:$BB$682)","v":0},null,{"$f":"B135","v":"Principle 6"},null,{"$f":"D135","v":"All"},{"$f":"E135","v":"6.1"},{"$f":"F135","v":"6.2"}]
[null,null,{"$f":"Drivers!$G$56","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E135,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F135,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G135,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H135,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I135,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J135,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K135,All!$BD$4:$BD$682)","v":0},null,{"$f":"B137","v":"Required - Principle 6"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"IF(D141=0,0,D136/(D141-D139))","v":0},0,0]
[null,null,{"$f":"Drivers!$G$57","v":"Other"},16,{"$f":"E141-SUM(E136:E139)","v":7},{"$f":"F141-SUM(F136:F139)","v":9},{"$f":"G141-SUM(G136:G139)","v":0},0,0,0,0,null,null,{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"IF(D141=0,0,D137/(D141-D139))","v":0},0,0]
[null,null,{"$f":"TranslatedTotal&\" \"&B136","v":"Total Required"},{"$f":"SUM(D136:D140)","v":16},{"$f":"SUMIF(All!$C$4:$C$682,E135,All!$AU$4:$AU$682)","v":7},{"$f":"SUMIF(All!$C$4:$C$682,F135,All!$AU$4:$AU$682)","v":9},{"$f":"SUMIF(All!$C$4:$C$682,G135,All!$AU$4:$AU$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H135,All!$AU$4:$AU$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I135,All!$AU$4:$AU$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J135,All!$AU$4:$AU$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K135,All!$AU$4:$AU$682)","v":0},null,null,{"$f":"Drivers!$G$55","v":"No"},{"$f":"IF(D141=0,0,D138/(D141-D139))","v":0},0,0]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"SUM(E142:K142)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E135,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F135,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G135,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H135,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I135,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J135,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K135,All!$BE$4:$BE$682)","v":0},null,null,{"$f":"Drivers!$G$57","v":"Other"},{"$f":"IF(D141=0,0,D140/(D141-D139))","v":1},1,1]
[null,{"$f":"B142&Spacer2&B135","v":"Recommended - Principle 6"},{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"SUM(E143:K143)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E135,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F135,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G135,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H135,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I135,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J135,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K135,All!$BG$4:$BG$682)","v":0},null,null,{"$f":"TranslatedTotal&\" \"&M139","v":"Total Required - Principle 6"},{"$f":"SUM(O139:O142)","v":1},{"$f":"SUM(P139:P142)","v":1},1]
[null,null,{"$f":"Drivers!$G$55","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E135,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F135,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G135,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H135,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I135,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J135,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K135,All!$BF$4:$BF$682)","v":0},null,{"$f":"B143","v":"Recommended - Principle 6"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"IF(D147=0,0,D142/(D147-D145))","v":0},0,0]
[null,null,{"$f":"Drivers!$G$56","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E135,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F135,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G135,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H135,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I135,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J135,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K135,All!$BH$4:$BH$682)","v":0},null,null,{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"IF(D147=0,0,D143/(D147-D145))","v":0},0,0]
[null,null,{"$f":"Drivers!$G$57","v":"Other"},20,{"$f":"E147-SUM(E142:E145)","v":11},{"$f":"F147-SUM(F142:F145)","v":9},{"$f":"G147-SUM(G142:G145)","v":0},0,0,0,0,null,null,{"$f":"Drivers!$G$55","v":"No"},{"$f":"IF(D147=0,0,D144/(D147-D145))","v":0},0,0]
[null,null,{"$f":"TranslatedTotal&\" \"&B142","v":"Total Recommended"},{"$f":"SUM(D142:D146)","v":20},{"$f":"SUMIF(All!$C$4:$C$682,E135,All!$AV$4:$AV$682)","v":11},{"$f":"SUMIF(All!$C$4:$C$682,F135,All!$AV$4:$AV$682)","v":9},{"$f":"SUMIF(All!$C$4:$C$682,G135,All!$AV$4:$AV$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H135,All!$AV$4:$AV$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I135,All!$AV$4:$AV$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J135,All!$AV$4:$AV$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K135,All!$AV$4:$AV$682)","v":0},null,null,{"$f":"Drivers!$G$57","v":"Other"},{"$f":"IF(D147=0,0,D146/(D147-D145))","v":1},1,1]
[null,{"$f":"CHOOSE(LanguageNumber,Y148,AK148,AW148,BI148)","v":"All Categories"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"D136+D142","v":0},0,0,0,0,0,0,0,null,null,{"$f":"TranslatedTotal&\" \"&M144","v":"Total Recommended - Principle 6"},{"$f":"SUM(O144:O147)","v":1},{"$f":"SUM(P144:P147)","v":1},1,null,null,null,null,null,null,null,"All Categories",null,null,null,null,null,null,null,null,null,null,null,"Toutes catégories",null,null,null,null,null,null,null,null,null,null,null,"ES All Categories",null,null,null,null,null,null,null,null,null,null,null,"YY All Categories"]
[null,null,{"$f":"Drivers!$G$54","v":"Partial"},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$55","v":"No"},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$56","v":"N/A"},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$57","v":"Other"},36,18,18,0,0,0,0,0]
[null,null,{"$f":"TranslatedTotal&\" \"&B148","v":"Total All Categories"},{"$f":"SUM(D148:D152)","v":36},{"$f":"SUM(E148:E152)","v":18},18,0,0,0,0,0]
[]
[null,{"$f":"TranslatedPrinciple&\" \"&C160","v":"Principle 7"}]
[null,{"$f":"CHOOSE(LanguageNumber,Y156,AK156,AW156,BI156)","v":"Principle 7 overall compliance (N/A Indicators excluded)"},null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,AC156,AO156,BA156,BM156)","v":"Principle 7 compliance (N/A excluded)"},null,null,null,null,{"$f":"CHOOSE(LanguageNumber,AF156,AR156,BD156,BT156)","v":"Compliance for Required Indicators (N/A Indicators excluded)"},null,null,null,null,null,null,null,null,null,null,null,"Principle 7 overall compliance (N/A Indicators excluded)",null,null,null,"Principle 7 compliance (N/A excluded)",null,null,"Compliance for Required Indicators (N/A Indicators excluded)",null,null,null,null,"Principe 7 conformité globale (hors indicateurs n/d)",null,null,null,"Principe 7 conformité (hors indicateurs n/d)",null,null,"FR Compliance for Required Indicators (N/A Indicators excluded)",null,null,null,null,"ES Principe 7 conformité globale (hors indicateurs n/d)",null,null,null,"ES Principe 7 conformité (hors indicateurs n/d)",null,null,"ES Compliance for Required Indicators (N/A Indicators excluded)",null,null,null,null,"YY Principe 7 conformité globale (hors indicateurs n/d)",null,null,null,"YY Principle 7 compliance (N/A excluded)",null,null,"YY Compliance for Required Indicators (N/A Indicators excluded)"]
[]
[]
[null,{"$f":"CHOOSE(LanguageNumber,Y159,AK159,AW159,BI159)","v":"Compliance"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Compliance",null,null,null,null,null,null,null,null,null,null,null,"Conformité",null,null,null,null,null,null,null,null,null,null,null,"ES Compliance",null,null,null,null,null,null,null,null,null,null,null,"YY Compliance"]
[null,{"$f":"B155","v":"Principle 7"},7,{"$f":"TranslatedAll","v":"All"},{"$f":"$C160&\".1\"","v":"7.1"},{"$f":"$C160&\".2\"","v":"7.2"},{"$f":"$C160&\".3\"","v":"7.3"},{"$f":"$C160&\".4\"","v":"7.4"},{"$f":"$C160&\".5\"","v":"7.5"},{"$f":"$C160&\".6\"","v":"7.6"},{"$f":"$C160&\".7\"","v":"7.7"}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"SUM(E161:K161)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E160,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F160,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G160,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H160,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I160,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J160,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K160,All!$BA$4:$BA$682)","v":0}]
[null,{"$f":"B161&Spacer2&B160","v":"Required - Principle 7"},{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"SUM(E162:K162)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E160,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F160,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G160,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H160,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I160,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J160,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K160,All!$BC$4:$BC$682)","v":0},null,{"$f":"CHOOSE(LanguageNumber,Y162,AK162,AW162,BI162)","v":"% Compliance (N/A Indicators excluded)"},null,null,null,null,null,null,null,null,null,null,null,"% Compliance (N/A Indicators excluded)",null,null,null,null,null,null,null,null,null,null,null,"% conformité (hors indicateurs n/d)",null,null,null,null,null,null,null,null,null,null,null,"ES % Compliance (N/A Indicators excluded)",null,null,null,null,null,null,null,null,null,null,null,"YY % Compliance (N/A Indicators excluded)"]
[null,null,{"$f":"Drivers!$G$55","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E160,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F160,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G160,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H160,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I160,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J160,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K160,All!$BB$4:$BB$682)","v":0},null,{"$f":"B160","v":"Principle 7"},null,{"$f":"D160","v":"All"},{"$f":"E160","v":"7.1"},{"$f":"F160","v":"7.2"},"7.3"]
[null,null,{"$f":"Drivers!$G$56","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E160,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F160,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G160,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H160,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I160,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J160,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K160,All!$BD$4:$BD$682)","v":0},null,{"$f":"B162","v":"Required - Principle 7"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"IF(D166=0,0,D161/(D166-D164))","v":0},0,0,0]
[null,null,{"$f":"Drivers!$G$57","v":"Other"},23,{"$f":"E166-SUM(E161:E164)","v":19},{"$f":"F166-SUM(F161:F164)","v":3},{"$f":"G166-SUM(G161:G164)","v":1},0,0,0,0,null,null,{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"IF(D166=0,0,D162/(D166-D164))","v":0},0,0,0]
[null,null,{"$f":"TranslatedTotal&\" \"&B161","v":"Total Required"},{"$f":"SUM(D161:D165)","v":23},{"$f":"SUMIF(All!$C$4:$C$682,E160,All!$AU$4:$AU$682)","v":19},{"$f":"SUMIF(All!$C$4:$C$682,F160,All!$AU$4:$AU$682)","v":3},{"$f":"SUMIF(All!$C$4:$C$682,G160,All!$AU$4:$AU$682)","v":1},{"$f":"SUMIF(All!$C$4:$C$682,H160,All!$AU$4:$AU$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I160,All!$AU$4:$AU$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J160,All!$AU$4:$AU$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K160,All!$AU$4:$AU$682)","v":0},null,null,{"$f":"Drivers!$G$55","v":"No"},{"$f":"IF(D166=0,0,D163/(D166-D164))","v":0},0,0,0]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"SUM(E167:K167)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E160,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F160,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G160,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H160,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I160,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J160,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K160,All!$BE$4:$BE$682)","v":0},null,null,{"$f":"Drivers!$G$57","v":"Other"},{"$f":"IF(D166=0,0,D165/(D166-D164))","v":1},1,1,1]
[null,{"$f":"B167&Spacer2&B160","v":"Recommended - Principle 7"},{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"SUM(E168:K168)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E160,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F160,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G160,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H160,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I160,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J160,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K160,All!$BG$4:$BG$682)","v":0},null,null,{"$f":"TranslatedTotal&\" \"&M164","v":"Total Required - Principle 7"},{"$f":"SUM(O164:O167)","v":1},{"$f":"SUM(P164:P167)","v":1},1,1]
[null,null,{"$f":"Drivers!$G$55","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E160,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F160,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G160,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H160,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I160,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J160,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K160,All!$BF$4:$BF$682)","v":0},null,{"$f":"B168","v":"Recommended - Principle 7"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"IF(D172=0,0,D167/(D172-D170))","v":0},0,0,0]
[null,null,{"$f":"Drivers!$G$56","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E160,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F160,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G160,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H160,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I160,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J160,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K160,All!$BH$4:$BH$682)","v":0},null,null,{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"IF(D172=0,0,D168/(D172-D170))","v":0},0,0,0]
[null,null,{"$f":"Drivers!$G$57","v":"Other"},38,{"$f":"E172-SUM(E167:E170)","v":22},{"$f":"F172-SUM(F167:F170)","v":9},{"$f":"G172-SUM(G167:G170)","v":7},0,0,0,0,null,null,{"$f":"Drivers!$G$55","v":"No"},{"$f":"IF(D172=0,0,D169/(D172-D170))","v":0},0,0,0]
[null,null,{"$f":"TranslatedTotal&\" \"&B167","v":"Total Recommended"},{"$f":"SUM(D167:D171)","v":38},{"$f":"SUMIF(All!$C$4:$C$682,E160,All!$AV$4:$AV$682)","v":22},{"$f":"SUMIF(All!$C$4:$C$682,F160,All!$AV$4:$AV$682)","v":9},{"$f":"SUMIF(All!$C$4:$C$682,G160,All!$AV$4:$AV$682)","v":7},{"$f":"SUMIF(All!$C$4:$C$682,H160,All!$AV$4:$AV$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I160,All!$AV$4:$AV$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J160,All!$AV$4:$AV$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K160,All!$AV$4:$AV$682)","v":0},null,null,{"$f":"Drivers!$G$57","v":"Other"},{"$f":"IF(D172=0,0,D171/(D172-D170))","v":1},1,1,1]
[null,{"$f":"CHOOSE(LanguageNumber,Y173,AK173,AW173,BI173)","v":"All Categories"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"D161+D167","v":0},0,0,0,0,0,0,0,null,null,{"$f":"TranslatedTotal&\" \"&M169","v":"Total Recommended - Principle 7"},{"$f":"SUM(O169:O172)","v":1},{"$f":"SUM(P169:P172)","v":1},1,1,null,null,null,null,null,null,"All Categories",null,null,null,null,null,null,null,null,null,null,null,"Toutes catégories",null,null,null,null,null,null,null,null,null,null,null,"ES All Categories",null,null,null,null,null,null,null,null,null,null,null,"YY All Categories"]
[null,null,{"$f":"Drivers!$G$54","v":"Partial"},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$55","v":"No"},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$56","v":"N/A"},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$57","v":"Other"},61,41,12,8,0,0,0,0]
[null,null,{"$f":"TranslatedTotal&\" \"&B173","v":"Total All Categories"},{"$f":"SUM(D173:D177)","v":61},{"$f":"SUM(E173:E177)","v":41},12,8,0,0,0,0]
[]
[null,{"$f":"TranslatedPrinciple&\" \"&C185","v":"Principle 8"}]
[null,{"$f":"CHOOSE(LanguageNumber,Y181,AK181,AW181,BI181)","v":"Principle 8 overall compliance (N/A Indicators excluded)"},null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,AC181,AO181,BA181,BM181)","v":"Principle 8 compliance (N/A excluded)"},null,null,null,null,{"$f":"CHOOSE(LanguageNumber,AF181,AR181,BD181,BT181)","v":"Compliance for Required Indicators (N/A Indicators excluded)"},null,null,null,null,null,null,null,null,null,null,null,"Principle 8 overall compliance (N/A Indicators excluded)",null,null,null,"Principle 8 compliance (N/A excluded)",null,null,"Compliance for Required Indicators (N/A Indicators excluded)",null,null,null,null,"Principe 8 conformité globale (hors indicateurs n/d)",null,null,null,"Principe 8 conformité (hors indicateurs n/d)",null,null,"FR Compliance for Required Indicators (N/A Indicators excluded)",null,null,null,null,"ES Principe 8 conformité globale (hors indicateurs n/d)",null,null,null,"ES Principe 8 conformité (hors indicateurs n/d)",null,null,"ES Compliance for Required Indicators (N/A Indicators excluded)",null,null,null,null,"YY Principe 8 conformité globale (hors indicateurs n/d)",null,null,null,"YY Principle 8 compliance (N/A excluded)",null,null,"YY Compliance for Required Indicators (N/A Indicators excluded)"]
[]
[]
[null,{"$f":"CHOOSE(LanguageNumber,Y184,AK184,AW184,BI184)","v":"Compliance"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Compliance",null,null,null,null,null,null,null,null,null,null,null,"Conformité",null,null,null,null,null,null,null,null,null,null,null,"ES Compliance",null,null,null,null,null,null,null,null,null,null,null,"YY Compliance"]
[null,{"$f":"B180","v":"Principle 8"},8,{"$f":"TranslatedAll","v":"All"},{"$f":"$C185&\".1\"","v":"8.1"},{"$f":"$C185&\".2\"","v":"8.2"},{"$f":"$C185&\".3\"","v":"8.3"},{"$f":"$C185&\".4\"","v":"8.4"},{"$f":"$C185&\".5\"","v":"8.5"},{"$f":"$C185&\".6\"","v":"8.6"},{"$f":"$C185&\".7\"","v":"8.7"}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"SUM(E186:K186)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E185,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F185,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G185,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H185,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I185,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J185,All!$BA$4:$BA$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K185,All!$BA$4:$BA$682)","v":0}]
[null,{"$f":"B186&Spacer2&B185","v":"Required - Principle 8"},{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"SUM(E187:K187)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E185,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F185,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G185,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H185,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I185,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J185,All!$BC$4:$BC$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K185,All!$BC$4:$BC$682)","v":0},null,{"$f":"CHOOSE(LanguageNumber,Y187,AK187,AW187,BI187)","v":"% Compliance (N/A Indicators excluded)"},null,null,null,null,null,null,null,null,null,null,null,"% Compliance (N/A Indicators excluded)",null,null,null,null,null,null,null,null,null,null,null,"% conformité (hors indicateurs n/d)",null,null,null,null,null,null,null,null,null,null,null,"ES % Compliance (N/A Indicators excluded)",null,null,null,null,null,null,null,null,null,null,null,"YY % Compliance (N/A Indicators excluded)"]
[null,null,{"$f":"Drivers!$G$55","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E185,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F185,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G185,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H185,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I185,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J185,All!$BB$4:$BB$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K185,All!$BB$4:$BB$682)","v":0},null,{"$f":"B185","v":"Principle 8"},null,{"$f":"D185","v":"All"},{"$f":"E185","v":"8.1"},{"$f":"F185","v":"8.2"},"8.3","8.4"]
[null,null,{"$f":"Drivers!$G$56","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E185,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F185,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G185,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H185,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I185,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J185,All!$BD$4:$BD$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K185,All!$BD$4:$BD$682)","v":0},null,{"$f":"B187","v":"Required - Principle 8"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"IF(D191=0,0,D186/(D191-D189))","v":0},0,0,0,0]
[null,null,{"$f":"Drivers!$G$57","v":"Other"},10,{"$f":"E191-SUM(E186:E189)","v":9},{"$f":"F191-SUM(F186:F189)","v":0},{"$f":"G191-SUM(G186:G189)","v":0},1,0,0,0,null,null,{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"IF(D191=0,0,D187/(D191-D189))","v":0},0,0,0,0]
[null,null,{"$f":"TranslatedTotal&\" \"&B186","v":"Total Required"},{"$f":"SUM(D186:D190)","v":10},{"$f":"SUMIF(All!$C$4:$C$682,E185,All!$AU$4:$AU$682)","v":9},{"$f":"SUMIF(All!$C$4:$C$682,F185,All!$AU$4:$AU$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G185,All!$AU$4:$AU$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H185,All!$AU$4:$AU$682)","v":1},{"$f":"SUMIF(All!$C$4:$C$682,I185,All!$AU$4:$AU$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J185,All!$AU$4:$AU$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K185,All!$AU$4:$AU$682)","v":0},null,null,{"$f":"Drivers!$G$55","v":"No"},{"$f":"IF(D191=0,0,D188/(D191-D189))","v":0},0,0,0,0]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"SUM(E192:K192)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E185,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F185,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G185,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H185,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I185,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J185,All!$BE$4:$BE$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K185,All!$BE$4:$BE$682)","v":0},null,null,{"$f":"Drivers!$G$57","v":"Other"},{"$f":"IF(D191=0,0,D190/(D191-D189))","v":1},1,0,0,1]
[null,{"$f":"B192&Spacer2&B185","v":"Recommended - Principle 8"},{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"SUM(E193:K193)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E185,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F185,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G185,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H185,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I185,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J185,All!$BG$4:$BG$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K185,All!$BG$4:$BG$682)","v":0},null,null,{"$f":"TranslatedTotal&\" \"&M189","v":"Total Required - Principle 8"},{"$f":"SUM(O189:O192)","v":1},{"$f":"SUM(P189:P192)","v":1},0,0,1]
[null,null,{"$f":"Drivers!$G$55","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E185,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F185,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G185,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H185,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I185,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J185,All!$BF$4:$BF$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K185,All!$BF$4:$BF$682)","v":0},null,{"$f":"B193","v":"Recommended - Principle 8"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"IF(D197=0,0,D192/(D197-D195))","v":0},0,0,0,0]
[null,null,{"$f":"Drivers!$G$56","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E185,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F185,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G185,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H185,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I185,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J185,All!$BH$4:$BH$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K185,All!$BH$4:$BH$682)","v":0},null,null,{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"IF(D197=0,0,D193/(D197-D195))","v":0},0,0,0,0]
[null,null,{"$f":"Drivers!$G$57","v":"Other"},22,{"$f":"E197-SUM(E192:E195)","v":9},{"$f":"F197-SUM(F192:F195)","v":4},{"$f":"G197-SUM(G192:G195)","v":5},4,0,0,0,null,null,{"$f":"Drivers!$G$55","v":"No"},{"$f":"IF(D197=0,0,D194/(D197-D195))","v":0},0,0,0,0]
[null,null,{"$f":"TranslatedTotal&\" \"&B192","v":"Total Recommended"},{"$f":"SUM(D192:D196)","v":22},{"$f":"SUMIF(All!$C$4:$C$682,E185,All!$AV$4:$AV$682)","v":9},{"$f":"SUMIF(All!$C$4:$C$682,F185,All!$AV$4:$AV$682)","v":4},{"$f":"SUMIF(All!$C$4:$C$682,G185,All!$AV$4:$AV$682)","v":5},{"$f":"SUMIF(All!$C$4:$C$682,H185,All!$AV$4:$AV$682)","v":4},{"$f":"SUMIF(All!$C$4:$C$682,I185,All!$AV$4:$AV$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J185,All!$AV$4:$AV$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K185,All!$AV$4:$AV$682)","v":0},null,null,{"$f":"Drivers!$G$57","v":"Other"},{"$f":"IF(D197=0,0,D196/(D197-D195))","v":1},1,1,1,1]
[null,{"$f":"CHOOSE(LanguageNumber,Y198,AK198,AW198,BI198)","v":"All Categories"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"D186+D192","v":0},0,0,0,0,0,0,0,null,null,{"$f":"TranslatedTotal&\" \"&M194","v":"Total Recommended - Principle 8"},{"$f":"SUM(O194:O197)","v":1},{"$f":"SUM(P194:P197)","v":1},1,1,1,null,null,null,null,null,"All Categories",null,null,null,null,null,null,null,null,null,null,null,"Toutes catégories",null,null,null,null,null,null,null,null,null,null,null,"ES All Categories",null,null,null,null,null,null,null,null,null,null,null,"YY All Categories"]
[null,null,{"$f":"Drivers!$G$54","v":"Partial"},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$55","v":"No"},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$56","v":"N/A"},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$57","v":"Other"},32,18,4,5,5,0,0,0]
[null,null,{"$f":"TranslatedTotal&\" \"&B198","v":"Total All Categories"},{"$f":"SUM(D198:D202)","v":32},{"$f":"SUM(E198:E202)","v":18},4,5,5,0,0,0]

{"sheet":"External Assessment Summary","index":13,"n_rows":21,"n_cols":19,"rows_kept":21,"cut":false,"hidden":false,"merged":[[15,1,15,2],[3,1,3,11],[8,1,8,2],[1,1,1,11],[2,1,2,11]]}
[]
[null,{"$f":"UPPER(CHOOSE(LanguageNumber,O2,Q2,S2,U2))","v":"SUMMARY OF EXTERNAL ASSESSMENT RESPONSES"},null,null,null,null,null,null,null,null,null,null,null,null,"Summary of external assessment responses",null,"Synthèse des réponses à l'évaluation externe",null,"Resumen de respuestas a la evaluación externa"]
[null,{"$f":"CHOOSE(LanguageNumber,O3,Q3,S3,U3)","v":"Instructions"},null,null,null,null,null,null,null,null,null,null,null,null,"Instructions",null,"Mode d'emploi",null,"Instrucciones"]
[null,{"$f":"CHOOSE(LanguageNumber,O4,Q4,S4,U4)","v":"This worksheet summarises compliance with all eight Principles of the Code of Conduct based on the external assessment data. The charts and tables present a picture of overall compliance for both Required and Recommended Indicators. The pie charts demonstrate overall compliance, while the bar charts provide information both on overall compliance and each individual Principle."},null,null,null,null,null,null,null,null,null,null,null,null,"This worksheet summarises compliance with all eight Principles of the Code of Conduct based on the external assessment data. The charts and tables present a picture of overall compliance for both Required and Recommended Indicators. The pie charts demonstrate overall compliance, while the bar charts provide information both on overall compliance and each individual Principle.",null,"Cette feuille de calcul résume la conformité aux huit Principes du Code de conduite en fonction des données obtenues suite à l'évaluation externe. Les graphiques et tableaux dressent une vue d’ensemble de la conformité générale pour les Indicateurs Requis et Recommandés. Les diagrammes circulaires indiquent la conformité dans son ensemble, les diagrammes en barres indiquent à la fois la conformité générale et la conformité à chaque Principe.",null,"Esta planilla resume el cumplimiento con los ocho Principios del Código de Conducta en base a los datos de la evaluación externa. Los gráficos y las tablas presentan el panorama del cumplimiento total tanto para Indicadores Obligatorios como Recomendados. Los gráficos circulares muestran el cumplimiento total, mientras que los gráficos de barras proveen información tanto sobre el cumplimiento total como sobre cada Principio individual."]
[]
[null,{"$f":"TranslatedOverallCompliance&\" \"&TranslatedNA_indicators_excluded","v":"Overall compliance (N/A indicators excluded)"},null,null,null,null,{"$f":"TranslatedCompliance&\" \"&TranslatedNA_indicators_excluded","v":"Compliance (N/A indicators excluded)"}]
[]
[null,null,null,null,1,2,3,4,5,6,7,8]
[null,{"$f":"TranslatedAllPrinciples","v":"All Principles"},{"$f":"CHOOSE(LanguageNumber,#REF!,#REF!,#REF!,#REF!)","v":{"$error":"#REF!"}},{"$f":"TranslatedTotal","v":"Total"},1,2,3,4,5,6,7,8]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"SUM(E10:L10)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,E$8,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,F$8,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,G$8,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,H$8,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,I$8,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,J$8,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,K$8,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,L$8,All!$BM$4:$BM$682)","v":0}]
[null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"SUM(E11:L11)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,E$8,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,F$8,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,G$8,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,H$8,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,I$8,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,J$8,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,K$8,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,L$8,All!$BN$4:$BN$682)","v":0}]
[null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"SUM(E12:L12)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,E$8,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,F$8,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,G$8,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,H$8,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,I$8,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,J$8,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,K$8,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,L$8,All!$BO$4:$BO$682)","v":0}]
[null,null,{"$f":"TranslatedNA","v":"N/A"},{"$f":"SUM(E13:L13)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,E$8,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,F$8,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,G$8,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,H$8,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,I$8,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,J$8,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,K$8,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$B$4:$B$682,L$8,All!$BP$4:$BP$682)","v":0}]
[null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"SUM(E14:L14)","v":281},{"$f":"E15-SUM(E10:E13)","v":15},56,30,63,68,16,23,10]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D10:D14)","v":281},{"$f":"SUMIF(All!$B$4:$B$682,E$8,All!$AU$4:$AU$682)","v":15},{"$f":"SUMIF(All!$B$4:$B$682,F$8,All!$AU$4:$AU$682)","v":56},{"$f":"SUMIF(All!$B$4:$B$682,G$8,All!$AU$4:$AU$682)","v":30},{"$f":"SUMIF(All!$B$4:$B$682,H$8,All!$AU$4:$AU$682)","v":63},{"$f":"SUMIF(All!$B$4:$B$682,I$8,All!$AU$4:$AU$682)","v":68},{"$f":"SUMIF(All!$B$4:$B$682,J$8,All!$AU$4:$AU$682)","v":16},{"$f":"SUMIF(All!$B$4:$B$682,K$8,All!$AU$4:$AU$682)","v":23},{"$f":"SUMIF(All!$B$4:$B$682,L$8,All!$AU$4:$AU$682)","v":10}]
[null,"All Principles except N/A",null,"Total","P1","P2","P3","P4","P5","P6","P7","P8"]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"Drivers!$G$53","v":"Yes"},{"$f":"D10/(D$15-D$13)","v":0},0,0,0,0,0,0,0,0]
[null,"DO NOT DELETE THIS AREA",{"$f":"Drivers!$G$54","v":"Partial"},{"$f":"D11/(D$15-D$13)","v":0},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$55","v":"No"},{"$f":"D12/(D$15-D$13)","v":0},0,0,0,0,0,0,0,0]
[null,null,{"$f":"Drivers!$G$57","v":"Other"},{"$f":"D14/(D$15-D$13)","v":1},1,1,1,1,1,1,1,1]
[null,{"$f":"\"Total \"&B17","v":"Total Required"},null,{"$f":"SUM(D17:D20)","v":1},1,1,1,1,1,1,1,1]

{"sheet":"External Assessment Charts","index":14,"n_rows":161,"n_cols":29,"rows_kept":161,"cut":false,"hidden":false,"merged":[[2,1,2,13],[1,1,1,13]]}
[]
[null,{"$f":"UPPER(CHOOSE(LanguageNumber,Y2,AA2,AC2,AE2))","v":"CHARTS OF EXTERNAL ASSESSMENT COMPLIANCE"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Charts of external assessment compliance",null,"Graphiques de conformité de l'évaluation externe",null,"Gráficos de cumplimiento de la evaluación externa"]
[null,{"$f":"CHOOSE(LanguageNumber,Y3,AA3,AC3,AE3)","v":"This worksheet provides a detailed summary of Code of Conduct external assessment compliance. \nThe pie charts give the compliance for each Principle (both required and recommended indicators) and the bar charts provide details of compliance for each sub-principle. Detailed data is included in tables for each Principle.\nNote that the pie charts and bar charts do not include N/A responses, as they focus on compliance with applicable Indicators only. "},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"This worksheet provides a detailed summary of Code of Conduct external assessment compliance. \nThe pie charts give the compliance for each Principle (both required and recommended indicators) and the bar charts provide details of compliance for each sub-principle. Detailed data is included in tables for each Principle.\nNote that the pie charts and bar charts do not include N/A responses, as they focus on compliance with applicable Indicators only. ",null,"Cette feuille de calcul fournit un résumé détaillé de la conformité au Code de conduite après l'évaluation externe. \nLes diagrammes circulaires indiquent la conformité à chaque Principe (indicateurs requis et recommandés) et les diagrammes en barres détaillent la conformité à chaque sous-principe. Des données détaillées figurent dans les tableaux pour chaque Principe.\nRemarque : les diagrammes circulaires et en barres n'incluent pas les réponses « n/d », car ils reflètent seulement la conformité aux Indicateurs applicables. ",null,"Esta planilla proporciona un resumen detallado del cumplimiento de la evaluación externa del Código de Conducta. \nLos gráficos circulares muestran el cumplimiento con cada Principio (tanto respecto de los Indicadores Obligatorios como de los Recomendados) y los gráficos de barras proveen información detallada sobre el cumplimiento con cada sub-principio Los datos detallados se exhiben en las tablas para cada Principio.\nNota: Los gráficos circulares y de barras no incluyen las respuestas «N/A», ya que solo se enfocan en el cumplimiento de los Indicadores aplicables."]
[]
[null,{"$f":"TranslatedPrinciple&\" \"&C5","v":"Principle 1"},1]
[null,{"$f":"$B5&\" \"&LOWER(TranslatedOverallCompliance)&\" \"&TranslatedNA_indicators_excluded","v":"Principle 1 overall compliance (N/A indicators excluded)"},null,null,null,null,null,null,null,null,null,null,{"$f":"TranslatedCompliance_by_Sub_Principle&\" \"&TranslatedNA_indicators_excluded","v":"Compliance by Sub-Principle (N/A indicators excluded)"}]
[]
[]
[]
[]
[]
[null,{"$f":"TranslatedCompliance","v":"Compliance"},null,null,null,null,null,null,null,null,null,null,{"$f":"\"% \"&TranslatedCompliance&\" \"&TranslatedNA_indicators_excluded","v":"% Compliance (N/A indicators excluded)"}]
[null,{"$f":"B5","v":"Principle 1"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"$C5&\".1\"","v":"1.1"},{"$f":"$C5&\".2\"","v":"1.2"},null,null,null,null,null,null,{"$f":"B5","v":"Principle 1"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"E13","v":"1.1"},{"$f":"F13","v":"1.2"}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"SUM(E14:K14)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E13,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F13,All!$BM$4:$BM$682)","v":0},null,null,null,null,null,null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D19=0,0,D14/(D19-D17))","v":0},{"$f":"IF(E19-E17=0,0,E14/(E19-E17))","v":0},{"$f":"IF(F19-F17=0,0,F14/(F19-F17))","v":0}]
[null,{"$f":"TranslatedRequired&Spacer2&B5","v":"Required - Principle 1"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"SUM(E15:K15)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E13,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F13,All!$BN$4:$BN$682)","v":0},null,null,null,null,null,null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D19=0,0,D15/(D19-D17))","v":0},{"$f":"IF(E19-E17=0,0,E15/(E19-E17))","v":0},{"$f":"IF(F19-F17=0,0,F15/(F19-F17))","v":0}]
[null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"SUM(E16:K16)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E13,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F13,All!$BO$4:$BO$682)","v":0},null,null,null,null,null,null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D19=0,0,D16/(D19-D17))","v":0},{"$f":"IF(E19-E17=0,0,E16/(E19-E17))","v":0},{"$f":"IF(F19-F17=0,0,F16/(F19-F17))","v":0}]
[null,null,{"$f":"TranslatedNA","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E13,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F13,All!$BP$4:$BP$682)","v":0},null,null,null,null,null,null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D19=0,0,D18/(D19-D17))","v":1},{"$f":"IF(E19-E17=0,0,E18/(E19-E17))","v":1},{"$f":"IF(F19-F17=0,0,F18/(F19-F17))","v":1}]
[null,null,{"$f":"TranslatedOther","v":"Other"},15,{"$f":"E19-SUM(E14:E17)","v":8},{"$f":"F19-SUM(F14:F17)","v":7},null,null,null,null,null,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O14:O17)","v":1},{"$f":"SUM(P14:P17)","v":1},{"$f":"SUM(Q14:Q17)","v":1}]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D14:D18)","v":15},{"$f":"SUMIF(All!$C$4:$C$682,E13,All!$AU$4:$AU$682)","v":8},{"$f":"SUMIF(All!$C$4:$C$682,F13,All!$AU$4:$AU$682)","v":7}]
[]
[null,{"$f":"TranslatedPrinciple&\" \"&C21","v":"Principle 2"},2]
[null,{"$f":"$B21&\" \"&LOWER(TranslatedOverallCompliance)&\" \"&TranslatedNA_indicators_excluded","v":"Principle 2 overall compliance (N/A indicators excluded)"},null,null,null,null,null,null,null,null,null,null,{"$f":"TranslatedCompliance_by_Sub_Principle&\" \"&TranslatedNA_indicators_excluded","v":"Compliance by Sub-Principle (N/A indicators excluded)"}]
[]
[]
[]
[]
[]
[null,{"$f":"TranslatedCompliance","v":"Compliance"},null,null,null,null,null,null,null,null,null,null,{"$f":"\"% \"&TranslatedCompliance&\" \"&TranslatedNA_indicators_excluded","v":"% Compliance (N/A indicators excluded)"}]
[null,{"$f":"B21","v":"Principle 2"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"$C21&\".1\"","v":"2.1"},{"$f":"$C21&\".2\"","v":"2.2"},{"$f":"$C21&\".3\"","v":"2.3"},{"$f":"$C21&\".4\"","v":"2.4"},{"$f":"$C21&\".5\"","v":"2.5"},{"$f":"$C21&\".6\"","v":"2.6"},{"$f":"$C21&\".7\"","v":"2.7"},null,{"$f":"B21","v":"Principle 2"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"E29","v":"2.1"},"2.2","2.3","2.4","2.5","2.6","2.7"]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"SUM(E30:K30)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E29,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F29,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G29,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H29,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I29,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J29,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K29,All!$BM$4:$BM$682)","v":0},null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D35=0,0,D30/(D35-D33))","v":0},{"$f":"IF(E35-E33=0,0,E30/(E35-E33))","v":0},0,0,0,0,0,0]
[null,{"$f":"TranslatedRequired&Spacer2&B21","v":"Required - Principle 2"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"SUM(E31:K31)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E29,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F29,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G29,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H29,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I29,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J29,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K29,All!$BN$4:$BN$682)","v":0},null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D35=0,0,D31/(D35-D33))","v":0},{"$f":"IF(E35-E33=0,0,E31/(E35-E33))","v":0},0,0,0,0,0,0]
[null,null,{"$f":"TranslatedNo","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E29,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F29,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G29,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H29,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I29,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J29,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K29,All!$BO$4:$BO$682)","v":0},null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D35=0,0,D32/(D35-D33))","v":0},{"$f":"IF(E35-E33=0,0,E32/(E35-E33))","v":0},0,0,0,0,0,0]
[null,null,{"$f":"TranslatedNA","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E29,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F29,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G29,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H29,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I29,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J29,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K29,All!$BP$4:$BP$682)","v":0},null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D35=0,0,D34/(D35-D33))","v":1},{"$f":"IF(E35-E33=0,0,E34/(E35-E33))","v":1},1,1,1,1,1,1]
[null,null,{"$f":"TranslatedOther","v":"Other"},56,{"$f":"E35-SUM(E30:E33)","v":10},6,5,3,15,5,12,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O30:O33)","v":1},1,1,1,1,1,1,1]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D30:D34)","v":56},{"$f":"SUMIF(All!$C$4:$C$682,E29,All!$AU$4:$AU$682)","v":10},{"$f":"SUMIF(All!$C$4:$C$682,F29,All!$AU$4:$AU$682)","v":6},{"$f":"SUMIF(All!$C$4:$C$682,G29,All!$AU$4:$AU$682)","v":5},{"$f":"SUMIF(All!$C$4:$C$682,H29,All!$AU$4:$AU$682)","v":3},{"$f":"SUMIF(All!$C$4:$C$682,I29,All!$AU$4:$AU$682)","v":15},{"$f":"SUMIF(All!$C$4:$C$682,J29,All!$AU$4:$AU$682)","v":5},{"$f":"SUMIF(All!$C$4:$C$682,K29,All!$AU$4:$AU$682)","v":12}]
[]
[null,{"$f":"TranslatedPrinciple&\" \"&C37","v":"Principle 3"},3]
[null,{"$f":"$B37&\" \"&LOWER(TranslatedOverallCompliance)&\" \"&TranslatedNA_indicators_excluded","v":"Principle 3 overall compliance (N/A indicators excluded)"},null,null,null,null,null,null,null,null,null,null,{"$f":"TranslatedCompliance_by_Sub_Principle&\" \"&TranslatedNA_indicators_excluded","v":"Compliance by Sub-Principle (N/A indicators excluded)"}]
[]
[]
[]
[]
[]
[null,{"$f":"TranslatedCompliance","v":"Compliance"},null,null,null,null,null,null,null,null,null,null,{"$f":"\"% \"&TranslatedCompliance&\" \"&TranslatedNA_indicators_excluded","v":"% Compliance (N/A indicators excluded)"}]
[null,{"$f":"B37","v":"Principle 3"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"$C37&\".1\"","v":"3.1"},{"$f":"$C37&\".2\"","v":"3.2"},{"$f":"$C37&\".3\"","v":"3.3"},{"$f":"$C37&\".4\"","v":"3.4"},null,null,null,null,{"$f":"B37","v":"Principle 3"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"E45","v":"3.1"},{"$f":"F45","v":"3.2"},{"$f":"G45","v":"3.3"},{"$f":"H45","v":"3.4"}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"SUM(E46:K46)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E45,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F45,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G45,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H45,All!$BM$4:$BM$682)","v":0},null,null,null,null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D51=0,0,D46/(D51-D49))","v":0},{"$f":"IF(E51-E49=0,0,E46/(E51-E49))","v":0},{"$f":"IF(F51-F49=0,0,F46/(F51-F49))","v":0},{"$f":"IF(G51-G49=0,0,G46/(G51-G49))","v":0},{"$f":"IF(H51-H49=0,0,H46/(H51-H49))","v":0}]
[null,{"$f":"TranslatedRequired&Spacer2&B37","v":"Required - Principle 3"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"SUM(E47:K47)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E45,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F45,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G45,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H45,All!$BN$4:$BN$682)","v":0},null,null,null,null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D51=0,0,D47/(D51-D49))","v":0},{"$f":"IF(E51-E49=0,0,E47/(E51-E49))","v":0},{"$f":"IF(F51-F49=0,0,F47/(F51-F49))","v":0},{"$f":"IF(G51-G49=0,0,G47/(G51-G49))","v":0},{"$f":"IF(H51-H49=0,0,H47/(H51-H49))","v":0}]
[null,null,{"$f":"TranslatedNo","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E45,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F45,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G45,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H45,All!$BO$4:$BO$682)","v":0},null,null,null,null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D51=0,0,D48/(D51-D49))","v":0},{"$f":"IF(E51-E49=0,0,E48/(E51-E49))","v":0},{"$f":"IF(F51-F49=0,0,F48/(F51-F49))","v":0},{"$f":"IF(G51-G49=0,0,G48/(G51-G49))","v":0},{"$f":"IF(H51-H49=0,0,H48/(H51-H49))","v":0}]
[null,null,{"$f":"TranslatedNA","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E45,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F45,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G45,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H45,All!$BP$4:$BP$682)","v":0},null,null,null,null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D51=0,0,D50/(D51-D49))","v":1},{"$f":"IF(E51-E49=0,0,E50/(E51-E49))","v":1},{"$f":"IF(F51-F49=0,0,F50/(F51-F49))","v":1},{"$f":"IF(G51-G49=0,0,G50/(G51-G49))","v":1},{"$f":"IF(H51-H49=0,0,H50/(H51-H49))","v":1}]
[null,null,{"$f":"TranslatedOther","v":"Other"},30,{"$f":"E51-SUM(E46:E49)","v":11},6,2,11,null,null,null,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O46:O49)","v":1},1,1,1,1]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D46:D50)","v":30},{"$f":"SUMIF(All!$C$4:$C$682,E45,All!$AU$4:$AU$682)","v":11},{"$f":"SUMIF(All!$C$4:$C$682,F45,All!$AU$4:$AU$682)","v":6},{"$f":"SUMIF(All!$C$4:$C$682,G45,All!$AU$4:$AU$682)","v":2},{"$f":"SUMIF(All!$C$4:$C$682,H45,All!$AU$4:$AU$682)","v":11}]
[]
[null,{"$f":"TranslatedPrinciple&\" \"&C53","v":"Principle 4"},4]
[null,{"$f":"$B53&\" \"&LOWER(TranslatedOverallCompliance)&\" \"&TranslatedNA_indicators_excluded","v":"Principle 4 overall compliance (N/A indicators excluded)"},null,null,null,null,null,null,null,null,null,null,{"$f":"TranslatedCompliance_by_Sub_Principle&\" \"&TranslatedNA_indicators_excluded","v":"Compliance by Sub-Principle (N/A indicators excluded)"}]
[]
[]
[]
[]
[]
[null,{"$f":"TranslatedCompliance","v":"Compliance"},null,null,null,null,null,null,null,null,null,null,{"$f":"\"% \"&TranslatedCompliance&\" \"&TranslatedNA_indicators_excluded","v":"% Compliance (N/A indicators excluded)"}]
[null,{"$f":"B53","v":"Principle 4"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"$C53&\".1\"","v":"4.1"},{"$f":"$C53&\".2\"","v":"4.2"},{"$f":"$C53&\".3\"","v":"4.3"},{"$f":"$C53&\".4\"","v":"4.4"},{"$f":"$C53&\".5\"","v":"4.5"},{"$f":"$C53&\".6\"","v":"4.6"},{"$f":"$C53&\".7\"","v":"4.7"},null,{"$f":"B53","v":"Principle 4"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"E61","v":"4.1"},"4.2","4.3","4.4","4.5","4.6","4.7"]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"SUM(E62:K62)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E61,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F61,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G61,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H61,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I61,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J61,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K61,All!$BM$4:$BM$682)","v":0},null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D67=0,0,D62/(D67-D65))","v":0},{"$f":"IF(E67-E65=0,0,E62/(E67-E65))","v":0},0,0,0,0,0,0]
[null,{"$f":"TranslatedRequired&Spacer2&B53","v":"Required - Principle 4"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"SUM(E63:K63)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E61,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F61,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G61,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H61,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I61,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J61,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K61,All!$BN$4:$BN$682)","v":0},null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D67=0,0,D63/(D67-D65))","v":0},{"$f":"IF(E67-E65=0,0,E63/(E67-E65))","v":0},0,0,0,0,0,0]
[null,null,{"$f":"TranslatedNo","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E61,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F61,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G61,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H61,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I61,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J61,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K61,All!$BO$4:$BO$682)","v":0},null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D67=0,0,D64/(D67-D65))","v":0},{"$f":"IF(E67-E65=0,0,E64/(E67-E65))","v":0},0,0,0,0,0,0]
[null,null,{"$f":"TranslatedNA","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E61,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F61,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G61,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H61,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,I61,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,J61,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,K61,All!$BP$4:$BP$682)","v":0},null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D67=0,0,D66/(D67-D65))","v":1},{"$f":"IF(E67-E65=0,0,E66/(E67-E65))","v":1},1,1,1,1,1,1]
[null,null,{"$f":"TranslatedOther","v":"Other"},63,{"$f":"E67-SUM(E62:E65)","v":6},14,6,3,10,9,15,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O62:O65)","v":1},1,1,1,1,1,1,1]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D62:D66)","v":63},{"$f":"SUMIF(All!$C$4:$C$682,E61,All!$AU$4:$AU$682)","v":6},{"$f":"SUMIF(All!$C$4:$C$682,F61,All!$AU$4:$AU$682)","v":14},{"$f":"SUMIF(All!$C$4:$C$682,G61,All!$AU$4:$AU$682)","v":6},{"$f":"SUMIF(All!$C$4:$C$682,H61,All!$AU$4:$AU$682)","v":3},{"$f":"SUMIF(All!$C$4:$C$682,I61,All!$AU$4:$AU$682)","v":10},{"$f":"SUMIF(All!$C$4:$C$682,J61,All!$AU$4:$AU$682)","v":9},{"$f":"SUMIF(All!$C$4:$C$682,K61,All!$AU$4:$AU$682)","v":15}]
[]
[null,{"$f":"TranslatedPrinciple&\" \"&C69","v":"Principle 5"},5]
[null,{"$f":"$B69&\" \"&LOWER(TranslatedOverallCompliance)&\" \"&TranslatedNA_indicators_excluded","v":"Principle 5 overall compliance (N/A indicators excluded)"},null,null,null,null,null,null,null,null,null,null,{"$f":"TranslatedCompliance_by_Sub_Principle&\" \"&TranslatedNA_indicators_excluded","v":"Compliance by Sub-Principle (N/A indicators excluded)"}]
[]
[]
[]
[]
[]
[null,{"$f":"TranslatedCompliance","v":"Compliance"},null,null,null,null,null,null,null,null,null,null,{"$f":"\"% \"&TranslatedCompliance&\" \"&TranslatedNA_indicators_excluded","v":"% Compliance (N/A indicators excluded)"}]
[null,{"$f":"B69","v":"Principle 5"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"$C69&\".1\"","v":"5.1"},{"$f":"$C69&\".2\"","v":"5.2"},{"$f":"$C69&\".3\"","v":"5.3"},null,null,null,null,null,{"$f":"B69","v":"Principle 5"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"E77","v":"5.1"},{"$f":"F77","v":"5.2"},{"$f":"G77","v":"5.3"}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"SUM(E78:K78)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E77,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F77,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G77,All!$BM$4:$BM$682)","v":0},null,null,null,null,null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D83=0,0,D78/(D83-D81))","v":0},{"$f":"IF(E83-E81=0,0,E78/(E83-E81))","v":0},{"$f":"IF(F83-F81=0,0,F78/(F83-F81))","v":0},{"$f":"IF(G83-G81=0,0,G78/(G83-G81))","v":0}]
[null,{"$f":"TranslatedRequired&Spacer2&B69","v":"Required - Principle 5"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"SUM(E79:K79)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E77,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F77,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G77,All!$BN$4:$BN$682)","v":0},null,null,null,null,null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D83=0,0,D79/(D83-D81))","v":0},{"$f":"IF(E83-E81=0,0,E79/(E83-E81))","v":0},{"$f":"IF(F83-F81=0,0,F79/(F83-F81))","v":0},{"$f":"IF(G83-G81=0,0,G79/(G83-G81))","v":0}]
[null,null,{"$f":"TranslatedNo","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E77,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F77,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G77,All!$BO$4:$BO$682)","v":0},null,null,null,null,null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D83=0,0,D80/(D83-D81))","v":0},{"$f":"IF(E83-E81=0,0,E80/(E83-E81))","v":0},{"$f":"IF(F83-F81=0,0,F80/(F83-F81))","v":0},{"$f":"IF(G83-G81=0,0,G80/(G83-G81))","v":0}]
[null,null,{"$f":"TranslatedNA","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E77,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F77,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G77,All!$BP$4:$BP$682)","v":0},null,null,null,null,null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D83=0,0,D82/(D83-D81))","v":1},{"$f":"IF(E83-E81=0,0,E82/(E83-E81))","v":1},{"$f":"IF(F83-F81=0,0,F82/(F83-F81))","v":1},{"$f":"IF(G83-G81=0,0,G82/(G83-G81))","v":1}]
[null,null,{"$f":"TranslatedOther","v":"Other"},68,{"$f":"E83-SUM(E78:E81)","v":8},16,44,null,null,null,null,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O78:O81)","v":1},1,1,1]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D78:D82)","v":68},{"$f":"SUMIF(All!$C$4:$C$682,E77,All!$AU$4:$AU$682)","v":8},{"$f":"SUMIF(All!$C$4:$C$682,F77,All!$AU$4:$AU$682)","v":16},{"$f":"SUMIF(All!$C$4:$C$682,G77,All!$AU$4:$AU$682)","v":44}]
[]
[null,{"$f":"TranslatedPrinciple&\" \"&C85","v":"Principle 6"},6]
[null,{"$f":"$B85&\" \"&LOWER(TranslatedOverallCompliance)&\" \"&TranslatedNA_indicators_excluded","v":"Principle 6 overall compliance (N/A indicators excluded)"},null,null,null,null,null,null,null,null,null,null,{"$f":"TranslatedCompliance_by_Sub_Principle&\" \"&TranslatedNA_indicators_excluded","v":"Compliance by Sub-Principle (N/A indicators excluded)"}]
[]
[]
[]
[]
[]
[null,{"$f":"TranslatedCompliance","v":"Compliance"},null,null,null,null,null,null,null,null,null,null,{"$f":"\"% \"&TranslatedCompliance&\" \"&TranslatedNA_indicators_excluded","v":"% Compliance (N/A indicators excluded)"}]
[null,{"$f":"B85","v":"Principle 6"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"$C85&\".1\"","v":"6.1"},{"$f":"$C85&\".2\"","v":"6.2"},null,null,null,null,null,null,{"$f":"B85","v":"Principle 6"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"E93","v":"6.1"},{"$f":"F93","v":"6.2"}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"SUM(E94:K94)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E93,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F93,All!$BM$4:$BM$682)","v":0},null,null,null,null,null," ",{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D99=0,0,D94/(D99-D97))","v":0},{"$f":"IF(E99-E97=0,0,E94/(E99-E97))","v":0},{"$f":"IF(F99-F97=0,0,F94/(F99-F97))","v":0}]
[null,{"$f":"TranslatedRequired&Spacer2&B85","v":"Required - Principle 6"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"SUM(E95:K95)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E93,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F93,All!$BN$4:$BN$682)","v":0},null,null,null,null,null,null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D99=0,0,D95/(D99-D97))","v":0},{"$f":"IF(E99-E97=0,0,E95/(E99-E97))","v":0},{"$f":"IF(F99-F97=0,0,F95/(F99-F97))","v":0}]
[null,null,{"$f":"TranslatedNo","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E93,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F93,All!$BO$4:$BO$682)","v":0},null,null,null,null,null,null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D99=0,0,D96/(D99-D97))","v":0},{"$f":"IF(E99-E97=0,0,E96/(E99-E97))","v":0},{"$f":"IF(F99-F97=0,0,F96/(F99-F97))","v":0}]
[null,null,{"$f":"TranslatedNA","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E93,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F93,All!$BP$4:$BP$682)","v":0},null,null,null,null,null,null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D99=0,0,D98/(D99-D97))","v":1},{"$f":"IF(E99-E97=0,0,E98/(E99-E97))","v":1},{"$f":"IF(F99-F97=0,0,F98/(F99-F97))","v":1}]
[null,null,{"$f":"TranslatedOther","v":"Other"},16,{"$f":"E99-SUM(E94:E97)","v":7},9,null,null,null,null,null,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O94:O97)","v":1},1,1]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D94:D98)","v":16},{"$f":"SUMIF(All!$C$4:$C$682,E93,All!$AU$4:$AU$682)","v":7},{"$f":"SUMIF(All!$C$4:$C$682,F93,All!$AU$4:$AU$682)","v":9}]
[]
[null,{"$f":"TranslatedPrinciple&\" \"&C101","v":"Principle 7"},7]
[null,{"$f":"$B101&\" \"&LOWER(TranslatedOverallCompliance)&\" \"&TranslatedNA_indicators_excluded","v":"Principle 7 overall compliance (N/A indicators excluded)"},null,null,null,null,null,null,null,null,null,null,{"$f":"TranslatedCompliance_by_Sub_Principle&\" \"&TranslatedNA_indicators_excluded","v":"Compliance by Sub-Principle (N/A indicators excluded)"}]
[]
[]
[]
[]
[]
[null,{"$f":"TranslatedCompliance","v":"Compliance"},null,null,null,null,null,null,null,null,null,null,{"$f":"\"% \"&TranslatedCompliance&\" \"&TranslatedNA_indicators_excluded","v":"% Compliance (N/A indicators excluded)"}]
[null,{"$f":"B101","v":"Principle 7"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"$C101&\".1\"","v":"7.1"},{"$f":"$C101&\".2\"","v":"7.2"},{"$f":"$C101&\".3\"","v":"7.3"},null,null,null,null,null,{"$f":"B101","v":"Principle 7"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"E109","v":"7.1"},{"$f":"F109","v":"7.2"},{"$f":"G109","v":"7.3"}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"SUM(E110:K110)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E109,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F109,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G109,All!$BM$4:$BM$682)","v":0},null,null,null,null,null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D115=0,0,D110/(D115-D113))","v":0},{"$f":"IF(E115-E113=0,0,E110/(E115-E113))","v":0},{"$f":"IF(F115-F113=0,0,F110/(F115-F113))","v":0},{"$f":"IF(G115-G113=0,0,G110/(G115-G113))","v":0}]
[null,{"$f":"TranslatedRequired&Spacer2&B101","v":"Required - Principle 7"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"SUM(E111:K111)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E109,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F109,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G109,All!$BN$4:$BN$682)","v":0},null,null,null,null,null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D115=0,0,D111/(D115-D113))","v":0},{"$f":"IF(E115-E113=0,0,E111/(E115-E113))","v":0},{"$f":"IF(F115-F113=0,0,F111/(F115-F113))","v":0},{"$f":"IF(G115-G113=0,0,G111/(G115-G113))","v":0}]
[null,null,{"$f":"TranslatedNo","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E109,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F109,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G109,All!$BO$4:$BO$682)","v":0},null,null,null,null,null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D115=0,0,D112/(D115-D113))","v":0},{"$f":"IF(E115-E113=0,0,E112/(E115-E113))","v":0},{"$f":"IF(F115-F113=0,0,F112/(F115-F113))","v":0},{"$f":"IF(G115-G113=0,0,G112/(G115-G113))","v":0}]
[null,null,{"$f":"TranslatedNA","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E109,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F109,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G109,All!$BP$4:$BP$682)","v":0},null,null,null,null,null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D115=0,0,D114/(D115-D113))","v":1},{"$f":"IF(E115-E113=0,0,E114/(E115-E113))","v":1},{"$f":"IF(F115-F113=0,0,F114/(F115-F113))","v":1},{"$f":"IF(G115-G113=0,0,G114/(G115-G113))","v":1}]
[null,null,{"$f":"TranslatedOther","v":"Other"},23,{"$f":"E115-SUM(E110:E113)","v":19},3,1,null,null,null,null,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O110:O113)","v":1},1,1,1]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D110:D114)","v":23},{"$f":"SUMIF(All!$C$4:$C$682,E109,All!$AU$4:$AU$682)","v":19},{"$f":"SUMIF(All!$C$4:$C$682,F109,All!$AU$4:$AU$682)","v":3},{"$f":"SUMIF(All!$C$4:$C$682,G109,All!$AU$4:$AU$682)","v":1}]
[]
[null,{"$f":"TranslatedPrinciple&\" \"&C117","v":"Principle 8"},8]
[null,{"$f":"$B117&\" \"&LOWER(TranslatedOverallCompliance)&\" \"&TranslatedNA_indicators_excluded","v":"Principle 8 overall compliance (N/A indicators excluded)"},null,null,null,null,null,null,null,null,null,null,{"$f":"TranslatedCompliance_by_Sub_Principle&\" \"&TranslatedNA_indicators_excluded","v":"Compliance by Sub-Principle (N/A indicators excluded)"}]
[]
[]
[]
[]
[]
[null,{"$f":"TranslatedCompliance","v":"Compliance"},null,null,null,null,null,null,null,null,null,null,{"$f":"\"% \"&TranslatedCompliance&\" \"&TranslatedNA_indicators_excluded","v":"% Compliance (N/A indicators excluded)"}]
[null,{"$f":"B117","v":"Principle 8"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"$C117&\".1\"","v":"8.1"},{"$f":"$C117&\".2\"","v":"8.2"},{"$f":"$C117&\".3\"","v":"8.3"},{"$f":"$C117&\".4\"","v":"8.4"},null,null,null,null,{"$f":"B117","v":"Principle 8"},null,{"$f":"TranslatedAll","v":"All"},{"$f":"E125","v":"8.1"},{"$f":"F125","v":"8.2"},{"$f":"G125","v":"8.3"},{"$f":"H125","v":"8.4"}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"SUM(E126:K126)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E125,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F125,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G125,All!$BM$4:$BM$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H125,All!$BM$4:$BM$682)","v":0},null,null,null,null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"TranslatedYes","v":"Yes"},{"$f":"IF(D131=0,0,D126/(D131-D129))","v":0},{"$f":"IF(E131-E129=0,0,E126/(E131-E129))","v":0},{"$f":"IF(F131-F129=0,0,F126/(F131-F129))","v":0},{"$f":"IF(G131-G129=0,0,G126/(G131-G129))","v":0},{"$f":"IF(H131-H129=0,0,H126/(H131-H129))","v":0}]
[null,{"$f":"TranslatedRequired&Spacer2&B117","v":"Required - Principle 8"},{"$f":"TranslatedPartial","v":"Partial"},{"$f":"SUM(E127:K127)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,E125,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F125,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G125,All!$BN$4:$BN$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H125,All!$BN$4:$BN$682)","v":0},null,null,null,null,null,{"$f":"TranslatedPartial","v":"Partial"},{"$f":"IF(D131=0,0,D127/(D131-D129))","v":0},{"$f":"IF(E131-E129=0,0,E127/(E131-E129))","v":0},{"$f":"IF(F131-F129=0,0,F127/(F131-F129))","v":0},{"$f":"IF(G131-G129=0,0,G127/(G131-G129))","v":0},{"$f":"IF(H131-H129=0,0,H127/(H131-H129))","v":0}]
[null,null,{"$f":"TranslatedNo","v":"No"},0,{"$f":"SUMIF(All!$C$4:$C$682,E125,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F125,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G125,All!$BO$4:$BO$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H125,All!$BO$4:$BO$682)","v":0},null,null,null,null,null,{"$f":"TranslatedNo","v":"No"},{"$f":"IF(D131=0,0,D128/(D131-D129))","v":0},{"$f":"IF(E131-E129=0,0,E128/(E131-E129))","v":0},{"$f":"IF(F131-F129=0,0,F128/(F131-F129))","v":0},{"$f":"IF(G131-G129=0,0,G128/(G131-G129))","v":0},{"$f":"IF(H131-H129=0,0,H128/(H131-H129))","v":0}]
[null,null,{"$f":"TranslatedNA","v":"N/A"},0,{"$f":"SUMIF(All!$C$4:$C$682,E125,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,F125,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G125,All!$BP$4:$BP$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H125,All!$BP$4:$BP$682)","v":0},null,null,null,null,null,{"$f":"TranslatedOther","v":"Other"},{"$f":"IF(D131=0,0,D130/(D131-D129))","v":1},{"$f":"IF(E131-E129=0,0,E130/(E131-E129))","v":1},{"$f":"IF(F131-F129=0,0,F130/(F131-F129))","v":0},{"$f":"IF(G131-G129=0,0,G130/(G131-G129))","v":0},{"$f":"IF(H131-H129=0,0,H130/(H131-H129))","v":1}]
[null,null,{"$f":"TranslatedOther","v":"Other"},10,{"$f":"E131-SUM(E126:E129)","v":9},0,0,1,null,null,null,null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(O126:O129)","v":1},1,0,0,1]
[null,null,{"$f":"TranslatedTotal","v":"Total"},{"$f":"SUM(D126:D130)","v":10},{"$f":"SUMIF(All!$C$4:$C$682,E125,All!$AU$4:$AU$682)","v":9},{"$f":"SUMIF(All!$C$4:$C$682,F125,All!$AU$4:$AU$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,G125,All!$AU$4:$AU$682)","v":0},{"$f":"SUMIF(All!$C$4:$C$682,H125,All!$AU$4:$AU$682)","v":1}]
[]
[]
[null,"Checksums",{"$f":"TranslatedPrinciple","v":"Principle"},{"$f":"TranslatedAll","v":"All"},".1",".2",".3",".4",".5",".6",".7"]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"C13","v":0},{"$f":"D19","v":15},{"$f":"E19","v":8},{"$f":"F19","v":7}]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},null,{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}}]
[null,{"$f":"TranslatedTotal&\" \"&TranslatedPrinciple&\" \"&C135","v":"Total Principle 0"},null,{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"C29","v":0},{"$f":"D35","v":56},10,6,5,3,15,5,12]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},null,{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}}]
[null,{"$f":"TranslatedTotal&\" \"&TranslatedPrinciple&\" \"&C138","v":"Total Principle 0"},null,{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"C45","v":0},{"$f":"D51","v":30},{"$f":"E51","v":11},{"$f":"F51","v":6},{"$f":"G51","v":2},{"$f":"H51","v":11}]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},null,{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}}]
[null,{"$f":"TranslatedTotal&\" \"&TranslatedPrinciple&\" \"&C141","v":"Total Principle 0"},null,{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"C61","v":0},{"$f":"D67","v":63},6,14,6,3,10,9,15]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},null,{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}}]
[null,{"$f":"TranslatedTotal&\" \"&TranslatedPrinciple&\" \"&C144","v":"Total Principle 0"},null,{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"C77","v":0},{"$f":"D83","v":68},{"$f":"E83","v":8},{"$f":"F83","v":16},{"$f":"G83","v":44}]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},null,{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}}]
[null,{"$f":"TranslatedTotal&\" \"&TranslatedPrinciple&\" \"&C147","v":"Total Principle 0"},null,{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"C93","v":0},{"$f":"D99","v":16},{"$f":"E99","v":7},{"$f":"F99","v":9}]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},null,{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}}]
[null,{"$f":"TranslatedTotal&\" \"&TranslatedPrinciple&\" \"&C150","v":"Total Principle 0"},null,{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"C109","v":0},{"$f":"D115","v":23},{"$f":"E115","v":19},{"$f":"F115","v":3},{"$f":"G115","v":1}]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},null,{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}}]
[null,{"$f":"TranslatedTotal&\" \"&TranslatedPrinciple&\" \"&C153","v":"Total Principle 0"},null,{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}}]
[null,{"$f":"TranslatedRequired","v":"Required"},{"$f":"C125","v":0},{"$f":"D131","v":10},{"$f":"E131","v":9},{"$f":"F131","v":0},{"$f":"G131","v":0},{"$f":"H131","v":1}]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},null,{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}}]
[null,{"$f":"TranslatedTotal&\" \"&TranslatedPrinciple&\" \"&C156","v":"Total Principle 0"},null,{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}},{"$f":"#REF!","v":{"$error":"#REF!"}}]
[null,{"$f":"TranslatedRequired","v":"Required"},null,{"$f":"SUM(D135,D138,D141,D144,D147,D150,D153,D156)","v":281},78,61,58,18,25,14,27]
[null,{"$f":"TranslatedRecommended","v":"Recommended"},null,{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"}]
[null,{"$f":"TranslatedTotal&\" \"&TranslatedPrinciple&\" \"&C159","v":"Total Principle "},null,{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"},{"$error":"#REF!"}]

{"sheet":"Report","index":15,"n_rows":623,"n_cols":55,"rows_kept":623,"cut":false,"hidden":false,"merged":[[2,50,5,50],[2,52,5,52],[2,54,5,54],[1,1,1,9],[2,1,2,9],[2,48,5,48]]}
[]
[null,{"$f":"UPPER(CHOOSE(LanguageNumber,AW2,AY2,BA2,BC2))","v":"COMPLETE DATA REPORT"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,Drivers!K18,Drivers!L18,Drivers!M18,Drivers!N18)","v":"SELF-ASSESSMENT"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,Drivers!K34,Drivers!L34,Drivers!M34,Drivers!N34)","v":"EXTERNAL ASSESSMENT"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Complete Data Report",null,"Rapport complet des données",null,"Reporte de Datos Completos",null,"Complete Data Report"]
[null,{"$f":"CHOOSE(LanguageNumber,AW3,AY3,BA3,BC3)","v":"This report contains all the assessment data for detailed analysis, including both self-assessment and external assessment compliance data. Filters may be applied to one or more of the columns to select the information appropriately. Columns may be hidden if not required. The report is formatted for printing - A3 paper should be used.\nNote: Sorting the data has no effect. "},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"This report contains all the assessment data for detailed analysis, including both self-assessment and external assessment compliance data. Filters may be applied to one or more of the columns to select the information appropriately. Columns may be hidden if not required. The report is formatted for printing - A3 paper should be used.\nNote: Sorting the data has no effect. ",null,"Ce rapport contient toutes les données d'évaluation à des fins d'analyse détaillée; il contient les données de conformité obtenues suite à une auto-évaluation ou une évaluation externe. Il est possible de filtrer une ou plusieurs colonnes pour sélectionner les informations appropriées. Les colonnes peuvent être masquées si nécessaire. Ce rapport est prévu pour une impression sur du papier format A3. Remarque : Le tri des données n’a aucun effet. ",null,"Este reporte contiene toda la información sobre la evaluación para un análisis detallado, e incluye los datos de cumplimiento tanto para la autoevaluación como la evaluación externa.  Se pueden aplicar filtros a una o más columnas para seleccionar la información requerida.  Si no se necesitan, estas columnas pueden ocultarse. Este reporte está formateado para imprimir en tamaño A3.    NOTA: La clasificación de los datos no tiene ningún efecto.  "]
[null,{"$f":"TranslatedFilter","v":"Filter"},{"$f":"TranslatedFilter","v":"Filter"},{"$f":"TranslatedFilter","v":"Filter"},null,{"$f":"TranslatedFilter","v":"Filter"},null,null,{"$f":"CHOOSE(LanguageNumber,AW4,AY4,#REF!,#REF!)","v":0},null,null,{"$f":"CHOOSE(LanguageNumber,AW4,AY4,#REF!,#REF!)","v":0},{"$f":"TranslatedFilter","v":"Filter"},{"$f":"TranslatedFilter","v":"Filter"},{"$f":"TranslatedFilter","v":"Filter"},{"$f":"TranslatedFilter","v":"Filter"},{"$f":"TranslatedFilter","v":"Filter"},null,null,null,{"$f":"TranslatedFilter","v":"Filter"},"Filter","Filter","Filter","Filter","Filter","Filter","Filter","Filter","Filter","Filter","Filter",null,null,null,{"$f":"TranslatedFilter","v":"Filter"}]
[null,"▽ ▽","▽ ▽","▽ ▽",null,"▽ ▽",null,null,{"$f":"CHOOSE(LanguageNumber,AW5,AY5,#REF!,#REF!)","v":0},null,null,{"$f":"CHOOSE(LanguageNumber,AW5,AY5,#REF!,#REF!)","v":0},"▽ ▽","▽ ▽","▽ ▽","▽ ▽","▽ ▽",null,null,null,"▽ ▽","▽ ▽","▽ ▽","▽ ▽","▽ ▽","▽ ▽","▽ ▽","▽ ▽","▽ ▽","▽ ▽","▽ ▽","▽ ▽",null,null,null,"▽ ▽"]
[null,{"$f":"All!B3","v":"Principle"},{"$f":"All!C3","v":"Sub-principle"},{"$f":"All!D3","v":"Sub-sub-principle"},{"$f":"All!E3","v":"Sub-sub-principle"},{"$f":"All!F3","v":"Practice ID"},{"$f":"All!G3","v":"Practice"},{"$f":"All!H3","v":"Practice data source"},{"$f":"All!I3","v":"Indicator ID"},{"$f":"All!J3","v":"Indicator"},{"$f":"All!K3","v":"Evidence required"},{"$f":"All!L3","v":"[SPARE]"},{"$f":"All!M3","v":"Detailed indicator category"},{"$f":"All!N3","v":"Indicator category"},{"$f":"All!O3","v":"Function"},{"$f":"All!P3","v":"[SPARE]"},{"$f":"All!Q3","v":"Compliance"},{"$f":"All!R3","v":"Evidence document (specify document name, section number and page number)"},{"$f":"All!S3","v":"Comments \n(include notes on how the practice is implemented)"},{"$f":"All!T3","v":"Action"},{"$f":"All!U3","v":"Reviewer name"},{"$f":"All!V3","v":"Evidence sent to Assessor?"},{"$f":"All!W3","v":"Spare 2"},{"$f":"All!X3","v":"Spare 3"},{"$f":"All!Y3","v":"Spare 4"},{"$f":"All!Z3","v":"Spare 5"},{"$f":"All!AA3","v":"Spare 6"},{"$f":"All!AB3","v":"Spare 7"},{"$f":"All!AC3","v":"Spare 8"},{"$f":"All!AD3","v":"Spare 9"},{"$f":"All!AE3","v":"Spare 10"},{"$f":"All!AF3","v":"Compliance"},{"$f":"All!AG3","v":"Evidence document (specify document name, section number and page number)"},{"$f":"All!AH3","v":"Comments \n(include notes on how the practice is implemented)"},{"$f":"All!AI3","v":"Recommendation to Provider"},{"$f":"All!AJ3","v":"Reviewer name"},{"$f":"All!AK3","v":"Guidance notes for Assessor"},{"$f":"All!AL3","v":"Scheme Operator comments"},{"$f":"All!AM3","v":"Assessor's response to Scheme Operator"},{"$f":"All!AN3","v":"Scheme Operator conclusion"},{"$f":"All!AO3","v":"Spare 15"},{"$f":"All!AP3","v":"Spare 16"},{"$f":"All!AQ3","v":"Spare 17"},{"$f":"All!AR3","v":"Spare 18"},{"$f":"All!AS3","v":"Spare 19"},{"$f":"All!AT3","v":"Spare 20"}]
[null,{"$f":"All!B4","v":"1"},{"$f":"All!C4","v":"1.1"},{"$f":"All!D4","v":"1.1.1"},{"$f":"All!E4","v":"1.1.1: Providers shall ensure that funds equal to the total value of outstanding mobile money liabilities are held in one or more custodial accounts on behalf of the mobile money users."},{"$f":"All!F4","v":"1.1.1.1"},{"$f":"All!G4","v":"1.1.1.1: VALUE OF E-MONEY MUST BALANCE VALUE IN CUSTODIAL ACCOUNTS\nThe value of funds held across all custodial accounts must be equal to or greater than the total value of outstanding mobile money liabilities. Depending upon the regulatory requirements in the country in question, either (1) 100% of the funds held in custodial accounts must be stored in a bank; or (2) some or all of the funds may be invested in other safe, liquid investments such as government bonds.\n\nIn case of discrepancy, the following must be implemented:\n• All discrepancies must be identified. \n• There should be an action plan for resolution which is being followed and tracked by management.\n• Discrepancies should be resolved promptly where possible. Long-term issues should have a clear plan and monitoring / management\n• The root cause of all discrepancies should be understood.\n• Any discrepancy must not be greater than 5% of the sum value of the custodial bank accounts at any time.\n\nProviders should keep records of the current and historical balances of the custodial account(s) and aggregate outstanding mobile money liabilities. "},{"$f":"All!H4","v":"GSMA RMT (FIN-06)"},{"$f":"All!I4","v":"1.1.1.1.1"},{"$f":"All!J4","v":"1.1.1.1.1: Are funds equal to or greater in value than the total value of outstanding mobile money liabilities held in custodial accounts on behalf of mobile money users?\n"},{"$f":"All!K4","v":"1) Custodial bank reconciliation record (most recent)\n- Check the total value of mobile money users funds held in custodian accounts is greater than, or equal to, the  total value of outstanding mobile money liabilities.\n- If there is a discrepancy, check that:\n• The discrepancy is not greater than 5% of the total value of the custodial bank accounts.\n• There is an action plan for resolution which is being followed and tracked by management.\n• The root cause of the discrepancy is understood or is under investigation, with supporting documentation. "},{"$f":"All!L4","v":0},{"$f":"All!M4","v":"Urgent Required"},{"$f":"All!N4","v":"Required"},{"$f":"All!O4","v":"FinOps"},{"$f":"All!P4","v":0},{"$f":"All!Q4","v":0},{"$f":"All!R4","v":0},{"$f":"All!S4","v":0},{"$f":"All!T4","v":0},{"$f":"All!U4","v":0},{"$f":"All!V4","v":0},{"$f":"All!W4","v":0},{"$f":"All!X4","v":0},{"$f":"All!Y4","v":0},{"$f":"All!Z4","v":0},{"$f":"All!AA4","v":0},{"$f":"All!AB4","v":0},{"$f":"All!AC4","v":0},{"$f":"All!AD4","v":0},{"$f":"All!AE4","v":0},{"$f":"All!AF4","v":0},{"$f":"All!AG4","v":0},{"$f":"All!AH4","v":0},{"$f":"All!AI4","v":0},{"$f":"All!AJ4","v":0},{"$f":"All!AK4","v":0},{"$f":"All!AL4","v":0},{"$f":"All!AM4","v":0},{"$f":"All!AN4","v":0},{"$f":"All!AO4","v":0},{"$f":"All!AP4","v":0},{"$f":"All!AQ4","v":0},{"$f":"All!AR4","v":0},{"$f":"All!AS4","v":0},{"$f":"All!AT4","v":0}]
[null,{"$f":"All!B5","v":"1"},{"$f":"All!C5","v":"1.1"},{"$f":"All!D5","v":"1.1.1"},{"$f":"All!E5","v":0},{"$f":"All!F5","v":"1.1.1.1"},{"$f":"All!G5","v":0},{"$f":"All!H5","v":0},{"$f":"All!I5","v":"1.1.1.1.2"},{"$f":"All!J5","v":"1.1.1.1.2: Are records of the current and historical balances of the custodial account(s) and aggregate outstanding mobile money liabilities readily available?\n"},{"$f":"All!K5","v":"1) Custodial bank reconciliation records (six months)\n- Check that the completed reconciliations for all custodial accounts are easily retrievable for 3-4 chosen dates within the last six months.\n- Check the historical balances are available for those dates.\n- If historical reconciliation balances are not available, review process documentation to ensure that records will be kept available."},{"$f":"All!L5","v":0},{"$f":"All!M5","v":"Standard Required"},{"$f":"All!N5","v":"Required"},{"$f":"All!O5","v":"FinOps"},{"$f":"All!P5","v":0},{"$f":"All!Q5","v":0},{"$f":"All!R5","v":0},{"$f":"All!S5","v":0},{"$f":"All!T5","v":0},{"$f":"All!U5","v":0},{"$f":"All!V5","v":0},{"$f":"All!W5","v":0},{"$f":"All!X5","v":0},{"$f":"All!Y5","v":0},{"$f":"All!Z5","v":0},{"$f":"All!AA5","v":0},{"$f":"All!AB5","v":0},{"$f":"All!AC5","v":0},{"$f":"All!AD5","v":0},{"$f":"All!AE5","v":0},{"$f":"All!AF5","v":0},{"$f":"All!AG5","v":0},{"$f":"All!AH5","v":0},{"$f":"All!AI5","v":0},{"$f":"All!AJ5","v":0},{"$f":"All!AK5","v":0},{"$f":"All!AL5","v":0},{"$f":"All!AM5","v":0},{"$f":"All!AN5","v":0},{"$f":"All!AO5","v":0},{"$f":"All!AP5","v":0},{"$f":"All!AQ5","v":0},{"$f":"All!AR5","v":0},{"$f":"All!AS5","v":0},{"$f":"All!AT5","v":0}]
[null,{"$f":"All!B6","v":"1"},{"$f":"All!C6","v":"1.1"},{"$f":"All!D6","v":"1.1.1"},{"$f":"All!E6","v":0},{"$f":"All!F6","v":"1.1.1.2"},{"$f":"All!G6","v":"1.1.1.2: CUSTODIAL BANK RECONCILIATION \nResponsibility for fund safeguarding should be assigned to a Mobile Money finance operations function that is separated from the business operations function. \n\nA process should be documented for reconciling the custodial account with the e-money system to ensure that the value of e-money matches the value of funds in the custodial account. This process should include the following actions:\n• e-money creation (e-money is created when funds are added to the custodial account)\n• e-money allocation (new e-money is allocated to the appropriate account)\n• e-money deletion (e-money is deleted when funds are withdrawn from the custodial account)\n\nReconciliation with the custodial bank should be performed at least daily on weekdays. The custodial bank reconciliation process should clearly specify the start and end point of each reconciliation period, clearly defining which transactions should be included to reach the final settlement position. A procedure should be specified for resolving reconciliation discrepancies.\n\nReconciliation data should be transferred via direct data exchange between the systems of the provider and the custodial bank in order to reduce the risk of errors and fraud. The reconciliation process itself may be manual or automated.\n\n"},{"$f":"All!H6","v":"GSMA RMT (FIN-05,\nFIN-11,\nFIN-13,\nFIN-14,\nFIN-15,\nFIN-16,\nFIN-17)\nISO 27002:2013 Sec. 12.1"},{"$f":"All!I6","v":"1.1.1.2.1"},{"$f":"All!J6","v":"1.1.1.2.1: Is responsibility for fund safeguarding assigned to a mobile money finance team that is separated from the business operations function?\n"},{"$f":"All!K6","v":"1) Documented custodial bank reconciliation process\n- Check responsibility for managing e-money is assigned to a mobile money finance team. \n\n2) Finance team organization chart and mobile money operations organisation chart. \n- Check there is separation of the mobile money finance and operations teams\n\n3) Custodial account mandates. \n- Check that only mobile money finance function personnel and mobile money senior management are permitted to operate the custodial accounts."},{"$f":"All!L6","v":0},{"$f":"All!M6","v":"Standard required"},{"$f":"All!N6","v":"Required"},{"$f":"All!O6","v":"FinOps"},{"$f":"All!P6","v":0},{"$f":"All!Q6","v":0},{"$f":"All!R6","v":0},{"$f":"All!S6","v":0},{"$f":"All!T6","v":0},{"$f":"All!U6","v":0},{"$f":"All!V6","v":0},{"$f":"All!W6","v":0},{"$f":"All!X6","v":0},{"$f":"All!Y6","v":0},{"$f":"All!Z6","v":0},{"$f":"All!AA6","v":0},{"$f":"All!AB6","v":0},{"$f":"All!AC6","v":0},{"$f":"All!AD6","v":0},{"$f":"All!AE6","v":0},{"$f":"All!AF6","v":0},{"$f":"All!AG6","v":0},{"$f":"All!AH6","v":0},{"$f":"All!AI6","v":0},{"$f":"All!AJ6","v":0},{"$f":"All!AK6","v":0},{"$f":"All!AL6","v":0},{"$f":"All!AM6","v":0},{"$f":"All!AN6","v":0},{"$f":"All!AO6","v":0},{"$f":"All!AP6","v":0},{"$f":"All!AQ6","v":0},{"$f":"All!AR6","v":0},{"$f":"All!AS6","v":0},{"$f":"All!AT6","v":0}]
[null,{"$f":"All!B7","v":"1"},{"$f":"All!C7","v":"1.1"},{"$f":"All!D7","v":"1.1.1"},{"$f":"All!E7","v":0},{"$f":"All!F7","v":"1.1.1.2"},{"$f":"All!G7","v":0},{"$f":"All!H7","v":0},{"$f":"All!I7","v":"1.1.1.2.2"},{"$f":"All!J7","v":"1.1.1.2.2: Is the custodial bank reconciliation process documented in detail, including the actions of e-money creation, allocation and deletion, and a procedure for resolving reconciliation discrepancies promptly?\n"},{"$f":"All!K7","v":"1) Documented custodial bank reconciliation process. \n- Check that the custodial bank reconciliation process is documented in detail, including the actions of:\n    • e-money creation (e-money is created when funds are added to the custodial account)\n    • e-money allocation (new e-money is allocated to the appropriate account)\n    • e-money deletion (e-money is deleted when funds are withdrawn from the custodial account)\n- Check that the process includes a procedure for resolving reconciliation discrepancies promptly, including escalation steps."},{"$f":"All!L7","v":0},{"$f":"All!M7","v":"Urgent Required"},{"$f":"All!N7","v":"Required"},{"$f":"All!O7","v":"FinOps"},{"$f":"All!P7","v":0},{"$f":"All!Q7","v":0},{"$f":"All!R7","v":0},{"$f":"All!S7","v":0},{"$f":"All!T7","v":0},{"$f":"All!U7","v":0},{"$f":"All!V7","v":0},{"$f":"All!W7","v":0},{"$f":"All!X7","v":0},{"$f":"All!Y7","v":0},{"$f":"All!Z7","v":0},{"$f":"All!AA7","v":0},{"$f":"All!AB7","v":0},{"$f":"All!AC7","v":0},{"$f":"All!AD7","v":0},{"$f":"All!AE7","v":0},{"$f":"All!AF7","v":0},{"$f":"All!AG7","v":0},{"$f":"All!AH7","v":0},{"$f":"All!AI7","v":0},{"$f":"All!AJ7","v":0},{"$f":"All!AK7","v":0},{"$f":"All!AL7","v":0},{"$f":"All!AM7","v":0},{"$f":"All!AN7","v":0},{"$f":"All!AO7","v":0},{"$f":"All!AP7","v":0},{"$f":"All!AQ7","v":0},{"$f":"All!AR7","v":0},{"$f":"All!AS7","v":0},{"$f":"All!AT7","v":0}]
[null,{"$f":"All!B8","v":"1"},{"$f":"All!C8","v":"1.1"},{"$f":"All!D8","v":"1.1.1"},{"$f":"All!E8","v":0},{"$f":"All!F8","v":"1.1.1.2"},{"$f":"All!G8","v":0},{"$f":"All!H8","v":0},{"$f":"All!I8","v":"1.1.1.2.3"},{"$f":"All!J8","v":"1.1.1.2.3: Is reconciliation with the custodial bank performed at least daily on weekdays?\n"},{"$f":"All!K8","v":"1) Documented custodial bank reconciliation process / custodial bank reconciliation records \n-  Check that the reconciliation with the custodial bank is performed at least daily on weekdays.\n"},{"$f":"All!L8","v":0},{"$f":"All!M8","v":"Standard required"},{"$f":"All!N8","v":"Required"},{"$f":"All!O8","v":"FinOps"},{"$f":"All!P8","v":0},{"$f":"All!Q8","v":0},{"$f":"All!R8","v":0},{"$f":"All!S8","v":0},{"$f":"All!T8","v":0},{"$f":"All!U8","v":0},{"$f":"All!V8","v":0},{"$f":"All!W8","v":0},{"$f":"All!X8","v":0},{"$f":"All!Y8","v":0},{"$f":"All!Z8","v":0},{"$f":"All!AA8","v":0},{"$f":"All!AB8","v":0},{"$f":"All!AC8","v":0},{"$f":"All!AD8","v":0},{"$f":"All!AE8","v":0},{"$f":"All!AF8","v":0},{"$f":"All!AG8","v":0},{"$f":"All!AH8","v":0},{"$f":"All!AI8","v":0},{"$f":"All!AJ8","v":0},{"$f":"All!AK8","v":0},{"$f":"All!AL8","v":0},{"$f":"All!AM8","v":0},{"$f":"All!AN8","v":0},{"$f":"All!AO8","v":0},{"$f":"All!AP8","v":0},{"$f":"All!AQ8","v":0},{"$f":"All!AR8","v":0},{"$f":"All!AS8","v":0},{"$f":"All!AT8","v":0}]
[null,{"$f":"All!B9","v":"1"},{"$f":"All!C9","v":"1.1"},{"$f":"All!D9","v":"1.1.1"},{"$f":"All!E9","v":0},{"$f":"All!F9","v":"1.1.1.2"},{"$f":"All!G9","v":0},{"$f":"All!H9","v":0},{"$f":"All!I9","v":"1.1.1.2.4"},{"$f":"All!J9","v":"1.1.1.2.4: Is the reconciliation process overseen by a reviewing function with separation of duty, to ensure reconciliation is accurately completed?\n"},{"$f":"All!K9","v":"1) Documented custodial bank reconciliation process / Custodial bank reconciliation records \n-  Check that custodial bank reconciliation is independently reviewed for accuracy and signed off by a separate team (i.e. segregation of duties).\n"},{"$f":"All!L9","v":0},{"$f":"All!M9","v":"Standard required"},{"$f":"All!N9","v":"Required"},{"$f":"All!O9","v":"FinOps"},{"$f":"All!P9","v":0},{"$f":"All!Q9","v":0},{"$f":"All!R9","v":0},{"$f":"All!S9","v":0},{"$f":"All!T9","v":0},{"$f":"All!U9","v":0},{"$f":"All!V9","v":0},{"$f":"All!W9","v":0},{"$f":"All!X9","v":0},{"$f":"All!Y9","v":0},{"$f":"All!Z9","v":0},{"$f":"All!AA9","v":0},{"$f":"All!AB9","v":0},{"$f":"All!AC9","v":0},{"$f":"All!AD9","v":0},{"$f":"All!AE9","v":0},{"$f":"All!AF9","v":0},{"$f":"All!AG9","v":0},{"$f":"All!AH9","v":0},{"$f":"All!AI9","v":0},{"$f":"All!AJ9","v":0},{"$f":"All!AK9","v":0},{"$f":"All!AL9","v":0},{"$f":"All!AM9","v":0},{"$f":"All!AN9","v":0},{"$f":"All!AO9","v":0},{"$f":"All!AP9","v":0},{"$f":"All!AQ9","v":0},{"$f":"All!AR9","v":0},{"$f":"All!AS9","v":0},{"$f":"All!AT9","v":0}]
[null,{"$f":"All!B10","v":"1"},{"$f":"All!C10","v":"1.1"},{"$f":"All!D10","v":"1.1.1"},{"$f":"All!E10","v":0},{"$f":"All!F10","v":"1.1.1.2"},{"$f":"All!G10","v":0},{"$f":"All!H10","v":0},{"$f":"All!I10","v":"1.1.1.2.5"},{"$f":"All!J10","v":"1.1.1.2.5: Does the custodial bank reconciliation process specify the start and end point of each reconciliation period, clearly defining which transactions should be included to reach the final settlement position?\n"},{"$f":"All!K10","v":0},{"$f":"All!L10","v":0},{"$f":"All!M10","v":"Recommended"},{"$f":"All!N10","v":"Recommended"},{"$f":"All!O10","v":"FinOps"},{"$f":"All!P10","v":0},{"$f":"All!Q10","v":0},{"$f":"All!R10","v":0},{"$f":"All!S10","v":0},{"$f":"All!T10","v":0},{"$f":"All!U10","v":0},{"$f":"All!V10","v":0},{"$f":"All!W10","v":0},{"$f":"All!X10","v":0},{"$f":"All!Y10","v":0},{"$f":"All!Z10","v":0},{"$f":"All!AA10","v":0},{"$f":"All!AB10","v":0},{"$f":"All!AC10","v":0},{"$f":"All!AD10","v":0},{"$f":"All!AE10","v":0},{"$f":"All!AF10","v":0},{"$f":"All!AG10","v":0},{"$f":"All!AH10","v":0},{"$f":"All!AI10","v":0},{"$f":"All!AJ10","v":0},{"$f":"All!AK10","v":0},{"$f":"All!AL10","v":0},{"$f":"All!AM10","v":0},{"$f":"All!AN10","v":0},{"$f":"All!AO10","v":0},{"$f":"All!AP10","v":0},{"$f":"All!AQ10","v":0},{"$f":"All!AR10","v":0},{"$f":"All!AS10","v":0},{"$f":"All!AT10","v":0}]
[null,{"$f":"All!B11","v":"1"},{"$f":"All!C11","v":"1.1"},{"$f":"All!D11","v":"1.1.2"},{"$f":"All!E11","v":"1.1.2: Providers shall ensure that user funds are ring-fenced to prevent attachment from the creditors of the provider in the event of a provider’s insolvency."},{"$f":"All!F11","v":"1.1.2.1"},{"$f":"All!G11","v":"1.1.2.1: PROTECTION OF FUNDS AGAINST LOSS DUE TO INSOLVENCY OF MOBILE MONEY PROVIDER\nUser funds must be legally segregated from the mobile money provider's assets to ensure that these funds may not be claimed by creditors of the provider in the event of a provider's insolvency. \n\nIn most countries with a common-law legal tradition (see definition), some form of a “trust” can be set up to ensure that funds are protected from a provider’s creditors. Funds held by the trust may not be claimed by the provider's creditors or the trustee's creditors.\n\nIn countries with a civil-law legal tradition, an arrangement similar to a common-law trust (such as a fiduciary contract) may be available, although in some countries user funds are not guaranteed full protection from the creditors of the fiduciary in the event of the fiduciary's insolvency. This risk can be mitigated if the fiduciary ensures that contractual agreements with creditors acknowledge that these assets are ring-fenced and unavailable in the event of the fiduciary’s insolvency.\n"},{"$f":"All!H11","v":"GSMA RMT (FIN-08)"},{"$f":"All!I11","v":"1.1.2.1.1"},{"$f":"All!J11","v":"1.1.2.1.1: Are user funds legally segregated - either through a trust or an arrangement that offers a similar level of protection - from the mobile money provider's assets (and the trustee's assets) to ensure that the funds may not be claimed by creditors in the event of the provider's or trustee's insolvency?\n"},{"$f":"All!K11","v":"1) Documented custodial bank reconciliation process. \n- Check the operator has formally identified measures to ensure customer funds are protected in the event of the operator, of any other key party, becoming insolvent. \n- Check the identified measures have been implemented effectively. \n\nNote 1: measures could include trust account, agreement with the regulator, separated commercial and trust accounts, etc.\nNote 2: This can be marked as N/A if trust accounts are not legally recognised the country of operation."},{"$f":"All!L11","v":0},{"$f":"All!M11","v":"Urgent Required"},{"$f":"All!N11","v":"Required"},{"$f":"All!O11","v":"FinOps"},{"$f":"All!P11","v":0},{"$f":"All!Q11","v":0},{"$f":"All!R11","v":0},{"$f":"All!S11","v":0},{"$f":"All!T11","v":0},{"$f":"All!U11","v":0},{"$f":"All!V11","v":0},{"$f":"All!W11","v":0},{"$f":"All!X11","v":0},{"$f":"All!Y11","v":0},{"$f":"All!Z11","v":0},{"$f":"All!AA11","v":0},{"$f":"All!AB11","v":0},{"$f":"All!AC11","v":0},{"$f":"All!AD11","v":0},{"$f":"All!AE11","v":0},{"$f":"All!AF11","v":0},{"$f":"All!AG11","v":0},{"$f":"All!AH11","v":0},{"$f":"All!AI11","v":0},{"$f":"All!AJ11","v":0},{"$f":"All!AK11","v":0},{"$f":"All!AL11","v":0},{"$f":"All!AM11","v":0},{"$f":"All!AN11","v":0},{"$f":"All!AO11","v":0},{"$f":"All!AP11","v":0},{"$f":"All!AQ11","v":0},{"$f":"All!AR11","v":0},{"$f":"All!AS11","v":0},{"$f":"All!AT11","v":0}]
[null,{"$f":"All!B12","v":"1"},{"$f":"All!C12","v":"1.1"},{"$f":"All!D12","v":"1.1.3"},{"$f":"All!E12","v":"1.1.3: Providers shall take measures to mitigate the risk of loss of funds due to insolvency of the bank, bond issuer, or other entity in which funds are invested."},{"$f":"All!F12","v":"1.1.3.1"},{"$f":"All!G12","v":"1.1.3.1: PROTECTION OF FUNDS AGAINST LOSS DUE TO INSOLVENCY OF CUSTODIAL BANK\nA risk assessment must be carried on the custodial bank to determine the bank's solvency. A risk mitigation strategy should be actioned appropriately. Recommended mitigation options include:\n• Custodial bank's deposit insurance, if it enables pass-through protection of individual mobile money wallets (this is not always the case);\n• Private deposit Insurance by the mobile money provider;\n• Spread risk across multiple banks;\n• Select custodial bank with a high reputation / rating;\n• Guarantee from the custodial bank’s parent group;\n• Guarantee from mobile money provider’s parent group.\n"},{"$f":"All!H12","v":0},{"$f":"All!I12","v":"1.1.3.1.1"},{"$f":"All!J12","v":"1.1.3.1.1: Has a risk assessment been carried on the custodial bank to determine the bank's solvency and a risk mitigation strategy actioned appropriately?\n"},{"$f":"All!K12","v":"1) Documented custodial bank reconciliation process. \n- Check the operator has assessed the custodial bank to determine their solvency and their risk of insolvency.\n- Check the operator has identified and actioned an appropriate migitation stratagy for custodial bank insolvency risk (Note: refer to Practice for examples)."},{"$f":"All!L12","v":0},{"$f":"All!M12","v":"Urgent Required"},{"$f":"All!N12","v":"Required"},{"$f":"All!O12","v":"FinOps"},{"$f":"All!P12","v":0},{"$f":"All!Q12","v":0},{"$f":"All!R12","v":0},{"$f":"All!S12","v":0},{"$f":"All!T12","v":0},{"$f":"All!U12","v":0},{"$f":"All!V12","v":0},{"$f":"All!W12","v":0},{"$f":"All!X12","v":0},{"$f":"All!Y12","v":0},{"$f":"All!Z12","v":0},{"$f":"All!AA12","v":0},{"$f":"All!AB12","v":0},{"$f":"All!AC12","v":0},{"$f":"All!AD12","v":0},{"$f":"All!AE12","v":0},{"$f":"All!AF12","v":0},{"$f":"All!AG12","v":0},{"$f":"All!AH12","v":0},{"$f":"All!AI12","v":0},{"$f":"All!AJ12","v":0},{"$f":"All!AK12","v":0},{"$f":"All!AL12","v":0},{"$f":"All!AM12","v":0},{"$f":"All!AN12","v":0},{"$f":"All!AO12","v":0},{"$f":"All!AP12","v":0},{"$f":"All!AQ12","v":0},{"$f":"All!AR12","v":0},{"$f":"All!AS12","v":0},{"$f":"All!AT12","v":0}]
[null,{"$f":"All!B13","v":"1"},{"$f":"All!C13","v":"1.1"},{"$f":"All!D13","v":"1.1.3"},{"$f":"All!E13","v":0},{"$f":"All!F13","v":"1.1.3.2"},{"$f":"All!G13","v":"1.1.3.2: MONITORING HEALTH OF CUSTODIAL BANK OR SIMILAR ENTITY\nMobile money providers should monitor the health of each bank, bond issuer, and/or other entity in which user funds are invested. This is particularly important in the absence of an effective public or private mechanism for insuring/guaranteeing user funds."},{"$f":"All!H13","v":"GSMA RMT (FIN-02)"},{"$f":"All!I13","v":"1.1.3.2.1"},{"$f":"All!J13","v":"1.1.3.2.1: Has a process been established for regularly monitoring the health of each bank, bond issuer, and/or other entity in which user funds are invested?\n"},{"$f":"All!K13","v":0},{"$f":"All!L13","v":0},{"$f":"All!M13","v":"Recommended"},{"$f":"All!N13","v":"Recommended"},{"$f":"All!O13","v":"FinOps"},{"$f":"All!P13","v":0},{"$f":"All!Q13","v":0},{"$f":"All!R13","v":0},{"$f":"All!S13","v":0},{"$f":"All!T13","v":0},{"$f":"All!U13","v":0},{"$f":"All!V13","v":0},{"$f":"All!W13","v":0},{"$f":"All!X13","v":0},{"$f":"All!Y13","v":0},{"$f":"All!Z13","v":0},{"$f":"All!AA13","v":0},{"$f":"All!AB13","v":0},{"$f":"All!AC13","v":0},{"$f":"All!AD13","v":0},{"$f":"All!AE13","v":0},{"$f":"All!AF13","v":0},{"$f":"All!AG13","v":0},{"$f":"All!AH13","v":0},{"$f":"All!AI13","v":0},{"$f":"All!AJ13","v":0},{"$f":"All!AK13","v":0},{"$f":"All!AL13","v":0},{"$f":"All!AM13","v":0},{"$f":"All!AN13","v":0},{"$f":"All!AO13","v":0},{"$f":"All!AP13","v":0},{"$f":"All!AQ13","v":0},{"$f":"All!AR13","v":0},{"$f":"All!AS13","v":0},{"$f":"All!AT13","v":0}]
[null,{"$f":"All!B14","v":"1"},{"$f":"All!C14","v":"1.1"},{"$f":"All!D14","v":"1.1.3"},{"$f":"All!E14","v":0},{"$f":"All!F14","v":"1.1.3.3"},{"$f":"All!G14","v":"1.1.3.3: DIVERSIFICATION OF FUNDS\nMobile money providers should consider diversification of funds among multiple banks (and/or other entities in which user funds are invested) to mitigate insolvency risk. At minimum, providers should begin diversification of funds once the value of user funds exceeds the value of the provider's net equity.\n\nIf an effective public or private mechanism for insuring user funds is in place, providers should still consider whether diversification of funds makes sense as a risk mitigation measure (e.g., to reduce risk of reliance on a single bank) or for commercial reasons (e.g., to facilitate cash-in and cash-out by financial ecosystem partners). \n"},{"$f":"All!H14","v":"GSMA RMT (FIN-09)"},{"$f":"All!I14","v":"1.1.3.3.1"},{"$f":"All!J14","v":"1.1.3.3.1: If the value of user funds exceeds the value of the provider's net equity, has the provider diversified funds among multiple banks (and/or other entities in which user funds are invested)?\n"},{"$f":"All!K14","v":0},{"$f":"All!L14","v":0},{"$f":"All!M14","v":"Recommended"},{"$f":"All!N14","v":"Recommended"},{"$f":"All!O14","v":"FinOps"},{"$f":"All!P14","v":0},{"$f":"All!Q14","v":0},{"$f":"All!R14","v":0},{"$f":"All!S14","v":0},{"$f":"All!T14","v":0},{"$f":"All!U14","v":0},{"$f":"All!V14","v":0},{"$f":"All!W14","v":0},{"$f":"All!X14","v":0},{"$f":"All!Y14","v":0},{"$f":"All!Z14","v":0},{"$f":"All!AA14","v":0},{"$f":"All!AB14","v":0},{"$f":"All!AC14","v":0},{"$f":"All!AD14","v":0},{"$f":"All!AE14","v":0},{"$f":"All!AF14","v":0},{"$f":"All!AG14","v":0},{"$f":"All!AH14","v":0},{"$f":"All!AI14","v":0},{"$f":"All!AJ14","v":0},{"$f":"All!AK14","v":0},{"$f":"All!AL14","v":0},{"$f":"All!AM14","v":0},{"$f":"All!AN14","v":0},{"$f":"All!AO14","v":0},{"$f":"All!AP14","v":0},{"$f":"All!AQ14","v":0},{"$f":"All!AR14","v":0},{"$f":"All!AS14","v":0},{"$f":"All!AT14","v":0}]
[null,{"$f":"All!B15","v":"1"},{"$f":"All!C15","v":"1.2"},{"$f":"All!D15","v":"1.2.1"},{"$f":"All!E15","v":"1.2.1: Where feasible, providers shall only authorize customer transactions in which the debiting and crediting of mobile money accounts is processed in real time."},{"$f":"All!F15","v":"1.2.1.1"},{"$f":"All!G15","v":"1.2.1.1: REAL-TIME TRANSACTION PROCESSING\nWhenever possible, all transactions must be completed in real time. The debit party's account should be debited at the same time as the credit party's account is credited.\n\n"},{"$f":"All!H15","v":0},{"$f":"All!I15","v":"1.2.1.1.1"},{"$f":"All!J15","v":"1.2.1.1.1: Are all transactions completed in real time (the debit party's account is debited at the same time as the credit party's account is credited), barring documented exceptions (i.e. multi-stage transactions - see 1.2.1.2)?\n"},{"$f":"All!K15","v":"1) Mobile Money system functional specification \n- Check that all transactions are processed in real time (debits and credits happen on the mobile money platform at the same time)  barring documented exceptions (i.e. multi-stage transactions noted in 1.2.1.2)"},{"$f":"All!L15","v":0},{"$f":"All!M15","v":"Standard Required"},{"$f":"All!N15","v":"Required"},{"$f":"All!O15","v":"TechOps"},{"$f":"All!P15","v":0},{"$f":"All!Q15","v":0},{"$f":"All!R15","v":0},{"$f":"All!S15","v":0},{"$f":"All!T15","v":0},{"$f":"All!U15","v":0},{"$f":"All!V15","v":0},{"$f":"All!W15","v":0},{"$f":"All!X15","v":0},{"$f":"All!Y15","v":0},{"$f":"All!Z15","v":0},{"$f":"All!AA15","v":0},{"$f":"All!AB15","v":0},{"$f":"All!AC15","v":0},{"$f":"All!AD15","v":0},{"$f":"All!AE15","v":0},{"$f":"All!AF15","v":0},{"$f":"All!AG15","v":0},{"$f":"All!AH15","v":0},{"$f":"All!AI15","v":0},{"$f":"All!AJ15","v":0},{"$f":"All!AK15","v":0},{"$f":"All!AL15","v":0},{"$f":"All!AM15","v":0},{"$f":"All!AN15","v":0},{"$f":"All!AO15","v":0},{"$f":"All!AP15","v":0},{"$f":"All!AQ15","v":0},{"$f":"All!AR15","v":0},{"$f":"All!AS15","v":0},{"$f":"All!AT15","v":0}]
[null,{"$f":"All!B16","v":"1"},{"$f":"All!C16","v":"1.2"},{"$f":"All!D16","v":"1.2.1"},{"$f":"All!E16","v":0},{"$f":"All!F16","v":"1.2.1.2"},{"$f":"All!G16","v":"1.2.1.2: FUNDS RESERVATION FOR MULTI-STAGE TRANSACTIONS\nSome transactions cannot be completed in real time, and require a confirmation step to be completed. Examples of multi-stage transactions include:\n   - transfer to an account of a financial partner, which requires time to confirm the transaction completion;\n   - P2P transfer to unregistered user (funds reserved until voucher is used)\n   - bill payment requiring biller's authorisation before completion;\n   - international money transfer requiring confirmation from the receiver's bank/hub, or requiring the recipient to provide additional KYC information. \n\nFunds should be debited or reserved from the sending party's account as soon as the transaction has been authorised by the mobile money sender. The funds will then be available for completing the transaction when it is confirmed (or released if the transaction is cancelled).\n\nThis is to mitigate the risk that the sender removes their funds before the transaction is completed, leading to a negative balance.\n"},{"$f":"All!H16","v":0},{"$f":"All!I16","v":"1.2.1.2.1"},{"$f":"All!J16","v":"1.2.1.2.1: For multi-stage transactions (requiring 3rd party action before completion), are funds debited or reserved from the sending party's account as soon as the transaction has been authorised by the mobile money sender?\n"},{"$f":"All!K16","v":"1) Mobile Money system functional specification or practical demonstration\n- Check transaction processing model for each multi-stage transaction type, including reversals and failure cases. Check that funds are debited or reserved as soon as each transaction is authorised by the sender. \nConsider the following examples:\n   - transfer to an account of a financial partner, which requires time to confirm the transaction completion;\n   - P2P transfer to unregistered user (funds reserved until voucher is used)\n   - bill payment requiring biller's authorisation before completion;\n   - international money transfer requiring confirmation from the receiver's bank/hub, or requiring the recipient to provide additional KYC information. \n"},{"$f":"All!L16","v":0},{"$f":"All!M16","v":"Urgent Required"},{"$f":"All!N16","v":"Required"},{"$f":"All!O16","v":"TechOps"},{"$f":"All!P16","v":0},{"$f":"All!Q16","v":0},{"$f":"All!R16","v":0},{"$f":"All!S16","v":0},{"$f":"All!T16","v":0},{"$f":"All!U16","v":{"$error":"#REF!"}},{"$f":"All!V16","v":0},{"$f":"All!W16","v":0},{"$f":"All!X16","v":0},{"$f":"All!Y16","v":0},{"$f":"All!Z16","v":0},{"$f":"All!AA16","v":0},{"$f":"All!AB16","v":0},{"$f":"All!AC16","v":0},{"$f":"All!AD16","v":0},{"$f":"All!AE16","v":0},{"$f":"All!AF16","v":0},{"$f":"All!AG16","v":0},{"$f":"All!AH16","v":0},{"$f":"All!AI16","v":0},{"$f":"All!AJ16","v":0},{"$f":"All!AK16","v":0},{"$f":"All!AL16","v":0},{"$f":"All!AM16","v":0},{"$f":"All!AN16","v":0},{"$f":"All!AO16","v":0},{"$f":"All!AP16","v":0},{"$f":"All!AQ16","v":0},{"$f":"All!AR16","v":0},{"$f":"All!AS16","v":0},{"$f":"All!AT16","v":0}]
[null,{"$f":"All!B17","v":"1"},{"$f":"All!C17","v":"1.2"},{"$f":"All!D17","v":"1.2.1"},{"$f":"All!E17","v":0},{"$f":"All!F17","v":"1.2.1.3"},{"$f":"All!G17","v":"1.2.1.3: SUSPENDED AND FAILED TRANSACTIONS\nThe system should automatically detect suspended transactions and alert staff to take appropriate action promptly (see definition).\n\nWhen transactions fail, the funds should be returned to the originator immediately, who should be notified promptly.\n"},{"$f":"All!H17","v":"GSMA RMT (FIN-12)"},{"$f":"All!I17","v":"1.2.1.3.1"},{"$f":"All!J17","v":"1.2.1.3.1: Does the system automatically detect suspended transactions and alert staff to take appropriate action promptly (see definition)?\n"},{"$f":"All!K17","v":0},{"$f":"All!L17","v":0},{"$f":"All!M17","v":"Recommended"},{"$f":"All!N17","v":"Recommended"},{"$f":"All!O17","v":"FinOps"},{"$f":"All!P17","v":0},{"$f":"All!Q17","v":0},{"$f":"All!R17","v":0},{"$f":"All!S17","v":0},{"$f":"All!T17","v":0},{"$f":"All!U17","v":0},{"$f":"All!V17","v":0},{"$f":"All!W17","v":0},{"$f":"All!X17","v":0},{"$f":"All!Y17","v":0},{"$f":"All!Z17","v":0},{"$f":"All!AA17","v":0},{"$f":"All!AB17","v":0},{"$f":"All!AC17","v":0},{"$f":"All!AD17","v":0},{"$f":"All!AE17","v":0},{"$f":"All!AF17","v":0},{"$f":"All!AG17","v":0},{"$f":"All!AH17","v":0},{"$f":"All!AI17","v":0},{"$f":"All!AJ17","v":0},{"$f":"All!AK17","v":0},{"$f":"All!AL17","v":0},{"$f":"All!AM17","v":0},{"$f":"All!AN17","v":0},{"$f":"All!AO17","v":0},{"$f":"All!AP17","v":0},{"$f":"All!AQ17","v":0},{"$f":"All!AR17","v":0},{"$f":"All!AS17","v":0},{"$f":"All!AT17","v":0}]
[null,{"$f":"All!B18","v":"1"},{"$f":"All!C18","v":"1.2"},{"$f":"All!D18","v":"1.2.1"},{"$f":"All!E18","v":0},{"$f":"All!F18","v":"1.2.1.3"},{"$f":"All!G18","v":0},{"$f":"All!H18","v":0},{"$f":"All!I18","v":"1.2.1.3.2"},{"$f":"All!J18","v":"1.2.1.3.2: When transactions fail, are funds returned to the originator immediately, with a prompt notification?\n"},{"$f":"All!K18","v":0},{"$f":"All!L18","v":0},{"$f":"All!M18","v":"Recommended"},{"$f":"All!N18","v":"Recommended"},{"$f":"All!O18","v":"FinOps"},{"$f":"All!P18","v":0},{"$f":"All!Q18","v":0},{"$f":"All!R18","v":0},{"$f":"All!S18","v":0},{"$f":"All!T18","v":0},{"$f":"All!U18","v":0},{"$f":"All!V18","v":0},{"$f":"All!W18","v":0},{"$f":"All!X18","v":0},{"$f":"All!Y18","v":0},{"$f":"All!Z18","v":0},{"$f":"All!AA18","v":0},{"$f":"All!AB18","v":0},{"$f":"All!AC18","v":0},{"$f":"All!AD18","v":0},{"$f":"All!AE18","v":0},{"$f":"All!AF18","v":0},{"$f":"All!AG18","v":0},{"$f":"All!AH18","v":0},{"$f":"All!AI18","v":0},{"$f":"All!AJ18","v":0},{"$f":"All!AK18","v":0},{"$f":"All!AL18","v":0},{"$f":"All!AM18","v":0},{"$f":"All!AN18","v":0},{"$f":"All!AO18","v":0},{"$f":"All!AP18","v":0},{"$f":"All!AQ18","v":0},{"$f":"All!AR18","v":0},{"$f":"All!AS18","v":0},{"$f":"All!AT18","v":0}]
[null,{"$f":"All!B19","v":"1"},{"$f":"All!C19","v":"1.2"},{"$f":"All!D19","v":"1.2.2"},{"$f":"All!E19","v":"1.2.2: Providers shall regularly reconcile transactions and settle balances with financial ecosystem partners."},{"$f":"All!F19","v":"1.2.2.1"},{"$f":"All!G19","v":"1.2.2.1: RECONCILIATION WITH FINANCIAL ECOSYSTEM PARTNERS\nA process should be defined for reconciling transactions with each financial ecosystem partner. Reconciliation is used to agree the transactions that have been exchanged with each financial partner, ensuring that both party's records are in agreement. The process should indicate how the net financial position is established for settling the balance.\n\nThe process should define:\n  - the data exchange mechanism (see below);\n  - the steps that should be taken by each party;\n  - the frequency of reconciliation determined by a risk assessment for each financial partner (e.g. daily);\n  - actions to be taken in case of discrepancy in reconciliation.\n\nData exchange: information on completed, pending, failed and suspended transactions should be included in the data exchanged. This is important for resolving the scenario where a transaction succeeds in one party's system but has not completed in the other party's system, leading to reconciliation discrepancy. \n\nSome financial ecosystem partners simply operate a prefunded e-money account (many ATM providers follow this model) and reconciliation is the responsibility of the partner. In this case, there must be a documented process for the financial ecosystem partner to dispute the transaction records.\n\n\n"},{"$f":"All!H19","v":"GSMA RMT (FIN-13)\nISO 27002:2013 Sec. 12.1"},{"$f":"All!I19","v":"1.2.2.1.1"},{"$f":"All!J19","v":"1.2.2.1.1: Has a process been documented for reconciliation of the net financial position with each applicable financial ecosystem partner?\n[Exclude financial ecosystem partners where the partner simply operates a prefunded e-monay account - see 1.2.2.1.2]\n"},{"$f":"All!K19","v":"1) Reconciliation and Settlement process or policy for financial partners\nCheck that the process specifies for each applicable financial partner (e.g. bank, IMT provider, interoperability MM provider):\n     a) the steps that should be taken by each party to establish the net financial position for settling the balance;\n     b) actions to be taken in case of discrepancy in reconciliation;\n     c) the frequency of reconciliation.\n"},{"$f":"All!L19","v":0},{"$f":"All!M19","v":"Urgent Required"},{"$f":"All!N19","v":"Required"},{"$f":"All!O19","v":"FinOps"},{"$f":"All!P19","v":0},{"$f":"All!Q19","v":0},{"$f":"All!R19","v":0},{"$f":"All!S19","v":0},{"$f":"All!T19","v":0},{"$f":"All!U19","v":0},{"$f":"All!V19","v":0},{"$f":"All!W19","v":0},{"$f":"All!X19","v":0},{"$f":"All!Y19","v":0},{"$f":"All!Z19","v":0},{"$f":"All!AA19","v":0},{"$f":"All!AB19","v":0},{"$f":"All!AC19","v":0},{"$f":"All!AD19","v":0},{"$f":"All!AE19","v":0},{"$f":"All!AF19","v":0},{"$f":"All!AG19","v":0},{"$f":"All!AH19","v":0},{"$f":"All!AI19","v":0},{"$f":"All!AJ19","v":0},{"$f":"All!AK19","v":0},{"$f":"All!AL19","v":0},{"$f":"All!AM19","v":0},{"$f":"All!AN19","v":0},{"$f":"All!AO19","v":0},{"$f":"All!AP19","v":0},{"$f":"All!AQ19","v":0},{"$f":"All!AR19","v":0},{"$f":"All!AS19","v":0},{"$f":"All!AT19","v":0}]
[null,{"$f":"All!B20","v":"1"},{"$f":"All!C20","v":"1.2"},{"$f":"All!D20","v":"1.2.2"},{"$f":"All!E20","v":0},{"$f":"All!F20","v":"1.2.2.1"},{"$f":"All!G20","v":0},{"$f":"All!H20","v":0},{"$f":"All!I20","v":"1.2.2.1.2"},{"$f":"All!J20","v":"1.2.2.1.2: For financial ecosystem partners that simply operate a prefunded e-monay account and reconciliation is the responsibility of the partner, is there a documented process for financial ecosystem partners to dispute transaction records?\n"},{"$f":"All!K20","v":"1) Reconciliation and Settlement process or policy for financial partners\n-  Check that the process specifies how financial ecosystem partners may dispute transaction records.\n"},{"$f":"All!L20","v":0},{"$f":"All!M20","v":"Urgent Required"},{"$f":"All!N20","v":"Required"},{"$f":"All!O20","v":"FinOps"},{"$f":"All!P20","v":0},{"$f":"All!Q20","v":0},{"$f":"All!R20","v":0},{"$f":"All!S20","v":0},{"$f":"All!T20","v":0},{"$f":"All!U20","v":0},{"$f":"All!V20","v":0},{"$f":"All!W20","v":0},{"$f":"All!X20","v":0},{"$f":"All!Y20","v":0},{"$f":"All!Z20","v":0},{"$f":"All!AA20","v":0},{"$f":"All!AB20","v":0},{"$f":"All!AC20","v":0},{"$f":"All!AD20","v":0},{"$f":"All!AE20","v":0},{"$f":"All!AF20","v":0},{"$f":"All!AG20","v":0},{"$f":"All!AH20","v":0},{"$f":"All!AI20","v":0},{"$f":"All!AJ20","v":0},{"$f":"All!AK20","v":0},{"$f":"All!AL20","v":0},{"$f":"All!AM20","v":0},{"$f":"All!AN20","v":0},{"$f":"All!AO20","v":0},{"$f":"All!AP20","v":0},{"$f":"All!AQ20","v":0},{"$f":"All!AR20","v":0},{"$f":"All!AS20","v":0},{"$f":"All!AT20","v":0}]
[null,{"$f":"All!B21","v":"1"},{"$f":"All!C21","v":"1.2"},{"$f":"All!D21","v":"1.2.2"},{"$f":"All!E21","v":0},{"$f":"All!F21","v":"1.2.2.1"},{"$f":"All!G21","v":0},{"$f":"All!H21","v":0},{"$f":"All!I21","v":"1.2.2.1.3"},{"$f":"All!J21","v":"1.2.2.1.3: Is information on failed and suspended transactions included in the data exchanged to help resolve reconciliation discrepancies?\n"},{"$f":"All!K21","v":0},{"$f":"All!L21","v":0},{"$f":"All!M21","v":"Recommended"},{"$f":"All!N21","v":"Recommended"},{"$f":"All!O21","v":"FinOps"},{"$f":"All!P21","v":0},{"$f":"All!Q21","v":0},{"$f":"All!R21","v":0},{"$f":"All!S21","v":0},{"$f":"All!T21","v":0},{"$f":"All!U21","v":0},{"$f":"All!V21","v":0},{"$f":"All!W21","v":0},{"$f":"All!X21","v":0},{"$f":"All!Y21","v":0},{"$f":"All!Z21","v":0},{"$f":"All!AA21","v":0},{"$f":"All!AB21","v":0},{"$f":"All!AC21","v":0},{"$f":"All!AD21","v":0},{"$f":"All!AE21","v":0},{"$f":"All!AF21","v":0},{"$f":"All!AG21","v":0},{"$f":"All!AH21","v":0},{"$f":"All!AI21","v":0},{"$f":"All!AJ21","v":0},{"$f":"All!AK21","v":0},{"$f":"All!AL21","v":0},{"$f":"All!AM21","v":0},{"$f":"All!AN21","v":0},{"$f":"All!AO21","v":0},{"$f":"All!AP21","v":0},{"$f":"All!AQ21","v":0},{"$f":"All!AR21","v":0},{"$f":"All!AS21","v":0},{"$f":"All!AT21","v":0}]
[null,{"$f":"All!B22","v":"1"},{"$f":"All!C22","v":"1.2"},{"$f":"All!D22","v":"1.2.2"},{"$f":"All!E22","v":0},{"$f":"All!F22","v":"1.2.2.2"},{"$f":"All!G22","v":"1.2.2.2: SETTLEMENT PROCESS FOR FINANCIAL ECOSYSTEM PARTNERS\nThe settlement process should specify the mechanism for exchange of funds between the provider and each financial ecosystem partner, in order to settle the balance indicated by reconciliation. \n\nSettlement accounts may be pre-funded or floating (i.e. which may go negative). A risk assessment should be done to determine whether a floating settlement account is suitable. For example, pre-funded settlement accounts may be required for some financial partners (e.g. international money transfer providers), but floating settlement accounts could be used for others (e.g. banks).\n\nFor settlement accounts that are not pre-funded and which might go negative (i.e. Provider could be a net payer):\n- the settlement process should specify for each financial partner how frequently settlement should be carried out.\n- acceptable settlement limits should be defined, together with a mechanism for enforcing the limits. There should be an escalation process to alert the head of mobile money to take action if settlement limits are exceeded.\n"},{"$f":"All!H22","v":"GSMA RMT\n\nISO 27002:2013 Sec. 12.1"},{"$f":"All!I22","v":"1.2.2.2.1"},{"$f":"All!J22","v":"1.2.2.2.1: Is a suitable settlement mechanism implemented and documented for every ecosystem partner (either pre-funded or risk-based)?\n"},{"$f":"All!K22","v":"1) Reconciliation and Settlement process or policy for financial partners\n- Check the process specifies a suitable settlement mechanism for each class of ecosystem partner\n- Check that pre-funded mechanisms are used for high-risk partners or where regulation prescribes it must be used.  \n\n[Note: settlement of prefunded accounts could simply mean deposit / withdrawal following the same model as master agents]"},{"$f":"All!L22","v":0},{"$f":"All!M22","v":"Urgent Required"},{"$f":"All!N22","v":"Required"},{"$f":"All!O22","v":"FinOps"},{"$f":"All!P22","v":0},{"$f":"All!Q22","v":0},{"$f":"All!R22","v":0},{"$f":"All!S22","v":0},{"$f":"All!T22","v":0},{"$f":"All!U22","v":0},{"$f":"All!V22","v":0},{"$f":"All!W22","v":0},{"$f":"All!X22","v":0},{"$f":"All!Y22","v":0},{"$f":"All!Z22","v":0},{"$f":"All!AA22","v":0},{"$f":"All!AB22","v":0},{"$f":"All!AC22","v":0},{"$f":"All!AD22","v":0},{"$f":"All!AE22","v":0},{"$f":"All!AF22","v":0},{"$f":"All!AG22","v":0},{"$f":"All!AH22","v":0},{"$f":"All!AI22","v":0},{"$f":"All!AJ22","v":0},{"$f":"All!AK22","v":0},{"$f":"All!AL22","v":0},{"$f":"All!AM22","v":0},{"$f":"All!AN22","v":0},{"$f":"All!AO22","v":0},{"$f":"All!AP22","v":0},{"$f":"All!AQ22","v":0},{"$f":"All!AR22","v":0},{"$f":"All!AS22","v":0},{"$f":"All!AT22","v":0}]
[null,{"$f":"All!B23","v":"1"},{"$f":"All!C23","v":"1.2"},{"$f":"All!D23","v":"1.2.2"},{"$f":"All!E23","v":0},{"$f":"All!F23","v":"1.2.2.2"},{"$f":"All!G23","v":0},{"$f":"All!H23","v":0},{"$f":"All!I23","v":"1.2.2.2.2"},{"$f":"All!J23","v":"1.2.2.2.2: If any settlement accounts are not pre-funded and which might go negative (i.e. Provider could be a net payer), does the reconciliation & settlement process define and enforce settlement account value limits?\n"},{"$f":"All!K23","v":"1) Reconciliation and Settlement process or policy for financial partners\n- If all settlement accounts are pre-funded (where the Provider is a net payer), mark this indicator as N/A.\n- Check that limits are set for all floating (non-pre-funded) settlement accounts with financial partners.\n- Check that there is a process for enforcing settlement limits for all floating settlement accounts (e.g. escalation to head of mobile money)."},{"$f":"All!L23","v":0},{"$f":"All!M23","v":"Standard Required"},{"$f":"All!N23","v":"Required"},{"$f":"All!O23","v":"FinOps"},{"$f":"All!P23","v":0},{"$f":"All!Q23","v":0},{"$f":"All!R23","v":0},{"$f":"All!S23","v":0},{"$f":"All!T23","v":0},{"$f":"All!U23","v":0},{"$f":"All!V23","v":0},{"$f":"All!W23","v":0},{"$f":"All!X23","v":0},{"$f":"All!Y23","v":0},{"$f":"All!Z23","v":0},{"$f":"All!AA23","v":0},{"$f":"All!AB23","v":0},{"$f":"All!AC23","v":0},{"$f":"All!AD23","v":0},{"$f":"All!AE23","v":0},{"$f":"All!AF23","v":0},{"$f":"All!AG23","v":0},{"$f":"All!AH23","v":0},{"$f":"All!AI23","v":0},{"$f":"All!AJ23","v":0},{"$f":"All!AK23","v":0},{"$f":"All!AL23","v":0},{"$f":"All!AM23","v":0},{"$f":"All!AN23","v":0},{"$f":"All!AO23","v":0},{"$f":"All!AP23","v":0},{"$f":"All!AQ23","v":0},{"$f":"All!AR23","v":0},{"$f":"All!AS23","v":0},{"$f":"All!AT23","v":0}]
[null,{"$f":"All!B24","v":"1"},{"$f":"All!C24","v":"1.2"},{"$f":"All!D24","v":"1.2.2"},{"$f":"All!E24","v":0},{"$f":"All!F24","v":"1.2.2.3"},{"$f":"All!G24","v":"1.2.2.3: RECONCILIATION & SETTLEMENT PROCESS: SERVICE LEVEL AGREEMENTS\nService levels for completion of reconciliation & settlement and for resolution of discrepancies and disputes should be agreed with each financial ecosystem partner. A process should be agreed for resolving breaches of the agreed service levels.\n\nService levels should include:\n- Time to complete reconciliation; \n- Time for transfers of settlement funds; and\n- Time for resolving disputes and escalations."},{"$f":"All!H24","v":"GSMA RMT\n\nISO 20000-1:2011 Sec. 6.1"},{"$f":"All!I24","v":"1.2.2.3.1"},{"$f":"All!J24","v":"1.2.2.3.1: Is there a Service Level Agreement (SLA) with each financial partner, specifying the expected performance for completing the reconciliation process?\n"},{"$f":"All!K24","v":0},{"$f":"All!L24","v":0},{"$f":"All!M24","v":"Recommended"},{"$f":"All!N24","v":"Recommended"},{"$f":"All!O24","v":"FinOps"},{"$f":"All!P24","v":0},{"$f":"All!Q24","v":0},{"$f":"All!R24","v":0},{"$f":"All!S24","v":0},{"$f":"All!T24","v":0},{"$f":"All!U24","v":0},{"$f":"All!V24","v":0},{"$f":"All!W24","v":0},{"$f":"All!X24","v":0},{"$f":"All!Y24","v":0},{"$f":"All!Z24","v":0},{"$f":"All!AA24","v":0},{"$f":"All!AB24","v":0},{"$f":"All!AC24","v":0},{"$f":"All!AD24","v":0},{"$f":"All!AE24","v":0},{"$f":"All!AF24","v":0},{"$f":"All!AG24","v":0},{"$f":"All!AH24","v":0},{"$f":"All!AI24","v":0},{"$f":"All!AJ24","v":0},{"$f":"All!AK24","v":0},{"$f":"All!AL24","v":0},{"$f":"All!AM24","v":0},{"$f":"All!AN24","v":0},{"$f":"All!AO24","v":0},{"$f":"All!AP24","v":0},{"$f":"All!AQ24","v":0},{"$f":"All!AR24","v":0},{"$f":"All!AS24","v":0},{"$f":"All!AT24","v":0}]
[null,{"$f":"All!B25","v":"1"},{"$f":"All!C25","v":"1.2"},{"$f":"All!D25","v":"1.2.2"},{"$f":"All!E25","v":0},{"$f":"All!F25","v":"1.2.2.3"},{"$f":"All!G25","v":0},{"$f":"All!H25","v":0},{"$f":"All!I25","v":"1.2.2.3.2"},{"$f":"All!J25","v":"1.2.2.3.2: Is there a Service Level Agreement (SLA) with each financial partner, specifying the expected performance for resolving reconciliation/settlement disputes and escalations?\n"},{"$f":"All!K25","v":0},{"$f":"All!L25","v":0},{"$f":"All!M25","v":"Recommended"},{"$f":"All!N25","v":"Recommended"},{"$f":"All!O25","v":"FinOps"},{"$f":"All!P25","v":0},{"$f":"All!Q25","v":0},{"$f":"All!R25","v":0},{"$f":"All!S25","v":0},{"$f":"All!T25","v":0},{"$f":"All!U25","v":0},{"$f":"All!V25","v":0},{"$f":"All!W25","v":0},{"$f":"All!X25","v":0},{"$f":"All!Y25","v":0},{"$f":"All!Z25","v":0},{"$f":"All!AA25","v":0},{"$f":"All!AB25","v":0},{"$f":"All!AC25","v":0},{"$f":"All!AD25","v":0},{"$f":"All!AE25","v":0},{"$f":"All!AF25","v":0},{"$f":"All!AG25","v":0},{"$f":"All!AH25","v":0},{"$f":"All!AI25","v":0},{"$f":"All!AJ25","v":0},{"$f":"All!AK25","v":0},{"$f":"All!AL25","v":0},{"$f":"All!AM25","v":0},{"$f":"All!AN25","v":0},{"$f":"All!AO25","v":0},{"$f":"All!AP25","v":0},{"$f":"All!AQ25","v":0},{"$f":"All!AR25","v":0},{"$f":"All!AS25","v":0},{"$f":"All!AT25","v":0}]
[null,{"$f":"All!B26","v":"1"},{"$f":"All!C26","v":"1.2"},{"$f":"All!D26","v":"1.2.2"},{"$f":"All!E26","v":0},{"$f":"All!F26","v":"1.2.2.4"},{"$f":"All!G26","v":"1.2.2.4: RECORD-KEEPING\nRecords of reconciliation with the custodial bank and financial ecosystem partners should be kept for a period determined by regulation or risk assessment, whichever is longer. FATF recommends that records be kept for a minimum of five years, either physically or electronically (or both)."},{"$f":"All!H26","v":"GSMA RMT\n(FR.P-07)"},{"$f":"All!I26","v":"1.2.2.4.1"},{"$f":"All!J26","v":"1.2.2.4.1: Are records of reconciliation with the custodial bank and financial ecosystem partners kept for at least five years?\n"},{"$f":"All!K26","v":"1) Reconciliation and Settlement process or policy for financial partners\n - Check that records will be kept for at least five years."},{"$f":"All!L26","v":0},{"$f":"All!M26","v":"Standard Required"},{"$f":"All!N26","v":"Required"},{"$f":"All!O26","v":"FinOps"},{"$f":"All!P26","v":0},{"$f":"All!Q26","v":0},{"$f":"All!R26","v":0},{"$f":"All!S26","v":0},{"$f":"All!T26","v":0},{"$f":"All!U26","v":0},{"$f":"All!V26","v":0},{"$f":"All!W26","v":0},{"$f":"All!X26","v":0},{"$f":"All!Y26","v":0},{"$f":"All!Z26","v":0},{"$f":"All!AA26","v":0},{"$f":"All!AB26","v":0},{"$f":"All!AC26","v":0},{"$f":"All!AD26","v":0},{"$f":"All!AE26","v":0},{"$f":"All!AF26","v":0},{"$f":"All!AG26","v":0},{"$f":"All!AH26","v":0},{"$f":"All!AI26","v":0},{"$f":"All!AJ26","v":0},{"$f":"All!AK26","v":0},{"$f":"All!AL26","v":0},{"$f":"All!AM26","v":0},{"$f":"All!AN26","v":0},{"$f":"All!AO26","v":0},{"$f":"All!AP26","v":0},{"$f":"All!AQ26","v":0},{"$f":"All!AR26","v":0},{"$f":"All!AS26","v":0},{"$f":"All!AT26","v":0}]
[null,{"$f":"All!B27","v":"2"},{"$f":"All!C27","v":"2.1"},{"$f":"All!D27","v":"2.1.1"},{"$f":"All!E27","v":"2.1.1: Providers shall develop effective policies and procedures for Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) compliance"},{"$f":"All!F27","v":"2.1.1.1"},{"$f":"All!G27","v":"2.1.1.1: AML/CFT POLICY\nProviders should develop a strong AML/CFT policy. The AML/CFT policy should be  reviewed and updated as needed, such as following material changes to the service or regulation. The AML/CFT policy should include:\n\n- Raising Suspicious Activity Reports (SARs) and Suspicious Transaction Reports (STRs) with the relevant authorities in the case of suspected ML/TF (refer to 2.1.1.2).\n- Regular independent audit to evaluate compliance with and efficacy of AML/CFT procedures (refer to 2.1.1.4).\n- Ensuring that changes in business processes and systems are matched by appropriate changes to the AML/CFT controls (refer to 2.2.1).\n- Updating the sub-policies and procedures as needed - such as following changes to the service or regulation (refer to 2.2.1).\n- Logging and monitoring transactions and actions (refer to 2.4.1).\n- Identifying customers by collecting and verifying KYC information (refer to 2.5.1).\n- Implementing transaction and balance limits based on KYC tiers (refer to 2.5.2).\n- Blocking accounts when necessary (refer to 2.5.3).\n- Screening customers, agents, staff and partners (refer to Principle 3).\n- Training staff and agents in AML/CFT (refer to 2.6.1)\n- Monitoring staff and agent compliance with AML/CFT procedures (refer to 2.6.2).\n- Addressing staff and agent AML/CFT violations (refer to 2.6.3)"},{"$f":"All!H27","v":"GSMA RMT"},{"$f":"All!I27","v":"2.1.1.1.1"},{"$f":"All!J27","v":"2.1.1.1.1: Is there documentation that describes the objectives and function of the AML function (i.e. policy or equivalent document) that is reviewed and approved by senior management?\n"},{"$f":"All!K27","v":"1) Documentation that describes the objective and function of the AML programme (i.e. policy or equivalent document)\n\n- Check that the document has been approved within the last two years by the current senior manager (Director) who is responsible for the policy."},{"$f":"All!L27","v":0},{"$f":"All!M27","v":"Urgent Required"},{"$f":"All!N27","v":"Required"},{"$f":"All!O27","v":"FraudRisk"},{"$f":"All!P27","v":0},{"$f":"All!Q27","v":0},{"$f":"All!R27","v":0},{"$f":"All!S27","v":0},{"$f":"All!T27","v":0},{"$f":"All!U27","v":0},{"$f":"All!V27","v":0},{"$f":"All!W27","v":0},{"$f":"All!X27","v":0},{"$f":"All!Y27","v":0},{"$f":"All!Z27","v":0},{"$f":"All!AA27","v":0},{"$f":"All!AB27","v":0},{"$f":"All!AC27","v":0},{"$f":"All!AD27","v":0},{"$f":"All!AE27","v":0},{"$f":"All!AF27","v":0},{"$f":"All!AG27","v":0},{"$f":"All!AH27","v":0},{"$f":"All!AI27","v":0},{"$f":"All!AJ27","v":0},{"$f":"All!AK27","v":0},{"$f":"All!AL27","v":0},{"$f":"All!AM27","v":0},{"$f":"All!AN27","v":0},{"$f":"All!AO27","v":0},{"$f":"All!AP27","v":0},{"$f":"All!AQ27","v":0},{"$f":"All!AR27","v":0},{"$f":"All!AS27","v":0},{"$f":"All!AT27","v":0}]
[null,{"$f":"All!B28","v":"2"},{"$f":"All!C28","v":"2.1"},{"$f":"All!D28","v":"2.1.1"},{"$f":"All!E28","v":0},{"$f":"All!F28","v":"2.1.1.1"},{"$f":"All!G28","v":0},{"$f":"All!H28","v":0},{"$f":"All!I28","v":"2.1.1.1.2"},{"$f":"All!J28","v":"2.1.1.1.2: Is the AML/CFT policy (or equivalent document) reviewed at least every 24 months and updated if needed?\n"},{"$f":"All!K28","v":"1) Documentation that describes the objective and function of the AML programme (i.e. policy or equivalent document)\n - Check that the document contains a revision history log and the last revision date is in the last 24 months.\n\n"},{"$f":"All!L28","v":0},{"$f":"All!M28","v":"Standard Required"},{"$f":"All!N28","v":"Required"},{"$f":"All!O28","v":"FraudRisk"},{"$f":"All!P28","v":0},{"$f":"All!Q28","v":0},{"$f":"All!R28","v":0},{"$f":"All!S28","v":0},{"$f":"All!T28","v":0},{"$f":"All!U28","v":0},{"$f":"All!V28","v":0},{"$f":"All!W28","v":0},{"$f":"All!X28","v":0},{"$f":"All!Y28","v":0},{"$f":"All!Z28","v":0},{"$f":"All!AA28","v":0},{"$f":"All!AB28","v":0},{"$f":"All!AC28","v":0},{"$f":"All!AD28","v":0},{"$f":"All!AE28","v":0},{"$f":"All!AF28","v":0},{"$f":"All!AG28","v":0},{"$f":"All!AH28","v":0},{"$f":"All!AI28","v":0},{"$f":"All!AJ28","v":0},{"$f":"All!AK28","v":0},{"$f":"All!AL28","v":0},{"$f":"All!AM28","v":0},{"$f":"All!AN28","v":0},{"$f":"All!AO28","v":0},{"$f":"All!AP28","v":0},{"$f":"All!AQ28","v":0},{"$f":"All!AR28","v":0},{"$f":"All!AS28","v":0},{"$f":"All!AT28","v":0}]
[null,{"$f":"All!B29","v":"2"},{"$f":"All!C29","v":"2.1"},{"$f":"All!D29","v":"2.1.1"},{"$f":"All!E29","v":0},{"$f":"All!F29","v":"2.1.1.2"},{"$f":"All!G29","v":"2.1.1.2: AML/CFT PROCESS\nProviders should implement a suspicious activity management process for addressing suspected ML/TF activity. This process should provide clear guidelines about appropriate internal actions to be taken when suspicious patterns are detected, such as:\n- further investigation and monitoring;\n- account blocking.\n\nThe risk of each suspicious activity should be evaluated, and investigating higher-risk suspicious activities should be prioritised.\n\nAgents and employees should be provided with a mechanism to report suspicious activity, the details of which should be communicated to them. [This could be the same channel as used for reporting fraud, security incidents and data privacy breaches] \n\nConfirmed cases of ML/TF must be reported to the appropriate authorities via a formal Suspicious Activity Report (SAR) and/or Suspicious Transaction Report (STR). Providers should engage with relevant law enforcement agencies to facilitate reporting and/or investigation of mobile money-related criminal offences.\n"},{"$f":"All!H29","v":"GSMA RMT"},{"$f":"All!I29","v":"2.1.1.2.1"},{"$f":"All!J29","v":"2.1.1.2.1: Has a suspicious activity management process been defined for dealing with suspected ML/TF activities?\n"},{"$f":"All!K29","v":"1) Suspicious activity management process for identifying, investigating, actioning and reporting suspected ML/TF activity.\n- Check that the process has been documented."},{"$f":"All!L29","v":0},{"$f":"All!M29","v":"Urgent Required"},{"$f":"All!N29","v":"Required"},{"$f":"All!O29","v":"FraudRisk"},{"$f":"All!P29","v":0},{"$f":"All!Q29","v":0},{"$f":"All!R29","v":0},{"$f":"All!S29","v":0},{"$f":"All!T29","v":0},{"$f":"All!U29","v":0},{"$f":"All!V29","v":0},{"$f":"All!W29","v":0},{"$f":"All!X29","v":0},{"$f":"All!Y29","v":0},{"$f":"All!Z29","v":0},{"$f":"All!AA29","v":0},{"$f":"All!AB29","v":0},{"$f":"All!AC29","v":0},{"$f":"All!AD29","v":0},{"$f":"All!AE29","v":0},{"$f":"All!AF29","v":0},{"$f":"All!AG29","v":0},{"$f":"All!AH29","v":0},{"$f":"All!AI29","v":0},{"$f":"All!AJ29","v":0},{"$f":"All!AK29","v":0},{"$f":"All!AL29","v":0},{"$f":"All!AM29","v":0},{"$f":"All!AN29","v":0},{"$f":"All!AO29","v":0},{"$f":"All!AP29","v":0},{"$f":"All!AQ29","v":0},{"$f":"All!AR29","v":0},{"$f":"All!AS29","v":0},{"$f":"All!AT29","v":0}]
[null,{"$f":"All!B30","v":"2"},{"$f":"All!C30","v":"2.1"},{"$f":"All!D30","v":"2.1.1"},{"$f":"All!E30","v":""},{"$f":"All!F30","v":"2.1.1.2"},{"$f":"All!G30","v":0},{"$f":"All!H30","v":0},{"$f":"All!I30","v":"2.1.1.2.2"},{"$f":"All!J30","v":"2.1.1.2.2: Does the suspicious activity management process provide clear guidelines about appropriate actions to be taken (e.g. further investigation and monitoring, account blocking)?\n"},{"$f":"All!K30","v":"1) Suspicious activity management process for identifying, investigating, actioning and reporting suspected ML/TF activity.\n\n- Check that this process includes:\n     1) How the report is received by the AML Unit\n     2) What additional information is obtained on the case\n     3) Who is responsible for the investigation\n     4) What actions must been taken for confirmed, not confirmed and inconclusive cases\n     5) Who approves the closure of the case\n"},{"$f":"All!L30","v":0},{"$f":"All!M30","v":"Urgent Required"},{"$f":"All!N30","v":"Required"},{"$f":"All!O30","v":"FraudRisk"},{"$f":"All!P30","v":0},{"$f":"All!Q30","v":0},{"$f":"All!R30","v":0},{"$f":"All!S30","v":0},{"$f":"All!T30","v":0},{"$f":"All!U30","v":0},{"$f":"All!V30","v":0},{"$f":"All!W30","v":0},{"$f":"All!X30","v":0},{"$f":"All!Y30","v":0},{"$f":"All!Z30","v":0},{"$f":"All!AA30","v":0},{"$f":"All!AB30","v":0},{"$f":"All!AC30","v":0},{"$f":"All!AD30","v":0},{"$f":"All!AE30","v":0},{"$f":"All!AF30","v":0},{"$f":"All!AG30","v":0},{"$f":"All!AH30","v":0},{"$f":"All!AI30","v":0},{"$f":"All!AJ30","v":0},{"$f":"All!AK30","v":0},{"$f":"All!AL30","v":0},{"$f":"All!AM30","v":0},{"$f":"All!AN30","v":0},{"$f":"All!AO30","v":0},{"$f":"All!AP30","v":0},{"$f":"All!AQ30","v":0},{"$f":"All!AR30","v":0},{"$f":"All!AS30","v":0},{"$f":"All!AT30","v":0}]
[null,{"$f":"All!B31","v":"2"},{"$f":"All!C31","v":"2.1"},{"$f":"All!D31","v":"2.1.1"},{"$f":"All!E31","v":0},{"$f":"All!F31","v":"2.1.1.2"},{"$f":"All!G31","v":0},{"$f":"All!H31","v":0},{"$f":"All!I31","v":"2.1.1.2.3"},{"$f":"All!J31","v":"2.1.1.2.3: Does the suspicious activity management process clearly define how Suspicious Activity Reports (SARs) and/or Suspicious Transaction Reports (STR) should be raised with the relevant authorities in the case of suspected ML/TF?\n"},{"$f":"All!K31","v":"1) Documented suspicious activity management process for identifying, investigating, actioning and reporting suspected ML/TF activity.\n\n- Check that this process includes:\n     1) Who reports the SAR\n     2) Which organisation the SAR is sent to (local FIU)\n     3) How the report is submitted\n     4) Time lines for issuing report (if required)\n"},{"$f":"All!L31","v":0},{"$f":"All!M31","v":"Urgent Required"},{"$f":"All!N31","v":"Required"},{"$f":"All!O31","v":"FraudRisk"},{"$f":"All!P31","v":0},{"$f":"All!Q31","v":0},{"$f":"All!R31","v":0},{"$f":"All!S31","v":0},{"$f":"All!T31","v":0},{"$f":"All!U31","v":0},{"$f":"All!V31","v":0},{"$f":"All!W31","v":0},{"$f":"All!X31","v":0},{"$f":"All!Y31","v":0},{"$f":"All!Z31","v":0},{"$f":"All!AA31","v":0},{"$f":"All!AB31","v":0},{"$f":"All!AC31","v":0},{"$f":"All!AD31","v":0},{"$f":"All!AE31","v":0},{"$f":"All!AF31","v":0},{"$f":"All!AG31","v":0},{"$f":"All!AH31","v":0},{"$f":"All!AI31","v":0},{"$f":"All!AJ31","v":0},{"$f":"All!AK31","v":0},{"$f":"All!AL31","v":0},{"$f":"All!AM31","v":0},{"$f":"All!AN31","v":0},{"$f":"All!AO31","v":0},{"$f":"All!AP31","v":0},{"$f":"All!AQ31","v":0},{"$f":"All!AR31","v":0},{"$f":"All!AS31","v":0},{"$f":"All!AT31","v":0}]
[null,{"$f":"All!B32","v":"2"},{"$f":"All!C32","v":"2.1"},{"$f":"All!D32","v":"2.1.1"},{"$f":"All!E32","v":""},{"$f":"All!F32","v":"2.1.1.2"},{"$f":"All!G32","v":0},{"$f":"All!H32","v":0},{"$f":"All!I32","v":"2.1.1.2.4"},{"$f":"All!J32","v":"2.1.1.2.4: Is there a mechanism for agents and employees to report suspicious activity (ML,TF), and are they made aware of this reporting channel? \n[This could be the same channel as used for reporting fraud, security incidents and data privacy breaches]\n"},{"$f":"All!K32","v":"1) Documented mechanism for agents and employees to report suspicious activities (e.g. phone line).\n- Check the reporting channel is available to all agents and employees by reviewing the processes.\n- Check that the suspicious activity reporting channel is practical and availed to all.\n\n2) Documentation showing how agents and staff are made aware of the suspicious activity reporting channel (e.g. training material, emails. SMS broadcasts, posters, agent handbook, awareness campaign).\n- Check the staff and agents have been made aware of the suspicious activity reporting channel and their responsibility to report suspicions.\n"},{"$f":"All!L32","v":0},{"$f":"All!M32","v":"Urgent Required"},{"$f":"All!N32","v":"Required"},{"$f":"All!O32","v":"FraudRisk"},{"$f":"All!P32","v":0},{"$f":"All!Q32","v":0},{"$f":"All!R32","v":0},{"$f":"All!S32","v":0},{"$f":"All!T32","v":0},{"$f":"All!U32","v":0},{"$f":"All!V32","v":0},{"$f":"All!W32","v":0},{"$f":"All!X32","v":0},{"$f":"All!Y32","v":0},{"$f":"All!Z32","v":0},{"$f":"All!AA32","v":0},{"$f":"All!AB32","v":0},{"$f":"All!AC32","v":0},{"$f":"All!AD32","v":0},{"$f":"All!AE32","v":0},{"$f":"All!AF32","v":0},{"$f":"All!AG32","v":0},{"$f":"All!AH32","v":0},{"$f":"All!AI32","v":0},{"$f":"All!AJ32","v":0},{"$f":"All!AK32","v":0},{"$f":"All!AL32","v":0},{"$f":"All!AM32","v":0},{"$f":"All!AN32","v":0},{"$f":"All!AO32","v":0},{"$f":"All!AP32","v":0},{"$f":"All!AQ32","v":0},{"$f":"All!AR32","v":0},{"$f":"All!AS32","v":0},{"$f":"All!AT32","v":0}]
[null,{"$f":"All!B33","v":"2"},{"$f":"All!C33","v":"2.1"},{"$f":"All!D33","v":"2.1.1"},{"$f":"All!E33","v":""},{"$f":"All!F33","v":"2.1.1.3"},{"$f":"All!G33","v":"2.1.1.3: AUDIT OF AML/CFT FUNCTION\nProviders should carry out an independent audit every two years to evaluate efficacy of AML/CFT procedures. Auditors could be internal and/or external, provided that they are independent.\n\nThe findings of the audit should be prioritized appropriately. The AML/CFT manager should ensure that the recommendations are implemented promptly."},{"$f":"All!H33","v":"GSMA RMT"},{"$f":"All!I33","v":"2.1.1.3.1"},{"$f":"All!J33","v":"2.1.1.3.1: Is a regular independent audit carried out (at least every two years) to evaluate efficacy of AML/CFT procedures?\n"},{"$f":"All!K33","v":"1) Most recent AML/CFT audit report (header page)\n- Check the date of the audit is within the last two years.\n- Check that the audit was carried out by either the providers own internal audit function, or a suitable external body.\n\n2) AML/CFT audit plan or process - this is suitable evidence if the provider has been operating for less than two years.\n- Check that the plan shows an AML/CFT audit planned within two years of the launch of the mobile money service.\n- Check that the audit will be carried out by either the providers own internal audit function, or a suitable external body."},{"$f":"All!L33","v":0},{"$f":"All!M33","v":"Urgent Required"},{"$f":"All!N33","v":"Required"},{"$f":"All!O33","v":"FraudRisk"},{"$f":"All!P33","v":0},{"$f":"All!Q33","v":0},{"$f":"All!R33","v":0},{"$f":"All!S33","v":0},{"$f":"All!T33","v":0},{"$f":"All!U33","v":0},{"$f":"All!V33","v":0},{"$f":"All!W33","v":0},{"$f":"All!X33","v":0},{"$f":"All!Y33","v":0},{"$f":"All!Z33","v":0},{"$f":"All!AA33","v":0},{"$f":"All!AB33","v":0},{"$f":"All!AC33","v":0},{"$f":"All!AD33","v":0},{"$f":"All!AE33","v":0},{"$f":"All!AF33","v":0},{"$f":"All!AG33","v":0},{"$f":"All!AH33","v":0},{"$f":"All!AI33","v":0},{"$f":"All!AJ33","v":0},{"$f":"All!AK33","v":0},{"$f":"All!AL33","v":0},{"$f":"All!AM33","v":0},{"$f":"All!AN33","v":0},{"$f":"All!AO33","v":0},{"$f":"All!AP33","v":0},{"$f":"All!AQ33","v":0},{"$f":"All!AR33","v":0},{"$f":"All!AS33","v":0},{"$f":"All!AT33","v":0}]
[null,{"$f":"All!B34","v":"2"},{"$f":"All!C34","v":"2.1"},{"$f":"All!D34","v":"2.1.1"},{"$f":"All!E34","v":""},{"$f":"All!F34","v":"2.1.1.3"},{"$f":"All!G34","v":0},{"$f":"All!H34","v":0},{"$f":"All!I34","v":"2.1.1.3.2"},{"$f":"All!J34","v":"2.1.1.3.2: Are audit findings prioritized, implemented and reviewed, with supervision from AML/CFT manager?\n"},{"$f":"All!K34","v":"1) Most recent  AML/CFT audit report\n- Check that agreed actions for audit findings have been prioritised and implemented.\n\n2) AML/CFT audit plan or process - this is suitable evidence if the provider is unwilling to share contents of audit report.\n- Check that the MLRO has access to all the reports and actions updates.\n- Check that there is a process to prioritise and implement all audit actions and findings."},{"$f":"All!L34","v":0},{"$f":"All!M34","v":"Urgent Required"},{"$f":"All!N34","v":"Required"},{"$f":"All!O34","v":"FraudRisk"},{"$f":"All!P34","v":0},{"$f":"All!Q34","v":0},{"$f":"All!R34","v":0},{"$f":"All!S34","v":0},{"$f":"All!T34","v":0},{"$f":"All!U34","v":0},{"$f":"All!V34","v":0},{"$f":"All!W34","v":0},{"$f":"All!X34","v":0},{"$f":"All!Y34","v":0},{"$f":"All!Z34","v":0},{"$f":"All!AA34","v":0},{"$f":"All!AB34","v":0},{"$f":"All!AC34","v":0},{"$f":"All!AD34","v":0},{"$f":"All!AE34","v":0},{"$f":"All!AF34","v":0},{"$f":"All!AG34","v":0},{"$f":"All!AH34","v":0},{"$f":"All!AI34","v":0},{"$f":"All!AJ34","v":0},{"$f":"All!AK34","v":0},{"$f":"All!AL34","v":0},{"$f":"All!AM34","v":0},{"$f":"All!AN34","v":0},{"$f":"All!AO34","v":0},{"$f":"All!AP34","v":0},{"$f":"All!AQ34","v":0},{"$f":"All!AR34","v":0},{"$f":"All!AS34","v":0},{"$f":"All!AT34","v":0}]
[null,{"$f":"All!B35","v":"2"},{"$f":"All!C35","v":"2.1"},{"$f":"All!D35","v":"2.1.1"},{"$f":"All!E35","v":""},{"$f":"All!F35","v":"2.1.1.4"},{"$f":"All!G35","v":"2.1.1.4: AML/CFT RECORDS\nRecords relevant to AML/CFT should be kept for a period determined by regulation or risk assessment, whichever is longer. FATF recommends that records be kept for a minimum of five years, either physically or electronically (or both). The following records should be kept as a minimum:\n- Customer/agent identification records;\n- Transaction records of all successful and failed transactions (refer to 5.3.6.2 - audit trails);\n- Suspicious activity reports (internal reports and external SARs/ STRs);\n- Policies and procedures, including previous versions of documentation with dates."},{"$f":"All!H35","v":"GSMA RMT (FR.P-07)"},{"$f":"All!I35","v":"2.1.1.4.1"},{"$f":"All!J35","v":"2.1.1.4.1: Have AML/CFT record-keeping processes and system functions been implemented?\n"},{"$f":"All!K35","v":"1) Record management process/documentation for AML/CFT records\n- Check that the processes have been implemented.\n"},{"$f":"All!L35","v":0},{"$f":"All!M35","v":"Standard Required"},{"$f":"All!N35","v":"Required"},{"$f":"All!O35","v":"FraudRisk"},{"$f":"All!P35","v":0},{"$f":"All!Q35","v":0},{"$f":"All!R35","v":0},{"$f":"All!S35","v":0},{"$f":"All!T35","v":0},{"$f":"All!U35","v":0},{"$f":"All!V35","v":0},{"$f":"All!W35","v":0},{"$f":"All!X35","v":0},{"$f":"All!Y35","v":0},{"$f":"All!Z35","v":0},{"$f":"All!AA35","v":0},{"$f":"All!AB35","v":0},{"$f":"All!AC35","v":0},{"$f":"All!AD35","v":0},{"$f":"All!AE35","v":0},{"$f":"All!AF35","v":0},{"$f":"All!AG35","v":0},{"$f":"All!AH35","v":0},{"$f":"All!AI35","v":0},{"$f":"All!AJ35","v":0},{"$f":"All!AK35","v":0},{"$f":"All!AL35","v":0},{"$f":"All!AM35","v":0},{"$f":"All!AN35","v":0},{"$f":"All!AO35","v":0},{"$f":"All!AP35","v":0},{"$f":"All!AQ35","v":0},{"$f":"All!AR35","v":0},{"$f":"All!AS35","v":0},{"$f":"All!AT35","v":0}]
[null,{"$f":"All!B36","v":"2"},{"$f":"All!C36","v":"2.1"},{"$f":"All!D36","v":"2.1.1"},{"$f":"All!E36","v":""},{"$f":"All!F36","v":"2.1.1.4"},{"$f":"All!G36","v":0},{"$f":"All!H36","v":0},{"$f":"All!I36","v":"2.1.1.4.2"},{"$f":"All!J36","v":"2.1.1.4.2: Are all suspicious activity reports being kept for both internal and externally-reported SARs/ STRs?\n"},{"$f":"All!K36","v":"1) Suspicious activity management record log\n- Check that internal and externally reported SARs/STRs are stored securely and accessible to the MLRO.\n(Note: there may be providers that have legitimately not received any SARs/STRs - in which case the proposed process should be checked)."},{"$f":"All!L36","v":0},{"$f":"All!M36","v":"Urgent Required"},{"$f":"All!N36","v":"Required"},{"$f":"All!O36","v":"FraudRisk"},{"$f":"All!P36","v":0},{"$f":"All!Q36","v":0},{"$f":"All!R36","v":0},{"$f":"All!S36","v":0},{"$f":"All!T36","v":0},{"$f":"All!U36","v":0},{"$f":"All!V36","v":0},{"$f":"All!W36","v":0},{"$f":"All!X36","v":0},{"$f":"All!Y36","v":0},{"$f":"All!Z36","v":0},{"$f":"All!AA36","v":0},{"$f":"All!AB36","v":0},{"$f":"All!AC36","v":0},{"$f":"All!AD36","v":0},{"$f":"All!AE36","v":0},{"$f":"All!AF36","v":0},{"$f":"All!AG36","v":0},{"$f":"All!AH36","v":0},{"$f":"All!AI36","v":0},{"$f":"All!AJ36","v":0},{"$f":"All!AK36","v":0},{"$f":"All!AL36","v":0},{"$f":"All!AM36","v":0},{"$f":"All!AN36","v":0},{"$f":"All!AO36","v":0},{"$f":"All!AP36","v":0},{"$f":"All!AQ36","v":0},{"$f":"All!AR36","v":0},{"$f":"All!AS36","v":0},{"$f":"All!AT36","v":0}]
[null,{"$f":"All!B37","v":"2"},{"$f":"All!C37","v":"2.1"},{"$f":"All!D37","v":"2.1.1"},{"$f":"All!E37","v":""},{"$f":"All!F37","v":"2.1.1.4"},{"$f":"All!G37","v":0},{"$f":"All!H37","v":0},{"$f":"All!I37","v":"2.1.1.4.3"},{"$f":"All!J37","v":"2.1.1.4.3: Are copies of all current and prior AML/CFT-related policies and processes being kept, including dates where they were in operation?\n"},{"$f":"All!K37","v":0},{"$f":"All!L37","v":0},{"$f":"All!M37","v":"Recommended"},{"$f":"All!N37","v":"Recommended"},{"$f":"All!O37","v":"FraudRisk"},{"$f":"All!P37","v":0},{"$f":"All!Q37","v":0},{"$f":"All!R37","v":0},{"$f":"All!S37","v":0},{"$f":"All!T37","v":0},{"$f":"All!U37","v":0},{"$f":"All!V37","v":0},{"$f":"All!W37","v":0},{"$f":"All!X37","v":0},{"$f":"All!Y37","v":0},{"$f":"All!Z37","v":0},{"$f":"All!AA37","v":0},{"$f":"All!AB37","v":0},{"$f":"All!AC37","v":0},{"$f":"All!AD37","v":0},{"$f":"All!AE37","v":0},{"$f":"All!AF37","v":0},{"$f":"All!AG37","v":0},{"$f":"All!AH37","v":0},{"$f":"All!AI37","v":0},{"$f":"All!AJ37","v":0},{"$f":"All!AK37","v":0},{"$f":"All!AL37","v":0},{"$f":"All!AM37","v":0},{"$f":"All!AN37","v":0},{"$f":"All!AO37","v":0},{"$f":"All!AP37","v":0},{"$f":"All!AQ37","v":0},{"$f":"All!AR37","v":0},{"$f":"All!AS37","v":0},{"$f":"All!AT37","v":0}]
[null,{"$f":"All!B38","v":"2"},{"$f":"All!C38","v":"2.2"},{"$f":"All!D38","v":"2.2.1"},{"$f":"All!E38","v":"2.2.1: Senior management shall demonstrate their commitment to AML/CFT compliance through proper oversight"},{"$f":"All!F38","v":"2.2.1.1"},{"$f":"All!G38","v":"2.2.1.1: AML/CFT COMPLIANCE DEPARTMENT\nSenior management should establish a compliance function that should fulfil the following criteria:\n- be independent of all operational and business functions; \n- report directly to senior management; \n- have sufficient management seniority and authority to enforce AML/CFT policies (able to influence functional managers to make necessary changes);\n- be sufficiently funded to implement effective AML/CFT procedures."},{"$f":"All!H38","v":"GSMA RMT (FR.O-02\nFR.O-03)"},{"$f":"All!I38","v":"2.2.1.1.1"},{"$f":"All!J38","v":"2.2.1.1.1: Has an AML/CFT compliance function been established?\n"},{"$f":"All!K38","v":"1) AML/CFT Organisation chart \n- Check the organisation chart contains the MLRO and support staff.\n\n2) Documentation that describes the objective and function of the AML programme (i.e. policy or equivalent document)\n- Check that provison has been made for an MLRO and support staff  \n(note: this might be contained in the roles and responsibilites section)."},{"$f":"All!L38","v":0},{"$f":"All!M38","v":"Urgent Required"},{"$f":"All!N38","v":"Required"},{"$f":"All!O38","v":"FraudRisk"},{"$f":"All!P38","v":0},{"$f":"All!Q38","v":0},{"$f":"All!R38","v":0},{"$f":"All!S38","v":0},{"$f":"All!T38","v":0},{"$f":"All!U38","v":0},{"$f":"All!V38","v":0},{"$f":"All!W38","v":0},{"$f":"All!X38","v":0},{"$f":"All!Y38","v":0},{"$f":"All!Z38","v":0},{"$f":"All!AA38","v":0},{"$f":"All!AB38","v":0},{"$f":"All!AC38","v":0},{"$f":"All!AD38","v":0},{"$f":"All!AE38","v":0},{"$f":"All!AF38","v":0},{"$f":"All!AG38","v":0},{"$f":"All!AH38","v":0},{"$f":"All!AI38","v":0},{"$f":"All!AJ38","v":0},{"$f":"All!AK38","v":0},{"$f":"All!AL38","v":0},{"$f":"All!AM38","v":0},{"$f":"All!AN38","v":0},{"$f":"All!AO38","v":0},{"$f":"All!AP38","v":0},{"$f":"All!AQ38","v":0},{"$f":"All!AR38","v":0},{"$f":"All!AS38","v":0},{"$f":"All!AT38","v":0}]
[null,{"$f":"All!B39","v":"2"},{"$f":"All!C39","v":"2.2"},{"$f":"All!D39","v":"2.2.1"},{"$f":"All!E39","v":0},{"$f":"All!F39","v":"2.2.1.1"},{"$f":"All!G39","v":0},{"$f":"All!H39","v":0},{"$f":"All!I39","v":"2.2.1.1.2"},{"$f":"All!J39","v":"2.2.1.1.2: Is the AML/CFT compliance function independent of all operational and business functions and does it report directly to senior management?\n"},{"$f":"All!K39","v":"1)  AML/CFT Organisation chart \n- Check the organisation chart to see that the reporting line is to a suitably 'independent' directorate.\n- Check the reporting line of the MLRO/AML Officer is to a senior manager (e.g. Director level)"},{"$f":"All!L39","v":0},{"$f":"All!M39","v":"Standard Required"},{"$f":"All!N39","v":"Required"},{"$f":"All!O39","v":"FraudRisk"},{"$f":"All!P39","v":0},{"$f":"All!Q39","v":0},{"$f":"All!R39","v":0},{"$f":"All!S39","v":0},{"$f":"All!T39","v":0},{"$f":"All!U39","v":0},{"$f":"All!V39","v":0},{"$f":"All!W39","v":0},{"$f":"All!X39","v":0},{"$f":"All!Y39","v":0},{"$f":"All!Z39","v":0},{"$f":"All!AA39","v":0},{"$f":"All!AB39","v":0},{"$f":"All!AC39","v":0},{"$f":"All!AD39","v":0},{"$f":"All!AE39","v":0},{"$f":"All!AF39","v":0},{"$f":"All!AG39","v":0},{"$f":"All!AH39","v":0},{"$f":"All!AI39","v":0},{"$f":"All!AJ39","v":0},{"$f":"All!AK39","v":0},{"$f":"All!AL39","v":0},{"$f":"All!AM39","v":0},{"$f":"All!AN39","v":0},{"$f":"All!AO39","v":0},{"$f":"All!AP39","v":0},{"$f":"All!AQ39","v":0},{"$f":"All!AR39","v":0},{"$f":"All!AS39","v":0},{"$f":"All!AT39","v":0}]
[null,{"$f":"All!B40","v":"2"},{"$f":"All!C40","v":"2.2"},{"$f":"All!D40","v":"2.2.1"},{"$f":"All!E40","v":0},{"$f":"All!F40","v":"2.2.1.1"},{"$f":"All!G40","v":0},{"$f":"All!H40","v":0},{"$f":"All!I40","v":"2.2.1.1.3"},{"$f":"All!J40","v":"2.2.1.1.3: Does the Head of AML/CFT compliance have sufficient management seniority and authority to enforce AML/CFT policies (able to influence functional managers to make necessary changes)?\n"},{"$f":"All!K40","v":"1)  Role description for Money Laundering Reporting Officer (MLRO) or equivalent\n- Check the banding/grade/rank is sufficiently senior to able to influence functional managers.\n\n2) Documentation that describes the objective and function of the AML programme (i.e. policy or equivalent document)\n- Check that the documents give the MLRO/AML officer the authority to implement effective AML/CFT policies, procedures and systems."},{"$f":"All!L40","v":0},{"$f":"All!M40","v":"Urgent Required"},{"$f":"All!N40","v":"Required"},{"$f":"All!O40","v":"FraudRisk"},{"$f":"All!P40","v":0},{"$f":"All!Q40","v":0},{"$f":"All!R40","v":0},{"$f":"All!S40","v":0},{"$f":"All!T40","v":0},{"$f":"All!U40","v":0},{"$f":"All!V40","v":0},{"$f":"All!W40","v":0},{"$f":"All!X40","v":0},{"$f":"All!Y40","v":0},{"$f":"All!Z40","v":0},{"$f":"All!AA40","v":0},{"$f":"All!AB40","v":0},{"$f":"All!AC40","v":0},{"$f":"All!AD40","v":0},{"$f":"All!AE40","v":0},{"$f":"All!AF40","v":0},{"$f":"All!AG40","v":0},{"$f":"All!AH40","v":0},{"$f":"All!AI40","v":0},{"$f":"All!AJ40","v":0},{"$f":"All!AK40","v":0},{"$f":"All!AL40","v":0},{"$f":"All!AM40","v":0},{"$f":"All!AN40","v":0},{"$f":"All!AO40","v":0},{"$f":"All!AP40","v":0},{"$f":"All!AQ40","v":0},{"$f":"All!AR40","v":0},{"$f":"All!AS40","v":0},{"$f":"All!AT40","v":0}]
[null,{"$f":"All!B41","v":"2"},{"$f":"All!C41","v":"2.2"},{"$f":"All!D41","v":"2.2.1"},{"$f":"All!E41","v":0},{"$f":"All!F41","v":"2.2.1.1"},{"$f":"All!G41","v":0},{"$f":"All!H41","v":0},{"$f":"All!I41","v":"2.2.1.1.4"},{"$f":"All!J41","v":"2.2.1.1.4: Is the AML/CFT compliance department sufficiently funded to implement effective AML/CFT policies, procedures and systems (as described in this toolkit)?\n"},{"$f":"All!K41","v":"1)  AML/CFT Organisation chart \n- Check AML team head count is sufficient to carry out the operational requirements\n(Note 1: The size of the AML team should be proportionate to the size, complexity and risk profile of the business.)\n(Note 2: Head count might sit in different teams, or shared services centres - these staff should be included when assessing head count)\n(Note 3: assessment of sufficient head count might also be made by reviewing the MLRO's (or equivalent) assessment of resourcing)"},{"$f":"All!L41","v":0},{"$f":"All!M41","v":"Urgent Required"},{"$f":"All!N41","v":"Required"},{"$f":"All!O41","v":"FraudRisk"},{"$f":"All!P41","v":0},{"$f":"All!Q41","v":0},{"$f":"All!R41","v":0},{"$f":"All!S41","v":0},{"$f":"All!T41","v":0},{"$f":"All!U41","v":0},{"$f":"All!V41","v":0},{"$f":"All!W41","v":0},{"$f":"All!X41","v":0},{"$f":"All!Y41","v":0},{"$f":"All!Z41","v":0},{"$f":"All!AA41","v":0},{"$f":"All!AB41","v":0},{"$f":"All!AC41","v":0},{"$f":"All!AD41","v":0},{"$f":"All!AE41","v":0},{"$f":"All!AF41","v":0},{"$f":"All!AG41","v":0},{"$f":"All!AH41","v":0},{"$f":"All!AI41","v":0},{"$f":"All!AJ41","v":0},{"$f":"All!AK41","v":0},{"$f":"All!AL41","v":0},{"$f":"All!AM41","v":0},{"$f":"All!AN41","v":0},{"$f":"All!AO41","v":0},{"$f":"All!AP41","v":0},{"$f":"All!AQ41","v":0},{"$f":"All!AR41","v":0},{"$f":"All!AS41","v":0},{"$f":"All!AT41","v":0}]
[null,{"$f":"All!B42","v":"2"},{"$f":"All!C42","v":"2.2"},{"$f":"All!D42","v":"2.2.1"},{"$f":"All!E42","v":""},{"$f":"All!F42","v":"2.2.1.2"},{"$f":"All!G42","v":"2.2.1.2: AML/CFT COMPLIANCE DEPARTMENT REVIEWS\nSenior management should regularly review the AML/CFT compliance function to ensure its effectiveness."},{"$f":"All!H42","v":"HK AML"},{"$f":"All!I42","v":"2.2.1.2.1"},{"$f":"All!J42","v":"2.2.1.2.1: Does senior management regularly review the AML/CFT compliance function to ensure its effectiveness?\n"},{"$f":"All!K42","v":"1) Most recent AML/CFT internal control report, annual MLRO report, or AML/CFT review process.\n- Check senior management regularly review the AML/CFT compliance function.\n\n"},{"$f":"All!L42","v":0},{"$f":"All!M42","v":"Urgent Required"},{"$f":"All!N42","v":"Required"},{"$f":"All!O42","v":"FraudRisk"},{"$f":"All!P42","v":0},{"$f":"All!Q42","v":0},{"$f":"All!R42","v":0},{"$f":"All!S42","v":0},{"$f":"All!T42","v":0},{"$f":"All!U42","v":0},{"$f":"All!V42","v":0},{"$f":"All!W42","v":0},{"$f":"All!X42","v":0},{"$f":"All!Y42","v":0},{"$f":"All!Z42","v":0},{"$f":"All!AA42","v":0},{"$f":"All!AB42","v":0},{"$f":"All!AC42","v":0},{"$f":"All!AD42","v":0},{"$f":"All!AE42","v":0},{"$f":"All!AF42","v":0},{"$f":"All!AG42","v":0},{"$f":"All!AH42","v":0},{"$f":"All!AI42","v":0},{"$f":"All!AJ42","v":0},{"$f":"All!AK42","v":0},{"$f":"All!AL42","v":0},{"$f":"All!AM42","v":0},{"$f":"All!AN42","v":0},{"$f":"All!AO42","v":0},{"$f":"All!AP42","v":0},{"$f":"All!AQ42","v":0},{"$f":"All!AR42","v":0},{"$f":"All!AS42","v":0},{"$f":"All!AT42","v":0}]
[null,{"$f":"All!B43","v":"2"},{"$f":"All!C43","v":"2.2"},{"$f":"All!D43","v":"2.2.1"},{"$f":"All!E43","v":""},{"$f":"All!F43","v":"2.2.1.2"},{"$f":"All!G43","v":0},{"$f":"All!H43","v":0},{"$f":"All!I43","v":"2.2.1.2.2"},{"$f":"All!J43","v":"2.2.1.2.2: In its most recent review, did senior management indicate satisfaction with the effectiveness of the AML/CFT function?\n"},{"$f":"All!K43","v":"1) Most recent AML/CFT internal control report, annual MLRO report, or AML/CFT review process.\n- Check senior management have confirmed receipt of there report, approved the contents and /or given instructions to reduce the residual risks."},{"$f":"All!L43","v":0},{"$f":"All!M43","v":"Standard Required"},{"$f":"All!N43","v":"Required"},{"$f":"All!O43","v":"FraudRisk"},{"$f":"All!P43","v":0},{"$f":"All!Q43","v":0},{"$f":"All!R43","v":0},{"$f":"All!S43","v":0},{"$f":"All!T43","v":0},{"$f":"All!U43","v":0},{"$f":"All!V43","v":0},{"$f":"All!W43","v":0},{"$f":"All!X43","v":0},{"$f":"All!Y43","v":0},{"$f":"All!Z43","v":0},{"$f":"All!AA43","v":0},{"$f":"All!AB43","v":0},{"$f":"All!AC43","v":0},{"$f":"All!AD43","v":0},{"$f":"All!AE43","v":0},{"$f":"All!AF43","v":0},{"$f":"All!AG43","v":0},{"$f":"All!AH43","v":0},{"$f":"All!AI43","v":0},{"$f":"All!AJ43","v":0},{"$f":"All!AK43","v":0},{"$f":"All!AL43","v":0},{"$f":"All!AM43","v":0},{"$f":"All!AN43","v":0},{"$f":"All!AO43","v":0},{"$f":"All!AP43","v":0},{"$f":"All!AQ43","v":0},{"$f":"All!AR43","v":0},{"$f":"All!AS43","v":0},{"$f":"All!AT43","v":0}]
[null,{"$f":"All!B44","v":"2"},{"$f":"All!C44","v":"2.3"},{"$f":"All!D44","v":"2.3.1"},{"$f":"All!E44","v":"2.3.1: Providers shall appoint a qualified money-laundering reporting officer (MLRO) to promote and monitor compliance with AML/CFT-related obligations"},{"$f":"All!F44","v":"2.3.1.1"},{"$f":"All!G44","v":"2.3.1.1: AML/CFT MANAGER: MONEY LAUNDERING REPORTING  OFFICER\nA qualified, independent and autonomous Money-Laundering Reporting Officer (MLRO) (or employee with equivalent responsibilities) should be appointed with responsibility for AML/CFT. The MLRO should report to a senior director or equivalent. A single identified person should be responsible and accountable for all MLRO functions. They may have other responsibilities, depending on the size of the mobile money operation.\n\nThe responsibilities of the MLRO should include the following:\n- Implementing procedures to comply with AML/CFT regulations;\n- Screening procedures for staff, agents, and entities providing outsourced services;\n- Monitoring compliance with AML/CFT procedures; \n- Receiving internal reports of suspicious activity and carrying out investigations and necessary actions; \n- Ensuring that changes in business processes and systems are matched by appropriate changes to AML/CFT controls; \n- Encouraging an AML/CFT culture within the Provider (with the assistance of the Directors, officers, and senior management); \n- Raising Suspicious Activity Reports (SARs) and/or Suspicious Transaction Reports (STRs) with the relevant authorities in the case of suspected ML/TF.\n- Serving as the contact person for law enforcement agencies  \n- Serving as the contact person for the Financial Intelligence Unit (or comparable government body) with respect to money laundering and terrorist financing; \n- Identifying national and international AML/CFT regulations that must be followed, and keeping up-to-date with regulations and guidance in AML/CFT practices (e.g. from FATF (Financial Action Task Force))."},{"$f":"All!H44","v":"GSMA RMT (FR.O-01)"},{"$f":"All!I44","v":"2.3.1.1.1"},{"$f":"All!J44","v":"2.3.1.1.1: Has a qualified, independent and autonomous Money-Laundering Reporting Officer (MLRO) (or employee with equivalent responsibilities) been appointed with responsibility for AML/CFT?\n"},{"$f":"All!K44","v":"1) MLRO's qualification  (or employee with equivalent responsibilities)\n- Check qualification is appropriate to AML/CFT \n- Check that the qualification/formal training is from a suitable professional body (i.e. ICA, ACAMS etc)\n(Note: 5 years of suitable relevant experience can be considered instead of a qualification)\n\n2) Role description for Money Laundering Reporting Officer (MLRO) or equivalent\n- Check the documents gives the MLRO authority to act autonomously.\n\n3) AML/CFT Organisation chart \n- Check the organisation chart to see that the reporting line is to a suitably independent directorate (same as 2.2.1.1.2.)."},{"$f":"All!L44","v":0},{"$f":"All!M44","v":"Urgent Required"},{"$f":"All!N44","v":"Required"},{"$f":"All!O44","v":"FraudRisk"},{"$f":"All!P44","v":0},{"$f":"All!Q44","v":0},{"$f":"All!R44","v":0},{"$f":"All!S44","v":0},{"$f":"All!T44","v":0},{"$f":"All!U44","v":0},{"$f":"All!V44","v":0},{"$f":"All!W44","v":0},{"$f":"All!X44","v":0},{"$f":"All!Y44","v":0},{"$f":"All!Z44","v":0},{"$f":"All!AA44","v":0},{"$f":"All!AB44","v":0},{"$f":"All!AC44","v":0},{"$f":"All!AD44","v":0},{"$f":"All!AE44","v":0},{"$f":"All!AF44","v":0},{"$f":"All!AG44","v":0},{"$f":"All!AH44","v":0},{"$f":"All!AI44","v":0},{"$f":"All!AJ44","v":0},{"$f":"All!AK44","v":0},{"$f":"All!AL44","v":0},{"$f":"All!AM44","v":0},{"$f":"All!AN44","v":0},{"$f":"All!AO44","v":0},{"$f":"All!AP44","v":0},{"$f":"All!AQ44","v":0},{"$f":"All!AR44","v":0},{"$f":"All!AS44","v":0},{"$f":"All!AT44","v":0}]
[null,{"$f":"All!B45","v":"2"},{"$f":"All!C45","v":"2.3"},{"$f":"All!D45","v":"2.3.1"},{"$f":"All!E45","v":0},{"$f":"All!F45","v":"2.3.1.1"},{"$f":"All!G45","v":0},{"$f":"All!H45","v":0},{"$f":"All!I45","v":"2.3.1.1.2"},{"$f":"All!J45","v":"2.3.1.1.2: Does the MLRO identify national and international AML/CFT regulations that must be followed and keep up-to-date with regulations and developments in AML/CFT?\n"},{"$f":"All!K45","v":"1) Risk Assessment on local legislation and regulations and providers controls\n- Check the risk assessment includes a review of local and international AML/CFT regualtions and how the organisation is meeting those requirements\n- Check the risk asessement has been refreshed within the last 18 months."},{"$f":"All!L45","v":0},{"$f":"All!M45","v":"Standard Required"},{"$f":"All!N45","v":"Required"},{"$f":"All!O45","v":"FraudRisk"},{"$f":"All!P45","v":0},{"$f":"All!Q45","v":0},{"$f":"All!R45","v":0},{"$f":"All!S45","v":0},{"$f":"All!T45","v":0},{"$f":"All!U45","v":0},{"$f":"All!V45","v":0},{"$f":"All!W45","v":0},{"$f":"All!X45","v":0},{"$f":"All!Y45","v":0},{"$f":"All!Z45","v":0},{"$f":"All!AA45","v":0},{"$f":"All!AB45","v":0},{"$f":"All!AC45","v":0},{"$f":"All!AD45","v":0},{"$f":"All!AE45","v":0},{"$f":"All!AF45","v":0},{"$f":"All!AG45","v":0},{"$f":"All!AH45","v":0},{"$f":"All!AI45","v":0},{"$f":"All!AJ45","v":0},{"$f":"All!AK45","v":0},{"$f":"All!AL45","v":0},{"$f":"All!AM45","v":0},{"$f":"All!AN45","v":0},{"$f":"All!AO45","v":0},{"$f":"All!AP45","v":0},{"$f":"All!AQ45","v":0},{"$f":"All!AR45","v":0},{"$f":"All!AS45","v":0},{"$f":"All!AT45","v":0}]
[null,{"$f":"All!B46","v":"2"},{"$f":"All!C46","v":"2.3"},{"$f":"All!D46","v":"2.3.1"},{"$f":"All!E46","v":0},{"$f":"All!F46","v":"2.3.1.1"},{"$f":"All!G46","v":0},{"$f":"All!H46","v":0},{"$f":"All!I46","v":"2.3.1.1.3"},{"$f":"All!J46","v":"2.3.1.1.3: Has the MLRO been given responsibility for ensuring procedures are implemented to comply with the AML/CFT laws and regulations?\n"},{"$f":"All!K46","v":"1) Documentation that describes the objective and function of the AML programme (i.e. policy or equivalent document)\n- Check that this includes an outline of the MLRO responsibilities, including overseeing implementation of procedures that comply with AML/CFT laws.\n"},{"$f":"All!L46","v":0},{"$f":"All!M46","v":"Urgent Required"},{"$f":"All!N46","v":"Required"},{"$f":"All!O46","v":"FraudRisk"},{"$f":"All!P46","v":0},{"$f":"All!Q46","v":0},{"$f":"All!R46","v":0},{"$f":"All!S46","v":0},{"$f":"All!T46","v":0},{"$f":"All!U46","v":0},{"$f":"All!V46","v":0},{"$f":"All!W46","v":0},{"$f":"All!X46","v":0},{"$f":"All!Y46","v":0},{"$f":"All!Z46","v":0},{"$f":"All!AA46","v":0},{"$f":"All!AB46","v":0},{"$f":"All!AC46","v":0},{"$f":"All!AD46","v":0},{"$f":"All!AE46","v":0},{"$f":"All!AF46","v":0},{"$f":"All!AG46","v":0},{"$f":"All!AH46","v":0},{"$f":"All!AI46","v":0},{"$f":"All!AJ46","v":0},{"$f":"All!AK46","v":0},{"$f":"All!AL46","v":0},{"$f":"All!AM46","v":0},{"$f":"All!AN46","v":0},{"$f":"All!AO46","v":0},{"$f":"All!AP46","v":0},{"$f":"All!AQ46","v":0},{"$f":"All!AR46","v":0},{"$f":"All!AS46","v":0},{"$f":"All!AT46","v":0}]
[null,{"$f":"All!B47","v":"2"},{"$f":"All!C47","v":"2.3"},{"$f":"All!D47","v":"2.3.1"},{"$f":"All!E47","v":""},{"$f":"All!F47","v":"2.3.1.1"},{"$f":"All!G47","v":0},{"$f":"All!H47","v":0},{"$f":"All!I47","v":"2.3.1.1.4"},{"$f":"All!J47","v":"2.3.1.1.4: Does the MLRO receive internal reports of suspicious activity and investigate suspect accounts / individuals and take appropriate action?\n"},{"$f":"All!K47","v":"1) Suspicious activity management process for identifying, investigating, actioning and reporting suspected ML/TF activity.\n-Check internal reports of suspicious activity are received by the MLRO.\n-Check there is a process for the MLRO to investigate the suspicion."},{"$f":"All!L47","v":0},{"$f":"All!M47","v":"Urgent Required"},{"$f":"All!N47","v":"Required"},{"$f":"All!O47","v":"FraudRisk"},{"$f":"All!P47","v":0},{"$f":"All!Q47","v":0},{"$f":"All!R47","v":0},{"$f":"All!S47","v":0},{"$f":"All!T47","v":0},{"$f":"All!U47","v":0},{"$f":"All!V47","v":0},{"$f":"All!W47","v":0},{"$f":"All!X47","v":0},{"$f":"All!Y47","v":0},{"$f":"All!Z47","v":0},{"$f":"All!AA47","v":0},{"$f":"All!AB47","v":0},{"$f":"All!AC47","v":0},{"$f":"All!AD47","v":0},{"$f":"All!AE47","v":0},{"$f":"All!AF47","v":0},{"$f":"All!AG47","v":0},{"$f":"All!AH47","v":0},{"$f":"All!AI47","v":0},{"$f":"All!AJ47","v":0},{"$f":"All!AK47","v":0},{"$f":"All!AL47","v":0},{"$f":"All!AM47","v":0},{"$f":"All!AN47","v":0},{"$f":"All!AO47","v":0},{"$f":"All!AP47","v":0},{"$f":"All!AQ47","v":0},{"$f":"All!AR47","v":0},{"$f":"All!AS47","v":0},{"$f":"All!AT47","v":0}]
[null,{"$f":"All!B48","v":"2"},{"$f":"All!C48","v":"2.3"},{"$f":"All!D48","v":"2.3.1"},{"$f":"All!E48","v":""},{"$f":"All!F48","v":"2.3.1.1"},{"$f":"All!G48","v":0},{"$f":"All!H48","v":0},{"$f":"All!I48","v":"2.3.1.1.5"},{"$f":"All!J48","v":"2.3.1.1.5: Does the MLRO ensure that when changes are made to business services and processes, appropriate changes to AML/CFT controls are also made?\n"},{"$f":"All!K48","v":"1) Mobile Money service change management process / product development process\n- Check the process includes the requirement for changes to be notified and approved by the MLRO where required \n- Check that AML controls are changed where required"},{"$f":"All!L48","v":0},{"$f":"All!M48","v":"Standard Required"},{"$f":"All!N48","v":"Required"},{"$f":"All!O48","v":"FraudRisk"},{"$f":"All!P48","v":0},{"$f":"All!Q48","v":0},{"$f":"All!R48","v":0},{"$f":"All!S48","v":0},{"$f":"All!T48","v":0},{"$f":"All!U48","v":0},{"$f":"All!V48","v":0},{"$f":"All!W48","v":0},{"$f":"All!X48","v":0},{"$f":"All!Y48","v":0},{"$f":"All!Z48","v":0},{"$f":"All!AA48","v":0},{"$f":"All!AB48","v":0},{"$f":"All!AC48","v":0},{"$f":"All!AD48","v":0},{"$f":"All!AE48","v":0},{"$f":"All!AF48","v":0},{"$f":"All!AG48","v":0},{"$f":"All!AH48","v":0},{"$f":"All!AI48","v":0},{"$f":"All!AJ48","v":0},{"$f":"All!AK48","v":0},{"$f":"All!AL48","v":0},{"$f":"All!AM48","v":0},{"$f":"All!AN48","v":0},{"$f":"All!AO48","v":0},{"$f":"All!AP48","v":0},{"$f":"All!AQ48","v":0},{"$f":"All!AR48","v":0},{"$f":"All!AS48","v":0},{"$f":"All!AT48","v":0}]
[null,{"$f":"All!B49","v":"2"},{"$f":"All!C49","v":"2.3"},{"$f":"All!D49","v":"2.3.1"},{"$f":"All!E49","v":""},{"$f":"All!F49","v":"2.3.1.1"},{"$f":"All!G49","v":0},{"$f":"All!H49","v":0},{"$f":"All!I49","v":"2.3.1.1.6"},{"$f":"All!J49","v":"2.3.1.1.6: Does the MLRO encourage an AML/CFT culture within the Provider (with the assistance of the Directors, Officers, and senior management)?\n"},{"$f":"All!K49","v":0},{"$f":"All!L49","v":0},{"$f":"All!M49","v":"Recommended"},{"$f":"All!N49","v":"Recommended"},{"$f":"All!O49","v":"FraudRisk"},{"$f":"All!P49","v":0},{"$f":"All!Q49","v":0},{"$f":"All!R49","v":0},{"$f":"All!S49","v":0},{"$f":"All!T49","v":0},{"$f":"All!U49","v":0},{"$f":"All!V49","v":0},{"$f":"All!W49","v":0},{"$f":"All!X49","v":0},{"$f":"All!Y49","v":0},{"$f":"All!Z49","v":0},{"$f":"All!AA49","v":0},{"$f":"All!AB49","v":0},{"$f":"All!AC49","v":0},{"$f":"All!AD49","v":0},{"$f":"All!AE49","v":0},{"$f":"All!AF49","v":0},{"$f":"All!AG49","v":0},{"$f":"All!AH49","v":0},{"$f":"All!AI49","v":0},{"$f":"All!AJ49","v":0},{"$f":"All!AK49","v":0},{"$f":"All!AL49","v":0},{"$f":"All!AM49","v":0},{"$f":"All!AN49","v":0},{"$f":"All!AO49","v":0},{"$f":"All!AP49","v":0},{"$f":"All!AQ49","v":0},{"$f":"All!AR49","v":0},{"$f":"All!AS49","v":0},{"$f":"All!AT49","v":0}]
[null,{"$f":"All!B50","v":"2"},{"$f":"All!C50","v":"2.3"},{"$f":"All!D50","v":"2.3.1"},{"$f":"All!E50","v":""},{"$f":"All!F50","v":"2.3.1.1"},{"$f":"All!G50","v":0},{"$f":"All!H50","v":0},{"$f":"All!I50","v":"2.3.1.1.7"},{"$f":"All!J50","v":"2.3.1.1.7: Does the MLRO maintain contacts with law enforcement agencies and the Financial Intelligence Unit (or comparable government body)?\n"},{"$f":"All!K50","v":0},{"$f":"All!L50","v":0},{"$f":"All!M50","v":"Recommended"},{"$f":"All!N50","v":"Recommended"},{"$f":"All!O50","v":"FraudRisk"},{"$f":"All!P50","v":0},{"$f":"All!Q50","v":0},{"$f":"All!R50","v":0},{"$f":"All!S50","v":0},{"$f":"All!T50","v":0},{"$f":"All!U50","v":0},{"$f":"All!V50","v":0},{"$f":"All!W50","v":0},{"$f":"All!X50","v":0},{"$f":"All!Y50","v":0},{"$f":"All!Z50","v":0},{"$f":"All!AA50","v":0},{"$f":"All!AB50","v":0},{"$f":"All!AC50","v":0},{"$f":"All!AD50","v":0},{"$f":"All!AE50","v":0},{"$f":"All!AF50","v":0},{"$f":"All!AG50","v":0},{"$f":"All!AH50","v":0},{"$f":"All!AI50","v":0},{"$f":"All!AJ50","v":0},{"$f":"All!AK50","v":0},{"$f":"All!AL50","v":0},{"$f":"All!AM50","v":0},{"$f":"All!AN50","v":0},{"$f":"All!AO50","v":0},{"$f":"All!AP50","v":0},{"$f":"All!AQ50","v":0},{"$f":"All!AR50","v":0},{"$f":"All!AS50","v":0},{"$f":"All!AT50","v":0}]
[null,{"$f":"All!B51","v":"2"},{"$f":"All!C51","v":"2.4"},{"$f":"All!D51","v":"2.4.1"},{"$f":"All!E51","v":"2.4.1: Providers shall create a system to monitor transactions for AML/CFT and anti-fraud purposes"},{"$f":"All!F51","v":"2.4.1.1"},{"$f":"All!G51","v":"2.4.1.1: TRANSACTION MONITORING\nA transaction monitoring system should be deployed to automatically identify suspicious transactions and patterns based on a configured set of rules. All transactions to/from mobile money accounts should be monitored to identify suspicious patterns. Alerts should be generated for manual follow-up and intervention. \n\nIt is recommended that actions on accounts (such as opening, closure, PIN change, SIM change) also be monitored for suspicious patterns.\n\nTransaction monitoring reports should be formally submitted to the MLRO and actions taken as defined in 2.1.1.2 and stored according to the record-keeping policy (2.1.1.5).\n\nDetails of the transaction monitoring system and its rules should be documented."},{"$f":"All!H51","v":"GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML"},{"$f":"All!I51","v":"2.4.1.1.1"},{"$f":"All!J51","v":"2.4.1.1.1: Has a transaction monitoring system been deployed to automatically identify suspicious transactions and patterns and create alerts for follow-up?\n"},{"$f":"All!K51","v":"1) Transaction monitoring system functional specification (or demonstration of system)\n- Check that the specification has been implemented and is operational."},{"$f":"All!L51","v":0},{"$f":"All!M51","v":"Urgent Required"},{"$f":"All!N51","v":"Required"},{"$f":"All!O51","v":"FraudRisk"},{"$f":"All!P51","v":0},{"$f":"All!Q51","v":0},{"$f":"All!R51","v":0},{"$f":"All!S51","v":0},{"$f":"All!T51","v":0},{"$f":"All!U51","v":0},{"$f":"All!V51","v":0},{"$f":"All!W51","v":0},{"$f":"All!X51","v":0},{"$f":"All!Y51","v":0},{"$f":"All!Z51","v":0},{"$f":"All!AA51","v":0},{"$f":"All!AB51","v":0},{"$f":"All!AC51","v":0},{"$f":"All!AD51","v":0},{"$f":"All!AE51","v":0},{"$f":"All!AF51","v":0},{"$f":"All!AG51","v":0},{"$f":"All!AH51","v":0},{"$f":"All!AI51","v":0},{"$f":"All!AJ51","v":0},{"$f":"All!AK51","v":0},{"$f":"All!AL51","v":0},{"$f":"All!AM51","v":0},{"$f":"All!AN51","v":0},{"$f":"All!AO51","v":0},{"$f":"All!AP51","v":0},{"$f":"All!AQ51","v":0},{"$f":"All!AR51","v":0},{"$f":"All!AS51","v":0},{"$f":"All!AT51","v":0}]
[null,{"$f":"All!B52","v":"2"},{"$f":"All!C52","v":"2.4"},{"$f":"All!D52","v":"2.4.1"},{"$f":"All!E52","v":0},{"$f":"All!F52","v":"2.4.1.1"},{"$f":"All!G52","v":0},{"$f":"All!H52","v":0},{"$f":"All!I52","v":"2.4.1.1.2"},{"$f":"All!J52","v":"2.4.1.1.2: Are details of the transaction monitoring system and its configuration documented?\n"},{"$f":"All!K52","v":"1) Transaction monitoring system functional specification\n- Check that transaction monitoring system and the configuration is documented.\n\n"},{"$f":"All!L52","v":0},{"$f":"All!M52","v":"Standard Required"},{"$f":"All!N52","v":"Required"},{"$f":"All!O52","v":"FraudRisk"},{"$f":"All!P52","v":0},{"$f":"All!Q52","v":0},{"$f":"All!R52","v":0},{"$f":"All!S52","v":0},{"$f":"All!T52","v":0},{"$f":"All!U52","v":0},{"$f":"All!V52","v":0},{"$f":"All!W52","v":0},{"$f":"All!X52","v":0},{"$f":"All!Y52","v":0},{"$f":"All!Z52","v":0},{"$f":"All!AA52","v":0},{"$f":"All!AB52","v":0},{"$f":"All!AC52","v":0},{"$f":"All!AD52","v":0},{"$f":"All!AE52","v":0},{"$f":"All!AF52","v":0},{"$f":"All!AG52","v":0},{"$f":"All!AH52","v":0},{"$f":"All!AI52","v":0},{"$f":"All!AJ52","v":0},{"$f":"All!AK52","v":0},{"$f":"All!AL52","v":0},{"$f":"All!AM52","v":0},{"$f":"All!AN52","v":0},{"$f":"All!AO52","v":0},{"$f":"All!AP52","v":0},{"$f":"All!AQ52","v":0},{"$f":"All!AR52","v":0},{"$f":"All!AS52","v":0},{"$f":"All!AT52","v":0}]
[null,{"$f":"All!B53","v":"2"},{"$f":"All!C53","v":"2.4"},{"$f":"All!D53","v":"2.4.1"},{"$f":"All!E53","v":0},{"$f":"All!F53","v":"2.4.1.1"},{"$f":"All!G53","v":0},{"$f":"All!H53","v":0},{"$f":"All!I53","v":"2.4.1.1.3"},{"$f":"All!J53","v":"2.4.1.1.3: Has an automated monitoring system been deployed to identify suspicious actions on accounts (such as opening, closure, PIN change, SIM change)?\n"},{"$f":"All!K53","v":0},{"$f":"All!L53","v":0},{"$f":"All!M53","v":"Recommended"},{"$f":"All!N53","v":"Recommended"},{"$f":"All!O53","v":"FraudRisk"},{"$f":"All!P53","v":0},{"$f":"All!Q53","v":0},{"$f":"All!R53","v":0},{"$f":"All!S53","v":0},{"$f":"All!T53","v":0},{"$f":"All!U53","v":0},{"$f":"All!V53","v":0},{"$f":"All!W53","v":0},{"$f":"All!X53","v":0},{"$f":"All!Y53","v":0},{"$f":"All!Z53","v":0},{"$f":"All!AA53","v":0},{"$f":"All!AB53","v":0},{"$f":"All!AC53","v":0},{"$f":"All!AD53","v":0},{"$f":"All!AE53","v":0},{"$f":"All!AF53","v":0},{"$f":"All!AG53","v":0},{"$f":"All!AH53","v":0},{"$f":"All!AI53","v":0},{"$f":"All!AJ53","v":0},{"$f":"All!AK53","v":0},{"$f":"All!AL53","v":0},{"$f":"All!AM53","v":0},{"$f":"All!AN53","v":0},{"$f":"All!AO53","v":0},{"$f":"All!AP53","v":0},{"$f":"All!AQ53","v":0},{"$f":"All!AR53","v":0},{"$f":"All!AS53","v":0},{"$f":"All!AT53","v":0}]
[null,{"$f":"All!B54","v":"2"},{"$f":"All!C54","v":"2.4"},{"$f":"All!D54","v":"2.4.1"},{"$f":"All!E54","v":0},{"$f":"All!F54","v":"2.4.1.2"},{"$f":"All!G54","v":"2.4.1.2: IDENTIFICATION OF SUSPICIOUS TRANSACTIONS\nThe transaction monitoring system should identify unusual or suspicious patterns of transactions. The system should be configurable so that it can be configured to respond to new types of suspicious patterns quickly and effectively.\n\nExamples of suspicious transactions that the system should be able to detect include:\n- Structuring of transactions (e.g., smurfing - multiple transactions just under the transaction limit);\n- Multiple attempted transactions exceeding allowable transaction limits; \n- Changes in velocity of transactions or transaction patterns inconsistent with customer’s prior behaviour (based on behaviour profiling);\n- Transaction requests from lost or stolen devices (e.g. using handset IMEI)."},{"$f":"All!H54","v":"GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML"},{"$f":"All!I54","v":"2.4.1.2.1"},{"$f":"All!J54","v":"2.4.1.2.1: Can the transaction monitoring system be configured to respond to new types of suspicious patterns quickly and effectively?\n"},{"$f":"All!K54","v":"1) Transaction monitoring system functional specification\n- Check that system can be reconfigured to respond to new patterns of suspicious behaviour without requiring significant changes such as a new software release."},{"$f":"All!L54","v":0},{"$f":"All!M54","v":"Standard Required"},{"$f":"All!N54","v":"Required"},{"$f":"All!O54","v":"FraudRisk"},{"$f":"All!P54","v":0},{"$f":"All!Q54","v":0},{"$f":"All!R54","v":0},{"$f":"All!S54","v":0},{"$f":"All!T54","v":0},{"$f":"All!U54","v":0},{"$f":"All!V54","v":0},{"$f":"All!W54","v":0},{"$f":"All!X54","v":0},{"$f":"All!Y54","v":0},{"$f":"All!Z54","v":0},{"$f":"All!AA54","v":0},{"$f":"All!AB54","v":0},{"$f":"All!AC54","v":0},{"$f":"All!AD54","v":0},{"$f":"All!AE54","v":0},{"$f":"All!AF54","v":0},{"$f":"All!AG54","v":0},{"$f":"All!AH54","v":0},{"$f":"All!AI54","v":0},{"$f":"All!AJ54","v":0},{"$f":"All!AK54","v":0},{"$f":"All!AL54","v":0},{"$f":"All!AM54","v":0},{"$f":"All!AN54","v":0},{"$f":"All!AO54","v":0},{"$f":"All!AP54","v":0},{"$f":"All!AQ54","v":0},{"$f":"All!AR54","v":0},{"$f":"All!AS54","v":0},{"$f":"All!AT54","v":0}]
[null,{"$f":"All!B55","v":"2"},{"$f":"All!C55","v":"2.4"},{"$f":"All!D55","v":"2.4.1"},{"$f":"All!E55","v":0},{"$f":"All!F55","v":"2.4.1.2"},{"$f":"All!G55","v":0},{"$f":"All!H55","v":0},{"$f":"All!I55","v":"2.4.1.2.2"},{"$f":"All!J55","v":"2.4.1.2.2: Can the transaction monitoring system detect structuring of transactions (e.g., smurfing) or multiple attempted transactions that exceed the transaction limit?\n"},{"$f":"All!K55","v":0},{"$f":"All!L55","v":0},{"$f":"All!M55","v":"Recommended"},{"$f":"All!N55","v":"Recommended"},{"$f":"All!O55","v":"FraudRisk"},{"$f":"All!P55","v":0},{"$f":"All!Q55","v":0},{"$f":"All!R55","v":0},{"$f":"All!S55","v":0},{"$f":"All!T55","v":0},{"$f":"All!U55","v":0},{"$f":"All!V55","v":0},{"$f":"All!W55","v":0},{"$f":"All!X55","v":0},{"$f":"All!Y55","v":0},{"$f":"All!Z55","v":0},{"$f":"All!AA55","v":0},{"$f":"All!AB55","v":0},{"$f":"All!AC55","v":0},{"$f":"All!AD55","v":0},{"$f":"All!AE55","v":0},{"$f":"All!AF55","v":0},{"$f":"All!AG55","v":0},{"$f":"All!AH55","v":0},{"$f":"All!AI55","v":0},{"$f":"All!AJ55","v":0},{"$f":"All!AK55","v":0},{"$f":"All!AL55","v":0},{"$f":"All!AM55","v":0},{"$f":"All!AN55","v":0},{"$f":"All!AO55","v":0},{"$f":"All!AP55","v":0},{"$f":"All!AQ55","v":0},{"$f":"All!AR55","v":0},{"$f":"All!AS55","v":0},{"$f":"All!AT55","v":0}]
[null,{"$f":"All!B56","v":"2"},{"$f":"All!C56","v":"2.4"},{"$f":"All!D56","v":"2.4.1"},{"$f":"All!E56","v":0},{"$f":"All!F56","v":"2.4.1.2"},{"$f":"All!G56","v":0},{"$f":"All!H56","v":0},{"$f":"All!I56","v":"2.4.1.2.3"},{"$f":"All!J56","v":"2.4.1.2.3: Can the transaction monitoring system promptly detect changes in velocity of transactions or transactions inconsistent with client’s prior behaviour?\n"},{"$f":"All!K56","v":0},{"$f":"All!L56","v":0},{"$f":"All!M56","v":"Recommended"},{"$f":"All!N56","v":"Recommended"},{"$f":"All!O56","v":"FraudRisk"},{"$f":"All!P56","v":0},{"$f":"All!Q56","v":0},{"$f":"All!R56","v":0},{"$f":"All!S56","v":0},{"$f":"All!T56","v":0},{"$f":"All!U56","v":0},{"$f":"All!V56","v":0},{"$f":"All!W56","v":0},{"$f":"All!X56","v":0},{"$f":"All!Y56","v":0},{"$f":"All!Z56","v":0},{"$f":"All!AA56","v":0},{"$f":"All!AB56","v":0},{"$f":"All!AC56","v":0},{"$f":"All!AD56","v":0},{"$f":"All!AE56","v":0},{"$f":"All!AF56","v":0},{"$f":"All!AG56","v":0},{"$f":"All!AH56","v":0},{"$f":"All!AI56","v":0},{"$f":"All!AJ56","v":0},{"$f":"All!AK56","v":0},{"$f":"All!AL56","v":0},{"$f":"All!AM56","v":0},{"$f":"All!AN56","v":0},{"$f":"All!AO56","v":0},{"$f":"All!AP56","v":0},{"$f":"All!AQ56","v":0},{"$f":"All!AR56","v":0},{"$f":"All!AS56","v":0},{"$f":"All!AT56","v":0}]
[null,{"$f":"All!B57","v":"2"},{"$f":"All!C57","v":"2.4"},{"$f":"All!D57","v":"2.4.1"},{"$f":"All!E57","v":0},{"$f":"All!F57","v":"2.4.1.2"},{"$f":"All!G57","v":0},{"$f":"All!H57","v":0},{"$f":"All!I57","v":"2.4.1.2.4"},{"$f":"All!J57","v":"2.4.1.2.4: Can the transaction monitoring system promptly detect transaction requests from lost or stolen devices (e.g. using handset IMEI)?\n"},{"$f":"All!K57","v":0},{"$f":"All!L57","v":0},{"$f":"All!M57","v":"Recommended"},{"$f":"All!N57","v":"Recommended"},{"$f":"All!O57","v":"FraudRisk"},{"$f":"All!P57","v":0},{"$f":"All!Q57","v":0},{"$f":"All!R57","v":0},{"$f":"All!S57","v":0},{"$f":"All!T57","v":0},{"$f":"All!U57","v":0},{"$f":"All!V57","v":0},{"$f":"All!W57","v":0},{"$f":"All!X57","v":0},{"$f":"All!Y57","v":0},{"$f":"All!Z57","v":0},{"$f":"All!AA57","v":0},{"$f":"All!AB57","v":0},{"$f":"All!AC57","v":0},{"$f":"All!AD57","v":0},{"$f":"All!AE57","v":0},{"$f":"All!AF57","v":0},{"$f":"All!AG57","v":0},{"$f":"All!AH57","v":0},{"$f":"All!AI57","v":0},{"$f":"All!AJ57","v":0},{"$f":"All!AK57","v":0},{"$f":"All!AL57","v":0},{"$f":"All!AM57","v":0},{"$f":"All!AN57","v":0},{"$f":"All!AO57","v":0},{"$f":"All!AP57","v":0},{"$f":"All!AQ57","v":0},{"$f":"All!AR57","v":0},{"$f":"All!AS57","v":0},{"$f":"All!AT57","v":0}]
[null,{"$f":"All!B58","v":"2"},{"$f":"All!C58","v":"2.4"},{"$f":"All!D58","v":"2.4.1"},{"$f":"All!E58","v":0},{"$f":"All!F58","v":"2.4.1.3"},{"$f":"All!G58","v":"2.4.1.3: GEOGRAPHIC VALIDATION\nIf technically feasible, location details of transaction parties should be monitored. Location details may be obtained through geo-location, cell site or other system-generated address data.\n\nLocation information can be used to identify suspicious behaviour such as:\n  - transactions to/from suspicious locations (e.g. prisons);\n  - transactions by an agent when the customer is not at the agent location;\n  - multiple transactions in different locations within a short time period (this is an indicator of SIM cloning).\n  - agents operating outside their expected area (agent SIMs that have moved location may be used for unauthorized cross-border transfers and are also more likely to be performing false registrations).\n"},{"$f":"All!H58","v":"GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML"},{"$f":"All!I58","v":"2.4.1.3.1"},{"$f":"All!J58","v":"2.4.1.3.1: Does the transaction monitoring system incorporate location information of transaction parties (obtained through geo-location, cell site or other system-generated address data)?\n"},{"$f":"All!K58","v":0},{"$f":"All!L58","v":0},{"$f":"All!M58","v":"Recommended"},{"$f":"All!N58","v":"Recommended"},{"$f":"All!O58","v":"FraudRisk"},{"$f":"All!P58","v":0},{"$f":"All!Q58","v":0},{"$f":"All!R58","v":0},{"$f":"All!S58","v":0},{"$f":"All!T58","v":0},{"$f":"All!U58","v":0},{"$f":"All!V58","v":0},{"$f":"All!W58","v":0},{"$f":"All!X58","v":0},{"$f":"All!Y58","v":0},{"$f":"All!Z58","v":0},{"$f":"All!AA58","v":0},{"$f":"All!AB58","v":0},{"$f":"All!AC58","v":0},{"$f":"All!AD58","v":0},{"$f":"All!AE58","v":0},{"$f":"All!AF58","v":0},{"$f":"All!AG58","v":0},{"$f":"All!AH58","v":0},{"$f":"All!AI58","v":0},{"$f":"All!AJ58","v":0},{"$f":"All!AK58","v":0},{"$f":"All!AL58","v":0},{"$f":"All!AM58","v":0},{"$f":"All!AN58","v":0},{"$f":"All!AO58","v":0},{"$f":"All!AP58","v":0},{"$f":"All!AQ58","v":0},{"$f":"All!AR58","v":0},{"$f":"All!AS58","v":0},{"$f":"All!AT58","v":0}]
[null,{"$f":"All!B59","v":"2"},{"$f":"All!C59","v":"2.4"},{"$f":"All!D59","v":"2.4.1"},{"$f":"All!E59","v":0},{"$f":"All!F59","v":"2.4.1.3"},{"$f":"All!G59","v":0},{"$f":"All!H59","v":0},{"$f":"All!I59","v":"2.4.1.3.2"},{"$f":"All!J59","v":"2.4.1.3.2: Can the transaction monitoring system detect transactions to/from suspicious locations?\n"},{"$f":"All!K59","v":0},{"$f":"All!L59","v":0},{"$f":"All!M59","v":"Recommended"},{"$f":"All!N59","v":"Recommended"},{"$f":"All!O59","v":"FraudRisk"},{"$f":"All!P59","v":0},{"$f":"All!Q59","v":0},{"$f":"All!R59","v":0},{"$f":"All!S59","v":0},{"$f":"All!T59","v":0},{"$f":"All!U59","v":0},{"$f":"All!V59","v":0},{"$f":"All!W59","v":0},{"$f":"All!X59","v":0},{"$f":"All!Y59","v":0},{"$f":"All!Z59","v":0},{"$f":"All!AA59","v":0},{"$f":"All!AB59","v":0},{"$f":"All!AC59","v":0},{"$f":"All!AD59","v":0},{"$f":"All!AE59","v":0},{"$f":"All!AF59","v":0},{"$f":"All!AG59","v":0},{"$f":"All!AH59","v":0},{"$f":"All!AI59","v":0},{"$f":"All!AJ59","v":0},{"$f":"All!AK59","v":0},{"$f":"All!AL59","v":0},{"$f":"All!AM59","v":0},{"$f":"All!AN59","v":0},{"$f":"All!AO59","v":0},{"$f":"All!AP59","v":0},{"$f":"All!AQ59","v":0},{"$f":"All!AR59","v":0},{"$f":"All!AS59","v":0},{"$f":"All!AT59","v":0}]
[null,{"$f":"All!B60","v":"2"},{"$f":"All!C60","v":"2.4"},{"$f":"All!D60","v":"2.4.1"},{"$f":"All!E60","v":0},{"$f":"All!F60","v":"2.4.1.3"},{"$f":"All!G60","v":0},{"$f":"All!H60","v":0},{"$f":"All!I60","v":"2.4.1.3.3"},{"$f":"All!J60","v":"2.4.1.3.3: Can the transaction monitoring system detect transactions by an agent when customer is not at agent location?\n"},{"$f":"All!K60","v":0},{"$f":"All!L60","v":0},{"$f":"All!M60","v":"Recommended"},{"$f":"All!N60","v":"Recommended"},{"$f":"All!O60","v":"FraudRisk"},{"$f":"All!P60","v":0},{"$f":"All!Q60","v":0},{"$f":"All!R60","v":0},{"$f":"All!S60","v":0},{"$f":"All!T60","v":0},{"$f":"All!U60","v":0},{"$f":"All!V60","v":0},{"$f":"All!W60","v":0},{"$f":"All!X60","v":0},{"$f":"All!Y60","v":0},{"$f":"All!Z60","v":0},{"$f":"All!AA60","v":0},{"$f":"All!AB60","v":0},{"$f":"All!AC60","v":0},{"$f":"All!AD60","v":0},{"$f":"All!AE60","v":0},{"$f":"All!AF60","v":0},{"$f":"All!AG60","v":0},{"$f":"All!AH60","v":0},{"$f":"All!AI60","v":0},{"$f":"All!AJ60","v":0},{"$f":"All!AK60","v":0},{"$f":"All!AL60","v":0},{"$f":"All!AM60","v":0},{"$f":"All!AN60","v":0},{"$f":"All!AO60","v":0},{"$f":"All!AP60","v":0},{"$f":"All!AQ60","v":0},{"$f":"All!AR60","v":0},{"$f":"All!AS60","v":0},{"$f":"All!AT60","v":0}]
[null,{"$f":"All!B61","v":"2"},{"$f":"All!C61","v":"2.4"},{"$f":"All!D61","v":"2.4.1"},{"$f":"All!E61","v":0},{"$f":"All!F61","v":"2.4.1.3"},{"$f":"All!G61","v":0},{"$f":"All!H61","v":0},{"$f":"All!I61","v":"2.4.1.3.4"},{"$f":"All!J61","v":"2.4.1.3.4: Can the transaction monitoring system detect multiple transactions in different locations within a short time period (this is an indicator of SIM cloning)?\n"},{"$f":"All!K61","v":0},{"$f":"All!L61","v":0},{"$f":"All!M61","v":"Recommended"},{"$f":"All!N61","v":"Recommended"},{"$f":"All!O61","v":"FraudRisk"},{"$f":"All!P61","v":0},{"$f":"All!Q61","v":0},{"$f":"All!R61","v":0},{"$f":"All!S61","v":0},{"$f":"All!T61","v":0},{"$f":"All!U61","v":0},{"$f":"All!V61","v":0},{"$f":"All!W61","v":0},{"$f":"All!X61","v":0},{"$f":"All!Y61","v":0},{"$f":"All!Z61","v":0},{"$f":"All!AA61","v":0},{"$f":"All!AB61","v":0},{"$f":"All!AC61","v":0},{"$f":"All!AD61","v":0},{"$f":"All!AE61","v":0},{"$f":"All!AF61","v":0},{"$f":"All!AG61","v":0},{"$f":"All!AH61","v":0},{"$f":"All!AI61","v":0},{"$f":"All!AJ61","v":0},{"$f":"All!AK61","v":0},{"$f":"All!AL61","v":0},{"$f":"All!AM61","v":0},{"$f":"All!AN61","v":0},{"$f":"All!AO61","v":0},{"$f":"All!AP61","v":0},{"$f":"All!AQ61","v":0},{"$f":"All!AR61","v":0},{"$f":"All!AS61","v":0},{"$f":"All!AT61","v":0}]
[null,{"$f":"All!B62","v":"2"},{"$f":"All!C62","v":"2.4"},{"$f":"All!D62","v":"2.4.1"},{"$f":"All!E62","v":0},{"$f":"All!F62","v":"2.4.1.3"},{"$f":"All!G62","v":0},{"$f":"All!H62","v":0},{"$f":"All!I62","v":"2.4.1.3.5"},{"$f":"All!J62","v":"2.4.1.3.5: Can the transaction monitoring system detect agents operating outside their expected area?\n"},{"$f":"All!K62","v":0},{"$f":"All!L62","v":0},{"$f":"All!M62","v":"Recommended"},{"$f":"All!N62","v":"Recommended"},{"$f":"All!O62","v":"FraudRisk"},{"$f":"All!P62","v":0},{"$f":"All!Q62","v":0},{"$f":"All!R62","v":0},{"$f":"All!S62","v":0},{"$f":"All!T62","v":0},{"$f":"All!U62","v":0},{"$f":"All!V62","v":0},{"$f":"All!W62","v":0},{"$f":"All!X62","v":0},{"$f":"All!Y62","v":0},{"$f":"All!Z62","v":0},{"$f":"All!AA62","v":0},{"$f":"All!AB62","v":0},{"$f":"All!AC62","v":0},{"$f":"All!AD62","v":0},{"$f":"All!AE62","v":0},{"$f":"All!AF62","v":0},{"$f":"All!AG62","v":0},{"$f":"All!AH62","v":0},{"$f":"All!AI62","v":0},{"$f":"All!AJ62","v":0},{"$f":"All!AK62","v":0},{"$f":"All!AL62","v":0},{"$f":"All!AM62","v":0},{"$f":"All!AN62","v":0},{"$f":"All!AO62","v":0},{"$f":"All!AP62","v":0},{"$f":"All!AQ62","v":0},{"$f":"All!AR62","v":0},{"$f":"All!AS62","v":0},{"$f":"All!AT62","v":0}]
[null,{"$f":"All!B63","v":"2"},{"$f":"All!C63","v":"2.4"},{"$f":"All!D63","v":"2.4.1"},{"$f":"All!E63","v":0},{"$f":"All!F63","v":"2.4.1.4"},{"$f":"All!G63","v":"2.4.1.4: ENHANCED TRANSACTION MONITORING\nEnhanced monitoring should be carried out for business transactions and transactions to/from financial ecosystem partners (e.g. banks, cross-border, interoperability), as these transactions may have higher limits and may present a higher ML / TF risk."},{"$f":"All!H63","v":"GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML"},{"$f":"All!I63","v":"2.4.1.4.1"},{"$f":"All!J63","v":"2.4.1.4.1: Is enhanced transaction monitoring implemented for business transactions and transactions to / from financial ecosystem partners (e.g. banks, cross-border, interoperability)?\n"},{"$f":"All!K63","v":0},{"$f":"All!L63","v":0},{"$f":"All!M63","v":"Recommended"},{"$f":"All!N63","v":"Recommended"},{"$f":"All!O63","v":"FraudRisk"},{"$f":"All!P63","v":0},{"$f":"All!Q63","v":0},{"$f":"All!R63","v":0},{"$f":"All!S63","v":0},{"$f":"All!T63","v":0},{"$f":"All!U63","v":0},{"$f":"All!V63","v":0},{"$f":"All!W63","v":0},{"$f":"All!X63","v":0},{"$f":"All!Y63","v":0},{"$f":"All!Z63","v":0},{"$f":"All!AA63","v":0},{"$f":"All!AB63","v":0},{"$f":"All!AC63","v":0},{"$f":"All!AD63","v":0},{"$f":"All!AE63","v":0},{"$f":"All!AF63","v":0},{"$f":"All!AG63","v":0},{"$f":"All!AH63","v":0},{"$f":"All!AI63","v":0},{"$f":"All!AJ63","v":0},{"$f":"All!AK63","v":0},{"$f":"All!AL63","v":0},{"$f":"All!AM63","v":0},{"$f":"All!AN63","v":0},{"$f":"All!AO63","v":0},{"$f":"All!AP63","v":0},{"$f":"All!AQ63","v":0},{"$f":"All!AR63","v":0},{"$f":"All!AS63","v":0},{"$f":"All!AT63","v":0}]
[null,{"$f":"All!B64","v":"2"},{"$f":"All!C64","v":"2.4"},{"$f":"All!D64","v":"2.4.1"},{"$f":"All!E64","v":0},{"$f":"All!F64","v":"2.4.1.5"},{"$f":"All!G64","v":"2.4.1.5: MONITORING CHANGES TO ACCOUNTS\nActions on accounts should be monitored to identify unusual and suspicious activity. This should include:\n  - Unusual account opening or closing;\n  - Suspicious changes to accounts;\n  - Suspicious patterns of security credential (e.g., PIN) change;\n  - Suspicious patterns of SIM change;\n  - Duplication of accounts."},{"$f":"All!H64","v":"GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML"},{"$f":"All!I64","v":"2.4.1.5.1"},{"$f":"All!J64","v":"2.4.1.5.1: Are actions on accounts monitored to identify unusual and suspicious activity, including account opening/closing/changes, suspicious PIN/SIM changes, and duplication of accounts?\n"},{"$f":"All!K64","v":0},{"$f":"All!L64","v":0},{"$f":"All!M64","v":"Recommended"},{"$f":"All!N64","v":"Recommended"},{"$f":"All!O64","v":"FraudRisk"},{"$f":"All!P64","v":0},{"$f":"All!Q64","v":0},{"$f":"All!R64","v":0},{"$f":"All!S64","v":0},{"$f":"All!T64","v":0},{"$f":"All!U64","v":0},{"$f":"All!V64","v":0},{"$f":"All!W64","v":0},{"$f":"All!X64","v":0},{"$f":"All!Y64","v":0},{"$f":"All!Z64","v":0},{"$f":"All!AA64","v":0},{"$f":"All!AB64","v":0},{"$f":"All!AC64","v":0},{"$f":"All!AD64","v":0},{"$f":"All!AE64","v":0},{"$f":"All!AF64","v":0},{"$f":"All!AG64","v":0},{"$f":"All!AH64","v":0},{"$f":"All!AI64","v":0},{"$f":"All!AJ64","v":0},{"$f":"All!AK64","v":0},{"$f":"All!AL64","v":0},{"$f":"All!AM64","v":0},{"$f":"All!AN64","v":0},{"$f":"All!AO64","v":0},{"$f":"All!AP64","v":0},{"$f":"All!AQ64","v":0},{"$f":"All!AR64","v":0},{"$f":"All!AS64","v":0},{"$f":"All!AT64","v":0}]
[null,{"$f":"All!B65","v":"2"},{"$f":"All!C65","v":"2.5"},{"$f":"All!D65","v":"2.5.1"},{"$f":"All!E65","v":"2.5.1: Providers shall adequately identify clients"},{"$f":"All!F65","v":"2.5.1.1"},{"$f":"All!G65","v":"2.5.1.1: KYC POLICY / REQUIREMENTS\nProviders should have a documented KYC policy (or doocumented KYC requirements) specifying the appropriate KYC to be collected for each type of account and the acceptable documentation.\n\nA risk-based KYC approach is recommended, which determines that higher-risk accounts or transactions (such as accounts with higher limits and/or greater functionality, transactions to/from high-risk markets, or accounts/transactions by politically exposed persons) require enhanced KYC, while simplified KYC is sufficient for lower-risk accounts (such as accounts with lower transaction and balance limits aimed at promoting financial inclusion)."},{"$f":"All!H65","v":"GSMA RMT (AG-09 )"},{"$f":"All!I65","v":"2.5.1.1.1"},{"$f":"All!J65","v":"2.5.1.1.1: Are the KYC requirements for customers documented, specifying the appropriate KYC to be collected for each type of account and the acceptable documentation?\n(Also see definition of risk-based KYC).\n"},{"$f":"All!K65","v":"1) KYC policy / KYC requirements / account registration process\n- Check that this specifies the KYC information required for each account type offered by the provider.\n- Check that the provider has assessed that the KYC information captured meets local regulatory requirements."},{"$f":"All!L65","v":0},{"$f":"All!M65","v":"Urgent Required"},{"$f":"All!N65","v":"Required"},{"$f":"All!O65","v":"FraudRisk"},{"$f":"All!P65","v":0},{"$f":"All!Q65","v":0},{"$f":"All!R65","v":0},{"$f":"All!S65","v":0},{"$f":"All!T65","v":0},{"$f":"All!U65","v":0},{"$f":"All!V65","v":0},{"$f":"All!W65","v":0},{"$f":"All!X65","v":0},{"$f":"All!Y65","v":0},{"$f":"All!Z65","v":0},{"$f":"All!AA65","v":0},{"$f":"All!AB65","v":0},{"$f":"All!AC65","v":0},{"$f":"All!AD65","v":0},{"$f":"All!AE65","v":0},{"$f":"All!AF65","v":0},{"$f":"All!AG65","v":0},{"$f":"All!AH65","v":0},{"$f":"All!AI65","v":0},{"$f":"All!AJ65","v":0},{"$f":"All!AK65","v":0},{"$f":"All!AL65","v":0},{"$f":"All!AM65","v":0},{"$f":"All!AN65","v":0},{"$f":"All!AO65","v":0},{"$f":"All!AP65","v":0},{"$f":"All!AQ65","v":0},{"$f":"All!AR65","v":0},{"$f":"All!AS65","v":0},{"$f":"All!AT65","v":0}]
[null,{"$f":"All!B66","v":"2"},{"$f":"All!C66","v":"2.5"},{"$f":"All!D66","v":"2.5.1"},{"$f":"All!E66","v":0},{"$f":"All!F66","v":"2.5.1.2"},{"$f":"All!G66","v":"2.5.1.2: MINIMUM KYC FOR BASIC ACCOUNTS AND LOW-VALUE OCCASIONAL TRANSACTIONS\nAt minimum, and subject to local law and regulation, providers should collect the following information at account opening or when conducting a low-value occasional transaction (e.g. OTC), either directly (for example, when a customer self-registers on their phone) or using agents: \n- Full name of Applicant; \n- Date of birth of Applicant; \n- Mobile telephone number of Applicant (if applicable);\n\nDepending upon domestic AML/CFT requirements, verification of information may be delayed or may not be required for low-value accounts or occasional transactions. Higher transaction/balance limits should require more KYC and stronger verification.\n\nIf permitted by local law, a basic account with limited functionality may be opened remotely using customer information already collected by the provider, government, or other party (e.g. from SIM registration or centralized electronic database). "},{"$f":"All!H66","v":"GSMA RMT (AG-09 )"},{"$f":"All!I66","v":"2.5.1.2.1"},{"$f":"All!J66","v":"2.5.1.2.1: Is all the following minimum KYC collected from customers opening basic accounts or conducting low-value occasional transactions (e.g. OTC)?\n"},{"$f":"All!K66","v":"1) KYC policy / KYC requirements / account registration process\n- Check that basic/low risk accounts (that only permit low value transactions) require the collection of at least the following KYC information:\n     a) Full name \n     b) Date of birth of Applicant\n     c) Mobile number or unique reference number\n\n[This indicator should be marked N/A if this type of basic account is not offered by the provider]"},{"$f":"All!L66","v":0},{"$f":"All!M66","v":"Urgent Required"},{"$f":"All!N66","v":"Required"},{"$f":"All!O66","v":"FraudRisk"},{"$f":"All!P66","v":0},{"$f":"All!Q66","v":0},{"$f":"All!R66","v":0},{"$f":"All!S66","v":0},{"$f":"All!T66","v":0},{"$f":"All!U66","v":0},{"$f":"All!V66","v":0},{"$f":"All!W66","v":0},{"$f":"All!X66","v":0},{"$f":"All!Y66","v":0},{"$f":"All!Z66","v":0},{"$f":"All!AA66","v":0},{"$f":"All!AB66","v":0},{"$f":"All!AC66","v":0},{"$f":"All!AD66","v":0},{"$f":"All!AE66","v":0},{"$f":"All!AF66","v":0},{"$f":"All!AG66","v":0},{"$f":"All!AH66","v":0},{"$f":"All!AI66","v":0},{"$f":"All!AJ66","v":0},{"$f":"All!AK66","v":0},{"$f":"All!AL66","v":0},{"$f":"All!AM66","v":0},{"$f":"All!AN66","v":0},{"$f":"All!AO66","v":0},{"$f":"All!AP66","v":0},{"$f":"All!AQ66","v":0},{"$f":"All!AR66","v":0},{"$f":"All!AS66","v":0},{"$f":"All!AT66","v":0}]
[null,{"$f":"All!B67","v":"2"},{"$f":"All!C67","v":"2.5"},{"$f":"All!D67","v":"2.5.1"},{"$f":"All!E67","v":""},{"$f":"All!F67","v":"2.5.1.3"},{"$f":"All!G67","v":"2.5.1.3: KYC FOR REGULAR ACCOUNTS\nAdditional KYC Information can be collected to enable higher-limit accounts or additional functionality and this may include: \n- All information required for Basic KYC; \n- Place of birth of Applicant; \n- Photograph of Applicant; \n- Current residential address of Applicant; \n- National ID number of Applicant (if such exists in the relevant jurisdiction) or other identifying number;\n- Any other information required to comply with local AML/CFT regulations.\n\nIf widely available, a national ID document should be used to verify customer identity. If a national ID is not widely available, one or more of the following IDs may be considered, if permitted by local laws and regulations. As part of the risk-based KYC approach, providers should evaluate the reliability of different identification documents when determining requirements for different account tiers: \n- Passport  \n- Voting card \n- Driver's licence \n- Social security card\n- Employee ID \n- Student ID \n- Salary slip \n- Tax report \n- Other government-issued ID\n- Attestation letter from local government official or person of appropriate standing in the community, such as a village chief.\n"},{"$f":"All!H67","v":"GSMA RMT (AG-09 )"},{"$f":"All!I67","v":"2.5.1.3.1"},{"$f":"All!J67","v":"2.5.1.3.1: In addition to the minimum KYC, is the National ID or other identifying number collected from customers opening regular accounts (if applicable)?\n"},{"$f":"All!K67","v":"1) KYC policy / KYC requirements / account registration process\n- Check that regular accounts require the collection of at least the following KYC information:\n     1) Full name\n     2) Date of birth of the applicant\n     3) Mobile number or unique reference number\n     4) National ID number or other identifying number "},{"$f":"All!L67","v":0},{"$f":"All!M67","v":"Urgent Required"},{"$f":"All!N67","v":"Required"},{"$f":"All!O67","v":"FraudRisk"},{"$f":"All!P67","v":0},{"$f":"All!Q67","v":0},{"$f":"All!R67","v":0},{"$f":"All!S67","v":0},{"$f":"All!T67","v":0},{"$f":"All!U67","v":0},{"$f":"All!V67","v":0},{"$f":"All!W67","v":0},{"$f":"All!X67","v":0},{"$f":"All!Y67","v":0},{"$f":"All!Z67","v":0},{"$f":"All!AA67","v":0},{"$f":"All!AB67","v":0},{"$f":"All!AC67","v":0},{"$f":"All!AD67","v":0},{"$f":"All!AE67","v":0},{"$f":"All!AF67","v":0},{"$f":"All!AG67","v":0},{"$f":"All!AH67","v":0},{"$f":"All!AI67","v":0},{"$f":"All!AJ67","v":0},{"$f":"All!AK67","v":0},{"$f":"All!AL67","v":0},{"$f":"All!AM67","v":0},{"$f":"All!AN67","v":0},{"$f":"All!AO67","v":0},{"$f":"All!AP67","v":0},{"$f":"All!AQ67","v":0},{"$f":"All!AR67","v":0},{"$f":"All!AS67","v":0},{"$f":"All!AT67","v":0}]
[null,{"$f":"All!B68","v":"2"},{"$f":"All!C68","v":"2.5"},{"$f":"All!D68","v":"2.5.1"},{"$f":"All!E68","v":""},{"$f":"All!F68","v":"2.5.1.3"},{"$f":"All!G68","v":0},{"$f":"All!H68","v":0},{"$f":"All!I68","v":"2.5.1.3.2"},{"$f":"All!J68","v":"2.5.1.3.2: In addition to the minimum KYC, is a photograph of the applicant taken for customers opening regular accounts?\n"},{"$f":"All!K68","v":0},{"$f":"All!L68","v":0},{"$f":"All!M68","v":"Recommended"},{"$f":"All!N68","v":"Recommended"},{"$f":"All!O68","v":"FraudRisk"},{"$f":"All!P68","v":0},{"$f":"All!Q68","v":0},{"$f":"All!R68","v":0},{"$f":"All!S68","v":0},{"$f":"All!T68","v":0},{"$f":"All!U68","v":0},{"$f":"All!V68","v":0},{"$f":"All!W68","v":0},{"$f":"All!X68","v":0},{"$f":"All!Y68","v":0},{"$f":"All!Z68","v":0},{"$f":"All!AA68","v":0},{"$f":"All!AB68","v":0},{"$f":"All!AC68","v":0},{"$f":"All!AD68","v":0},{"$f":"All!AE68","v":0},{"$f":"All!AF68","v":0},{"$f":"All!AG68","v":0},{"$f":"All!AH68","v":0},{"$f":"All!AI68","v":0},{"$f":"All!AJ68","v":0},{"$f":"All!AK68","v":0},{"$f":"All!AL68","v":0},{"$f":"All!AM68","v":0},{"$f":"All!AN68","v":0},{"$f":"All!AO68","v":0},{"$f":"All!AP68","v":0},{"$f":"All!AQ68","v":0},{"$f":"All!AR68","v":0},{"$f":"All!AS68","v":0},{"$f":"All!AT68","v":0}]
[null,{"$f":"All!B69","v":"2"},{"$f":"All!C69","v":"2.5"},{"$f":"All!D69","v":"2.5.1"},{"$f":"All!E69","v":""},{"$f":"All!F69","v":"2.5.1.3"},{"$f":"All!G69","v":0},{"$f":"All!H69","v":0},{"$f":"All!I69","v":"2.5.1.3.3"},{"$f":"All!J69","v":"2.5.1.3.3: In addition to the minimum KYC, is the current residential address collected from customers opening regular accounts?\n"},{"$f":"All!K69","v":0},{"$f":"All!L69","v":0},{"$f":"All!M69","v":"Recommended"},{"$f":"All!N69","v":"Recommended"},{"$f":"All!O69","v":"FraudRisk"},{"$f":"All!P69","v":0},{"$f":"All!Q69","v":0},{"$f":"All!R69","v":0},{"$f":"All!S69","v":0},{"$f":"All!T69","v":0},{"$f":"All!U69","v":0},{"$f":"All!V69","v":0},{"$f":"All!W69","v":0},{"$f":"All!X69","v":0},{"$f":"All!Y69","v":0},{"$f":"All!Z69","v":0},{"$f":"All!AA69","v":0},{"$f":"All!AB69","v":0},{"$f":"All!AC69","v":0},{"$f":"All!AD69","v":0},{"$f":"All!AE69","v":0},{"$f":"All!AF69","v":0},{"$f":"All!AG69","v":0},{"$f":"All!AH69","v":0},{"$f":"All!AI69","v":0},{"$f":"All!AJ69","v":0},{"$f":"All!AK69","v":0},{"$f":"All!AL69","v":0},{"$f":"All!AM69","v":0},{"$f":"All!AN69","v":0},{"$f":"All!AO69","v":0},{"$f":"All!AP69","v":0},{"$f":"All!AQ69","v":0},{"$f":"All!AR69","v":0},{"$f":"All!AS69","v":0},{"$f":"All!AT69","v":0}]
[null,{"$f":"All!B70","v":"2"},{"$f":"All!C70","v":"2.5"},{"$f":"All!D70","v":"2.5.1"},{"$f":"All!E70","v":""},{"$f":"All!F70","v":"2.5.1.3"},{"$f":"All!G70","v":0},{"$f":"All!H70","v":0},{"$f":"All!I70","v":"2.5.1.3.4"},{"$f":"All!J70","v":"2.5.1.3.4: In addition to the minimum KYC, is the place of birth collected from customers opening regular accounts?\n"},{"$f":"All!K70","v":0},{"$f":"All!L70","v":0},{"$f":"All!M70","v":"Recommended"},{"$f":"All!N70","v":"Recommended"},{"$f":"All!O70","v":"FraudRisk"},{"$f":"All!P70","v":0},{"$f":"All!Q70","v":0},{"$f":"All!R70","v":0},{"$f":"All!S70","v":0},{"$f":"All!T70","v":0},{"$f":"All!U70","v":0},{"$f":"All!V70","v":0},{"$f":"All!W70","v":0},{"$f":"All!X70","v":0},{"$f":"All!Y70","v":0},{"$f":"All!Z70","v":0},{"$f":"All!AA70","v":0},{"$f":"All!AB70","v":0},{"$f":"All!AC70","v":0},{"$f":"All!AD70","v":0},{"$f":"All!AE70","v":0},{"$f":"All!AF70","v":0},{"$f":"All!AG70","v":0},{"$f":"All!AH70","v":0},{"$f":"All!AI70","v":0},{"$f":"All!AJ70","v":0},{"$f":"All!AK70","v":0},{"$f":"All!AL70","v":0},{"$f":"All!AM70","v":0},{"$f":"All!AN70","v":0},{"$f":"All!AO70","v":0},{"$f":"All!AP70","v":0},{"$f":"All!AQ70","v":0},{"$f":"All!AR70","v":0},{"$f":"All!AS70","v":0},{"$f":"All!AT70","v":0}]
[null,{"$f":"All!B71","v":"2"},{"$f":"All!C71","v":"2.5"},{"$f":"All!D71","v":"2.5.1"},{"$f":"All!E71","v":""},{"$f":"All!F71","v":"2.5.1.3"},{"$f":"All!G71","v":0},{"$f":"All!H71","v":0},{"$f":"All!I71","v":"2.5.1.3.5"},{"$f":"All!J71","v":"2.5.1.3.5: Do contracts with business customers oblige them to provide updated details to the provider whenever there is a material change in the business ownership or management?\n"},{"$f":"All!K71","v":0},{"$f":"All!L71","v":0},{"$f":"All!M71","v":"Recommended"},{"$f":"All!N71","v":"Recommended"},{"$f":"All!O71","v":"FraudRisk"},{"$f":"All!P71","v":0},{"$f":"All!Q71","v":0},{"$f":"All!R71","v":0},{"$f":"All!S71","v":0},{"$f":"All!T71","v":0},{"$f":"All!U71","v":0},{"$f":"All!V71","v":0},{"$f":"All!W71","v":0},{"$f":"All!X71","v":0},{"$f":"All!Y71","v":0},{"$f":"All!Z71","v":0},{"$f":"All!AA71","v":0},{"$f":"All!AB71","v":0},{"$f":"All!AC71","v":0},{"$f":"All!AD71","v":0},{"$f":"All!AE71","v":0},{"$f":"All!AF71","v":0},{"$f":"All!AG71","v":0},{"$f":"All!AH71","v":0},{"$f":"All!AI71","v":0},{"$f":"All!AJ71","v":0},{"$f":"All!AK71","v":0},{"$f":"All!AL71","v":0},{"$f":"All!AM71","v":0},{"$f":"All!AN71","v":0},{"$f":"All!AO71","v":0},{"$f":"All!AP71","v":0},{"$f":"All!AQ71","v":0},{"$f":"All!AR71","v":0},{"$f":"All!AS71","v":0},{"$f":"All!AT71","v":0}]
[null,{"$f":"All!B72","v":"2"},{"$f":"All!C72","v":"2.5"},{"$f":"All!D72","v":"2.5.1"},{"$f":"All!E72","v":""},{"$f":"All!F72","v":"2.5.1.4"},{"$f":"All!G72","v":"2.5.1.4: KYC FOR BUSINESS ACCOUNTS\nEnhanced customer information should be collected for business customers and merchants and their directors. Business accounts typically have higher transaction limits so the ML/TF risks are higher. \n\nThe minimum additional Business KYC information to be collected is:\n- Identification of owners of the business;\n- Identification of members of senior management of the business;\n\nBackground checks on the owners and senior management of the business, including a police check and bankruptcy check, should be made where possible, and the financial viability and reputation of the business should be established, taking references where necessary. Using a risk-based approach, providers should consider checking the source of a business customer's funds and, where appropriate, their income statements.\n\nData should be reviewed and updated annually and whenever there is a material change in the business ownership or management. Contracts with business customers should oblige them to provide updated details to the provider whenever there is a material change in the business ownership or management.\n\nReports should be run regularly to ensure that all business customers have complete KYC for their owners and senior managers."},{"$f":"All!H72","v":"GSMA RMT (FR.P-28)"},{"$f":"All!I72","v":"2.5.1.4.1"},{"$f":"All!J72","v":"2.5.1.4.1: Are the KYC requirements for business accounts documented; in particular, the requirement for identification of the owners and senior management of each business?\n"},{"$f":"All!K72","v":"1) KYC policy / KYC requirements / account registration process\n- Check that KYC requirements are specified for business accounts (e.g. certificate of incorporation or registration, Tax registration, Business licence or permit, Bank details, ID documents for owners and directors)\n- Check that business accounts require risk-based identity checks of owners and/or directors"},{"$f":"All!L72","v":0},{"$f":"All!M72","v":"Standard Required"},{"$f":"All!N72","v":"Required"},{"$f":"All!O72","v":"FraudRisk"},{"$f":"All!P72","v":0},{"$f":"All!Q72","v":0},{"$f":"All!R72","v":0},{"$f":"All!S72","v":0},{"$f":"All!T72","v":0},{"$f":"All!U72","v":0},{"$f":"All!V72","v":0},{"$f":"All!W72","v":0},{"$f":"All!X72","v":0},{"$f":"All!Y72","v":0},{"$f":"All!Z72","v":0},{"$f":"All!AA72","v":0},{"$f":"All!AB72","v":0},{"$f":"All!AC72","v":0},{"$f":"All!AD72","v":0},{"$f":"All!AE72","v":0},{"$f":"All!AF72","v":0},{"$f":"All!AG72","v":0},{"$f":"All!AH72","v":0},{"$f":"All!AI72","v":0},{"$f":"All!AJ72","v":0},{"$f":"All!AK72","v":0},{"$f":"All!AL72","v":0},{"$f":"All!AM72","v":0},{"$f":"All!AN72","v":0},{"$f":"All!AO72","v":0},{"$f":"All!AP72","v":0},{"$f":"All!AQ72","v":0},{"$f":"All!AR72","v":0},{"$f":"All!AS72","v":0},{"$f":"All!AT72","v":0}]
[null,{"$f":"All!B73","v":"2"},{"$f":"All!C73","v":"2.5"},{"$f":"All!D73","v":"2.5.1"},{"$f":"All!E73","v":""},{"$f":"All!F73","v":"2.5.1.4"},{"$f":"All!G73","v":0},{"$f":"All!H73","v":0},{"$f":"All!I73","v":"2.5.1.4.2"},{"$f":"All!J73","v":"2.5.1.4.2: Are suitable checks (e.g. police check, bankruptcy check, financial viability and reputation) are made on business customers, and references taken if necessary?\n"},{"$f":"All!K73","v":0},{"$f":"All!L73","v":0},{"$f":"All!M73","v":"Recommended"},{"$f":"All!N73","v":"Recommended"},{"$f":"All!O73","v":"FraudRisk"},{"$f":"All!P73","v":0},{"$f":"All!Q73","v":0},{"$f":"All!R73","v":0},{"$f":"All!S73","v":0},{"$f":"All!T73","v":0},{"$f":"All!U73","v":0},{"$f":"All!V73","v":0},{"$f":"All!W73","v":0},{"$f":"All!X73","v":0},{"$f":"All!Y73","v":0},{"$f":"All!Z73","v":0},{"$f":"All!AA73","v":0},{"$f":"All!AB73","v":0},{"$f":"All!AC73","v":0},{"$f":"All!AD73","v":0},{"$f":"All!AE73","v":0},{"$f":"All!AF73","v":0},{"$f":"All!AG73","v":0},{"$f":"All!AH73","v":0},{"$f":"All!AI73","v":0},{"$f":"All!AJ73","v":0},{"$f":"All!AK73","v":0},{"$f":"All!AL73","v":0},{"$f":"All!AM73","v":0},{"$f":"All!AN73","v":0},{"$f":"All!AO73","v":0},{"$f":"All!AP73","v":0},{"$f":"All!AQ73","v":0},{"$f":"All!AR73","v":0},{"$f":"All!AS73","v":0},{"$f":"All!AT73","v":0}]
[null,{"$f":"All!B74","v":"2"},{"$f":"All!C74","v":"2.5"},{"$f":"All!D74","v":"2.5.1"},{"$f":"All!E74","v":0},{"$f":"All!F74","v":"2.5.1.4"},{"$f":"All!G74","v":0},{"$f":"All!H74","v":0},{"$f":"All!I74","v":"2.5.1.4.3"},{"$f":"All!J74","v":"2.5.1.4.3: Is KYC data reviewed and updated as needed?\n"},{"$f":"All!K74","v":0},{"$f":"All!L74","v":0},{"$f":"All!M74","v":"Recommended"},{"$f":"All!N74","v":"Recommended"},{"$f":"All!O74","v":"FraudRisk"},{"$f":"All!P74","v":0},{"$f":"All!Q74","v":0},{"$f":"All!R74","v":0},{"$f":"All!S74","v":0},{"$f":"All!T74","v":0},{"$f":"All!U74","v":0},{"$f":"All!V74","v":0},{"$f":"All!W74","v":0},{"$f":"All!X74","v":0},{"$f":"All!Y74","v":0},{"$f":"All!Z74","v":0},{"$f":"All!AA74","v":0},{"$f":"All!AB74","v":0},{"$f":"All!AC74","v":0},{"$f":"All!AD74","v":0},{"$f":"All!AE74","v":0},{"$f":"All!AF74","v":0},{"$f":"All!AG74","v":0},{"$f":"All!AH74","v":0},{"$f":"All!AI74","v":0},{"$f":"All!AJ74","v":0},{"$f":"All!AK74","v":0},{"$f":"All!AL74","v":0},{"$f":"All!AM74","v":0},{"$f":"All!AN74","v":0},{"$f":"All!AO74","v":0},{"$f":"All!AP74","v":0},{"$f":"All!AQ74","v":0},{"$f":"All!AR74","v":0},{"$f":"All!AS74","v":0},{"$f":"All!AT74","v":0}]
[null,{"$f":"All!B75","v":"2"},{"$f":"All!C75","v":"2.5"},{"$f":"All!D75","v":"2.5.1"},{"$f":"All!E75","v":""},{"$f":"All!F75","v":"2.5.1.4"},{"$f":"All!G75","v":0},{"$f":"All!H75","v":0},{"$f":"All!I75","v":"2.5.1.4.4"},{"$f":"All!J75","v":"2.5.1.4.4: Do contracts with business customers oblige them to provide updated details to the provider whenever there is a material change in the business ownership or management?\n"},{"$f":"All!K75","v":0},{"$f":"All!L75","v":0},{"$f":"All!M75","v":"Recommended"},{"$f":"All!N75","v":"Recommended"},{"$f":"All!O75","v":"FraudRisk"},{"$f":"All!P75","v":0},{"$f":"All!Q75","v":0},{"$f":"All!R75","v":0},{"$f":"All!S75","v":0},{"$f":"All!T75","v":0},{"$f":"All!U75","v":0},{"$f":"All!V75","v":0},{"$f":"All!W75","v":0},{"$f":"All!X75","v":0},{"$f":"All!Y75","v":0},{"$f":"All!Z75","v":0},{"$f":"All!AA75","v":0},{"$f":"All!AB75","v":0},{"$f":"All!AC75","v":0},{"$f":"All!AD75","v":0},{"$f":"All!AE75","v":0},{"$f":"All!AF75","v":0},{"$f":"All!AG75","v":0},{"$f":"All!AH75","v":0},{"$f":"All!AI75","v":0},{"$f":"All!AJ75","v":0},{"$f":"All!AK75","v":0},{"$f":"All!AL75","v":0},{"$f":"All!AM75","v":0},{"$f":"All!AN75","v":0},{"$f":"All!AO75","v":0},{"$f":"All!AP75","v":0},{"$f":"All!AQ75","v":0},{"$f":"All!AR75","v":0},{"$f":"All!AS75","v":0},{"$f":"All!AT75","v":0}]
[null,{"$f":"All!B76","v":"2"},{"$f":"All!C76","v":"2.5"},{"$f":"All!D76","v":"2.5.1"},{"$f":"All!E76","v":""},{"$f":"All!F76","v":"2.5.1.5"},{"$f":"All!G76","v":"2.5.1.5: VERIFYING KYC  \nUnder a risk-based approach (which must meet regulatory requirements), various levels of verification can be considered, depending upon transaction/balance limits and other risk controls. More rigorous verification procedures should be employed for higher-value and higher-risk accounts (see definition of risk-based KYC). \n\nAs a minimum, the following should be done:\n- Verification of KYC at the time of registration by viewing the appropriate ID document. Verification should confirm that document exists, that it is not an obvious forgery, that the photo (if there is one) is visible and matches the customer, and that the document confirms the supplied KYC details. \n- Basic system-enforced verification to ensure completeness and spot obvious issues (e.g. Date of Birth is a valid date, all fields completed, ID not duplicated).\n- Risk-based review of the KYC data, to confirm completeness and to look for errors such as obviously-false names. This could be automated or semi-automated in the system.\nIn some countries, providers are required to make a copy of the provided ID document.\n\nIf required, verification can be enforced by blocking accounts of customers whose ID has not been verified within a short period of registration (e.g. a week). Additional limits (e.g. cash-in only or very low transaction limit) may be placed on the accounts until the KYC ID has been verified. \n\nIf suspicious activity occurs on the account, then it may be necessary to carry out additional due diligence."},{"$f":"All!H76","v":"GSMA RMT (FR.T-11\nAG-09 )"},{"$f":"All!I76","v":"2.5.1.5.1"},{"$f":"All!J76","v":"2.5.1.5.1: Is the KYC data verified at the time of registration, by the registering agent or by the provider, by viewing or copying suitable ID documentation?\n"},{"$f":"All!K76","v":"1) KYC policy / KYC requirements / account registration process\n- Check that the KYC information provided by the applicant during registration is verified by viewing the customer's identification documentation."},{"$f":"All!L76","v":0},{"$f":"All!M76","v":"Urgent Required"},{"$f":"All!N76","v":"Required"},{"$f":"All!O76","v":"FraudRisk"},{"$f":"All!P76","v":0},{"$f":"All!Q76","v":0},{"$f":"All!R76","v":0},{"$f":"All!S76","v":0},{"$f":"All!T76","v":0},{"$f":"All!U76","v":0},{"$f":"All!V76","v":0},{"$f":"All!W76","v":0},{"$f":"All!X76","v":0},{"$f":"All!Y76","v":0},{"$f":"All!Z76","v":0},{"$f":"All!AA76","v":0},{"$f":"All!AB76","v":0},{"$f":"All!AC76","v":0},{"$f":"All!AD76","v":0},{"$f":"All!AE76","v":0},{"$f":"All!AF76","v":0},{"$f":"All!AG76","v":0},{"$f":"All!AH76","v":0},{"$f":"All!AI76","v":0},{"$f":"All!AJ76","v":0},{"$f":"All!AK76","v":0},{"$f":"All!AL76","v":0},{"$f":"All!AM76","v":0},{"$f":"All!AN76","v":0},{"$f":"All!AO76","v":0},{"$f":"All!AP76","v":0},{"$f":"All!AQ76","v":0},{"$f":"All!AR76","v":0},{"$f":"All!AS76","v":0},{"$f":"All!AT76","v":0}]
[null,{"$f":"All!B77","v":"2"},{"$f":"All!C77","v":"2.5"},{"$f":"All!D77","v":"2.5.1"},{"$f":"All!E77","v":""},{"$f":"All!F77","v":"2.5.1.5"},{"$f":"All!G77","v":0},{"$f":"All!H77","v":0},{"$f":"All!I77","v":"2.5.1.5.2"},{"$f":"All!J77","v":"2.5.1.5.2: Is basic system-enforced verification performed to ensure completeness and to spot obvious issues (e.g. Date of Birth is a valid date, all fields completed)?\n"},{"$f":"All!K77","v":"1) Configuration of the customer registration platform.\n- Check that the system rejects applications that have obvious issues (e.g. Date of Birth is a valid date, all fields completed)"},{"$f":"All!L77","v":0},{"$f":"All!M77","v":"Standard Required"},{"$f":"All!N77","v":"Required"},{"$f":"All!O77","v":"FraudRisk"},{"$f":"All!P77","v":0},{"$f":"All!Q77","v":0},{"$f":"All!R77","v":0},{"$f":"All!S77","v":0},{"$f":"All!T77","v":0},{"$f":"All!U77","v":0},{"$f":"All!V77","v":0},{"$f":"All!W77","v":0},{"$f":"All!X77","v":0},{"$f":"All!Y77","v":0},{"$f":"All!Z77","v":0},{"$f":"All!AA77","v":0},{"$f":"All!AB77","v":0},{"$f":"All!AC77","v":0},{"$f":"All!AD77","v":0},{"$f":"All!AE77","v":0},{"$f":"All!AF77","v":0},{"$f":"All!AG77","v":0},{"$f":"All!AH77","v":0},{"$f":"All!AI77","v":0},{"$f":"All!AJ77","v":0},{"$f":"All!AK77","v":0},{"$f":"All!AL77","v":0},{"$f":"All!AM77","v":0},{"$f":"All!AN77","v":0},{"$f":"All!AO77","v":0},{"$f":"All!AP77","v":0},{"$f":"All!AQ77","v":0},{"$f":"All!AR77","v":0},{"$f":"All!AS77","v":0},{"$f":"All!AT77","v":0}]
[null,{"$f":"All!B78","v":"2"},{"$f":"All!C78","v":"2.5"},{"$f":"All!D78","v":"2.5.1"},{"$f":"All!E78","v":""},{"$f":"All!F78","v":"2.5.1.5"},{"$f":"All!G78","v":0},{"$f":"All!H78","v":0},{"$f":"All!I78","v":"2.5.1.5.3"},{"$f":"All!J78","v":"2.5.1.5.3: If regulation permits accounts to be opened without immediate verification of KYC data, is account functionality limited (through measures such as lower transaction and/or balance limits, limits on permitted services, etc.) to mitigate risk?\n"},{"$f":"All!K78","v":"1)  KYC policy / KYC requirements / account registration process\n- For accounts that are opened without immediate verification, check that account functionality is limited for the period before verification is complete\n\n2) Assessment of local AML/CFT regulatory requirements\n- Check that the provider has reviewed the limited functionality (for accounts with unverified KYC) in relation to local regulatory requirements.\n\n[This indicator should be marked N/A if not offered by the provider]"},{"$f":"All!L78","v":0},{"$f":"All!M78","v":"Standard Required"},{"$f":"All!N78","v":"Required"},{"$f":"All!O78","v":"FraudRisk"},{"$f":"All!P78","v":0},{"$f":"All!Q78","v":0},{"$f":"All!R78","v":0},{"$f":"All!S78","v":0},{"$f":"All!T78","v":0},{"$f":"All!U78","v":0},{"$f":"All!V78","v":0},{"$f":"All!W78","v":0},{"$f":"All!X78","v":0},{"$f":"All!Y78","v":0},{"$f":"All!Z78","v":0},{"$f":"All!AA78","v":0},{"$f":"All!AB78","v":0},{"$f":"All!AC78","v":0},{"$f":"All!AD78","v":0},{"$f":"All!AE78","v":0},{"$f":"All!AF78","v":0},{"$f":"All!AG78","v":0},{"$f":"All!AH78","v":0},{"$f":"All!AI78","v":0},{"$f":"All!AJ78","v":0},{"$f":"All!AK78","v":0},{"$f":"All!AL78","v":0},{"$f":"All!AM78","v":0},{"$f":"All!AN78","v":0},{"$f":"All!AO78","v":0},{"$f":"All!AP78","v":0},{"$f":"All!AQ78","v":0},{"$f":"All!AR78","v":0},{"$f":"All!AS78","v":0},{"$f":"All!AT78","v":0}]
[null,{"$f":"All!B79","v":"2"},{"$f":"All!C79","v":"2.5"},{"$f":"All!D79","v":"2.5.1"},{"$f":"All!E79","v":""},{"$f":"All!F79","v":"2.5.1.5"},{"$f":"All!G79","v":0},{"$f":"All!H79","v":0},{"$f":"All!I79","v":"2.5.1.5.4"},{"$f":"All!J79","v":"2.5.1.5.4: Are risk-based reviews (either automated or semi-automated) of customers' and businesses' KYC data performed to confirm completeness and to identify errors?\n"},{"$f":"All!K79","v":0},{"$f":"All!L79","v":0},{"$f":"All!M79","v":"Recommended"},{"$f":"All!N79","v":"Recommended"},{"$f":"All!O79","v":"FraudRisk"},{"$f":"All!P79","v":0},{"$f":"All!Q79","v":0},{"$f":"All!R79","v":0},{"$f":"All!S79","v":0},{"$f":"All!T79","v":0},{"$f":"All!U79","v":0},{"$f":"All!V79","v":0},{"$f":"All!W79","v":0},{"$f":"All!X79","v":0},{"$f":"All!Y79","v":0},{"$f":"All!Z79","v":0},{"$f":"All!AA79","v":0},{"$f":"All!AB79","v":0},{"$f":"All!AC79","v":0},{"$f":"All!AD79","v":0},{"$f":"All!AE79","v":0},{"$f":"All!AF79","v":0},{"$f":"All!AG79","v":0},{"$f":"All!AH79","v":0},{"$f":"All!AI79","v":0},{"$f":"All!AJ79","v":0},{"$f":"All!AK79","v":0},{"$f":"All!AL79","v":0},{"$f":"All!AM79","v":0},{"$f":"All!AN79","v":0},{"$f":"All!AO79","v":0},{"$f":"All!AP79","v":0},{"$f":"All!AQ79","v":0},{"$f":"All!AR79","v":0},{"$f":"All!AS79","v":0},{"$f":"All!AT79","v":0}]
[null,{"$f":"All!B80","v":"2"},{"$f":"All!C80","v":"2.5"},{"$f":"All!D80","v":"2.5.1"},{"$f":"All!E80","v":""},{"$f":"All!F80","v":"2.5.1.5"},{"$f":"All!G80","v":0},{"$f":"All!H80","v":0},{"$f":"All!I80","v":"2.5.1.5.5"},{"$f":"All!J80","v":"2.5.1.5.5: For customers whose ID has not been verified within a period of time (e.g. a week), does the system automatically block their accounts to enforce verification of ID (unless an exemption to the verification requirement exists for low-value accounts)?\n"},{"$f":"All!K80","v":0},{"$f":"All!L80","v":0},{"$f":"All!M80","v":"Recommended"},{"$f":"All!N80","v":"Recommended"},{"$f":"All!O80","v":"FraudRisk"},{"$f":"All!P80","v":0},{"$f":"All!Q80","v":0},{"$f":"All!R80","v":0},{"$f":"All!S80","v":0},{"$f":"All!T80","v":0},{"$f":"All!U80","v":0},{"$f":"All!V80","v":0},{"$f":"All!W80","v":0},{"$f":"All!X80","v":0},{"$f":"All!Y80","v":0},{"$f":"All!Z80","v":0},{"$f":"All!AA80","v":0},{"$f":"All!AB80","v":0},{"$f":"All!AC80","v":0},{"$f":"All!AD80","v":0},{"$f":"All!AE80","v":0},{"$f":"All!AF80","v":0},{"$f":"All!AG80","v":0},{"$f":"All!AH80","v":0},{"$f":"All!AI80","v":0},{"$f":"All!AJ80","v":0},{"$f":"All!AK80","v":0},{"$f":"All!AL80","v":0},{"$f":"All!AM80","v":0},{"$f":"All!AN80","v":0},{"$f":"All!AO80","v":0},{"$f":"All!AP80","v":0},{"$f":"All!AQ80","v":0},{"$f":"All!AR80","v":0},{"$f":"All!AS80","v":0},{"$f":"All!AT80","v":0}]
[null,{"$f":"All!B81","v":"2"},{"$f":"All!C81","v":"2.5"},{"$f":"All!D81","v":"2.5.1"},{"$f":"All!E81","v":""},{"$f":"All!F81","v":"2.5.1.5"},{"$f":"All!G81","v":0},{"$f":"All!H81","v":0},{"$f":"All!I81","v":"2.5.1.5.6"},{"$f":"All!J81","v":"2.5.1.5.6: In case of suspicious activity, is additional KYC due diligence carried out?\n"},{"$f":"All!K81","v":0},{"$f":"All!L81","v":0},{"$f":"All!M81","v":"Recommended"},{"$f":"All!N81","v":"Recommended"},{"$f":"All!O81","v":"FraudRisk"},{"$f":"All!P81","v":0},{"$f":"All!Q81","v":0},{"$f":"All!R81","v":0},{"$f":"All!S81","v":0},{"$f":"All!T81","v":0},{"$f":"All!U81","v":0},{"$f":"All!V81","v":0},{"$f":"All!W81","v":0},{"$f":"All!X81","v":0},{"$f":"All!Y81","v":0},{"$f":"All!Z81","v":0},{"$f":"All!AA81","v":0},{"$f":"All!AB81","v":0},{"$f":"All!AC81","v":0},{"$f":"All!AD81","v":0},{"$f":"All!AE81","v":0},{"$f":"All!AF81","v":0},{"$f":"All!AG81","v":0},{"$f":"All!AH81","v":0},{"$f":"All!AI81","v":0},{"$f":"All!AJ81","v":0},{"$f":"All!AK81","v":0},{"$f":"All!AL81","v":0},{"$f":"All!AM81","v":0},{"$f":"All!AN81","v":0},{"$f":"All!AO81","v":0},{"$f":"All!AP81","v":0},{"$f":"All!AQ81","v":0},{"$f":"All!AR81","v":0},{"$f":"All!AS81","v":0},{"$f":"All!AT81","v":0}]
[null,{"$f":"All!B82","v":"2"},{"$f":"All!C82","v":"2.5"},{"$f":"All!D82","v":"2.5.1"},{"$f":"All!E82","v":""},{"$f":"All!F82","v":"2.5.1.6"},{"$f":"All!G82","v":"2.5.1.6: VERIFYING KYC AGAINST MOBILE PHONE RECORDS\nProviders should regularly reconcile their mobile money system with their mobile phone CRM system to identify accounts where the customer information does not match.\n\nWhere information does not match, providers should identify whether this is expected and acceptable (e.g. because an employer or family member is paying for postpaid service). If not, the discrepancy should be investigated."},{"$f":"All!H82","v":"GSMA RMT (FR.T-11)"},{"$f":"All!I82","v":"2.5.1.6.1"},{"$f":"All!J82","v":"2.5.1.6.1: Are customers' KYC details cross-checked against ID records held with the mobile phone CRM accounts to identify accounts where the customer information does not match?\n"},{"$f":"All!K82","v":0},{"$f":"All!L82","v":0},{"$f":"All!M82","v":"Recommended"},{"$f":"All!N82","v":"Recommended"},{"$f":"All!O82","v":"FraudRisk"},{"$f":"All!P82","v":0},{"$f":"All!Q82","v":0},{"$f":"All!R82","v":0},{"$f":"All!S82","v":0},{"$f":"All!T82","v":0},{"$f":"All!U82","v":0},{"$f":"All!V82","v":0},{"$f":"All!W82","v":0},{"$f":"All!X82","v":0},{"$f":"All!Y82","v":0},{"$f":"All!Z82","v":0},{"$f":"All!AA82","v":0},{"$f":"All!AB82","v":0},{"$f":"All!AC82","v":0},{"$f":"All!AD82","v":0},{"$f":"All!AE82","v":0},{"$f":"All!AF82","v":0},{"$f":"All!AG82","v":0},{"$f":"All!AH82","v":0},{"$f":"All!AI82","v":0},{"$f":"All!AJ82","v":0},{"$f":"All!AK82","v":0},{"$f":"All!AL82","v":0},{"$f":"All!AM82","v":0},{"$f":"All!AN82","v":0},{"$f":"All!AO82","v":0},{"$f":"All!AP82","v":0},{"$f":"All!AQ82","v":0},{"$f":"All!AR82","v":0},{"$f":"All!AS82","v":0},{"$f":"All!AT82","v":0}]
[null,{"$f":"All!B83","v":"2"},{"$f":"All!C83","v":"2.5"},{"$f":"All!D83","v":"2.5.1"},{"$f":"All!E83","v":""},{"$f":"All!F83","v":"2.5.1.6"},{"$f":"All!G83","v":0},{"$f":"All!H83","v":0},{"$f":"All!I83","v":"2.5.1.6.2"},{"$f":"All!J83","v":"2.5.1.6.2: In case a customer's KYC does not match their mobile phone CRM record, does the verification policy and process specify the appropriate action to identify whether this is expected and acceptable (e.g. because an employer or family member is paying for postpaid service) and to investigate the discrepancy if necessary?\n"},{"$f":"All!K83","v":0},{"$f":"All!L83","v":0},{"$f":"All!M83","v":"Recommended"},{"$f":"All!N83","v":"Recommended"},{"$f":"All!O83","v":"FraudRisk"},{"$f":"All!P83","v":0},{"$f":"All!Q83","v":0},{"$f":"All!R83","v":0},{"$f":"All!S83","v":0},{"$f":"All!T83","v":0},{"$f":"All!U83","v":0},{"$f":"All!V83","v":0},{"$f":"All!W83","v":0},{"$f":"All!X83","v":0},{"$f":"All!Y83","v":0},{"$f":"All!Z83","v":0},{"$f":"All!AA83","v":0},{"$f":"All!AB83","v":0},{"$f":"All!AC83","v":0},{"$f":"All!AD83","v":0},{"$f":"All!AE83","v":0},{"$f":"All!AF83","v":0},{"$f":"All!AG83","v":0},{"$f":"All!AH83","v":0},{"$f":"All!AI83","v":0},{"$f":"All!AJ83","v":0},{"$f":"All!AK83","v":0},{"$f":"All!AL83","v":0},{"$f":"All!AM83","v":0},{"$f":"All!AN83","v":0},{"$f":"All!AO83","v":0},{"$f":"All!AP83","v":0},{"$f":"All!AQ83","v":0},{"$f":"All!AR83","v":0},{"$f":"All!AS83","v":0},{"$f":"All!AT83","v":0}]
[null,{"$f":"All!B84","v":"2"},{"$f":"All!C84","v":"2.5"},{"$f":"All!D84","v":"2.5.1"},{"$f":"All!E84","v":""},{"$f":"All!F84","v":"2.5.1.7"},{"$f":"All!G84","v":"2.5.1.7: CHECKING IDENTITY DURING CASH-IN/CASH-OUT TRANSACTIONS\nProviders should ensure that agents consistently perform identity checks on the customer at cash-out, as a final check point to stop fraudsters and money launderers from liquidating e-money. It is recommended also to perform identity checks at cash-in too, to reduce the risk of direct deposits (see 2.7.1).\n\nA report should be created for all cash-in/out transactions that are rejected due to authentication failure (e.g. wrong PIN or lack of ID), with a process implemented for the AML/CFT team to review the report regularly."},{"$f":"All!H84","v":"GSMA RMT (FR.P-16\nFR.T-08)"},{"$f":"All!I84","v":"2.5.1.7.1"},{"$f":"All!J84","v":"2.5.1.7.1: Is the identity of the customer systematically checked by the agent at cash-out?\n"},{"$f":"All!K84","v":0},{"$f":"All!L84","v":0},{"$f":"All!M84","v":"Recommended"},{"$f":"All!N84","v":"Recommended"},{"$f":"All!O84","v":"FraudRisk"},{"$f":"All!P84","v":0},{"$f":"All!Q84","v":0},{"$f":"All!R84","v":0},{"$f":"All!S84","v":0},{"$f":"All!T84","v":0},{"$f":"All!U84","v":0},{"$f":"All!V84","v":0},{"$f":"All!W84","v":0},{"$f":"All!X84","v":0},{"$f":"All!Y84","v":0},{"$f":"All!Z84","v":0},{"$f":"All!AA84","v":0},{"$f":"All!AB84","v":0},{"$f":"All!AC84","v":0},{"$f":"All!AD84","v":0},{"$f":"All!AE84","v":0},{"$f":"All!AF84","v":0},{"$f":"All!AG84","v":0},{"$f":"All!AH84","v":0},{"$f":"All!AI84","v":0},{"$f":"All!AJ84","v":0},{"$f":"All!AK84","v":0},{"$f":"All!AL84","v":0},{"$f":"All!AM84","v":0},{"$f":"All!AN84","v":0},{"$f":"All!AO84","v":0},{"$f":"All!AP84","v":0},{"$f":"All!AQ84","v":0},{"$f":"All!AR84","v":0},{"$f":"All!AS84","v":0},{"$f":"All!AT84","v":0}]
[null,{"$f":"All!B85","v":"2"},{"$f":"All!C85","v":"2.5"},{"$f":"All!D85","v":"2.5.1"},{"$f":"All!E85","v":""},{"$f":"All!F85","v":"2.5.1.7"},{"$f":"All!G85","v":0},{"$f":"All!H85","v":0},{"$f":"All!I85","v":"2.5.1.7.2"},{"$f":"All!J85","v":"2.5.1.7.2: Does the AML/CFT team regularly review a report of all cash-in/out transactions that are rejected due to identity check failure?\n"},{"$f":"All!K85","v":0},{"$f":"All!L85","v":0},{"$f":"All!M85","v":"Recommended"},{"$f":"All!N85","v":"Recommended"},{"$f":"All!O85","v":"FraudRisk"},{"$f":"All!P85","v":0},{"$f":"All!Q85","v":0},{"$f":"All!R85","v":0},{"$f":"All!S85","v":0},{"$f":"All!T85","v":0},{"$f":"All!U85","v":0},{"$f":"All!V85","v":0},{"$f":"All!W85","v":0},{"$f":"All!X85","v":0},{"$f":"All!Y85","v":0},{"$f":"All!Z85","v":0},{"$f":"All!AA85","v":0},{"$f":"All!AB85","v":0},{"$f":"All!AC85","v":0},{"$f":"All!AD85","v":0},{"$f":"All!AE85","v":0},{"$f":"All!AF85","v":0},{"$f":"All!AG85","v":0},{"$f":"All!AH85","v":0},{"$f":"All!AI85","v":0},{"$f":"All!AJ85","v":0},{"$f":"All!AK85","v":0},{"$f":"All!AL85","v":0},{"$f":"All!AM85","v":0},{"$f":"All!AN85","v":0},{"$f":"All!AO85","v":0},{"$f":"All!AP85","v":0},{"$f":"All!AQ85","v":0},{"$f":"All!AR85","v":0},{"$f":"All!AS85","v":0},{"$f":"All!AT85","v":0}]
[null,{"$f":"All!B86","v":"2"},{"$f":"All!C86","v":"2.5"},{"$f":"All!D86","v":"2.5.2"},{"$f":"All!E86","v":"2.5.2: Providers shall place appropriate risk-based transaction and balance limits on accounts, depending upon the strength of customer identification and verification"},{"$f":"All!F86","v":"2.5.2.1"},{"$f":"All!G86","v":"2.5.2.1: TRANSACTION AND BALANCE LIMITS BASED ON KYC TIER\nTransaction and balance limits should be assigned to each tier and enforced by the system to limit the risk of abuse of the service (for fraud, money laundering or terrorist financing). Transactions that would breach a transaction or balance limit should be prevented.\n\nProviders should establish some or all of the following limits:\n- Maximum value of a single transaction;\n- Total value of transactions per day, week, month, 3 months, and/or year. Limits for inbound and outbound transactions could be different;\n- Total number of transactions per day, week, month, 3 months, and/or year; \n- Limit on the maximum balance that may be stored at any time.\n\nIf warranted due to risk assessments and/or required by regulation, providers may limit lower-tier customers to domestic transfers only and/or prevent them from accessing other financial ecosystem products, such as savings accounts."},{"$f":"All!H86","v":"GSMA RMT (FR.T-12\nFR.P-27\nFR.P-32)"},{"$f":"All!I86","v":"2.5.2.1.1"},{"$f":"All!J86","v":"2.5.2.1.1: Are transaction and balance limits assigned to each KYC tier of customer accounts and enforced by the system?\n"},{"$f":"All!K86","v":"1) MM system functional specification\n - Transaction limits: check that the system is confgured to block transactions once a threshold is met, and that this is customised to each KYC tier."},{"$f":"All!L86","v":0},{"$f":"All!M86","v":"Urgent Required"},{"$f":"All!N86","v":"Required"},{"$f":"All!O86","v":"FraudRisk"},{"$f":"All!P86","v":0},{"$f":"All!Q86","v":0},{"$f":"All!R86","v":0},{"$f":"All!S86","v":0},{"$f":"All!T86","v":0},{"$f":"All!U86","v":0},{"$f":"All!V86","v":0},{"$f":"All!W86","v":0},{"$f":"All!X86","v":0},{"$f":"All!Y86","v":0},{"$f":"All!Z86","v":0},{"$f":"All!AA86","v":0},{"$f":"All!AB86","v":0},{"$f":"All!AC86","v":0},{"$f":"All!AD86","v":0},{"$f":"All!AE86","v":0},{"$f":"All!AF86","v":0},{"$f":"All!AG86","v":0},{"$f":"All!AH86","v":0},{"$f":"All!AI86","v":0},{"$f":"All!AJ86","v":0},{"$f":"All!AK86","v":0},{"$f":"All!AL86","v":0},{"$f":"All!AM86","v":0},{"$f":"All!AN86","v":0},{"$f":"All!AO86","v":0},{"$f":"All!AP86","v":0},{"$f":"All!AQ86","v":0},{"$f":"All!AR86","v":0},{"$f":"All!AS86","v":0},{"$f":"All!AT86","v":0}]
[null,{"$f":"All!B87","v":"2"},{"$f":"All!C87","v":"2.5"},{"$f":"All!D87","v":"2.5.2"},{"$f":"All!E87","v":0},{"$f":"All!F87","v":"2.5.2.1"},{"$f":"All!G87","v":0},{"$f":"All!H87","v":0},{"$f":"All!I87","v":"2.5.2.1.2"},{"$f":"All!J87","v":"2.5.2.1.2: Do higher transaction/balance limits (if applicable) require more KYC and stronger verification?\n"},{"$f":"All!K87","v":"1) KYC policy / KYC requirements / account registration process\n- Check that more KYC and verification is required for higher transaction/balance limits."},{"$f":"All!L87","v":0},{"$f":"All!M87","v":"Standard Required"},{"$f":"All!N87","v":"Required"},{"$f":"All!O87","v":"FraudRisk"},{"$f":"All!P87","v":0},{"$f":"All!Q87","v":0},{"$f":"All!R87","v":0},{"$f":"All!S87","v":0},{"$f":"All!T87","v":0},{"$f":"All!U87","v":0},{"$f":"All!V87","v":0},{"$f":"All!W87","v":0},{"$f":"All!X87","v":0},{"$f":"All!Y87","v":0},{"$f":"All!Z87","v":0},{"$f":"All!AA87","v":0},{"$f":"All!AB87","v":0},{"$f":"All!AC87","v":0},{"$f":"All!AD87","v":0},{"$f":"All!AE87","v":0},{"$f":"All!AF87","v":0},{"$f":"All!AG87","v":0},{"$f":"All!AH87","v":0},{"$f":"All!AI87","v":0},{"$f":"All!AJ87","v":0},{"$f":"All!AK87","v":0},{"$f":"All!AL87","v":0},{"$f":"All!AM87","v":0},{"$f":"All!AN87","v":0},{"$f":"All!AO87","v":0},{"$f":"All!AP87","v":0},{"$f":"All!AQ87","v":0},{"$f":"All!AR87","v":0},{"$f":"All!AS87","v":0},{"$f":"All!AT87","v":0}]
[null,{"$f":"All!B88","v":"2"},{"$f":"All!C88","v":"2.5"},{"$f":"All!D88","v":"2.5.2"},{"$f":"All!E88","v":0},{"$f":"All!F88","v":"2.5.2.1"},{"$f":"All!G88","v":0},{"$f":"All!H88","v":0},{"$f":"All!I88","v":"2.5.2.1.3"},{"$f":"All!J88","v":"2.5.2.1.3: If warranted due to risk assessments and/or required by regulation, are lower-tier customers restricted to lower-risk products only?\n"},{"$f":"All!K88","v":0},{"$f":"All!L88","v":0},{"$f":"All!M88","v":"Recommended"},{"$f":"All!N88","v":"Recommended"},{"$f":"All!O88","v":"FraudRisk"},{"$f":"All!P88","v":0},{"$f":"All!Q88","v":0},{"$f":"All!R88","v":0},{"$f":"All!S88","v":0},{"$f":"All!T88","v":0},{"$f":"All!U88","v":0},{"$f":"All!V88","v":0},{"$f":"All!W88","v":0},{"$f":"All!X88","v":0},{"$f":"All!Y88","v":0},{"$f":"All!Z88","v":0},{"$f":"All!AA88","v":0},{"$f":"All!AB88","v":0},{"$f":"All!AC88","v":0},{"$f":"All!AD88","v":0},{"$f":"All!AE88","v":0},{"$f":"All!AF88","v":0},{"$f":"All!AG88","v":0},{"$f":"All!AH88","v":0},{"$f":"All!AI88","v":0},{"$f":"All!AJ88","v":0},{"$f":"All!AK88","v":0},{"$f":"All!AL88","v":0},{"$f":"All!AM88","v":0},{"$f":"All!AN88","v":0},{"$f":"All!AO88","v":0},{"$f":"All!AP88","v":0},{"$f":"All!AQ88","v":0},{"$f":"All!AR88","v":0},{"$f":"All!AS88","v":0},{"$f":"All!AT88","v":0}]
[null,{"$f":"All!B89","v":"2"},{"$f":"All!C89","v":"2.5"},{"$f":"All!D89","v":"2.5.2"},{"$f":"All!E89","v":0},{"$f":"All!F89","v":"2.5.2.2"},{"$f":"All!G89","v":"2.5.2.2: TRANSACTION AND BALANCE LIMITS: MULTIPLE ACCOUNTS\nThe provider should set limits on the number of accounts a customer / business can hold. If more than  one account is permitted, the transaction and balance limits should be applied to the aggregate total of transactions/balances across the accounts."},{"$f":"All!H89","v":"GSMA RMT (FR.P-03)"},{"$f":"All!I89","v":"2.5.2.2.1"},{"$f":"All!J89","v":"2.5.2.2.1: Does the AML/CFT policy specify a limit on the number of accounts that a customer / business can hold?\n"},{"$f":"All!K89","v":0},{"$f":"All!L89","v":0},{"$f":"All!M89","v":"Recommended"},{"$f":"All!N89","v":"Recommended"},{"$f":"All!O89","v":"FraudRisk"},{"$f":"All!P89","v":0},{"$f":"All!Q89","v":0},{"$f":"All!R89","v":0},{"$f":"All!S89","v":0},{"$f":"All!T89","v":0},{"$f":"All!U89","v":0},{"$f":"All!V89","v":0},{"$f":"All!W89","v":0},{"$f":"All!X89","v":0},{"$f":"All!Y89","v":0},{"$f":"All!Z89","v":0},{"$f":"All!AA89","v":0},{"$f":"All!AB89","v":0},{"$f":"All!AC89","v":0},{"$f":"All!AD89","v":0},{"$f":"All!AE89","v":0},{"$f":"All!AF89","v":0},{"$f":"All!AG89","v":0},{"$f":"All!AH89","v":0},{"$f":"All!AI89","v":0},{"$f":"All!AJ89","v":0},{"$f":"All!AK89","v":0},{"$f":"All!AL89","v":0},{"$f":"All!AM89","v":0},{"$f":"All!AN89","v":0},{"$f":"All!AO89","v":0},{"$f":"All!AP89","v":0},{"$f":"All!AQ89","v":0},{"$f":"All!AR89","v":0},{"$f":"All!AS89","v":0},{"$f":"All!AT89","v":0}]
[null,{"$f":"All!B90","v":"2"},{"$f":"All!C90","v":"2.5"},{"$f":"All!D90","v":"2.5.2"},{"$f":"All!E90","v":0},{"$f":"All!F90","v":"2.5.2.2"},{"$f":"All!G90","v":0},{"$f":"All!H90","v":0},{"$f":"All!I90","v":"2.5.2.2.2"},{"$f":"All!J90","v":"2.5.2.2.2: Are system and process controls in place to enforce the limit on the number of accounts that a customer / business can hold?\n"},{"$f":"All!K90","v":0},{"$f":"All!L90","v":0},{"$f":"All!M90","v":"Recommended"},{"$f":"All!N90","v":"Recommended"},{"$f":"All!O90","v":"FraudRisk"},{"$f":"All!P90","v":0},{"$f":"All!Q90","v":0},{"$f":"All!R90","v":0},{"$f":"All!S90","v":0},{"$f":"All!T90","v":0},{"$f":"All!U90","v":0},{"$f":"All!V90","v":0},{"$f":"All!W90","v":0},{"$f":"All!X90","v":0},{"$f":"All!Y90","v":0},{"$f":"All!Z90","v":0},{"$f":"All!AA90","v":0},{"$f":"All!AB90","v":0},{"$f":"All!AC90","v":0},{"$f":"All!AD90","v":0},{"$f":"All!AE90","v":0},{"$f":"All!AF90","v":0},{"$f":"All!AG90","v":0},{"$f":"All!AH90","v":0},{"$f":"All!AI90","v":0},{"$f":"All!AJ90","v":0},{"$f":"All!AK90","v":0},{"$f":"All!AL90","v":0},{"$f":"All!AM90","v":0},{"$f":"All!AN90","v":0},{"$f":"All!AO90","v":0},{"$f":"All!AP90","v":0},{"$f":"All!AQ90","v":0},{"$f":"All!AR90","v":0},{"$f":"All!AS90","v":0},{"$f":"All!AT90","v":0}]
[null,{"$f":"All!B91","v":"2"},{"$f":"All!C91","v":"2.5"},{"$f":"All!D91","v":"2.5.2"},{"$f":"All!E91","v":0},{"$f":"All!F91","v":"2.5.2.2"},{"$f":"All!G91","v":0},{"$f":"All!H91","v":0},{"$f":"All!I91","v":"2.5.2.2.3"},{"$f":"All!J91","v":"2.5.2.2.3: If more than one account is permitted, are transaction and balance limits correctly applied to the aggregate total of transactions/balances across the accounts, or are other controls implemented, based on risk assessment?\n"},{"$f":"All!K91","v":0},{"$f":"All!L91","v":0},{"$f":"All!M91","v":"Recommended"},{"$f":"All!N91","v":"Recommended"},{"$f":"All!O91","v":"FraudRisk"},{"$f":"All!P91","v":0},{"$f":"All!Q91","v":0},{"$f":"All!R91","v":0},{"$f":"All!S91","v":0},{"$f":"All!T91","v":0},{"$f":"All!U91","v":0},{"$f":"All!V91","v":0},{"$f":"All!W91","v":0},{"$f":"All!X91","v":0},{"$f":"All!Y91","v":0},{"$f":"All!Z91","v":0},{"$f":"All!AA91","v":0},{"$f":"All!AB91","v":0},{"$f":"All!AC91","v":0},{"$f":"All!AD91","v":0},{"$f":"All!AE91","v":0},{"$f":"All!AF91","v":0},{"$f":"All!AG91","v":0},{"$f":"All!AH91","v":0},{"$f":"All!AI91","v":0},{"$f":"All!AJ91","v":0},{"$f":"All!AK91","v":0},{"$f":"All!AL91","v":0},{"$f":"All!AM91","v":0},{"$f":"All!AN91","v":0},{"$f":"All!AO91","v":0},{"$f":"All!AP91","v":0},{"$f":"All!AQ91","v":0},{"$f":"All!AR91","v":0},{"$f":"All!AS91","v":0},{"$f":"All!AT91","v":0}]
[null,{"$f":"All!B92","v":"2"},{"$f":"All!C92","v":"2.5"},{"$f":"All!D92","v":"2.5.3"},{"$f":"All!E92","v":"2.5.3: Providers shall have the ability to block account transactions under certain circumstances"},{"$f":"All!F92","v":"2.5.3.1"},{"$f":"All!G92","v":"2.5.3.1: ACCOUNT-BLOCKING\nThe account-blocking mechanism should prevent accounts from being used under carefully-defined circumstances. Some of the circumstances under which providers could decide to block accounts include:\n- Prior to completion of identification and verification (subject to any exceptions for verification of low-value accounts, as noted in 2.5.1.2); \n- If required to do so by a competent authority;\n- If an account has become compromised or when a trigger event occurs on the account which indicates ML/TF may have occurred;\n- If an account has been fraudulently created;\n- If there is doubt that the KYC information is correct or if a customer has refused to provide additional KYC information requested;\n- When it is discovered that the customer has more than the maximum number of permitted accounts;\n- When a handset known to have been used for fraudulent activities is used with the account (e.g. identified by IMEI);\n"},{"$f":"All!H92","v":"GSMA RMT (FR.P-12)"},{"$f":"All!I92","v":"2.5.3.1.1"},{"$f":"All!J92","v":"2.5.3.1.1: Is there documentation that specifies the situations when accounts should be blocked?\n"},{"$f":"All!K92","v":"1) AML/CFT policy or process documentation\n- Check that there is documentation that specifies when an account should be blocked."},{"$f":"All!L92","v":0},{"$f":"All!M92","v":"Urgent Required"},{"$f":"All!N92","v":"Required"},{"$f":"All!O92","v":"FraudRisk"},{"$f":"All!P92","v":0},{"$f":"All!Q92","v":0},{"$f":"All!R92","v":0},{"$f":"All!S92","v":0},{"$f":"All!T92","v":0},{"$f":"All!U92","v":0},{"$f":"All!V92","v":0},{"$f":"All!W92","v":0},{"$f":"All!X92","v":0},{"$f":"All!Y92","v":0},{"$f":"All!Z92","v":0},{"$f":"All!AA92","v":0},{"$f":"All!AB92","v":0},{"$f":"All!AC92","v":0},{"$f":"All!AD92","v":0},{"$f":"All!AE92","v":0},{"$f":"All!AF92","v":0},{"$f":"All!AG92","v":0},{"$f":"All!AH92","v":0},{"$f":"All!AI92","v":0},{"$f":"All!AJ92","v":0},{"$f":"All!AK92","v":0},{"$f":"All!AL92","v":0},{"$f":"All!AM92","v":0},{"$f":"All!AN92","v":0},{"$f":"All!AO92","v":0},{"$f":"All!AP92","v":0},{"$f":"All!AQ92","v":0},{"$f":"All!AR92","v":0},{"$f":"All!AS92","v":0},{"$f":"All!AT92","v":0}]
[null,{"$f":"All!B93","v":"2"},{"$f":"All!C93","v":"2.5"},{"$f":"All!D93","v":"2.5.3"},{"$f":"All!E93","v":0},{"$f":"All!F93","v":"2.5.3.1"},{"$f":"All!G93","v":0},{"$f":"All!H93","v":0},{"$f":"All!I93","v":"2.5.3.1.2"},{"$f":"All!J93","v":"2.5.3.1.2: Is account-blocking enforced if required to do so by a competent authority?\n"},{"$f":"All!K93","v":"1) AML/CFT policy or process documentation\n- Check that there is a process by which a competent authority can block an account."},{"$f":"All!L93","v":0},{"$f":"All!M93","v":"Standard Required"},{"$f":"All!N93","v":"Required"},{"$f":"All!O93","v":"FraudRisk"},{"$f":"All!P93","v":0},{"$f":"All!Q93","v":0},{"$f":"All!R93","v":0},{"$f":"All!S93","v":0},{"$f":"All!T93","v":0},{"$f":"All!U93","v":0},{"$f":"All!V93","v":0},{"$f":"All!W93","v":0},{"$f":"All!X93","v":0},{"$f":"All!Y93","v":0},{"$f":"All!Z93","v":0},{"$f":"All!AA93","v":0},{"$f":"All!AB93","v":0},{"$f":"All!AC93","v":0},{"$f":"All!AD93","v":0},{"$f":"All!AE93","v":0},{"$f":"All!AF93","v":0},{"$f":"All!AG93","v":0},{"$f":"All!AH93","v":0},{"$f":"All!AI93","v":0},{"$f":"All!AJ93","v":0},{"$f":"All!AK93","v":0},{"$f":"All!AL93","v":0},{"$f":"All!AM93","v":0},{"$f":"All!AN93","v":0},{"$f":"All!AO93","v":0},{"$f":"All!AP93","v":0},{"$f":"All!AQ93","v":0},{"$f":"All!AR93","v":0},{"$f":"All!AS93","v":0},{"$f":"All!AT93","v":0}]
[null,{"$f":"All!B94","v":"2"},{"$f":"All!C94","v":"2.5"},{"$f":"All!D94","v":"2.5.3"},{"$f":"All!E94","v":0},{"$f":"All!F94","v":"2.5.3.1"},{"$f":"All!G94","v":0},{"$f":"All!H94","v":0},{"$f":"All!I94","v":"2.5.3.1.3"},{"$f":"All!J94","v":"2.5.3.1.3: Is account-blocking enforced if an account has become compromised or when a trigger event has occurred on the account which indicates ML/TF or fraud may have occurred?\n"},{"$f":"All!K94","v":"1) AML/CFT policy or process documentation\n- Check that there is a process by which the system can block an account due to a trigger event that indicates fraud or ML/TF may have occurred."},{"$f":"All!L94","v":0},{"$f":"All!M94","v":"Standard Required"},{"$f":"All!N94","v":"Required"},{"$f":"All!O94","v":"FraudRisk"},{"$f":"All!P94","v":0},{"$f":"All!Q94","v":0},{"$f":"All!R94","v":0},{"$f":"All!S94","v":0},{"$f":"All!T94","v":0},{"$f":"All!U94","v":0},{"$f":"All!V94","v":0},{"$f":"All!W94","v":0},{"$f":"All!X94","v":0},{"$f":"All!Y94","v":0},{"$f":"All!Z94","v":0},{"$f":"All!AA94","v":0},{"$f":"All!AB94","v":0},{"$f":"All!AC94","v":0},{"$f":"All!AD94","v":0},{"$f":"All!AE94","v":0},{"$f":"All!AF94","v":0},{"$f":"All!AG94","v":0},{"$f":"All!AH94","v":0},{"$f":"All!AI94","v":0},{"$f":"All!AJ94","v":0},{"$f":"All!AK94","v":0},{"$f":"All!AL94","v":0},{"$f":"All!AM94","v":0},{"$f":"All!AN94","v":0},{"$f":"All!AO94","v":0},{"$f":"All!AP94","v":0},{"$f":"All!AQ94","v":0},{"$f":"All!AR94","v":0},{"$f":"All!AS94","v":0},{"$f":"All!AT94","v":0}]
[null,{"$f":"All!B95","v":"2"},{"$f":"All!C95","v":"2.5"},{"$f":"All!D95","v":"2.5.3"},{"$f":"All!E95","v":0},{"$f":"All!F95","v":"2.5.3.1"},{"$f":"All!G95","v":0},{"$f":"All!H95","v":0},{"$f":"All!I95","v":"2.5.3.1.4"},{"$f":"All!J95","v":"2.5.3.1.4: Is account-blocking enforced prior to completion of identification and verification (subject to any exceptions for verification of low-value accounts, as noted in 2.5.1.2)?\n"},{"$f":"All!K95","v":0},{"$f":"All!L95","v":0},{"$f":"All!M95","v":"Recommended"},{"$f":"All!N95","v":"Recommended"},{"$f":"All!O95","v":"FraudRisk"},{"$f":"All!P95","v":0},{"$f":"All!Q95","v":0},{"$f":"All!R95","v":0},{"$f":"All!S95","v":0},{"$f":"All!T95","v":0},{"$f":"All!U95","v":0},{"$f":"All!V95","v":0},{"$f":"All!W95","v":0},{"$f":"All!X95","v":0},{"$f":"All!Y95","v":0},{"$f":"All!Z95","v":0},{"$f":"All!AA95","v":0},{"$f":"All!AB95","v":0},{"$f":"All!AC95","v":0},{"$f":"All!AD95","v":0},{"$f":"All!AE95","v":0},{"$f":"All!AF95","v":0},{"$f":"All!AG95","v":0},{"$f":"All!AH95","v":0},{"$f":"All!AI95","v":0},{"$f":"All!AJ95","v":0},{"$f":"All!AK95","v":0},{"$f":"All!AL95","v":0},{"$f":"All!AM95","v":0},{"$f":"All!AN95","v":0},{"$f":"All!AO95","v":0},{"$f":"All!AP95","v":0},{"$f":"All!AQ95","v":0},{"$f":"All!AR95","v":0},{"$f":"All!AS95","v":0},{"$f":"All!AT95","v":0}]
[null,{"$f":"All!B96","v":"2"},{"$f":"All!C96","v":"2.5"},{"$f":"All!D96","v":"2.5.3"},{"$f":"All!E96","v":""},{"$f":"All!F96","v":"2.5.3.2"},{"$f":"All!G96","v":"2.5.3.2: CUSTOMER BLACKLISTS\nProviders should record blacklists of customers that have been found to be involved in fraud, and should prevent these customers from holding mobile money accounts.\n\nIt is recommended that providers block transactions to/from blacklisted accounts managed by financial ecosystem partners if financial ecosystem partners provide such information and if legally permitted. \n\nIf possible, blacklists should be exchanged with other domestic mobile money providers and financial ecosystem partners. Ideally, Mobile Money providers and financial ecosystem partners in each country should come to an agreement about sharing details of money laundering, terrorist financing, and perpetration of fraud. This will help to prevent fraudsters from moving from one operator to another in order to continue their activities.\n\nThe agreement should include which identities to include in the information exchange. For example, it should include agents, businesses, and merchants (and their directors). Whether to include customers will depend on local agreements. How to identify the individuals should also be agreed - for example, by national ID."},{"$f":"All!H96","v":"GSMA RMT (FR.P-31)"},{"$f":"All!I96","v":"2.5.3.2.1"},{"$f":"All!J96","v":"2.5.3.2.1: Is there a process for maintaining a blacklist of customers that have been found to be involved in fraud and preventing them from holding accounts?\n"},{"$f":"All!K96","v":0},{"$f":"All!L96","v":0},{"$f":"All!M96","v":"Standard Required"},{"$f":"All!N96","v":"Recommended"},{"$f":"All!O96","v":"FraudRisk"},{"$f":"All!P96","v":0},{"$f":"All!Q96","v":0},{"$f":"All!R96","v":0},{"$f":"All!S96","v":0},{"$f":"All!T96","v":0},{"$f":"All!U96","v":0},{"$f":"All!V96","v":0},{"$f":"All!W96","v":0},{"$f":"All!X96","v":0},{"$f":"All!Y96","v":0},{"$f":"All!Z96","v":0},{"$f":"All!AA96","v":0},{"$f":"All!AB96","v":0},{"$f":"All!AC96","v":0},{"$f":"All!AD96","v":0},{"$f":"All!AE96","v":0},{"$f":"All!AF96","v":0},{"$f":"All!AG96","v":0},{"$f":"All!AH96","v":0},{"$f":"All!AI96","v":0},{"$f":"All!AJ96","v":0},{"$f":"All!AK96","v":0},{"$f":"All!AL96","v":0},{"$f":"All!AM96","v":0},{"$f":"All!AN96","v":0},{"$f":"All!AO96","v":0},{"$f":"All!AP96","v":0},{"$f":"All!AQ96","v":0},{"$f":"All!AR96","v":0},{"$f":"All!AS96","v":0},{"$f":"All!AT96","v":0}]
[null,{"$f":"All!B97","v":"2"},{"$f":"All!C97","v":"2.5"},{"$f":"All!D97","v":"2.5.3"},{"$f":"All!E97","v":""},{"$f":"All!F97","v":"2.5.3.2"},{"$f":"All!G97","v":0},{"$f":"All!H97","v":0},{"$f":"All!I97","v":"2.5.3.2.2"},{"$f":"All!J97","v":"2.5.3.2.2: If supported by financial ecosystem partners, are operator-maintained blacklists exchanged under a joint blacklisting agreement?\n"},{"$f":"All!K97","v":0},{"$f":"All!L97","v":0},{"$f":"All!M97","v":"Recommended"},{"$f":"All!N97","v":"Recommended"},{"$f":"All!O97","v":"FraudRisk"},{"$f":"All!P97","v":0},{"$f":"All!Q97","v":0},{"$f":"All!R97","v":0},{"$f":"All!S97","v":0},{"$f":"All!T97","v":0},{"$f":"All!U97","v":0},{"$f":"All!V97","v":0},{"$f":"All!W97","v":0},{"$f":"All!X97","v":0},{"$f":"All!Y97","v":0},{"$f":"All!Z97","v":0},{"$f":"All!AA97","v":0},{"$f":"All!AB97","v":0},{"$f":"All!AC97","v":0},{"$f":"All!AD97","v":0},{"$f":"All!AE97","v":0},{"$f":"All!AF97","v":0},{"$f":"All!AG97","v":0},{"$f":"All!AH97","v":0},{"$f":"All!AI97","v":0},{"$f":"All!AJ97","v":0},{"$f":"All!AK97","v":0},{"$f":"All!AL97","v":0},{"$f":"All!AM97","v":0},{"$f":"All!AN97","v":0},{"$f":"All!AO97","v":0},{"$f":"All!AP97","v":0},{"$f":"All!AQ97","v":0},{"$f":"All!AR97","v":0},{"$f":"All!AS97","v":0},{"$f":"All!AT97","v":0}]
[null,{"$f":"All!B98","v":"2"},{"$f":"All!C98","v":"2.5"},{"$f":"All!D98","v":"2.5.4"},{"$f":"All!E98","v":"2.5.4: Providers shall screen accounts using domestic and international money laundering, terrorist financing, and sanctions watch lists"},{"$f":"All!F98","v":"2.5.4.1"},{"$f":"All!G98","v":"2.5.4.1: WATCHLIST SCREENING OF ACCOUNTS\nAll accounts (including customer, agent and business accounts) should be screened against watchhlists.  Watchlists should include domestic and international money laundering, terrorist financing, Politically Exposed Persons (PEP) and sanctions watch lists. \nExamples of international watch lists that may be used include:\n- The Consolidated United Nations Security Council Sanctions List\n- OFAC (US Office of Foreign Assets Control) Specially Designated Nationals List \n- The Consolidated List of Persons, Groups and Entities subject to EU Financial Sanctions.\n\nScreening should be performed within a short period of time following account opening and it is recommended that screening is repeated regularly thereafter (frequency may vary depending upon customer risk level). \nIn case a match is found against a mandatory watchlist, the account should be immediately blocked and appropriate action taken on such accounts and their owners. \n\nA number of \"possible matches\" may be found during screening. A risk-based process should be implemented to deal with such accounts (e.g. obtaining further KYC ID and temporarily blocking of account, depending upon risk level.\n\nA regular report should be generated (and reviewed by the AML/CFT management) on the number of screening matches and possible matches and the action taken on each."},{"$f":"All!H98","v":"GSMA RMT (FR.P-09)"},{"$f":"All!I98","v":"2.5.4.1.1"},{"$f":"All!J98","v":"2.5.4.1.1: Has a documented account-screening process been implemented to ensure that all accounts (including customer, agent and business accounts) are screened against appropriate watch lists?\n"},{"$f":"All!K98","v":"1) Watchlist screening process or AML/CFT policy / process\n- Check that the provider has a documented account screening process.\n- Check that the provider has conducted and documented an assessment of which sanction lists they are required to screen against.\n\n\n\n\n"},{"$f":"All!L98","v":0},{"$f":"All!M98","v":"Standard Required"},{"$f":"All!N98","v":"Required"},{"$f":"All!O98","v":"FraudRisk"},{"$f":"All!P98","v":0},{"$f":"All!Q98","v":0},{"$f":"All!R98","v":0},{"$f":"All!S98","v":0},{"$f":"All!T98","v":0},{"$f":"All!U98","v":0},{"$f":"All!V98","v":0},{"$f":"All!W98","v":0},{"$f":"All!X98","v":0},{"$f":"All!Y98","v":0},{"$f":"All!Z98","v":0},{"$f":"All!AA98","v":0},{"$f":"All!AB98","v":0},{"$f":"All!AC98","v":0},{"$f":"All!AD98","v":0},{"$f":"All!AE98","v":0},{"$f":"All!AF98","v":0},{"$f":"All!AG98","v":0},{"$f":"All!AH98","v":0},{"$f":"All!AI98","v":0},{"$f":"All!AJ98","v":0},{"$f":"All!AK98","v":0},{"$f":"All!AL98","v":0},{"$f":"All!AM98","v":0},{"$f":"All!AN98","v":0},{"$f":"All!AO98","v":0},{"$f":"All!AP98","v":0},{"$f":"All!AQ98","v":0},{"$f":"All!AR98","v":0},{"$f":"All!AS98","v":0},{"$f":"All!AT98","v":0}]
[null,{"$f":"All!B99","v":"2"},{"$f":"All!C99","v":"2.5"},{"$f":"All!D99","v":"2.5.4"},{"$f":"All!E99","v":0},{"$f":"All!F99","v":"2.5.4.1"},{"$f":"All!G99","v":0},{"$f":"All!H99","v":0},{"$f":"All!I99","v":"2.5.4.1.2"},{"$f":"All!J99","v":"2.5.4.1.2: Does the account-screening process ensure that screening is performed within a short period of time following account opening?\n"},{"$f":"All!K99","v":"1) Watchlist screening process or AML/CFT policy / process\n- Check the timing of the screening. It should before the business relationship is established or soon thereafter.\n- Check that the provider is screening newly sanctioned entities against the customer base\n- Check that the provider is receiving regular updates of both sanctions and PEP lists"},{"$f":"All!L99","v":0},{"$f":"All!M99","v":"Standard Required"},{"$f":"All!N99","v":"Required"},{"$f":"All!O99","v":"FraudRisk"},{"$f":"All!P99","v":0},{"$f":"All!Q99","v":0},{"$f":"All!R99","v":0},{"$f":"All!S99","v":0},{"$f":"All!T99","v":0},{"$f":"All!U99","v":0},{"$f":"All!V99","v":0},{"$f":"All!W99","v":0},{"$f":"All!X99","v":0},{"$f":"All!Y99","v":0},{"$f":"All!Z99","v":0},{"$f":"All!AA99","v":0},{"$f":"All!AB99","v":0},{"$f":"All!AC99","v":0},{"$f":"All!AD99","v":0},{"$f":"All!AE99","v":0},{"$f":"All!AF99","v":0},{"$f":"All!AG99","v":0},{"$f":"All!AH99","v":0},{"$f":"All!AI99","v":0},{"$f":"All!AJ99","v":0},{"$f":"All!AK99","v":0},{"$f":"All!AL99","v":0},{"$f":"All!AM99","v":0},{"$f":"All!AN99","v":0},{"$f":"All!AO99","v":0},{"$f":"All!AP99","v":0},{"$f":"All!AQ99","v":0},{"$f":"All!AR99","v":0},{"$f":"All!AS99","v":0},{"$f":"All!AT99","v":0}]
[null,{"$f":"All!B100","v":"2"},{"$f":"All!C100","v":"2.5"},{"$f":"All!D100","v":"2.5.4"},{"$f":"All!E100","v":0},{"$f":"All!F100","v":"2.5.4.1"},{"$f":"All!G100","v":0},{"$f":"All!H100","v":0},{"$f":"All!I100","v":"2.5.4.1.3"},{"$f":"All!J100","v":"2.5.4.1.3: Does the account-screening process ensure that in case a confirmed match is found against a mandatory watchlist, the account is blocked within one day and appropriate action taken on such accounts and their owners?\n"},{"$f":"All!K100","v":"1) Watchlist screening process or AML/CFT policy / process\n- Check that the process requires any accounts that are identified as being on a mandatory lists to be blocked within one day and further appropriate actions taken.\n- Check that the process includes full documentation and rationale for decisions to block accounts.\n"},{"$f":"All!L100","v":0},{"$f":"All!M100","v":"Standard Required"},{"$f":"All!N100","v":"Required"},{"$f":"All!O100","v":"FraudRisk"},{"$f":"All!P100","v":0},{"$f":"All!Q100","v":0},{"$f":"All!R100","v":0},{"$f":"All!S100","v":0},{"$f":"All!T100","v":0},{"$f":"All!U100","v":0},{"$f":"All!V100","v":0},{"$f":"All!W100","v":0},{"$f":"All!X100","v":0},{"$f":"All!Y100","v":0},{"$f":"All!Z100","v":0},{"$f":"All!AA100","v":0},{"$f":"All!AB100","v":0},{"$f":"All!AC100","v":0},{"$f":"All!AD100","v":0},{"$f":"All!AE100","v":0},{"$f":"All!AF100","v":0},{"$f":"All!AG100","v":0},{"$f":"All!AH100","v":0},{"$f":"All!AI100","v":0},{"$f":"All!AJ100","v":0},{"$f":"All!AK100","v":0},{"$f":"All!AL100","v":0},{"$f":"All!AM100","v":0},{"$f":"All!AN100","v":0},{"$f":"All!AO100","v":0},{"$f":"All!AP100","v":0},{"$f":"All!AQ100","v":0},{"$f":"All!AR100","v":0},{"$f":"All!AS100","v":0},{"$f":"All!AT100","v":0}]
[null,{"$f":"All!B101","v":"2"},{"$f":"All!C101","v":"2.5"},{"$f":"All!D101","v":"2.5.4"},{"$f":"All!E101","v":0},{"$f":"All!F101","v":"2.5.4.1"},{"$f":"All!G101","v":0},{"$f":"All!H101","v":0},{"$f":"All!I101","v":"2.5.4.1.4"},{"$f":"All!J101","v":"2.5.4.1.4: Does the account-screening process ensure that screening is performed regularly on all customer, agent and business accounts, and following certain triggers, such as discovery of suspicious account activity or KYC issues?\n"},{"$f":"All!K101","v":0},{"$f":"All!L101","v":0},{"$f":"All!M101","v":"Recommended"},{"$f":"All!N101","v":"Recommended"},{"$f":"All!O101","v":"FraudRisk"},{"$f":"All!P101","v":0},{"$f":"All!Q101","v":0},{"$f":"All!R101","v":0},{"$f":"All!S101","v":0},{"$f":"All!T101","v":0},{"$f":"All!U101","v":0},{"$f":"All!V101","v":0},{"$f":"All!W101","v":0},{"$f":"All!X101","v":0},{"$f":"All!Y101","v":0},{"$f":"All!Z101","v":0},{"$f":"All!AA101","v":0},{"$f":"All!AB101","v":0},{"$f":"All!AC101","v":0},{"$f":"All!AD101","v":0},{"$f":"All!AE101","v":0},{"$f":"All!AF101","v":0},{"$f":"All!AG101","v":0},{"$f":"All!AH101","v":0},{"$f":"All!AI101","v":0},{"$f":"All!AJ101","v":0},{"$f":"All!AK101","v":0},{"$f":"All!AL101","v":0},{"$f":"All!AM101","v":0},{"$f":"All!AN101","v":0},{"$f":"All!AO101","v":0},{"$f":"All!AP101","v":0},{"$f":"All!AQ101","v":0},{"$f":"All!AR101","v":0},{"$f":"All!AS101","v":0},{"$f":"All!AT101","v":0}]
[null,{"$f":"All!B102","v":"2"},{"$f":"All!C102","v":"2.5"},{"$f":"All!D102","v":"2.5.4"},{"$f":"All!E102","v":0},{"$f":"All!F102","v":"2.5.4.1"},{"$f":"All!G102","v":0},{"$f":"All!H102","v":0},{"$f":"All!I102","v":"2.5.4.1.5"},{"$f":"All!J102","v":"2.5.4.1.5: Does the account-screening process specify how to deal with \"possible matches\", defining a risk-based process to deal with such accounts, including collection of further KYC ID and temporarily blocking of the account, depending upon risk level?\n"},{"$f":"All!K102","v":0},{"$f":"All!L102","v":0},{"$f":"All!M102","v":"Recommended"},{"$f":"All!N102","v":"Recommended"},{"$f":"All!O102","v":"FraudRisk"},{"$f":"All!P102","v":0},{"$f":"All!Q102","v":0},{"$f":"All!R102","v":0},{"$f":"All!S102","v":0},{"$f":"All!T102","v":0},{"$f":"All!U102","v":0},{"$f":"All!V102","v":0},{"$f":"All!W102","v":0},{"$f":"All!X102","v":0},{"$f":"All!Y102","v":0},{"$f":"All!Z102","v":0},{"$f":"All!AA102","v":0},{"$f":"All!AB102","v":0},{"$f":"All!AC102","v":0},{"$f":"All!AD102","v":0},{"$f":"All!AE102","v":0},{"$f":"All!AF102","v":0},{"$f":"All!AG102","v":0},{"$f":"All!AH102","v":0},{"$f":"All!AI102","v":0},{"$f":"All!AJ102","v":0},{"$f":"All!AK102","v":0},{"$f":"All!AL102","v":0},{"$f":"All!AM102","v":0},{"$f":"All!AN102","v":0},{"$f":"All!AO102","v":0},{"$f":"All!AP102","v":0},{"$f":"All!AQ102","v":0},{"$f":"All!AR102","v":0},{"$f":"All!AS102","v":0},{"$f":"All!AT102","v":0}]
[null,{"$f":"All!B103","v":"2"},{"$f":"All!C103","v":"2.5"},{"$f":"All!D103","v":"2.5.4"},{"$f":"All!E103","v":""},{"$f":"All!F103","v":"2.5.4.1"},{"$f":"All!G103","v":0},{"$f":"All!H103","v":0},{"$f":"All!I103","v":"2.5.4.1.6"},{"$f":"All!J103","v":"2.5.4.1.6: Is a regular report generated (and reviewed by the AML/CFT management) on the number of screening matches and possible matches and the action taken on each?\n"},{"$f":"All!K103","v":0},{"$f":"All!L103","v":0},{"$f":"All!M103","v":"Recommended"},{"$f":"All!N103","v":"Recommended"},{"$f":"All!O103","v":"FraudRisk"},{"$f":"All!P103","v":0},{"$f":"All!Q103","v":0},{"$f":"All!R103","v":0},{"$f":"All!S103","v":0},{"$f":"All!T103","v":0},{"$f":"All!U103","v":0},{"$f":"All!V103","v":0},{"$f":"All!W103","v":0},{"$f":"All!X103","v":0},{"$f":"All!Y103","v":0},{"$f":"All!Z103","v":0},{"$f":"All!AA103","v":0},{"$f":"All!AB103","v":0},{"$f":"All!AC103","v":0},{"$f":"All!AD103","v":0},{"$f":"All!AE103","v":0},{"$f":"All!AF103","v":0},{"$f":"All!AG103","v":0},{"$f":"All!AH103","v":0},{"$f":"All!AI103","v":0},{"$f":"All!AJ103","v":0},{"$f":"All!AK103","v":0},{"$f":"All!AL103","v":0},{"$f":"All!AM103","v":0},{"$f":"All!AN103","v":0},{"$f":"All!AO103","v":0},{"$f":"All!AP103","v":0},{"$f":"All!AQ103","v":0},{"$f":"All!AR103","v":0},{"$f":"All!AS103","v":0},{"$f":"All!AT103","v":0}]
[null,{"$f":"All!B104","v":"2"},{"$f":"All!C104","v":"2.6"},{"$f":"All!D104","v":"2.6.1"},{"$f":"All!E104","v":"2.6.1: Providers shall ensure that staff and agents are properly trained in AML/CFT procedures"},{"$f":"All!F104","v":"2.6.1.1"},{"$f":"All!G104","v":"2.6.1.1: AGENT TRAINING IN AML/CFT\nThe AML/CFT policy should include a requirement to train agents in AML/CFT procedures before they start operating. Provider-agent contracts should require agents to implement proper processes and to train their own staff members accordingly.\n\nAgent training should include the following (as applicable):\n- How to conduct proper KYC verification when registering new customers; and\n- Responsibility of provider and individual staff for AML/CFT compliance and suspicious transaction reporting."},{"$f":"All!H104","v":"GSMA RMT\n(AG-09)\n\nHK AML"},{"$f":"All!I104","v":"2.6.1.1.1"},{"$f":"All!J104","v":"2.6.1.1.1: Is there a policy stating that all agents must be trained in AML/CFT procedures before they start operating?\n"},{"$f":"All!K104","v":"1) Agent training plan/materials or AML/CFT training plan\n- Check that all agents receive AML training prior to their starting operating.\n"},{"$f":"All!L104","v":0},{"$f":"All!M104","v":"Urgent Required"},{"$f":"All!N104","v":"Required"},{"$f":"All!O104","v":"FraudRisk"},{"$f":"All!P104","v":0},{"$f":"All!Q104","v":0},{"$f":"All!R104","v":0},{"$f":"All!S104","v":0},{"$f":"All!T104","v":0},{"$f":"All!U104","v":0},{"$f":"All!V104","v":0},{"$f":"All!W104","v":0},{"$f":"All!X104","v":0},{"$f":"All!Y104","v":0},{"$f":"All!Z104","v":0},{"$f":"All!AA104","v":0},{"$f":"All!AB104","v":0},{"$f":"All!AC104","v":0},{"$f":"All!AD104","v":0},{"$f":"All!AE104","v":0},{"$f":"All!AF104","v":0},{"$f":"All!AG104","v":0},{"$f":"All!AH104","v":0},{"$f":"All!AI104","v":0},{"$f":"All!AJ104","v":0},{"$f":"All!AK104","v":0},{"$f":"All!AL104","v":0},{"$f":"All!AM104","v":0},{"$f":"All!AN104","v":0},{"$f":"All!AO104","v":0},{"$f":"All!AP104","v":0},{"$f":"All!AQ104","v":0},{"$f":"All!AR104","v":0},{"$f":"All!AS104","v":0},{"$f":"All!AT104","v":0}]
[null,{"$f":"All!B105","v":"2"},{"$f":"All!C105","v":"2.6"},{"$f":"All!D105","v":"2.6.1"},{"$f":"All!E105","v":0},{"$f":"All!F105","v":"2.6.1.1"},{"$f":"All!G105","v":0},{"$f":"All!H105","v":0},{"$f":"All!I105","v":"2.6.1.1.2"},{"$f":"All!J105","v":"2.6.1.1.2: Does agent training for registering agents include how to conduct proper KYC verification when registering new customers?\n"},{"$f":"All!K105","v":"1) Agent training plan/materials or AML/CFT training plan\n- Check that it contains details on what information is to be collected from the customer at registration, and how it is processed.\n- Check that it contains details on what documentation should be presented by the customer, and how it is verified by the agent."},{"$f":"All!L105","v":0},{"$f":"All!M105","v":"Urgent Required"},{"$f":"All!N105","v":"Required"},{"$f":"All!O105","v":"FraudRisk"},{"$f":"All!P105","v":0},{"$f":"All!Q105","v":0},{"$f":"All!R105","v":0},{"$f":"All!S105","v":0},{"$f":"All!T105","v":0},{"$f":"All!U105","v":0},{"$f":"All!V105","v":0},{"$f":"All!W105","v":0},{"$f":"All!X105","v":0},{"$f":"All!Y105","v":0},{"$f":"All!Z105","v":0},{"$f":"All!AA105","v":0},{"$f":"All!AB105","v":0},{"$f":"All!AC105","v":0},{"$f":"All!AD105","v":0},{"$f":"All!AE105","v":0},{"$f":"All!AF105","v":0},{"$f":"All!AG105","v":0},{"$f":"All!AH105","v":0},{"$f":"All!AI105","v":0},{"$f":"All!AJ105","v":0},{"$f":"All!AK105","v":0},{"$f":"All!AL105","v":0},{"$f":"All!AM105","v":0},{"$f":"All!AN105","v":0},{"$f":"All!AO105","v":0},{"$f":"All!AP105","v":0},{"$f":"All!AQ105","v":0},{"$f":"All!AR105","v":0},{"$f":"All!AS105","v":0},{"$f":"All!AT105","v":0}]
[null,{"$f":"All!B106","v":"2"},{"$f":"All!C106","v":"2.6"},{"$f":"All!D106","v":"2.6.1"},{"$f":"All!E106","v":0},{"$f":"All!F106","v":"2.6.1.1"},{"$f":"All!G106","v":0},{"$f":"All!H106","v":0},{"$f":"All!I106","v":"2.6.1.1.3"},{"$f":"All!J106","v":"2.6.1.1.3: Do contractual arrangements require agents to implement appropriate AML/CFT processes and to train their staff members accordingly?\n"},{"$f":"All!K106","v":"1) Standard / sample agent contract\n- Check that the agent contract requires agents to implement appropriate AML/CTF processes and to train their staff accordingly"},{"$f":"All!L106","v":0},{"$f":"All!M106","v":"Standard Required"},{"$f":"All!N106","v":"Required"},{"$f":"All!O106","v":"FraudRisk"},{"$f":"All!P106","v":0},{"$f":"All!Q106","v":0},{"$f":"All!R106","v":0},{"$f":"All!S106","v":0},{"$f":"All!T106","v":0},{"$f":"All!U106","v":0},{"$f":"All!V106","v":0},{"$f":"All!W106","v":0},{"$f":"All!X106","v":0},{"$f":"All!Y106","v":0},{"$f":"All!Z106","v":0},{"$f":"All!AA106","v":0},{"$f":"All!AB106","v":0},{"$f":"All!AC106","v":0},{"$f":"All!AD106","v":0},{"$f":"All!AE106","v":0},{"$f":"All!AF106","v":0},{"$f":"All!AG106","v":0},{"$f":"All!AH106","v":0},{"$f":"All!AI106","v":0},{"$f":"All!AJ106","v":0},{"$f":"All!AK106","v":0},{"$f":"All!AL106","v":0},{"$f":"All!AM106","v":0},{"$f":"All!AN106","v":0},{"$f":"All!AO106","v":0},{"$f":"All!AP106","v":0},{"$f":"All!AQ106","v":0},{"$f":"All!AR106","v":0},{"$f":"All!AS106","v":0},{"$f":"All!AT106","v":0}]
[null,{"$f":"All!B107","v":"2"},{"$f":"All!C107","v":"2.6"},{"$f":"All!D107","v":"2.6.1"},{"$f":"All!E107","v":0},{"$f":"All!F107","v":"2.6.1.2"},{"$f":"All!G107","v":"2.6.1.2: STAFF TRAINING IN AML/CFT\nThe AML/CFT policy should include a requirement to train relevant staff in AML/CFT procedures, and they should be provided with regular refresher training, and that training records must be kept.\n\nStaff training should include the following (as applicable):\n- Responsibility of provider and individual staff for AML/CFT compliance and suspicious transaction reporting; \n- Provider’s policies and procedures and the role of staff with respect with to these policies and procedures; \n- Relevant emerging risks and trends in ML/TF; \n- How to conduct proper KYC verification when registering new clients; \n- Proper record-keeping procedures; \n- How to identify and report suspicious activity without “tipping off”; \n- How to communicate with agents;\n- How to monitor agent compliance with AML/CFT requirements."},{"$f":"All!H107","v":"GSMA RMT (FR.O-06)\n\nHK AML"},{"$f":"All!I107","v":"2.6.1.2.1"},{"$f":"All!J107","v":"2.6.1.2.1: Is there a policy stating that relevant staff must be trained in AML/CFT procedures?\n"},{"$f":"All!K107","v":"1) Employee training plan/materials or AML/CFT training plan/materials or AML/CFT policy (or equivalent)\n- Check that there is a requirement for staff to receive AML training during the induction process. [or this could be specified in AML/CFT policy]\n"},{"$f":"All!L107","v":0},{"$f":"All!M107","v":"Urgent Required"},{"$f":"All!N107","v":"Required"},{"$f":"All!O107","v":"FraudRisk"},{"$f":"All!P107","v":0},{"$f":"All!Q107","v":0},{"$f":"All!R107","v":0},{"$f":"All!S107","v":0},{"$f":"All!T107","v":0},{"$f":"All!U107","v":0},{"$f":"All!V107","v":0},{"$f":"All!W107","v":0},{"$f":"All!X107","v":0},{"$f":"All!Y107","v":0},{"$f":"All!Z107","v":0},{"$f":"All!AA107","v":0},{"$f":"All!AB107","v":0},{"$f":"All!AC107","v":0},{"$f":"All!AD107","v":0},{"$f":"All!AE107","v":0},{"$f":"All!AF107","v":0},{"$f":"All!AG107","v":0},{"$f":"All!AH107","v":0},{"$f":"All!AI107","v":0},{"$f":"All!AJ107","v":0},{"$f":"All!AK107","v":0},{"$f":"All!AL107","v":0},{"$f":"All!AM107","v":0},{"$f":"All!AN107","v":0},{"$f":"All!AO107","v":0},{"$f":"All!AP107","v":0},{"$f":"All!AQ107","v":0},{"$f":"All!AR107","v":0},{"$f":"All!AS107","v":0},{"$f":"All!AT107","v":0}]
[null,{"$f":"All!B108","v":"2"},{"$f":"All!C108","v":"2.6"},{"$f":"All!D108","v":"2.6.1"},{"$f":"All!E108","v":0},{"$f":"All!F108","v":"2.6.1.2"},{"$f":"All!G108","v":0},{"$f":"All!H108","v":0},{"$f":"All!I108","v":"2.6.1.2.2"},{"$f":"All!J108","v":"2.6.1.2.2: Are staff tested regularly on their understanding of internal policies and procedures and legal obligations with respect to AML/CFT?\n"},{"$f":"All!K108","v":0},{"$f":"All!L108","v":0},{"$f":"All!M108","v":"Recommended"},{"$f":"All!N108","v":"Recommended"},{"$f":"All!O108","v":"FraudRisk"},{"$f":"All!P108","v":0},{"$f":"All!Q108","v":0},{"$f":"All!R108","v":0},{"$f":"All!S108","v":0},{"$f":"All!T108","v":0},{"$f":"All!U108","v":0},{"$f":"All!V108","v":0},{"$f":"All!W108","v":0},{"$f":"All!X108","v":0},{"$f":"All!Y108","v":0},{"$f":"All!Z108","v":0},{"$f":"All!AA108","v":0},{"$f":"All!AB108","v":0},{"$f":"All!AC108","v":0},{"$f":"All!AD108","v":0},{"$f":"All!AE108","v":0},{"$f":"All!AF108","v":0},{"$f":"All!AG108","v":0},{"$f":"All!AH108","v":0},{"$f":"All!AI108","v":0},{"$f":"All!AJ108","v":0},{"$f":"All!AK108","v":0},{"$f":"All!AL108","v":0},{"$f":"All!AM108","v":0},{"$f":"All!AN108","v":0},{"$f":"All!AO108","v":0},{"$f":"All!AP108","v":0},{"$f":"All!AQ108","v":0},{"$f":"All!AR108","v":0},{"$f":"All!AS108","v":0},{"$f":"All!AT108","v":0}]
[null,{"$f":"All!B109","v":"2"},{"$f":"All!C109","v":"2.6"},{"$f":"All!D109","v":"2.6.2"},{"$f":"All!E109","v":"2.6.2: Providers shall monitor staff and agent compliance with AML/CFT procedures"},{"$f":"All!F109","v":"2.6.2.1"},{"$f":"All!G109","v":"2.6.2.1: MONITORING OF AGENT AML/CFT COMPLIANCE\nMonitoring (both on-site and off-site) should be aimed at ensuring that agents (including any sub-agents) comply with all internal policies and procedures and legal obligations with respect to AML/CFT. Providers should:\n- Develop systems that allow providers to monitor agent compliance with AML/CFT requirements; \n- Ensure agents understand the AML/CFT procedures;\n- Ensure all correct KYC details and IDs are captured when registering customers;\n- Ensure identity checks are properly performed for cash-in and cash-out transactions;\n- Ensure that all required records are kept;\n- Regularly review agent compliance with AML/CFT processes; and\n- Conduct on-site reviews of agents and their AML/CFT processes."},{"$f":"All!H109","v":"HK AML\nBCBS AML\nGSMA RMT"},{"$f":"All!I109","v":"2.6.2.1.1"},{"$f":"All!J109","v":"2.6.2.1.1: Does agent monitoring ensure that all correct KYC details and IDs are captured when registering customers (if applicable)?\n"},{"$f":"All!K109","v":"1) AML/CFT policy or process documentation\n- Check that there is a process to monitor agents to ensure all that KYC details are captured correctly. \n"},{"$f":"All!L109","v":0},{"$f":"All!M109","v":"Standard Required"},{"$f":"All!N109","v":"Required"},{"$f":"All!O109","v":"FraudRisk"},{"$f":"All!P109","v":0},{"$f":"All!Q109","v":0},{"$f":"All!R109","v":0},{"$f":"All!S109","v":0},{"$f":"All!T109","v":0},{"$f":"All!U109","v":0},{"$f":"All!V109","v":0},{"$f":"All!W109","v":0},{"$f":"All!X109","v":0},{"$f":"All!Y109","v":0},{"$f":"All!Z109","v":0},{"$f":"All!AA109","v":0},{"$f":"All!AB109","v":0},{"$f":"All!AC109","v":0},{"$f":"All!AD109","v":0},{"$f":"All!AE109","v":0},{"$f":"All!AF109","v":0},{"$f":"All!AG109","v":0},{"$f":"All!AH109","v":0},{"$f":"All!AI109","v":0},{"$f":"All!AJ109","v":0},{"$f":"All!AK109","v":0},{"$f":"All!AL109","v":0},{"$f":"All!AM109","v":0},{"$f":"All!AN109","v":0},{"$f":"All!AO109","v":0},{"$f":"All!AP109","v":0},{"$f":"All!AQ109","v":0},{"$f":"All!AR109","v":0},{"$f":"All!AS109","v":0},{"$f":"All!AT109","v":0}]
[null,{"$f":"All!B110","v":"2"},{"$f":"All!C110","v":"2.6"},{"$f":"All!D110","v":"2.6.2"},{"$f":"All!E110","v":0},{"$f":"All!F110","v":"2.6.2.1"},{"$f":"All!G110","v":0},{"$f":"All!H110","v":0},{"$f":"All!I110","v":"2.6.2.1.2"},{"$f":"All!J110","v":"2.6.2.1.2: Does agent monitoring ensure that identity checks are properly performed for cash-in and cash-out transactions?\n"},{"$f":"All!K110","v":0},{"$f":"All!L110","v":0},{"$f":"All!M110","v":"Recommended"},{"$f":"All!N110","v":"Recommended"},{"$f":"All!O110","v":"FraudRisk"},{"$f":"All!P110","v":0},{"$f":"All!Q110","v":0},{"$f":"All!R110","v":0},{"$f":"All!S110","v":0},{"$f":"All!T110","v":0},{"$f":"All!U110","v":0},{"$f":"All!V110","v":0},{"$f":"All!W110","v":0},{"$f":"All!X110","v":0},{"$f":"All!Y110","v":0},{"$f":"All!Z110","v":0},{"$f":"All!AA110","v":0},{"$f":"All!AB110","v":0},{"$f":"All!AC110","v":0},{"$f":"All!AD110","v":0},{"$f":"All!AE110","v":0},{"$f":"All!AF110","v":0},{"$f":"All!AG110","v":0},{"$f":"All!AH110","v":0},{"$f":"All!AI110","v":0},{"$f":"All!AJ110","v":0},{"$f":"All!AK110","v":0},{"$f":"All!AL110","v":0},{"$f":"All!AM110","v":0},{"$f":"All!AN110","v":0},{"$f":"All!AO110","v":0},{"$f":"All!AP110","v":0},{"$f":"All!AQ110","v":0},{"$f":"All!AR110","v":0},{"$f":"All!AS110","v":0},{"$f":"All!AT110","v":0}]
[null,{"$f":"All!B111","v":"2"},{"$f":"All!C111","v":"2.6"},{"$f":"All!D111","v":"2.6.2"},{"$f":"All!E111","v":0},{"$f":"All!F111","v":"2.6.2.1"},{"$f":"All!G111","v":0},{"$f":"All!H111","v":0},{"$f":"All!I111","v":"2.6.2.1.3"},{"$f":"All!J111","v":"2.6.2.1.3: Are records kept of agent monitoring activities?\n"},{"$f":"All!K111","v":0},{"$f":"All!L111","v":0},{"$f":"All!M111","v":"Standard Required"},{"$f":"All!N111","v":"Recommended"},{"$f":"All!O111","v":"FraudRisk"},{"$f":"All!P111","v":0},{"$f":"All!Q111","v":0},{"$f":"All!R111","v":0},{"$f":"All!S111","v":0},{"$f":"All!T111","v":0},{"$f":"All!U111","v":0},{"$f":"All!V111","v":0},{"$f":"All!W111","v":0},{"$f":"All!X111","v":0},{"$f":"All!Y111","v":0},{"$f":"All!Z111","v":0},{"$f":"All!AA111","v":0},{"$f":"All!AB111","v":0},{"$f":"All!AC111","v":0},{"$f":"All!AD111","v":0},{"$f":"All!AE111","v":0},{"$f":"All!AF111","v":0},{"$f":"All!AG111","v":0},{"$f":"All!AH111","v":0},{"$f":"All!AI111","v":0},{"$f":"All!AJ111","v":0},{"$f":"All!AK111","v":0},{"$f":"All!AL111","v":0},{"$f":"All!AM111","v":0},{"$f":"All!AN111","v":0},{"$f":"All!AO111","v":0},{"$f":"All!AP111","v":0},{"$f":"All!AQ111","v":0},{"$f":"All!AR111","v":0},{"$f":"All!AS111","v":0},{"$f":"All!AT111","v":0}]
[null,{"$f":"All!B112","v":"2"},{"$f":"All!C112","v":"2.6"},{"$f":"All!D112","v":"2.6.2"},{"$f":"All!E112","v":""},{"$f":"All!F112","v":"2.6.2.2"},{"$f":"All!G112","v":"2.6.2.2: MONITORING OF STAFF AML/CFT COMPLIANCE\nRelevant staff should be monitored to ensure that they comply with AML/CFT processes. This should include:\n - KYC quality assurance (to identify erroneous  or fraudulent data that is inputted by customer service staff). \n - AML analysts (e.g. transaction monitoring / watchlist screening) should also have their work dip-tested to ensure that they are following procedures correctly.  \n - Staff who carry out agent due diligence should have samples of their work subjected to review. \n\n"},{"$f":"All!H112","v":"HK AML\nGSMA RMT"},{"$f":"All!I112","v":"2.6.2.2.1"},{"$f":"All!J112","v":"2.6.2.2.1: Are there processes to review the work of those staff who carry out KYC QA, Agent Due Diligence assurance, transaction monitoring and watchlist screening or other AML analysis?\n"},{"$f":"All!K112","v":0},{"$f":"All!L112","v":0},{"$f":"All!M112","v":"Recommended"},{"$f":"All!N112","v":"Recommended"},{"$f":"All!O112","v":"FraudRisk"},{"$f":"All!P112","v":0},{"$f":"All!Q112","v":0},{"$f":"All!R112","v":0},{"$f":"All!S112","v":0},{"$f":"All!T112","v":0},{"$f":"All!U112","v":0},{"$f":"All!V112","v":0},{"$f":"All!W112","v":0},{"$f":"All!X112","v":0},{"$f":"All!Y112","v":0},{"$f":"All!Z112","v":0},{"$f":"All!AA112","v":0},{"$f":"All!AB112","v":0},{"$f":"All!AC112","v":0},{"$f":"All!AD112","v":0},{"$f":"All!AE112","v":0},{"$f":"All!AF112","v":0},{"$f":"All!AG112","v":0},{"$f":"All!AH112","v":0},{"$f":"All!AI112","v":0},{"$f":"All!AJ112","v":0},{"$f":"All!AK112","v":0},{"$f":"All!AL112","v":0},{"$f":"All!AM112","v":0},{"$f":"All!AN112","v":0},{"$f":"All!AO112","v":0},{"$f":"All!AP112","v":0},{"$f":"All!AQ112","v":0},{"$f":"All!AR112","v":0},{"$f":"All!AS112","v":0},{"$f":"All!AT112","v":0}]
[null,{"$f":"All!B113","v":2},{"$f":"All!C113","v":2.7},{"$f":"All!D113","v":"2.7.1"},{"$f":"All!E113","v":"2.7.1: Providers shall develop risk-based policies and measures for fraud detection and prevention"},{"$f":"All!F113","v":"2.7.1.1"},{"$f":"All!G113","v":"2.7.1.1: FRAUD MANAGEMENT POLICY\nProviders should establish a mobile money fraud management policy that defines the approach to anticipating, monitoring, assessing, managing and controlling fraud. It should address the following:\n- design and implementation of the transaction monitoring system;\n- policies governing employees, agents, customers and third parties to reduce opportunities for fraud; and\n- communication with law enforcement agencies, statutory and regulatory bodies, and other key decision-makers concerning mobile money fraud."},{"$f":"All!H113","v":"ECB RSMP"},{"$f":"All!I113","v":"2.7.1.1.1"},{"$f":"All!J113","v":"2.7.1.1.1: Is there a fraud management policy that defines the approach to anticipating, monitoring, assessing, managing and controlling mobile money fraud?\n"},{"$f":"All!K113","v":"1) Fraud management policy (or equivalent documents)\n- Check the policy includes the entire fraud management lifecycle including anticipating, monitoring, assessing, managing and controlling fraud.\n- Check the policy contains specific actions relating to mobile money fraud (important if the policy is not mobile money-specific)."},{"$f":"All!L113","v":0},{"$f":"All!M113","v":"Standard Required"},{"$f":"All!N113","v":"Required"},{"$f":"All!O113","v":"FraudRisk"},{"$f":"All!P113","v":0},{"$f":"All!Q113","v":0},{"$f":"All!R113","v":0},{"$f":"All!S113","v":0},{"$f":"All!T113","v":0},{"$f":"All!U113","v":0},{"$f":"All!V113","v":0},{"$f":"All!W113","v":0},{"$f":"All!X113","v":0},{"$f":"All!Y113","v":0},{"$f":"All!Z113","v":0},{"$f":"All!AA113","v":0},{"$f":"All!AB113","v":0},{"$f":"All!AC113","v":0},{"$f":"All!AD113","v":0},{"$f":"All!AE113","v":0},{"$f":"All!AF113","v":0},{"$f":"All!AG113","v":0},{"$f":"All!AH113","v":0},{"$f":"All!AI113","v":0},{"$f":"All!AJ113","v":0},{"$f":"All!AK113","v":0},{"$f":"All!AL113","v":0},{"$f":"All!AM113","v":0},{"$f":"All!AN113","v":0},{"$f":"All!AO113","v":0},{"$f":"All!AP113","v":0},{"$f":"All!AQ113","v":0},{"$f":"All!AR113","v":0},{"$f":"All!AS113","v":0},{"$f":"All!AT113","v":0}]
[null,{"$f":"All!B114","v":2},{"$f":"All!C114","v":2.7},{"$f":"All!D114","v":"2.7.1"},{"$f":"All!E114","v":""},{"$f":"All!F114","v":"2.7.1.2"},{"$f":"All!G114","v":"2.7.1.2: ANTI-FRAUD TRAINING\nMuch anti-fraud training is covered by AML/CFT and KYC training (see 2.6). Additional anti-fraud training should be implemented for staff and agents, which should include:\n- awareness of common frauds, including provider risks, agent risks and customer risks (e.g. social engineering);\n- specific processes that are designed to counter fraud; and\n- how to report suspicious activity (employees and agents should be mandated to report fraud or suspected fraud);\n- how to report fraud.\n\nThe channel for reporting fraud reporting could be the same as used for reporting suspected ML/TF, security incidents and data privacy breaches."},{"$f":"All!H114","v":"GSMA RMT"},{"$f":"All!I114","v":"2.7.1.2.1"},{"$f":"All!J114","v":"2.7.1.2.1: Is there a staff training programme that addresses fraud management and fraud awareness, including provider risks, agent risks and customer risks (e.g. social engineering) and anti-fraud processes?\n"},{"$f":"All!K114","v":"1) Employee training plan / materials\n- Check that the training plan / materials includes training staff in fraud management and fraud awareness.\n- Check that the training plan / materials includes details on provider, agent and customer risk.\n- Check that the training plan / materials includes details on anti-fraud processes."},{"$f":"All!L114","v":0},{"$f":"All!M114","v":"Standard Required"},{"$f":"All!N114","v":"Required"},{"$f":"All!O114","v":"FraudRisk"},{"$f":"All!P114","v":0},{"$f":"All!Q114","v":0},{"$f":"All!R114","v":0},{"$f":"All!S114","v":0},{"$f":"All!T114","v":0},{"$f":"All!U114","v":0},{"$f":"All!V114","v":0},{"$f":"All!W114","v":0},{"$f":"All!X114","v":0},{"$f":"All!Y114","v":0},{"$f":"All!Z114","v":0},{"$f":"All!AA114","v":0},{"$f":"All!AB114","v":0},{"$f":"All!AC114","v":0},{"$f":"All!AD114","v":0},{"$f":"All!AE114","v":0},{"$f":"All!AF114","v":0},{"$f":"All!AG114","v":0},{"$f":"All!AH114","v":0},{"$f":"All!AI114","v":0},{"$f":"All!AJ114","v":0},{"$f":"All!AK114","v":0},{"$f":"All!AL114","v":0},{"$f":"All!AM114","v":0},{"$f":"All!AN114","v":0},{"$f":"All!AO114","v":0},{"$f":"All!AP114","v":0},{"$f":"All!AQ114","v":0},{"$f":"All!AR114","v":0},{"$f":"All!AS114","v":0},{"$f":"All!AT114","v":0}]
[null,{"$f":"All!B115","v":2},{"$f":"All!C115","v":2.7},{"$f":"All!D115","v":"2.7.1"},{"$f":"All!E115","v":0},{"$f":"All!F115","v":"2.7.1.2"},{"$f":"All!G115","v":0},{"$f":"All!H115","v":0},{"$f":"All!I115","v":"2.7.1.2.2"},{"$f":"All!J115","v":"2.7.1.2.2: Are agents trained in anti-fraud measures, such as being aware of common frauds, identity checking, and social engineering, and how to report fraud?\n[The channel for reporting fraud reporting could be the same as used for reporting suspected ML/TF, security incidents and data privacy breaches]\n"},{"$f":"All!K115","v":"1) Agent training plan / materials\n- Check content of agent training includes fraud education. For example, details of common frauds, identity checking and social engineering, and how to report fraud."},{"$f":"All!L115","v":0},{"$f":"All!M115","v":"Standard Required"},{"$f":"All!N115","v":"Required"},{"$f":"All!O115","v":"FraudRisk"},{"$f":"All!P115","v":0},{"$f":"All!Q115","v":0},{"$f":"All!R115","v":0},{"$f":"All!S115","v":0},{"$f":"All!T115","v":0},{"$f":"All!U115","v":0},{"$f":"All!V115","v":0},{"$f":"All!W115","v":0},{"$f":"All!X115","v":0},{"$f":"All!Y115","v":0},{"$f":"All!Z115","v":0},{"$f":"All!AA115","v":0},{"$f":"All!AB115","v":0},{"$f":"All!AC115","v":0},{"$f":"All!AD115","v":0},{"$f":"All!AE115","v":0},{"$f":"All!AF115","v":0},{"$f":"All!AG115","v":0},{"$f":"All!AH115","v":0},{"$f":"All!AI115","v":0},{"$f":"All!AJ115","v":0},{"$f":"All!AK115","v":0},{"$f":"All!AL115","v":0},{"$f":"All!AM115","v":0},{"$f":"All!AN115","v":0},{"$f":"All!AO115","v":0},{"$f":"All!AP115","v":0},{"$f":"All!AQ115","v":0},{"$f":"All!AR115","v":0},{"$f":"All!AS115","v":0},{"$f":"All!AT115","v":0}]
[null,{"$f":"All!B116","v":2},{"$f":"All!C116","v":2.7},{"$f":"All!D116","v":"2.7.1"},{"$f":"All!E116","v":""},{"$f":"All!F116","v":"2.7.1.2"},{"$f":"All!G116","v":0},{"$f":"All!H116","v":0},{"$f":"All!I116","v":"2.7.1.2.3"},{"$f":"All!J116","v":"2.7.1.2.3: Are employees and agents mandated to report fraud or suspected fraud, and trained in how to report suspicious activity?\n"},{"$f":"All!K116","v":0},{"$f":"All!L116","v":0},{"$f":"All!M116","v":"Recommended"},{"$f":"All!N116","v":"Recommended"},{"$f":"All!O116","v":"FraudRisk"},{"$f":"All!P116","v":0},{"$f":"All!Q116","v":0},{"$f":"All!R116","v":0},{"$f":"All!S116","v":0},{"$f":"All!T116","v":0},{"$f":"All!U116","v":0},{"$f":"All!V116","v":0},{"$f":"All!W116","v":0},{"$f":"All!X116","v":0},{"$f":"All!Y116","v":0},{"$f":"All!Z116","v":0},{"$f":"All!AA116","v":0},{"$f":"All!AB116","v":0},{"$f":"All!AC116","v":0},{"$f":"All!AD116","v":0},{"$f":"All!AE116","v":0},{"$f":"All!AF116","v":0},{"$f":"All!AG116","v":0},{"$f":"All!AH116","v":0},{"$f":"All!AI116","v":0},{"$f":"All!AJ116","v":0},{"$f":"All!AK116","v":0},{"$f":"All!AL116","v":0},{"$f":"All!AM116","v":0},{"$f":"All!AN116","v":0},{"$f":"All!AO116","v":0},{"$f":"All!AP116","v":0},{"$f":"All!AQ116","v":0},{"$f":"All!AR116","v":0},{"$f":"All!AS116","v":0},{"$f":"All!AT116","v":0}]
[null,{"$f":"All!B117","v":2},{"$f":"All!C117","v":2.7},{"$f":"All!D117","v":"2.7.1"},{"$f":"All!E117","v":""},{"$f":"All!F117","v":"2.7.1.3"},{"$f":"All!G117","v":"2.7.1.3: NOTIFICATIONS TO CUSTOMERS AND AGENTS\nProviders should send notifications to customers and agents whenever activity occurs on their account so that the user can verify it. This should include:\n- success or failure of all transactions;\n- change of security credentials (e.g., PIN replacement); and\n- change of personal information.\n\nTransaction confirmation messages should be sent to both the customer and the agent for cash-in and cash-out transactions.\n"},{"$f":"All!H117","v":"GSMA RMT"},{"$f":"All!I117","v":"2.7.1.3.1"},{"$f":"All!J117","v":"2.7.1.3.1: Are all mobile money users notified of the success or failure of all transactions?\n"},{"$f":"All!K117","v":"1) MM system functional specification \n- Check that notifications are sent to the customer of all transactions on their account, including transactions that have failed. [Could be evidenced by a demonstration of system]"},{"$f":"All!L117","v":0},{"$f":"All!M117","v":"Urgent Required"},{"$f":"All!N117","v":"Required"},{"$f":"All!O117","v":"FraudRisk"},{"$f":"All!P117","v":0},{"$f":"All!Q117","v":0},{"$f":"All!R117","v":0},{"$f":"All!S117","v":0},{"$f":"All!T117","v":0},{"$f":"All!U117","v":0},{"$f":"All!V117","v":0},{"$f":"All!W117","v":0},{"$f":"All!X117","v":0},{"$f":"All!Y117","v":0},{"$f":"All!Z117","v":0},{"$f":"All!AA117","v":0},{"$f":"All!AB117","v":0},{"$f":"All!AC117","v":0},{"$f":"All!AD117","v":0},{"$f":"All!AE117","v":0},{"$f":"All!AF117","v":0},{"$f":"All!AG117","v":0},{"$f":"All!AH117","v":0},{"$f":"All!AI117","v":0},{"$f":"All!AJ117","v":0},{"$f":"All!AK117","v":0},{"$f":"All!AL117","v":0},{"$f":"All!AM117","v":0},{"$f":"All!AN117","v":0},{"$f":"All!AO117","v":0},{"$f":"All!AP117","v":0},{"$f":"All!AQ117","v":0},{"$f":"All!AR117","v":0},{"$f":"All!AS117","v":0},{"$f":"All!AT117","v":0}]
[null,{"$f":"All!B118","v":2},{"$f":"All!C118","v":2.7},{"$f":"All!D118","v":"2.7.1"},{"$f":"All!E118","v":""},{"$f":"All!F118","v":"2.7.1.3"},{"$f":"All!G118","v":0},{"$f":"All!H118","v":0},{"$f":"All!I118","v":"2.7.1.3.2"},{"$f":"All!J118","v":"2.7.1.3.2: Are transaction confirmation messages sent to both the customer and the agent for cash-in and cash-out transactions?\n"},{"$f":"All!K118","v":"1) The MM system functional specification that relates to transactions, product description or customer journey description\n- Check that confirmation messages are sent to both customer and agent for cash-in/out transactions. [Could be evidenced by a demonstration of system]"},{"$f":"All!L118","v":0},{"$f":"All!M118","v":"Standard Required"},{"$f":"All!N118","v":"Required"},{"$f":"All!O118","v":"FraudRisk"},{"$f":"All!P118","v":0},{"$f":"All!Q118","v":0},{"$f":"All!R118","v":0},{"$f":"All!S118","v":0},{"$f":"All!T118","v":0},{"$f":"All!U118","v":0},{"$f":"All!V118","v":0},{"$f":"All!W118","v":0},{"$f":"All!X118","v":0},{"$f":"All!Y118","v":0},{"$f":"All!Z118","v":0},{"$f":"All!AA118","v":0},{"$f":"All!AB118","v":0},{"$f":"All!AC118","v":0},{"$f":"All!AD118","v":0},{"$f":"All!AE118","v":0},{"$f":"All!AF118","v":0},{"$f":"All!AG118","v":0},{"$f":"All!AH118","v":0},{"$f":"All!AI118","v":0},{"$f":"All!AJ118","v":0},{"$f":"All!AK118","v":0},{"$f":"All!AL118","v":0},{"$f":"All!AM118","v":0},{"$f":"All!AN118","v":0},{"$f":"All!AO118","v":0},{"$f":"All!AP118","v":0},{"$f":"All!AQ118","v":0},{"$f":"All!AR118","v":0},{"$f":"All!AS118","v":0},{"$f":"All!AT118","v":0}]
[null,{"$f":"All!B119","v":2},{"$f":"All!C119","v":2.7},{"$f":"All!D119","v":"2.7.1"},{"$f":"All!E119","v":""},{"$f":"All!F119","v":"2.7.1.3"},{"$f":"All!G119","v":0},{"$f":"All!H119","v":0},{"$f":"All!I119","v":"2.7.1.3.3"},{"$f":"All!J119","v":"2.7.1.3.3: Are mobile money account holders notified of key events such as change of security credentials (e.g. PIN replacement) and change of personal information?\n"},{"$f":"All!K119","v":"1) MM system functional specification \n- Check that notifications are sent to the customer of all changes on their account, including changes to security credentials and personal information. [Could be evidenced by a demonstration of system]"},{"$f":"All!L119","v":0},{"$f":"All!M119","v":"Urgent Required"},{"$f":"All!N119","v":"Required"},{"$f":"All!O119","v":"FraudRisk"},{"$f":"All!P119","v":0},{"$f":"All!Q119","v":0},{"$f":"All!R119","v":0},{"$f":"All!S119","v":0},{"$f":"All!T119","v":0},{"$f":"All!U119","v":0},{"$f":"All!V119","v":0},{"$f":"All!W119","v":0},{"$f":"All!X119","v":0},{"$f":"All!Y119","v":0},{"$f":"All!Z119","v":0},{"$f":"All!AA119","v":0},{"$f":"All!AB119","v":0},{"$f":"All!AC119","v":0},{"$f":"All!AD119","v":0},{"$f":"All!AE119","v":0},{"$f":"All!AF119","v":0},{"$f":"All!AG119","v":0},{"$f":"All!AH119","v":0},{"$f":"All!AI119","v":0},{"$f":"All!AJ119","v":0},{"$f":"All!AK119","v":0},{"$f":"All!AL119","v":0},{"$f":"All!AM119","v":0},{"$f":"All!AN119","v":0},{"$f":"All!AO119","v":0},{"$f":"All!AP119","v":0},{"$f":"All!AQ119","v":0},{"$f":"All!AR119","v":0},{"$f":"All!AS119","v":0},{"$f":"All!AT119","v":0}]
[null,{"$f":"All!B120","v":2},{"$f":"All!C120","v":2.7},{"$f":"All!D120","v":"2.7.1"},{"$f":"All!E120","v":""},{"$f":"All!F120","v":"2.7.1.4"},{"$f":"All!G120","v":"2.7.1.4: SECURE CHANGING OF SECURITY CREDENTIALS AND SIMS\nSIM swaps and PIN changes are particularly susceptible to fraud. Impersonation fraud and employee frauds are common.\n\nControls should be implemented to protect SIM swaps against impersonation fraud. Examples of protections include:\n - Requiring customer to present ID documentation to do SIM swap;\n - Preventing customer from using mobile money or USSD for 48 hours.\n\nAgent SIM swaps should be prohibited or strictly controlled. \n\nStrict controls shouold be enforced on staff that perform PIN changes, such as maker-checker, or restriction by roles, or monitoring of the PIN-change staff.\n\nRisk-based monitoring should be done on SIM swaps and change of PINs. High-risk accounts should be particularly monitored (e.g. airtime collection account, e-money disbursement/collection accounts, and high-value accounts)."},{"$f":"All!H120","v":"GSMA RMT"},{"$f":"All!I120","v":"2.7.1.4.1"},{"$f":"All!J120","v":"2.7.1.4.1: Have controls been implemented to protect SIM swaps against impersonation fraud?\n"},{"$f":"All!K120","v":"1) SIM swap process / fraud management policy (or equivalent documents)\n- Check that controls have been implemented to protect SIM swaps against impersonation fraud. Examples of protections include requiring customer to present ID documentation to or preventing customer from using mobile money or USSD for 48 hours. Other approaches may be acceptable.\n"},{"$f":"All!L120","v":0},{"$f":"All!M120","v":"Urgent Required"},{"$f":"All!N120","v":"Required"},{"$f":"All!O120","v":"FraudRisk"},{"$f":"All!P120","v":0},{"$f":"All!Q120","v":0},{"$f":"All!R120","v":0},{"$f":"All!S120","v":0},{"$f":"All!T120","v":0},{"$f":"All!U120","v":0},{"$f":"All!V120","v":0},{"$f":"All!W120","v":0},{"$f":"All!X120","v":0},{"$f":"All!Y120","v":0},{"$f":"All!Z120","v":0},{"$f":"All!AA120","v":0},{"$f":"All!AB120","v":0},{"$f":"All!AC120","v":0},{"$f":"All!AD120","v":0},{"$f":"All!AE120","v":0},{"$f":"All!AF120","v":0},{"$f":"All!AG120","v":0},{"$f":"All!AH120","v":0},{"$f":"All!AI120","v":0},{"$f":"All!AJ120","v":0},{"$f":"All!AK120","v":0},{"$f":"All!AL120","v":0},{"$f":"All!AM120","v":0},{"$f":"All!AN120","v":0},{"$f":"All!AO120","v":0},{"$f":"All!AP120","v":0},{"$f":"All!AQ120","v":0},{"$f":"All!AR120","v":0},{"$f":"All!AS120","v":0},{"$f":"All!AT120","v":0}]
[null,{"$f":"All!B121","v":2},{"$f":"All!C121","v":2.7},{"$f":"All!D121","v":"2.7.1"},{"$f":"All!E121","v":""},{"$f":"All!F121","v":"2.7.1.4"},{"$f":"All!G121","v":0},{"$f":"All!H121","v":0},{"$f":"All!I121","v":"2.7.1.4.2"},{"$f":"All!J121","v":"2.7.1.4.2: Are Agent SIM swaps prohibited or strictly controlled?\n"},{"$f":"All!K121","v":"1) SIM swap process / fraud management policy (or equivalent documents)\n- Check that there are controls in place to strictly control or prohibit Agent SIM swaps.\n\n"},{"$f":"All!L121","v":0},{"$f":"All!M121","v":"Standard Required"},{"$f":"All!N121","v":"Required"},{"$f":"All!O121","v":"FraudRisk"},{"$f":"All!P121","v":0},{"$f":"All!Q121","v":0},{"$f":"All!R121","v":0},{"$f":"All!S121","v":0},{"$f":"All!T121","v":0},{"$f":"All!U121","v":0},{"$f":"All!V121","v":0},{"$f":"All!W121","v":0},{"$f":"All!X121","v":0},{"$f":"All!Y121","v":0},{"$f":"All!Z121","v":0},{"$f":"All!AA121","v":0},{"$f":"All!AB121","v":0},{"$f":"All!AC121","v":0},{"$f":"All!AD121","v":0},{"$f":"All!AE121","v":0},{"$f":"All!AF121","v":0},{"$f":"All!AG121","v":0},{"$f":"All!AH121","v":0},{"$f":"All!AI121","v":0},{"$f":"All!AJ121","v":0},{"$f":"All!AK121","v":0},{"$f":"All!AL121","v":0},{"$f":"All!AM121","v":0},{"$f":"All!AN121","v":0},{"$f":"All!AO121","v":0},{"$f":"All!AP121","v":0},{"$f":"All!AQ121","v":0},{"$f":"All!AR121","v":0},{"$f":"All!AS121","v":0},{"$f":"All!AT121","v":0}]
[null,{"$f":"All!B122","v":2},{"$f":"All!C122","v":2.7},{"$f":"All!D122","v":"2.7.1"},{"$f":"All!E122","v":""},{"$f":"All!F122","v":"2.7.1.4"},{"$f":"All!G122","v":0},{"$f":"All!H122","v":0},{"$f":"All!I122","v":"2.7.1.4.3"},{"$f":"All!J122","v":"2.7.1.4.3: Are strict controls enforced on staff that perform PIN changes \ne.g. maker-checker, or restriction by roles, or monitoring of the PIN-change staff.\n"},{"$f":"All!K122","v":"1) PIN change process / fraud management policy (or equivalent documents)\n- Check that strict controls are enforced on staff that perform PIN changes e.g. maker-checker, or restriction by roles, or monitoring of the PIN-change staff.\n"},{"$f":"All!L122","v":0},{"$f":"All!M122","v":"Urgent Required"},{"$f":"All!N122","v":"Required"},{"$f":"All!O122","v":"FraudRisk"},{"$f":"All!P122","v":0},{"$f":"All!Q122","v":0},{"$f":"All!R122","v":0},{"$f":"All!S122","v":0},{"$f":"All!T122","v":0},{"$f":"All!U122","v":0},{"$f":"All!V122","v":0},{"$f":"All!W122","v":0},{"$f":"All!X122","v":0},{"$f":"All!Y122","v":0},{"$f":"All!Z122","v":0},{"$f":"All!AA122","v":0},{"$f":"All!AB122","v":0},{"$f":"All!AC122","v":0},{"$f":"All!AD122","v":0},{"$f":"All!AE122","v":0},{"$f":"All!AF122","v":0},{"$f":"All!AG122","v":0},{"$f":"All!AH122","v":0},{"$f":"All!AI122","v":0},{"$f":"All!AJ122","v":0},{"$f":"All!AK122","v":0},{"$f":"All!AL122","v":0},{"$f":"All!AM122","v":0},{"$f":"All!AN122","v":0},{"$f":"All!AO122","v":0},{"$f":"All!AP122","v":0},{"$f":"All!AQ122","v":0},{"$f":"All!AR122","v":0},{"$f":"All!AS122","v":0},{"$f":"All!AT122","v":0}]
[null,{"$f":"All!B123","v":2},{"$f":"All!C123","v":2.7},{"$f":"All!D123","v":"2.7.1"},{"$f":"All!E123","v":""},{"$f":"All!F123","v":"2.7.1.4"},{"$f":"All!G123","v":0},{"$f":"All!H123","v":0},{"$f":"All!I123","v":"2.7.1.4.4"},{"$f":"All!J123","v":"2.7.1.4.4: Is risk-based monitoring done on SIM swaps and change of PINs, particularly on higher-risk accounts?\n"},{"$f":"All!K123","v":"1) Monitoring / logging / audit trail specification and/or SIM swap and PIN change report \n- Check that monitoring is done on SIM swaps and change of PINs."},{"$f":"All!L123","v":0},{"$f":"All!M123","v":"Standard Required"},{"$f":"All!N123","v":"Required"},{"$f":"All!O123","v":"FraudRisk"},{"$f":"All!P123","v":0},{"$f":"All!Q123","v":0},{"$f":"All!R123","v":0},{"$f":"All!S123","v":0},{"$f":"All!T123","v":0},{"$f":"All!U123","v":0},{"$f":"All!V123","v":0},{"$f":"All!W123","v":0},{"$f":"All!X123","v":0},{"$f":"All!Y123","v":0},{"$f":"All!Z123","v":0},{"$f":"All!AA123","v":0},{"$f":"All!AB123","v":0},{"$f":"All!AC123","v":0},{"$f":"All!AD123","v":0},{"$f":"All!AE123","v":0},{"$f":"All!AF123","v":0},{"$f":"All!AG123","v":0},{"$f":"All!AH123","v":0},{"$f":"All!AI123","v":0},{"$f":"All!AJ123","v":0},{"$f":"All!AK123","v":0},{"$f":"All!AL123","v":0},{"$f":"All!AM123","v":0},{"$f":"All!AN123","v":0},{"$f":"All!AO123","v":0},{"$f":"All!AP123","v":0},{"$f":"All!AQ123","v":0},{"$f":"All!AR123","v":0},{"$f":"All!AS123","v":0},{"$f":"All!AT123","v":0}]
[null,{"$f":"All!B124","v":2},{"$f":"All!C124","v":2.7},{"$f":"All!D124","v":"2.7.1"},{"$f":"All!E124","v":""},{"$f":"All!F124","v":"2.7.1.5"},{"$f":"All!G124","v":"2.7.1.5: TRANSACTION AUTHORIZATION - BUYING GOODS AT MERCHANTS\nCustomer security credentials (e.g., PINs) should not be entered on any system that is not controlled by the provider or its trusted partners, including Point of Sale (PoS) devices and websites. Instead, the mobile money system should use another mechanism to authenticate customer transactions initiated on PoS devices or websites. If a customer-generated voucher (one-time code) is used, it should:\n- have a short validity period;\n- be specific to a merchant (or merchant chain);\n- be valid only up to a defined amount.\n\nThese controls limit the risk of the voucher being obtained by an unauthorized party and misused."},{"$f":"All!H124","v":"GSMA RMT"},{"$f":"All!I124","v":"2.7.1.5.1"},{"$f":"All!J124","v":"2.7.1.5.1: Are merchant transactions designed such that customers do not have to enter their PIN or other security credentials on Point of Sale (PoS) devices or websites that are not controlled by the provider or its trusted partners?\n"},{"$f":"All!K124","v":"1) MM system functional specification and / or demonstration of system\n- Check the system specification to verify customers do not enter security details on any merchant point of sale device, website or any other device not controlled by the provider or its trusted partner."},{"$f":"All!L124","v":0},{"$f":"All!M124","v":"Standard Required"},{"$f":"All!N124","v":"Required"},{"$f":"All!O124","v":"FraudRisk"},{"$f":"All!P124","v":0},{"$f":"All!Q124","v":0},{"$f":"All!R124","v":0},{"$f":"All!S124","v":0},{"$f":"All!T124","v":0},{"$f":"All!U124","v":0},{"$f":"All!V124","v":0},{"$f":"All!W124","v":0},{"$f":"All!X124","v":0},{"$f":"All!Y124","v":0},{"$f":"All!Z124","v":0},{"$f":"All!AA124","v":0},{"$f":"All!AB124","v":0},{"$f":"All!AC124","v":0},{"$f":"All!AD124","v":0},{"$f":"All!AE124","v":0},{"$f":"All!AF124","v":0},{"$f":"All!AG124","v":0},{"$f":"All!AH124","v":0},{"$f":"All!AI124","v":0},{"$f":"All!AJ124","v":0},{"$f":"All!AK124","v":0},{"$f":"All!AL124","v":0},{"$f":"All!AM124","v":0},{"$f":"All!AN124","v":0},{"$f":"All!AO124","v":0},{"$f":"All!AP124","v":0},{"$f":"All!AQ124","v":0},{"$f":"All!AR124","v":0},{"$f":"All!AS124","v":0},{"$f":"All!AT124","v":0}]
[null,{"$f":"All!B125","v":2},{"$f":"All!C125","v":2.7},{"$f":"All!D125","v":"2.7.1"},{"$f":"All!E125","v":""},{"$f":"All!F125","v":"2.7.1.5"},{"$f":"All!G125","v":0},{"$f":"All!H125","v":0},{"$f":"All!I125","v":"2.7.1.5.2"},{"$f":"All!J125","v":"2.7.1.5.2: If customer-generated vouchers (one-time codes) are used for merchant payments on PoS devices or websites, are they:\n - restricted with a short validity period?\n - specific to the merchant (or merchant chain)?\n - valid only up to a defined amount?\n"},{"$f":"All!K125","v":0},{"$f":"All!L125","v":0},{"$f":"All!M125","v":"Recommended"},{"$f":"All!N125","v":"Recommended"},{"$f":"All!O125","v":"FraudRisk"},{"$f":"All!P125","v":0},{"$f":"All!Q125","v":0},{"$f":"All!R125","v":0},{"$f":"All!S125","v":0},{"$f":"All!T125","v":0},{"$f":"All!U125","v":0},{"$f":"All!V125","v":0},{"$f":"All!W125","v":0},{"$f":"All!X125","v":0},{"$f":"All!Y125","v":0},{"$f":"All!Z125","v":0},{"$f":"All!AA125","v":0},{"$f":"All!AB125","v":0},{"$f":"All!AC125","v":0},{"$f":"All!AD125","v":0},{"$f":"All!AE125","v":0},{"$f":"All!AF125","v":0},{"$f":"All!AG125","v":0},{"$f":"All!AH125","v":0},{"$f":"All!AI125","v":0},{"$f":"All!AJ125","v":0},{"$f":"All!AK125","v":0},{"$f":"All!AL125","v":0},{"$f":"All!AM125","v":0},{"$f":"All!AN125","v":0},{"$f":"All!AO125","v":0},{"$f":"All!AP125","v":0},{"$f":"All!AQ125","v":0},{"$f":"All!AR125","v":0},{"$f":"All!AS125","v":0},{"$f":"All!AT125","v":0}]
[null,{"$f":"All!B126","v":2},{"$f":"All!C126","v":2.7},{"$f":"All!D126","v":"2.7.1"},{"$f":"All!E126","v":""},{"$f":"All!F126","v":"2.7.1.6"},{"$f":"All!G126","v":"2.7.1.6: DIRECT DEPOSITS\nA direct deposit is a cash-in into a remote account to fraudulently bypass the P2P charge. This is a major source of revenue leakage for many providers. \nProviders should implement controls to prevent or reduce direct deposits, including:\n- \"soft\" controls i.e. education of agents to conduct identity checks of the customer to prevent direct deposits, and penalties for agents that fail to do so; and\n- \"hard\" controls i.e. technical changes to ensure that the sender handset is present at cash-in."},{"$f":"All!H126","v":"GSMA RMT"},{"$f":"All!I126","v":"2.7.1.6.1"},{"$f":"All!J126","v":"2.7.1.6.1: Are controls implemented to prevent or reduce direct deposit fraud, where controls could include soft controls (agent processes) or hard controls (technical changes)?\n"},{"$f":"All!K126","v":0},{"$f":"All!L126","v":0},{"$f":"All!M126","v":"Recommended"},{"$f":"All!N126","v":"Recommended"},{"$f":"All!O126","v":"FraudRisk"},{"$f":"All!P126","v":0},{"$f":"All!Q126","v":0},{"$f":"All!R126","v":0},{"$f":"All!S126","v":0},{"$f":"All!T126","v":0},{"$f":"All!U126","v":0},{"$f":"All!V126","v":0},{"$f":"All!W126","v":0},{"$f":"All!X126","v":0},{"$f":"All!Y126","v":0},{"$f":"All!Z126","v":0},{"$f":"All!AA126","v":0},{"$f":"All!AB126","v":0},{"$f":"All!AC126","v":0},{"$f":"All!AD126","v":0},{"$f":"All!AE126","v":0},{"$f":"All!AF126","v":0},{"$f":"All!AG126","v":0},{"$f":"All!AH126","v":0},{"$f":"All!AI126","v":0},{"$f":"All!AJ126","v":0},{"$f":"All!AK126","v":0},{"$f":"All!AL126","v":0},{"$f":"All!AM126","v":0},{"$f":"All!AN126","v":0},{"$f":"All!AO126","v":0},{"$f":"All!AP126","v":0},{"$f":"All!AQ126","v":0},{"$f":"All!AR126","v":0},{"$f":"All!AS126","v":0},{"$f":"All!AT126","v":0}]
[null,{"$f":"All!B127","v":2},{"$f":"All!C127","v":2.7},{"$f":"All!D127","v":"2.7.1"},{"$f":"All!E127","v":""},{"$f":"All!F127","v":"2.7.1.7"},{"$f":"All!G127","v":"2.7.1.7: AGENT ANTI-FRAUD MEASURES\nProviders should ensure that agents cannot provide services outside the expected geographical area of their activities, as this may indicate fraudulent activity - for example, agent SIMs have been found operating illegal international money transfer from another country or used in prisons. The following controls should be implemented:\n- Providers should use location tracking of agent SIMs to identify agents that are operating outside their normal area;\n- Providers should disable roaming on agent handsets.\n\nProviders should introduce SMS restrictions so that agent SIMs can only receive SMSs from the mobile money system. This can prevent spoof SMSs from being sent to agents for false cash-outs.\n\nProviders should reconcile transaction and commissions data to detect commissions fraud, such as agents parcelling large transactions into smaller ones to earn larger commissions."},{"$f":"All!H127","v":"GSMA RMT"},{"$f":"All!I127","v":"2.7.1.7.1"},{"$f":"All!J127","v":"2.7.1.7.1: Is the location of agents being tracked to prevent agents from operating outside their normal area?\n"},{"$f":"All!K127","v":0},{"$f":"All!L127","v":0},{"$f":"All!M127","v":"Recommended"},{"$f":"All!N127","v":"Recommended"},{"$f":"All!O127","v":"FraudRisk"},{"$f":"All!P127","v":0},{"$f":"All!Q127","v":0},{"$f":"All!R127","v":0},{"$f":"All!S127","v":0},{"$f":"All!T127","v":0},{"$f":"All!U127","v":0},{"$f":"All!V127","v":0},{"$f":"All!W127","v":0},{"$f":"All!X127","v":0},{"$f":"All!Y127","v":0},{"$f":"All!Z127","v":0},{"$f":"All!AA127","v":0},{"$f":"All!AB127","v":0},{"$f":"All!AC127","v":0},{"$f":"All!AD127","v":0},{"$f":"All!AE127","v":0},{"$f":"All!AF127","v":0},{"$f":"All!AG127","v":0},{"$f":"All!AH127","v":0},{"$f":"All!AI127","v":0},{"$f":"All!AJ127","v":0},{"$f":"All!AK127","v":0},{"$f":"All!AL127","v":0},{"$f":"All!AM127","v":0},{"$f":"All!AN127","v":0},{"$f":"All!AO127","v":0},{"$f":"All!AP127","v":0},{"$f":"All!AQ127","v":0},{"$f":"All!AR127","v":0},{"$f":"All!AS127","v":0},{"$f":"All!AT127","v":0}]
[null,{"$f":"All!B128","v":2},{"$f":"All!C128","v":2.7},{"$f":"All!D128","v":"2.7.1"},{"$f":"All!E128","v":""},{"$f":"All!F128","v":"2.7.1.7"},{"$f":"All!G128","v":0},{"$f":"All!H128","v":0},{"$f":"All!I128","v":"2.7.1.7.2"},{"$f":"All!J128","v":"2.7.1.7.2: Is roaming disabled on agent handsets?\n"},{"$f":"All!K128","v":0},{"$f":"All!L128","v":0},{"$f":"All!M128","v":"Recommended"},{"$f":"All!N128","v":"Recommended"},{"$f":"All!O128","v":"FraudRisk"},{"$f":"All!P128","v":0},{"$f":"All!Q128","v":0},{"$f":"All!R128","v":0},{"$f":"All!S128","v":0},{"$f":"All!T128","v":0},{"$f":"All!U128","v":0},{"$f":"All!V128","v":0},{"$f":"All!W128","v":0},{"$f":"All!X128","v":0},{"$f":"All!Y128","v":0},{"$f":"All!Z128","v":0},{"$f":"All!AA128","v":0},{"$f":"All!AB128","v":0},{"$f":"All!AC128","v":0},{"$f":"All!AD128","v":0},{"$f":"All!AE128","v":0},{"$f":"All!AF128","v":0},{"$f":"All!AG128","v":0},{"$f":"All!AH128","v":0},{"$f":"All!AI128","v":0},{"$f":"All!AJ128","v":0},{"$f":"All!AK128","v":0},{"$f":"All!AL128","v":0},{"$f":"All!AM128","v":0},{"$f":"All!AN128","v":0},{"$f":"All!AO128","v":0},{"$f":"All!AP128","v":0},{"$f":"All!AQ128","v":0},{"$f":"All!AR128","v":0},{"$f":"All!AS128","v":0},{"$f":"All!AT128","v":0}]
[null,{"$f":"All!B129","v":2},{"$f":"All!C129","v":2.7},{"$f":"All!D129","v":"2.7.1"},{"$f":"All!E129","v":""},{"$f":"All!F129","v":"2.7.1.7"},{"$f":"All!G129","v":0},{"$f":"All!H129","v":0},{"$f":"All!I129","v":"2.7.1.7.3"},{"$f":"All!J129","v":"2.7.1.7.3: Have SMS restrictions been applied so that agent SIMs can only receive SMSs from the mobile money system in order to prevent spoof SMSs being sent to agents for false cash-outs?\n"},{"$f":"All!K129","v":0},{"$f":"All!L129","v":0},{"$f":"All!M129","v":"Recommended"},{"$f":"All!N129","v":"Recommended"},{"$f":"All!O129","v":"FraudRisk"},{"$f":"All!P129","v":0},{"$f":"All!Q129","v":0},{"$f":"All!R129","v":0},{"$f":"All!S129","v":0},{"$f":"All!T129","v":0},{"$f":"All!U129","v":0},{"$f":"All!V129","v":0},{"$f":"All!W129","v":0},{"$f":"All!X129","v":0},{"$f":"All!Y129","v":0},{"$f":"All!Z129","v":0},{"$f":"All!AA129","v":0},{"$f":"All!AB129","v":0},{"$f":"All!AC129","v":0},{"$f":"All!AD129","v":0},{"$f":"All!AE129","v":0},{"$f":"All!AF129","v":0},{"$f":"All!AG129","v":0},{"$f":"All!AH129","v":0},{"$f":"All!AI129","v":0},{"$f":"All!AJ129","v":0},{"$f":"All!AK129","v":0},{"$f":"All!AL129","v":0},{"$f":"All!AM129","v":0},{"$f":"All!AN129","v":0},{"$f":"All!AO129","v":0},{"$f":"All!AP129","v":0},{"$f":"All!AQ129","v":0},{"$f":"All!AR129","v":0},{"$f":"All!AS129","v":0},{"$f":"All!AT129","v":0}]
[null,{"$f":"All!B130","v":2},{"$f":"All!C130","v":2.7},{"$f":"All!D130","v":"2.7.1"},{"$f":"All!E130","v":""},{"$f":"All!F130","v":"2.7.1.7"},{"$f":"All!G130","v":0},{"$f":"All!H130","v":0},{"$f":"All!I130","v":"2.7.1.7.4"},{"$f":"All!J130","v":"2.7.1.7.4: Is transaction and commissions data reconciled to detect commissions fraud, such as agents parcelling large transactions into smaller ones to earn larger commissions?\n"},{"$f":"All!K130","v":0},{"$f":"All!L130","v":0},{"$f":"All!M130","v":"Recommended"},{"$f":"All!N130","v":"Recommended"},{"$f":"All!O130","v":"FraudRisk"},{"$f":"All!P130","v":0},{"$f":"All!Q130","v":0},{"$f":"All!R130","v":0},{"$f":"All!S130","v":0},{"$f":"All!T130","v":0},{"$f":"All!U130","v":0},{"$f":"All!V130","v":0},{"$f":"All!W130","v":0},{"$f":"All!X130","v":0},{"$f":"All!Y130","v":0},{"$f":"All!Z130","v":0},{"$f":"All!AA130","v":0},{"$f":"All!AB130","v":0},{"$f":"All!AC130","v":0},{"$f":"All!AD130","v":0},{"$f":"All!AE130","v":0},{"$f":"All!AF130","v":0},{"$f":"All!AG130","v":0},{"$f":"All!AH130","v":0},{"$f":"All!AI130","v":0},{"$f":"All!AJ130","v":0},{"$f":"All!AK130","v":0},{"$f":"All!AL130","v":0},{"$f":"All!AM130","v":0},{"$f":"All!AN130","v":0},{"$f":"All!AO130","v":0},{"$f":"All!AP130","v":0},{"$f":"All!AQ130","v":0},{"$f":"All!AR130","v":0},{"$f":"All!AS130","v":0},{"$f":"All!AT130","v":0}]
[null,{"$f":"All!B131","v":2},{"$f":"All!C131","v":2.7},{"$f":"All!D131","v":"2.7.1"},{"$f":"All!E131","v":""},{"$f":"All!F131","v":"2.7.1.8"},{"$f":"All!G131","v":"2.7.1.8: SANCTIONS FOR AGENTS, BUSINESSES AND MERCHANTS\nSanctions should be applied to agents, businesses or merchants found to be in breach of process or involved in fraud. Examples of sanctions include:\n- Tiered sanctions, increasing in severity upon repetition of offence e.g., suspend account for 1 day/ 1 month/ permanently, or three-strikes-and-out;\n- Termination of agent or reseller status; or\n- Reporting to police for criminal activity."},{"$f":"All!H131","v":"GSMA RMT"},{"$f":"All!I131","v":"2.7.1.8.1"},{"$f":"All!J131","v":"2.7.1.8.1: Are sanctions applied to agents, businesses, or merchants found to be involved in fraud?\n"},{"$f":"All!K131","v":"1) Fraud management policy (or equivalent documents)\n- Check there is a process to sanction agents, businesses or merchants that are found to be involved in fraud or wrongdoing.\n\n"},{"$f":"All!L131","v":0},{"$f":"All!M131","v":"Urgent Required"},{"$f":"All!N131","v":"Required"},{"$f":"All!O131","v":"FraudRisk"},{"$f":"All!P131","v":0},{"$f":"All!Q131","v":0},{"$f":"All!R131","v":0},{"$f":"All!S131","v":0},{"$f":"All!T131","v":0},{"$f":"All!U131","v":0},{"$f":"All!V131","v":0},{"$f":"All!W131","v":0},{"$f":"All!X131","v":0},{"$f":"All!Y131","v":0},{"$f":"All!Z131","v":0},{"$f":"All!AA131","v":0},{"$f":"All!AB131","v":0},{"$f":"All!AC131","v":0},{"$f":"All!AD131","v":0},{"$f":"All!AE131","v":0},{"$f":"All!AF131","v":0},{"$f":"All!AG131","v":0},{"$f":"All!AH131","v":0},{"$f":"All!AI131","v":0},{"$f":"All!AJ131","v":0},{"$f":"All!AK131","v":0},{"$f":"All!AL131","v":0},{"$f":"All!AM131","v":0},{"$f":"All!AN131","v":0},{"$f":"All!AO131","v":0},{"$f":"All!AP131","v":0},{"$f":"All!AQ131","v":0},{"$f":"All!AR131","v":0},{"$f":"All!AS131","v":0},{"$f":"All!AT131","v":0}]
[null,{"$f":"All!B132","v":2},{"$f":"All!C132","v":2.7},{"$f":"All!D132","v":"2.7.1"},{"$f":"All!E132","v":""},{"$f":"All!F132","v":"2.7.1.9"},{"$f":"All!G132","v":"2.7.1.9: ACCOUNT-CHECKING BY AGENTS, BUSINESSES AND MERCHANTS\nProviders should communicate to agents, businesses and merchants the importance of regular checks to ensure the integrity and accuracy of their accounts. This will help detect fraud and reduce the opportunity for fraud. \n\nAgents, businesses and merchants should:\n- reconcile their mobile money account balance with a separate log of transactions to detect any variance between the actual and expected amount;\n- monitor account balances to check for unusual activity."},{"$f":"All!H132","v":"GSMA RMT"},{"$f":"All!I132","v":"2.7.1.9.1"},{"$f":"All!J132","v":"2.7.1.9.1: Do providers communicate to agents, businesses and merchants the importance of comparing the actual and expected balance of funds in their mobile money account to detect possible fraud?\n"},{"$f":"All!K132","v":0},{"$f":"All!L132","v":0},{"$f":"All!M132","v":"Recommended"},{"$f":"All!N132","v":"Recommended"},{"$f":"All!O132","v":"FraudRisk"},{"$f":"All!P132","v":0},{"$f":"All!Q132","v":0},{"$f":"All!R132","v":0},{"$f":"All!S132","v":0},{"$f":"All!T132","v":0},{"$f":"All!U132","v":0},{"$f":"All!V132","v":0},{"$f":"All!W132","v":0},{"$f":"All!X132","v":0},{"$f":"All!Y132","v":0},{"$f":"All!Z132","v":0},{"$f":"All!AA132","v":0},{"$f":"All!AB132","v":0},{"$f":"All!AC132","v":0},{"$f":"All!AD132","v":0},{"$f":"All!AE132","v":0},{"$f":"All!AF132","v":0},{"$f":"All!AG132","v":0},{"$f":"All!AH132","v":0},{"$f":"All!AI132","v":0},{"$f":"All!AJ132","v":0},{"$f":"All!AK132","v":0},{"$f":"All!AL132","v":0},{"$f":"All!AM132","v":0},{"$f":"All!AN132","v":0},{"$f":"All!AO132","v":0},{"$f":"All!AP132","v":0},{"$f":"All!AQ132","v":0},{"$f":"All!AR132","v":0},{"$f":"All!AS132","v":0},{"$f":"All!AT132","v":0}]
[null,{"$f":"All!B133","v":2},{"$f":"All!C133","v":2.7},{"$f":"All!D133","v":"2.7.1"},{"$f":"All!E133","v":""},{"$f":"All!F133","v":"2.7.1.10"},{"$f":"All!G133","v":"2.7.1.10: INFORMATION-SHARING WITH OTHER PROVIDERS\nAn information-sharing process or forum should be set up to enable a country's mobile money providers to share information about known frauds and counter-measures.\n\nWhere possible, providers should share details of agents, businesses and merchants (and their directors) that have been found to have engaged in fraud.\n\nNote: GSMA also hosts a Fraud and Risk working group, where best practice is shared and discussed."},{"$f":"All!H133","v":"GSMA RMT"},{"$f":"All!I133","v":"2.7.1.10.1"},{"$f":"All!J133","v":"2.7.1.10.1: Is there an information-sharing process or forum to enable a country's mobile money providers to share information about known frauds and counter-measures?\n"},{"$f":"All!K133","v":0},{"$f":"All!L133","v":0},{"$f":"All!M133","v":"Recommended"},{"$f":"All!N133","v":"Recommended"},{"$f":"All!O133","v":"FraudRisk"},{"$f":"All!P133","v":0},{"$f":"All!Q133","v":0},{"$f":"All!R133","v":0},{"$f":"All!S133","v":0},{"$f":"All!T133","v":0},{"$f":"All!U133","v":0},{"$f":"All!V133","v":0},{"$f":"All!W133","v":0},{"$f":"All!X133","v":0},{"$f":"All!Y133","v":0},{"$f":"All!Z133","v":0},{"$f":"All!AA133","v":0},{"$f":"All!AB133","v":0},{"$f":"All!AC133","v":0},{"$f":"All!AD133","v":0},{"$f":"All!AE133","v":0},{"$f":"All!AF133","v":0},{"$f":"All!AG133","v":0},{"$f":"All!AH133","v":0},{"$f":"All!AI133","v":0},{"$f":"All!AJ133","v":0},{"$f":"All!AK133","v":0},{"$f":"All!AL133","v":0},{"$f":"All!AM133","v":0},{"$f":"All!AN133","v":0},{"$f":"All!AO133","v":0},{"$f":"All!AP133","v":0},{"$f":"All!AQ133","v":0},{"$f":"All!AR133","v":0},{"$f":"All!AS133","v":0},{"$f":"All!AT133","v":0}]
[null,{"$f":"All!B134","v":2},{"$f":"All!C134","v":2.7},{"$f":"All!D134","v":"2.7.1"},{"$f":"All!E134","v":""},{"$f":"All!F134","v":"2.7.1.11"},{"$f":"All!G134","v":"2.7.1.11: PROTECT AT-RISK ACCOUNTS AND TRANSACTIONS\nCertain types of accounts have been targeted by fraudsters (often internal fraud), and measures should be implemented to protect these accounts. Types of at-risk accounts include:\n- Provider's airtime collection account;\n- High-value accounts such as business accounts;\n- E-money collection/disbursement accounts;\n- Abandoned accounts e.g. the customer closes the mobile phone account but not the mobile money account; the customer forgets about the account; or the customer dies.\n\nIt is recommended that more secure handsets are used for higher-risk accounts, such as agent, business and merchant accounts. For example, STK-based or smartphone terminals instead of USSD-based handsets.\n\nBulk payment transactions are another source of fraud and measures should be taken to secure these transactions. For example the use of maker-checker.\n"},{"$f":"All!H134","v":"GSMA RMT"},{"$f":"All!I134","v":"2.7.1.11.1"},{"$f":"All!J134","v":"2.7.1.11.1: Have measures been implemented to protect at-risk accounts from internal fraud, such as the airtime collection account, e-money disbursement/collection accounts, high-value accounts and abandoned accounts?\n"},{"$f":"All!K134","v":0},{"$f":"All!L134","v":0},{"$f":"All!M134","v":"Recommended"},{"$f":"All!N134","v":"Recommended"},{"$f":"All!O134","v":"FraudRisk"},{"$f":"All!P134","v":0},{"$f":"All!Q134","v":0},{"$f":"All!R134","v":0},{"$f":"All!S134","v":0},{"$f":"All!T134","v":0},{"$f":"All!U134","v":0},{"$f":"All!V134","v":0},{"$f":"All!W134","v":0},{"$f":"All!X134","v":0},{"$f":"All!Y134","v":0},{"$f":"All!Z134","v":0},{"$f":"All!AA134","v":0},{"$f":"All!AB134","v":0},{"$f":"All!AC134","v":0},{"$f":"All!AD134","v":0},{"$f":"All!AE134","v":0},{"$f":"All!AF134","v":0},{"$f":"All!AG134","v":0},{"$f":"All!AH134","v":0},{"$f":"All!AI134","v":0},{"$f":"All!AJ134","v":0},{"$f":"All!AK134","v":0},{"$f":"All!AL134","v":0},{"$f":"All!AM134","v":0},{"$f":"All!AN134","v":0},{"$f":"All!AO134","v":0},{"$f":"All!AP134","v":0},{"$f":"All!AQ134","v":0},{"$f":"All!AR134","v":0},{"$f":"All!AS134","v":0},{"$f":"All!AT134","v":0}]
[null,{"$f":"All!B135","v":2},{"$f":"All!C135","v":2.7},{"$f":"All!D135","v":"2.7.1"},{"$f":"All!E135","v":0},{"$f":"All!F135","v":"2.7.1.11"},{"$f":"All!G135","v":0},{"$f":"All!H135","v":0},{"$f":"All!I135","v":0},{"$f":"All!J135","v":"2.7.1.11.2: Are more secure handsets are used for higher-risk accounts, such as agent, business and merchant accounts? \n(For example, STK-based or smartphone terminals instead of USSD-based handsets.)\n"},{"$f":"All!K135","v":0},{"$f":"All!L135","v":0},{"$f":"All!M135","v":"Recommended"},{"$f":"All!N135","v":"Recommended"},{"$f":"All!O135","v":"FraudRisk"},{"$f":"All!P135","v":0},{"$f":"All!Q135","v":0},{"$f":"All!R135","v":0},{"$f":"All!S135","v":0},{"$f":"All!T135","v":0},{"$f":"All!U135","v":0},{"$f":"All!V135","v":0},{"$f":"All!W135","v":0},{"$f":"All!X135","v":0},{"$f":"All!Y135","v":0},{"$f":"All!Z135","v":0},{"$f":"All!AA135","v":0},{"$f":"All!AB135","v":0},{"$f":"All!AC135","v":0},{"$f":"All!AD135","v":0},{"$f":"All!AE135","v":0},{"$f":"All!AF135","v":0},{"$f":"All!AG135","v":0},{"$f":"All!AH135","v":0},{"$f":"All!AI135","v":0},{"$f":"All!AJ135","v":0},{"$f":"All!AK135","v":0},{"$f":"All!AL135","v":0},{"$f":"All!AM135","v":0},{"$f":"All!AN135","v":0},{"$f":"All!AO135","v":0},{"$f":"All!AP135","v":0},{"$f":"All!AQ135","v":0},{"$f":"All!AR135","v":0},{"$f":"All!AS135","v":0},{"$f":"All!AT135","v":0}]
[null,{"$f":"All!B136","v":2},{"$f":"All!C136","v":2.7},{"$f":"All!D136","v":"2.7.1"},{"$f":"All!E136","v":0},{"$f":"All!F136","v":"2.7.1.11"},{"$f":"All!G136","v":0},{"$f":"All!H136","v":0},{"$f":"All!I136","v":"2.7.1.11.3"},{"$f":"All!J136","v":"2.7.1.11.3: Have measures been implemented to secure bulk payment transactions, for example with the use of maker-checker?\n"},{"$f":"All!K136","v":0},{"$f":"All!L136","v":0},{"$f":"All!M136","v":"Recommended"},{"$f":"All!N136","v":"Recommended"},{"$f":"All!O136","v":"FraudRisk"},{"$f":"All!P136","v":0},{"$f":"All!Q136","v":0},{"$f":"All!R136","v":0},{"$f":"All!S136","v":0},{"$f":"All!T136","v":0},{"$f":"All!U136","v":0},{"$f":"All!V136","v":0},{"$f":"All!W136","v":0},{"$f":"All!X136","v":0},{"$f":"All!Y136","v":0},{"$f":"All!Z136","v":0},{"$f":"All!AA136","v":0},{"$f":"All!AB136","v":0},{"$f":"All!AC136","v":0},{"$f":"All!AD136","v":0},{"$f":"All!AE136","v":0},{"$f":"All!AF136","v":0},{"$f":"All!AG136","v":0},{"$f":"All!AH136","v":0},{"$f":"All!AI136","v":0},{"$f":"All!AJ136","v":0},{"$f":"All!AK136","v":0},{"$f":"All!AL136","v":0},{"$f":"All!AM136","v":0},{"$f":"All!AN136","v":0},{"$f":"All!AO136","v":0},{"$f":"All!AP136","v":0},{"$f":"All!AQ136","v":0},{"$f":"All!AR136","v":0},{"$f":"All!AS136","v":0},{"$f":"All!AT136","v":0}]
[null,{"$f":"All!B137","v":2},{"$f":"All!C137","v":2.7},{"$f":"All!D137","v":"2.7.1"},{"$f":"All!E137","v":""},{"$f":"All!F137","v":"2.7.1.12"},{"$f":"All!G137","v":"2.7.1.12: IDENTITY THEFT PROTECTION\nCustomer name validation is implemented by some operators to reduce reversals by presenting the recipient's name to the sender. However, this could be abused by fraudsters to steal customers' identities.\n\nProviders should implement measures to reduce the risk of identity theft using the customer name validation functionality. For example, providers could:\n- restrict the number of times that customer name validation can be initiated and cancelled per day; or \n- restrict customer name validation only to names from the customer's list of contacts."},{"$f":"All!H137","v":"GSMA RMT"},{"$f":"All!I137","v":"2.7.1.12.1"},{"$f":"All!J137","v":"2.7.1.12.1: Have providers implemented controls to limit the risk of customer name validation functionality being used for identity theft?\n"},{"$f":"All!K137","v":0},{"$f":"All!L137","v":0},{"$f":"All!M137","v":"Recommended"},{"$f":"All!N137","v":"Recommended"},{"$f":"All!O137","v":"FraudRisk"},{"$f":"All!P137","v":0},{"$f":"All!Q137","v":0},{"$f":"All!R137","v":0},{"$f":"All!S137","v":0},{"$f":"All!T137","v":0},{"$f":"All!U137","v":0},{"$f":"All!V137","v":0},{"$f":"All!W137","v":0},{"$f":"All!X137","v":0},{"$f":"All!Y137","v":0},{"$f":"All!Z137","v":0},{"$f":"All!AA137","v":0},{"$f":"All!AB137","v":0},{"$f":"All!AC137","v":0},{"$f":"All!AD137","v":0},{"$f":"All!AE137","v":0},{"$f":"All!AF137","v":0},{"$f":"All!AG137","v":0},{"$f":"All!AH137","v":0},{"$f":"All!AI137","v":0},{"$f":"All!AJ137","v":0},{"$f":"All!AK137","v":0},{"$f":"All!AL137","v":0},{"$f":"All!AM137","v":0},{"$f":"All!AN137","v":0},{"$f":"All!AO137","v":0},{"$f":"All!AP137","v":0},{"$f":"All!AQ137","v":0},{"$f":"All!AR137","v":0},{"$f":"All!AS137","v":0},{"$f":"All!AT137","v":0}]
[null,{"$f":"All!B138","v":"3"},{"$f":"All!C138","v":"3.1"},{"$f":"All!D138","v":"3.1.1"},{"$f":"All!E138","v":"3.1.1: Providers shall conduct proper due diligence on potential staff, agents and entities providing outsourced services"},{"$f":"All!F138","v":"3.1.1.1"},{"$f":"All!G138","v":"3.1.1.1: STAFF DUE DILIGENCE PROCESS\nDue diligence should be carried out on all mobile money staff before their employment and regularly thereafter, as determined by risk assessment.\n\nIdentification data should be obtained for all staff (full name, address, date of birth). A risk assessment should determine whether further due diligence is reuqired, which could include the following, for example:\n- employment history;\n- reference checks;\n- criminal record check;\n- watchlist screening (using domestic and international money laundering, terrorist financing, and sanctions watchlists). \n\nThe risk assessment may determine that additional due diligence should be carried out on higher-risk roles; for example the following:\n- Finance team\n- AML/Fraud team\n- Privileged account holders (super users or account creation roles)\n- The head of mobile money and managers of key functions\n\nThe staff due diligence process should be regularly reviewed and updated as needed, such as when changes are made to the service or regulation. "},{"$f":"All!H138","v":"GSMA RMT"},{"$f":"All!I138","v":"3.1.1.1.1"},{"$f":"All!J138","v":"3.1.1.1.1: Is there a documented staff due diligence process, and is it regularly reviewed and updated as needed?\n"},{"$f":"All!K138","v":"1) Staff due diligence process\n-Check that that process is documented\n-Check that the document includes a revision history\n-Check that that document has been reviewed within the last 24 months"},{"$f":"All!L138","v":0},{"$f":"All!M138","v":"Urgent Required"},{"$f":"All!N138","v":"Required"},{"$f":"All!O138","v":"HR"},{"$f":"All!P138","v":0},{"$f":"All!Q138","v":0},{"$f":"All!R138","v":0},{"$f":"All!S138","v":0},{"$f":"All!T138","v":0},{"$f":"All!U138","v":0},{"$f":"All!V138","v":0},{"$f":"All!W138","v":0},{"$f":"All!X138","v":0},{"$f":"All!Y138","v":0},{"$f":"All!Z138","v":0},{"$f":"All!AA138","v":0},{"$f":"All!AB138","v":0},{"$f":"All!AC138","v":0},{"$f":"All!AD138","v":0},{"$f":"All!AE138","v":0},{"$f":"All!AF138","v":0},{"$f":"All!AG138","v":0},{"$f":"All!AH138","v":0},{"$f":"All!AI138","v":0},{"$f":"All!AJ138","v":0},{"$f":"All!AK138","v":0},{"$f":"All!AL138","v":0},{"$f":"All!AM138","v":0},{"$f":"All!AN138","v":0},{"$f":"All!AO138","v":0},{"$f":"All!AP138","v":0},{"$f":"All!AQ138","v":0},{"$f":"All!AR138","v":0},{"$f":"All!AS138","v":0},{"$f":"All!AT138","v":0}]
[null,{"$f":"All!B139","v":"3"},{"$f":"All!C139","v":"3.1"},{"$f":"All!D139","v":"3.1.1"},{"$f":"All!E139","v":0},{"$f":"All!F139","v":"3.1.1.1"},{"$f":"All!G139","v":0},{"$f":"All!H139","v":0},{"$f":"All!I139","v":"3.1.1.1.2"},{"$f":"All!J139","v":"3.1.1.1.2: Are identification data collected for staff - full name, address, date of birth?\n"},{"$f":"All!K139","v":"1) Staff due diligence process\n- Check that there is a process for identification data to be collected from staff.\n- Check that this includes:\na) Full Names\nb) Address\nc) Date of birth"},{"$f":"All!L139","v":0},{"$f":"All!M139","v":"Urgent Required"},{"$f":"All!N139","v":"Required"},{"$f":"All!O139","v":"HR"},{"$f":"All!P139","v":0},{"$f":"All!Q139","v":0},{"$f":"All!R139","v":0},{"$f":"All!S139","v":0},{"$f":"All!T139","v":0},{"$f":"All!U139","v":0},{"$f":"All!V139","v":0},{"$f":"All!W139","v":0},{"$f":"All!X139","v":0},{"$f":"All!Y139","v":0},{"$f":"All!Z139","v":0},{"$f":"All!AA139","v":0},{"$f":"All!AB139","v":0},{"$f":"All!AC139","v":0},{"$f":"All!AD139","v":0},{"$f":"All!AE139","v":0},{"$f":"All!AF139","v":0},{"$f":"All!AG139","v":0},{"$f":"All!AH139","v":0},{"$f":"All!AI139","v":0},{"$f":"All!AJ139","v":0},{"$f":"All!AK139","v":0},{"$f":"All!AL139","v":0},{"$f":"All!AM139","v":0},{"$f":"All!AN139","v":0},{"$f":"All!AO139","v":0},{"$f":"All!AP139","v":0},{"$f":"All!AQ139","v":0},{"$f":"All!AR139","v":0},{"$f":"All!AS139","v":0},{"$f":"All!AT139","v":0}]
[null,{"$f":"All!B140","v":"3"},{"$f":"All!C140","v":"3.1"},{"$f":"All!D140","v":"3.1.1"},{"$f":"All!E140","v":0},{"$f":"All!F140","v":"3.1.1.1"},{"$f":"All!G140","v":0},{"$f":"All!H140","v":0},{"$f":"All!I140","v":"3.1.1.1.3"},{"$f":"All!J140","v":"3.1.1.1.3: Is a risk-based assessment carried out to determine whether additional due diligence is required (e.g. watchlist screening or additional KYC) for staff in sensitive roles (such as head of mobile money, Finance team, AML staff, Fraud team, and privileged staff account holders (super users or account creation roles)?\n"},{"$f":"All!K140","v":"1) Staff due diligence process\n- Check that a risk-based assessment has been carried out to determine whether additional due diligence is required (e.g. watchlist screening or additional KYC) for staff in sensitive roles  (based on reasonable assessment of risk)."},{"$f":"All!L140","v":0},{"$f":"All!M140","v":"Standard Required"},{"$f":"All!N140","v":"Required"},{"$f":"All!O140","v":"HR"},{"$f":"All!P140","v":0},{"$f":"All!Q140","v":0},{"$f":"All!R140","v":0},{"$f":"All!S140","v":0},{"$f":"All!T140","v":0},{"$f":"All!U140","v":0},{"$f":"All!V140","v":0},{"$f":"All!W140","v":0},{"$f":"All!X140","v":0},{"$f":"All!Y140","v":0},{"$f":"All!Z140","v":0},{"$f":"All!AA140","v":0},{"$f":"All!AB140","v":0},{"$f":"All!AC140","v":0},{"$f":"All!AD140","v":0},{"$f":"All!AE140","v":0},{"$f":"All!AF140","v":0},{"$f":"All!AG140","v":0},{"$f":"All!AH140","v":0},{"$f":"All!AI140","v":0},{"$f":"All!AJ140","v":0},{"$f":"All!AK140","v":0},{"$f":"All!AL140","v":0},{"$f":"All!AM140","v":0},{"$f":"All!AN140","v":0},{"$f":"All!AO140","v":0},{"$f":"All!AP140","v":0},{"$f":"All!AQ140","v":0},{"$f":"All!AR140","v":0},{"$f":"All!AS140","v":0},{"$f":"All!AT140","v":0}]
[null,{"$f":"All!B141","v":"3"},{"$f":"All!C141","v":"3.1"},{"$f":"All!D141","v":"3.1.1"},{"$f":"All!E141","v":0},{"$f":"All!F141","v":"3.1.1.1"},{"$f":"All!G141","v":0},{"$f":"All!H141","v":0},{"$f":"All!I141","v":"3.1.1.1.4"},{"$f":"All!J141","v":"3.1.1.1.4: Is employment history checked and are references taken for all operational staff?\n"},{"$f":"All!K141","v":0},{"$f":"All!L141","v":0},{"$f":"All!M141","v":"Recommended"},{"$f":"All!N141","v":"Recommended"},{"$f":"All!O141","v":"HR"},{"$f":"All!P141","v":0},{"$f":"All!Q141","v":0},{"$f":"All!R141","v":0},{"$f":"All!S141","v":0},{"$f":"All!T141","v":0},{"$f":"All!U141","v":0},{"$f":"All!V141","v":0},{"$f":"All!W141","v":0},{"$f":"All!X141","v":0},{"$f":"All!Y141","v":0},{"$f":"All!Z141","v":0},{"$f":"All!AA141","v":0},{"$f":"All!AB141","v":0},{"$f":"All!AC141","v":0},{"$f":"All!AD141","v":0},{"$f":"All!AE141","v":0},{"$f":"All!AF141","v":0},{"$f":"All!AG141","v":0},{"$f":"All!AH141","v":0},{"$f":"All!AI141","v":0},{"$f":"All!AJ141","v":0},{"$f":"All!AK141","v":0},{"$f":"All!AL141","v":0},{"$f":"All!AM141","v":0},{"$f":"All!AN141","v":0},{"$f":"All!AO141","v":0},{"$f":"All!AP141","v":0},{"$f":"All!AQ141","v":0},{"$f":"All!AR141","v":0},{"$f":"All!AS141","v":0},{"$f":"All!AT141","v":0}]
[null,{"$f":"All!B142","v":"3"},{"$f":"All!C142","v":"3.1"},{"$f":"All!D142","v":"3.1.1"},{"$f":"All!E142","v":0},{"$f":"All!F142","v":"3.1.1.1"},{"$f":"All!G142","v":0},{"$f":"All!H142","v":0},{"$f":"All!I142","v":"3.1.1.1.5"},{"$f":"All!J142","v":"3.1.1.1.5: Are criminal record checks carried out for all operational staff?\n"},{"$f":"All!K142","v":0},{"$f":"All!L142","v":0},{"$f":"All!M142","v":"Recommended"},{"$f":"All!N142","v":"Recommended"},{"$f":"All!O142","v":"HR"},{"$f":"All!P142","v":0},{"$f":"All!Q142","v":0},{"$f":"All!R142","v":0},{"$f":"All!S142","v":0},{"$f":"All!T142","v":0},{"$f":"All!U142","v":0},{"$f":"All!V142","v":0},{"$f":"All!W142","v":0},{"$f":"All!X142","v":0},{"$f":"All!Y142","v":0},{"$f":"All!Z142","v":0},{"$f":"All!AA142","v":0},{"$f":"All!AB142","v":0},{"$f":"All!AC142","v":0},{"$f":"All!AD142","v":0},{"$f":"All!AE142","v":0},{"$f":"All!AF142","v":0},{"$f":"All!AG142","v":0},{"$f":"All!AH142","v":0},{"$f":"All!AI142","v":0},{"$f":"All!AJ142","v":0},{"$f":"All!AK142","v":0},{"$f":"All!AL142","v":0},{"$f":"All!AM142","v":0},{"$f":"All!AN142","v":0},{"$f":"All!AO142","v":0},{"$f":"All!AP142","v":0},{"$f":"All!AQ142","v":0},{"$f":"All!AR142","v":0},{"$f":"All!AS142","v":0},{"$f":"All!AT142","v":0}]
[null,{"$f":"All!B143","v":"3"},{"$f":"All!C143","v":"3.1"},{"$f":"All!D143","v":"3.1.1"},{"$f":"All!E143","v":""},{"$f":"All!F143","v":"3.1.1.2"},{"$f":"All!G143","v":"3.1.1.2: STAFF DUE DILIGENCE - FREQUENCY AND RECORDS\nDue diligence checks should be performed on all staff at intervals specified in the staff due diligence policy. This should ideally be every three years at minimum, and every two years at minimum for staff that are in the sensitive roles identified by risk assessment (3.1.1.2).\n\nThe provider should maintain the following staff due diligence records:\n- Records of staff due diligence conducted\n- Copies of all documentation collected during due diligence\nRecords should be kept for a period determined by regulation or risk assessment, whichever is longer. FATF recommends that records be kept for a minimum of five years after termination, either physically or electronically (or both). "},{"$f":"All!H143","v":"GSMA RMT"},{"$f":"All!I143","v":"3.1.1.2.1"},{"$f":"All!J143","v":"3.1.1.2.1: Are due diligence checks performed on all staff every three years at minimum, and every two years at minimum for staff that are in sensitive roles?\n"},{"$f":"All!K143","v":0},{"$f":"All!L143","v":0},{"$f":"All!M143","v":"Recommended"},{"$f":"All!N143","v":"Recommended"},{"$f":"All!O143","v":"HR"},{"$f":"All!P143","v":0},{"$f":"All!Q143","v":0},{"$f":"All!R143","v":0},{"$f":"All!S143","v":0},{"$f":"All!T143","v":0},{"$f":"All!U143","v":0},{"$f":"All!V143","v":0},{"$f":"All!W143","v":0},{"$f":"All!X143","v":0},{"$f":"All!Y143","v":0},{"$f":"All!Z143","v":0},{"$f":"All!AA143","v":0},{"$f":"All!AB143","v":0},{"$f":"All!AC143","v":0},{"$f":"All!AD143","v":0},{"$f":"All!AE143","v":0},{"$f":"All!AF143","v":0},{"$f":"All!AG143","v":0},{"$f":"All!AH143","v":0},{"$f":"All!AI143","v":0},{"$f":"All!AJ143","v":0},{"$f":"All!AK143","v":0},{"$f":"All!AL143","v":0},{"$f":"All!AM143","v":0},{"$f":"All!AN143","v":0},{"$f":"All!AO143","v":0},{"$f":"All!AP143","v":0},{"$f":"All!AQ143","v":0},{"$f":"All!AR143","v":0},{"$f":"All!AS143","v":0},{"$f":"All!AT143","v":0}]
[null,{"$f":"All!B144","v":"3"},{"$f":"All!C144","v":"3.1"},{"$f":"All!D144","v":"3.1.1"},{"$f":"All!E144","v":""},{"$f":"All!F144","v":"3.1.1.2"},{"$f":"All!G144","v":0},{"$f":"All!H144","v":0},{"$f":"All!I144","v":"3.1.1.2.2"},{"$f":"All!J144","v":"3.1.1.2.2: Are staff due diligence records kept for at least five years after termination, including identification records and records of due diligence conducted?\n"},{"$f":"All!K144","v":0},{"$f":"All!L144","v":0},{"$f":"All!M144","v":"Recommended"},{"$f":"All!N144","v":"Recommended"},{"$f":"All!O144","v":"HR"},{"$f":"All!P144","v":0},{"$f":"All!Q144","v":0},{"$f":"All!R144","v":0},{"$f":"All!S144","v":0},{"$f":"All!T144","v":0},{"$f":"All!U144","v":0},{"$f":"All!V144","v":0},{"$f":"All!W144","v":0},{"$f":"All!X144","v":0},{"$f":"All!Y144","v":0},{"$f":"All!Z144","v":0},{"$f":"All!AA144","v":0},{"$f":"All!AB144","v":0},{"$f":"All!AC144","v":0},{"$f":"All!AD144","v":0},{"$f":"All!AE144","v":0},{"$f":"All!AF144","v":0},{"$f":"All!AG144","v":0},{"$f":"All!AH144","v":0},{"$f":"All!AI144","v":0},{"$f":"All!AJ144","v":0},{"$f":"All!AK144","v":0},{"$f":"All!AL144","v":0},{"$f":"All!AM144","v":0},{"$f":"All!AN144","v":0},{"$f":"All!AO144","v":0},{"$f":"All!AP144","v":0},{"$f":"All!AQ144","v":0},{"$f":"All!AR144","v":0},{"$f":"All!AS144","v":0},{"$f":"All!AT144","v":0}]
[null,{"$f":"All!B145","v":"3"},{"$f":"All!C145","v":"3.1"},{"$f":"All!D145","v":"3.1.1"},{"$f":"All!E145","v":""},{"$f":"All!F145","v":"3.1.1.3"},{"$f":"All!G145","v":"3.1.1.3: AGENT DUE DILIGENCE POLICY\nThe provider should have a policy to carry out due diligence on mobile money agents before they start operation and regularly thereafter. The agent due diligence policy should define checks to be made when contracting new master agents and individual agents, and ongoing reviews. \n\nThe agent due diligence policy should be regularly reviewed and updated as needed, such as when changes are made to the service or regulation."},{"$f":"All!H145","v":"GSMA RMT"},{"$f":"All!I145","v":"3.1.1.3.1"},{"$f":"All!J145","v":"3.1.1.3.1: Is there a policy to perform due diligence on mobile money agents before their engagement and regularly thereafter, and is the policy regularly reviewed and updated as needed, such as when changes are made to the service or regulation?\n"},{"$f":"All!K145","v":0},{"$f":"All!L145","v":0},{"$f":"All!M145","v":"Recommended"},{"$f":"All!N145","v":"Recommended"},{"$f":"All!O145","v":"Agent"},{"$f":"All!P145","v":0},{"$f":"All!Q145","v":0},{"$f":"All!R145","v":0},{"$f":"All!S145","v":0},{"$f":"All!T145","v":0},{"$f":"All!U145","v":0},{"$f":"All!V145","v":0},{"$f":"All!W145","v":0},{"$f":"All!X145","v":0},{"$f":"All!Y145","v":0},{"$f":"All!Z145","v":0},{"$f":"All!AA145","v":0},{"$f":"All!AB145","v":0},{"$f":"All!AC145","v":0},{"$f":"All!AD145","v":0},{"$f":"All!AE145","v":0},{"$f":"All!AF145","v":0},{"$f":"All!AG145","v":0},{"$f":"All!AH145","v":0},{"$f":"All!AI145","v":0},{"$f":"All!AJ145","v":0},{"$f":"All!AK145","v":0},{"$f":"All!AL145","v":0},{"$f":"All!AM145","v":0},{"$f":"All!AN145","v":0},{"$f":"All!AO145","v":0},{"$f":"All!AP145","v":0},{"$f":"All!AQ145","v":0},{"$f":"All!AR145","v":0},{"$f":"All!AS145","v":0},{"$f":"All!AT145","v":0}]
[null,{"$f":"All!B146","v":"3"},{"$f":"All!C146","v":"3.1"},{"$f":"All!D146","v":"3.1.1"},{"$f":"All!E146","v":""},{"$f":"All!F146","v":"3.1.1.4"},{"$f":"All!G146","v":"3.1.1.4: AGENT DUE DILIGENCE: MASTER AGENTS\nProviders should conduct due diligence on all master agents and agent aggregators. Checks should include:\n- Identification of owners and senior management of master agents - full name, address, date of birth (validated by viewing ID);\n- Two business references;\n- Criminal record check on owners and senior management of master agents;\n- Bankruptcy check on owners and senior management of master agents;\n- A certified true copy of the business registration documents of the master agent (e.g. memorandum and articles of association);\n- An organisational chart of the agent network indicating the identity of the managers of each agent store;\n- Screening of owners and senior management of master agents using domestic and international money laundering, terrorist financing, and sanctions watchlists."},{"$f":"All!H146","v":"GSMA RMT (AG-02)"},{"$f":"All!I146","v":"3.1.1.4.1"},{"$f":"All!J146","v":"3.1.1.4.1: Has a process been implemented to carry out due diligence on all master agents and agent aggregators?\n"},{"$f":"All!K146","v":"1) Agent Due Diligence Process\n- Check that there is a process to carry out due diligence on all master agents and agent aggregators."},{"$f":"All!L146","v":0},{"$f":"All!M146","v":"Urgent Required"},{"$f":"All!N146","v":"Required"},{"$f":"All!O146","v":"Agent"},{"$f":"All!P146","v":0},{"$f":"All!Q146","v":0},{"$f":"All!R146","v":0},{"$f":"All!S146","v":0},{"$f":"All!T146","v":0},{"$f":"All!U146","v":0},{"$f":"All!V146","v":0},{"$f":"All!W146","v":0},{"$f":"All!X146","v":0},{"$f":"All!Y146","v":0},{"$f":"All!Z146","v":0},{"$f":"All!AA146","v":0},{"$f":"All!AB146","v":0},{"$f":"All!AC146","v":0},{"$f":"All!AD146","v":0},{"$f":"All!AE146","v":0},{"$f":"All!AF146","v":0},{"$f":"All!AG146","v":0},{"$f":"All!AH146","v":0},{"$f":"All!AI146","v":0},{"$f":"All!AJ146","v":0},{"$f":"All!AK146","v":0},{"$f":"All!AL146","v":0},{"$f":"All!AM146","v":0},{"$f":"All!AN146","v":0},{"$f":"All!AO146","v":0},{"$f":"All!AP146","v":0},{"$f":"All!AQ146","v":0},{"$f":"All!AR146","v":0},{"$f":"All!AS146","v":0},{"$f":"All!AT146","v":0}]
[null,{"$f":"All!B147","v":"3"},{"$f":"All!C147","v":"3.1"},{"$f":"All!D147","v":"3.1.1"},{"$f":"All!E147","v":""},{"$f":"All!F147","v":"3.1.1.4"},{"$f":"All!G147","v":0},{"$f":"All!H147","v":0},{"$f":"All!I147","v":"3.1.1.4.2"},{"$f":"All!J147","v":"3.1.1.4.2: Is identification of owners and senior management of master agents & and agent aggregators collected, including full name, address, and date of birth (with verification of name and DoB)?\n"},{"$f":"All!K147","v":"1) Agent Due Diligence Process\n- Check that identification of all owners (>25% ownership) and senior management of master agents/agent aggregators is collected, including:\na) Full Name      (verified by viewing ID documentation)\nb) Address\nc) Date of birth  (verified by viewing ID documentation, where available)"},{"$f":"All!L147","v":0},{"$f":"All!M147","v":"Urgent Required"},{"$f":"All!N147","v":"Required"},{"$f":"All!O147","v":"Agent"},{"$f":"All!P147","v":0},{"$f":"All!Q147","v":0},{"$f":"All!R147","v":0},{"$f":"All!S147","v":0},{"$f":"All!T147","v":0},{"$f":"All!U147","v":0},{"$f":"All!V147","v":0},{"$f":"All!W147","v":0},{"$f":"All!X147","v":0},{"$f":"All!Y147","v":0},{"$f":"All!Z147","v":0},{"$f":"All!AA147","v":0},{"$f":"All!AB147","v":0},{"$f":"All!AC147","v":0},{"$f":"All!AD147","v":0},{"$f":"All!AE147","v":0},{"$f":"All!AF147","v":0},{"$f":"All!AG147","v":0},{"$f":"All!AH147","v":0},{"$f":"All!AI147","v":0},{"$f":"All!AJ147","v":0},{"$f":"All!AK147","v":0},{"$f":"All!AL147","v":0},{"$f":"All!AM147","v":0},{"$f":"All!AN147","v":0},{"$f":"All!AO147","v":0},{"$f":"All!AP147","v":0},{"$f":"All!AQ147","v":0},{"$f":"All!AR147","v":0},{"$f":"All!AS147","v":0},{"$f":"All!AT147","v":0}]
[null,{"$f":"All!B148","v":"3"},{"$f":"All!C148","v":"3.1"},{"$f":"All!D148","v":"3.1.1"},{"$f":"All!E148","v":""},{"$f":"All!F148","v":"3.1.1.4"},{"$f":"All!G148","v":0},{"$f":"All!H148","v":0},{"$f":"All!I148","v":"3.1.1.4.3"},{"$f":"All!J148","v":"3.1.1.4.3: Are owners and senior management of all master agents and agent aggregators screened using watchlists?\n"},{"$f":"All!K148","v":"1) Agent Due Diligence Process\n- Check that the process includes the screening of owners and senior managers of master agents and agent aggregators against watch lists (which should be at a minimum the lists required for customer screening)."},{"$f":"All!L148","v":0},{"$f":"All!M148","v":"Standard Required"},{"$f":"All!N148","v":"Required"},{"$f":"All!O148","v":"Agent"},{"$f":"All!P148","v":0},{"$f":"All!Q148","v":0},{"$f":"All!R148","v":0},{"$f":"All!S148","v":0},{"$f":"All!T148","v":0},{"$f":"All!U148","v":0},{"$f":"All!V148","v":0},{"$f":"All!W148","v":0},{"$f":"All!X148","v":0},{"$f":"All!Y148","v":0},{"$f":"All!Z148","v":0},{"$f":"All!AA148","v":0},{"$f":"All!AB148","v":0},{"$f":"All!AC148","v":0},{"$f":"All!AD148","v":0},{"$f":"All!AE148","v":0},{"$f":"All!AF148","v":0},{"$f":"All!AG148","v":0},{"$f":"All!AH148","v":0},{"$f":"All!AI148","v":0},{"$f":"All!AJ148","v":0},{"$f":"All!AK148","v":0},{"$f":"All!AL148","v":0},{"$f":"All!AM148","v":0},{"$f":"All!AN148","v":0},{"$f":"All!AO148","v":0},{"$f":"All!AP148","v":0},{"$f":"All!AQ148","v":0},{"$f":"All!AR148","v":0},{"$f":"All!AS148","v":0},{"$f":"All!AT148","v":0}]
[null,{"$f":"All!B149","v":"3"},{"$f":"All!C149","v":"3.1"},{"$f":"All!D149","v":"3.1.1"},{"$f":"All!E149","v":""},{"$f":"All!F149","v":"3.1.1.4"},{"$f":"All!G149","v":0},{"$f":"All!H149","v":0},{"$f":"All!I149","v":"3.1.1.4.4"},{"$f":"All!J149","v":"3.1.1.4.4: Are at least two business references obtained for all master agents and agent aggregators?\n"},{"$f":"All!K149","v":0},{"$f":"All!L149","v":0},{"$f":"All!M149","v":"Recommended"},{"$f":"All!N149","v":"Recommended"},{"$f":"All!O149","v":"Agent"},{"$f":"All!P149","v":0},{"$f":"All!Q149","v":0},{"$f":"All!R149","v":0},{"$f":"All!S149","v":0},{"$f":"All!T149","v":0},{"$f":"All!U149","v":0},{"$f":"All!V149","v":0},{"$f":"All!W149","v":0},{"$f":"All!X149","v":0},{"$f":"All!Y149","v":0},{"$f":"All!Z149","v":0},{"$f":"All!AA149","v":0},{"$f":"All!AB149","v":0},{"$f":"All!AC149","v":0},{"$f":"All!AD149","v":0},{"$f":"All!AE149","v":0},{"$f":"All!AF149","v":0},{"$f":"All!AG149","v":0},{"$f":"All!AH149","v":0},{"$f":"All!AI149","v":0},{"$f":"All!AJ149","v":0},{"$f":"All!AK149","v":0},{"$f":"All!AL149","v":0},{"$f":"All!AM149","v":0},{"$f":"All!AN149","v":0},{"$f":"All!AO149","v":0},{"$f":"All!AP149","v":0},{"$f":"All!AQ149","v":0},{"$f":"All!AR149","v":0},{"$f":"All!AS149","v":0},{"$f":"All!AT149","v":0}]
[null,{"$f":"All!B150","v":"3"},{"$f":"All!C150","v":"3.1"},{"$f":"All!D150","v":"3.1.1"},{"$f":"All!E150","v":""},{"$f":"All!F150","v":"3.1.1.4"},{"$f":"All!G150","v":0},{"$f":"All!H150","v":0},{"$f":"All!I150","v":"3.1.1.4.5"},{"$f":"All!J150","v":"3.1.1.4.5: Are criminal record checks performed on owners and senior management of all master agents and agent aggregators ?\n"},{"$f":"All!K150","v":0},{"$f":"All!L150","v":0},{"$f":"All!M150","v":"Recommended"},{"$f":"All!N150","v":"Recommended"},{"$f":"All!O150","v":"Agent"},{"$f":"All!P150","v":0},{"$f":"All!Q150","v":0},{"$f":"All!R150","v":0},{"$f":"All!S150","v":0},{"$f":"All!T150","v":0},{"$f":"All!U150","v":0},{"$f":"All!V150","v":0},{"$f":"All!W150","v":0},{"$f":"All!X150","v":0},{"$f":"All!Y150","v":0},{"$f":"All!Z150","v":0},{"$f":"All!AA150","v":0},{"$f":"All!AB150","v":0},{"$f":"All!AC150","v":0},{"$f":"All!AD150","v":0},{"$f":"All!AE150","v":0},{"$f":"All!AF150","v":0},{"$f":"All!AG150","v":0},{"$f":"All!AH150","v":0},{"$f":"All!AI150","v":0},{"$f":"All!AJ150","v":0},{"$f":"All!AK150","v":0},{"$f":"All!AL150","v":0},{"$f":"All!AM150","v":0},{"$f":"All!AN150","v":0},{"$f":"All!AO150","v":0},{"$f":"All!AP150","v":0},{"$f":"All!AQ150","v":0},{"$f":"All!AR150","v":0},{"$f":"All!AS150","v":0},{"$f":"All!AT150","v":0}]
[null,{"$f":"All!B151","v":"3"},{"$f":"All!C151","v":"3.1"},{"$f":"All!D151","v":"3.1.1"},{"$f":"All!E151","v":""},{"$f":"All!F151","v":"3.1.1.4"},{"$f":"All!G151","v":0},{"$f":"All!H151","v":0},{"$f":"All!I151","v":"3.1.1.4.6"},{"$f":"All!J151","v":"3.1.1.4.6: Is a bankruptcy check performed on the owners and senior management of all master agents and agent aggregators ?\n"},{"$f":"All!K151","v":0},{"$f":"All!L151","v":0},{"$f":"All!M151","v":"Recommended"},{"$f":"All!N151","v":"Recommended"},{"$f":"All!O151","v":"Agent"},{"$f":"All!P151","v":0},{"$f":"All!Q151","v":0},{"$f":"All!R151","v":0},{"$f":"All!S151","v":0},{"$f":"All!T151","v":0},{"$f":"All!U151","v":0},{"$f":"All!V151","v":0},{"$f":"All!W151","v":0},{"$f":"All!X151","v":0},{"$f":"All!Y151","v":0},{"$f":"All!Z151","v":0},{"$f":"All!AA151","v":0},{"$f":"All!AB151","v":0},{"$f":"All!AC151","v":0},{"$f":"All!AD151","v":0},{"$f":"All!AE151","v":0},{"$f":"All!AF151","v":0},{"$f":"All!AG151","v":0},{"$f":"All!AH151","v":0},{"$f":"All!AI151","v":0},{"$f":"All!AJ151","v":0},{"$f":"All!AK151","v":0},{"$f":"All!AL151","v":0},{"$f":"All!AM151","v":0},{"$f":"All!AN151","v":0},{"$f":"All!AO151","v":0},{"$f":"All!AP151","v":0},{"$f":"All!AQ151","v":0},{"$f":"All!AR151","v":0},{"$f":"All!AS151","v":0},{"$f":"All!AT151","v":0}]
[null,{"$f":"All!B152","v":"3"},{"$f":"All!C152","v":"3.1"},{"$f":"All!D152","v":"3.1.1"},{"$f":"All!E152","v":""},{"$f":"All!F152","v":"3.1.1.4"},{"$f":"All!G152","v":0},{"$f":"All!H152","v":0},{"$f":"All!I152","v":"3.1.1.4.7"},{"$f":"All!J152","v":"3.1.1.4.7: Is a certified true copy of the business registration documents obtained (e.g. memorandum and articles of association) for all master agents and agent aggregators?\n"},{"$f":"All!K152","v":0},{"$f":"All!L152","v":0},{"$f":"All!M152","v":"Recommended"},{"$f":"All!N152","v":"Recommended"},{"$f":"All!O152","v":"Agent"},{"$f":"All!P152","v":0},{"$f":"All!Q152","v":0},{"$f":"All!R152","v":0},{"$f":"All!S152","v":0},{"$f":"All!T152","v":0},{"$f":"All!U152","v":0},{"$f":"All!V152","v":0},{"$f":"All!W152","v":0},{"$f":"All!X152","v":0},{"$f":"All!Y152","v":0},{"$f":"All!Z152","v":0},{"$f":"All!AA152","v":0},{"$f":"All!AB152","v":0},{"$f":"All!AC152","v":0},{"$f":"All!AD152","v":0},{"$f":"All!AE152","v":0},{"$f":"All!AF152","v":0},{"$f":"All!AG152","v":0},{"$f":"All!AH152","v":0},{"$f":"All!AI152","v":0},{"$f":"All!AJ152","v":0},{"$f":"All!AK152","v":0},{"$f":"All!AL152","v":0},{"$f":"All!AM152","v":0},{"$f":"All!AN152","v":0},{"$f":"All!AO152","v":0},{"$f":"All!AP152","v":0},{"$f":"All!AQ152","v":0},{"$f":"All!AR152","v":0},{"$f":"All!AS152","v":0},{"$f":"All!AT152","v":0}]
[null,{"$f":"All!B153","v":"3"},{"$f":"All!C153","v":"3.1"},{"$f":"All!D153","v":"3.1.1"},{"$f":"All!E153","v":""},{"$f":"All!F153","v":"3.1.1.5"},{"$f":"All!G153","v":"3.1.1.5: AGENT DUE DILIGENCE: AGENTS\nThe Agent Due Diligence policy should define procedures for vetting agents, whether they are engaged directly by the provider or via master agents. In the case that agents are engaged via master agents, the provider's contract should ensure that the master agents carry out the same level of vetting on the agents.\n\nThe following due diligence should be carried out on agents:\n- Identification of owners and managers of agents - full name, address, date of birth;\n- Certificate of trading or tax certificate or similar business entity document (if required by regulation or risk assessment).\n\nIf feasible, a good practice to consider is to take a photo of each agent location and map the GPS coordinates of the location.\n\nIf master agents are used, master agents should supply this due diligence information to the provider.\n\nAdditionally, the provider should carry out screening of the owners and managers of agents using domestic and international money laundering, terrorist financing, and sanctions watchlists. Screening should also be done against the provider's own blacklist of individuals known for fraud/ML/TF (refer to 2.5.3 and 5.3.10). Where \"possible matches\" are found, further ID should be obtained from the individual so that the match can be confirmed or discarded."},{"$f":"All!H153","v":"GSMA RMT (AG-02)"},{"$f":"All!I153","v":"3.1.1.5.1"},{"$f":"All!J153","v":"3.1.1.5.1: Is due diligence carried out on agents, including verifying the identity of their owners and managers (at minimum full name, address, and date of birth)?\n"},{"$f":"All!K153","v":"1) Agent Due Diligence Process\n- Check that there is a process to carry out due diligence on all  agents before they are activated.\n- Check that the process includes identification of all owners (>25% ownership) and managers of agents\n-Check that information captured on owners and senior management includes:\n     a) Full Name\n     b) Address\n     c) Date of birth "},{"$f":"All!L153","v":0},{"$f":"All!M153","v":"Urgent Required"},{"$f":"All!N153","v":"Required"},{"$f":"All!O153","v":"Agent"},{"$f":"All!P153","v":0},{"$f":"All!Q153","v":0},{"$f":"All!R153","v":0},{"$f":"All!S153","v":0},{"$f":"All!T153","v":0},{"$f":"All!U153","v":0},{"$f":"All!V153","v":0},{"$f":"All!W153","v":0},{"$f":"All!X153","v":0},{"$f":"All!Y153","v":0},{"$f":"All!Z153","v":0},{"$f":"All!AA153","v":0},{"$f":"All!AB153","v":0},{"$f":"All!AC153","v":0},{"$f":"All!AD153","v":0},{"$f":"All!AE153","v":0},{"$f":"All!AF153","v":0},{"$f":"All!AG153","v":0},{"$f":"All!AH153","v":0},{"$f":"All!AI153","v":0},{"$f":"All!AJ153","v":0},{"$f":"All!AK153","v":0},{"$f":"All!AL153","v":0},{"$f":"All!AM153","v":0},{"$f":"All!AN153","v":0},{"$f":"All!AO153","v":0},{"$f":"All!AP153","v":0},{"$f":"All!AQ153","v":0},{"$f":"All!AR153","v":0},{"$f":"All!AS153","v":0},{"$f":"All!AT153","v":0}]
[null,{"$f":"All!B154","v":"3"},{"$f":"All!C154","v":"3.1"},{"$f":"All!D154","v":"3.1.1"},{"$f":"All!E154","v":""},{"$f":"All!F154","v":"3.1.1.5"},{"$f":"All!G154","v":0},{"$f":"All!H154","v":0},{"$f":"All!I154","v":"3.1.1.5.2"},{"$f":"All!J154","v":"3.1.1.5.2: Are master agents contractually required to supply due diligence information on their agents to the provider?\n"},{"$f":"All!K154","v":"1) Agent due diligence process\n-Check that the process requires master agents to collect and supply due diligence information on their individual agents.\n\n2) Master agents contracts\n- Check master agents contract contains a clause requiring them to supply due diligence information on their individual agents."},{"$f":"All!L154","v":0},{"$f":"All!M154","v":"Standard Required"},{"$f":"All!N154","v":"Required"},{"$f":"All!O154","v":"Agent"},{"$f":"All!P154","v":0},{"$f":"All!Q154","v":0},{"$f":"All!R154","v":0},{"$f":"All!S154","v":0},{"$f":"All!T154","v":0},{"$f":"All!U154","v":0},{"$f":"All!V154","v":0},{"$f":"All!W154","v":0},{"$f":"All!X154","v":0},{"$f":"All!Y154","v":0},{"$f":"All!Z154","v":0},{"$f":"All!AA154","v":0},{"$f":"All!AB154","v":0},{"$f":"All!AC154","v":0},{"$f":"All!AD154","v":0},{"$f":"All!AE154","v":0},{"$f":"All!AF154","v":0},{"$f":"All!AG154","v":0},{"$f":"All!AH154","v":0},{"$f":"All!AI154","v":0},{"$f":"All!AJ154","v":0},{"$f":"All!AK154","v":0},{"$f":"All!AL154","v":0},{"$f":"All!AM154","v":0},{"$f":"All!AN154","v":0},{"$f":"All!AO154","v":0},{"$f":"All!AP154","v":0},{"$f":"All!AQ154","v":0},{"$f":"All!AR154","v":0},{"$f":"All!AS154","v":0},{"$f":"All!AT154","v":0}]
[null,{"$f":"All!B155","v":"3"},{"$f":"All!C155","v":"3.1"},{"$f":"All!D155","v":"3.1.1"},{"$f":"All!E155","v":""},{"$f":"All!F155","v":"3.1.1.5"},{"$f":"All!G155","v":0},{"$f":"All!H155","v":0},{"$f":"All!I155","v":"3.1.1.5.3"},{"$f":"All!J155","v":"3.1.1.5.3: Are owners of all agents screened using watchlists?\n"},{"$f":"All!K155","v":"1) Agent Due Diligence Process\n- Check that the process includes the screening of owners of individual agents against watch lists.\n- Check that the selected watch list include at a minimum the lists required for customer screening.\n- Check that the process include the identification and management of politically exposed persons."},{"$f":"All!L155","v":0},{"$f":"All!M155","v":"Standard Required"},{"$f":"All!N155","v":"Required"},{"$f":"All!O155","v":"Agent"},{"$f":"All!P155","v":0},{"$f":"All!Q155","v":0},{"$f":"All!R155","v":0},{"$f":"All!S155","v":0},{"$f":"All!T155","v":0},{"$f":"All!U155","v":0},{"$f":"All!V155","v":0},{"$f":"All!W155","v":0},{"$f":"All!X155","v":0},{"$f":"All!Y155","v":0},{"$f":"All!Z155","v":0},{"$f":"All!AA155","v":0},{"$f":"All!AB155","v":0},{"$f":"All!AC155","v":0},{"$f":"All!AD155","v":0},{"$f":"All!AE155","v":0},{"$f":"All!AF155","v":0},{"$f":"All!AG155","v":0},{"$f":"All!AH155","v":0},{"$f":"All!AI155","v":0},{"$f":"All!AJ155","v":0},{"$f":"All!AK155","v":0},{"$f":"All!AL155","v":0},{"$f":"All!AM155","v":0},{"$f":"All!AN155","v":0},{"$f":"All!AO155","v":0},{"$f":"All!AP155","v":0},{"$f":"All!AQ155","v":0},{"$f":"All!AR155","v":0},{"$f":"All!AS155","v":0},{"$f":"All!AT155","v":0}]
[null,{"$f":"All!B156","v":"3"},{"$f":"All!C156","v":"3.1"},{"$f":"All!D156","v":"3.1.1"},{"$f":"All!E156","v":""},{"$f":"All!F156","v":"3.1.1.5"},{"$f":"All!G156","v":0},{"$f":"All!H156","v":0},{"$f":"All!I156","v":"3.1.1.5.4"},{"$f":"All!J156","v":"3.1.1.5.4: Is a copy obtained of each agent's certificate of trading / tax certificate / similar business entity document (if required by regulation or risk assessment)?\n"},{"$f":"All!K156","v":0},{"$f":"All!L156","v":0},{"$f":"All!M156","v":"Recommended"},{"$f":"All!N156","v":"Recommended"},{"$f":"All!O156","v":"Agent"},{"$f":"All!P156","v":0},{"$f":"All!Q156","v":0},{"$f":"All!R156","v":0},{"$f":"All!S156","v":0},{"$f":"All!T156","v":0},{"$f":"All!U156","v":0},{"$f":"All!V156","v":0},{"$f":"All!W156","v":0},{"$f":"All!X156","v":0},{"$f":"All!Y156","v":0},{"$f":"All!Z156","v":0},{"$f":"All!AA156","v":0},{"$f":"All!AB156","v":0},{"$f":"All!AC156","v":0},{"$f":"All!AD156","v":0},{"$f":"All!AE156","v":0},{"$f":"All!AF156","v":0},{"$f":"All!AG156","v":0},{"$f":"All!AH156","v":0},{"$f":"All!AI156","v":0},{"$f":"All!AJ156","v":0},{"$f":"All!AK156","v":0},{"$f":"All!AL156","v":0},{"$f":"All!AM156","v":0},{"$f":"All!AN156","v":0},{"$f":"All!AO156","v":0},{"$f":"All!AP156","v":0},{"$f":"All!AQ156","v":0},{"$f":"All!AR156","v":0},{"$f":"All!AS156","v":0},{"$f":"All!AT156","v":0}]
[null,{"$f":"All!B157","v":"3"},{"$f":"All!C157","v":"3.1"},{"$f":"All!D157","v":"3.1.1"},{"$f":"All!E157","v":""},{"$f":"All!F157","v":"3.1.1.6"},{"$f":"All!G157","v":"3.1.1.6: AGENT DUE DILIGENCE FREQUENCY AND RECORDS\nDue diligence checks should be performed at intervals specified in the agent due diligence policy. This should be every two years at a minimum.\n\nThe provider should maintain the following agent due diligence records:\n- Records of agent due diligence conducted\n- Copies of all documentation collected during due diligence\nRecords should be kept for a period determined by regulation or risk assessment, whichever is longer. FATF recommends that records be kept for a minimum of five years, either physically or electronically (or both). "},{"$f":"All!H157","v":"GSMA RMT"},{"$f":"All!I157","v":"3.1.1.6.1"},{"$f":"All!J157","v":"3.1.1.6.1: Are due diligence checks performed on all agents every two years at a minimum?\n"},{"$f":"All!K157","v":0},{"$f":"All!L157","v":0},{"$f":"All!M157","v":"Recommended"},{"$f":"All!N157","v":"Recommended"},{"$f":"All!O157","v":"Agent"},{"$f":"All!P157","v":0},{"$f":"All!Q157","v":0},{"$f":"All!R157","v":0},{"$f":"All!S157","v":0},{"$f":"All!T157","v":0},{"$f":"All!U157","v":0},{"$f":"All!V157","v":0},{"$f":"All!W157","v":0},{"$f":"All!X157","v":0},{"$f":"All!Y157","v":0},{"$f":"All!Z157","v":0},{"$f":"All!AA157","v":0},{"$f":"All!AB157","v":0},{"$f":"All!AC157","v":0},{"$f":"All!AD157","v":0},{"$f":"All!AE157","v":0},{"$f":"All!AF157","v":0},{"$f":"All!AG157","v":0},{"$f":"All!AH157","v":0},{"$f":"All!AI157","v":0},{"$f":"All!AJ157","v":0},{"$f":"All!AK157","v":0},{"$f":"All!AL157","v":0},{"$f":"All!AM157","v":0},{"$f":"All!AN157","v":0},{"$f":"All!AO157","v":0},{"$f":"All!AP157","v":0},{"$f":"All!AQ157","v":0},{"$f":"All!AR157","v":0},{"$f":"All!AS157","v":0},{"$f":"All!AT157","v":0}]
[null,{"$f":"All!B158","v":"3"},{"$f":"All!C158","v":"3.1"},{"$f":"All!D158","v":"3.1.1"},{"$f":"All!E158","v":""},{"$f":"All!F158","v":"3.1.1.6"},{"$f":"All!G158","v":0},{"$f":"All!H158","v":0},{"$f":"All!I158","v":"3.1.1.6.2"},{"$f":"All!J158","v":"3.1.1.6.2: Are agent due diligence records kept for at least five years, including KYC records and records of due diligence conducted?\n"},{"$f":"All!K158","v":0},{"$f":"All!L158","v":0},{"$f":"All!M158","v":"Recommended"},{"$f":"All!N158","v":"Recommended"},{"$f":"All!O158","v":"Agent"},{"$f":"All!P158","v":0},{"$f":"All!Q158","v":0},{"$f":"All!R158","v":0},{"$f":"All!S158","v":0},{"$f":"All!T158","v":0},{"$f":"All!U158","v":0},{"$f":"All!V158","v":0},{"$f":"All!W158","v":0},{"$f":"All!X158","v":0},{"$f":"All!Y158","v":0},{"$f":"All!Z158","v":0},{"$f":"All!AA158","v":0},{"$f":"All!AB158","v":0},{"$f":"All!AC158","v":0},{"$f":"All!AD158","v":0},{"$f":"All!AE158","v":0},{"$f":"All!AF158","v":0},{"$f":"All!AG158","v":0},{"$f":"All!AH158","v":0},{"$f":"All!AI158","v":0},{"$f":"All!AJ158","v":0},{"$f":"All!AK158","v":0},{"$f":"All!AL158","v":0},{"$f":"All!AM158","v":0},{"$f":"All!AN158","v":0},{"$f":"All!AO158","v":0},{"$f":"All!AP158","v":0},{"$f":"All!AQ158","v":0},{"$f":"All!AR158","v":0},{"$f":"All!AS158","v":0},{"$f":"All!AT158","v":0}]
[null,{"$f":"All!B159","v":"3"},{"$f":"All!C159","v":"3.1"},{"$f":"All!D159","v":"3.1.1"},{"$f":"All!E159","v":""},{"$f":"All!F159","v":"3.1.1.7"},{"$f":"All!G159","v":"3.1.1.7: DUE DILIGENCE ON ENTITIES PROVIDING OUTSOURCED SERVICES\nProviders should carry out due diligence on entities providing outsourced services before they start operation and regularly thereafter (every two years at a minimum).\n\nThe due diligence requirements should be documented and regularly reviewed and updated as needed, such as when changes are made to the service or regulation. \n\nAt a minimum the following checks should be included:\n- The entity must be able to provide outsourced services effectively and reliably;\n- The entity should be qualified to provide the particular service: the provider should check appropriate documentation to confirm this;\n- The entity should have a good reputation: the provider could request client references to confirm this;\n- The entity should understand and be able to meet the provider’s objectives: this should be confirmed by written confirmation from the entity;\n- The entity should have proper risk management policies and controls in place: the provider should review the risk management documentation;\n- The entity should have the financial soundness to meet its obligations: Provider should check that the partner is financially solvent, with sufficient capital reserves to underwrite its level of operations.\n\nThe provider should maintain the following due diligence records:\n- Records of due diligence conducted on entities providing outsourced services;\n- Copies of all documentation collected during due diligence.\nRecords should be kept for a period determined by regulation or risk assessment, whichever is longer. FATF recommends that records be kept for a minimum of five years after termination, either physically or electronically (or both)."},{"$f":"All!H159","v":"GSMA RMT\nBCBS OFS"},{"$f":"All!I159","v":"3.1.1.7.1"},{"$f":"All!J159","v":"3.1.1.7.1: Is due diligence carried out on all entities providing outsourced services for core mobile money functions before they start operation?\n"},{"$f":"All!K159","v":"1) Outsourcing due diligence requirements, process or similar documentation \n- Check that due diligence requirements are documented for entities providing outsourced services for core mobile money functions.\n- Check that there is a process to perform due diligence on these outsourcing entities before their services become operational.\n"},{"$f":"All!L159","v":0},{"$f":"All!M159","v":"Urgent Required"},{"$f":"All!N159","v":"Required"},{"$f":"All!O159","v":"BizOps"},{"$f":"All!P159","v":0},{"$f":"All!Q159","v":0},{"$f":"All!R159","v":0},{"$f":"All!S159","v":0},{"$f":"All!T159","v":0},{"$f":"All!U159","v":0},{"$f":"All!V159","v":0},{"$f":"All!W159","v":0},{"$f":"All!X159","v":0},{"$f":"All!Y159","v":0},{"$f":"All!Z159","v":0},{"$f":"All!AA159","v":0},{"$f":"All!AB159","v":0},{"$f":"All!AC159","v":0},{"$f":"All!AD159","v":0},{"$f":"All!AE159","v":0},{"$f":"All!AF159","v":0},{"$f":"All!AG159","v":0},{"$f":"All!AH159","v":0},{"$f":"All!AI159","v":0},{"$f":"All!AJ159","v":0},{"$f":"All!AK159","v":0},{"$f":"All!AL159","v":0},{"$f":"All!AM159","v":0},{"$f":"All!AN159","v":0},{"$f":"All!AO159","v":0},{"$f":"All!AP159","v":0},{"$f":"All!AQ159","v":0},{"$f":"All!AR159","v":0},{"$f":"All!AS159","v":0},{"$f":"All!AT159","v":0}]
[null,{"$f":"All!B160","v":"3"},{"$f":"All!C160","v":"3.1"},{"$f":"All!D160","v":"3.1.1"},{"$f":"All!E160","v":""},{"$f":"All!F160","v":"3.1.1.7"},{"$f":"All!G160","v":0},{"$f":"All!H160","v":0},{"$f":"All!I160","v":"3.1.1.7.2"},{"$f":"All!J160","v":"3.1.1.7.2: Are checks done (e.g. review qualifications or documentation) to ensure that each entity providing outsourced services for core mobile money functions can provide its outsourced services effectively and reliably?\n"},{"$f":"All!K160","v":"1) Outsourcing due diligence requirements, process or similar documentation \n- Check that there is a process to ascertain that any outsourced entity carrying out core mobile money functions has appropriate skills to carry out the function effectively and reliably.\n"},{"$f":"All!L160","v":0},{"$f":"All!M160","v":"Standard Required"},{"$f":"All!N160","v":"Required"},{"$f":"All!O160","v":"BizOps"},{"$f":"All!P160","v":0},{"$f":"All!Q160","v":0},{"$f":"All!R160","v":0},{"$f":"All!S160","v":0},{"$f":"All!T160","v":0},{"$f":"All!U160","v":0},{"$f":"All!V160","v":0},{"$f":"All!W160","v":0},{"$f":"All!X160","v":0},{"$f":"All!Y160","v":0},{"$f":"All!Z160","v":0},{"$f":"All!AA160","v":0},{"$f":"All!AB160","v":0},{"$f":"All!AC160","v":0},{"$f":"All!AD160","v":0},{"$f":"All!AE160","v":0},{"$f":"All!AF160","v":0},{"$f":"All!AG160","v":0},{"$f":"All!AH160","v":0},{"$f":"All!AI160","v":0},{"$f":"All!AJ160","v":0},{"$f":"All!AK160","v":0},{"$f":"All!AL160","v":0},{"$f":"All!AM160","v":0},{"$f":"All!AN160","v":0},{"$f":"All!AO160","v":0},{"$f":"All!AP160","v":0},{"$f":"All!AQ160","v":0},{"$f":"All!AR160","v":0},{"$f":"All!AS160","v":0},{"$f":"All!AT160","v":0}]
[null,{"$f":"All!B161","v":"3"},{"$f":"All!C161","v":"3.1"},{"$f":"All!D161","v":"3.1.1"},{"$f":"All!E161","v":""},{"$f":"All!F161","v":"3.1.1.7"},{"$f":"All!G161","v":0},{"$f":"All!H161","v":0},{"$f":"All!I161","v":"3.1.1.7.3"},{"$f":"All!J161","v":"3.1.1.7.3: Are references checked to ensure that each entity providing outsourced services has a good reputation?\n"},{"$f":"All!K161","v":0},{"$f":"All!L161","v":0},{"$f":"All!M161","v":"Recommended"},{"$f":"All!N161","v":"Recommended"},{"$f":"All!O161","v":"BizOps"},{"$f":"All!P161","v":0},{"$f":"All!Q161","v":0},{"$f":"All!R161","v":0},{"$f":"All!S161","v":0},{"$f":"All!T161","v":0},{"$f":"All!U161","v":0},{"$f":"All!V161","v":0},{"$f":"All!W161","v":0},{"$f":"All!X161","v":0},{"$f":"All!Y161","v":0},{"$f":"All!Z161","v":0},{"$f":"All!AA161","v":0},{"$f":"All!AB161","v":0},{"$f":"All!AC161","v":0},{"$f":"All!AD161","v":0},{"$f":"All!AE161","v":0},{"$f":"All!AF161","v":0},{"$f":"All!AG161","v":0},{"$f":"All!AH161","v":0},{"$f":"All!AI161","v":0},{"$f":"All!AJ161","v":0},{"$f":"All!AK161","v":0},{"$f":"All!AL161","v":0},{"$f":"All!AM161","v":0},{"$f":"All!AN161","v":0},{"$f":"All!AO161","v":0},{"$f":"All!AP161","v":0},{"$f":"All!AQ161","v":0},{"$f":"All!AR161","v":0},{"$f":"All!AS161","v":0},{"$f":"All!AT161","v":0}]
[null,{"$f":"All!B162","v":"3"},{"$f":"All!C162","v":"3.1"},{"$f":"All!D162","v":"3.1.1"},{"$f":"All!E162","v":""},{"$f":"All!F162","v":"3.1.1.7"},{"$f":"All!G162","v":0},{"$f":"All!H162","v":0},{"$f":"All!I162","v":"3.1.1.7.4"},{"$f":"All!J162","v":"3.1.1.7.4: Are checks done to ensure that the entity providing outsourced services is financially solvent, with sufficient capital reserves to underwrite its level of operations?\n"},{"$f":"All!K162","v":0},{"$f":"All!L162","v":0},{"$f":"All!M162","v":"Recommended"},{"$f":"All!N162","v":"Recommended"},{"$f":"All!O162","v":"BizOps"},{"$f":"All!P162","v":0},{"$f":"All!Q162","v":0},{"$f":"All!R162","v":0},{"$f":"All!S162","v":0},{"$f":"All!T162","v":0},{"$f":"All!U162","v":0},{"$f":"All!V162","v":0},{"$f":"All!W162","v":0},{"$f":"All!X162","v":0},{"$f":"All!Y162","v":0},{"$f":"All!Z162","v":0},{"$f":"All!AA162","v":0},{"$f":"All!AB162","v":0},{"$f":"All!AC162","v":0},{"$f":"All!AD162","v":0},{"$f":"All!AE162","v":0},{"$f":"All!AF162","v":0},{"$f":"All!AG162","v":0},{"$f":"All!AH162","v":0},{"$f":"All!AI162","v":0},{"$f":"All!AJ162","v":0},{"$f":"All!AK162","v":0},{"$f":"All!AL162","v":0},{"$f":"All!AM162","v":0},{"$f":"All!AN162","v":0},{"$f":"All!AO162","v":0},{"$f":"All!AP162","v":0},{"$f":"All!AQ162","v":0},{"$f":"All!AR162","v":0},{"$f":"All!AS162","v":0},{"$f":"All!AT162","v":0}]
[null,{"$f":"All!B163","v":"3"},{"$f":"All!C163","v":"3.1"},{"$f":"All!D163","v":"3.1.1"},{"$f":"All!E163","v":""},{"$f":"All!F163","v":"3.1.1.7"},{"$f":"All!G163","v":0},{"$f":"All!H163","v":0},{"$f":"All!I163","v":"3.1.1.7.5"},{"$f":"All!J163","v":"3.1.1.7.5: Are due diligence checks performed on all entities providing outsourced services for core mobile money functions every two years at a minimum?\n"},{"$f":"All!K163","v":0},{"$f":"All!L163","v":0},{"$f":"All!M163","v":"Recommended"},{"$f":"All!N163","v":"Recommended"},{"$f":"All!O163","v":"BizOps"},{"$f":"All!P163","v":0},{"$f":"All!Q163","v":0},{"$f":"All!R163","v":0},{"$f":"All!S163","v":0},{"$f":"All!T163","v":0},{"$f":"All!U163","v":0},{"$f":"All!V163","v":0},{"$f":"All!W163","v":0},{"$f":"All!X163","v":0},{"$f":"All!Y163","v":0},{"$f":"All!Z163","v":0},{"$f":"All!AA163","v":0},{"$f":"All!AB163","v":0},{"$f":"All!AC163","v":0},{"$f":"All!AD163","v":0},{"$f":"All!AE163","v":0},{"$f":"All!AF163","v":0},{"$f":"All!AG163","v":0},{"$f":"All!AH163","v":0},{"$f":"All!AI163","v":0},{"$f":"All!AJ163","v":0},{"$f":"All!AK163","v":0},{"$f":"All!AL163","v":0},{"$f":"All!AM163","v":0},{"$f":"All!AN163","v":0},{"$f":"All!AO163","v":0},{"$f":"All!AP163","v":0},{"$f":"All!AQ163","v":0},{"$f":"All!AR163","v":0},{"$f":"All!AS163","v":0},{"$f":"All!AT163","v":0}]
[null,{"$f":"All!B164","v":"3"},{"$f":"All!C164","v":"3.1"},{"$f":"All!D164","v":"3.1.1"},{"$f":"All!E164","v":""},{"$f":"All!F164","v":"3.1.1.7"},{"$f":"All!G164","v":0},{"$f":"All!H164","v":0},{"$f":"All!I164","v":"3.1.1.7.6"},{"$f":"All!J164","v":"3.1.1.7.6: Are due diligence records for all entities providing outsourced services kept for at least five years after termination, including copies of all documentation collected and records of due diligence conducted?\n"},{"$f":"All!K164","v":0},{"$f":"All!L164","v":0},{"$f":"All!M164","v":"Recommended"},{"$f":"All!N164","v":"Recommended"},{"$f":"All!O164","v":"BizOps"},{"$f":"All!P164","v":0},{"$f":"All!Q164","v":0},{"$f":"All!R164","v":0},{"$f":"All!S164","v":0},{"$f":"All!T164","v":0},{"$f":"All!U164","v":0},{"$f":"All!V164","v":0},{"$f":"All!W164","v":0},{"$f":"All!X164","v":0},{"$f":"All!Y164","v":0},{"$f":"All!Z164","v":0},{"$f":"All!AA164","v":0},{"$f":"All!AB164","v":0},{"$f":"All!AC164","v":0},{"$f":"All!AD164","v":0},{"$f":"All!AE164","v":0},{"$f":"All!AF164","v":0},{"$f":"All!AG164","v":0},{"$f":"All!AH164","v":0},{"$f":"All!AI164","v":0},{"$f":"All!AJ164","v":0},{"$f":"All!AK164","v":0},{"$f":"All!AL164","v":0},{"$f":"All!AM164","v":0},{"$f":"All!AN164","v":0},{"$f":"All!AO164","v":0},{"$f":"All!AP164","v":0},{"$f":"All!AQ164","v":0},{"$f":"All!AR164","v":0},{"$f":"All!AS164","v":0},{"$f":"All!AT164","v":0}]
[null,{"$f":"All!B165","v":"3"},{"$f":"All!C165","v":"3.2"},{"$f":"All!D165","v":"3.2.1"},{"$f":"All!E165","v":"3.2.1: Providers shall develop and implement training programmes for staff"},{"$f":"All!F165","v":"3.2.1.1"},{"$f":"All!G165","v":"3.2.1.1: STAFF TRAINING: REQUIREMENTS / POLICY\nThe Provider should document training requirements for mobile money staff. Staff should receive relevant initial training and ongoing additional training as needed according to their role.\nThe training requirements should be regularly reviewed and updated as needed, such as when changes are made to the service or regulation.\n"},{"$f":"All!H165","v":"GSMA RMT"},{"$f":"All!I165","v":"3.2.1.1.1"},{"$f":"All!J165","v":"3.2.1.1.1: Is there documentation that describes the training requirements for mobile money staff (including initial and ongoing training), and is it regularly reviewed and updated as needed, such as when changes are made to the service or regulation?\n"},{"$f":"All!K165","v":"1) Staff training plan, training material or similar training documentation\n- Check the training requirements are documented for mobile money staff\n- Check the documents include:\n     a) Initial training \n     b) on-going training\n- Check there is a process to revise training requirements when required - for example when changes are made to the services, or to local regulations.\n"},{"$f":"All!L165","v":0},{"$f":"All!M165","v":"Standard Required"},{"$f":"All!N165","v":"Required"},{"$f":"All!O165","v":"BizOps"},{"$f":"All!P165","v":0},{"$f":"All!Q165","v":0},{"$f":"All!R165","v":0},{"$f":"All!S165","v":0},{"$f":"All!T165","v":0},{"$f":"All!U165","v":0},{"$f":"All!V165","v":0},{"$f":"All!W165","v":0},{"$f":"All!X165","v":0},{"$f":"All!Y165","v":0},{"$f":"All!Z165","v":0},{"$f":"All!AA165","v":0},{"$f":"All!AB165","v":0},{"$f":"All!AC165","v":0},{"$f":"All!AD165","v":0},{"$f":"All!AE165","v":0},{"$f":"All!AF165","v":0},{"$f":"All!AG165","v":0},{"$f":"All!AH165","v":0},{"$f":"All!AI165","v":0},{"$f":"All!AJ165","v":0},{"$f":"All!AK165","v":0},{"$f":"All!AL165","v":0},{"$f":"All!AM165","v":0},{"$f":"All!AN165","v":0},{"$f":"All!AO165","v":0},{"$f":"All!AP165","v":0},{"$f":"All!AQ165","v":0},{"$f":"All!AR165","v":0},{"$f":"All!AS165","v":0},{"$f":"All!AT165","v":0}]
[null,{"$f":"All!B166","v":"3"},{"$f":"All!C166","v":"3.2"},{"$f":"All!D166","v":"3.2.1"},{"$f":"All!E166","v":0},{"$f":"All!F166","v":"3.2.1.2"},{"$f":"All!G166","v":"3.2.1.2: STAFF TRAINING: PROCESS\nThe Provider should implement a process to train all new staff in mobile money and their role. The training should include, at a minimum:\n- the details of carrying out their role, the potential failure points and the implications for the business and its customers; and\n- the provider's mobile money business.\n\nRefresher training should be performed at intervals specified in the staff training policy. This should be every two years at a minimum. Training should also be conducted when staff change roles or when there are changes to the mobile money service that affect their role.\n\nWhen relevant to the role, staff should be trained in AML/CFT procedures and in anti-fraud measures (see 2.6.1)."},{"$f":"All!H166","v":"GSMA RMT"},{"$f":"All!I166","v":"3.2.1.2.1"},{"$f":"All!J166","v":"3.2.1.2.1: Are employees trained in (i) the details of carrying out their role, and (ii) the provider's mobile money business?\n"},{"$f":"All!K166","v":"1) Staff training plan, training material or similar training documentation\n- Check the staff training content includes:\na) details of carrying out their role\nb) the providers mobile money business\n\n\n"},{"$f":"All!L166","v":0},{"$f":"All!M166","v":"Urgent Required"},{"$f":"All!N166","v":"Required"},{"$f":"All!O166","v":"BizOps"},{"$f":"All!P166","v":0},{"$f":"All!Q166","v":0},{"$f":"All!R166","v":0},{"$f":"All!S166","v":0},{"$f":"All!T166","v":0},{"$f":"All!U166","v":0},{"$f":"All!V166","v":0},{"$f":"All!W166","v":0},{"$f":"All!X166","v":0},{"$f":"All!Y166","v":0},{"$f":"All!Z166","v":0},{"$f":"All!AA166","v":0},{"$f":"All!AB166","v":0},{"$f":"All!AC166","v":0},{"$f":"All!AD166","v":0},{"$f":"All!AE166","v":0},{"$f":"All!AF166","v":0},{"$f":"All!AG166","v":0},{"$f":"All!AH166","v":0},{"$f":"All!AI166","v":0},{"$f":"All!AJ166","v":0},{"$f":"All!AK166","v":0},{"$f":"All!AL166","v":0},{"$f":"All!AM166","v":0},{"$f":"All!AN166","v":0},{"$f":"All!AO166","v":0},{"$f":"All!AP166","v":0},{"$f":"All!AQ166","v":0},{"$f":"All!AR166","v":0},{"$f":"All!AS166","v":0},{"$f":"All!AT166","v":0}]
[null,{"$f":"All!B167","v":"3"},{"$f":"All!C167","v":"3.2"},{"$f":"All!D167","v":"3.2.1"},{"$f":"All!E167","v":""},{"$f":"All!F167","v":"3.2.1.2"},{"$f":"All!G167","v":0},{"$f":"All!H167","v":0},{"$f":"All!I167","v":"3.2.1.2.2"},{"$f":"All!J167","v":"3.2.1.2.2: Is refresher training (for mobile money and their specific role) performed for staff every two years at a minimum?\n"},{"$f":"All!K167","v":0},{"$f":"All!L167","v":0},{"$f":"All!M167","v":"Recommended"},{"$f":"All!N167","v":"Recommended"},{"$f":"All!O167","v":"BizOps"},{"$f":"All!P167","v":0},{"$f":"All!Q167","v":0},{"$f":"All!R167","v":0},{"$f":"All!S167","v":0},{"$f":"All!T167","v":0},{"$f":"All!U167","v":0},{"$f":"All!V167","v":0},{"$f":"All!W167","v":0},{"$f":"All!X167","v":0},{"$f":"All!Y167","v":0},{"$f":"All!Z167","v":0},{"$f":"All!AA167","v":0},{"$f":"All!AB167","v":0},{"$f":"All!AC167","v":0},{"$f":"All!AD167","v":0},{"$f":"All!AE167","v":0},{"$f":"All!AF167","v":0},{"$f":"All!AG167","v":0},{"$f":"All!AH167","v":0},{"$f":"All!AI167","v":0},{"$f":"All!AJ167","v":0},{"$f":"All!AK167","v":0},{"$f":"All!AL167","v":0},{"$f":"All!AM167","v":0},{"$f":"All!AN167","v":0},{"$f":"All!AO167","v":0},{"$f":"All!AP167","v":0},{"$f":"All!AQ167","v":0},{"$f":"All!AR167","v":0},{"$f":"All!AS167","v":0},{"$f":"All!AT167","v":0}]
[null,{"$f":"All!B168","v":"3"},{"$f":"All!C168","v":"3.2"},{"$f":"All!D168","v":"3.2.1"},{"$f":"All!E168","v":""},{"$f":"All!F168","v":"3.2.1.2"},{"$f":"All!G168","v":0},{"$f":"All!H168","v":0},{"$f":"All!I168","v":"3.2.1.2.3"},{"$f":"All!J168","v":"3.2.1.2.3: Is training conducted when staff change roles and when there are changes to the mobile money service that affect their role?\n"},{"$f":"All!K168","v":0},{"$f":"All!L168","v":0},{"$f":"All!M168","v":"Recommended"},{"$f":"All!N168","v":"Recommended"},{"$f":"All!O168","v":"BizOps"},{"$f":"All!P168","v":0},{"$f":"All!Q168","v":0},{"$f":"All!R168","v":0},{"$f":"All!S168","v":0},{"$f":"All!T168","v":0},{"$f":"All!U168","v":0},{"$f":"All!V168","v":0},{"$f":"All!W168","v":0},{"$f":"All!X168","v":0},{"$f":"All!Y168","v":0},{"$f":"All!Z168","v":0},{"$f":"All!AA168","v":0},{"$f":"All!AB168","v":0},{"$f":"All!AC168","v":0},{"$f":"All!AD168","v":0},{"$f":"All!AE168","v":0},{"$f":"All!AF168","v":0},{"$f":"All!AG168","v":0},{"$f":"All!AH168","v":0},{"$f":"All!AI168","v":0},{"$f":"All!AJ168","v":0},{"$f":"All!AK168","v":0},{"$f":"All!AL168","v":0},{"$f":"All!AM168","v":0},{"$f":"All!AN168","v":0},{"$f":"All!AO168","v":0},{"$f":"All!AP168","v":0},{"$f":"All!AQ168","v":0},{"$f":"All!AR168","v":0},{"$f":"All!AS168","v":0},{"$f":"All!AT168","v":0}]
[null,{"$f":"All!B169","v":"3"},{"$f":"All!C169","v":"3.2"},{"$f":"All!D169","v":"3.2.1"},{"$f":"All!E169","v":""},{"$f":"All!F169","v":"3.2.1.3"},{"$f":"All!G169","v":"3.2.1.3: STAFF TRAINING: RECORDS\nThe provider should maintain records of all staff training conducted. Records should be kept for a period determined by regulation or risk assessment, whichever is longer. Records should be kept physically or electronically (or both). "},{"$f":"All!H169","v":"GSMA RMT"},{"$f":"All!I169","v":"3.2.1.3.1"},{"$f":"All!J169","v":"3.2.1.3.1: Are all employees trained and are all training records kept for a suitable period?\n"},{"$f":"All!K169","v":"1) Training records\n- Check records kept include:\n      a) Name of employee/unique ID\n      b) Training received\n      c) Assessment score (if any test is administered)\n      d) Date training completed\n- Check there is a timeline for the storage of the records.\n- Check records are aligned with the training plan.\n"},{"$f":"All!L169","v":0},{"$f":"All!M169","v":"Standard Required"},{"$f":"All!N169","v":"Required"},{"$f":"All!O169","v":"BizOps"},{"$f":"All!P169","v":0},{"$f":"All!Q169","v":0},{"$f":"All!R169","v":0},{"$f":"All!S169","v":0},{"$f":"All!T169","v":0},{"$f":"All!U169","v":0},{"$f":"All!V169","v":0},{"$f":"All!W169","v":0},{"$f":"All!X169","v":0},{"$f":"All!Y169","v":0},{"$f":"All!Z169","v":0},{"$f":"All!AA169","v":0},{"$f":"All!AB169","v":0},{"$f":"All!AC169","v":0},{"$f":"All!AD169","v":0},{"$f":"All!AE169","v":0},{"$f":"All!AF169","v":0},{"$f":"All!AG169","v":0},{"$f":"All!AH169","v":0},{"$f":"All!AI169","v":0},{"$f":"All!AJ169","v":0},{"$f":"All!AK169","v":0},{"$f":"All!AL169","v":0},{"$f":"All!AM169","v":0},{"$f":"All!AN169","v":0},{"$f":"All!AO169","v":0},{"$f":"All!AP169","v":0},{"$f":"All!AQ169","v":0},{"$f":"All!AR169","v":0},{"$f":"All!AS169","v":0},{"$f":"All!AT169","v":0}]
[null,{"$f":"All!B170","v":"3"},{"$f":"All!C170","v":"3.2"},{"$f":"All!D170","v":"3.2.2"},{"$f":"All!E170","v":"3.2.2: Providers shall develop and implement training programmes for agents"},{"$f":"All!F170","v":"3.2.2.1"},{"$f":"All!G170","v":"3.2.2.1: TRAINING FOR AGENTS: REQUIREMENTS / POLICY\nThe provider should document a policy to carry out training of mobile money agents before their engagement and regularly thereafter. The agent training policy should be regularly reviewed and updated as needed, such as when changes are made to the service or regulation. "},{"$f":"All!H170","v":"GSMA RMT"},{"$f":"All!I170","v":"3.2.2.1.1"},{"$f":"All!J170","v":"3.2.2.1.1: Is there documentation that describes the training requirements for mobile money agents (including initial and ongoing training), and is it regularly reviewed and updated as needed, such as when changes are made to the service or regulation?\n"},{"$f":"All!K170","v":"1) Agent training plan, training material or similar training documentation\n- Check that training requirements are documented for agents\n- Check that the document includes:\n     a) Initial training \n     b) On-going training\n- Check that there is a process to revise training requirements when required - for example when changes are main to the services, or local regulations\n"},{"$f":"All!L170","v":0},{"$f":"All!M170","v":"Urgent Required"},{"$f":"All!N170","v":"Required"},{"$f":"All!O170","v":"Agent"},{"$f":"All!P170","v":0},{"$f":"All!Q170","v":0},{"$f":"All!R170","v":0},{"$f":"All!S170","v":0},{"$f":"All!T170","v":0},{"$f":"All!U170","v":0},{"$f":"All!V170","v":0},{"$f":"All!W170","v":0},{"$f":"All!X170","v":0},{"$f":"All!Y170","v":0},{"$f":"All!Z170","v":0},{"$f":"All!AA170","v":0},{"$f":"All!AB170","v":0},{"$f":"All!AC170","v":0},{"$f":"All!AD170","v":0},{"$f":"All!AE170","v":0},{"$f":"All!AF170","v":0},{"$f":"All!AG170","v":0},{"$f":"All!AH170","v":0},{"$f":"All!AI170","v":0},{"$f":"All!AJ170","v":0},{"$f":"All!AK170","v":0},{"$f":"All!AL170","v":0},{"$f":"All!AM170","v":0},{"$f":"All!AN170","v":0},{"$f":"All!AO170","v":0},{"$f":"All!AP170","v":0},{"$f":"All!AQ170","v":0},{"$f":"All!AR170","v":0},{"$f":"All!AS170","v":0},{"$f":"All!AT170","v":0}]
[null,{"$f":"All!B171","v":"3"},{"$f":"All!C171","v":"3.2"},{"$f":"All!D171","v":"3.2.2"},{"$f":"All!E171","v":0},{"$f":"All!F171","v":"3.2.2.2"},{"$f":"All!G171","v":"3.2.2.2: TRAINING FOR AGENTS: PROCESS\nThe Provider should implement a process to ensure all agents are trained. The training should include, at a minimum:\n- Liquidity management (see definition);\n- How to facilitate customer transactions;\n- AML/CFT procedures (see 2.6.1.1.2);\n- Anti-fraud measures (see 5.3.10.2);\n- Disclosure of fees; and\n- How to inform customers of their rights in the event of a complaint (see 7.1.2.1).\n\nProviders should monitor agents to ensure they are properly trained and to identify areas where further support is required (refer to 3.4). Refresher training should be performed at intervals specified in the agent training policy, and every two years at a minimum.\n\nTraining of all agents should also be conducted when there are changes to the mobile money service that affect agents."},{"$f":"All!H171","v":"ISO 27015:2012 Sec. 12.1\nGSMA RMT (AG-08,\nAG-10,\nAG-11,\nAG-14,\nAG-17)"},{"$f":"All!I171","v":"3.2.2.2.1"},{"$f":"All!J171","v":"3.2.2.2.1: Are agents trained in the important aspects of operating as a mobile money agent, such as liquidity management (see definition), carrying out customer transactions, and key security measures?\n"},{"$f":"All!K171","v":"1) Agent training plan, training material or similar training documentation\n- Check that the training content includes important aspects of operating as a mobile money agent such as liquidity management, customer registration (if applicable), cash in/out, etc.\n"},{"$f":"All!L171","v":0},{"$f":"All!M171","v":"Urgent Required"},{"$f":"All!N171","v":"Required"},{"$f":"All!O171","v":"Agent"},{"$f":"All!P171","v":0},{"$f":"All!Q171","v":0},{"$f":"All!R171","v":0},{"$f":"All!S171","v":0},{"$f":"All!T171","v":0},{"$f":"All!U171","v":0},{"$f":"All!V171","v":0},{"$f":"All!W171","v":0},{"$f":"All!X171","v":0},{"$f":"All!Y171","v":0},{"$f":"All!Z171","v":0},{"$f":"All!AA171","v":0},{"$f":"All!AB171","v":0},{"$f":"All!AC171","v":0},{"$f":"All!AD171","v":0},{"$f":"All!AE171","v":0},{"$f":"All!AF171","v":0},{"$f":"All!AG171","v":0},{"$f":"All!AH171","v":0},{"$f":"All!AI171","v":0},{"$f":"All!AJ171","v":0},{"$f":"All!AK171","v":0},{"$f":"All!AL171","v":0},{"$f":"All!AM171","v":0},{"$f":"All!AN171","v":0},{"$f":"All!AO171","v":0},{"$f":"All!AP171","v":0},{"$f":"All!AQ171","v":0},{"$f":"All!AR171","v":0},{"$f":"All!AS171","v":0},{"$f":"All!AT171","v":0}]
[null,{"$f":"All!B172","v":"3"},{"$f":"All!C172","v":"3.2"},{"$f":"All!D172","v":"3.2.2"},{"$f":"All!E172","v":""},{"$f":"All!F172","v":"3.2.2.2"},{"$f":"All!G172","v":0},{"$f":"All!H172","v":0},{"$f":"All!I172","v":"3.2.2.2.2"},{"$f":"All!J172","v":"3.2.2.2.2: Are agents trained in disclosure of fees?\n"},{"$f":"All!K172","v":0},{"$f":"All!L172","v":0},{"$f":"All!M172","v":"Recommended"},{"$f":"All!N172","v":"Recommended"},{"$f":"All!O172","v":"Agent"},{"$f":"All!P172","v":0},{"$f":"All!Q172","v":0},{"$f":"All!R172","v":0},{"$f":"All!S172","v":0},{"$f":"All!T172","v":0},{"$f":"All!U172","v":0},{"$f":"All!V172","v":0},{"$f":"All!W172","v":0},{"$f":"All!X172","v":0},{"$f":"All!Y172","v":0},{"$f":"All!Z172","v":0},{"$f":"All!AA172","v":0},{"$f":"All!AB172","v":0},{"$f":"All!AC172","v":0},{"$f":"All!AD172","v":0},{"$f":"All!AE172","v":0},{"$f":"All!AF172","v":0},{"$f":"All!AG172","v":0},{"$f":"All!AH172","v":0},{"$f":"All!AI172","v":0},{"$f":"All!AJ172","v":0},{"$f":"All!AK172","v":0},{"$f":"All!AL172","v":0},{"$f":"All!AM172","v":0},{"$f":"All!AN172","v":0},{"$f":"All!AO172","v":0},{"$f":"All!AP172","v":0},{"$f":"All!AQ172","v":0},{"$f":"All!AR172","v":0},{"$f":"All!AS172","v":0},{"$f":"All!AT172","v":0}]
[null,{"$f":"All!B173","v":"3"},{"$f":"All!C173","v":"3.2"},{"$f":"All!D173","v":"3.2.2"},{"$f":"All!E173","v":""},{"$f":"All!F173","v":"3.2.2.2"},{"$f":"All!G173","v":0},{"$f":"All!H173","v":0},{"$f":"All!I173","v":"3.2.2.2.3"},{"$f":"All!J173","v":"3.2.2.2.3: Is refresher training performed at least every two years and whenever there are changes to the mobile money service that affect agents?\n"},{"$f":"All!K173","v":0},{"$f":"All!L173","v":0},{"$f":"All!M173","v":"Recommended"},{"$f":"All!N173","v":"Recommended"},{"$f":"All!O173","v":"Agent"},{"$f":"All!P173","v":0},{"$f":"All!Q173","v":0},{"$f":"All!R173","v":0},{"$f":"All!S173","v":0},{"$f":"All!T173","v":0},{"$f":"All!U173","v":0},{"$f":"All!V173","v":0},{"$f":"All!W173","v":0},{"$f":"All!X173","v":0},{"$f":"All!Y173","v":0},{"$f":"All!Z173","v":0},{"$f":"All!AA173","v":0},{"$f":"All!AB173","v":0},{"$f":"All!AC173","v":0},{"$f":"All!AD173","v":0},{"$f":"All!AE173","v":0},{"$f":"All!AF173","v":0},{"$f":"All!AG173","v":0},{"$f":"All!AH173","v":0},{"$f":"All!AI173","v":0},{"$f":"All!AJ173","v":0},{"$f":"All!AK173","v":0},{"$f":"All!AL173","v":0},{"$f":"All!AM173","v":0},{"$f":"All!AN173","v":0},{"$f":"All!AO173","v":0},{"$f":"All!AP173","v":0},{"$f":"All!AQ173","v":0},{"$f":"All!AR173","v":0},{"$f":"All!AS173","v":0},{"$f":"All!AT173","v":0}]
[null,{"$f":"All!B174","v":"3"},{"$f":"All!C174","v":"3.2"},{"$f":"All!D174","v":"3.2.2"},{"$f":"All!E174","v":""},{"$f":"All!F174","v":"3.2.2.3"},{"$f":"All!G174","v":"3.2.2.3: TRAINING FOR AGENTS: RECORDS\nThe provider should maintain records of all agent training conducted. Records should be kept for a period determined by regulation or risk assessment, whichever is longer. Records should be kept physically or electronically (or both). \n"},{"$f":"All!H174","v":"GSMA RMT"},{"$f":"All!I174","v":"3.2.2.3.1"},{"$f":"All!J174","v":"3.2.2.3.1: Are all agents trained and are all training records kept for a suitable period?\n"},{"$f":"All!K174","v":"1) Training records\n- Check records kept include:\n      a) Name of agent/unique ID\n      b) Training received\n      c) Assessment score (if any test is administered)\n      d) Date training completed\n- Check there is a timeline for the storage of the records.\n- Check records are aligned with the training plan.\n"},{"$f":"All!L174","v":0},{"$f":"All!M174","v":"Standard Required"},{"$f":"All!N174","v":"Required"},{"$f":"All!O174","v":"Agent"},{"$f":"All!P174","v":0},{"$f":"All!Q174","v":0},{"$f":"All!R174","v":0},{"$f":"All!S174","v":0},{"$f":"All!T174","v":0},{"$f":"All!U174","v":0},{"$f":"All!V174","v":0},{"$f":"All!W174","v":0},{"$f":"All!X174","v":0},{"$f":"All!Y174","v":0},{"$f":"All!Z174","v":0},{"$f":"All!AA174","v":0},{"$f":"All!AB174","v":0},{"$f":"All!AC174","v":0},{"$f":"All!AD174","v":0},{"$f":"All!AE174","v":0},{"$f":"All!AF174","v":0},{"$f":"All!AG174","v":0},{"$f":"All!AH174","v":0},{"$f":"All!AI174","v":0},{"$f":"All!AJ174","v":0},{"$f":"All!AK174","v":0},{"$f":"All!AL174","v":0},{"$f":"All!AM174","v":0},{"$f":"All!AN174","v":0},{"$f":"All!AO174","v":0},{"$f":"All!AP174","v":0},{"$f":"All!AQ174","v":0},{"$f":"All!AR174","v":0},{"$f":"All!AS174","v":0},{"$f":"All!AT174","v":0}]
[null,{"$f":"All!B175","v":"3"},{"$f":"All!C175","v":"3.3"},{"$f":"All!D175","v":"3.3.1"},{"$f":"All!E175","v":"3.3.1: Providers shall establish written agreements governing their relationship with agents and entities providing outsourced services."},{"$f":"All!F175","v":"3.3.1.1"},{"$f":"All!G175","v":"3.3.1.1: AGENT AGREEMENTS\nContractual agreements should be established with all agents, either directly or through master agents or agent aggregators. Agreements should ensure that the responsibilities and expectations of providers and agents are clearly established. The following topics should be included:\n- A list of the functions to be provided by agent (e.g. registration, cash-in, cash-out).\n- Expected service levels from agent and the service level of provider's system (which may include scheduled downtime) (see definition).\n- Contractual liabilities of the respective parties with respect to fraud/forgery, cash and mobile money security, physical security, customer data security, and other relevant matters.\n- Stipulation that provider must have access to all data related to the activities conducted by the agent on behalf of the provider (such as written records of transactions, customer identification data etc.), and clarification of the ownership of such data.\n- Barring of discriminatory practices - all customers should be served equally."},{"$f":"All!H175","v":"ECB RSMP \nBCBS OFS\nGSMA RMT\n(CON-05, CON-06, CON-09, CON-10, CON-13, CON-14)"},{"$f":"All!I175","v":"3.3.1.1.1"},{"$f":"All!J175","v":"3.3.1.1.1: Are contractual agreements in place with all agents, either directly or through master agents or agent aggregators?\n"},{"$f":"All!K175","v":"1) Sample agent contract or standard contract template.\n2) Sample master agent contract / agent aggregator contract or template contract.\n\n- Check that a suitable contract exists for agents.\n- Check that a suitable contract exists for master agents and agent aggregators (if applicable).\n"},{"$f":"All!L175","v":0},{"$f":"All!M175","v":"Urgent Required"},{"$f":"All!N175","v":"Required"},{"$f":"All!O175","v":"Agent"},{"$f":"All!P175","v":0},{"$f":"All!Q175","v":0},{"$f":"All!R175","v":0},{"$f":"All!S175","v":0},{"$f":"All!T175","v":0},{"$f":"All!U175","v":0},{"$f":"All!V175","v":0},{"$f":"All!W175","v":0},{"$f":"All!X175","v":0},{"$f":"All!Y175","v":0},{"$f":"All!Z175","v":0},{"$f":"All!AA175","v":0},{"$f":"All!AB175","v":0},{"$f":"All!AC175","v":0},{"$f":"All!AD175","v":0},{"$f":"All!AE175","v":0},{"$f":"All!AF175","v":0},{"$f":"All!AG175","v":0},{"$f":"All!AH175","v":0},{"$f":"All!AI175","v":0},{"$f":"All!AJ175","v":0},{"$f":"All!AK175","v":0},{"$f":"All!AL175","v":0},{"$f":"All!AM175","v":0},{"$f":"All!AN175","v":0},{"$f":"All!AO175","v":0},{"$f":"All!AP175","v":0},{"$f":"All!AQ175","v":0},{"$f":"All!AR175","v":0},{"$f":"All!AS175","v":0},{"$f":"All!AT175","v":0}]
[null,{"$f":"All!B176","v":"3"},{"$f":"All!C176","v":"3.3"},{"$f":"All!D176","v":"3.3.1"},{"$f":"All!E176","v":0},{"$f":"All!F176","v":"3.3.1.1"},{"$f":"All!G176","v":0},{"$f":"All!H176","v":0},{"$f":"All!I176","v":"3.3.1.1.2"},{"$f":"All!J176","v":"3.3.1.1.2: Do agent agreements include (i) a list of the functions to be provided by the agent and (ii) the expected service levels from the agent and provider (see definition)?\n"},{"$f":"All!K176","v":0},{"$f":"All!L176","v":0},{"$f":"All!M176","v":"Recommended"},{"$f":"All!N176","v":"Recommended"},{"$f":"All!O176","v":"Agent"},{"$f":"All!P176","v":0},{"$f":"All!Q176","v":0},{"$f":"All!R176","v":0},{"$f":"All!S176","v":0},{"$f":"All!T176","v":0},{"$f":"All!U176","v":0},{"$f":"All!V176","v":0},{"$f":"All!W176","v":0},{"$f":"All!X176","v":0},{"$f":"All!Y176","v":0},{"$f":"All!Z176","v":0},{"$f":"All!AA176","v":0},{"$f":"All!AB176","v":0},{"$f":"All!AC176","v":0},{"$f":"All!AD176","v":0},{"$f":"All!AE176","v":0},{"$f":"All!AF176","v":0},{"$f":"All!AG176","v":0},{"$f":"All!AH176","v":0},{"$f":"All!AI176","v":0},{"$f":"All!AJ176","v":0},{"$f":"All!AK176","v":0},{"$f":"All!AL176","v":0},{"$f":"All!AM176","v":0},{"$f":"All!AN176","v":0},{"$f":"All!AO176","v":0},{"$f":"All!AP176","v":0},{"$f":"All!AQ176","v":0},{"$f":"All!AR176","v":0},{"$f":"All!AS176","v":0},{"$f":"All!AT176","v":0}]
[null,{"$f":"All!B177","v":"3"},{"$f":"All!C177","v":"3.3"},{"$f":"All!D177","v":"3.3.1"},{"$f":"All!E177","v":0},{"$f":"All!F177","v":"3.3.1.1"},{"$f":"All!G177","v":0},{"$f":"All!H177","v":0},{"$f":"All!I177","v":"3.3.1.1.3"},{"$f":"All!J177","v":"3.3.1.1.3: Do agent agreements specify contractual liabilities with respect to fraud/forgery, cash and mobile money security, physical security, and customer data security?\n"},{"$f":"All!K177","v":0},{"$f":"All!L177","v":0},{"$f":"All!M177","v":"Recommended"},{"$f":"All!N177","v":"Recommended"},{"$f":"All!O177","v":"Agent"},{"$f":"All!P177","v":0},{"$f":"All!Q177","v":0},{"$f":"All!R177","v":0},{"$f":"All!S177","v":0},{"$f":"All!T177","v":0},{"$f":"All!U177","v":0},{"$f":"All!V177","v":0},{"$f":"All!W177","v":0},{"$f":"All!X177","v":0},{"$f":"All!Y177","v":0},{"$f":"All!Z177","v":0},{"$f":"All!AA177","v":0},{"$f":"All!AB177","v":0},{"$f":"All!AC177","v":0},{"$f":"All!AD177","v":0},{"$f":"All!AE177","v":0},{"$f":"All!AF177","v":0},{"$f":"All!AG177","v":0},{"$f":"All!AH177","v":0},{"$f":"All!AI177","v":0},{"$f":"All!AJ177","v":0},{"$f":"All!AK177","v":0},{"$f":"All!AL177","v":0},{"$f":"All!AM177","v":0},{"$f":"All!AN177","v":0},{"$f":"All!AO177","v":0},{"$f":"All!AP177","v":0},{"$f":"All!AQ177","v":0},{"$f":"All!AR177","v":0},{"$f":"All!AS177","v":0},{"$f":"All!AT177","v":0}]
[null,{"$f":"All!B178","v":"3"},{"$f":"All!C178","v":"3.3"},{"$f":"All!D178","v":"3.3.1"},{"$f":"All!E178","v":0},{"$f":"All!F178","v":"3.3.1.1"},{"$f":"All!G178","v":0},{"$f":"All!H178","v":0},{"$f":"All!I178","v":"3.3.1.1.4"},{"$f":"All!J178","v":"3.3.1.1.4: Do agent agreements stipulate that provider must have access to all data related to the activities conducted by the agent on behalf of the provider (such as written records of transactions, customer identification data etc.) and clarify the ownership of such data?\n"},{"$f":"All!K178","v":0},{"$f":"All!L178","v":0},{"$f":"All!M178","v":"Recommended"},{"$f":"All!N178","v":"Recommended"},{"$f":"All!O178","v":"Agent"},{"$f":"All!P178","v":0},{"$f":"All!Q178","v":0},{"$f":"All!R178","v":0},{"$f":"All!S178","v":0},{"$f":"All!T178","v":0},{"$f":"All!U178","v":0},{"$f":"All!V178","v":0},{"$f":"All!W178","v":0},{"$f":"All!X178","v":0},{"$f":"All!Y178","v":0},{"$f":"All!Z178","v":0},{"$f":"All!AA178","v":0},{"$f":"All!AB178","v":0},{"$f":"All!AC178","v":0},{"$f":"All!AD178","v":0},{"$f":"All!AE178","v":0},{"$f":"All!AF178","v":0},{"$f":"All!AG178","v":0},{"$f":"All!AH178","v":0},{"$f":"All!AI178","v":0},{"$f":"All!AJ178","v":0},{"$f":"All!AK178","v":0},{"$f":"All!AL178","v":0},{"$f":"All!AM178","v":0},{"$f":"All!AN178","v":0},{"$f":"All!AO178","v":0},{"$f":"All!AP178","v":0},{"$f":"All!AQ178","v":0},{"$f":"All!AR178","v":0},{"$f":"All!AS178","v":0},{"$f":"All!AT178","v":0}]
[null,{"$f":"All!B179","v":"3"},{"$f":"All!C179","v":"3.3"},{"$f":"All!D179","v":"3.3.1"},{"$f":"All!E179","v":0},{"$f":"All!F179","v":"3.3.1.1"},{"$f":"All!G179","v":0},{"$f":"All!H179","v":0},{"$f":"All!I179","v":"3.3.1.1.5"},{"$f":"All!J179","v":"3.3.1.1.5: Do agent agreements bar discriminatory practices, meaning that all customers should be served equally?\n"},{"$f":"All!K179","v":0},{"$f":"All!L179","v":0},{"$f":"All!M179","v":"Recommended"},{"$f":"All!N179","v":"Recommended"},{"$f":"All!O179","v":"Agent"},{"$f":"All!P179","v":0},{"$f":"All!Q179","v":0},{"$f":"All!R179","v":0},{"$f":"All!S179","v":0},{"$f":"All!T179","v":0},{"$f":"All!U179","v":0},{"$f":"All!V179","v":0},{"$f":"All!W179","v":0},{"$f":"All!X179","v":0},{"$f":"All!Y179","v":0},{"$f":"All!Z179","v":0},{"$f":"All!AA179","v":0},{"$f":"All!AB179","v":0},{"$f":"All!AC179","v":0},{"$f":"All!AD179","v":0},{"$f":"All!AE179","v":0},{"$f":"All!AF179","v":0},{"$f":"All!AG179","v":0},{"$f":"All!AH179","v":0},{"$f":"All!AI179","v":0},{"$f":"All!AJ179","v":0},{"$f":"All!AK179","v":0},{"$f":"All!AL179","v":0},{"$f":"All!AM179","v":0},{"$f":"All!AN179","v":0},{"$f":"All!AO179","v":0},{"$f":"All!AP179","v":0},{"$f":"All!AQ179","v":0},{"$f":"All!AR179","v":0},{"$f":"All!AS179","v":0},{"$f":"All!AT179","v":0}]
[null,{"$f":"All!B180","v":"3"},{"$f":"All!C180","v":"3.3"},{"$f":"All!D180","v":"3.3.1"},{"$f":"All!E180","v":""},{"$f":"All!F180","v":"3.3.1.2"},{"$f":"All!G180","v":"3.3.1.2: AGREEMENTS WITH ENTITIES PROVIDING OUTSOURCED SERVICES\nContractual agreements should be established with all entities providing outsourced services. Agreements should ensure that the responsibilities and expectations of providers and entities providing outsourced services are clearly established. \n\nThe following topics should be included:\n- Expected service levels from the entity providing outsourced services. Note that the SLA published to customers should take account of the operational SLA agreed with entities providing outsourced services (see 4.2).\n- Where appropriate, a requirement for entities providing outsourced services to conduct appropriate due diligence on their own staff.\n- Business continuity requirements (when appropriate - for example, if the mobile money system is outsourced);\n- Stipulation that provider must have access to all data related to the activities conducted by the entity providing outsourced services on behalf of the provider and clarification of the ownership of such data.\n"},{"$f":"All!H180","v":0},{"$f":"All!I180","v":"3.3.1.2.1"},{"$f":"All!J180","v":"3.3.1.2.1: Are the expected service levels defined for each entity providing material outsourced services?\n"},{"$f":"All!K180","v":"1) Contract document for each material outsourced service suppliers (e.g. MM platform provider)\n- Check that expected service levels are defined for all entities providing material outsourced services.\n"},{"$f":"All!L180","v":0},{"$f":"All!M180","v":"Urgent Required"},{"$f":"All!N180","v":"Required"},{"$f":"All!O180","v":"BizOps"},{"$f":"All!P180","v":0},{"$f":"All!Q180","v":0},{"$f":"All!R180","v":0},{"$f":"All!S180","v":0},{"$f":"All!T180","v":0},{"$f":"All!U180","v":0},{"$f":"All!V180","v":0},{"$f":"All!W180","v":0},{"$f":"All!X180","v":0},{"$f":"All!Y180","v":0},{"$f":"All!Z180","v":0},{"$f":"All!AA180","v":0},{"$f":"All!AB180","v":0},{"$f":"All!AC180","v":0},{"$f":"All!AD180","v":0},{"$f":"All!AE180","v":0},{"$f":"All!AF180","v":0},{"$f":"All!AG180","v":0},{"$f":"All!AH180","v":0},{"$f":"All!AI180","v":0},{"$f":"All!AJ180","v":0},{"$f":"All!AK180","v":0},{"$f":"All!AL180","v":0},{"$f":"All!AM180","v":0},{"$f":"All!AN180","v":0},{"$f":"All!AO180","v":0},{"$f":"All!AP180","v":0},{"$f":"All!AQ180","v":0},{"$f":"All!AR180","v":0},{"$f":"All!AS180","v":0},{"$f":"All!AT180","v":0}]
[null,{"$f":"All!B181","v":"3"},{"$f":"All!C181","v":"3.3"},{"$f":"All!D181","v":"3.3.1"},{"$f":"All!E181","v":""},{"$f":"All!F181","v":"3.3.1.2"},{"$f":"All!G181","v":0},{"$f":"All!H181","v":0},{"$f":"All!I181","v":"3.3.1.2.2"},{"$f":"All!J181","v":"3.3.1.2.2: Where appropriate, do agreements with entities providing outsourced services require them to conduct appropriate due diligence on their staff?\n"},{"$f":"All!K181","v":0},{"$f":"All!L181","v":0},{"$f":"All!M181","v":"Recommended"},{"$f":"All!N181","v":"Recommended"},{"$f":"All!O181","v":"BizOps"},{"$f":"All!P181","v":0},{"$f":"All!Q181","v":0},{"$f":"All!R181","v":0},{"$f":"All!S181","v":0},{"$f":"All!T181","v":0},{"$f":"All!U181","v":0},{"$f":"All!V181","v":0},{"$f":"All!W181","v":0},{"$f":"All!X181","v":0},{"$f":"All!Y181","v":0},{"$f":"All!Z181","v":0},{"$f":"All!AA181","v":0},{"$f":"All!AB181","v":0},{"$f":"All!AC181","v":0},{"$f":"All!AD181","v":0},{"$f":"All!AE181","v":0},{"$f":"All!AF181","v":0},{"$f":"All!AG181","v":0},{"$f":"All!AH181","v":0},{"$f":"All!AI181","v":0},{"$f":"All!AJ181","v":0},{"$f":"All!AK181","v":0},{"$f":"All!AL181","v":0},{"$f":"All!AM181","v":0},{"$f":"All!AN181","v":0},{"$f":"All!AO181","v":0},{"$f":"All!AP181","v":0},{"$f":"All!AQ181","v":0},{"$f":"All!AR181","v":0},{"$f":"All!AS181","v":0},{"$f":"All!AT181","v":0}]
[null,{"$f":"All!B182","v":"3"},{"$f":"All!C182","v":"3.3"},{"$f":"All!D182","v":"3.3.1"},{"$f":"All!E182","v":""},{"$f":"All!F182","v":"3.3.1.2"},{"$f":"All!G182","v":0},{"$f":"All!H182","v":0},{"$f":"All!I182","v":"3.3.1.2.3"},{"$f":"All!J182","v":"3.3.1.2.3: Where appropriate, do agreements with entities providing outsourced services address business continuity requirements?\n"},{"$f":"All!K182","v":0},{"$f":"All!L182","v":0},{"$f":"All!M182","v":"Recommended"},{"$f":"All!N182","v":"Recommended"},{"$f":"All!O182","v":"BizOps"},{"$f":"All!P182","v":0},{"$f":"All!Q182","v":0},{"$f":"All!R182","v":0},{"$f":"All!S182","v":0},{"$f":"All!T182","v":0},{"$f":"All!U182","v":0},{"$f":"All!V182","v":0},{"$f":"All!W182","v":0},{"$f":"All!X182","v":0},{"$f":"All!Y182","v":0},{"$f":"All!Z182","v":0},{"$f":"All!AA182","v":0},{"$f":"All!AB182","v":0},{"$f":"All!AC182","v":0},{"$f":"All!AD182","v":0},{"$f":"All!AE182","v":0},{"$f":"All!AF182","v":0},{"$f":"All!AG182","v":0},{"$f":"All!AH182","v":0},{"$f":"All!AI182","v":0},{"$f":"All!AJ182","v":0},{"$f":"All!AK182","v":0},{"$f":"All!AL182","v":0},{"$f":"All!AM182","v":0},{"$f":"All!AN182","v":0},{"$f":"All!AO182","v":0},{"$f":"All!AP182","v":0},{"$f":"All!AQ182","v":0},{"$f":"All!AR182","v":0},{"$f":"All!AS182","v":0},{"$f":"All!AT182","v":0}]
[null,{"$f":"All!B183","v":"3"},{"$f":"All!C183","v":"3.3"},{"$f":"All!D183","v":"3.3.1"},{"$f":"All!E183","v":""},{"$f":"All!F183","v":"3.3.1.2"},{"$f":"All!G183","v":0},{"$f":"All!H183","v":0},{"$f":"All!I183","v":"3.3.1.2.4"},{"$f":"All!J183","v":"3.3.1.2.4: Do agreements with entities providing outsourced services (i) stipulate that the provider must have access to all data related to the activities conducted by the entity providing outsourced services on behalf of the provider and (ii) clarify the ownership of such data?\n"},{"$f":"All!K183","v":0},{"$f":"All!L183","v":0},{"$f":"All!M183","v":"Recommended"},{"$f":"All!N183","v":"Recommended"},{"$f":"All!O183","v":"BizOps"},{"$f":"All!P183","v":0},{"$f":"All!Q183","v":0},{"$f":"All!R183","v":0},{"$f":"All!S183","v":0},{"$f":"All!T183","v":0},{"$f":"All!U183","v":0},{"$f":"All!V183","v":0},{"$f":"All!W183","v":0},{"$f":"All!X183","v":0},{"$f":"All!Y183","v":0},{"$f":"All!Z183","v":0},{"$f":"All!AA183","v":0},{"$f":"All!AB183","v":0},{"$f":"All!AC183","v":0},{"$f":"All!AD183","v":0},{"$f":"All!AE183","v":0},{"$f":"All!AF183","v":0},{"$f":"All!AG183","v":0},{"$f":"All!AH183","v":0},{"$f":"All!AI183","v":0},{"$f":"All!AJ183","v":0},{"$f":"All!AK183","v":0},{"$f":"All!AL183","v":0},{"$f":"All!AM183","v":0},{"$f":"All!AN183","v":0},{"$f":"All!AO183","v":0},{"$f":"All!AP183","v":0},{"$f":"All!AQ183","v":0},{"$f":"All!AR183","v":0},{"$f":"All!AS183","v":0},{"$f":"All!AT183","v":0}]
[null,{"$f":"All!B184","v":"3"},{"$f":"All!C184","v":"3.3"},{"$f":"All!D184","v":"3.3.2"},{"$f":"All!E184","v":"3.3.2: Providers shall assume responsibility for actions taken on their behalf by their agents (and any sub-agents) under the provider-agent contract.\n"},{"$f":"All!F184","v":"3.3.2.1"},{"$f":"All!G184","v":"3.3.2.1: AGENT AGREEMENTS AND PROVIDER RESPONSIBILITY\nProviders shall assume responsibility for actions taken by their agents when acting on behalf of the provider. This includes all cases where the agents had actual (express or implied) or apparent authority to take the action in question on behalf of the provider.\n\nThis should be made clear in the provider's agreement with agents and customers.\n"},{"$f":"All!H184","v":0},{"$f":"All!I184","v":"3.3.2.1.1"},{"$f":"All!J184","v":"3.3.2.1.1: Does the provider's agreement with agents and customers make it clear that the provider assumes responsibility for actions taken by their agents when acting on behalf of the provider?\n"},{"$f":"All!K184","v":"1) Sample agent contract\n- Check that there is a clause that states the provider assumes responsibility for actions taken by the agent on behalf of the provider\n\n2) Sample of customer contract\n- Check that there is a clause that states the provider assumes responsibility for actions taken by an agent on behalf of the provider."},{"$f":"All!L184","v":0},{"$f":"All!M184","v":"Recommended"},{"$f":"All!N184","v":"Recommended"},{"$f":"All!O184","v":"Agent"},{"$f":"All!P184","v":0},{"$f":"All!Q184","v":0},{"$f":"All!R184","v":0},{"$f":"All!S184","v":0},{"$f":"All!T184","v":0},{"$f":"All!U184","v":0},{"$f":"All!V184","v":0},{"$f":"All!W184","v":0},{"$f":"All!X184","v":0},{"$f":"All!Y184","v":0},{"$f":"All!Z184","v":0},{"$f":"All!AA184","v":0},{"$f":"All!AB184","v":0},{"$f":"All!AC184","v":0},{"$f":"All!AD184","v":0},{"$f":"All!AE184","v":0},{"$f":"All!AF184","v":0},{"$f":"All!AG184","v":0},{"$f":"All!AH184","v":0},{"$f":"All!AI184","v":0},{"$f":"All!AJ184","v":0},{"$f":"All!AK184","v":0},{"$f":"All!AL184","v":0},{"$f":"All!AM184","v":0},{"$f":"All!AN184","v":0},{"$f":"All!AO184","v":0},{"$f":"All!AP184","v":0},{"$f":"All!AQ184","v":0},{"$f":"All!AR184","v":0},{"$f":"All!AS184","v":0},{"$f":"All!AT184","v":0}]
[null,{"$f":"All!B185","v":"3"},{"$f":"All!C185","v":"3.3"},{"$f":"All!D185","v":"3.3.2"},{"$f":"All!E185","v":0},{"$f":"All!F185","v":"3.3.2.2"},{"$f":"All!G185","v":"3.3.2.2: AGENT AGREEMENTS AND PROVIDER RESPONSIBILITY\nProvider-agent contracts (see 3.3.1) should include provisions granting providers the right to seek restitution for damages incurred by the provider due to agent (or sub-agent) conduct.\n"},{"$f":"All!H185","v":0},{"$f":"All!I185","v":"3.3.2.2.1"},{"$f":"All!J185","v":"3.3.2.2.1: Does the provider-agent contract include provisions granting providers the right to seek restitution for damages incurred by the provider due to agent (or sub-agent) conduct?\n"},{"$f":"All!K185","v":0},{"$f":"All!L185","v":0},{"$f":"All!M185","v":"Recommended"},{"$f":"All!N185","v":"Recommended"},{"$f":"All!O185","v":"Agent"},{"$f":"All!P185","v":0},{"$f":"All!Q185","v":0},{"$f":"All!R185","v":0},{"$f":"All!S185","v":0},{"$f":"All!T185","v":0},{"$f":"All!U185","v":0},{"$f":"All!V185","v":0},{"$f":"All!W185","v":0},{"$f":"All!X185","v":0},{"$f":"All!Y185","v":0},{"$f":"All!Z185","v":0},{"$f":"All!AA185","v":0},{"$f":"All!AB185","v":0},{"$f":"All!AC185","v":0},{"$f":"All!AD185","v":0},{"$f":"All!AE185","v":0},{"$f":"All!AF185","v":0},{"$f":"All!AG185","v":0},{"$f":"All!AH185","v":0},{"$f":"All!AI185","v":0},{"$f":"All!AJ185","v":0},{"$f":"All!AK185","v":0},{"$f":"All!AL185","v":0},{"$f":"All!AM185","v":0},{"$f":"All!AN185","v":0},{"$f":"All!AO185","v":0},{"$f":"All!AP185","v":0},{"$f":"All!AQ185","v":0},{"$f":"All!AR185","v":0},{"$f":"All!AS185","v":0},{"$f":"All!AT185","v":0}]
[null,{"$f":"All!B186","v":"3"},{"$f":"All!C186","v":"3.4"},{"$f":"All!D186","v":"3.4.1"},{"$f":"All!E186","v":"3.4.1: Providers shall develop policies and processes for ongoing management and oversight of staff, agents and entities providing outsourced services"},{"$f":"All!F186","v":"3.4.1.1"},{"$f":"All!G186","v":"3.4.1.1: STAFF MANAGEMENT POLICY\nProviders should implement a human resources policy for their mobile money staff. The policy should determine how the provider will ensure it has the human resources needed to implement and maintain the mobile money service.\n\nA human resources management process should be implemented to do the following:\n- Determine the necessary competence for staff for each role within the mobile money organization.\n- Provide training or take other actions (e.g. recruitment) to achieve the necessary competence in each role.\n- Provide training on other key processes, particularly those relating to AML/CFT, anti-fraud, regulatory compliance, data privacy, security, and business continuity.\n- Ensure that staff are aware of their roles and responsibilities, and how their role contributes to the mobile money service.\n- Ensure changes of responsibility, including initiation or termination of a responsibility, are managed appropriately, including through suitable training and monitoring.\n- Maintain appropriate records of staff training, skills and experience.\n"},{"$f":"All!H186","v":"ISO 20000-1:2018 Sec. 5.2,\nGSMA RMT"},{"$f":"All!I186","v":"3.4.1.1.1"},{"$f":"All!J186","v":"3.4.1.1.1: Has a human resources policy been implemented that determines how the provider will ensure it has appropriate human resources needed to implement and maintain the mobile money service, and is the policy kept up to date?\n"},{"$f":"All!K186","v":"1) Human resources policy (or equivalent documentation)\n- Check provider has appropriate human resources to operate the mobile money service.\n- Check the revision date on the policy/equivalent document is within the last 24 months."},{"$f":"All!L186","v":0},{"$f":"All!M186","v":"Standard Required"},{"$f":"All!N186","v":"Required"},{"$f":"All!O186","v":"HR"},{"$f":"All!P186","v":0},{"$f":"All!Q186","v":0},{"$f":"All!R186","v":0},{"$f":"All!S186","v":0},{"$f":"All!T186","v":0},{"$f":"All!U186","v":0},{"$f":"All!V186","v":0},{"$f":"All!W186","v":0},{"$f":"All!X186","v":0},{"$f":"All!Y186","v":0},{"$f":"All!Z186","v":0},{"$f":"All!AA186","v":0},{"$f":"All!AB186","v":0},{"$f":"All!AC186","v":0},{"$f":"All!AD186","v":0},{"$f":"All!AE186","v":0},{"$f":"All!AF186","v":0},{"$f":"All!AG186","v":0},{"$f":"All!AH186","v":0},{"$f":"All!AI186","v":0},{"$f":"All!AJ186","v":0},{"$f":"All!AK186","v":0},{"$f":"All!AL186","v":0},{"$f":"All!AM186","v":0},{"$f":"All!AN186","v":0},{"$f":"All!AO186","v":0},{"$f":"All!AP186","v":0},{"$f":"All!AQ186","v":0},{"$f":"All!AR186","v":0},{"$f":"All!AS186","v":0},{"$f":"All!AT186","v":0}]
[null,{"$f":"All!B187","v":"3"},{"$f":"All!C187","v":"3.4"},{"$f":"All!D187","v":"3.4.1"},{"$f":"All!E187","v":0},{"$f":"All!F187","v":"3.4.1.1"},{"$f":"All!G187","v":0},{"$f":"All!H187","v":0},{"$f":"All!I187","v":"3.4.1.1.2"},{"$f":"All!J187","v":"3.4.1.1.2: Are the competencies required for each role being identified, and are competency gaps being filled through training or recruitment?\n"},{"$f":"All!K187","v":0},{"$f":"All!L187","v":0},{"$f":"All!M187","v":"Recommended"},{"$f":"All!N187","v":"Recommended"},{"$f":"All!O187","v":"HR"},{"$f":"All!P187","v":0},{"$f":"All!Q187","v":0},{"$f":"All!R187","v":0},{"$f":"All!S187","v":0},{"$f":"All!T187","v":0},{"$f":"All!U187","v":0},{"$f":"All!V187","v":0},{"$f":"All!W187","v":0},{"$f":"All!X187","v":0},{"$f":"All!Y187","v":0},{"$f":"All!Z187","v":0},{"$f":"All!AA187","v":0},{"$f":"All!AB187","v":0},{"$f":"All!AC187","v":0},{"$f":"All!AD187","v":0},{"$f":"All!AE187","v":0},{"$f":"All!AF187","v":0},{"$f":"All!AG187","v":0},{"$f":"All!AH187","v":0},{"$f":"All!AI187","v":0},{"$f":"All!AJ187","v":0},{"$f":"All!AK187","v":0},{"$f":"All!AL187","v":0},{"$f":"All!AM187","v":0},{"$f":"All!AN187","v":0},{"$f":"All!AO187","v":0},{"$f":"All!AP187","v":0},{"$f":"All!AQ187","v":0},{"$f":"All!AR187","v":0},{"$f":"All!AS187","v":0},{"$f":"All!AT187","v":0}]
[null,{"$f":"All!B188","v":"3"},{"$f":"All!C188","v":"3.4"},{"$f":"All!D188","v":"3.4.1"},{"$f":"All!E188","v":""},{"$f":"All!F188","v":"3.4.1.2"},{"$f":"All!G188","v":"3.4.1.2: STAFF MANAGEMENT PROCESS\nA process should be defined for dealing with unsatisfactory performance from staff. The process should determine how to respond to unsatisfactory performance or breaches of process / policy. The process should include the following:\n- Assisting staff to improve through coaching, training or other mechanisms;\n- Disciplinary procedure to address continued poor performance or more substantial issues;\n- Termination for serious failings - including specification of the circumstances under which staff can be terminated and the procedures to be followed;\n- Procedure for managing disputes with staff."},{"$f":"All!H188","v":"ECB RSMP, ISO 27015:2012 Sec. 7.4"},{"$f":"All!I188","v":"3.4.1.2.1"},{"$f":"All!J188","v":"3.4.1.2.1: Has a process been defined for dealing with unsatisfactory performance from staff and breaches of process / policy?\n"},{"$f":"All!K188","v":0},{"$f":"All!L188","v":0},{"$f":"All!M188","v":"Recommended"},{"$f":"All!N188","v":"Recommended"},{"$f":"All!O188","v":"HR"},{"$f":"All!P188","v":0},{"$f":"All!Q188","v":0},{"$f":"All!R188","v":0},{"$f":"All!S188","v":0},{"$f":"All!T188","v":0},{"$f":"All!U188","v":0},{"$f":"All!V188","v":0},{"$f":"All!W188","v":0},{"$f":"All!X188","v":0},{"$f":"All!Y188","v":0},{"$f":"All!Z188","v":0},{"$f":"All!AA188","v":0},{"$f":"All!AB188","v":0},{"$f":"All!AC188","v":0},{"$f":"All!AD188","v":0},{"$f":"All!AE188","v":0},{"$f":"All!AF188","v":0},{"$f":"All!AG188","v":0},{"$f":"All!AH188","v":0},{"$f":"All!AI188","v":0},{"$f":"All!AJ188","v":0},{"$f":"All!AK188","v":0},{"$f":"All!AL188","v":0},{"$f":"All!AM188","v":0},{"$f":"All!AN188","v":0},{"$f":"All!AO188","v":0},{"$f":"All!AP188","v":0},{"$f":"All!AQ188","v":0},{"$f":"All!AR188","v":0},{"$f":"All!AS188","v":0},{"$f":"All!AT188","v":0}]
[null,{"$f":"All!B189","v":"3"},{"$f":"All!C189","v":"3.4"},{"$f":"All!D189","v":"3.4.1"},{"$f":"All!E189","v":""},{"$f":"All!F189","v":"3.4.1.3"},{"$f":"All!G189","v":"3.4.1.3: AGENT MANAGEMENT POLICY\nProviders should set a policy for managing their agent network, including:\n- Definition of an agent management function within the provider;\n- The level of direct contracting with individual agents that the provider can support and the proportion of agents that should be engaged via master agents or aggregators;\n- Selection criteria for appropriate agents / master agents / agent aggregators;\n- Acceptable level of agent management concentration risk associated with agents (i.e. number/percentage of agents managed by a single master agent / agent aggregator)."},{"$f":"All!H189","v":0},{"$f":"All!I189","v":"3.4.1.3.1"},{"$f":"All!J189","v":"3.4.1.3.1: Does the agent management policy define the level of direct contracting with individual agents that the provider can support and the proportion of agents that should be engaged via master agents or aggregators?\n"},{"$f":"All!K189","v":0},{"$f":"All!L189","v":0},{"$f":"All!M189","v":"Recommended"},{"$f":"All!N189","v":"Recommended"},{"$f":"All!O189","v":"Agent"},{"$f":"All!P189","v":0},{"$f":"All!Q189","v":0},{"$f":"All!R189","v":0},{"$f":"All!S189","v":0},{"$f":"All!T189","v":0},{"$f":"All!U189","v":0},{"$f":"All!V189","v":0},{"$f":"All!W189","v":0},{"$f":"All!X189","v":0},{"$f":"All!Y189","v":0},{"$f":"All!Z189","v":0},{"$f":"All!AA189","v":0},{"$f":"All!AB189","v":0},{"$f":"All!AC189","v":0},{"$f":"All!AD189","v":0},{"$f":"All!AE189","v":0},{"$f":"All!AF189","v":0},{"$f":"All!AG189","v":0},{"$f":"All!AH189","v":0},{"$f":"All!AI189","v":0},{"$f":"All!AJ189","v":0},{"$f":"All!AK189","v":0},{"$f":"All!AL189","v":0},{"$f":"All!AM189","v":0},{"$f":"All!AN189","v":0},{"$f":"All!AO189","v":0},{"$f":"All!AP189","v":0},{"$f":"All!AQ189","v":0},{"$f":"All!AR189","v":0},{"$f":"All!AS189","v":0},{"$f":"All!AT189","v":0}]
[null,{"$f":"All!B190","v":"3"},{"$f":"All!C190","v":"3.4"},{"$f":"All!D190","v":"3.4.1"},{"$f":"All!E190","v":""},{"$f":"All!F190","v":"3.4.1.3"},{"$f":"All!G190","v":0},{"$f":"All!H190","v":0},{"$f":"All!I190","v":"3.4.1.3.2"},{"$f":"All!J190","v":"3.4.1.3.2: Does the agent management policy define selection criteria for appropriate agents / master agents / agent aggregators?\n"},{"$f":"All!K190","v":0},{"$f":"All!L190","v":0},{"$f":"All!M190","v":"Recommended"},{"$f":"All!N190","v":"Recommended"},{"$f":"All!O190","v":"Agent"},{"$f":"All!P190","v":0},{"$f":"All!Q190","v":0},{"$f":"All!R190","v":0},{"$f":"All!S190","v":0},{"$f":"All!T190","v":0},{"$f":"All!U190","v":0},{"$f":"All!V190","v":0},{"$f":"All!W190","v":0},{"$f":"All!X190","v":0},{"$f":"All!Y190","v":0},{"$f":"All!Z190","v":0},{"$f":"All!AA190","v":0},{"$f":"All!AB190","v":0},{"$f":"All!AC190","v":0},{"$f":"All!AD190","v":0},{"$f":"All!AE190","v":0},{"$f":"All!AF190","v":0},{"$f":"All!AG190","v":0},{"$f":"All!AH190","v":0},{"$f":"All!AI190","v":0},{"$f":"All!AJ190","v":0},{"$f":"All!AK190","v":0},{"$f":"All!AL190","v":0},{"$f":"All!AM190","v":0},{"$f":"All!AN190","v":0},{"$f":"All!AO190","v":0},{"$f":"All!AP190","v":0},{"$f":"All!AQ190","v":0},{"$f":"All!AR190","v":0},{"$f":"All!AS190","v":0},{"$f":"All!AT190","v":0}]
[null,{"$f":"All!B191","v":"3"},{"$f":"All!C191","v":"3.4"},{"$f":"All!D191","v":"3.4.1"},{"$f":"All!E191","v":""},{"$f":"All!F191","v":"3.4.1.3"},{"$f":"All!G191","v":0},{"$f":"All!H191","v":0},{"$f":"All!I191","v":"3.4.1.3.3"},{"$f":"All!J191","v":"3.4.1.3.3: Does the agent management policy define an acceptable level of agent management concentration risk (i.e. number/percentage of agents managed by a single master agent / agent aggregator)?\n"},{"$f":"All!K191","v":0},{"$f":"All!L191","v":0},{"$f":"All!M191","v":"Recommended"},{"$f":"All!N191","v":"Recommended"},{"$f":"All!O191","v":"Agent"},{"$f":"All!P191","v":0},{"$f":"All!Q191","v":0},{"$f":"All!R191","v":0},{"$f":"All!S191","v":0},{"$f":"All!T191","v":0},{"$f":"All!U191","v":0},{"$f":"All!V191","v":0},{"$f":"All!W191","v":0},{"$f":"All!X191","v":0},{"$f":"All!Y191","v":0},{"$f":"All!Z191","v":0},{"$f":"All!AA191","v":0},{"$f":"All!AB191","v":0},{"$f":"All!AC191","v":0},{"$f":"All!AD191","v":0},{"$f":"All!AE191","v":0},{"$f":"All!AF191","v":0},{"$f":"All!AG191","v":0},{"$f":"All!AH191","v":0},{"$f":"All!AI191","v":0},{"$f":"All!AJ191","v":0},{"$f":"All!AK191","v":0},{"$f":"All!AL191","v":0},{"$f":"All!AM191","v":0},{"$f":"All!AN191","v":0},{"$f":"All!AO191","v":0},{"$f":"All!AP191","v":0},{"$f":"All!AQ191","v":0},{"$f":"All!AR191","v":0},{"$f":"All!AS191","v":0},{"$f":"All!AT191","v":0}]
[null,{"$f":"All!B192","v":"3"},{"$f":"All!C192","v":"3.4"},{"$f":"All!D192","v":"3.4.1"},{"$f":"All!E192","v":""},{"$f":"All!F192","v":"3.4.1.4"},{"$f":"All!G192","v":"3.4.1.4: AGENT MANAGEMENT PROCESS\nThe roles and responsibilities of the provider's agent management function should be clearly defined to carry out management of agents. Business processes for agent management should be specified, and monitored to ensure that they are working efficiently.\n\nProviders should ensure that there are clear lines of communication for information exchange with master agents and agent aggregators, so that relevant information is shared promptly by both parties.  Routes for escalation of issues should be made available to agents (e.g. through regular contact with the agent manager)."},{"$f":"All!H192","v":0},{"$f":"All!I192","v":"3.4.1.4.1"},{"$f":"All!J192","v":"3.4.1.4.1: Have roles and responsibilities been defined to carry out management of agents?\n"},{"$f":"All!K192","v":"1) Agent management process or RACI or sample agent contract or similar document\n- Check that roles and responsibilities for agent management have been defined."},{"$f":"All!L192","v":0},{"$f":"All!M192","v":"Standard Required"},{"$f":"All!N192","v":"Required"},{"$f":"All!O192","v":"Agent"},{"$f":"All!P192","v":0},{"$f":"All!Q192","v":0},{"$f":"All!R192","v":0},{"$f":"All!S192","v":0},{"$f":"All!T192","v":0},{"$f":"All!U192","v":0},{"$f":"All!V192","v":0},{"$f":"All!W192","v":0},{"$f":"All!X192","v":0},{"$f":"All!Y192","v":0},{"$f":"All!Z192","v":0},{"$f":"All!AA192","v":0},{"$f":"All!AB192","v":0},{"$f":"All!AC192","v":0},{"$f":"All!AD192","v":0},{"$f":"All!AE192","v":0},{"$f":"All!AF192","v":0},{"$f":"All!AG192","v":0},{"$f":"All!AH192","v":0},{"$f":"All!AI192","v":0},{"$f":"All!AJ192","v":0},{"$f":"All!AK192","v":0},{"$f":"All!AL192","v":0},{"$f":"All!AM192","v":0},{"$f":"All!AN192","v":0},{"$f":"All!AO192","v":0},{"$f":"All!AP192","v":0},{"$f":"All!AQ192","v":0},{"$f":"All!AR192","v":0},{"$f":"All!AS192","v":0},{"$f":"All!AT192","v":0}]
[null,{"$f":"All!B193","v":"3"},{"$f":"All!C193","v":"3.4"},{"$f":"All!D193","v":"3.4.1"},{"$f":"All!E193","v":""},{"$f":"All!F193","v":"3.4.1.4"},{"$f":"All!G193","v":0},{"$f":"All!H193","v":0},{"$f":"All!I193","v":"3.4.1.4.2"},{"$f":"All!J193","v":"3.4.1.4.2: Are agents provided with a route to escalate issues?\n"},{"$f":"All!K193","v":"1) Agent management process or RACI or sample agent contract or similar document\n- Check there is a process for agents to escalate issues (e.g. through regular contact with the agent manager).\n"},{"$f":"All!L193","v":0},{"$f":"All!M193","v":"Standard Required"},{"$f":"All!N193","v":"Required"},{"$f":"All!O193","v":"Agent"},{"$f":"All!P193","v":0},{"$f":"All!Q193","v":0},{"$f":"All!R193","v":0},{"$f":"All!S193","v":0},{"$f":"All!T193","v":0},{"$f":"All!U193","v":0},{"$f":"All!V193","v":0},{"$f":"All!W193","v":0},{"$f":"All!X193","v":0},{"$f":"All!Y193","v":0},{"$f":"All!Z193","v":0},{"$f":"All!AA193","v":0},{"$f":"All!AB193","v":0},{"$f":"All!AC193","v":0},{"$f":"All!AD193","v":0},{"$f":"All!AE193","v":0},{"$f":"All!AF193","v":0},{"$f":"All!AG193","v":0},{"$f":"All!AH193","v":0},{"$f":"All!AI193","v":0},{"$f":"All!AJ193","v":0},{"$f":"All!AK193","v":0},{"$f":"All!AL193","v":0},{"$f":"All!AM193","v":0},{"$f":"All!AN193","v":0},{"$f":"All!AO193","v":0},{"$f":"All!AP193","v":0},{"$f":"All!AQ193","v":0},{"$f":"All!AR193","v":0},{"$f":"All!AS193","v":0},{"$f":"All!AT193","v":0}]
[null,{"$f":"All!B194","v":"3"},{"$f":"All!C194","v":"3.4"},{"$f":"All!D194","v":"3.4.1"},{"$f":"All!E194","v":""},{"$f":"All!F194","v":"3.4.1.5"},{"$f":"All!G194","v":"3.4.1.5: AGENT MONITORING\nProcesses should be implemented to monitor agents and to notify agents (and their master agents / agent aggregators) of unsatisfactory performance. Relevant information should also be provided to internal management. \nProviders should use a combination of on-site visits (e.g. mystery shoppers) and off-site monitoring (e.g. transaction / location monitoring). Monitoring should address at least the following:\n- Ensuring personal details (KYC) are correctly obtained and verified when registering customers (see 2.6.2 - AML Compliance); \n- Ensuring identity checks are done correctly for cash-in/out;\n- Ensuring processes are followed;\n- Following-up customer complaints.\n\nNote: Contractual agreements should specify that providers may monitor and audit agent to ensure that the provider’s obligations to customers and regulators are being met. Contractual agreements should also specify that providers have access to all relevant records and other information held by agents (see 3.3.1 - Contractual agreements). "},{"$f":"All!H194","v":"GSMA RMT\n(AG-03, \nAG-04,\nAG-05)"},{"$f":"All!I194","v":"3.4.1.5.1"},{"$f":"All!J194","v":"3.4.1.5.1: Have processes been implemented to monitor agents and to notify agents (and their master agents / agent aggregators) of unsatisfactory performance?\n"},{"$f":"All!K194","v":"1) Agent management process or RACI or sample agent contract or similar document\n- Check there is a process to monitor agents\n- Check there is a process for agents, master agents and agent aggregators to be informed of unsatisfactory performance\n"},{"$f":"All!L194","v":0},{"$f":"All!M194","v":"Urgent Required"},{"$f":"All!N194","v":"Required"},{"$f":"All!O194","v":"Agent"},{"$f":"All!P194","v":0},{"$f":"All!Q194","v":0},{"$f":"All!R194","v":0},{"$f":"All!S194","v":0},{"$f":"All!T194","v":0},{"$f":"All!U194","v":0},{"$f":"All!V194","v":0},{"$f":"All!W194","v":0},{"$f":"All!X194","v":0},{"$f":"All!Y194","v":0},{"$f":"All!Z194","v":0},{"$f":"All!AA194","v":0},{"$f":"All!AB194","v":0},{"$f":"All!AC194","v":0},{"$f":"All!AD194","v":0},{"$f":"All!AE194","v":0},{"$f":"All!AF194","v":0},{"$f":"All!AG194","v":0},{"$f":"All!AH194","v":0},{"$f":"All!AI194","v":0},{"$f":"All!AJ194","v":0},{"$f":"All!AK194","v":0},{"$f":"All!AL194","v":0},{"$f":"All!AM194","v":0},{"$f":"All!AN194","v":0},{"$f":"All!AO194","v":0},{"$f":"All!AP194","v":0},{"$f":"All!AQ194","v":0},{"$f":"All!AR194","v":0},{"$f":"All!AS194","v":0},{"$f":"All!AT194","v":0}]
[null,{"$f":"All!B195","v":"3"},{"$f":"All!C195","v":"3.4"},{"$f":"All!D195","v":"3.4.1"},{"$f":"All!E195","v":""},{"$f":"All!F195","v":"3.4.1.5"},{"$f":"All!G195","v":0},{"$f":"All!H195","v":0},{"$f":"All!I195","v":"3.4.1.5.2"},{"$f":"All!J195","v":"3.4.1.5.2: Are both on-site visits (e.g. mystery shoppers) and off-site monitoring (e.g. transaction/ location monitoring) used to monitor/ audit agents?\n"},{"$f":"All!K195","v":"1) Agent management process or RACI or sample agent contract or similar document\n- Check the process for monitoring agents includes:\n        a) onsite visits (e.g. mystery shopping)\n        b) off-site monitoring (e.g. transaction / complaints monitoring)\n\n2) Agent monitoring records\n- Check that the process is active by reviewing records or schedules of site-visits\n"},{"$f":"All!L195","v":0},{"$f":"All!M195","v":"Urgent Required"},{"$f":"All!N195","v":"Required"},{"$f":"All!O195","v":"Agent"},{"$f":"All!P195","v":0},{"$f":"All!Q195","v":0},{"$f":"All!R195","v":0},{"$f":"All!S195","v":0},{"$f":"All!T195","v":0},{"$f":"All!U195","v":0},{"$f":"All!V195","v":0},{"$f":"All!W195","v":0},{"$f":"All!X195","v":0},{"$f":"All!Y195","v":0},{"$f":"All!Z195","v":0},{"$f":"All!AA195","v":0},{"$f":"All!AB195","v":0},{"$f":"All!AC195","v":0},{"$f":"All!AD195","v":0},{"$f":"All!AE195","v":0},{"$f":"All!AF195","v":0},{"$f":"All!AG195","v":0},{"$f":"All!AH195","v":0},{"$f":"All!AI195","v":0},{"$f":"All!AJ195","v":0},{"$f":"All!AK195","v":0},{"$f":"All!AL195","v":0},{"$f":"All!AM195","v":0},{"$f":"All!AN195","v":0},{"$f":"All!AO195","v":0},{"$f":"All!AP195","v":0},{"$f":"All!AQ195","v":0},{"$f":"All!AR195","v":0},{"$f":"All!AS195","v":0},{"$f":"All!AT195","v":0}]
[null,{"$f":"All!B196","v":"3"},{"$f":"All!C196","v":"3.4"},{"$f":"All!D196","v":"3.4.1"},{"$f":"All!E196","v":""},{"$f":"All!F196","v":"3.4.1.5"},{"$f":"All!G196","v":0},{"$f":"All!H196","v":0},{"$f":"All!I196","v":"3.4.1.5.3"},{"$f":"All!J196","v":"3.4.1.5.3: Are customer complaints about agents tracked and action taken on regularly-offending agents?\n"},{"$f":"All!K196","v":"1) Sample records of complaints about agents\n- Look at a sample of customer complaints about agents to ensure the process is being followed, complaints are being recored and actions taken.\n"},{"$f":"All!L196","v":0},{"$f":"All!M196","v":"Urgent Required"},{"$f":"All!N196","v":"Required"},{"$f":"All!O196","v":"Agent"},{"$f":"All!P196","v":0},{"$f":"All!Q196","v":0},{"$f":"All!R196","v":0},{"$f":"All!S196","v":0},{"$f":"All!T196","v":0},{"$f":"All!U196","v":0},{"$f":"All!V196","v":0},{"$f":"All!W196","v":0},{"$f":"All!X196","v":0},{"$f":"All!Y196","v":0},{"$f":"All!Z196","v":0},{"$f":"All!AA196","v":0},{"$f":"All!AB196","v":0},{"$f":"All!AC196","v":0},{"$f":"All!AD196","v":0},{"$f":"All!AE196","v":0},{"$f":"All!AF196","v":0},{"$f":"All!AG196","v":0},{"$f":"All!AH196","v":0},{"$f":"All!AI196","v":0},{"$f":"All!AJ196","v":0},{"$f":"All!AK196","v":0},{"$f":"All!AL196","v":0},{"$f":"All!AM196","v":0},{"$f":"All!AN196","v":0},{"$f":"All!AO196","v":0},{"$f":"All!AP196","v":0},{"$f":"All!AQ196","v":0},{"$f":"All!AR196","v":0},{"$f":"All!AS196","v":0},{"$f":"All!AT196","v":0}]
[null,{"$f":"All!B197","v":"3"},{"$f":"All!C197","v":"3.4"},{"$f":"All!D197","v":"3.4.1"},{"$f":"All!E197","v":""},{"$f":"All!F197","v":"3.4.1.6"},{"$f":"All!G197","v":"3.4.1.6: AGENT SANCTIONS AND TERMINATION\nA sanctions and termination process should be defined and agreed with each agent / master agent / agent aggregator (as applicable) for escalation and resolution of unsatisfactory performance or breaches of process / policy. The process should clearly describe the circumstances under which agents can be terminated and the procedures to be followed.\n\nThe process should include escalating levels of sanctions up to termination of an individual agent / master agent / agent aggregator. Examples of sanctions that could be considered include:\n\n- 3 strikes and out for minor offences;\n- Financial sanctions;\n- Tiered penalties – increasing severity upon repetition of offence. e.g. suspend agent for 1 day / 1 week / 1 month;\n- Termination of mobile money status (which will cut off this part of their revenue stream);\n- Termination of mobile reseller status, if applicable (which will cut off further revenue stream).\n\nNote: Agents should be reported to the police if criminal activity is discovered."},{"$f":"All!H197","v":0},{"$f":"All!I197","v":"3.4.1.6.1"},{"$f":"All!J197","v":"3.4.1.6.1: Has a sanctions and termination process been agreed with each agent / master agent / agent aggregator (as applicable) for escalation and resolution of unsatisfactory performance or breaches of process / policy?\n"},{"$f":"All!K197","v":"1) Agent management process or RACI or sample agent contract or record of agent sanctions or similar document\n- Check that the there is a process to sanction and/or terminate agents / master agents / agent aggregators (as applicable) of unsatisfactory performance or breaches of process / policy. \n- Check that the process includes escalation and resolution measures."},{"$f":"All!L197","v":0},{"$f":"All!M197","v":"Standard Required"},{"$f":"All!N197","v":"Required"},{"$f":"All!O197","v":"Agent"},{"$f":"All!P197","v":0},{"$f":"All!Q197","v":0},{"$f":"All!R197","v":0},{"$f":"All!S197","v":0},{"$f":"All!T197","v":0},{"$f":"All!U197","v":0},{"$f":"All!V197","v":0},{"$f":"All!W197","v":0},{"$f":"All!X197","v":0},{"$f":"All!Y197","v":0},{"$f":"All!Z197","v":0},{"$f":"All!AA197","v":0},{"$f":"All!AB197","v":0},{"$f":"All!AC197","v":0},{"$f":"All!AD197","v":0},{"$f":"All!AE197","v":0},{"$f":"All!AF197","v":0},{"$f":"All!AG197","v":0},{"$f":"All!AH197","v":0},{"$f":"All!AI197","v":0},{"$f":"All!AJ197","v":0},{"$f":"All!AK197","v":0},{"$f":"All!AL197","v":0},{"$f":"All!AM197","v":0},{"$f":"All!AN197","v":0},{"$f":"All!AO197","v":0},{"$f":"All!AP197","v":0},{"$f":"All!AQ197","v":0},{"$f":"All!AR197","v":0},{"$f":"All!AS197","v":0},{"$f":"All!AT197","v":0}]
[null,{"$f":"All!B198","v":"3"},{"$f":"All!C198","v":"3.4"},{"$f":"All!D198","v":"3.4.1"},{"$f":"All!E198","v":""},{"$f":"All!F198","v":"3.4.1.6"},{"$f":"All!G198","v":0},{"$f":"All!H198","v":0},{"$f":"All!I198","v":"3.4.1.6.2"},{"$f":"All!J198","v":"3.4.1.6.2: Does the sanctions process include escalating levels of sanctions, such as 3 strikes and out / financial sanctions / tiered penalties / termination of mobile money status / termination of mobile reseller status?\n"},{"$f":"All!K198","v":0},{"$f":"All!L198","v":0},{"$f":"All!M198","v":"Recommended"},{"$f":"All!N198","v":"Recommended"},{"$f":"All!O198","v":"Agent"},{"$f":"All!P198","v":0},{"$f":"All!Q198","v":0},{"$f":"All!R198","v":0},{"$f":"All!S198","v":0},{"$f":"All!T198","v":0},{"$f":"All!U198","v":0},{"$f":"All!V198","v":0},{"$f":"All!W198","v":0},{"$f":"All!X198","v":0},{"$f":"All!Y198","v":0},{"$f":"All!Z198","v":0},{"$f":"All!AA198","v":0},{"$f":"All!AB198","v":0},{"$f":"All!AC198","v":0},{"$f":"All!AD198","v":0},{"$f":"All!AE198","v":0},{"$f":"All!AF198","v":0},{"$f":"All!AG198","v":0},{"$f":"All!AH198","v":0},{"$f":"All!AI198","v":0},{"$f":"All!AJ198","v":0},{"$f":"All!AK198","v":0},{"$f":"All!AL198","v":0},{"$f":"All!AM198","v":0},{"$f":"All!AN198","v":0},{"$f":"All!AO198","v":0},{"$f":"All!AP198","v":0},{"$f":"All!AQ198","v":0},{"$f":"All!AR198","v":0},{"$f":"All!AS198","v":0},{"$f":"All!AT198","v":0}]
[null,{"$f":"All!B199","v":"3"},{"$f":"All!C199","v":"3.4"},{"$f":"All!D199","v":"3.4.1"},{"$f":"All!E199","v":""},{"$f":"All!F199","v":"3.4.1.6"},{"$f":"All!G199","v":0},{"$f":"All!H199","v":0},{"$f":"All!I199","v":"3.4.1.6.3"},{"$f":"All!J199","v":"3.4.1.6.3: Does the sanctions process clearly describe the circumstances under which agents can be terminated and the procedures to be followed?\n"},{"$f":"All!K199","v":0},{"$f":"All!L199","v":0},{"$f":"All!M199","v":"Recommended"},{"$f":"All!N199","v":"Recommended"},{"$f":"All!O199","v":"Agent"},{"$f":"All!P199","v":0},{"$f":"All!Q199","v":0},{"$f":"All!R199","v":0},{"$f":"All!S199","v":0},{"$f":"All!T199","v":0},{"$f":"All!U199","v":0},{"$f":"All!V199","v":0},{"$f":"All!W199","v":0},{"$f":"All!X199","v":0},{"$f":"All!Y199","v":0},{"$f":"All!Z199","v":0},{"$f":"All!AA199","v":0},{"$f":"All!AB199","v":0},{"$f":"All!AC199","v":0},{"$f":"All!AD199","v":0},{"$f":"All!AE199","v":0},{"$f":"All!AF199","v":0},{"$f":"All!AG199","v":0},{"$f":"All!AH199","v":0},{"$f":"All!AI199","v":0},{"$f":"All!AJ199","v":0},{"$f":"All!AK199","v":0},{"$f":"All!AL199","v":0},{"$f":"All!AM199","v":0},{"$f":"All!AN199","v":0},{"$f":"All!AO199","v":0},{"$f":"All!AP199","v":0},{"$f":"All!AQ199","v":0},{"$f":"All!AR199","v":0},{"$f":"All!AS199","v":0},{"$f":"All!AT199","v":0}]
[null,{"$f":"All!B200","v":"3"},{"$f":"All!C200","v":"3.4"},{"$f":"All!D200","v":"3.4.1"},{"$f":"All!E200","v":""},{"$f":"All!F200","v":"3.4.1.7"},{"$f":"All!G200","v":"3.4.1.7: AGENT DISPUTE MANAGEMENT\nA dispute-management process should be implemented with each agent / master agent / agent aggregator (as applicable) to resolve major issues, disagreements and contractual disputes, with the final escalation being court resolution."},{"$f":"All!H200","v":0},{"$f":"All!I200","v":"3.4.1.7.1"},{"$f":"All!J200","v":"3.4.1.7.1: Has an agent dispute-management process been implemented to resolve major issues, disagreements and contractual disputes with agents?\n"},{"$f":"All!K200","v":"1) Agent dispute management process / agent contract\n- Check that there is a process documented for agent dispute management\n"},{"$f":"All!L200","v":0},{"$f":"All!M200","v":"Standard Required"},{"$f":"All!N200","v":"Required"},{"$f":"All!O200","v":"Agent"},{"$f":"All!P200","v":0},{"$f":"All!Q200","v":0},{"$f":"All!R200","v":0},{"$f":"All!S200","v":0},{"$f":"All!T200","v":0},{"$f":"All!U200","v":0},{"$f":"All!V200","v":0},{"$f":"All!W200","v":0},{"$f":"All!X200","v":0},{"$f":"All!Y200","v":0},{"$f":"All!Z200","v":0},{"$f":"All!AA200","v":0},{"$f":"All!AB200","v":0},{"$f":"All!AC200","v":0},{"$f":"All!AD200","v":0},{"$f":"All!AE200","v":0},{"$f":"All!AF200","v":0},{"$f":"All!AG200","v":0},{"$f":"All!AH200","v":0},{"$f":"All!AI200","v":0},{"$f":"All!AJ200","v":0},{"$f":"All!AK200","v":0},{"$f":"All!AL200","v":0},{"$f":"All!AM200","v":0},{"$f":"All!AN200","v":0},{"$f":"All!AO200","v":0},{"$f":"All!AP200","v":0},{"$f":"All!AQ200","v":0},{"$f":"All!AR200","v":0},{"$f":"All!AS200","v":0},{"$f":"All!AT200","v":0}]
[null,{"$f":"All!B201","v":"3"},{"$f":"All!C201","v":"3.4"},{"$f":"All!D201","v":"3.4.1"},{"$f":"All!E201","v":""},{"$f":"All!F201","v":"3.4.1.8"},{"$f":"All!G201","v":"3.4.1.8: AGENT AVAILABILITY AND LIQUIDITY\nProviders should monitor customers' usage patterns and their agent network to ensure sufficient coverage of agents, given current and anticipated usage patterns.\n\nAgent liquidity should be monitored. If necessary, providers should establish super-agents to assist agents in maintaining liquidity and should continue to optimize liquidity management. "},{"$f":"All!H201","v":"GSMA RMT\n(AG-18,\nAG-19)"},{"$f":"All!I201","v":"3.4.1.8.1"},{"$f":"All!J201","v":"3.4.1.8.1: Are customers' usage patterns and the agent network monitored to ensure sufficient coverage of agents, given current and anticipated usage patterns?\n"},{"$f":"All!K201","v":0},{"$f":"All!L201","v":0},{"$f":"All!M201","v":"Recommended"},{"$f":"All!N201","v":"Recommended"},{"$f":"All!O201","v":"Agent"},{"$f":"All!P201","v":0},{"$f":"All!Q201","v":0},{"$f":"All!R201","v":0},{"$f":"All!S201","v":0},{"$f":"All!T201","v":0},{"$f":"All!U201","v":0},{"$f":"All!V201","v":0},{"$f":"All!W201","v":0},{"$f":"All!X201","v":0},{"$f":"All!Y201","v":0},{"$f":"All!Z201","v":0},{"$f":"All!AA201","v":0},{"$f":"All!AB201","v":0},{"$f":"All!AC201","v":0},{"$f":"All!AD201","v":0},{"$f":"All!AE201","v":0},{"$f":"All!AF201","v":0},{"$f":"All!AG201","v":0},{"$f":"All!AH201","v":0},{"$f":"All!AI201","v":0},{"$f":"All!AJ201","v":0},{"$f":"All!AK201","v":0},{"$f":"All!AL201","v":0},{"$f":"All!AM201","v":0},{"$f":"All!AN201","v":0},{"$f":"All!AO201","v":0},{"$f":"All!AP201","v":0},{"$f":"All!AQ201","v":0},{"$f":"All!AR201","v":0},{"$f":"All!AS201","v":0},{"$f":"All!AT201","v":0}]
[null,{"$f":"All!B202","v":"3"},{"$f":"All!C202","v":"3.4"},{"$f":"All!D202","v":"3.4.1"},{"$f":"All!E202","v":""},{"$f":"All!F202","v":"3.4.1.8"},{"$f":"All!G202","v":0},{"$f":"All!H202","v":0},{"$f":"All!I202","v":"3.4.1.8.2"},{"$f":"All!J202","v":"3.4.1.8.2: Is the liquidity of agents monitored?\n"},{"$f":"All!K202","v":0},{"$f":"All!L202","v":0},{"$f":"All!M202","v":"Recommended"},{"$f":"All!N202","v":"Recommended"},{"$f":"All!O202","v":"Agent"},{"$f":"All!P202","v":0},{"$f":"All!Q202","v":0},{"$f":"All!R202","v":0},{"$f":"All!S202","v":0},{"$f":"All!T202","v":0},{"$f":"All!U202","v":0},{"$f":"All!V202","v":0},{"$f":"All!W202","v":0},{"$f":"All!X202","v":0},{"$f":"All!Y202","v":0},{"$f":"All!Z202","v":0},{"$f":"All!AA202","v":0},{"$f":"All!AB202","v":0},{"$f":"All!AC202","v":0},{"$f":"All!AD202","v":0},{"$f":"All!AE202","v":0},{"$f":"All!AF202","v":0},{"$f":"All!AG202","v":0},{"$f":"All!AH202","v":0},{"$f":"All!AI202","v":0},{"$f":"All!AJ202","v":0},{"$f":"All!AK202","v":0},{"$f":"All!AL202","v":0},{"$f":"All!AM202","v":0},{"$f":"All!AN202","v":0},{"$f":"All!AO202","v":0},{"$f":"All!AP202","v":0},{"$f":"All!AQ202","v":0},{"$f":"All!AR202","v":0},{"$f":"All!AS202","v":0},{"$f":"All!AT202","v":0}]
[null,{"$f":"All!B203","v":"3"},{"$f":"All!C203","v":"3.4"},{"$f":"All!D203","v":"3.4.1"},{"$f":"All!E203","v":""},{"$f":"All!F203","v":"3.4.1.8"},{"$f":"All!G203","v":0},{"$f":"All!H203","v":0},{"$f":"All!I203","v":"3.4.1.8.3"},{"$f":"All!J203","v":"3.4.1.8.3: If necessary, have super-agents been established to assist agents in maintaining liquidity, with ongoing optimization?\n"},{"$f":"All!K203","v":0},{"$f":"All!L203","v":0},{"$f":"All!M203","v":"Recommended"},{"$f":"All!N203","v":"Recommended"},{"$f":"All!O203","v":"Agent"},{"$f":"All!P203","v":0},{"$f":"All!Q203","v":0},{"$f":"All!R203","v":0},{"$f":"All!S203","v":0},{"$f":"All!T203","v":0},{"$f":"All!U203","v":0},{"$f":"All!V203","v":0},{"$f":"All!W203","v":0},{"$f":"All!X203","v":0},{"$f":"All!Y203","v":0},{"$f":"All!Z203","v":0},{"$f":"All!AA203","v":0},{"$f":"All!AB203","v":0},{"$f":"All!AC203","v":0},{"$f":"All!AD203","v":0},{"$f":"All!AE203","v":0},{"$f":"All!AF203","v":0},{"$f":"All!AG203","v":0},{"$f":"All!AH203","v":0},{"$f":"All!AI203","v":0},{"$f":"All!AJ203","v":0},{"$f":"All!AK203","v":0},{"$f":"All!AL203","v":0},{"$f":"All!AM203","v":0},{"$f":"All!AN203","v":0},{"$f":"All!AO203","v":0},{"$f":"All!AP203","v":0},{"$f":"All!AQ203","v":0},{"$f":"All!AR203","v":0},{"$f":"All!AS203","v":0},{"$f":"All!AT203","v":0}]
[null,{"$f":"All!B204","v":"3"},{"$f":"All!C204","v":"3.4"},{"$f":"All!D204","v":"3.4.1"},{"$f":"All!E204","v":""},{"$f":"All!F204","v":"3.4.1.9"},{"$f":"All!G204","v":"3.4.1.9: AGENT RISK MANAGEMENT\nProviders should conduct risk management for each of their master agents and agent aggregators. Risk management should be carried out when agents are appointed and thereafter when required. When assessing risk, all of the following factors should be considered:\n- Performance of each master agent / agent aggregator in managing its agents and implementing the provider's policies and processes;\n- Relationship between provider and each master agent/ agent aggregator;\n- Relationship between master agent/ agent aggregator and agents;\n- Regulatory status of each master agent / agent aggregator;\n- Financial, reputational, and operational impact on provider of performance failure by each master agent / agent aggregator;\n- Potential losses to provider’s customers due to performance failure by master agent / agent aggregator; and\n- Concentration risk (number/percentage of agents managed by a single master agent / agent aggregator)."},{"$f":"All!H204","v":"BCBS OFS"},{"$f":"All!I204","v":"3.4.1.9.1"},{"$f":"All!J204","v":"3.4.1.9.1: Is risk management carried out on agents when each master agent and agent aggregator is appointed and when required?\n"},{"$f":"All!K204","v":"1) Agent risk register\n- Check that there is a risk register that records risks of each master agent and agent aggregator.\n- Check that actions have been assigned a severity and an owner and followed up."},{"$f":"All!L204","v":0},{"$f":"All!M204","v":"Urgent Required"},{"$f":"All!N204","v":"Required"},{"$f":"All!O204","v":"Agent"},{"$f":"All!P204","v":0},{"$f":"All!Q204","v":0},{"$f":"All!R204","v":0},{"$f":"All!S204","v":0},{"$f":"All!T204","v":0},{"$f":"All!U204","v":0},{"$f":"All!V204","v":0},{"$f":"All!W204","v":0},{"$f":"All!X204","v":0},{"$f":"All!Y204","v":0},{"$f":"All!Z204","v":0},{"$f":"All!AA204","v":0},{"$f":"All!AB204","v":0},{"$f":"All!AC204","v":0},{"$f":"All!AD204","v":0},{"$f":"All!AE204","v":0},{"$f":"All!AF204","v":0},{"$f":"All!AG204","v":0},{"$f":"All!AH204","v":0},{"$f":"All!AI204","v":0},{"$f":"All!AJ204","v":0},{"$f":"All!AK204","v":0},{"$f":"All!AL204","v":0},{"$f":"All!AM204","v":0},{"$f":"All!AN204","v":0},{"$f":"All!AO204","v":0},{"$f":"All!AP204","v":0},{"$f":"All!AQ204","v":0},{"$f":"All!AR204","v":0},{"$f":"All!AS204","v":0},{"$f":"All!AT204","v":0}]
[null,{"$f":"All!B205","v":"3"},{"$f":"All!C205","v":"3.4"},{"$f":"All!D205","v":"3.4.1"},{"$f":"All!E205","v":""},{"$f":"All!F205","v":"3.4.1.9"},{"$f":"All!G205","v":0},{"$f":"All!H205","v":0},{"$f":"All!I205","v":"3.4.1.9.2"},{"$f":"All!J205","v":"3.4.1.9.2: Does agent risk management review the relationship between provider and each master agent/ agent aggregator, as well as that between the master agent and their individual agents?\n"},{"$f":"All!K205","v":0},{"$f":"All!L205","v":0},{"$f":"All!M205","v":"Recommended"},{"$f":"All!N205","v":"Recommended"},{"$f":"All!O205","v":"Agent"},{"$f":"All!P205","v":0},{"$f":"All!Q205","v":0},{"$f":"All!R205","v":0},{"$f":"All!S205","v":0},{"$f":"All!T205","v":0},{"$f":"All!U205","v":0},{"$f":"All!V205","v":0},{"$f":"All!W205","v":0},{"$f":"All!X205","v":0},{"$f":"All!Y205","v":0},{"$f":"All!Z205","v":0},{"$f":"All!AA205","v":0},{"$f":"All!AB205","v":0},{"$f":"All!AC205","v":0},{"$f":"All!AD205","v":0},{"$f":"All!AE205","v":0},{"$f":"All!AF205","v":0},{"$f":"All!AG205","v":0},{"$f":"All!AH205","v":0},{"$f":"All!AI205","v":0},{"$f":"All!AJ205","v":0},{"$f":"All!AK205","v":0},{"$f":"All!AL205","v":0},{"$f":"All!AM205","v":0},{"$f":"All!AN205","v":0},{"$f":"All!AO205","v":0},{"$f":"All!AP205","v":0},{"$f":"All!AQ205","v":0},{"$f":"All!AR205","v":0},{"$f":"All!AS205","v":0},{"$f":"All!AT205","v":0}]
[null,{"$f":"All!B206","v":"3"},{"$f":"All!C206","v":"3.4"},{"$f":"All!D206","v":"3.4.1"},{"$f":"All!E206","v":""},{"$f":"All!F206","v":"3.4.1.9"},{"$f":"All!G206","v":0},{"$f":"All!H206","v":0},{"$f":"All!I206","v":"3.4.1.9.3"},{"$f":"All!J206","v":"3.4.1.9.3: Is the risk and impact of failure of each master agent / agent aggregator assessed?\n"},{"$f":"All!K206","v":0},{"$f":"All!L206","v":0},{"$f":"All!M206","v":"Recommended"},{"$f":"All!N206","v":"Recommended"},{"$f":"All!O206","v":"Agent"},{"$f":"All!P206","v":0},{"$f":"All!Q206","v":0},{"$f":"All!R206","v":0},{"$f":"All!S206","v":0},{"$f":"All!T206","v":0},{"$f":"All!U206","v":0},{"$f":"All!V206","v":0},{"$f":"All!W206","v":0},{"$f":"All!X206","v":0},{"$f":"All!Y206","v":0},{"$f":"All!Z206","v":0},{"$f":"All!AA206","v":0},{"$f":"All!AB206","v":0},{"$f":"All!AC206","v":0},{"$f":"All!AD206","v":0},{"$f":"All!AE206","v":0},{"$f":"All!AF206","v":0},{"$f":"All!AG206","v":0},{"$f":"All!AH206","v":0},{"$f":"All!AI206","v":0},{"$f":"All!AJ206","v":0},{"$f":"All!AK206","v":0},{"$f":"All!AL206","v":0},{"$f":"All!AM206","v":0},{"$f":"All!AN206","v":0},{"$f":"All!AO206","v":0},{"$f":"All!AP206","v":0},{"$f":"All!AQ206","v":0},{"$f":"All!AR206","v":0},{"$f":"All!AS206","v":0},{"$f":"All!AT206","v":0}]
[null,{"$f":"All!B207","v":"3"},{"$f":"All!C207","v":"3.4"},{"$f":"All!D207","v":"3.4.1"},{"$f":"All!E207","v":""},{"$f":"All!F207","v":"3.4.1.9"},{"$f":"All!G207","v":0},{"$f":"All!H207","v":0},{"$f":"All!I207","v":"3.4.1.9.4"},{"$f":"All!J207","v":"3.4.1.9.4: Does agent risk management address the concentration risk associated with use of master agents / agent aggregators?\n"},{"$f":"All!K207","v":0},{"$f":"All!L207","v":0},{"$f":"All!M207","v":"Recommended"},{"$f":"All!N207","v":"Recommended"},{"$f":"All!O207","v":"Agent"},{"$f":"All!P207","v":0},{"$f":"All!Q207","v":0},{"$f":"All!R207","v":0},{"$f":"All!S207","v":0},{"$f":"All!T207","v":0},{"$f":"All!U207","v":0},{"$f":"All!V207","v":0},{"$f":"All!W207","v":0},{"$f":"All!X207","v":0},{"$f":"All!Y207","v":0},{"$f":"All!Z207","v":0},{"$f":"All!AA207","v":0},{"$f":"All!AB207","v":0},{"$f":"All!AC207","v":0},{"$f":"All!AD207","v":0},{"$f":"All!AE207","v":0},{"$f":"All!AF207","v":0},{"$f":"All!AG207","v":0},{"$f":"All!AH207","v":0},{"$f":"All!AI207","v":0},{"$f":"All!AJ207","v":0},{"$f":"All!AK207","v":0},{"$f":"All!AL207","v":0},{"$f":"All!AM207","v":0},{"$f":"All!AN207","v":0},{"$f":"All!AO207","v":0},{"$f":"All!AP207","v":0},{"$f":"All!AQ207","v":0},{"$f":"All!AR207","v":0},{"$f":"All!AS207","v":0},{"$f":"All!AT207","v":0}]
[null,{"$f":"All!B208","v":"3"},{"$f":"All!C208","v":"3.4"},{"$f":"All!D208","v":"3.4.1"},{"$f":"All!E208","v":""},{"$f":"All!F208","v":"3.4.1.10"},{"$f":"All!G208","v":"3.4.1.10: OUTSOURCING POLICY\nIf material elements of the mobile money service are outsourced, the provider should define an outsourcing policy or similar document to specify principles for governance of outsourcing. This should include:\n- How to determine whether (and the extent to which) a function is appropriate for outsourcing;\n- Ensuring that all entities providing material services are compliant with relevant regulations [relevant regulations could differ by country and role of supplier. e.g. MM platform supplier may have to comply with data processor regulations];\n- Concentration risk - i.e. risk of outsourcing multiple activities to a single entity providing outsourced services; and\n- Limits on acceptable overall levels of outsourcing.\n\nAlso refer to the definitions of \"outsourcing\" and \"entities providing outsourced services\"."},{"$f":"All!H208","v":0},{"$f":"All!I208","v":"3.4.1.10.1"},{"$f":"All!J208","v":"3.4.1.10.1: Does the provider request all entities providing material services to state that they are compliant with relevant regulations?\n"},{"$f":"All!K208","v":"1) Contract document for each material outsourced service suppliers (e.g. MM platform provider)\n- Check that relevant regulations have been identified for all material outsourced suppliers.\n- Check that all material outsourced suppliers have stated that they are compliant with relevant regulations.\n"},{"$f":"All!L208","v":0},{"$f":"All!M208","v":"Standard Required"},{"$f":"All!N208","v":"Required"},{"$f":"All!O208","v":"FraudRisk"},{"$f":"All!P208","v":0},{"$f":"All!Q208","v":0},{"$f":"All!R208","v":0},{"$f":"All!S208","v":0},{"$f":"All!T208","v":0},{"$f":"All!U208","v":0},{"$f":"All!V208","v":0},{"$f":"All!W208","v":0},{"$f":"All!X208","v":0},{"$f":"All!Y208","v":0},{"$f":"All!Z208","v":0},{"$f":"All!AA208","v":0},{"$f":"All!AB208","v":0},{"$f":"All!AC208","v":0},{"$f":"All!AD208","v":0},{"$f":"All!AE208","v":0},{"$f":"All!AF208","v":0},{"$f":"All!AG208","v":0},{"$f":"All!AH208","v":0},{"$f":"All!AI208","v":0},{"$f":"All!AJ208","v":0},{"$f":"All!AK208","v":0},{"$f":"All!AL208","v":0},{"$f":"All!AM208","v":0},{"$f":"All!AN208","v":0},{"$f":"All!AO208","v":0},{"$f":"All!AP208","v":0},{"$f":"All!AQ208","v":0},{"$f":"All!AR208","v":0},{"$f":"All!AS208","v":0},{"$f":"All!AT208","v":0}]
[null,{"$f":"All!B209","v":"3"},{"$f":"All!C209","v":"3.4"},{"$f":"All!D209","v":"3.4.1"},{"$f":"All!E209","v":""},{"$f":"All!F209","v":"3.4.1.10"},{"$f":"All!G209","v":0},{"$f":"All!H209","v":0},{"$f":"All!I209","v":"3.4.1.10.2"},{"$f":"All!J209","v":"3.4.1.10.2: Does the outsourcing policy indicate how to determine whether (and the extent to which) a mobile money function is appropriate for outsourcing?\n"},{"$f":"All!K209","v":0},{"$f":"All!L209","v":0},{"$f":"All!M209","v":"Recommended"},{"$f":"All!N209","v":"Recommended"},{"$f":"All!O209","v":"BizOps"},{"$f":"All!P209","v":0},{"$f":"All!Q209","v":0},{"$f":"All!R209","v":0},{"$f":"All!S209","v":0},{"$f":"All!T209","v":0},{"$f":"All!U209","v":0},{"$f":"All!V209","v":0},{"$f":"All!W209","v":0},{"$f":"All!X209","v":0},{"$f":"All!Y209","v":0},{"$f":"All!Z209","v":0},{"$f":"All!AA209","v":0},{"$f":"All!AB209","v":0},{"$f":"All!AC209","v":0},{"$f":"All!AD209","v":0},{"$f":"All!AE209","v":0},{"$f":"All!AF209","v":0},{"$f":"All!AG209","v":0},{"$f":"All!AH209","v":0},{"$f":"All!AI209","v":0},{"$f":"All!AJ209","v":0},{"$f":"All!AK209","v":0},{"$f":"All!AL209","v":0},{"$f":"All!AM209","v":0},{"$f":"All!AN209","v":0},{"$f":"All!AO209","v":0},{"$f":"All!AP209","v":0},{"$f":"All!AQ209","v":0},{"$f":"All!AR209","v":0},{"$f":"All!AS209","v":0},{"$f":"All!AT209","v":0}]
[null,{"$f":"All!B210","v":"3"},{"$f":"All!C210","v":"3.4"},{"$f":"All!D210","v":"3.4.1"},{"$f":"All!E210","v":""},{"$f":"All!F210","v":"3.4.1.10"},{"$f":"All!G210","v":0},{"$f":"All!H210","v":0},{"$f":"All!I210","v":"3.4.1.10.3"},{"$f":"All!J210","v":"3.4.1.10.3: Does the outsourcing policy address concentration risk associated with a single entity providing outsourced services and limits on acceptable overall levels of outsourcing?\n"},{"$f":"All!K210","v":0},{"$f":"All!L210","v":0},{"$f":"All!M210","v":"Recommended"},{"$f":"All!N210","v":"Recommended"},{"$f":"All!O210","v":"BizOps"},{"$f":"All!P210","v":0},{"$f":"All!Q210","v":0},{"$f":"All!R210","v":0},{"$f":"All!S210","v":0},{"$f":"All!T210","v":0},{"$f":"All!U210","v":0},{"$f":"All!V210","v":0},{"$f":"All!W210","v":0},{"$f":"All!X210","v":0},{"$f":"All!Y210","v":0},{"$f":"All!Z210","v":0},{"$f":"All!AA210","v":0},{"$f":"All!AB210","v":0},{"$f":"All!AC210","v":0},{"$f":"All!AD210","v":0},{"$f":"All!AE210","v":0},{"$f":"All!AF210","v":0},{"$f":"All!AG210","v":0},{"$f":"All!AH210","v":0},{"$f":"All!AI210","v":0},{"$f":"All!AJ210","v":0},{"$f":"All!AK210","v":0},{"$f":"All!AL210","v":0},{"$f":"All!AM210","v":0},{"$f":"All!AN210","v":0},{"$f":"All!AO210","v":0},{"$f":"All!AP210","v":0},{"$f":"All!AQ210","v":0},{"$f":"All!AR210","v":0},{"$f":"All!AS210","v":0},{"$f":"All!AT210","v":0}]
[null,{"$f":"All!B211","v":"3"},{"$f":"All!C211","v":"3.4"},{"$f":"All!D211","v":"3.4.1"},{"$f":"All!E211","v":""},{"$f":"All!F211","v":"3.4.1.11"},{"$f":"All!G211","v":"3.4.1.11: OUTSOURCING MANAGEMENT\nProviders should monitor entities providing material outsourced services (see definition) against agreed service levels (see 3.3) and notify entities of exceptions and unsatisfactory performance. Procedures for escalation of issues on both sides of the relationship should be implemented. \n\nThe provider should manage the relationship with each entity providing outsourced services to ensure that there are lines of communication for information exchange so that relevant information is shared promptly by both parties."},{"$f":"All!H211","v":0},{"$f":"All!I211","v":"3.4.1.11.1"},{"$f":"All!J211","v":"3.4.1.11.1: Are entities providing material outsourced services (see see definition) monitored against agreed service levels and notified of exceptions and unsatisfactory performance?\n"},{"$f":"All!K211","v":0},{"$f":"All!L211","v":0},{"$f":"All!M211","v":"Recommended"},{"$f":"All!N211","v":"Recommended"},{"$f":"All!O211","v":"BizOps"},{"$f":"All!P211","v":0},{"$f":"All!Q211","v":0},{"$f":"All!R211","v":0},{"$f":"All!S211","v":0},{"$f":"All!T211","v":0},{"$f":"All!U211","v":0},{"$f":"All!V211","v":0},{"$f":"All!W211","v":0},{"$f":"All!X211","v":0},{"$f":"All!Y211","v":0},{"$f":"All!Z211","v":0},{"$f":"All!AA211","v":0},{"$f":"All!AB211","v":0},{"$f":"All!AC211","v":0},{"$f":"All!AD211","v":0},{"$f":"All!AE211","v":0},{"$f":"All!AF211","v":0},{"$f":"All!AG211","v":0},{"$f":"All!AH211","v":0},{"$f":"All!AI211","v":0},{"$f":"All!AJ211","v":0},{"$f":"All!AK211","v":0},{"$f":"All!AL211","v":0},{"$f":"All!AM211","v":0},{"$f":"All!AN211","v":0},{"$f":"All!AO211","v":0},{"$f":"All!AP211","v":0},{"$f":"All!AQ211","v":0},{"$f":"All!AR211","v":0},{"$f":"All!AS211","v":0},{"$f":"All!AT211","v":0}]
[null,{"$f":"All!B212","v":"3"},{"$f":"All!C212","v":"3.4"},{"$f":"All!D212","v":"3.4.1"},{"$f":"All!E212","v":""},{"$f":"All!F212","v":"3.4.1.12"},{"$f":"All!G212","v":"3.4.1.12: OUTSOURCING MANAGEMENT - DISPUTE MANAGEMENT\nA dispute management process should be implemented with each entity providing outsourced services to resolve major issues and contractual disputes that cannot be resolved by the normal issue management and escalation process."},{"$f":"All!H212","v":0},{"$f":"All!I212","v":"3.4.1.12.1"},{"$f":"All!J212","v":"3.4.1.12.1: Has a dispute management process been implemented with each entity providing outsourced services to resolve major issues and contractual disputes?\n"},{"$f":"All!K212","v":0},{"$f":"All!L212","v":0},{"$f":"All!M212","v":"Recommended"},{"$f":"All!N212","v":"Recommended"},{"$f":"All!O212","v":"BizOps"},{"$f":"All!P212","v":0},{"$f":"All!Q212","v":0},{"$f":"All!R212","v":0},{"$f":"All!S212","v":0},{"$f":"All!T212","v":0},{"$f":"All!U212","v":0},{"$f":"All!V212","v":0},{"$f":"All!W212","v":0},{"$f":"All!X212","v":0},{"$f":"All!Y212","v":0},{"$f":"All!Z212","v":0},{"$f":"All!AA212","v":0},{"$f":"All!AB212","v":0},{"$f":"All!AC212","v":0},{"$f":"All!AD212","v":0},{"$f":"All!AE212","v":0},{"$f":"All!AF212","v":0},{"$f":"All!AG212","v":0},{"$f":"All!AH212","v":0},{"$f":"All!AI212","v":0},{"$f":"All!AJ212","v":0},{"$f":"All!AK212","v":0},{"$f":"All!AL212","v":0},{"$f":"All!AM212","v":0},{"$f":"All!AN212","v":0},{"$f":"All!AO212","v":0},{"$f":"All!AP212","v":0},{"$f":"All!AQ212","v":0},{"$f":"All!AR212","v":0},{"$f":"All!AS212","v":0},{"$f":"All!AT212","v":0}]
[null,{"$f":"All!B213","v":"3"},{"$f":"All!C213","v":"3.4"},{"$f":"All!D213","v":"3.4.1"},{"$f":"All!E213","v":""},{"$f":"All!F213","v":"3.4.1.13"},{"$f":"All!G213","v":"3.4.1.13: OUTSOURCING RISK MANAGEMENT\nThe provider should conduct risk management for outsourced services. When assessing outsourcing risk, all of the following factors should be considered:\n- Performance of entity providing outsourced services in managing and controlling their own risks;\n- Relationship between provider and entity providing outsourced services;\n- Financial, reputational, and operational impact on provider of performance failure by entity providing outsourced services;\n- Potential losses to provider’s customers due to performance failure by entity providing outsourced services;\n- Effects of outsourcing on the ability of provider to comply with legal/regulatory requirements (and adapt to changes in regulatory requirements);\n- Effort/time required to switch to alternate entity providing outsourced services or to bring activity in-house, if necessary;\n- Complexity of each outsourcing arrangement and the overall level of outsourcing complexity;\n- Impact of outsourcing on the provider's ability to supervise its business;\n- Ability of each entity providing outsourced services to adhere to the provider's security policy."},{"$f":"All!H213","v":"BCBS OFS"},{"$f":"All!I213","v":"3.4.1.13.1"},{"$f":"All!J213","v":"3.4.1.13.1: Is risk management conducted for each mobile money function that is outsourced?\n"},{"$f":"All!K213","v":"1) Outsourcing risk management process / policy\n- Check that there is a process/method to identify mobile money functions that are outsourced\n- Check that there is risk management process for identified functions\n- Check that there is a process for dealing with outsourced functions that fail the risk management process. "},{"$f":"All!L213","v":0},{"$f":"All!M213","v":"Standard Required"},{"$f":"All!N213","v":"Required"},{"$f":"All!O213","v":"FraudRisk"},{"$f":"All!P213","v":0},{"$f":"All!Q213","v":0},{"$f":"All!R213","v":0},{"$f":"All!S213","v":0},{"$f":"All!T213","v":0},{"$f":"All!U213","v":0},{"$f":"All!V213","v":0},{"$f":"All!W213","v":0},{"$f":"All!X213","v":0},{"$f":"All!Y213","v":0},{"$f":"All!Z213","v":0},{"$f":"All!AA213","v":0},{"$f":"All!AB213","v":0},{"$f":"All!AC213","v":0},{"$f":"All!AD213","v":0},{"$f":"All!AE213","v":0},{"$f":"All!AF213","v":0},{"$f":"All!AG213","v":0},{"$f":"All!AH213","v":0},{"$f":"All!AI213","v":0},{"$f":"All!AJ213","v":0},{"$f":"All!AK213","v":0},{"$f":"All!AL213","v":0},{"$f":"All!AM213","v":0},{"$f":"All!AN213","v":0},{"$f":"All!AO213","v":0},{"$f":"All!AP213","v":0},{"$f":"All!AQ213","v":0},{"$f":"All!AR213","v":0},{"$f":"All!AS213","v":0},{"$f":"All!AT213","v":0}]
[null,{"$f":"All!B214","v":"3"},{"$f":"All!C214","v":"3.4"},{"$f":"All!D214","v":"3.4.1"},{"$f":"All!E214","v":""},{"$f":"All!F214","v":"3.4.1.13"},{"$f":"All!G214","v":0},{"$f":"All!H214","v":0},{"$f":"All!I214","v":"3.4.1.13.2"},{"$f":"All!J214","v":"3.4.1.13.2: Does risk management for outsourcing analyse the relationship between the provider and each entity providing outsourced services?\n"},{"$f":"All!K214","v":0},{"$f":"All!L214","v":0},{"$f":"All!M214","v":"Recommended"},{"$f":"All!N214","v":"Recommended"},{"$f":"All!O214","v":"FraudRisk"},{"$f":"All!P214","v":0},{"$f":"All!Q214","v":0},{"$f":"All!R214","v":0},{"$f":"All!S214","v":0},{"$f":"All!T214","v":0},{"$f":"All!U214","v":0},{"$f":"All!V214","v":0},{"$f":"All!W214","v":0},{"$f":"All!X214","v":0},{"$f":"All!Y214","v":0},{"$f":"All!Z214","v":0},{"$f":"All!AA214","v":0},{"$f":"All!AB214","v":0},{"$f":"All!AC214","v":0},{"$f":"All!AD214","v":0},{"$f":"All!AE214","v":0},{"$f":"All!AF214","v":0},{"$f":"All!AG214","v":0},{"$f":"All!AH214","v":0},{"$f":"All!AI214","v":0},{"$f":"All!AJ214","v":0},{"$f":"All!AK214","v":0},{"$f":"All!AL214","v":0},{"$f":"All!AM214","v":0},{"$f":"All!AN214","v":0},{"$f":"All!AO214","v":0},{"$f":"All!AP214","v":0},{"$f":"All!AQ214","v":0},{"$f":"All!AR214","v":0},{"$f":"All!AS214","v":0},{"$f":"All!AT214","v":0}]
[null,{"$f":"All!B215","v":"3"},{"$f":"All!C215","v":"3.4"},{"$f":"All!D215","v":"3.4.1"},{"$f":"All!E215","v":""},{"$f":"All!F215","v":"3.4.1.13"},{"$f":"All!G215","v":0},{"$f":"All!H215","v":0},{"$f":"All!I215","v":"3.4.1.13.3"},{"$f":"All!J215","v":"3.4.1.13.3: Does risk management for outsourcing evaluate the financial, reputational, and operational impact on provider of performance failure by each entity providing outsourced services?\n"},{"$f":"All!K215","v":0},{"$f":"All!L215","v":0},{"$f":"All!M215","v":"Recommended"},{"$f":"All!N215","v":"Recommended"},{"$f":"All!O215","v":"FraudRisk"},{"$f":"All!P215","v":0},{"$f":"All!Q215","v":0},{"$f":"All!R215","v":0},{"$f":"All!S215","v":0},{"$f":"All!T215","v":0},{"$f":"All!U215","v":0},{"$f":"All!V215","v":0},{"$f":"All!W215","v":0},{"$f":"All!X215","v":0},{"$f":"All!Y215","v":0},{"$f":"All!Z215","v":0},{"$f":"All!AA215","v":0},{"$f":"All!AB215","v":0},{"$f":"All!AC215","v":0},{"$f":"All!AD215","v":0},{"$f":"All!AE215","v":0},{"$f":"All!AF215","v":0},{"$f":"All!AG215","v":0},{"$f":"All!AH215","v":0},{"$f":"All!AI215","v":0},{"$f":"All!AJ215","v":0},{"$f":"All!AK215","v":0},{"$f":"All!AL215","v":0},{"$f":"All!AM215","v":0},{"$f":"All!AN215","v":0},{"$f":"All!AO215","v":0},{"$f":"All!AP215","v":0},{"$f":"All!AQ215","v":0},{"$f":"All!AR215","v":0},{"$f":"All!AS215","v":0},{"$f":"All!AT215","v":0}]
[null,{"$f":"All!B216","v":"3"},{"$f":"All!C216","v":"3.4"},{"$f":"All!D216","v":"3.4.1"},{"$f":"All!E216","v":0},{"$f":"All!F216","v":"3.4.1.13"},{"$f":"All!G216","v":0},{"$f":"All!H216","v":0},{"$f":"All!I216","v":"3.4.1.13.4"},{"$f":"All!J216","v":"3.4.1.13.4: Does risk management for outsourcing consider the effects of outsourcing on the ability of the provider to comply with legal/regulatory requirements (and adapt to changes in regulatory requirements)?\n"},{"$f":"All!K216","v":0},{"$f":"All!L216","v":0},{"$f":"All!M216","v":"Recommended"},{"$f":"All!N216","v":"Recommended"},{"$f":"All!O216","v":"FraudRisk"},{"$f":"All!P216","v":0},{"$f":"All!Q216","v":0},{"$f":"All!R216","v":0},{"$f":"All!S216","v":0},{"$f":"All!T216","v":0},{"$f":"All!U216","v":0},{"$f":"All!V216","v":0},{"$f":"All!W216","v":0},{"$f":"All!X216","v":0},{"$f":"All!Y216","v":0},{"$f":"All!Z216","v":0},{"$f":"All!AA216","v":0},{"$f":"All!AB216","v":0},{"$f":"All!AC216","v":0},{"$f":"All!AD216","v":0},{"$f":"All!AE216","v":0},{"$f":"All!AF216","v":0},{"$f":"All!AG216","v":0},{"$f":"All!AH216","v":0},{"$f":"All!AI216","v":0},{"$f":"All!AJ216","v":0},{"$f":"All!AK216","v":0},{"$f":"All!AL216","v":0},{"$f":"All!AM216","v":0},{"$f":"All!AN216","v":0},{"$f":"All!AO216","v":0},{"$f":"All!AP216","v":0},{"$f":"All!AQ216","v":0},{"$f":"All!AR216","v":0},{"$f":"All!AS216","v":0},{"$f":"All!AT216","v":0}]
[null,{"$f":"All!B217","v":"3"},{"$f":"All!C217","v":"3.4"},{"$f":"All!D217","v":"3.4.1"},{"$f":"All!E217","v":""},{"$f":"All!F217","v":"3.4.1.13"},{"$f":"All!G217","v":0},{"$f":"All!H217","v":0},{"$f":"All!I217","v":"3.4.1.13.5"},{"$f":"All!J217","v":"3.4.1.13.5: Does risk management for outsourcing assess the effort/time required to switch to an alternate entity providing outsourced services or to bring activity in-house, if necessary?\n"},{"$f":"All!K217","v":0},{"$f":"All!L217","v":0},{"$f":"All!M217","v":"Recommended"},{"$f":"All!N217","v":"Recommended"},{"$f":"All!O217","v":"FraudRisk"},{"$f":"All!P217","v":0},{"$f":"All!Q217","v":0},{"$f":"All!R217","v":0},{"$f":"All!S217","v":0},{"$f":"All!T217","v":0},{"$f":"All!U217","v":0},{"$f":"All!V217","v":0},{"$f":"All!W217","v":0},{"$f":"All!X217","v":0},{"$f":"All!Y217","v":0},{"$f":"All!Z217","v":0},{"$f":"All!AA217","v":0},{"$f":"All!AB217","v":0},{"$f":"All!AC217","v":0},{"$f":"All!AD217","v":0},{"$f":"All!AE217","v":0},{"$f":"All!AF217","v":0},{"$f":"All!AG217","v":0},{"$f":"All!AH217","v":0},{"$f":"All!AI217","v":0},{"$f":"All!AJ217","v":0},{"$f":"All!AK217","v":0},{"$f":"All!AL217","v":0},{"$f":"All!AM217","v":0},{"$f":"All!AN217","v":0},{"$f":"All!AO217","v":0},{"$f":"All!AP217","v":0},{"$f":"All!AQ217","v":0},{"$f":"All!AR217","v":0},{"$f":"All!AS217","v":0},{"$f":"All!AT217","v":0}]
[null,{"$f":"All!B218","v":"3"},{"$f":"All!C218","v":"3.4"},{"$f":"All!D218","v":"3.4.1"},{"$f":"All!E218","v":""},{"$f":"All!F218","v":"3.4.1.14"},{"$f":"All!G218","v":"3.4.1.14: OUTSOURCING MANAGEMENT - REVIEW OF OUTSOURCED SYSTEMS\nIf the mobile money system (or components of it) are outsourced, providers should review the technical capability of the supplier(s) at regular intervals - at least every two years or following a significant change to the services outsourced - including the following aspects:\n- System high-availability design;\n- Capacity management;\n- Technical operations;\n- Change management;\n- Disaster recovery and contingency plans;\n- IT security."},{"$f":"All!H218","v":"BCBS OFS"},{"$f":"All!I218","v":"3.4.1.14.1"},{"$f":"All!J218","v":"3.4.1.14.1: If the mobile money system (or components of it) are outsourced, is the technical capability of the supplier(s) being reviewed at regular intervals and following any significant changes?\n"},{"$f":"All!K218","v":"1) Outsourced risk management process / policy\n- Check that there is a process to review the technical capability of an outsourced function\n- Check that the outsource review plan include regular reviews and details for triggers for review (e.g. following significant changes)\n\n2) Outsourced function contract\n- Check that the contract or agreement includes the right for provider to review the technical capabilities of the outsource supplier."},{"$f":"All!L218","v":0},{"$f":"All!M218","v":"Recommended"},{"$f":"All!N218","v":"Recommended"},{"$f":"All!O218","v":"TechOps"},{"$f":"All!P218","v":0},{"$f":"All!Q218","v":0},{"$f":"All!R218","v":0},{"$f":"All!S218","v":0},{"$f":"All!T218","v":0},{"$f":"All!U218","v":0},{"$f":"All!V218","v":0},{"$f":"All!W218","v":0},{"$f":"All!X218","v":0},{"$f":"All!Y218","v":0},{"$f":"All!Z218","v":0},{"$f":"All!AA218","v":0},{"$f":"All!AB218","v":0},{"$f":"All!AC218","v":0},{"$f":"All!AD218","v":0},{"$f":"All!AE218","v":0},{"$f":"All!AF218","v":0},{"$f":"All!AG218","v":0},{"$f":"All!AH218","v":0},{"$f":"All!AI218","v":0},{"$f":"All!AJ218","v":0},{"$f":"All!AK218","v":0},{"$f":"All!AL218","v":0},{"$f":"All!AM218","v":0},{"$f":"All!AN218","v":0},{"$f":"All!AO218","v":0},{"$f":"All!AP218","v":0},{"$f":"All!AQ218","v":0},{"$f":"All!AR218","v":0},{"$f":"All!AS218","v":0},{"$f":"All!AT218","v":0}]
[null,{"$f":"All!B219","v":"4"},{"$f":"All!C219","v":"4.1"},{"$f":"All!D219","v":"4.1.1"},{"$f":"All!E219","v":"4.1.1: Providers shall ensure that the Board of Directors and senior management establish effective management oversight"},{"$f":"All!F219","v":"4.1.1.1"},{"$f":"All!G219","v":"4.1.1.1: GOVERNANCE OF MOBILE MONEY BUSINESS\nSenior management should develop a strategy and governance model for the mobile money business. This should:\n\n- define the governance structure and senior roles to manage the mobile money business;\n- define the scope of business that is addressed by mobile money;\n- communicate the importance of fulfilling regulatory requirements;\n- set measurable goals for the operation of the mobile money service (see 4.2);\n- specify management reviews and audits at planned intervals (see 4.2 and 4.1.1.3); and\n- ensure that risks to services are assessed and managed (see 4.6).\n\nThe strategy should be communicated to mobile money staff and should be regularly updated and reviewed for continued suitability.\n\nSenior management should ensure the provision of sufficient resources to fulfil the objectives of the mobile money business."},{"$f":"All!H219","v":"ISO 20000-1:2018 Sec. 5.1"},{"$f":"All!I219","v":"4.1.1.1.1"},{"$f":"All!J219","v":"4.1.1.1.1: Has senior management defined the governance and organization to manage the mobile money business?\n"},{"$f":"All!K219","v":"1) Mobile Money organization chart and/or governance documentation\n- Check the the governance structure of the mobile money business is documented.\n- Check the organisation of the mobile money business is documented."},{"$f":"All!L219","v":0},{"$f":"All!M219","v":"Urgent Required"},{"$f":"All!N219","v":"Required"},{"$f":"All!O219","v":"BizOps"},{"$f":"All!P219","v":0},{"$f":"All!Q219","v":0},{"$f":"All!R219","v":0},{"$f":"All!S219","v":0},{"$f":"All!T219","v":0},{"$f":"All!U219","v":0},{"$f":"All!V219","v":0},{"$f":"All!W219","v":0},{"$f":"All!X219","v":0},{"$f":"All!Y219","v":0},{"$f":"All!Z219","v":0},{"$f":"All!AA219","v":0},{"$f":"All!AB219","v":0},{"$f":"All!AC219","v":0},{"$f":"All!AD219","v":0},{"$f":"All!AE219","v":0},{"$f":"All!AF219","v":0},{"$f":"All!AG219","v":0},{"$f":"All!AH219","v":0},{"$f":"All!AI219","v":0},{"$f":"All!AJ219","v":0},{"$f":"All!AK219","v":0},{"$f":"All!AL219","v":0},{"$f":"All!AM219","v":0},{"$f":"All!AN219","v":0},{"$f":"All!AO219","v":0},{"$f":"All!AP219","v":0},{"$f":"All!AQ219","v":0},{"$f":"All!AR219","v":0},{"$f":"All!AS219","v":0},{"$f":"All!AT219","v":0}]
[null,{"$f":"All!B220","v":"4"},{"$f":"All!C220","v":"4.1"},{"$f":"All!D220","v":"4.1.1"},{"$f":"All!E220","v":0},{"$f":"All!F220","v":"4.1.1.1"},{"$f":"All!G220","v":0},{"$f":"All!H220","v":0},{"$f":"All!I220","v":"4.1.1.1.2"},{"$f":"All!J220","v":"4.1.1.1.2: Is the governance and organization regularly updated and reviewed for continued suitability?\n"},{"$f":"All!K220","v":"1) Mobile Money organization chart and/or governance documentation\n- Check the governance and organization model has been reviewed and approved in the last 24 months.\n"},{"$f":"All!L220","v":0},{"$f":"All!M220","v":"Standard Required"},{"$f":"All!N220","v":"Required"},{"$f":"All!O220","v":"BizOps"},{"$f":"All!P220","v":0},{"$f":"All!Q220","v":0},{"$f":"All!R220","v":0},{"$f":"All!S220","v":0},{"$f":"All!T220","v":0},{"$f":"All!U220","v":0},{"$f":"All!V220","v":0},{"$f":"All!W220","v":0},{"$f":"All!X220","v":0},{"$f":"All!Y220","v":0},{"$f":"All!Z220","v":0},{"$f":"All!AA220","v":0},{"$f":"All!AB220","v":0},{"$f":"All!AC220","v":0},{"$f":"All!AD220","v":0},{"$f":"All!AE220","v":0},{"$f":"All!AF220","v":0},{"$f":"All!AG220","v":0},{"$f":"All!AH220","v":0},{"$f":"All!AI220","v":0},{"$f":"All!AJ220","v":0},{"$f":"All!AK220","v":0},{"$f":"All!AL220","v":0},{"$f":"All!AM220","v":0},{"$f":"All!AN220","v":0},{"$f":"All!AO220","v":0},{"$f":"All!AP220","v":0},{"$f":"All!AQ220","v":0},{"$f":"All!AR220","v":0},{"$f":"All!AS220","v":0},{"$f":"All!AT220","v":0}]
[null,{"$f":"All!B221","v":"4"},{"$f":"All!C221","v":"4.1"},{"$f":"All!D221","v":"4.1.1"},{"$f":"All!E221","v":0},{"$f":"All!F221","v":"4.1.1.1"},{"$f":"All!G221","v":0},{"$f":"All!H221","v":0},{"$f":"All!I221","v":"4.1.1.1.3"},{"$f":"All!J221","v":"4.1.1.1.3: Has the scope of the mobile money business been formally identified and documented?\n"},{"$f":"All!K221","v":0},{"$f":"All!L221","v":0},{"$f":"All!M221","v":"Recommended"},{"$f":"All!N221","v":"Recommended"},{"$f":"All!O221","v":"BizOps"},{"$f":"All!P221","v":0},{"$f":"All!Q221","v":0},{"$f":"All!R221","v":0},{"$f":"All!S221","v":0},{"$f":"All!T221","v":0},{"$f":"All!U221","v":0},{"$f":"All!V221","v":0},{"$f":"All!W221","v":0},{"$f":"All!X221","v":0},{"$f":"All!Y221","v":0},{"$f":"All!Z221","v":0},{"$f":"All!AA221","v":0},{"$f":"All!AB221","v":0},{"$f":"All!AC221","v":0},{"$f":"All!AD221","v":0},{"$f":"All!AE221","v":0},{"$f":"All!AF221","v":0},{"$f":"All!AG221","v":0},{"$f":"All!AH221","v":0},{"$f":"All!AI221","v":0},{"$f":"All!AJ221","v":0},{"$f":"All!AK221","v":0},{"$f":"All!AL221","v":0},{"$f":"All!AM221","v":0},{"$f":"All!AN221","v":0},{"$f":"All!AO221","v":0},{"$f":"All!AP221","v":0},{"$f":"All!AQ221","v":0},{"$f":"All!AR221","v":0},{"$f":"All!AS221","v":0},{"$f":"All!AT221","v":0}]
[null,{"$f":"All!B222","v":"4"},{"$f":"All!C222","v":"4.1"},{"$f":"All!D222","v":"4.1.1"},{"$f":"All!E222","v":""},{"$f":"All!F222","v":"4.1.1.1"},{"$f":"All!G222","v":0},{"$f":"All!H222","v":0},{"$f":"All!I222","v":"4.1.1.1.4"},{"$f":"All!J222","v":"4.1.1.1.4: Does senior management ensure the provision of sufficient resources to fulfil the objectives of the mobile money business?\n"},{"$f":"All!K222","v":0},{"$f":"All!L222","v":0},{"$f":"All!M222","v":"Recommended"},{"$f":"All!N222","v":"Recommended"},{"$f":"All!O222","v":"BizOps"},{"$f":"All!P222","v":0},{"$f":"All!Q222","v":0},{"$f":"All!R222","v":0},{"$f":"All!S222","v":0},{"$f":"All!T222","v":0},{"$f":"All!U222","v":0},{"$f":"All!V222","v":0},{"$f":"All!W222","v":0},{"$f":"All!X222","v":0},{"$f":"All!Y222","v":0},{"$f":"All!Z222","v":0},{"$f":"All!AA222","v":0},{"$f":"All!AB222","v":0},{"$f":"All!AC222","v":0},{"$f":"All!AD222","v":0},{"$f":"All!AE222","v":0},{"$f":"All!AF222","v":0},{"$f":"All!AG222","v":0},{"$f":"All!AH222","v":0},{"$f":"All!AI222","v":0},{"$f":"All!AJ222","v":0},{"$f":"All!AK222","v":0},{"$f":"All!AL222","v":0},{"$f":"All!AM222","v":0},{"$f":"All!AN222","v":0},{"$f":"All!AO222","v":0},{"$f":"All!AP222","v":0},{"$f":"All!AQ222","v":0},{"$f":"All!AR222","v":0},{"$f":"All!AS222","v":0},{"$f":"All!AT222","v":0}]
[null,{"$f":"All!B223","v":"4"},{"$f":"All!C223","v":"4.1"},{"$f":"All!D223","v":"4.1.1"},{"$f":"All!E223","v":""},{"$f":"All!F223","v":"4.1.1.2"},{"$f":"All!G223","v":"4.1.1.2: HEAD OF MOBILE MONEY\nThe mobile money provider should appoint a head of mobile money, who is responsible for operating the mobile money service. The manager should:\n\n- ensure that managers are assigned for each function of service operation;\n- ensure appropriate documentation is produced for each area of service operation;\n- ensure that all operations (internal and via third parties) are managed to meet the goals of the service;\n- regularly report to senior management in service management reviews."},{"$f":"All!H223","v":"ISO 20000-1:2018 Sec. 5.1"},{"$f":"All!I223","v":"4.1.1.2.1"},{"$f":"All!J223","v":"4.1.1.2.1: Has a head of mobile money been assigned, who is responsible for operating the mobile money service?\n"},{"$f":"All!K223","v":"1) Mobile Money organization chart and/or governance documentation\n- Check a position exists for the Head of mobile money, and \n- Check responsibility for managing the mobile money business has been assigned to that position.  \n- Check that the position is currently filled.\n"},{"$f":"All!L223","v":0},{"$f":"All!M223","v":"Urgent Required"},{"$f":"All!N223","v":"Required"},{"$f":"All!O223","v":"BizOps"},{"$f":"All!P223","v":0},{"$f":"All!Q223","v":0},{"$f":"All!R223","v":0},{"$f":"All!S223","v":0},{"$f":"All!T223","v":0},{"$f":"All!U223","v":0},{"$f":"All!V223","v":0},{"$f":"All!W223","v":0},{"$f":"All!X223","v":0},{"$f":"All!Y223","v":0},{"$f":"All!Z223","v":0},{"$f":"All!AA223","v":0},{"$f":"All!AB223","v":0},{"$f":"All!AC223","v":0},{"$f":"All!AD223","v":0},{"$f":"All!AE223","v":0},{"$f":"All!AF223","v":0},{"$f":"All!AG223","v":0},{"$f":"All!AH223","v":0},{"$f":"All!AI223","v":0},{"$f":"All!AJ223","v":0},{"$f":"All!AK223","v":0},{"$f":"All!AL223","v":0},{"$f":"All!AM223","v":0},{"$f":"All!AN223","v":0},{"$f":"All!AO223","v":0},{"$f":"All!AP223","v":0},{"$f":"All!AQ223","v":0},{"$f":"All!AR223","v":0},{"$f":"All!AS223","v":0},{"$f":"All!AT223","v":0}]
[null,{"$f":"All!B224","v":"4"},{"$f":"All!C224","v":"4.1"},{"$f":"All!D224","v":"4.1.1"},{"$f":"All!E224","v":""},{"$f":"All!F224","v":"4.1.1.2"},{"$f":"All!G224","v":0},{"$f":"All!H224","v":0},{"$f":"All!I224","v":"4.1.1.2.2"},{"$f":"All!J224","v":"4.1.1.2.2: Does the head of mobile money report regularly to senior management on the performance of the mobile money service?\n"},{"$f":"All!K224","v":"1) Mobile money performance reports / service review report\n- Check that a mobile money performance report or service review report has been produced in the last six months.\n- Check that the report was sent to senior management."},{"$f":"All!L224","v":0},{"$f":"All!M224","v":"Urgent Required"},{"$f":"All!N224","v":"Required"},{"$f":"All!O224","v":"BizOps"},{"$f":"All!P224","v":0},{"$f":"All!Q224","v":0},{"$f":"All!R224","v":0},{"$f":"All!S224","v":0},{"$f":"All!T224","v":0},{"$f":"All!U224","v":0},{"$f":"All!V224","v":0},{"$f":"All!W224","v":0},{"$f":"All!X224","v":0},{"$f":"All!Y224","v":0},{"$f":"All!Z224","v":0},{"$f":"All!AA224","v":0},{"$f":"All!AB224","v":0},{"$f":"All!AC224","v":0},{"$f":"All!AD224","v":0},{"$f":"All!AE224","v":0},{"$f":"All!AF224","v":0},{"$f":"All!AG224","v":0},{"$f":"All!AH224","v":0},{"$f":"All!AI224","v":0},{"$f":"All!AJ224","v":0},{"$f":"All!AK224","v":0},{"$f":"All!AL224","v":0},{"$f":"All!AM224","v":0},{"$f":"All!AN224","v":0},{"$f":"All!AO224","v":0},{"$f":"All!AP224","v":0},{"$f":"All!AQ224","v":0},{"$f":"All!AR224","v":0},{"$f":"All!AS224","v":0},{"$f":"All!AT224","v":0}]
[null,{"$f":"All!B225","v":"4"},{"$f":"All!C225","v":"4.1"},{"$f":"All!D225","v":"4.1.1"},{"$f":"All!E225","v":""},{"$f":"All!F225","v":"4.1.1.3"},{"$f":"All!G225","v":"4.1.1.3: MOBILE MONEY AUDIT\nRegular audits or compliance reviews of the mobile money service should be carried out on behalf of senior management. In setting up the review, the following should be adhered to:\n- The scope and purpose should be defined - typically to evaluate whether the MM governance, internal control and risk management processes are operating effectively;\n- Reviewers could be internal and/or external, provided that they are independent - for example, the compliance function could do the review;\n- Planning of the audit / review should take into account the importance of the services, processes and areas to be audited and the results of previous reviews.\n- An Internal Audit function is created that reports directly to the Head of Mobile Money and its report is distributed to relevant management.\n"},{"$f":"All!H225","v":"ISO 20000-2:2019 Sec. 9.2"},{"$f":"All!I225","v":"4.1.1.3.1"},{"$f":"All!J225","v":"4.1.1.3.1: is an audit or compliance review of the mobile money service (or high-risk activities of mobile money) done to evaluate the MM governance, internal control and risk management processes - at least every two years and reporting to senior management?\n"},{"$f":"All!K225","v":"1. Header page of last audit, or audit policy/process/plan, or compliance framework\n- Check that an audit or compliance review of mobile money is performed at least every 2 years by an independent function (e.g. internal audit or compliance team).\n"},{"$f":"All!L225","v":0},{"$f":"All!M225","v":"Urgent Required"},{"$f":"All!N225","v":"Required"},{"$f":"All!O225","v":"BizOps"},{"$f":"All!P225","v":0},{"$f":"All!Q225","v":0},{"$f":"All!R225","v":0},{"$f":"All!S225","v":0},{"$f":"All!T225","v":0},{"$f":"All!U225","v":0},{"$f":"All!V225","v":0},{"$f":"All!W225","v":0},{"$f":"All!X225","v":0},{"$f":"All!Y225","v":0},{"$f":"All!Z225","v":0},{"$f":"All!AA225","v":0},{"$f":"All!AB225","v":0},{"$f":"All!AC225","v":0},{"$f":"All!AD225","v":0},{"$f":"All!AE225","v":0},{"$f":"All!AF225","v":0},{"$f":"All!AG225","v":0},{"$f":"All!AH225","v":0},{"$f":"All!AI225","v":0},{"$f":"All!AJ225","v":0},{"$f":"All!AK225","v":0},{"$f":"All!AL225","v":0},{"$f":"All!AM225","v":0},{"$f":"All!AN225","v":0},{"$f":"All!AO225","v":0},{"$f":"All!AP225","v":0},{"$f":"All!AQ225","v":0},{"$f":"All!AR225","v":0},{"$f":"All!AS225","v":0},{"$f":"All!AT225","v":0}]
[null,{"$f":"All!B226","v":"4"},{"$f":"All!C226","v":"4.1"},{"$f":"All!D226","v":"4.1.1"},{"$f":"All!E226","v":""},{"$f":"All!F226","v":"4.1.1.3"},{"$f":"All!G226","v":0},{"$f":"All!H226","v":0},{"$f":"All!I226","v":"4.1.1.3.2"},{"$f":"All!J226","v":"4.1.1.3.2: Are issues raised by audits / compliance reviews being followed up by senior management to ensure they are addressed promptly?\n"},{"$f":"All!K226","v":"1) Records of last audit, or audit policy/process/plan, or compliance framework\n- Check that issues raised by audits/compliance reviews are being followed up by senior management to ensure they are addressed promptly\n(Note: Records of the last audit / review could be redacted to remove sensitive contents but to show that actions are being followed up. Alternatively, the process documentation could be used as evidence)"},{"$f":"All!L226","v":0},{"$f":"All!M226","v":"Standard Required"},{"$f":"All!N226","v":"Required"},{"$f":"All!O226","v":"BizOps"},{"$f":"All!P226","v":0},{"$f":"All!Q226","v":0},{"$f":"All!R226","v":0},{"$f":"All!S226","v":0},{"$f":"All!T226","v":0},{"$f":"All!U226","v":0},{"$f":"All!V226","v":0},{"$f":"All!W226","v":0},{"$f":"All!X226","v":0},{"$f":"All!Y226","v":0},{"$f":"All!Z226","v":0},{"$f":"All!AA226","v":0},{"$f":"All!AB226","v":0},{"$f":"All!AC226","v":0},{"$f":"All!AD226","v":0},{"$f":"All!AE226","v":0},{"$f":"All!AF226","v":0},{"$f":"All!AG226","v":0},{"$f":"All!AH226","v":0},{"$f":"All!AI226","v":0},{"$f":"All!AJ226","v":0},{"$f":"All!AK226","v":0},{"$f":"All!AL226","v":0},{"$f":"All!AM226","v":0},{"$f":"All!AN226","v":0},{"$f":"All!AO226","v":0},{"$f":"All!AP226","v":0},{"$f":"All!AQ226","v":0},{"$f":"All!AR226","v":0},{"$f":"All!AS226","v":0},{"$f":"All!AT226","v":0}]
[null,{"$f":"All!B227","v":"4"},{"$f":"All!C227","v":"4.1"},{"$f":"All!D227","v":"4.1.1"},{"$f":"All!E227","v":""},{"$f":"All!F227","v":"4.1.1.3"},{"$f":"All!G227","v":0},{"$f":"All!H227","v":0},{"$f":"All!I227","v":"4.1.1.3.3"},{"$f":"All!J227","v":"4.1.1.3.3: Does the planning of the review take into account the importance of the services, processes and areas to be reviewed and the results of previous reviews?\n"},{"$f":"All!K227","v":0},{"$f":"All!L227","v":0},{"$f":"All!M227","v":"Recommended"},{"$f":"All!N227","v":"Recommended"},{"$f":"All!O227","v":"BizOps"},{"$f":"All!P227","v":0},{"$f":"All!Q227","v":0},{"$f":"All!R227","v":0},{"$f":"All!S227","v":0},{"$f":"All!T227","v":0},{"$f":"All!U227","v":0},{"$f":"All!V227","v":0},{"$f":"All!W227","v":0},{"$f":"All!X227","v":0},{"$f":"All!Y227","v":0},{"$f":"All!Z227","v":0},{"$f":"All!AA227","v":0},{"$f":"All!AB227","v":0},{"$f":"All!AC227","v":0},{"$f":"All!AD227","v":0},{"$f":"All!AE227","v":0},{"$f":"All!AF227","v":0},{"$f":"All!AG227","v":0},{"$f":"All!AH227","v":0},{"$f":"All!AI227","v":0},{"$f":"All!AJ227","v":0},{"$f":"All!AK227","v":0},{"$f":"All!AL227","v":0},{"$f":"All!AM227","v":0},{"$f":"All!AN227","v":0},{"$f":"All!AO227","v":0},{"$f":"All!AP227","v":0},{"$f":"All!AQ227","v":0},{"$f":"All!AR227","v":0},{"$f":"All!AS227","v":0},{"$f":"All!AT227","v":0}]
[null,{"$f":"All!B228","v":"4"},{"$f":"All!C228","v":"4.1"},{"$f":"All!D228","v":"4.1.1"},{"$f":"All!E228","v":""},{"$f":"All!F228","v":"4.1.1.4"},{"$f":"All!G228","v":"4.1.1.4: DOCUMENT MANAGEMENT POLICY\nA policy for document management should be documented and implemented. The policy should ensure that all business activities are properly documented. The document management policy should specify the following:\n- Each business function should be governed by its own documented policy.\n- All business processes should be documented.\n- Agreements with customers and suppliers should be documented and include service levels.\n- All documents should be reviewed and updated regularly.\n- Change controls should be implemented to manage changes to documents, with new versions of documents recorded using a proper change log.\n- Document retention should be specified, including old versions of documents."},{"$f":"All!H228","v":"ISO 20000-1:2011 Sec. 4.3"},{"$f":"All!I228","v":"4.1.1.4.1"},{"$f":"All!J228","v":"4.1.1.4.1: Has a document management policy, that requires all business activities to be properly documented, been specified and implemented?\n"},{"$f":"All!K228","v":"1. A Document management policy is in place which requires that all business activities are documented. Check that the policy requires:\n - all business units have documented policies;\n - all business processes are documented;\n - all customer and supplier contracts are documented and contain an SLA.\nCheck that the document management policy specifies document review periods, change control processes, version control and storage and retrieval processes.\nCheck that the policy has been signed by the current senior management team in the last 2 years."},{"$f":"All!L228","v":0},{"$f":"All!M228","v":"Recommended"},{"$f":"All!N228","v":"Recommended"},{"$f":"All!O228","v":"BizOps"},{"$f":"All!P228","v":0},{"$f":"All!Q228","v":0},{"$f":"All!R228","v":0},{"$f":"All!S228","v":0},{"$f":"All!T228","v":0},{"$f":"All!U228","v":0},{"$f":"All!V228","v":0},{"$f":"All!W228","v":0},{"$f":"All!X228","v":0},{"$f":"All!Y228","v":0},{"$f":"All!Z228","v":0},{"$f":"All!AA228","v":0},{"$f":"All!AB228","v":0},{"$f":"All!AC228","v":0},{"$f":"All!AD228","v":0},{"$f":"All!AE228","v":0},{"$f":"All!AF228","v":0},{"$f":"All!AG228","v":0},{"$f":"All!AH228","v":0},{"$f":"All!AI228","v":0},{"$f":"All!AJ228","v":0},{"$f":"All!AK228","v":0},{"$f":"All!AL228","v":0},{"$f":"All!AM228","v":0},{"$f":"All!AN228","v":0},{"$f":"All!AO228","v":0},{"$f":"All!AP228","v":0},{"$f":"All!AQ228","v":0},{"$f":"All!AR228","v":0},{"$f":"All!AS228","v":0},{"$f":"All!AT228","v":0}]
[null,{"$f":"All!B229","v":"4"},{"$f":"All!C229","v":"4.2"},{"$f":"All!D229","v":"4.2.1"},{"$f":"All!E229","v":"4.2.1: Providers and partners should operate technical systems properly and manage service levels"},{"$f":"All!F229","v":"4.2.1.1"},{"$f":"All!G229","v":"4.2.1.1: TECHNICAL OPERATIONS\nThe provider should create, implement and maintain technical operations documentation, which should include:\n1. Functional architecture and infrastructure architecture;\n2. Scheduled operational activities and dependencies. Include:;\n     - manual processes for manipulating systems or files (e.g. log file maintenance, renewing certificates);\n     - scheduling of regular jobs;\n     - instructions for handling errors or other exceptional conditions that might arise;\n     - system or component restart and recovery procedures for use in the event of errors or failures;\n     - backup of data and storage of backup material (see 5.3.5.2);\n     - management of system logs and system monitoring (see 5.3.6).\n\nOther technical operations documentation should include:\n - Effort and resources definition, including an organizational chart;\n - Compliance (e.g. ISO, PCI DSS, ITIL);\n - Operational management tools;\n - Risks to technical operations;\n - Planned activities (e.g. upgrades);\n - Governance, communication and reporting plan;\n - Service levels (see elsewhere in 4.2.1);\n - Incident support and escalation (see 4.4).\n\nRegular reviews and improvements should be part of the process."},{"$f":"All!H229","v":"ISO 20000-1:2018 Sec 6.3"},{"$f":"All!I229","v":"4.2.1.1.1"},{"$f":"All!J229","v":"4.2.1.1.1: Is documentation in place to define all technical operations activities of the mobile money system, including regular and scheduled technical operations tasks?\n"},{"$f":"All!K229","v":"1) Operational process documentation\n- Check this appears complete\n- Check this includes a process for regular / scheduled operational activities\n- Check the plan has been implemented \n"},{"$f":"All!L229","v":0},{"$f":"All!M229","v":"Urgent Required"},{"$f":"All!N229","v":"Required"},{"$f":"All!O229","v":"TechOps"},{"$f":"All!P229","v":0},{"$f":"All!Q229","v":0},{"$f":"All!R229","v":0},{"$f":"All!S229","v":0},{"$f":"All!T229","v":0},{"$f":"All!U229","v":0},{"$f":"All!V229","v":0},{"$f":"All!W229","v":0},{"$f":"All!X229","v":0},{"$f":"All!Y229","v":0},{"$f":"All!Z229","v":0},{"$f":"All!AA229","v":0},{"$f":"All!AB229","v":0},{"$f":"All!AC229","v":0},{"$f":"All!AD229","v":0},{"$f":"All!AE229","v":0},{"$f":"All!AF229","v":0},{"$f":"All!AG229","v":0},{"$f":"All!AH229","v":0},{"$f":"All!AI229","v":0},{"$f":"All!AJ229","v":0},{"$f":"All!AK229","v":0},{"$f":"All!AL229","v":0},{"$f":"All!AM229","v":0},{"$f":"All!AN229","v":0},{"$f":"All!AO229","v":0},{"$f":"All!AP229","v":0},{"$f":"All!AQ229","v":0},{"$f":"All!AR229","v":0},{"$f":"All!AS229","v":0},{"$f":"All!AT229","v":0}]
[null,{"$f":"All!B230","v":"4"},{"$f":"All!C230","v":"4.2"},{"$f":"All!D230","v":"4.2.1"},{"$f":"All!E230","v":0},{"$f":"All!F230","v":"4.2.1.1"},{"$f":"All!G230","v":0},{"$f":"All!H230","v":0},{"$f":"All!I230","v":"4.2.1.1.2"},{"$f":"All!J230","v":"4.2.1.1.2: Are the functional architecture and infrastructure architecture of the mobile money system documented?\n"},{"$f":"All!K230","v":"1) System architecture specification\n- Check both the functional and technical architecture has been documented"},{"$f":"All!L230","v":0},{"$f":"All!M230","v":"Urgent Required"},{"$f":"All!N230","v":"Required"},{"$f":"All!O230","v":"TechOps"},{"$f":"All!P230","v":0},{"$f":"All!Q230","v":0},{"$f":"All!R230","v":0},{"$f":"All!S230","v":0},{"$f":"All!T230","v":0},{"$f":"All!U230","v":0},{"$f":"All!V230","v":0},{"$f":"All!W230","v":0},{"$f":"All!X230","v":0},{"$f":"All!Y230","v":0},{"$f":"All!Z230","v":0},{"$f":"All!AA230","v":0},{"$f":"All!AB230","v":0},{"$f":"All!AC230","v":0},{"$f":"All!AD230","v":0},{"$f":"All!AE230","v":0},{"$f":"All!AF230","v":0},{"$f":"All!AG230","v":0},{"$f":"All!AH230","v":0},{"$f":"All!AI230","v":0},{"$f":"All!AJ230","v":0},{"$f":"All!AK230","v":0},{"$f":"All!AL230","v":0},{"$f":"All!AM230","v":0},{"$f":"All!AN230","v":0},{"$f":"All!AO230","v":0},{"$f":"All!AP230","v":0},{"$f":"All!AQ230","v":0},{"$f":"All!AR230","v":0},{"$f":"All!AS230","v":0},{"$f":"All!AT230","v":0}]
[null,{"$f":"All!B231","v":"4"},{"$f":"All!C231","v":"4.2"},{"$f":"All!D231","v":"4.2.1"},{"$f":"All!E231","v":0},{"$f":"All!F231","v":"4.2.1.1"},{"$f":"All!G231","v":0},{"$f":"All!H231","v":0},{"$f":"All!I231","v":"4.2.1.1.3"},{"$f":"All!J231","v":"4.2.1.1.3: Are the required resources documented, including an organizational chart and/or responsibility assignment matrix (RACI)?\n"},{"$f":"All!K231","v":"1) Organizational chart and/or responsibility assignment matrix (RACI) for all organizations supporting the platform (both internal and external, if applicable).\n- Check that the plan includes identification of required resources either by Technical operations organization chart and/or responsibility matrix.\n\n"},{"$f":"All!L231","v":0},{"$f":"All!M231","v":"Standard Required"},{"$f":"All!N231","v":"Required"},{"$f":"All!O231","v":"TechOps"},{"$f":"All!P231","v":0},{"$f":"All!Q231","v":0},{"$f":"All!R231","v":0},{"$f":"All!S231","v":0},{"$f":"All!T231","v":0},{"$f":"All!U231","v":0},{"$f":"All!V231","v":0},{"$f":"All!W231","v":0},{"$f":"All!X231","v":0},{"$f":"All!Y231","v":0},{"$f":"All!Z231","v":0},{"$f":"All!AA231","v":0},{"$f":"All!AB231","v":0},{"$f":"All!AC231","v":0},{"$f":"All!AD231","v":0},{"$f":"All!AE231","v":0},{"$f":"All!AF231","v":0},{"$f":"All!AG231","v":0},{"$f":"All!AH231","v":0},{"$f":"All!AI231","v":0},{"$f":"All!AJ231","v":0},{"$f":"All!AK231","v":0},{"$f":"All!AL231","v":0},{"$f":"All!AM231","v":0},{"$f":"All!AN231","v":0},{"$f":"All!AO231","v":0},{"$f":"All!AP231","v":0},{"$f":"All!AQ231","v":0},{"$f":"All!AR231","v":0},{"$f":"All!AS231","v":0},{"$f":"All!AT231","v":0}]
[null,{"$f":"All!B232","v":"4"},{"$f":"All!C232","v":"4.2"},{"$f":"All!D232","v":"4.2.1"},{"$f":"All!E232","v":""},{"$f":"All!F232","v":"4.2.1.1"},{"$f":"All!G232","v":0},{"$f":"All!H232","v":0},{"$f":"All!I232","v":"4.2.1.1.4"},{"$f":"All!J232","v":"4.2.1.1.4: Is the process for planned activities (e.g. upgrades) specified in the technical operations documentation so that they can be managed appropriately?\n"},{"$f":"All!K232","v":0},{"$f":"All!L232","v":0},{"$f":"All!M232","v":"Recommended"},{"$f":"All!N232","v":"Recommended"},{"$f":"All!O232","v":"TechOps"},{"$f":"All!P232","v":0},{"$f":"All!Q232","v":0},{"$f":"All!R232","v":0},{"$f":"All!S232","v":0},{"$f":"All!T232","v":0},{"$f":"All!U232","v":0},{"$f":"All!V232","v":0},{"$f":"All!W232","v":0},{"$f":"All!X232","v":0},{"$f":"All!Y232","v":0},{"$f":"All!Z232","v":0},{"$f":"All!AA232","v":0},{"$f":"All!AB232","v":0},{"$f":"All!AC232","v":0},{"$f":"All!AD232","v":0},{"$f":"All!AE232","v":0},{"$f":"All!AF232","v":0},{"$f":"All!AG232","v":0},{"$f":"All!AH232","v":0},{"$f":"All!AI232","v":0},{"$f":"All!AJ232","v":0},{"$f":"All!AK232","v":0},{"$f":"All!AL232","v":0},{"$f":"All!AM232","v":0},{"$f":"All!AN232","v":0},{"$f":"All!AO232","v":0},{"$f":"All!AP232","v":0},{"$f":"All!AQ232","v":0},{"$f":"All!AR232","v":0},{"$f":"All!AS232","v":0},{"$f":"All!AT232","v":0}]
[null,{"$f":"All!B233","v":"4"},{"$f":"All!C233","v":"4.2"},{"$f":"All!D233","v":"4.2.1"},{"$f":"All!E233","v":""},{"$f":"All!F233","v":"4.2.1.1"},{"$f":"All!G233","v":0},{"$f":"All!H233","v":0},{"$f":"All!I233","v":"4.2.1.1.5"},{"$f":"All!J233","v":"4.2.1.1.5: Is the technical operations documentation reviewed at planned intervals to ensure its continued suitability and effectiveness and to make improvements as necessary?\n"},{"$f":"All!K233","v":0},{"$f":"All!L233","v":0},{"$f":"All!M233","v":"Recommended"},{"$f":"All!N233","v":"Recommended"},{"$f":"All!O233","v":"TechOps"},{"$f":"All!P233","v":0},{"$f":"All!Q233","v":0},{"$f":"All!R233","v":0},{"$f":"All!S233","v":0},{"$f":"All!T233","v":0},{"$f":"All!U233","v":0},{"$f":"All!V233","v":0},{"$f":"All!W233","v":0},{"$f":"All!X233","v":0},{"$f":"All!Y233","v":0},{"$f":"All!Z233","v":0},{"$f":"All!AA233","v":0},{"$f":"All!AB233","v":0},{"$f":"All!AC233","v":0},{"$f":"All!AD233","v":0},{"$f":"All!AE233","v":0},{"$f":"All!AF233","v":0},{"$f":"All!AG233","v":0},{"$f":"All!AH233","v":0},{"$f":"All!AI233","v":0},{"$f":"All!AJ233","v":0},{"$f":"All!AK233","v":0},{"$f":"All!AL233","v":0},{"$f":"All!AM233","v":0},{"$f":"All!AN233","v":0},{"$f":"All!AO233","v":0},{"$f":"All!AP233","v":0},{"$f":"All!AQ233","v":0},{"$f":"All!AR233","v":0},{"$f":"All!AS233","v":0},{"$f":"All!AT233","v":0}]
[null,{"$f":"All!B234","v":"4"},{"$f":"All!C234","v":"4.2"},{"$f":"All!D234","v":"4.2.1"},{"$f":"All!E234","v":""},{"$f":"All!F234","v":"4.2.1.2"},{"$f":"All!G234","v":"4.2.1.2: BACKUPS\nProviders should implement a process for backups of the mobile money system, which determines: \n- the data that should be backed up;\n- the frequency of backups;\n- the mechanism for making backups;\n- the storage of backups;\n- the data retention period.\n\nBackups of the mobile money system and all financial data should be implemented according to the policy and carried out at least daily. Financial data should be backed up by replication to the Disaster Recovery site.\n\nBackups should be stored securely offsite (e.g. at a second data centre or a commercial storage facility) and securely disposed of when the retention period is passed. \n\nA process for restoring backed-up data should be implemented and tested."},{"$f":"All!H234","v":"PCI DSS, ISO 27002:2013 Sec. 12.3 "},{"$f":"All!I234","v":"4.2.1.2.1"},{"$f":"All!J234","v":"4.2.1.2.1: Has a process for mobile money system backups been documented that determines the data that is backed up, the frequency of backups and the data retention period?\n"},{"$f":"All!K234","v":"1) Backup process documentation\n- Check that the backup process has been documented\n- Check that the document includes details on:\n     a) The data that should be backed up;\n     b) The frequency of backups;\n     c) The data retention period."},{"$f":"All!L234","v":0},{"$f":"All!M234","v":"Standard Required"},{"$f":"All!N234","v":"Required"},{"$f":"All!O234","v":"TechOps"},{"$f":"All!P234","v":0},{"$f":"All!Q234","v":0},{"$f":"All!R234","v":0},{"$f":"All!S234","v":0},{"$f":"All!T234","v":0},{"$f":"All!U234","v":0},{"$f":"All!V234","v":0},{"$f":"All!W234","v":0},{"$f":"All!X234","v":0},{"$f":"All!Y234","v":0},{"$f":"All!Z234","v":0},{"$f":"All!AA234","v":0},{"$f":"All!AB234","v":0},{"$f":"All!AC234","v":0},{"$f":"All!AD234","v":0},{"$f":"All!AE234","v":0},{"$f":"All!AF234","v":0},{"$f":"All!AG234","v":0},{"$f":"All!AH234","v":0},{"$f":"All!AI234","v":0},{"$f":"All!AJ234","v":0},{"$f":"All!AK234","v":0},{"$f":"All!AL234","v":0},{"$f":"All!AM234","v":0},{"$f":"All!AN234","v":0},{"$f":"All!AO234","v":0},{"$f":"All!AP234","v":0},{"$f":"All!AQ234","v":0},{"$f":"All!AR234","v":0},{"$f":"All!AS234","v":0},{"$f":"All!AT234","v":0}]
[null,{"$f":"All!B235","v":"4"},{"$f":"All!C235","v":"4.2"},{"$f":"All!D235","v":"4.2.1"},{"$f":"All!E235","v":""},{"$f":"All!F235","v":"4.2.1.2"},{"$f":"All!G235","v":0},{"$f":"All!H235","v":0},{"$f":"All!I235","v":"4.2.1.2.2"},{"$f":"All!J235","v":"4.2.1.2.2: Is the mobile money system and all financial data backed up at least daily?\n"},{"$f":"All!K235","v":"1) Backup process documentation or backup logs\n- Check that the frequency of backup of the mobile money system is at least daily\n- Check that the backup includes all financial data"},{"$f":"All!L235","v":0},{"$f":"All!M235","v":"Urgent Required"},{"$f":"All!N235","v":"Required"},{"$f":"All!O235","v":"TechOps"},{"$f":"All!P235","v":0},{"$f":"All!Q235","v":0},{"$f":"All!R235","v":0},{"$f":"All!S235","v":0},{"$f":"All!T235","v":0},{"$f":"All!U235","v":0},{"$f":"All!V235","v":0},{"$f":"All!W235","v":0},{"$f":"All!X235","v":0},{"$f":"All!Y235","v":0},{"$f":"All!Z235","v":0},{"$f":"All!AA235","v":0},{"$f":"All!AB235","v":0},{"$f":"All!AC235","v":0},{"$f":"All!AD235","v":0},{"$f":"All!AE235","v":0},{"$f":"All!AF235","v":0},{"$f":"All!AG235","v":0},{"$f":"All!AH235","v":0},{"$f":"All!AI235","v":0},{"$f":"All!AJ235","v":0},{"$f":"All!AK235","v":0},{"$f":"All!AL235","v":0},{"$f":"All!AM235","v":0},{"$f":"All!AN235","v":0},{"$f":"All!AO235","v":0},{"$f":"All!AP235","v":0},{"$f":"All!AQ235","v":0},{"$f":"All!AR235","v":0},{"$f":"All!AS235","v":0},{"$f":"All!AT235","v":0}]
[null,{"$f":"All!B236","v":"4"},{"$f":"All!C236","v":"4.2"},{"$f":"All!D236","v":"4.2.1"},{"$f":"All!E236","v":""},{"$f":"All!F236","v":"4.2.1.2"},{"$f":"All!G236","v":0},{"$f":"All!H236","v":0},{"$f":"All!I236","v":"4.2.1.2.3"},{"$f":"All!J236","v":"4.2.1.2.3: Are backups stored securely offsite (e.g. at a second data centre or a commercial storage facility)?\n"},{"$f":"All!K236","v":"1) Backup process documentation\n- Check that the storage of backup data for the mobile money system is secure and offsite."},{"$f":"All!L236","v":0},{"$f":"All!M236","v":"Urgent Required"},{"$f":"All!N236","v":"Required"},{"$f":"All!O236","v":"TechOps"},{"$f":"All!P236","v":0},{"$f":"All!Q236","v":0},{"$f":"All!R236","v":0},{"$f":"All!S236","v":0},{"$f":"All!T236","v":0},{"$f":"All!U236","v":0},{"$f":"All!V236","v":0},{"$f":"All!W236","v":0},{"$f":"All!X236","v":0},{"$f":"All!Y236","v":0},{"$f":"All!Z236","v":0},{"$f":"All!AA236","v":0},{"$f":"All!AB236","v":0},{"$f":"All!AC236","v":0},{"$f":"All!AD236","v":0},{"$f":"All!AE236","v":0},{"$f":"All!AF236","v":0},{"$f":"All!AG236","v":0},{"$f":"All!AH236","v":0},{"$f":"All!AI236","v":0},{"$f":"All!AJ236","v":0},{"$f":"All!AK236","v":0},{"$f":"All!AL236","v":0},{"$f":"All!AM236","v":0},{"$f":"All!AN236","v":0},{"$f":"All!AO236","v":0},{"$f":"All!AP236","v":0},{"$f":"All!AQ236","v":0},{"$f":"All!AR236","v":0},{"$f":"All!AS236","v":0},{"$f":"All!AT236","v":0}]
[null,{"$f":"All!B237","v":"4"},{"$f":"All!C237","v":"4.2"},{"$f":"All!D237","v":"4.2.1"},{"$f":"All!E237","v":""},{"$f":"All!F237","v":"4.2.1.2"},{"$f":"All!G237","v":0},{"$f":"All!H237","v":0},{"$f":"All!I237","v":"4.2.1.2.4"},{"$f":"All!J237","v":"4.2.1.2.4: Has a process for restoring backed-up data been implemented and tested?\n"},{"$f":"All!K237","v":"1) Backup process documentation\n- Check there is process to restore backed-up data\n\n2) Backup test logs\n- Check that the restoration process has been tested\n"},{"$f":"All!L237","v":0},{"$f":"All!M237","v":"Standard Required"},{"$f":"All!N237","v":"Required"},{"$f":"All!O237","v":"TechOps"},{"$f":"All!P237","v":0},{"$f":"All!Q237","v":0},{"$f":"All!R237","v":0},{"$f":"All!S237","v":0},{"$f":"All!T237","v":0},{"$f":"All!U237","v":0},{"$f":"All!V237","v":0},{"$f":"All!W237","v":0},{"$f":"All!X237","v":0},{"$f":"All!Y237","v":0},{"$f":"All!Z237","v":0},{"$f":"All!AA237","v":0},{"$f":"All!AB237","v":0},{"$f":"All!AC237","v":0},{"$f":"All!AD237","v":0},{"$f":"All!AE237","v":0},{"$f":"All!AF237","v":0},{"$f":"All!AG237","v":0},{"$f":"All!AH237","v":0},{"$f":"All!AI237","v":0},{"$f":"All!AJ237","v":0},{"$f":"All!AK237","v":0},{"$f":"All!AL237","v":0},{"$f":"All!AM237","v":0},{"$f":"All!AN237","v":0},{"$f":"All!AO237","v":0},{"$f":"All!AP237","v":0},{"$f":"All!AQ237","v":0},{"$f":"All!AR237","v":0},{"$f":"All!AS237","v":0},{"$f":"All!AT237","v":0}]
[null,{"$f":"All!B238","v":"4"},{"$f":"All!C238","v":"4.2"},{"$f":"All!D238","v":"4.2.1"},{"$f":"All!E238","v":""},{"$f":"All!F238","v":"4.2.1.3"},{"$f":"All!G238","v":0},{"$f":"All!H238","v":"ISO 20000-1:2018 Sec 6.3"},{"$f":"All!I238","v":"4.2.1.3.1"},{"$f":"All!J238","v":"4.2.1.3.1: Are service levels defined for the mobile money system for availability and incident response/resolution times?\n"},{"$f":"All!K238","v":"1) Service level definition for technical functions\n- Check there are clearly defined service levels for the mobile money system\n- Check the service levels include:\na) Availability \nb) Incident response/resolution times\n"},{"$f":"All!L238","v":0},{"$f":"All!M238","v":"Urgent Required"},{"$f":"All!N238","v":"Required"},{"$f":"All!O238","v":"TechOps"},{"$f":"All!P238","v":0},{"$f":"All!Q238","v":0},{"$f":"All!R238","v":0},{"$f":"All!S238","v":0},{"$f":"All!T238","v":0},{"$f":"All!U238","v":0},{"$f":"All!V238","v":0},{"$f":"All!W238","v":0},{"$f":"All!X238","v":0},{"$f":"All!Y238","v":0},{"$f":"All!Z238","v":0},{"$f":"All!AA238","v":0},{"$f":"All!AB238","v":0},{"$f":"All!AC238","v":0},{"$f":"All!AD238","v":0},{"$f":"All!AE238","v":0},{"$f":"All!AF238","v":0},{"$f":"All!AG238","v":0},{"$f":"All!AH238","v":0},{"$f":"All!AI238","v":0},{"$f":"All!AJ238","v":0},{"$f":"All!AK238","v":0},{"$f":"All!AL238","v":0},{"$f":"All!AM238","v":0},{"$f":"All!AN238","v":0},{"$f":"All!AO238","v":0},{"$f":"All!AP238","v":0},{"$f":"All!AQ238","v":0},{"$f":"All!AR238","v":0},{"$f":"All!AS238","v":0},{"$f":"All!AT238","v":0}]
[null,{"$f":"All!B239","v":"4"},{"$f":"All!C239","v":"4.2"},{"$f":"All!D239","v":"4.2.1"},{"$f":"All!E239","v":""},{"$f":"All!F239","v":"4.2.1.3"},{"$f":"All!G239","v":0},{"$f":"All!H239","v":0},{"$f":"All!I239","v":"4.2.1.3.2"},{"$f":"All!J239","v":"4.2.1.3.2: Is the availability of the mobile money system being monitored and reported against the service level?\n"},{"$f":"All!K239","v":"1) Service level reports for technical functions\n- Check that the availability of the mobile money system is monitored against the service level and reports generated."},{"$f":"All!L239","v":0},{"$f":"All!M239","v":"Urgent Required"},{"$f":"All!N239","v":"Required"},{"$f":"All!O239","v":"TechOps"},{"$f":"All!P239","v":0},{"$f":"All!Q239","v":0},{"$f":"All!R239","v":0},{"$f":"All!S239","v":0},{"$f":"All!T239","v":0},{"$f":"All!U239","v":0},{"$f":"All!V239","v":0},{"$f":"All!W239","v":0},{"$f":"All!X239","v":0},{"$f":"All!Y239","v":0},{"$f":"All!Z239","v":0},{"$f":"All!AA239","v":0},{"$f":"All!AB239","v":0},{"$f":"All!AC239","v":0},{"$f":"All!AD239","v":0},{"$f":"All!AE239","v":0},{"$f":"All!AF239","v":0},{"$f":"All!AG239","v":0},{"$f":"All!AH239","v":0},{"$f":"All!AI239","v":0},{"$f":"All!AJ239","v":0},{"$f":"All!AK239","v":0},{"$f":"All!AL239","v":0},{"$f":"All!AM239","v":0},{"$f":"All!AN239","v":0},{"$f":"All!AO239","v":0},{"$f":"All!AP239","v":0},{"$f":"All!AQ239","v":0},{"$f":"All!AR239","v":0},{"$f":"All!AS239","v":0},{"$f":"All!AT239","v":0}]
[null,{"$f":"All!B240","v":"4"},{"$f":"All!C240","v":"4.2"},{"$f":"All!D240","v":"4.2.1"},{"$f":"All!E240","v":""},{"$f":"All!F240","v":"4.2.1.3"},{"$f":"All!G240","v":0},{"$f":"All!H240","v":0},{"$f":"All!I240","v":"4.2.1.3.3"},{"$f":"All!J240","v":"4.2.1.3.3: Are incident management reports being produced regularly to indicate whether service level targets are being met?\n"},{"$f":"All!K240","v":"1) Service level reports for technical functions\n- Check that incident management reports are being produced regularly to indicate whether service level targets are being met."},{"$f":"All!L240","v":0},{"$f":"All!M240","v":"Urgent Required"},{"$f":"All!N240","v":"Required"},{"$f":"All!O240","v":"TechOps"},{"$f":"All!P240","v":0},{"$f":"All!Q240","v":0},{"$f":"All!R240","v":0},{"$f":"All!S240","v":0},{"$f":"All!T240","v":0},{"$f":"All!U240","v":0},{"$f":"All!V240","v":0},{"$f":"All!W240","v":0},{"$f":"All!X240","v":0},{"$f":"All!Y240","v":0},{"$f":"All!Z240","v":0},{"$f":"All!AA240","v":0},{"$f":"All!AB240","v":0},{"$f":"All!AC240","v":0},{"$f":"All!AD240","v":0},{"$f":"All!AE240","v":0},{"$f":"All!AF240","v":0},{"$f":"All!AG240","v":0},{"$f":"All!AH240","v":0},{"$f":"All!AI240","v":0},{"$f":"All!AJ240","v":0},{"$f":"All!AK240","v":0},{"$f":"All!AL240","v":0},{"$f":"All!AM240","v":0},{"$f":"All!AN240","v":0},{"$f":"All!AO240","v":0},{"$f":"All!AP240","v":0},{"$f":"All!AQ240","v":0},{"$f":"All!AR240","v":0},{"$f":"All!AS240","v":0},{"$f":"All!AT240","v":0}]
[null,{"$f":"All!B241","v":"4"},{"$f":"All!C241","v":"4.2"},{"$f":"All!D241","v":"4.2.1"},{"$f":"All!E241","v":""},{"$f":"All!F241","v":"4.2.1.3"},{"$f":"All!G241","v":0},{"$f":"All!H241","v":0},{"$f":"All!I241","v":"4.2.1.3.4"},{"$f":"All!J241","v":"4.2.1.3.4: Is the performance of the mobile money system being monitored against its service levels (via end-to-end monitoring) and reported?\n"},{"$f":"All!K241","v":0},{"$f":"All!L241","v":0},{"$f":"All!M241","v":"Recommended"},{"$f":"All!N241","v":"Recommended"},{"$f":"All!O241","v":"TechOps"},{"$f":"All!P241","v":0},{"$f":"All!Q241","v":0},{"$f":"All!R241","v":0},{"$f":"All!S241","v":0},{"$f":"All!T241","v":0},{"$f":"All!U241","v":0},{"$f":"All!V241","v":0},{"$f":"All!W241","v":0},{"$f":"All!X241","v":0},{"$f":"All!Y241","v":0},{"$f":"All!Z241","v":0},{"$f":"All!AA241","v":0},{"$f":"All!AB241","v":0},{"$f":"All!AC241","v":0},{"$f":"All!AD241","v":0},{"$f":"All!AE241","v":0},{"$f":"All!AF241","v":0},{"$f":"All!AG241","v":0},{"$f":"All!AH241","v":0},{"$f":"All!AI241","v":0},{"$f":"All!AJ241","v":0},{"$f":"All!AK241","v":0},{"$f":"All!AL241","v":0},{"$f":"All!AM241","v":0},{"$f":"All!AN241","v":0},{"$f":"All!AO241","v":0},{"$f":"All!AP241","v":0},{"$f":"All!AQ241","v":0},{"$f":"All!AR241","v":0},{"$f":"All!AS241","v":0},{"$f":"All!AT241","v":0}]
[null,{"$f":"All!B242","v":"4"},{"$f":"All!C242","v":"4.2"},{"$f":"All!D242","v":"4.2.1"},{"$f":"All!E242","v":""},{"$f":"All!F242","v":"4.2.1.3"},{"$f":"All!G242","v":0},{"$f":"All!H242","v":0},{"$f":"All!I242","v":"4.2.1.3.5"},{"$f":"All!J242","v":"4.2.1.3.5: Are service levels set and monitored for each technical component of the mobile money system?\n"},{"$f":"All!K242","v":0},{"$f":"All!L242","v":0},{"$f":"All!M242","v":"Recommended"},{"$f":"All!N242","v":"Recommended"},{"$f":"All!O242","v":"TechOps"},{"$f":"All!P242","v":0},{"$f":"All!Q242","v":0},{"$f":"All!R242","v":0},{"$f":"All!S242","v":0},{"$f":"All!T242","v":0},{"$f":"All!U242","v":0},{"$f":"All!V242","v":0},{"$f":"All!W242","v":0},{"$f":"All!X242","v":0},{"$f":"All!Y242","v":0},{"$f":"All!Z242","v":0},{"$f":"All!AA242","v":0},{"$f":"All!AB242","v":0},{"$f":"All!AC242","v":0},{"$f":"All!AD242","v":0},{"$f":"All!AE242","v":0},{"$f":"All!AF242","v":0},{"$f":"All!AG242","v":0},{"$f":"All!AH242","v":0},{"$f":"All!AI242","v":0},{"$f":"All!AJ242","v":0},{"$f":"All!AK242","v":0},{"$f":"All!AL242","v":0},{"$f":"All!AM242","v":0},{"$f":"All!AN242","v":0},{"$f":"All!AO242","v":0},{"$f":"All!AP242","v":0},{"$f":"All!AQ242","v":0},{"$f":"All!AR242","v":0},{"$f":"All!AS242","v":0},{"$f":"All!AT242","v":0}]
[null,{"$f":"All!B243","v":"4"},{"$f":"All!C243","v":"4.2"},{"$f":"All!D243","v":"4.2.1"},{"$f":"All!E243","v":""},{"$f":"All!F243","v":"4.2.1.3"},{"$f":"All!G243","v":0},{"$f":"All!H243","v":0},{"$f":"All!I243","v":"4.2.1.3.6"},{"$f":"All!J243","v":"4.2.1.3.6: Are technical service level targets updated when changes are made to the mobile money service / system?\n"},{"$f":"All!K243","v":0},{"$f":"All!L243","v":0},{"$f":"All!M243","v":"Recommended"},{"$f":"All!N243","v":"Recommended"},{"$f":"All!O243","v":"TechOps"},{"$f":"All!P243","v":0},{"$f":"All!Q243","v":0},{"$f":"All!R243","v":0},{"$f":"All!S243","v":0},{"$f":"All!T243","v":0},{"$f":"All!U243","v":0},{"$f":"All!V243","v":0},{"$f":"All!W243","v":0},{"$f":"All!X243","v":0},{"$f":"All!Y243","v":0},{"$f":"All!Z243","v":0},{"$f":"All!AA243","v":0},{"$f":"All!AB243","v":0},{"$f":"All!AC243","v":0},{"$f":"All!AD243","v":0},{"$f":"All!AE243","v":0},{"$f":"All!AF243","v":0},{"$f":"All!AG243","v":0},{"$f":"All!AH243","v":0},{"$f":"All!AI243","v":0},{"$f":"All!AJ243","v":0},{"$f":"All!AK243","v":0},{"$f":"All!AL243","v":0},{"$f":"All!AM243","v":0},{"$f":"All!AN243","v":0},{"$f":"All!AO243","v":0},{"$f":"All!AP243","v":0},{"$f":"All!AQ243","v":0},{"$f":"All!AR243","v":0},{"$f":"All!AS243","v":0},{"$f":"All!AT243","v":0}]
[null,{"$f":"All!B244","v":"4"},{"$f":"All!C244","v":"4.2"},{"$f":"All!D244","v":"4.2.1"},{"$f":"All!E244","v":""},{"$f":"All!F244","v":"4.2.1.4"},{"$f":"All!G244","v":"4.2.1.4: SYSTEM MONITORING\nThe mobile money system components should be monitored using a centralized monitoring system, and alerts should be raised in case of problems or failures. Alerts should result in incidents or problems being raised (see 4.4).\n"},{"$f":"All!H244","v":"PCI DSS, ISO 27002: 2013 Sec. 12.4 "},{"$f":"All!I244","v":"4.2.1.4.1"},{"$f":"All!J244","v":"4.2.1.4.1: Are all mobile money system components monitored, and are alerts raised in case of problems or failures?\n"},{"$f":"All!K244","v":"1) Monitoring and alerting system logs or specification\n- Check that there is a monitoring / alerting system to monitor log files of all components of the mobile money system.\n- Check that the monitoring system raises alerts in case of problems or failures."},{"$f":"All!L244","v":0},{"$f":"All!M244","v":"Urgent Required"},{"$f":"All!N244","v":"Required"},{"$f":"All!O244","v":"TechOps"},{"$f":"All!P244","v":0},{"$f":"All!Q244","v":0},{"$f":"All!R244","v":0},{"$f":"All!S244","v":0},{"$f":"All!T244","v":0},{"$f":"All!U244","v":0},{"$f":"All!V244","v":0},{"$f":"All!W244","v":0},{"$f":"All!X244","v":0},{"$f":"All!Y244","v":0},{"$f":"All!Z244","v":0},{"$f":"All!AA244","v":0},{"$f":"All!AB244","v":0},{"$f":"All!AC244","v":0},{"$f":"All!AD244","v":0},{"$f":"All!AE244","v":0},{"$f":"All!AF244","v":0},{"$f":"All!AG244","v":0},{"$f":"All!AH244","v":0},{"$f":"All!AI244","v":0},{"$f":"All!AJ244","v":0},{"$f":"All!AK244","v":0},{"$f":"All!AL244","v":0},{"$f":"All!AM244","v":0},{"$f":"All!AN244","v":0},{"$f":"All!AO244","v":0},{"$f":"All!AP244","v":0},{"$f":"All!AQ244","v":0},{"$f":"All!AR244","v":0},{"$f":"All!AS244","v":0},{"$f":"All!AT244","v":0}]
[null,{"$f":"All!B245","v":"4"},{"$f":"All!C245","v":"4.2"},{"$f":"All!D245","v":"4.2.1"},{"$f":"All!E245","v":""},{"$f":"All!F245","v":"4.2.1.5"},{"$f":"All!G245","v":"4.2.1.5: TIME SYNCHRONIZATION\nProviders should use up-to-date time-synchronization technology to synchronize all mobile money system clocks."},{"$f":"All!H245","v":"PCI DSS, ISO 27002: 2013 Sec. 12.4 "},{"$f":"All!I245","v":"4.2.1.5.1"},{"$f":"All!J245","v":"4.2.1.5.1: Is up-to-date time-synchronization technology used to synchronize all mobile money system clocks?\n"},{"$f":"All!K245","v":"1) System architecture specification \n- Check that there is a system for synchronisation of all mobile money system clocks (e.g. NTP server)."},{"$f":"All!L245","v":0},{"$f":"All!M245","v":"Standard Required"},{"$f":"All!N245","v":"Required"},{"$f":"All!O245","v":"TechOps"},{"$f":"All!P245","v":0},{"$f":"All!Q245","v":0},{"$f":"All!R245","v":0},{"$f":"All!S245","v":0},{"$f":"All!T245","v":0},{"$f":"All!U245","v":0},{"$f":"All!V245","v":0},{"$f":"All!W245","v":0},{"$f":"All!X245","v":0},{"$f":"All!Y245","v":0},{"$f":"All!Z245","v":0},{"$f":"All!AA245","v":0},{"$f":"All!AB245","v":0},{"$f":"All!AC245","v":0},{"$f":"All!AD245","v":0},{"$f":"All!AE245","v":0},{"$f":"All!AF245","v":0},{"$f":"All!AG245","v":0},{"$f":"All!AH245","v":0},{"$f":"All!AI245","v":0},{"$f":"All!AJ245","v":0},{"$f":"All!AK245","v":0},{"$f":"All!AL245","v":0},{"$f":"All!AM245","v":0},{"$f":"All!AN245","v":0},{"$f":"All!AO245","v":0},{"$f":"All!AP245","v":0},{"$f":"All!AQ245","v":0},{"$f":"All!AR245","v":0},{"$f":"All!AS245","v":0},{"$f":"All!AT245","v":0}]
[null,{"$f":"All!B246","v":"4"},{"$f":"All!C246","v":"4.2"},{"$f":"All!D246","v":"4.2.1"},{"$f":"All!E246","v":"4.2.2: Providers and partners should manage business operations and service levels"},{"$f":"All!F246","v":"4.2.2.1"},{"$f":"All!G246","v":"4.2.2.1: BUSINESS OPERATIONS\nThe business operations of mobile money should be organized and documented. Documentation of the business operations should include:\n -  Product definition documentation – describing mobile money features, functions, fees, customer transactions, etc.;\n -  Business function chart – which defines the roles of all the business functions (customer support, back-office operations, technical operations, financial operations, product management, etc.);\n -  Organization chart for the mobile money business.\n -  Business process definitions (i.e. standard operating procedures) for each back-office business function shown on the business function chart (i.e. functions such as agent / partner management, and product / service / channel management)."},{"$f":"All!H246","v":"ISO 20000-1:2018 Sec 6.3"},{"$f":"All!I246","v":"4.2.2.1.1"},{"$f":"All!J246","v":"4.2.2.1.1: Has product definition documentation been developed that describes mobile money services, features and fees?\n"},{"$f":"All!K246","v":"1) Commercial product catalogue\n- Check the commercial product catalogue describes the following aspects of the mobile money service:\n     a) Details of services and functions\n     b) Fees for each service"},{"$f":"All!L246","v":0},{"$f":"All!M246","v":"Urgent Required"},{"$f":"All!N246","v":"Required"},{"$f":"All!O246","v":"BizOps"},{"$f":"All!P246","v":0},{"$f":"All!Q246","v":0},{"$f":"All!R246","v":0},{"$f":"All!S246","v":0},{"$f":"All!T246","v":0},{"$f":"All!U246","v":0},{"$f":"All!V246","v":0},{"$f":"All!W246","v":0},{"$f":"All!X246","v":0},{"$f":"All!Y246","v":0},{"$f":"All!Z246","v":0},{"$f":"All!AA246","v":0},{"$f":"All!AB246","v":0},{"$f":"All!AC246","v":0},{"$f":"All!AD246","v":0},{"$f":"All!AE246","v":0},{"$f":"All!AF246","v":0},{"$f":"All!AG246","v":0},{"$f":"All!AH246","v":0},{"$f":"All!AI246","v":0},{"$f":"All!AJ246","v":0},{"$f":"All!AK246","v":0},{"$f":"All!AL246","v":0},{"$f":"All!AM246","v":0},{"$f":"All!AN246","v":0},{"$f":"All!AO246","v":0},{"$f":"All!AP246","v":0},{"$f":"All!AQ246","v":0},{"$f":"All!AR246","v":0},{"$f":"All!AS246","v":0},{"$f":"All!AT246","v":0}]
[null,{"$f":"All!B247","v":"4"},{"$f":"All!C247","v":"4.2"},{"$f":"All!D247","v":"4.2.1"},{"$f":"All!E247","v":0},{"$f":"All!F247","v":"4.2.2.1"},{"$f":"All!G247","v":0},{"$f":"All!H247","v":0},{"$f":"All!I247","v":"4.2.2.1.2"},{"$f":"All!J247","v":"4.2.2.1.2: Have business processes (standard operating procedures) been documented for each back-office business function?\n(i.e. functions such as agent / partner management, and product / service / channel management)\n\n[Note that this indicator is requesting process documentation for functions other than customer operations (principle 7), financial operations (principle 1), AML/CFT (principle 2), and technical operations (4.2.1.1).]\n"},{"$f":"All!K247","v":"1) Business processes (standard operating procedures) and Business function chart\n- Check that there are business processes for each back-office business function shown on the business function chart (i.e. functions such as agent / partner management, and product / service / channel management)."},{"$f":"All!L247","v":0},{"$f":"All!M247","v":"Recommended"},{"$f":"All!N247","v":"Recommended"},{"$f":"All!O247","v":"BizOps"},{"$f":"All!P247","v":0},{"$f":"All!Q247","v":0},{"$f":"All!R247","v":0},{"$f":"All!S247","v":0},{"$f":"All!T247","v":0},{"$f":"All!U247","v":0},{"$f":"All!V247","v":0},{"$f":"All!W247","v":0},{"$f":"All!X247","v":0},{"$f":"All!Y247","v":0},{"$f":"All!Z247","v":0},{"$f":"All!AA247","v":0},{"$f":"All!AB247","v":0},{"$f":"All!AC247","v":0},{"$f":"All!AD247","v":0},{"$f":"All!AE247","v":0},{"$f":"All!AF247","v":0},{"$f":"All!AG247","v":0},{"$f":"All!AH247","v":0},{"$f":"All!AI247","v":0},{"$f":"All!AJ247","v":0},{"$f":"All!AK247","v":0},{"$f":"All!AL247","v":0},{"$f":"All!AM247","v":0},{"$f":"All!AN247","v":0},{"$f":"All!AO247","v":0},{"$f":"All!AP247","v":0},{"$f":"All!AQ247","v":0},{"$f":"All!AR247","v":0},{"$f":"All!AS247","v":0},{"$f":"All!AT247","v":0}]
[null,{"$f":"All!B248","v":"4"},{"$f":"All!C248","v":"4.2"},{"$f":"All!D248","v":"4.2.1"},{"$f":"All!E248","v":0},{"$f":"All!F248","v":"4.2.2.1"},{"$f":"All!G248","v":0},{"$f":"All!H248","v":0},{"$f":"All!I248","v":"4.2.2.1.3"},{"$f":"All!J248","v":"4.2.2.1.3: Has a business function chart (or similar document) been developed that defines the roles of all the business functions (customer support, back-office operations, technical operations, financial operations, product management, etc.)?\n"},{"$f":"All!K248","v":0},{"$f":"All!L248","v":0},{"$f":"All!M248","v":"Recommended"},{"$f":"All!N248","v":"Recommended"},{"$f":"All!O248","v":"BizOps"},{"$f":"All!P248","v":0},{"$f":"All!Q248","v":0},{"$f":"All!R248","v":0},{"$f":"All!S248","v":0},{"$f":"All!T248","v":0},{"$f":"All!U248","v":0},{"$f":"All!V248","v":0},{"$f":"All!W248","v":0},{"$f":"All!X248","v":0},{"$f":"All!Y248","v":0},{"$f":"All!Z248","v":0},{"$f":"All!AA248","v":0},{"$f":"All!AB248","v":0},{"$f":"All!AC248","v":0},{"$f":"All!AD248","v":0},{"$f":"All!AE248","v":0},{"$f":"All!AF248","v":0},{"$f":"All!AG248","v":0},{"$f":"All!AH248","v":0},{"$f":"All!AI248","v":0},{"$f":"All!AJ248","v":0},{"$f":"All!AK248","v":0},{"$f":"All!AL248","v":0},{"$f":"All!AM248","v":0},{"$f":"All!AN248","v":0},{"$f":"All!AO248","v":0},{"$f":"All!AP248","v":0},{"$f":"All!AQ248","v":0},{"$f":"All!AR248","v":0},{"$f":"All!AS248","v":0},{"$f":"All!AT248","v":0}]
[null,{"$f":"All!B249","v":"4"},{"$f":"All!C249","v":"4.2"},{"$f":"All!D249","v":"4.2.1"},{"$f":"All!E249","v":""},{"$f":"All!F249","v":"4.2.2.2"},{"$f":"All!G249","v":"4.2.2.2: BUSINESS SERVICE LEVEL MANAGEMENT\nService levels should be defined for customer-facing business processes. Examples of such processes include:\n- Calls to customer service (response time);\n- Processing reversals (time to complete the reversal); \n- Registration (time to activate account);\n- Reconciliation and settlement (time to complete).\n\nMonitoring should be implemented for each customer-facing business process against their service level targets, and reports generated for the relevant functional managers and the head of mobile money.\n\nBusiness process service level targets should be updated when changes are made to the mobile money service."},{"$f":"All!H249","v":"ISO 20000-1:2011 Sec. 6.1"},{"$f":"All!I249","v":"4.2.2.2.1"},{"$f":"All!J249","v":"4.2.2.2.1: Have service levels been defined for all customer-facing business processes (e.g. response time for calls to customer service, completion time for reversals, and time to complete account activation)?\n"},{"$f":"All!K249","v":0},{"$f":"All!L249","v":0},{"$f":"All!M249","v":"Recommended"},{"$f":"All!N249","v":"Recommended"},{"$f":"All!O249","v":"BizOps"},{"$f":"All!P249","v":0},{"$f":"All!Q249","v":0},{"$f":"All!R249","v":0},{"$f":"All!S249","v":0},{"$f":"All!T249","v":0},{"$f":"All!U249","v":0},{"$f":"All!V249","v":0},{"$f":"All!W249","v":0},{"$f":"All!X249","v":0},{"$f":"All!Y249","v":0},{"$f":"All!Z249","v":0},{"$f":"All!AA249","v":0},{"$f":"All!AB249","v":0},{"$f":"All!AC249","v":0},{"$f":"All!AD249","v":0},{"$f":"All!AE249","v":0},{"$f":"All!AF249","v":0},{"$f":"All!AG249","v":0},{"$f":"All!AH249","v":0},{"$f":"All!AI249","v":0},{"$f":"All!AJ249","v":0},{"$f":"All!AK249","v":0},{"$f":"All!AL249","v":0},{"$f":"All!AM249","v":0},{"$f":"All!AN249","v":0},{"$f":"All!AO249","v":0},{"$f":"All!AP249","v":0},{"$f":"All!AQ249","v":0},{"$f":"All!AR249","v":0},{"$f":"All!AS249","v":0},{"$f":"All!AT249","v":0}]
[null,{"$f":"All!B250","v":"4"},{"$f":"All!C250","v":"4.2"},{"$f":"All!D250","v":"4.2.1"},{"$f":"All!E250","v":""},{"$f":"All!F250","v":"4.2.2.2"},{"$f":"All!G250","v":0},{"$f":"All!H250","v":0},{"$f":"All!I250","v":"4.2.2.2.2"},{"$f":"All!J250","v":"4.2.2.2.2: Are customer-facing business processes monitored to track performance of the processes against the service level targets?\n"},{"$f":"All!K250","v":0},{"$f":"All!L250","v":0},{"$f":"All!M250","v":"Recommended"},{"$f":"All!N250","v":"Recommended"},{"$f":"All!O250","v":"BizOps"},{"$f":"All!P250","v":0},{"$f":"All!Q250","v":0},{"$f":"All!R250","v":0},{"$f":"All!S250","v":0},{"$f":"All!T250","v":0},{"$f":"All!U250","v":0},{"$f":"All!V250","v":0},{"$f":"All!W250","v":0},{"$f":"All!X250","v":0},{"$f":"All!Y250","v":0},{"$f":"All!Z250","v":0},{"$f":"All!AA250","v":0},{"$f":"All!AB250","v":0},{"$f":"All!AC250","v":0},{"$f":"All!AD250","v":0},{"$f":"All!AE250","v":0},{"$f":"All!AF250","v":0},{"$f":"All!AG250","v":0},{"$f":"All!AH250","v":0},{"$f":"All!AI250","v":0},{"$f":"All!AJ250","v":0},{"$f":"All!AK250","v":0},{"$f":"All!AL250","v":0},{"$f":"All!AM250","v":0},{"$f":"All!AN250","v":0},{"$f":"All!AO250","v":0},{"$f":"All!AP250","v":0},{"$f":"All!AQ250","v":0},{"$f":"All!AR250","v":0},{"$f":"All!AS250","v":0},{"$f":"All!AT250","v":0}]
[null,{"$f":"All!B251","v":"4"},{"$f":"All!C251","v":"4.2"},{"$f":"All!D251","v":"4.2.1"},{"$f":"All!E251","v":""},{"$f":"All!F251","v":"4.2.2.2"},{"$f":"All!G251","v":0},{"$f":"All!H251","v":0},{"$f":"All!I251","v":"4.2.2.2.3"},{"$f":"All!J251","v":"4.2.2.2.3: Are service reports being produced regularly for business process service levels to assess whether customer-facing business processes are meeting their service level targets?\n"},{"$f":"All!K251","v":0},{"$f":"All!L251","v":0},{"$f":"All!M251","v":"Recommended"},{"$f":"All!N251","v":"Recommended"},{"$f":"All!O251","v":"BizOps"},{"$f":"All!P251","v":0},{"$f":"All!Q251","v":0},{"$f":"All!R251","v":0},{"$f":"All!S251","v":0},{"$f":"All!T251","v":0},{"$f":"All!U251","v":0},{"$f":"All!V251","v":0},{"$f":"All!W251","v":0},{"$f":"All!X251","v":0},{"$f":"All!Y251","v":0},{"$f":"All!Z251","v":0},{"$f":"All!AA251","v":0},{"$f":"All!AB251","v":0},{"$f":"All!AC251","v":0},{"$f":"All!AD251","v":0},{"$f":"All!AE251","v":0},{"$f":"All!AF251","v":0},{"$f":"All!AG251","v":0},{"$f":"All!AH251","v":0},{"$f":"All!AI251","v":0},{"$f":"All!AJ251","v":0},{"$f":"All!AK251","v":0},{"$f":"All!AL251","v":0},{"$f":"All!AM251","v":0},{"$f":"All!AN251","v":0},{"$f":"All!AO251","v":0},{"$f":"All!AP251","v":0},{"$f":"All!AQ251","v":0},{"$f":"All!AR251","v":0},{"$f":"All!AS251","v":0},{"$f":"All!AT251","v":0}]
[null,{"$f":"All!B252","v":"4"},{"$f":"All!C252","v":"4.2"},{"$f":"All!D252","v":"4.2.1"},{"$f":"All!E252","v":""},{"$f":"All!F252","v":"4.2.2.2"},{"$f":"All!G252","v":0},{"$f":"All!H252","v":0},{"$f":"All!I252","v":"4.2.2.2.4"},{"$f":"All!J252","v":"4.2.2.2.4: Are business process service level targets updated when changes are made to the mobile money service?\n"},{"$f":"All!K252","v":0},{"$f":"All!L252","v":0},{"$f":"All!M252","v":"Recommended"},{"$f":"All!N252","v":"Recommended"},{"$f":"All!O252","v":"BizOps"},{"$f":"All!P252","v":0},{"$f":"All!Q252","v":0},{"$f":"All!R252","v":0},{"$f":"All!S252","v":0},{"$f":"All!T252","v":0},{"$f":"All!U252","v":0},{"$f":"All!V252","v":0},{"$f":"All!W252","v":0},{"$f":"All!X252","v":0},{"$f":"All!Y252","v":0},{"$f":"All!Z252","v":0},{"$f":"All!AA252","v":0},{"$f":"All!AB252","v":0},{"$f":"All!AC252","v":0},{"$f":"All!AD252","v":0},{"$f":"All!AE252","v":0},{"$f":"All!AF252","v":0},{"$f":"All!AG252","v":0},{"$f":"All!AH252","v":0},{"$f":"All!AI252","v":0},{"$f":"All!AJ252","v":0},{"$f":"All!AK252","v":0},{"$f":"All!AL252","v":0},{"$f":"All!AM252","v":0},{"$f":"All!AN252","v":0},{"$f":"All!AO252","v":0},{"$f":"All!AP252","v":0},{"$f":"All!AQ252","v":0},{"$f":"All!AR252","v":0},{"$f":"All!AS252","v":0},{"$f":"All!AT252","v":0}]
[null,{"$f":"All!B253","v":"4"},{"$f":"All!C253","v":"4.2"},{"$f":"All!D253","v":"4.2.1"},{"$f":"All!E253","v":""},{"$f":"All!F253","v":"4.2.2.3"},{"$f":"All!G253","v":"4.2.2.3: MANAGEMENT REPORTING\nManagement reports should be produced regularly to report on the performance of the mobile money service. This should include volume-based reports and event-based reports.\n\nEvent-based service reports should contain relevant information about significant events including at least:\na) Incidents involving service disruption \nb) SLA breaches\nc) Deployment or new or changed services \n\nVolume-based service reports should include at least:\n- volume of mobile money customers (registered and active);\n- volume of transactions (by transaction type);\n- customer satisfaction measurements such as customer complaints.\n\nManagement reports should be communicated to all mobile money managers and the head of mobile money.\n"},{"$f":"All!H253","v":0},{"$f":"All!I253","v":"4.2.2.3.1"},{"$f":"All!J253","v":"4.2.2.3.1: Are event-based management reports produced that contain relevant information about significant events, including (at minimum):\na) Incidents involving service disruption \nb) SLA breaches\nc) Deployment or new or changed services?\n"},{"$f":"All!K253","v":"1) Management operational reports \n- Check that management operational reports are being produced and contain relevant information on service events:\na) Incidents involving service disruption \nb) SLA breaches\nc) Deployment or new or changed services \n\n"},{"$f":"All!L253","v":0},{"$f":"All!M253","v":"Standard Required"},{"$f":"All!N253","v":"Required"},{"$f":"All!O253","v":"BizOps"},{"$f":"All!P253","v":0},{"$f":"All!Q253","v":0},{"$f":"All!R253","v":0},{"$f":"All!S253","v":0},{"$f":"All!T253","v":0},{"$f":"All!U253","v":0},{"$f":"All!V253","v":0},{"$f":"All!W253","v":0},{"$f":"All!X253","v":0},{"$f":"All!Y253","v":0},{"$f":"All!Z253","v":0},{"$f":"All!AA253","v":0},{"$f":"All!AB253","v":0},{"$f":"All!AC253","v":0},{"$f":"All!AD253","v":0},{"$f":"All!AE253","v":0},{"$f":"All!AF253","v":0},{"$f":"All!AG253","v":0},{"$f":"All!AH253","v":0},{"$f":"All!AI253","v":0},{"$f":"All!AJ253","v":0},{"$f":"All!AK253","v":0},{"$f":"All!AL253","v":0},{"$f":"All!AM253","v":0},{"$f":"All!AN253","v":0},{"$f":"All!AO253","v":0},{"$f":"All!AP253","v":0},{"$f":"All!AQ253","v":0},{"$f":"All!AR253","v":0},{"$f":"All!AS253","v":0},{"$f":"All!AT253","v":0}]
[null,{"$f":"All!B254","v":"4"},{"$f":"All!C254","v":"4.2"},{"$f":"All!D254","v":"4.2.1"},{"$f":"All!E254","v":""},{"$f":"All!F254","v":"4.2.2.3"},{"$f":"All!G254","v":0},{"$f":"All!H254","v":"ISO 20000-1:2018 Sec 9.3"},{"$f":"All!I254","v":"4.2.2.3.2"},{"$f":"All!J254","v":"4.2.2.3.2: Are volume-based management reports produced regularly that detail (at minimum) the volume of mobile money customers (registered and active), transactions (by transaction type), and customer complaints?\n"},{"$f":"All!K254","v":0},{"$f":"All!L254","v":0},{"$f":"All!M254","v":"Recommended"},{"$f":"All!N254","v":"Recommended"},{"$f":"All!O254","v":"BizOps"},{"$f":"All!P254","v":0},{"$f":"All!Q254","v":0},{"$f":"All!R254","v":0},{"$f":"All!S254","v":0},{"$f":"All!T254","v":0},{"$f":"All!U254","v":0},{"$f":"All!V254","v":0},{"$f":"All!W254","v":0},{"$f":"All!X254","v":0},{"$f":"All!Y254","v":0},{"$f":"All!Z254","v":0},{"$f":"All!AA254","v":0},{"$f":"All!AB254","v":0},{"$f":"All!AC254","v":0},{"$f":"All!AD254","v":0},{"$f":"All!AE254","v":0},{"$f":"All!AF254","v":0},{"$f":"All!AG254","v":0},{"$f":"All!AH254","v":0},{"$f":"All!AI254","v":0},{"$f":"All!AJ254","v":0},{"$f":"All!AK254","v":0},{"$f":"All!AL254","v":0},{"$f":"All!AM254","v":0},{"$f":"All!AN254","v":0},{"$f":"All!AO254","v":0},{"$f":"All!AP254","v":0},{"$f":"All!AQ254","v":0},{"$f":"All!AR254","v":0},{"$f":"All!AS254","v":0},{"$f":"All!AT254","v":0}]
[null,{"$f":"All!B255","v":"4"},{"$f":"All!C255","v":"4.2"},{"$f":"All!D255","v":"4.2.1"},{"$f":"All!E255","v":""},{"$f":"All!F255","v":"4.2.2.3"},{"$f":"All!G255","v":0},{"$f":"All!H255","v":0},{"$f":"All!I255","v":"4.2.2.3.3"},{"$f":"All!J255","v":"4.2.2.3.3: Are management reports being communicated to all mobile money managers and the head of mobile money?\n"},{"$f":"All!K255","v":0},{"$f":"All!L255","v":0},{"$f":"All!M255","v":"Recommended"},{"$f":"All!N255","v":"Recommended"},{"$f":"All!O255","v":"BizOps"},{"$f":"All!P255","v":0},{"$f":"All!Q255","v":0},{"$f":"All!R255","v":0},{"$f":"All!S255","v":0},{"$f":"All!T255","v":0},{"$f":"All!U255","v":0},{"$f":"All!V255","v":0},{"$f":"All!W255","v":0},{"$f":"All!X255","v":0},{"$f":"All!Y255","v":0},{"$f":"All!Z255","v":0},{"$f":"All!AA255","v":0},{"$f":"All!AB255","v":0},{"$f":"All!AC255","v":0},{"$f":"All!AD255","v":0},{"$f":"All!AE255","v":0},{"$f":"All!AF255","v":0},{"$f":"All!AG255","v":0},{"$f":"All!AH255","v":0},{"$f":"All!AI255","v":0},{"$f":"All!AJ255","v":0},{"$f":"All!AK255","v":0},{"$f":"All!AL255","v":0},{"$f":"All!AM255","v":0},{"$f":"All!AN255","v":0},{"$f":"All!AO255","v":0},{"$f":"All!AP255","v":0},{"$f":"All!AQ255","v":0},{"$f":"All!AR255","v":0},{"$f":"All!AS255","v":0},{"$f":"All!AT255","v":0}]
[null,{"$f":"All!B256","v":"4"},{"$f":"All!C256","v":"4.3"},{"$f":"All!D256","v":"4.3.1"},{"$f":"All!E256","v":"4.3.1: Providers shall take steps to ensure sufficient service capacity through forecasting, monitoring and testing"},{"$f":"All!F256","v":"4.3.1.1"},{"$f":"All!G256","v":"4.3.1.1: BUSINESS FORECASTING\nBusiness forecasts provide the key information for capacity planning. Realistic business forecasts for the mobile money business should be generated based on:\n- Current performance of mobile money business;\n- Current growth trends;\n- Analysis of mobile money and financial market;\n- Competitor analysis;\n- Growth from new activities - new products, additional marketing, sales/distribution activities, etc. \n\nFor capacity planning purposes, it is helpful to split forecasts as Low forecast / On-target forecast / High forecast. Of these, the on-target forecast is the most important. \n\nQuarterly forecasts over the coming 1-3 year period are recommended, but forecasts should be at least annual.\n\nForecasts should include the following parameters:\n- Number of subscribers (registered/active);\n- Number of transactions (by transaction type);\n- Volume of other functions, such as web access;\n- Number of calls (or other communication) to customer service."},{"$f":"All!H256","v":"ISO 20000-1:2019 Sec 6.2"},{"$f":"All!I256","v":"4.3.1.1.1"},{"$f":"All!J256","v":"4.3.1.1.1: Are business forecasts generated at least annually to provide a realistic prediction of the mobile money business over the coming 1-3 year period?\n"},{"$f":"All!K256","v":"1) Business forecasts \n- Check that business forecasts are produced at least annually and forecast over a 1-3 year horizon\n"},{"$f":"All!L256","v":0},{"$f":"All!M256","v":"Urgent Required"},{"$f":"All!N256","v":"Required"},{"$f":"All!O256","v":"BizOps"},{"$f":"All!P256","v":0},{"$f":"All!Q256","v":0},{"$f":"All!R256","v":0},{"$f":"All!S256","v":0},{"$f":"All!T256","v":0},{"$f":"All!U256","v":0},{"$f":"All!V256","v":0},{"$f":"All!W256","v":0},{"$f":"All!X256","v":0},{"$f":"All!Y256","v":0},{"$f":"All!Z256","v":0},{"$f":"All!AA256","v":0},{"$f":"All!AB256","v":0},{"$f":"All!AC256","v":0},{"$f":"All!AD256","v":0},{"$f":"All!AE256","v":0},{"$f":"All!AF256","v":0},{"$f":"All!AG256","v":0},{"$f":"All!AH256","v":0},{"$f":"All!AI256","v":0},{"$f":"All!AJ256","v":0},{"$f":"All!AK256","v":0},{"$f":"All!AL256","v":0},{"$f":"All!AM256","v":0},{"$f":"All!AN256","v":0},{"$f":"All!AO256","v":0},{"$f":"All!AP256","v":0},{"$f":"All!AQ256","v":0},{"$f":"All!AR256","v":0},{"$f":"All!AS256","v":0},{"$f":"All!AT256","v":0}]
[null,{"$f":"All!B257","v":"4"},{"$f":"All!C257","v":"4.3"},{"$f":"All!D257","v":"4.3.1"},{"$f":"All!E257","v":0},{"$f":"All!F257","v":"4.3.1.1"},{"$f":"All!G257","v":0},{"$f":"All!H257","v":0},{"$f":"All!I257","v":"4.3.1.1.2"},{"$f":"All!J257","v":"4.3.1.1.2: Do business forecasts include number of subscribers (registered and active) and number of transactions (by transaction type)?\n"},{"$f":"All!K257","v":"1) Business forecasts \n- Check business forecasts include number of subscribers (registered and active) and number of transactions by transaction type."},{"$f":"All!L257","v":0},{"$f":"All!M257","v":"Standard Required"},{"$f":"All!N257","v":"Required"},{"$f":"All!O257","v":"BizOps"},{"$f":"All!P257","v":0},{"$f":"All!Q257","v":0},{"$f":"All!R257","v":0},{"$f":"All!S257","v":0},{"$f":"All!T257","v":0},{"$f":"All!U257","v":0},{"$f":"All!V257","v":0},{"$f":"All!W257","v":0},{"$f":"All!X257","v":0},{"$f":"All!Y257","v":0},{"$f":"All!Z257","v":0},{"$f":"All!AA257","v":0},{"$f":"All!AB257","v":0},{"$f":"All!AC257","v":0},{"$f":"All!AD257","v":0},{"$f":"All!AE257","v":0},{"$f":"All!AF257","v":0},{"$f":"All!AG257","v":0},{"$f":"All!AH257","v":0},{"$f":"All!AI257","v":0},{"$f":"All!AJ257","v":0},{"$f":"All!AK257","v":0},{"$f":"All!AL257","v":0},{"$f":"All!AM257","v":0},{"$f":"All!AN257","v":0},{"$f":"All!AO257","v":0},{"$f":"All!AP257","v":0},{"$f":"All!AQ257","v":0},{"$f":"All!AR257","v":0},{"$f":"All!AS257","v":0},{"$f":"All!AT257","v":0}]
[null,{"$f":"All!B258","v":"4"},{"$f":"All!C258","v":"4.3"},{"$f":"All!D258","v":"4.3.1"},{"$f":"All!E258","v":0},{"$f":"All!F258","v":"4.3.1.1"},{"$f":"All!G258","v":0},{"$f":"All!H258","v":0},{"$f":"All!I258","v":"4.3.1.1.3"},{"$f":"All!J258","v":"4.3.1.1.3: Do business forecasts include number of calls (or other communication) to customer service and number of agents?\n"},{"$f":"All!K258","v":0},{"$f":"All!L258","v":0},{"$f":"All!M258","v":"Recommended"},{"$f":"All!N258","v":"Recommended"},{"$f":"All!O258","v":"BizOps"},{"$f":"All!P258","v":0},{"$f":"All!Q258","v":0},{"$f":"All!R258","v":0},{"$f":"All!S258","v":0},{"$f":"All!T258","v":0},{"$f":"All!U258","v":0},{"$f":"All!V258","v":0},{"$f":"All!W258","v":0},{"$f":"All!X258","v":0},{"$f":"All!Y258","v":0},{"$f":"All!Z258","v":0},{"$f":"All!AA258","v":0},{"$f":"All!AB258","v":0},{"$f":"All!AC258","v":0},{"$f":"All!AD258","v":0},{"$f":"All!AE258","v":0},{"$f":"All!AF258","v":0},{"$f":"All!AG258","v":0},{"$f":"All!AH258","v":0},{"$f":"All!AI258","v":0},{"$f":"All!AJ258","v":0},{"$f":"All!AK258","v":0},{"$f":"All!AL258","v":0},{"$f":"All!AM258","v":0},{"$f":"All!AN258","v":0},{"$f":"All!AO258","v":0},{"$f":"All!AP258","v":0},{"$f":"All!AQ258","v":0},{"$f":"All!AR258","v":0},{"$f":"All!AS258","v":0},{"$f":"All!AT258","v":0}]
[null,{"$f":"All!B259","v":"4"},{"$f":"All!C259","v":"4.3"},{"$f":"All!D259","v":"4.3.1"},{"$f":"All!E259","v":""},{"$f":"All!F259","v":"4.3.1.2"},{"$f":"All!G259","v":"4.3.1.2: CAPACITY PLAN - TECHNICAL\nThe technical capacity plan should determine how the technical system will support the forecast business volumes and performance (see 4.3.1.1). It should be a forward-looking projection with anticipated technial hardware upgrades. Providers should produce a technical capacity plan at least annually or more frequently if required due to rates of change to services and service volumes. \n\n The capacity plan should include the following analysis:\n- analysis of the business forecast of mobile money service usage;\n- analysis of past, current and forecast technical component usage and performance, including an understanding of which resources support which services and the potential impact of new technologies (system modelling and trend analysis can be used to analyse performance);\n- analysis of the impact on capacity from changes to requirements for availability, service continuity and performance service levels;\n\nThe capacity plan should determine the following technical requirements:\n- Horizontal scaling of system infrastructure\n- Vertical scaling of system infrastructure\n- Changes to system architecture to support the forecast business volumes.\n- Performance tuning of the system.\n\nThe capacity plan should determine the following business requirements:\n- Human resource and cost requirements to deliver the required technical performance;\n- The time and planning required to implement the technical changes.\n"},{"$f":"All!H259","v":"ISO 20000-1:2019 Sec 8.4.3"},{"$f":"All!I259","v":"4.3.1.2.1"},{"$f":"All!J259","v":"4.3.1.2.1: Is a technical capacity plan produced at least annually - i.e. a forward-looking projection with anticipated technial hardware upgrades?\n"},{"$f":"All!K259","v":"1) Technical capacity plan \n-  Check the technical capacity plan (a forward-looking projection with anticipated technial hardware upgrades) is produced at least annually."},{"$f":"All!L259","v":0},{"$f":"All!M259","v":"Urgent Required"},{"$f":"All!N259","v":"Required"},{"$f":"All!O259","v":"TechOps"},{"$f":"All!P259","v":0},{"$f":"All!Q259","v":0},{"$f":"All!R259","v":0},{"$f":"All!S259","v":0},{"$f":"All!T259","v":0},{"$f":"All!U259","v":0},{"$f":"All!V259","v":0},{"$f":"All!W259","v":0},{"$f":"All!X259","v":0},{"$f":"All!Y259","v":0},{"$f":"All!Z259","v":0},{"$f":"All!AA259","v":0},{"$f":"All!AB259","v":0},{"$f":"All!AC259","v":0},{"$f":"All!AD259","v":0},{"$f":"All!AE259","v":0},{"$f":"All!AF259","v":0},{"$f":"All!AG259","v":0},{"$f":"All!AH259","v":0},{"$f":"All!AI259","v":0},{"$f":"All!AJ259","v":0},{"$f":"All!AK259","v":0},{"$f":"All!AL259","v":0},{"$f":"All!AM259","v":0},{"$f":"All!AN259","v":0},{"$f":"All!AO259","v":0},{"$f":"All!AP259","v":0},{"$f":"All!AQ259","v":0},{"$f":"All!AR259","v":0},{"$f":"All!AS259","v":0},{"$f":"All!AT259","v":0}]
[null,{"$f":"All!B260","v":"4"},{"$f":"All!C260","v":"4.3"},{"$f":"All!D260","v":"4.3.1"},{"$f":"All!E260","v":""},{"$f":"All!F260","v":"4.3.1.2"},{"$f":"All!G260","v":0},{"$f":"All!H260","v":0},{"$f":"All!I260","v":"4.3.1.2.2"},{"$f":"All!J260","v":"4.3.1.2.2: Is the capacity plan based on the business forecast of transactions, subscribers and other functional usage?\n"},{"$f":"All!K260","v":"1) Technical capacity plan \n2) Business forecasts\n-  Check the technical capacity plan is based on the business forecasts of subscribers, volumes and other functional usage to meet projected growth requirements."},{"$f":"All!L260","v":0},{"$f":"All!M260","v":"Urgent Required"},{"$f":"All!N260","v":"Required"},{"$f":"All!O260","v":"TechOps"},{"$f":"All!P260","v":0},{"$f":"All!Q260","v":0},{"$f":"All!R260","v":0},{"$f":"All!S260","v":0},{"$f":"All!T260","v":0},{"$f":"All!U260","v":0},{"$f":"All!V260","v":0},{"$f":"All!W260","v":0},{"$f":"All!X260","v":0},{"$f":"All!Y260","v":0},{"$f":"All!Z260","v":0},{"$f":"All!AA260","v":0},{"$f":"All!AB260","v":0},{"$f":"All!AC260","v":0},{"$f":"All!AD260","v":0},{"$f":"All!AE260","v":0},{"$f":"All!AF260","v":0},{"$f":"All!AG260","v":0},{"$f":"All!AH260","v":0},{"$f":"All!AI260","v":0},{"$f":"All!AJ260","v":0},{"$f":"All!AK260","v":0},{"$f":"All!AL260","v":0},{"$f":"All!AM260","v":0},{"$f":"All!AN260","v":0},{"$f":"All!AO260","v":0},{"$f":"All!AP260","v":0},{"$f":"All!AQ260","v":0},{"$f":"All!AR260","v":0},{"$f":"All!AS260","v":0},{"$f":"All!AT260","v":0}]
[null,{"$f":"All!B261","v":"4"},{"$f":"All!C261","v":"4.3"},{"$f":"All!D261","v":"4.3.1"},{"$f":"All!E261","v":""},{"$f":"All!F261","v":"4.3.1.2"},{"$f":"All!G261","v":0},{"$f":"All!H261","v":0},{"$f":"All!I261","v":"4.3.1.2.3"},{"$f":"All!J261","v":"4.3.1.2.3: Is the capacity plan based on an analysis of usage and performance of all the components of the mobile money system?\n"},{"$f":"All!K261","v":"1) Technical capacity plan \n-  Check the technical capacity plan is based on analysis and usage of all the components of the mobile money system environment\n"},{"$f":"All!L261","v":0},{"$f":"All!M261","v":"Urgent Required"},{"$f":"All!N261","v":"Required"},{"$f":"All!O261","v":"TechOps"},{"$f":"All!P261","v":0},{"$f":"All!Q261","v":0},{"$f":"All!R261","v":0},{"$f":"All!S261","v":0},{"$f":"All!T261","v":0},{"$f":"All!U261","v":0},{"$f":"All!V261","v":0},{"$f":"All!W261","v":0},{"$f":"All!X261","v":0},{"$f":"All!Y261","v":0},{"$f":"All!Z261","v":0},{"$f":"All!AA261","v":0},{"$f":"All!AB261","v":0},{"$f":"All!AC261","v":0},{"$f":"All!AD261","v":0},{"$f":"All!AE261","v":0},{"$f":"All!AF261","v":0},{"$f":"All!AG261","v":0},{"$f":"All!AH261","v":0},{"$f":"All!AI261","v":0},{"$f":"All!AJ261","v":0},{"$f":"All!AK261","v":0},{"$f":"All!AL261","v":0},{"$f":"All!AM261","v":0},{"$f":"All!AN261","v":0},{"$f":"All!AO261","v":0},{"$f":"All!AP261","v":0},{"$f":"All!AQ261","v":0},{"$f":"All!AR261","v":0},{"$f":"All!AS261","v":0},{"$f":"All!AT261","v":0}]
[null,{"$f":"All!B262","v":"4"},{"$f":"All!C262","v":"4.3"},{"$f":"All!D262","v":"4.3.1"},{"$f":"All!E262","v":""},{"$f":"All!F262","v":"4.3.1.2"},{"$f":"All!G262","v":0},{"$f":"All!H262","v":0},{"$f":"All!I262","v":"4.3.1.2.4"},{"$f":"All!J262","v":"4.3.1.2.4: Does the capacity plan analyse changes to requirements for availability, service continuity and performance and the impact this has on system capacity?\n"},{"$f":"All!K262","v":0},{"$f":"All!L262","v":0},{"$f":"All!M262","v":"Recommended"},{"$f":"All!N262","v":"Recommended"},{"$f":"All!O262","v":"TechOps"},{"$f":"All!P262","v":0},{"$f":"All!Q262","v":0},{"$f":"All!R262","v":0},{"$f":"All!S262","v":0},{"$f":"All!T262","v":0},{"$f":"All!U262","v":0},{"$f":"All!V262","v":0},{"$f":"All!W262","v":0},{"$f":"All!X262","v":0},{"$f":"All!Y262","v":0},{"$f":"All!Z262","v":0},{"$f":"All!AA262","v":0},{"$f":"All!AB262","v":0},{"$f":"All!AC262","v":0},{"$f":"All!AD262","v":0},{"$f":"All!AE262","v":0},{"$f":"All!AF262","v":0},{"$f":"All!AG262","v":0},{"$f":"All!AH262","v":0},{"$f":"All!AI262","v":0},{"$f":"All!AJ262","v":0},{"$f":"All!AK262","v":0},{"$f":"All!AL262","v":0},{"$f":"All!AM262","v":0},{"$f":"All!AN262","v":0},{"$f":"All!AO262","v":0},{"$f":"All!AP262","v":0},{"$f":"All!AQ262","v":0},{"$f":"All!AR262","v":0},{"$f":"All!AS262","v":0},{"$f":"All!AT262","v":0}]
[null,{"$f":"All!B263","v":"4"},{"$f":"All!C263","v":"4.3"},{"$f":"All!D263","v":"4.3.1"},{"$f":"All!E263","v":""},{"$f":"All!F263","v":"4.3.1.2"},{"$f":"All!G263","v":0},{"$f":"All!H263","v":0},{"$f":"All!I263","v":"4.3.1.2.5"},{"$f":"All!J263","v":"4.3.1.2.5: Does the capacity plan determine all the technical changes to meet future capacity and performance needs, including horizontal and vertical scaling, changes to system architecture and performance tuning?\n"},{"$f":"All!K263","v":0},{"$f":"All!L263","v":0},{"$f":"All!M263","v":"Recommended"},{"$f":"All!N263","v":"Recommended"},{"$f":"All!O263","v":"TechOps"},{"$f":"All!P263","v":0},{"$f":"All!Q263","v":0},{"$f":"All!R263","v":0},{"$f":"All!S263","v":0},{"$f":"All!T263","v":0},{"$f":"All!U263","v":0},{"$f":"All!V263","v":0},{"$f":"All!W263","v":0},{"$f":"All!X263","v":0},{"$f":"All!Y263","v":0},{"$f":"All!Z263","v":0},{"$f":"All!AA263","v":0},{"$f":"All!AB263","v":0},{"$f":"All!AC263","v":0},{"$f":"All!AD263","v":0},{"$f":"All!AE263","v":0},{"$f":"All!AF263","v":0},{"$f":"All!AG263","v":0},{"$f":"All!AH263","v":0},{"$f":"All!AI263","v":0},{"$f":"All!AJ263","v":0},{"$f":"All!AK263","v":0},{"$f":"All!AL263","v":0},{"$f":"All!AM263","v":0},{"$f":"All!AN263","v":0},{"$f":"All!AO263","v":0},{"$f":"All!AP263","v":0},{"$f":"All!AQ263","v":0},{"$f":"All!AR263","v":0},{"$f":"All!AS263","v":0},{"$f":"All!AT263","v":0}]
[null,{"$f":"All!B264","v":"4"},{"$f":"All!C264","v":"4.3"},{"$f":"All!D264","v":"4.3.1"},{"$f":"All!E264","v":""},{"$f":"All!F264","v":"4.3.1.2"},{"$f":"All!G264","v":0},{"$f":"All!H264","v":0},{"$f":"All!I264","v":"4.3.1.2.6"},{"$f":"All!J264","v":"4.3.1.2.6: Does the capacity plan determine business requirements such as resources, time and planning to implement technical capacity changes?\n"},{"$f":"All!K264","v":0},{"$f":"All!L264","v":0},{"$f":"All!M264","v":"Recommended"},{"$f":"All!N264","v":"Recommended"},{"$f":"All!O264","v":"TechOps"},{"$f":"All!P264","v":0},{"$f":"All!Q264","v":0},{"$f":"All!R264","v":0},{"$f":"All!S264","v":0},{"$f":"All!T264","v":0},{"$f":"All!U264","v":0},{"$f":"All!V264","v":0},{"$f":"All!W264","v":0},{"$f":"All!X264","v":0},{"$f":"All!Y264","v":0},{"$f":"All!Z264","v":0},{"$f":"All!AA264","v":0},{"$f":"All!AB264","v":0},{"$f":"All!AC264","v":0},{"$f":"All!AD264","v":0},{"$f":"All!AE264","v":0},{"$f":"All!AF264","v":0},{"$f":"All!AG264","v":0},{"$f":"All!AH264","v":0},{"$f":"All!AI264","v":0},{"$f":"All!AJ264","v":0},{"$f":"All!AK264","v":0},{"$f":"All!AL264","v":0},{"$f":"All!AM264","v":0},{"$f":"All!AN264","v":0},{"$f":"All!AO264","v":0},{"$f":"All!AP264","v":0},{"$f":"All!AQ264","v":0},{"$f":"All!AR264","v":0},{"$f":"All!AS264","v":0},{"$f":"All!AT264","v":0}]
[null,{"$f":"All!B265","v":"4"},{"$f":"All!C265","v":"4.3"},{"$f":"All!D265","v":"4.3.1"},{"$f":"All!E265","v":""},{"$f":"All!F265","v":"4.3.1.3"},{"$f":"All!G265","v":"4.3.1.3: CAPACITY PLAN - BUSINESS\nThe business capacity plan should determine how the mobile money business team will be scaled to support the forecast business volumes (see 4.3.1.1). Providers should produce a business capacity plan at least annually or more frequently if required due to rates of change to services or service volumes. \n\nThe business capacity plan should address human resource requirements by function, including:\n- Customer service;\n- Agent management;\n- Financial operations;\n- Business operations;\n- AML/CFT;\n- Fraud management.\n"},{"$f":"All!H265","v":"ISO 20000-2:2012 Sec. 6.5.3.1-2"},{"$f":"All!I265","v":"4.3.1.3.1"},{"$f":"All!J265","v":"4.3.1.3.1: Is a business capacity plan produced at least annually or more frequently if required due to rates of change to services or service volumes?\n"},{"$f":"All!K265","v":"Business capacity (human resource) plan"},{"$f":"All!L265","v":0},{"$f":"All!M265","v":"Recommended"},{"$f":"All!N265","v":"Recommended"},{"$f":"All!O265","v":"BizOps"},{"$f":"All!P265","v":0},{"$f":"All!Q265","v":0},{"$f":"All!R265","v":0},{"$f":"All!S265","v":0},{"$f":"All!T265","v":0},{"$f":"All!U265","v":0},{"$f":"All!V265","v":0},{"$f":"All!W265","v":0},{"$f":"All!X265","v":0},{"$f":"All!Y265","v":0},{"$f":"All!Z265","v":0},{"$f":"All!AA265","v":0},{"$f":"All!AB265","v":0},{"$f":"All!AC265","v":0},{"$f":"All!AD265","v":0},{"$f":"All!AE265","v":0},{"$f":"All!AF265","v":0},{"$f":"All!AG265","v":0},{"$f":"All!AH265","v":0},{"$f":"All!AI265","v":0},{"$f":"All!AJ265","v":0},{"$f":"All!AK265","v":0},{"$f":"All!AL265","v":0},{"$f":"All!AM265","v":0},{"$f":"All!AN265","v":0},{"$f":"All!AO265","v":0},{"$f":"All!AP265","v":0},{"$f":"All!AQ265","v":0},{"$f":"All!AR265","v":0},{"$f":"All!AS265","v":0},{"$f":"All!AT265","v":0}]
[null,{"$f":"All!B266","v":"4"},{"$f":"All!C266","v":"4.3"},{"$f":"All!D266","v":"4.3.1"},{"$f":"All!E266","v":""},{"$f":"All!F266","v":"4.3.1.3"},{"$f":"All!G266","v":0},{"$f":"All!H266","v":0},{"$f":"All!I266","v":"4.3.1.3.2"},{"$f":"All!J266","v":"4.3.1.3.2: Does the business capacity plan address human resource requirements by function, including Customer service, Agent management, Financial operations, Business operations, AML/CFT, and Fraud management?\n"},{"$f":"All!K266","v":0},{"$f":"All!L266","v":0},{"$f":"All!M266","v":"Recommended"},{"$f":"All!N266","v":"Recommended"},{"$f":"All!O266","v":"BizOps"},{"$f":"All!P266","v":0},{"$f":"All!Q266","v":0},{"$f":"All!R266","v":0},{"$f":"All!S266","v":0},{"$f":"All!T266","v":0},{"$f":"All!U266","v":0},{"$f":"All!V266","v":0},{"$f":"All!W266","v":0},{"$f":"All!X266","v":0},{"$f":"All!Y266","v":0},{"$f":"All!Z266","v":0},{"$f":"All!AA266","v":0},{"$f":"All!AB266","v":0},{"$f":"All!AC266","v":0},{"$f":"All!AD266","v":0},{"$f":"All!AE266","v":0},{"$f":"All!AF266","v":0},{"$f":"All!AG266","v":0},{"$f":"All!AH266","v":0},{"$f":"All!AI266","v":0},{"$f":"All!AJ266","v":0},{"$f":"All!AK266","v":0},{"$f":"All!AL266","v":0},{"$f":"All!AM266","v":0},{"$f":"All!AN266","v":0},{"$f":"All!AO266","v":0},{"$f":"All!AP266","v":0},{"$f":"All!AQ266","v":0},{"$f":"All!AR266","v":0},{"$f":"All!AS266","v":0},{"$f":"All!AT266","v":0}]
[null,{"$f":"All!B267","v":"4"},{"$f":"All!C267","v":"4.3"},{"$f":"All!D267","v":"4.3.1"},{"$f":"All!E267","v":""},{"$f":"All!F267","v":"4.3.1.4"},{"$f":"All!G267","v":"4.3.1.4: CAPACITY AND PERFORMANCE ALERTS AND REPORTS\nOperational alerts should be raised when the capacity and/or performance of a particular component has become unacceptable.\n\nProviders should produce technical capacity and performance reports. Reports should be generated on the resource utilization of each system component, along with the corresponding transaction response times, transaction rates, and workload volumes. These reports can be used to compare current utilization against forecasts and are important in capacity planning."},{"$f":"All!H267","v":0},{"$f":"All!I267","v":"4.3.1.4.1"},{"$f":"All!J267","v":"4.3.1.4.1: Are operational alerts raised when the capacity and/or performance of a particular component has become unacceptable?\n"},{"$f":"All!K267","v":"1) Monitoring and alerting system logs or specification\n- Check there is a process for operational alerts to be raised when the capacity or performance of a particular component has become unacceptable in terms of planned thresholds.  \n"},{"$f":"All!L267","v":0},{"$f":"All!M267","v":"Standard Required"},{"$f":"All!N267","v":"Required"},{"$f":"All!O267","v":"TechOps"},{"$f":"All!P267","v":0},{"$f":"All!Q267","v":0},{"$f":"All!R267","v":0},{"$f":"All!S267","v":0},{"$f":"All!T267","v":0},{"$f":"All!U267","v":0},{"$f":"All!V267","v":0},{"$f":"All!W267","v":0},{"$f":"All!X267","v":0},{"$f":"All!Y267","v":0},{"$f":"All!Z267","v":0},{"$f":"All!AA267","v":0},{"$f":"All!AB267","v":0},{"$f":"All!AC267","v":0},{"$f":"All!AD267","v":0},{"$f":"All!AE267","v":0},{"$f":"All!AF267","v":0},{"$f":"All!AG267","v":0},{"$f":"All!AH267","v":0},{"$f":"All!AI267","v":0},{"$f":"All!AJ267","v":0},{"$f":"All!AK267","v":0},{"$f":"All!AL267","v":0},{"$f":"All!AM267","v":0},{"$f":"All!AN267","v":0},{"$f":"All!AO267","v":0},{"$f":"All!AP267","v":0},{"$f":"All!AQ267","v":0},{"$f":"All!AR267","v":0},{"$f":"All!AS267","v":0},{"$f":"All!AT267","v":0}]
[null,{"$f":"All!B268","v":"4"},{"$f":"All!C268","v":"4.3"},{"$f":"All!D268","v":"4.3.1"},{"$f":"All!E268","v":""},{"$f":"All!F268","v":"4.3.1.4"},{"$f":"All!G268","v":0},{"$f":"All!H268","v":"ISO 20000-1:2019 Sec 8.6.1"},{"$f":"All!I268","v":"4.3.1.4.2"},{"$f":"All!J268","v":"4.3.1.4.2: Are component-based capacity and performance reports that illustrate system component performance and capacity utilisation regularly produced?\n"},{"$f":"All!K268","v":0},{"$f":"All!L268","v":0},{"$f":"All!M268","v":"Recommended"},{"$f":"All!N268","v":"Recommended"},{"$f":"All!O268","v":"TechOps"},{"$f":"All!P268","v":0},{"$f":"All!Q268","v":0},{"$f":"All!R268","v":0},{"$f":"All!S268","v":0},{"$f":"All!T268","v":0},{"$f":"All!U268","v":0},{"$f":"All!V268","v":0},{"$f":"All!W268","v":0},{"$f":"All!X268","v":0},{"$f":"All!Y268","v":0},{"$f":"All!Z268","v":0},{"$f":"All!AA268","v":0},{"$f":"All!AB268","v":0},{"$f":"All!AC268","v":0},{"$f":"All!AD268","v":0},{"$f":"All!AE268","v":0},{"$f":"All!AF268","v":0},{"$f":"All!AG268","v":0},{"$f":"All!AH268","v":0},{"$f":"All!AI268","v":0},{"$f":"All!AJ268","v":0},{"$f":"All!AK268","v":0},{"$f":"All!AL268","v":0},{"$f":"All!AM268","v":0},{"$f":"All!AN268","v":0},{"$f":"All!AO268","v":0},{"$f":"All!AP268","v":0},{"$f":"All!AQ268","v":0},{"$f":"All!AR268","v":0},{"$f":"All!AS268","v":0},{"$f":"All!AT268","v":0}]
[null,{"$f":"All!B269","v":"4"},{"$f":"All!C269","v":"4.3"},{"$f":"All!D269","v":"4.3.1"},{"$f":"All!E269","v":""},{"$f":"All!F269","v":"4.3.1.5"},{"$f":"All!G269","v":"4.3.1.5: CAPACITY TESTING\nCapacity testing of the mobile money system should be performed whenever significant changes are made to the system, including application, architecture or infrastructure changes. \n\nTesting should be done on a test system that is scaled to be representative of the live system.\n\nDifferent configurations and transaction mixes can significantly impact system performance. Capacity testing should test a number of configurations and transaction mixes so that all realistically-expected scenarios are tested.\n\n"},{"$f":"All!H269","v":"ISO 20000-2:2012 Sec.6.5.3.1"},{"$f":"All!I269","v":"4.3.1.5.1"},{"$f":"All!J269","v":"4.3.1.5.1: Is capacity testing of the mobile money system performed whenever significant changes are made to the system, including application, architecture or infrastructure changes?\n"},{"$f":"All!K269","v":"Capacity testing plan"},{"$f":"All!L269","v":0},{"$f":"All!M269","v":"Recommended"},{"$f":"All!N269","v":"Recommended"},{"$f":"All!O269","v":"TechOps"},{"$f":"All!P269","v":0},{"$f":"All!Q269","v":0},{"$f":"All!R269","v":0},{"$f":"All!S269","v":0},{"$f":"All!T269","v":0},{"$f":"All!U269","v":0},{"$f":"All!V269","v":0},{"$f":"All!W269","v":0},{"$f":"All!X269","v":0},{"$f":"All!Y269","v":0},{"$f":"All!Z269","v":0},{"$f":"All!AA269","v":0},{"$f":"All!AB269","v":0},{"$f":"All!AC269","v":0},{"$f":"All!AD269","v":0},{"$f":"All!AE269","v":0},{"$f":"All!AF269","v":0},{"$f":"All!AG269","v":0},{"$f":"All!AH269","v":0},{"$f":"All!AI269","v":0},{"$f":"All!AJ269","v":0},{"$f":"All!AK269","v":0},{"$f":"All!AL269","v":0},{"$f":"All!AM269","v":0},{"$f":"All!AN269","v":0},{"$f":"All!AO269","v":0},{"$f":"All!AP269","v":0},{"$f":"All!AQ269","v":0},{"$f":"All!AR269","v":0},{"$f":"All!AS269","v":0},{"$f":"All!AT269","v":0}]
[null,{"$f":"All!B270","v":"4"},{"$f":"All!C270","v":"4.3"},{"$f":"All!D270","v":"4.3.1"},{"$f":"All!E270","v":""},{"$f":"All!F270","v":"4.3.1.5"},{"$f":"All!G270","v":0},{"$f":"All!H270","v":0},{"$f":"All!I270","v":"4.3.1.5.2"},{"$f":"All!J270","v":"4.3.1.5.2: Is capacity testing done on a test system that is scaled to be representative of the live system?\n"},{"$f":"All!K270","v":0},{"$f":"All!L270","v":0},{"$f":"All!M270","v":"Recommended"},{"$f":"All!N270","v":"Recommended"},{"$f":"All!O270","v":"TechOps"},{"$f":"All!P270","v":0},{"$f":"All!Q270","v":0},{"$f":"All!R270","v":0},{"$f":"All!S270","v":0},{"$f":"All!T270","v":0},{"$f":"All!U270","v":0},{"$f":"All!V270","v":0},{"$f":"All!W270","v":0},{"$f":"All!X270","v":0},{"$f":"All!Y270","v":0},{"$f":"All!Z270","v":0},{"$f":"All!AA270","v":0},{"$f":"All!AB270","v":0},{"$f":"All!AC270","v":0},{"$f":"All!AD270","v":0},{"$f":"All!AE270","v":0},{"$f":"All!AF270","v":0},{"$f":"All!AG270","v":0},{"$f":"All!AH270","v":0},{"$f":"All!AI270","v":0},{"$f":"All!AJ270","v":0},{"$f":"All!AK270","v":0},{"$f":"All!AL270","v":0},{"$f":"All!AM270","v":0},{"$f":"All!AN270","v":0},{"$f":"All!AO270","v":0},{"$f":"All!AP270","v":0},{"$f":"All!AQ270","v":0},{"$f":"All!AR270","v":0},{"$f":"All!AS270","v":0},{"$f":"All!AT270","v":0}]
[null,{"$f":"All!B271","v":"4"},{"$f":"All!C271","v":"4.3"},{"$f":"All!D271","v":"4.3.1"},{"$f":"All!E271","v":""},{"$f":"All!F271","v":"4.3.1.5"},{"$f":"All!G271","v":0},{"$f":"All!H271","v":0},{"$f":"All!I271","v":"4.3.1.5.3"},{"$f":"All!J271","v":"4.3.1.5.3: Does capacity testing test a number of configurations and transaction mixes so that all realistically-expected scenarios are tested?\n"},{"$f":"All!K271","v":0},{"$f":"All!L271","v":0},{"$f":"All!M271","v":"Recommended"},{"$f":"All!N271","v":"Recommended"},{"$f":"All!O271","v":"TechOps"},{"$f":"All!P271","v":0},{"$f":"All!Q271","v":0},{"$f":"All!R271","v":0},{"$f":"All!S271","v":0},{"$f":"All!T271","v":0},{"$f":"All!U271","v":0},{"$f":"All!V271","v":0},{"$f":"All!W271","v":0},{"$f":"All!X271","v":0},{"$f":"All!Y271","v":0},{"$f":"All!Z271","v":0},{"$f":"All!AA271","v":0},{"$f":"All!AB271","v":0},{"$f":"All!AC271","v":0},{"$f":"All!AD271","v":0},{"$f":"All!AE271","v":0},{"$f":"All!AF271","v":0},{"$f":"All!AG271","v":0},{"$f":"All!AH271","v":0},{"$f":"All!AI271","v":0},{"$f":"All!AJ271","v":0},{"$f":"All!AK271","v":0},{"$f":"All!AL271","v":0},{"$f":"All!AM271","v":0},{"$f":"All!AN271","v":0},{"$f":"All!AO271","v":0},{"$f":"All!AP271","v":0},{"$f":"All!AQ271","v":0},{"$f":"All!AR271","v":0},{"$f":"All!AS271","v":0},{"$f":"All!AT271","v":0}]
[null,{"$f":"All!B272","v":"4"},{"$f":"All!C272","v":"4.3"},{"$f":"All!D272","v":"4.3.1"},{"$f":"All!E272","v":""},{"$f":"All!F272","v":"4.3.1.6"},{"$f":"All!G272","v":"4.3.1.6: TECHNICAL CAPACITY ANALYSIS\nCapacity limitations of all system components should be assessed and the maximum recommended utilization level should be documented, beyond which the resource will be over-utilised and the performance of the services using the resource will be impaired.\n\nArchitectural bottlenecks and other known weaknesses should be identified, along with redundancy and spare capacity.\n\nCurrent and past throughput and performance should be recorded and analysed, including comparisons of actual achievements against forecasts. This will give a picture of the system capacity and expected resource utilization.\n\nModelling can be used to predict resource utilization as volumes increase. Trend analysis (using the business forecast) should be applied to a baseline model. Analytical system modelling can also be used to analyse performance – for example modelling transaction rates against a given system configuration.\n"},{"$f":"All!H272","v":"ISO 20000-1:2011 Sec. 6.5"},{"$f":"All!I272","v":"4.3.1.6.1"},{"$f":"All!J272","v":"4.3.1.6.1: Is the maximum recommended utilization level of each system component documented?\n"},{"$f":"All!K272","v":"Current system capacity report (disk, memory, CPU by system component)"},{"$f":"All!L272","v":0},{"$f":"All!M272","v":"Recommended"},{"$f":"All!N272","v":"Recommended"},{"$f":"All!O272","v":"TechOps"},{"$f":"All!P272","v":0},{"$f":"All!Q272","v":0},{"$f":"All!R272","v":0},{"$f":"All!S272","v":0},{"$f":"All!T272","v":0},{"$f":"All!U272","v":0},{"$f":"All!V272","v":0},{"$f":"All!W272","v":0},{"$f":"All!X272","v":0},{"$f":"All!Y272","v":0},{"$f":"All!Z272","v":0},{"$f":"All!AA272","v":0},{"$f":"All!AB272","v":0},{"$f":"All!AC272","v":0},{"$f":"All!AD272","v":0},{"$f":"All!AE272","v":0},{"$f":"All!AF272","v":0},{"$f":"All!AG272","v":0},{"$f":"All!AH272","v":0},{"$f":"All!AI272","v":0},{"$f":"All!AJ272","v":0},{"$f":"All!AK272","v":0},{"$f":"All!AL272","v":0},{"$f":"All!AM272","v":0},{"$f":"All!AN272","v":0},{"$f":"All!AO272","v":0},{"$f":"All!AP272","v":0},{"$f":"All!AQ272","v":0},{"$f":"All!AR272","v":0},{"$f":"All!AS272","v":0},{"$f":"All!AT272","v":0}]
[null,{"$f":"All!B273","v":"4"},{"$f":"All!C273","v":"4.3"},{"$f":"All!D273","v":"4.3.1"},{"$f":"All!E273","v":""},{"$f":"All!F273","v":"4.3.1.6"},{"$f":"All!G273","v":0},{"$f":"All!H273","v":0},{"$f":"All!I273","v":"4.3.1.6.2"},{"$f":"All!J273","v":"4.3.1.6.2: Are architectural bottlenecks and other known weaknesses identified, along with redundancy and spare capacity?\n"},{"$f":"All!K273","v":0},{"$f":"All!L273","v":0},{"$f":"All!M273","v":"Recommended"},{"$f":"All!N273","v":"Recommended"},{"$f":"All!O273","v":"TechOps"},{"$f":"All!P273","v":0},{"$f":"All!Q273","v":0},{"$f":"All!R273","v":0},{"$f":"All!S273","v":0},{"$f":"All!T273","v":0},{"$f":"All!U273","v":0},{"$f":"All!V273","v":0},{"$f":"All!W273","v":0},{"$f":"All!X273","v":0},{"$f":"All!Y273","v":0},{"$f":"All!Z273","v":0},{"$f":"All!AA273","v":0},{"$f":"All!AB273","v":0},{"$f":"All!AC273","v":0},{"$f":"All!AD273","v":0},{"$f":"All!AE273","v":0},{"$f":"All!AF273","v":0},{"$f":"All!AG273","v":0},{"$f":"All!AH273","v":0},{"$f":"All!AI273","v":0},{"$f":"All!AJ273","v":0},{"$f":"All!AK273","v":0},{"$f":"All!AL273","v":0},{"$f":"All!AM273","v":0},{"$f":"All!AN273","v":0},{"$f":"All!AO273","v":0},{"$f":"All!AP273","v":0},{"$f":"All!AQ273","v":0},{"$f":"All!AR273","v":0},{"$f":"All!AS273","v":0},{"$f":"All!AT273","v":0}]
[null,{"$f":"All!B274","v":"4"},{"$f":"All!C274","v":"4.3"},{"$f":"All!D274","v":"4.3.1"},{"$f":"All!E274","v":""},{"$f":"All!F274","v":"4.3.1.6"},{"$f":"All!G274","v":0},{"$f":"All!H274","v":0},{"$f":"All!I274","v":"4.3.1.6.3"},{"$f":"All!J274","v":"4.3.1.6.3: Is current and past throughput and performance recorded and analysed, including comparisons of actual achievements against forecasts?\n"},{"$f":"All!K274","v":0},{"$f":"All!L274","v":0},{"$f":"All!M274","v":"Recommended"},{"$f":"All!N274","v":"Recommended"},{"$f":"All!O274","v":"TechOps"},{"$f":"All!P274","v":0},{"$f":"All!Q274","v":0},{"$f":"All!R274","v":0},{"$f":"All!S274","v":0},{"$f":"All!T274","v":0},{"$f":"All!U274","v":0},{"$f":"All!V274","v":0},{"$f":"All!W274","v":0},{"$f":"All!X274","v":0},{"$f":"All!Y274","v":0},{"$f":"All!Z274","v":0},{"$f":"All!AA274","v":0},{"$f":"All!AB274","v":0},{"$f":"All!AC274","v":0},{"$f":"All!AD274","v":0},{"$f":"All!AE274","v":0},{"$f":"All!AF274","v":0},{"$f":"All!AG274","v":0},{"$f":"All!AH274","v":0},{"$f":"All!AI274","v":0},{"$f":"All!AJ274","v":0},{"$f":"All!AK274","v":0},{"$f":"All!AL274","v":0},{"$f":"All!AM274","v":0},{"$f":"All!AN274","v":0},{"$f":"All!AO274","v":0},{"$f":"All!AP274","v":0},{"$f":"All!AQ274","v":0},{"$f":"All!AR274","v":0},{"$f":"All!AS274","v":0},{"$f":"All!AT274","v":0}]
[null,{"$f":"All!B275","v":"4"},{"$f":"All!C275","v":"4.4"},{"$f":"All!D275","v":"4.4.1"},{"$f":"All!E275","v":"4.4.1: Providers shall set up an incident management process to restore the service within agreed service levels and to investigate root causes of problems"},{"$f":"All!F275","v":"4.4.1.1"},{"$f":"All!G275","v":"4.4.1.1: INCIDENT MANAGEMENT\nAn incident management process should be established that can:\n- record and classify incidents (see defnition);\n- analyse and prioritize incidents;\n- resolve and close incidents according to agreed service levels;\n- escalate incidents that have not progressed according to agreed service levels;\n- report to technical and business management on the status and progress of incidents.\n- Establish if there are any patterns in incidents.\n\nThe focus of incident management is on reducing the duration and limiting the consequences of the service issue (e.g. by implementing a workaround) and not on addressing the root cause of the incident.\n\nIncident management will be subject to an operational support period and an SLA - see 4.2.1.3."},{"$f":"All!H275","v":"ISO 20000-1:2019 Sec 8.6.1"},{"$f":"All!I275","v":"4.4.1.1.1"},{"$f":"All!J275","v":"4.4.1.1.1: Are incidents being recorded, analysed, and prioritised?\n"},{"$f":"All!K275","v":"1) Incident management process \n- Check incidents are being recorded, analysed and prioritised.  "},{"$f":"All!L275","v":0},{"$f":"All!M275","v":"Urgent Required"},{"$f":"All!N275","v":"Required"},{"$f":"All!O275","v":"TechOps"},{"$f":"All!P275","v":0},{"$f":"All!Q275","v":0},{"$f":"All!R275","v":0},{"$f":"All!S275","v":0},{"$f":"All!T275","v":0},{"$f":"All!U275","v":0},{"$f":"All!V275","v":0},{"$f":"All!W275","v":0},{"$f":"All!X275","v":0},{"$f":"All!Y275","v":0},{"$f":"All!Z275","v":0},{"$f":"All!AA275","v":0},{"$f":"All!AB275","v":0},{"$f":"All!AC275","v":0},{"$f":"All!AD275","v":0},{"$f":"All!AE275","v":0},{"$f":"All!AF275","v":0},{"$f":"All!AG275","v":0},{"$f":"All!AH275","v":0},{"$f":"All!AI275","v":0},{"$f":"All!AJ275","v":0},{"$f":"All!AK275","v":0},{"$f":"All!AL275","v":0},{"$f":"All!AM275","v":0},{"$f":"All!AN275","v":0},{"$f":"All!AO275","v":0},{"$f":"All!AP275","v":0},{"$f":"All!AQ275","v":0},{"$f":"All!AR275","v":0},{"$f":"All!AS275","v":0},{"$f":"All!AT275","v":0}]
[null,{"$f":"All!B276","v":"4"},{"$f":"All!C276","v":"4.4"},{"$f":"All!D276","v":"4.4.1"},{"$f":"All!E276","v":0},{"$f":"All!F276","v":"4.4.1.1"},{"$f":"All!G276","v":0},{"$f":"All!H276","v":0},{"$f":"All!I276","v":"4.4.1.1.2"},{"$f":"All!J276","v":"4.4.1.1.2: Are incidents which have not progressed according to agreed service levels being escalated?\n"},{"$f":"All!K276","v":"1) Incident management process\n- Check that incidents which are not closed within SLA have been escalated according to the incident management process."},{"$f":"All!L276","v":0},{"$f":"All!M276","v":"Urgent Required"},{"$f":"All!N276","v":"Required"},{"$f":"All!O276","v":"TechOps"},{"$f":"All!P276","v":0},{"$f":"All!Q276","v":0},{"$f":"All!R276","v":0},{"$f":"All!S276","v":0},{"$f":"All!T276","v":0},{"$f":"All!U276","v":0},{"$f":"All!V276","v":0},{"$f":"All!W276","v":0},{"$f":"All!X276","v":0},{"$f":"All!Y276","v":0},{"$f":"All!Z276","v":0},{"$f":"All!AA276","v":0},{"$f":"All!AB276","v":0},{"$f":"All!AC276","v":0},{"$f":"All!AD276","v":0},{"$f":"All!AE276","v":0},{"$f":"All!AF276","v":0},{"$f":"All!AG276","v":0},{"$f":"All!AH276","v":0},{"$f":"All!AI276","v":0},{"$f":"All!AJ276","v":0},{"$f":"All!AK276","v":0},{"$f":"All!AL276","v":0},{"$f":"All!AM276","v":0},{"$f":"All!AN276","v":0},{"$f":"All!AO276","v":0},{"$f":"All!AP276","v":0},{"$f":"All!AQ276","v":0},{"$f":"All!AR276","v":0},{"$f":"All!AS276","v":0},{"$f":"All!AT276","v":0}]
[null,{"$f":"All!B277","v":"4"},{"$f":"All!C277","v":"4.4"},{"$f":"All!D277","v":"4.4.1"},{"$f":"All!E277","v":0},{"$f":"All!F277","v":"4.4.1.1"},{"$f":"All!G277","v":0},{"$f":"All!H277","v":0},{"$f":"All!I277","v":"4.4.1.1.3"},{"$f":"All!J277","v":"4.4.1.1.3: Are incidents being resolved and closed according to agreed service levels?\n"},{"$f":"All!K277","v":0},{"$f":"All!L277","v":0},{"$f":"All!M277","v":"Recommended"},{"$f":"All!N277","v":"Recommended"},{"$f":"All!O277","v":"TechOps"},{"$f":"All!P277","v":0},{"$f":"All!Q277","v":0},{"$f":"All!R277","v":0},{"$f":"All!S277","v":0},{"$f":"All!T277","v":0},{"$f":"All!U277","v":0},{"$f":"All!V277","v":0},{"$f":"All!W277","v":0},{"$f":"All!X277","v":0},{"$f":"All!Y277","v":0},{"$f":"All!Z277","v":0},{"$f":"All!AA277","v":0},{"$f":"All!AB277","v":0},{"$f":"All!AC277","v":0},{"$f":"All!AD277","v":0},{"$f":"All!AE277","v":0},{"$f":"All!AF277","v":0},{"$f":"All!AG277","v":0},{"$f":"All!AH277","v":0},{"$f":"All!AI277","v":0},{"$f":"All!AJ277","v":0},{"$f":"All!AK277","v":0},{"$f":"All!AL277","v":0},{"$f":"All!AM277","v":0},{"$f":"All!AN277","v":0},{"$f":"All!AO277","v":0},{"$f":"All!AP277","v":0},{"$f":"All!AQ277","v":0},{"$f":"All!AR277","v":0},{"$f":"All!AS277","v":0},{"$f":"All!AT277","v":0}]
[null,{"$f":"All!B278","v":"4"},{"$f":"All!C278","v":"4.4"},{"$f":"All!D278","v":"4.4.1"},{"$f":"All!E278","v":0},{"$f":"All!F278","v":"4.4.1.1"},{"$f":"All!G278","v":0},{"$f":"All!H278","v":0},{"$f":"All!I278","v":"4.4.1.1.4"},{"$f":"All!J278","v":"4.4.1.1.4: Are reports generated on the status and progress of incidents and provided regularly to technical and business management?\n"},{"$f":"All!K278","v":0},{"$f":"All!L278","v":0},{"$f":"All!M278","v":"Recommended"},{"$f":"All!N278","v":"Recommended"},{"$f":"All!O278","v":"TechOps"},{"$f":"All!P278","v":0},{"$f":"All!Q278","v":0},{"$f":"All!R278","v":0},{"$f":"All!S278","v":0},{"$f":"All!T278","v":0},{"$f":"All!U278","v":0},{"$f":"All!V278","v":0},{"$f":"All!W278","v":0},{"$f":"All!X278","v":0},{"$f":"All!Y278","v":0},{"$f":"All!Z278","v":0},{"$f":"All!AA278","v":0},{"$f":"All!AB278","v":0},{"$f":"All!AC278","v":0},{"$f":"All!AD278","v":0},{"$f":"All!AE278","v":0},{"$f":"All!AF278","v":0},{"$f":"All!AG278","v":0},{"$f":"All!AH278","v":0},{"$f":"All!AI278","v":0},{"$f":"All!AJ278","v":0},{"$f":"All!AK278","v":0},{"$f":"All!AL278","v":0},{"$f":"All!AM278","v":0},{"$f":"All!AN278","v":0},{"$f":"All!AO278","v":0},{"$f":"All!AP278","v":0},{"$f":"All!AQ278","v":0},{"$f":"All!AR278","v":0},{"$f":"All!AS278","v":0},{"$f":"All!AT278","v":0}]
[null,{"$f":"All!B279","v":"4"},{"$f":"All!C279","v":"4.4"},{"$f":"All!D279","v":"4.4.1"},{"$f":"All!E279","v":""},{"$f":"All!F279","v":"4.4.1.2"},{"$f":"All!G279","v":"4.4.1.2: SERVICE REQUEST MANAGEMENT\nService requests (see definition) are routine requests that require action by the technical operations team. \n\nThe service request management process should:\n- record and classify service requests;\n- implement and close service requests according to agreed service levels;\n- escalate service requests which have not progressed according to agreed service levels;\n- report to technical and business management on the status and progress of service requests."},{"$f":"All!H279","v":"ISO 20000-1:2011 Sec. 8.1\nITIL 3"},{"$f":"All!I279","v":"4.4.1.2.1"},{"$f":"All!J279","v":"4.4.1.2.1: Has a service request process been implemented (see definition)?\n"},{"$f":"All!K279","v":0},{"$f":"All!L279","v":0},{"$f":"All!M279","v":"Recommended"},{"$f":"All!N279","v":"Recommended"},{"$f":"All!O279","v":"TechOps"},{"$f":"All!P279","v":0},{"$f":"All!Q279","v":0},{"$f":"All!R279","v":0},{"$f":"All!S279","v":0},{"$f":"All!T279","v":0},{"$f":"All!U279","v":0},{"$f":"All!V279","v":0},{"$f":"All!W279","v":0},{"$f":"All!X279","v":0},{"$f":"All!Y279","v":0},{"$f":"All!Z279","v":0},{"$f":"All!AA279","v":0},{"$f":"All!AB279","v":0},{"$f":"All!AC279","v":0},{"$f":"All!AD279","v":0},{"$f":"All!AE279","v":0},{"$f":"All!AF279","v":0},{"$f":"All!AG279","v":0},{"$f":"All!AH279","v":0},{"$f":"All!AI279","v":0},{"$f":"All!AJ279","v":0},{"$f":"All!AK279","v":0},{"$f":"All!AL279","v":0},{"$f":"All!AM279","v":0},{"$f":"All!AN279","v":0},{"$f":"All!AO279","v":0},{"$f":"All!AP279","v":0},{"$f":"All!AQ279","v":0},{"$f":"All!AR279","v":0},{"$f":"All!AS279","v":0},{"$f":"All!AT279","v":0}]
[null,{"$f":"All!B280","v":"4"},{"$f":"All!C280","v":"4.4"},{"$f":"All!D280","v":"4.4.1"},{"$f":"All!E280","v":""},{"$f":"All!F280","v":"4.4.1.2"},{"$f":"All!G280","v":0},{"$f":"All!H280","v":0},{"$f":"All!I280","v":"4.4.1.2.2"},{"$f":"All!J280","v":"4.4.1.2.2: Are service requests being implemented and closed according to agreed service levels (and escalated if necessary)?\n"},{"$f":"All!K280","v":0},{"$f":"All!L280","v":0},{"$f":"All!M280","v":"Recommended"},{"$f":"All!N280","v":"Recommended"},{"$f":"All!O280","v":"TechOps"},{"$f":"All!P280","v":0},{"$f":"All!Q280","v":0},{"$f":"All!R280","v":0},{"$f":"All!S280","v":0},{"$f":"All!T280","v":0},{"$f":"All!U280","v":0},{"$f":"All!V280","v":0},{"$f":"All!W280","v":0},{"$f":"All!X280","v":0},{"$f":"All!Y280","v":0},{"$f":"All!Z280","v":0},{"$f":"All!AA280","v":0},{"$f":"All!AB280","v":0},{"$f":"All!AC280","v":0},{"$f":"All!AD280","v":0},{"$f":"All!AE280","v":0},{"$f":"All!AF280","v":0},{"$f":"All!AG280","v":0},{"$f":"All!AH280","v":0},{"$f":"All!AI280","v":0},{"$f":"All!AJ280","v":0},{"$f":"All!AK280","v":0},{"$f":"All!AL280","v":0},{"$f":"All!AM280","v":0},{"$f":"All!AN280","v":0},{"$f":"All!AO280","v":0},{"$f":"All!AP280","v":0},{"$f":"All!AQ280","v":0},{"$f":"All!AR280","v":0},{"$f":"All!AS280","v":0},{"$f":"All!AT280","v":0}]
[null,{"$f":"All!B281","v":"4"},{"$f":"All!C281","v":"4.4"},{"$f":"All!D281","v":"4.4.1"},{"$f":"All!E281","v":""},{"$f":"All!F281","v":"4.4.1.2"},{"$f":"All!G281","v":0},{"$f":"All!H281","v":0},{"$f":"All!I281","v":"4.4.1.2.3"},{"$f":"All!J281","v":"4.4.1.2.3: Are reports generated on the status and progress of service requests and provided regularly to technical and business management?\n"},{"$f":"All!K281","v":0},{"$f":"All!L281","v":0},{"$f":"All!M281","v":"Recommended"},{"$f":"All!N281","v":"Recommended"},{"$f":"All!O281","v":"TechOps"},{"$f":"All!P281","v":0},{"$f":"All!Q281","v":0},{"$f":"All!R281","v":0},{"$f":"All!S281","v":0},{"$f":"All!T281","v":0},{"$f":"All!U281","v":0},{"$f":"All!V281","v":0},{"$f":"All!W281","v":0},{"$f":"All!X281","v":0},{"$f":"All!Y281","v":0},{"$f":"All!Z281","v":0},{"$f":"All!AA281","v":0},{"$f":"All!AB281","v":0},{"$f":"All!AC281","v":0},{"$f":"All!AD281","v":0},{"$f":"All!AE281","v":0},{"$f":"All!AF281","v":0},{"$f":"All!AG281","v":0},{"$f":"All!AH281","v":0},{"$f":"All!AI281","v":0},{"$f":"All!AJ281","v":0},{"$f":"All!AK281","v":0},{"$f":"All!AL281","v":0},{"$f":"All!AM281","v":0},{"$f":"All!AN281","v":0},{"$f":"All!AO281","v":0},{"$f":"All!AP281","v":0},{"$f":"All!AQ281","v":0},{"$f":"All!AR281","v":0},{"$f":"All!AS281","v":0},{"$f":"All!AT281","v":0}]
[null,{"$f":"All!B282","v":"4"},{"$f":"All!C282","v":"4.4"},{"$f":"All!D282","v":"4.4.1"},{"$f":"All!E282","v":""},{"$f":"All!F282","v":"4.4.1.3"},{"$f":"All!G282","v":"4.4.1.3: PROBLEM MANAGEMENT\nProblem management differs from incident management in that it deals with underlying issues that may or may not directly affect the user (see definition). The aim of incident management is to restore the service to the user as quickly as possible, often through a workaround, while the aim of problem management is to try to find a permanent solution to the problem.\n\nProviders should establish a problem management process to minimize service disruption by:\n- identifying, recording, and classifying problems proactively and reactively;\n- analysing and prioritizing problems;\n- resolving and closing problems according to agreed service levels;\n- escalating problems which have not progressed according to agreed service levels;\n- minimizing the effect of unresolved problems through workarounds and other solutions; and\n- communicating the status and progress of problem resolution to technical and business management.\n\nThe service level for resolving problems is often stated as a \"number of outstanding problems\" rather than a resolution time, as some problems can take a long time to solve. The number of outstanding problems should not grow over time."},{"$f":"All!H282","v":"ISO 20000-1:2019 Sec 8.6.3\nITIL"},{"$f":"All!I282","v":"4.4.1.3.1"},{"$f":"All!J282","v":"4.4.1.3.1: Are problems (see definition) being identified, recorded and prioritised?\n"},{"$f":"All!K282","v":"1) Documented problem management process \n- Check the process requires problems to be:\na) Identified\nb) Recorded \nc) Prioritised\n- Check the log to see if the process implemented\n\n\n"},{"$f":"All!L282","v":0},{"$f":"All!M282","v":"Standard Required"},{"$f":"All!N282","v":"Required"},{"$f":"All!O282","v":"TechOps"},{"$f":"All!P282","v":0},{"$f":"All!Q282","v":0},{"$f":"All!R282","v":0},{"$f":"All!S282","v":0},{"$f":"All!T282","v":0},{"$f":"All!U282","v":0},{"$f":"All!V282","v":0},{"$f":"All!W282","v":0},{"$f":"All!X282","v":0},{"$f":"All!Y282","v":0},{"$f":"All!Z282","v":0},{"$f":"All!AA282","v":0},{"$f":"All!AB282","v":0},{"$f":"All!AC282","v":0},{"$f":"All!AD282","v":0},{"$f":"All!AE282","v":0},{"$f":"All!AF282","v":0},{"$f":"All!AG282","v":0},{"$f":"All!AH282","v":0},{"$f":"All!AI282","v":0},{"$f":"All!AJ282","v":0},{"$f":"All!AK282","v":0},{"$f":"All!AL282","v":0},{"$f":"All!AM282","v":0},{"$f":"All!AN282","v":0},{"$f":"All!AO282","v":0},{"$f":"All!AP282","v":0},{"$f":"All!AQ282","v":0},{"$f":"All!AR282","v":0},{"$f":"All!AS282","v":0},{"$f":"All!AT282","v":0}]
[null,{"$f":"All!B283","v":"4"},{"$f":"All!C283","v":"4.4"},{"$f":"All!D283","v":"4.4.1"},{"$f":"All!E283","v":""},{"$f":"All!F283","v":"4.4.1.3"},{"$f":"All!G283","v":0},{"$f":"All!H283","v":0},{"$f":"All!I283","v":"4.4.1.3.2"},{"$f":"All!J283","v":"4.4.1.3.2: Are problems being resolved and closed according to agreed service levels?\n"},{"$f":"All!K283","v":0},{"$f":"All!L283","v":0},{"$f":"All!M283","v":"Recommended"},{"$f":"All!N283","v":"Recommended"},{"$f":"All!O283","v":"TechOps"},{"$f":"All!P283","v":0},{"$f":"All!Q283","v":0},{"$f":"All!R283","v":0},{"$f":"All!S283","v":0},{"$f":"All!T283","v":0},{"$f":"All!U283","v":0},{"$f":"All!V283","v":0},{"$f":"All!W283","v":0},{"$f":"All!X283","v":0},{"$f":"All!Y283","v":0},{"$f":"All!Z283","v":0},{"$f":"All!AA283","v":0},{"$f":"All!AB283","v":0},{"$f":"All!AC283","v":0},{"$f":"All!AD283","v":0},{"$f":"All!AE283","v":0},{"$f":"All!AF283","v":0},{"$f":"All!AG283","v":0},{"$f":"All!AH283","v":0},{"$f":"All!AI283","v":0},{"$f":"All!AJ283","v":0},{"$f":"All!AK283","v":0},{"$f":"All!AL283","v":0},{"$f":"All!AM283","v":0},{"$f":"All!AN283","v":0},{"$f":"All!AO283","v":0},{"$f":"All!AP283","v":0},{"$f":"All!AQ283","v":0},{"$f":"All!AR283","v":0},{"$f":"All!AS283","v":0},{"$f":"All!AT283","v":0}]
[null,{"$f":"All!B284","v":"4"},{"$f":"All!C284","v":"4.4"},{"$f":"All!D284","v":"4.4.1"},{"$f":"All!E284","v":""},{"$f":"All!F284","v":"4.4.1.3"},{"$f":"All!G284","v":0},{"$f":"All!H284","v":0},{"$f":"All!I284","v":"4.4.1.3.3"},{"$f":"All!J284","v":"4.4.1.3.3: Are problems which have not progressed according to agreed service levels being escalated?\n"},{"$f":"All!K284","v":0},{"$f":"All!L284","v":0},{"$f":"All!M284","v":"Recommended"},{"$f":"All!N284","v":"Recommended"},{"$f":"All!O284","v":"TechOps"},{"$f":"All!P284","v":0},{"$f":"All!Q284","v":0},{"$f":"All!R284","v":0},{"$f":"All!S284","v":0},{"$f":"All!T284","v":0},{"$f":"All!U284","v":0},{"$f":"All!V284","v":0},{"$f":"All!W284","v":0},{"$f":"All!X284","v":0},{"$f":"All!Y284","v":0},{"$f":"All!Z284","v":0},{"$f":"All!AA284","v":0},{"$f":"All!AB284","v":0},{"$f":"All!AC284","v":0},{"$f":"All!AD284","v":0},{"$f":"All!AE284","v":0},{"$f":"All!AF284","v":0},{"$f":"All!AG284","v":0},{"$f":"All!AH284","v":0},{"$f":"All!AI284","v":0},{"$f":"All!AJ284","v":0},{"$f":"All!AK284","v":0},{"$f":"All!AL284","v":0},{"$f":"All!AM284","v":0},{"$f":"All!AN284","v":0},{"$f":"All!AO284","v":0},{"$f":"All!AP284","v":0},{"$f":"All!AQ284","v":0},{"$f":"All!AR284","v":0},{"$f":"All!AS284","v":0},{"$f":"All!AT284","v":0}]
[null,{"$f":"All!B285","v":"4"},{"$f":"All!C285","v":"4.4"},{"$f":"All!D285","v":"4.4.1"},{"$f":"All!E285","v":""},{"$f":"All!F285","v":"4.4.1.3"},{"$f":"All!G285","v":0},{"$f":"All!H285","v":0},{"$f":"All!I285","v":"4.4.1.3.4"},{"$f":"All!J285","v":"4.4.1.3.4: Is the status and progress of problem resolution being communicated to technical and business management?\n"},{"$f":"All!K285","v":0},{"$f":"All!L285","v":0},{"$f":"All!M285","v":"Recommended"},{"$f":"All!N285","v":"Recommended"},{"$f":"All!O285","v":"TechOps"},{"$f":"All!P285","v":0},{"$f":"All!Q285","v":0},{"$f":"All!R285","v":0},{"$f":"All!S285","v":0},{"$f":"All!T285","v":0},{"$f":"All!U285","v":0},{"$f":"All!V285","v":0},{"$f":"All!W285","v":0},{"$f":"All!X285","v":0},{"$f":"All!Y285","v":0},{"$f":"All!Z285","v":0},{"$f":"All!AA285","v":0},{"$f":"All!AB285","v":0},{"$f":"All!AC285","v":0},{"$f":"All!AD285","v":0},{"$f":"All!AE285","v":0},{"$f":"All!AF285","v":0},{"$f":"All!AG285","v":0},{"$f":"All!AH285","v":0},{"$f":"All!AI285","v":0},{"$f":"All!AJ285","v":0},{"$f":"All!AK285","v":0},{"$f":"All!AL285","v":0},{"$f":"All!AM285","v":0},{"$f":"All!AN285","v":0},{"$f":"All!AO285","v":0},{"$f":"All!AP285","v":0},{"$f":"All!AQ285","v":0},{"$f":"All!AR285","v":0},{"$f":"All!AS285","v":0},{"$f":"All!AT285","v":0}]
[null,{"$f":"All!B286","v":"4"},{"$f":"All!C286","v":"4.5"},{"$f":"All!D286","v":"4.5.1"},{"$f":"All!E286","v":"4.5.1: Providers shall develop processes to ensure that systems and applications remain robust and secure following system and configuration changes"},{"$f":"All!F286","v":"4.5.1.1"},{"$f":"All!G286","v":"4.5.1.1: GATED PROJECT MANAGEMENT PROCESS\nProposed changes to the mobile money service should be managed by a gated project management process to ensure that requirements, design and implementation of the service change are fully considered and documented and approved. The process should cover both technical system changes and business process changes. \n\nThe gated project management process should include:\n- Requirements definition, including expected outcomes from the changed service, expressed in measurable terms;\n- Impact assessment, which should seek inputs from some or all of the following functions: Technical development, Business operations, Technical operations, Customer service, Agent management, Financial operations, AML/CFT/Fraud management;\n- Planning - timescales, risks and dependencies for the project;\n- Design - changes to processes, training, technical systems, reporting, SLAs and third party arrangements;\n- Costing - financial and human resources (including training);\n- Development and implementation (change release management for technical changes - see 4.5.1.3);\n- Testing and acceptance criteria (see 4.5.1.4);\n- Internal and external communication of the service changes;\n- Approval from management and all relevant functions."},{"$f":"All!H286","v":"ISO 20000-1:2019 Sec 8.5"},{"$f":"All!I286","v":"4.5.1.1.1"},{"$f":"All!J286","v":"4.5.1.1.1: Is there a formal gated project management process for managing changes to the mobile money service (both technical and commercial changes)?\n"},{"$f":"All!K286","v":"1) Project management process/plan or product development process\n-  Check there is a documented gated project management process for making changes to the mobile money service.\n- Check the process covers both technical and business changes."},{"$f":"All!L286","v":0},{"$f":"All!M286","v":"Urgent Required"},{"$f":"All!N286","v":"Required"},{"$f":"All!O286","v":"BizOps"},{"$f":"All!P286","v":0},{"$f":"All!Q286","v":0},{"$f":"All!R286","v":0},{"$f":"All!S286","v":0},{"$f":"All!T286","v":0},{"$f":"All!U286","v":0},{"$f":"All!V286","v":0},{"$f":"All!W286","v":0},{"$f":"All!X286","v":0},{"$f":"All!Y286","v":0},{"$f":"All!Z286","v":0},{"$f":"All!AA286","v":0},{"$f":"All!AB286","v":0},{"$f":"All!AC286","v":0},{"$f":"All!AD286","v":0},{"$f":"All!AE286","v":0},{"$f":"All!AF286","v":0},{"$f":"All!AG286","v":0},{"$f":"All!AH286","v":0},{"$f":"All!AI286","v":0},{"$f":"All!AJ286","v":0},{"$f":"All!AK286","v":0},{"$f":"All!AL286","v":0},{"$f":"All!AM286","v":0},{"$f":"All!AN286","v":0},{"$f":"All!AO286","v":0},{"$f":"All!AP286","v":0},{"$f":"All!AQ286","v":0},{"$f":"All!AR286","v":0},{"$f":"All!AS286","v":0},{"$f":"All!AT286","v":0}]
[null,{"$f":"All!B287","v":"4"},{"$f":"All!C287","v":"4.5"},{"$f":"All!D287","v":"4.5.1"},{"$f":"All!E287","v":0},{"$f":"All!F287","v":"4.5.1.1"},{"$f":"All!G287","v":0},{"$f":"All!H287","v":0},{"$f":"All!I287","v":"4.5.1.1.2"},{"$f":"All!J287","v":"4.5.1.1.2: Does the gated project management process ensure that all changes are clearly defined, planned & documented in advance?\n"},{"$f":"All!K287","v":"1) Project management process/plan or product development process\n-  Check that the gated project management process ensures that all changes are clearly defined, planned & documented in advance.\n- Check that the next update to the service is documented and planned."},{"$f":"All!L287","v":0},{"$f":"All!M287","v":"Standard Required"},{"$f":"All!N287","v":"Required"},{"$f":"All!O287","v":"BizOps"},{"$f":"All!P287","v":0},{"$f":"All!Q287","v":0},{"$f":"All!R287","v":0},{"$f":"All!S287","v":0},{"$f":"All!T287","v":0},{"$f":"All!U287","v":0},{"$f":"All!V287","v":0},{"$f":"All!W287","v":0},{"$f":"All!X287","v":0},{"$f":"All!Y287","v":0},{"$f":"All!Z287","v":0},{"$f":"All!AA287","v":0},{"$f":"All!AB287","v":0},{"$f":"All!AC287","v":0},{"$f":"All!AD287","v":0},{"$f":"All!AE287","v":0},{"$f":"All!AF287","v":0},{"$f":"All!AG287","v":0},{"$f":"All!AH287","v":0},{"$f":"All!AI287","v":0},{"$f":"All!AJ287","v":0},{"$f":"All!AK287","v":0},{"$f":"All!AL287","v":0},{"$f":"All!AM287","v":0},{"$f":"All!AN287","v":0},{"$f":"All!AO287","v":0},{"$f":"All!AP287","v":0},{"$f":"All!AQ287","v":0},{"$f":"All!AR287","v":0},{"$f":"All!AS287","v":0},{"$f":"All!AT287","v":0}]
[null,{"$f":"All!B288","v":"4"},{"$f":"All!C288","v":"4.5"},{"$f":"All!D288","v":"4.5.1"},{"$f":"All!E288","v":0},{"$f":"All!F288","v":"4.5.1.1"},{"$f":"All!G288","v":0},{"$f":"All!H288","v":0},{"$f":"All!I288","v":"4.5.1.1.3"},{"$f":"All!J288","v":"4.5.1.1.3: Does the gated project management process require input and approval from all relevant mobile money functions?\n"},{"$f":"All!K288","v":"1) Project management process/plan or product development process\n-  Check the gated project management process includes input and approval from all relevant mobile money functions."},{"$f":"All!L288","v":0},{"$f":"All!M288","v":"Standard Required"},{"$f":"All!N288","v":"Required"},{"$f":"All!O288","v":"BizOps"},{"$f":"All!P288","v":0},{"$f":"All!Q288","v":0},{"$f":"All!R288","v":0},{"$f":"All!S288","v":0},{"$f":"All!T288","v":0},{"$f":"All!U288","v":0},{"$f":"All!V288","v":0},{"$f":"All!W288","v":0},{"$f":"All!X288","v":0},{"$f":"All!Y288","v":0},{"$f":"All!Z288","v":0},{"$f":"All!AA288","v":0},{"$f":"All!AB288","v":0},{"$f":"All!AC288","v":0},{"$f":"All!AD288","v":0},{"$f":"All!AE288","v":0},{"$f":"All!AF288","v":0},{"$f":"All!AG288","v":0},{"$f":"All!AH288","v":0},{"$f":"All!AI288","v":0},{"$f":"All!AJ288","v":0},{"$f":"All!AK288","v":0},{"$f":"All!AL288","v":0},{"$f":"All!AM288","v":0},{"$f":"All!AN288","v":0},{"$f":"All!AO288","v":0},{"$f":"All!AP288","v":0},{"$f":"All!AQ288","v":0},{"$f":"All!AR288","v":0},{"$f":"All!AS288","v":0},{"$f":"All!AT288","v":0}]
[null,{"$f":"All!B289","v":"4"},{"$f":"All!C289","v":"4.5"},{"$f":"All!D289","v":"4.5.1"},{"$f":"All!E289","v":""},{"$f":"All!F289","v":"4.5.1.1"},{"$f":"All!G289","v":0},{"$f":"All!H289","v":0},{"$f":"All!I289","v":"4.5.1.1.4"},{"$f":"All!J289","v":"4.5.1.1.4: When designing and planning changes to the mobile money service, are changes to processes considered for all functions?\n"},{"$f":"All!K289","v":0},{"$f":"All!L289","v":0},{"$f":"All!M289","v":"Recommended"},{"$f":"All!N289","v":"Recommended"},{"$f":"All!O289","v":"BizOps"},{"$f":"All!P289","v":0},{"$f":"All!Q289","v":0},{"$f":"All!R289","v":0},{"$f":"All!S289","v":0},{"$f":"All!T289","v":0},{"$f":"All!U289","v":0},{"$f":"All!V289","v":0},{"$f":"All!W289","v":0},{"$f":"All!X289","v":0},{"$f":"All!Y289","v":0},{"$f":"All!Z289","v":0},{"$f":"All!AA289","v":0},{"$f":"All!AB289","v":0},{"$f":"All!AC289","v":0},{"$f":"All!AD289","v":0},{"$f":"All!AE289","v":0},{"$f":"All!AF289","v":0},{"$f":"All!AG289","v":0},{"$f":"All!AH289","v":0},{"$f":"All!AI289","v":0},{"$f":"All!AJ289","v":0},{"$f":"All!AK289","v":0},{"$f":"All!AL289","v":0},{"$f":"All!AM289","v":0},{"$f":"All!AN289","v":0},{"$f":"All!AO289","v":0},{"$f":"All!AP289","v":0},{"$f":"All!AQ289","v":0},{"$f":"All!AR289","v":0},{"$f":"All!AS289","v":0},{"$f":"All!AT289","v":0}]
[null,{"$f":"All!B290","v":"4"},{"$f":"All!C290","v":"4.5"},{"$f":"All!D290","v":"4.5.1"},{"$f":"All!E290","v":""},{"$f":"All!F290","v":"4.5.1.1"},{"$f":"All!G290","v":0},{"$f":"All!H290","v":0},{"$f":"All!I290","v":"4.5.1.1.5"},{"$f":"All!J290","v":"4.5.1.1.5: When designing and planning changes to the mobile money service, are changes to reporting requirements considered for all functions?\n"},{"$f":"All!K290","v":0},{"$f":"All!L290","v":0},{"$f":"All!M290","v":"Recommended"},{"$f":"All!N290","v":"Recommended"},{"$f":"All!O290","v":"BizOps"},{"$f":"All!P290","v":0},{"$f":"All!Q290","v":0},{"$f":"All!R290","v":0},{"$f":"All!S290","v":0},{"$f":"All!T290","v":0},{"$f":"All!U290","v":0},{"$f":"All!V290","v":0},{"$f":"All!W290","v":0},{"$f":"All!X290","v":0},{"$f":"All!Y290","v":0},{"$f":"All!Z290","v":0},{"$f":"All!AA290","v":0},{"$f":"All!AB290","v":0},{"$f":"All!AC290","v":0},{"$f":"All!AD290","v":0},{"$f":"All!AE290","v":0},{"$f":"All!AF290","v":0},{"$f":"All!AG290","v":0},{"$f":"All!AH290","v":0},{"$f":"All!AI290","v":0},{"$f":"All!AJ290","v":0},{"$f":"All!AK290","v":0},{"$f":"All!AL290","v":0},{"$f":"All!AM290","v":0},{"$f":"All!AN290","v":0},{"$f":"All!AO290","v":0},{"$f":"All!AP290","v":0},{"$f":"All!AQ290","v":0},{"$f":"All!AR290","v":0},{"$f":"All!AS290","v":0},{"$f":"All!AT290","v":0}]
[null,{"$f":"All!B291","v":"4"},{"$f":"All!C291","v":"4.5"},{"$f":"All!D291","v":"4.5.1"},{"$f":"All!E291","v":""},{"$f":"All!F291","v":"4.5.1.1"},{"$f":"All!G291","v":0},{"$f":"All!H291","v":0},{"$f":"All!I291","v":"4.5.1.1.6"},{"$f":"All!J291","v":"4.5.1.1.6: When designing and planning changes to the mobile money service, are changes to SLAs considered for all functions?\n"},{"$f":"All!K291","v":0},{"$f":"All!L291","v":0},{"$f":"All!M291","v":"Recommended"},{"$f":"All!N291","v":"Recommended"},{"$f":"All!O291","v":"BizOps"},{"$f":"All!P291","v":0},{"$f":"All!Q291","v":0},{"$f":"All!R291","v":0},{"$f":"All!S291","v":0},{"$f":"All!T291","v":0},{"$f":"All!U291","v":0},{"$f":"All!V291","v":0},{"$f":"All!W291","v":0},{"$f":"All!X291","v":0},{"$f":"All!Y291","v":0},{"$f":"All!Z291","v":0},{"$f":"All!AA291","v":0},{"$f":"All!AB291","v":0},{"$f":"All!AC291","v":0},{"$f":"All!AD291","v":0},{"$f":"All!AE291","v":0},{"$f":"All!AF291","v":0},{"$f":"All!AG291","v":0},{"$f":"All!AH291","v":0},{"$f":"All!AI291","v":0},{"$f":"All!AJ291","v":0},{"$f":"All!AK291","v":0},{"$f":"All!AL291","v":0},{"$f":"All!AM291","v":0},{"$f":"All!AN291","v":0},{"$f":"All!AO291","v":0},{"$f":"All!AP291","v":0},{"$f":"All!AQ291","v":0},{"$f":"All!AR291","v":0},{"$f":"All!AS291","v":0},{"$f":"All!AT291","v":0}]
[null,{"$f":"All!B292","v":"4"},{"$f":"All!C292","v":"4.5"},{"$f":"All!D292","v":"4.5.1"},{"$f":"All!E292","v":""},{"$f":"All!F292","v":"4.5.1.1"},{"$f":"All!G292","v":0},{"$f":"All!H292","v":0},{"$f":"All!I292","v":"4.5.1.1.7"},{"$f":"All!J292","v":"4.5.1.1.7: When designing and planning changes to the mobile money service, are changes to third party arrangements considered for all functions?\n"},{"$f":"All!K292","v":0},{"$f":"All!L292","v":0},{"$f":"All!M292","v":"Recommended"},{"$f":"All!N292","v":"Recommended"},{"$f":"All!O292","v":"BizOps"},{"$f":"All!P292","v":0},{"$f":"All!Q292","v":0},{"$f":"All!R292","v":0},{"$f":"All!S292","v":0},{"$f":"All!T292","v":0},{"$f":"All!U292","v":0},{"$f":"All!V292","v":0},{"$f":"All!W292","v":0},{"$f":"All!X292","v":0},{"$f":"All!Y292","v":0},{"$f":"All!Z292","v":0},{"$f":"All!AA292","v":0},{"$f":"All!AB292","v":0},{"$f":"All!AC292","v":0},{"$f":"All!AD292","v":0},{"$f":"All!AE292","v":0},{"$f":"All!AF292","v":0},{"$f":"All!AG292","v":0},{"$f":"All!AH292","v":0},{"$f":"All!AI292","v":0},{"$f":"All!AJ292","v":0},{"$f":"All!AK292","v":0},{"$f":"All!AL292","v":0},{"$f":"All!AM292","v":0},{"$f":"All!AN292","v":0},{"$f":"All!AO292","v":0},{"$f":"All!AP292","v":0},{"$f":"All!AQ292","v":0},{"$f":"All!AR292","v":0},{"$f":"All!AS292","v":0},{"$f":"All!AT292","v":0}]
[null,{"$f":"All!B293","v":"4"},{"$f":"All!C293","v":"4.5"},{"$f":"All!D293","v":"4.5.1"},{"$f":"All!E293","v":""},{"$f":"All!F293","v":"4.5.1.1"},{"$f":"All!G293","v":0},{"$f":"All!H293","v":0},{"$f":"All!I293","v":"4.5.1.1.8"},{"$f":"All!J293","v":"4.5.1.1.8: When designing and planning changes to the mobile money service, are human resource requirements (including training) considered for all functions?\n"},{"$f":"All!K293","v":0},{"$f":"All!L293","v":0},{"$f":"All!M293","v":"Recommended"},{"$f":"All!N293","v":"Recommended"},{"$f":"All!O293","v":"BizOps"},{"$f":"All!P293","v":0},{"$f":"All!Q293","v":0},{"$f":"All!R293","v":0},{"$f":"All!S293","v":0},{"$f":"All!T293","v":0},{"$f":"All!U293","v":0},{"$f":"All!V293","v":0},{"$f":"All!W293","v":0},{"$f":"All!X293","v":0},{"$f":"All!Y293","v":0},{"$f":"All!Z293","v":0},{"$f":"All!AA293","v":0},{"$f":"All!AB293","v":0},{"$f":"All!AC293","v":0},{"$f":"All!AD293","v":0},{"$f":"All!AE293","v":0},{"$f":"All!AF293","v":0},{"$f":"All!AG293","v":0},{"$f":"All!AH293","v":0},{"$f":"All!AI293","v":0},{"$f":"All!AJ293","v":0},{"$f":"All!AK293","v":0},{"$f":"All!AL293","v":0},{"$f":"All!AM293","v":0},{"$f":"All!AN293","v":0},{"$f":"All!AO293","v":0},{"$f":"All!AP293","v":0},{"$f":"All!AQ293","v":0},{"$f":"All!AR293","v":0},{"$f":"All!AS293","v":0},{"$f":"All!AT293","v":0}]
[null,{"$f":"All!B294","v":"4"},{"$f":"All!C294","v":"4.5"},{"$f":"All!D294","v":"4.5.1"},{"$f":"All!E294","v":""},{"$f":"All!F294","v":"4.5.1.1"},{"$f":"All!G294","v":0},{"$f":"All!H294","v":0},{"$f":"All!I294","v":"4.5.1.1.9"},{"$f":"All!J294","v":"4.5.1.1.9: When changes are made to the mobile money service does the planning include internal and external communication of the changes?\n"},{"$f":"All!K294","v":0},{"$f":"All!L294","v":0},{"$f":"All!M294","v":"Recommended"},{"$f":"All!N294","v":"Recommended"},{"$f":"All!O294","v":"BizOps"},{"$f":"All!P294","v":0},{"$f":"All!Q294","v":0},{"$f":"All!R294","v":0},{"$f":"All!S294","v":0},{"$f":"All!T294","v":0},{"$f":"All!U294","v":0},{"$f":"All!V294","v":0},{"$f":"All!W294","v":0},{"$f":"All!X294","v":0},{"$f":"All!Y294","v":0},{"$f":"All!Z294","v":0},{"$f":"All!AA294","v":0},{"$f":"All!AB294","v":0},{"$f":"All!AC294","v":0},{"$f":"All!AD294","v":0},{"$f":"All!AE294","v":0},{"$f":"All!AF294","v":0},{"$f":"All!AG294","v":0},{"$f":"All!AH294","v":0},{"$f":"All!AI294","v":0},{"$f":"All!AJ294","v":0},{"$f":"All!AK294","v":0},{"$f":"All!AL294","v":0},{"$f":"All!AM294","v":0},{"$f":"All!AN294","v":0},{"$f":"All!AO294","v":0},{"$f":"All!AP294","v":0},{"$f":"All!AQ294","v":0},{"$f":"All!AR294","v":0},{"$f":"All!AS294","v":0},{"$f":"All!AT294","v":0}]
[null,{"$f":"All!B295","v":"4"},{"$f":"All!C295","v":"4.5"},{"$f":"All!D295","v":"4.5.1"},{"$f":"All!E295","v":""},{"$f":"All!F295","v":"4.5.1.2"},{"$f":"All!G295","v":"4.5.1.2: CHANGES TO THE MOBILE MONEY SYSTEM (CHANGE ADVISORY BOARD)\nAll technical changes to the mobile money system should be subject to a technical change management process (e.g. Change Advisory Board) to review and approve proposed changes to the mobile money system. The process should include:\n- Definition of the proposed change;\n- Impact assessment;\n- Testing - user acceptance testing, operational acceptance testing (see 4.5.1.3);\n- Deployment process, including go/no-go and roll-back (see 4.5.1.4);\n- Communication plan;\n- Review and approval by all relevant technical areas.\n\nA schedule for deployment of releases should be planned and communicated to technical and business managers.\n\nRelease notes should document the changes that are being made with each system change, including  all changes, bug fixes, known issues, and deployment/roll-back procedures.\n\nFollowing deployment, there should be a period or observation on the live environment to validate the deployment and a post-implementation review.\n\nFollowing each update to the system a report of the testing and deployment should be sent to business and technical managers.\n\nEmergency releases (fixes to resolve an incident) should be managed and deployed according to a documented procedure that is part of the incident management process.\n"},{"$f":"All!H295","v":"ISO 20000-1:2019 Sec 8.5.2\nISO 27002: 2013 Sec. 12.5"},{"$f":"All!I295","v":"4.5.1.2.1"},{"$f":"All!J295","v":"4.5.1.2.1: Is there a formal technical change management process (e.g. Change Advisory Board) to manage all changes to the live technical environment (including patches, minor changes and major releases)?\n"},{"$f":"All!K295","v":"1) Technical change management process or example change management documentation\n- Check that there is a documented formal technical change management process (e.g. Change Advisory Board) to manage all changes to the live technical environment (including patches, minor changes and major releases).\n- Check that evidence exists for approval by the technical operations manager for all releases.  \n        a) Review sign-off of release documentation for examples of technical changes in the last year.\n        b) Review process documentation if no releases have been made in the last year.\n        c) If previous technical changes did not have approval, review process documentation and look for evidence that future releases will have approval (e.g. revised process)\n"},{"$f":"All!L295","v":0},{"$f":"All!M295","v":"Urgent Required"},{"$f":"All!N295","v":"Required"},{"$f":"All!O295","v":"TechOps"},{"$f":"All!P295","v":0},{"$f":"All!Q295","v":0},{"$f":"All!R295","v":0},{"$f":"All!S295","v":0},{"$f":"All!T295","v":0},{"$f":"All!U295","v":0},{"$f":"All!V295","v":0},{"$f":"All!W295","v":0},{"$f":"All!X295","v":0},{"$f":"All!Y295","v":0},{"$f":"All!Z295","v":0},{"$f":"All!AA295","v":0},{"$f":"All!AB295","v":0},{"$f":"All!AC295","v":0},{"$f":"All!AD295","v":0},{"$f":"All!AE295","v":0},{"$f":"All!AF295","v":0},{"$f":"All!AG295","v":0},{"$f":"All!AH295","v":0},{"$f":"All!AI295","v":0},{"$f":"All!AJ295","v":0},{"$f":"All!AK295","v":0},{"$f":"All!AL295","v":0},{"$f":"All!AM295","v":0},{"$f":"All!AN295","v":0},{"$f":"All!AO295","v":0},{"$f":"All!AP295","v":0},{"$f":"All!AQ295","v":0},{"$f":"All!AR295","v":0},{"$f":"All!AS295","v":0},{"$f":"All!AT295","v":0}]
[null,{"$f":"All!B296","v":"4"},{"$f":"All!C296","v":"4.5"},{"$f":"All!D296","v":"4.5.1"},{"$f":"All!E296","v":""},{"$f":"All!F296","v":"4.5.1.2"},{"$f":"All!G296","v":0},{"$f":"All!H296","v":0},{"$f":"All!I296","v":"4.5.1.2.2"},{"$f":"All!J296","v":"4.5.1.2.2: Are planned system changes documented in a change calendar and communicated to technical and business managers?\n"},{"$f":"All!K296","v":"1) Mobile money system deployment plan\n- Check that technical changes to the MM system have been documented in a change calendar.\n- Check that previous technical changes have been communicated to technical and business managers in advance.\n"},{"$f":"All!L296","v":0},{"$f":"All!M296","v":"Standard Required"},{"$f":"All!N296","v":"Required"},{"$f":"All!O296","v":"TechOps"},{"$f":"All!P296","v":0},{"$f":"All!Q296","v":0},{"$f":"All!R296","v":0},{"$f":"All!S296","v":0},{"$f":"All!T296","v":0},{"$f":"All!U296","v":0},{"$f":"All!V296","v":0},{"$f":"All!W296","v":0},{"$f":"All!X296","v":0},{"$f":"All!Y296","v":0},{"$f":"All!Z296","v":0},{"$f":"All!AA296","v":0},{"$f":"All!AB296","v":0},{"$f":"All!AC296","v":0},{"$f":"All!AD296","v":0},{"$f":"All!AE296","v":0},{"$f":"All!AF296","v":0},{"$f":"All!AG296","v":0},{"$f":"All!AH296","v":0},{"$f":"All!AI296","v":0},{"$f":"All!AJ296","v":0},{"$f":"All!AK296","v":0},{"$f":"All!AL296","v":0},{"$f":"All!AM296","v":0},{"$f":"All!AN296","v":0},{"$f":"All!AO296","v":0},{"$f":"All!AP296","v":0},{"$f":"All!AQ296","v":0},{"$f":"All!AR296","v":0},{"$f":"All!AS296","v":0},{"$f":"All!AT296","v":0}]
[null,{"$f":"All!B297","v":"4"},{"$f":"All!C297","v":"4.5"},{"$f":"All!D297","v":"4.5.1"},{"$f":"All!E297","v":""},{"$f":"All!F297","v":"4.5.1.2"},{"$f":"All!G297","v":0},{"$f":"All!H297","v":0},{"$f":"All!I297","v":"4.5.1.2.3"},{"$f":"All!J297","v":"4.5.1.2.3: Are release notes produced for each change, documenting the changes that are being made, including all changes, bug fixes, known issues, and deployment/roll-back procedures?\n"},{"$f":"All!K297","v":"1) Technical change management process or example change management documentation\n- Check that suitable release notes are produced for all changes. \n        a) Review release notes for example changes in the last year. \n        b) Review release notes template if no changes have been made in the last year.\n        c) If previous changes did not have release notes, review process documentation and look for evidence that future changes will have release notes (e.g. revised process)"},{"$f":"All!L297","v":0},{"$f":"All!M297","v":"Standard Required"},{"$f":"All!N297","v":"Required"},{"$f":"All!O297","v":"TechOps"},{"$f":"All!P297","v":0},{"$f":"All!Q297","v":0},{"$f":"All!R297","v":0},{"$f":"All!S297","v":0},{"$f":"All!T297","v":0},{"$f":"All!U297","v":0},{"$f":"All!V297","v":0},{"$f":"All!W297","v":0},{"$f":"All!X297","v":0},{"$f":"All!Y297","v":0},{"$f":"All!Z297","v":0},{"$f":"All!AA297","v":0},{"$f":"All!AB297","v":0},{"$f":"All!AC297","v":0},{"$f":"All!AD297","v":0},{"$f":"All!AE297","v":0},{"$f":"All!AF297","v":0},{"$f":"All!AG297","v":0},{"$f":"All!AH297","v":0},{"$f":"All!AI297","v":0},{"$f":"All!AJ297","v":0},{"$f":"All!AK297","v":0},{"$f":"All!AL297","v":0},{"$f":"All!AM297","v":0},{"$f":"All!AN297","v":0},{"$f":"All!AO297","v":0},{"$f":"All!AP297","v":0},{"$f":"All!AQ297","v":0},{"$f":"All!AR297","v":0},{"$f":"All!AS297","v":0},{"$f":"All!AT297","v":0}]
[null,{"$f":"All!B298","v":"4"},{"$f":"All!C298","v":"4.5"},{"$f":"All!D298","v":"4.5.1"},{"$f":"All!E298","v":""},{"$f":"All!F298","v":"4.5.1.2"},{"$f":"All!G298","v":0},{"$f":"All!H298","v":0},{"$f":"All!I298","v":"4.5.1.2.4"},{"$f":"All!J298","v":"4.5.1.2.4: Following deployment, is final testing performed on the live environment to validate the deployment?\n"},{"$f":"All!K298","v":0},{"$f":"All!L298","v":0},{"$f":"All!M298","v":"Recommended"},{"$f":"All!N298","v":"Recommended"},{"$f":"All!O298","v":"TechOps"},{"$f":"All!P298","v":0},{"$f":"All!Q298","v":0},{"$f":"All!R298","v":0},{"$f":"All!S298","v":0},{"$f":"All!T298","v":0},{"$f":"All!U298","v":0},{"$f":"All!V298","v":0},{"$f":"All!W298","v":0},{"$f":"All!X298","v":0},{"$f":"All!Y298","v":0},{"$f":"All!Z298","v":0},{"$f":"All!AA298","v":0},{"$f":"All!AB298","v":0},{"$f":"All!AC298","v":0},{"$f":"All!AD298","v":0},{"$f":"All!AE298","v":0},{"$f":"All!AF298","v":0},{"$f":"All!AG298","v":0},{"$f":"All!AH298","v":0},{"$f":"All!AI298","v":0},{"$f":"All!AJ298","v":0},{"$f":"All!AK298","v":0},{"$f":"All!AL298","v":0},{"$f":"All!AM298","v":0},{"$f":"All!AN298","v":0},{"$f":"All!AO298","v":0},{"$f":"All!AP298","v":0},{"$f":"All!AQ298","v":0},{"$f":"All!AR298","v":0},{"$f":"All!AS298","v":0},{"$f":"All!AT298","v":0}]
[null,{"$f":"All!B299","v":"4"},{"$f":"All!C299","v":"4.5"},{"$f":"All!D299","v":"4.5.1"},{"$f":"All!E299","v":""},{"$f":"All!F299","v":"4.5.1.2"},{"$f":"All!G299","v":0},{"$f":"All!H299","v":0},{"$f":"All!I299","v":"4.5.1.2.5"},{"$f":"All!J299","v":"4.5.1.2.5: Following each release, is a report of the testing and deployment sent to business and technical managers, comparing the outcomes achieved against the expected outcomes?\n"},{"$f":"All!K299","v":0},{"$f":"All!L299","v":0},{"$f":"All!M299","v":"Recommended"},{"$f":"All!N299","v":"Recommended"},{"$f":"All!O299","v":"TechOps"},{"$f":"All!P299","v":0},{"$f":"All!Q299","v":0},{"$f":"All!R299","v":0},{"$f":"All!S299","v":0},{"$f":"All!T299","v":0},{"$f":"All!U299","v":0},{"$f":"All!V299","v":0},{"$f":"All!W299","v":0},{"$f":"All!X299","v":0},{"$f":"All!Y299","v":0},{"$f":"All!Z299","v":0},{"$f":"All!AA299","v":0},{"$f":"All!AB299","v":0},{"$f":"All!AC299","v":0},{"$f":"All!AD299","v":0},{"$f":"All!AE299","v":0},{"$f":"All!AF299","v":0},{"$f":"All!AG299","v":0},{"$f":"All!AH299","v":0},{"$f":"All!AI299","v":0},{"$f":"All!AJ299","v":0},{"$f":"All!AK299","v":0},{"$f":"All!AL299","v":0},{"$f":"All!AM299","v":0},{"$f":"All!AN299","v":0},{"$f":"All!AO299","v":0},{"$f":"All!AP299","v":0},{"$f":"All!AQ299","v":0},{"$f":"All!AR299","v":0},{"$f":"All!AS299","v":0},{"$f":"All!AT299","v":0}]
[null,{"$f":"All!B300","v":"4"},{"$f":"All!C300","v":"4.5"},{"$f":"All!D300","v":"4.5.1"},{"$f":"All!E300","v":""},{"$f":"All!F300","v":"4.5.1.2"},{"$f":"All!G300","v":0},{"$f":"All!H300","v":0},{"$f":"All!I300","v":"4.5.1.2.6"},{"$f":"All!J300","v":"4.5.1.2.6: Are emergency changes managed and deployed according to a documented procedure that is part of the incident management process (e.g. Emergency Change Advisory Board)?\n"},{"$f":"All!K300","v":"1) Incident management process\n- Check the incident management procedure includes a process for emergency changes with suitable approval (e.g. Emergency Change Advisory Board)."},{"$f":"All!L300","v":0},{"$f":"All!M300","v":"Standard Required"},{"$f":"All!N300","v":"Required"},{"$f":"All!O300","v":"TechOps"},{"$f":"All!P300","v":0},{"$f":"All!Q300","v":0},{"$f":"All!R300","v":0},{"$f":"All!S300","v":0},{"$f":"All!T300","v":0},{"$f":"All!U300","v":0},{"$f":"All!V300","v":0},{"$f":"All!W300","v":0},{"$f":"All!X300","v":0},{"$f":"All!Y300","v":0},{"$f":"All!Z300","v":0},{"$f":"All!AA300","v":0},{"$f":"All!AB300","v":0},{"$f":"All!AC300","v":0},{"$f":"All!AD300","v":0},{"$f":"All!AE300","v":0},{"$f":"All!AF300","v":0},{"$f":"All!AG300","v":0},{"$f":"All!AH300","v":0},{"$f":"All!AI300","v":0},{"$f":"All!AJ300","v":0},{"$f":"All!AK300","v":0},{"$f":"All!AL300","v":0},{"$f":"All!AM300","v":0},{"$f":"All!AN300","v":0},{"$f":"All!AO300","v":0},{"$f":"All!AP300","v":0},{"$f":"All!AQ300","v":0},{"$f":"All!AR300","v":0},{"$f":"All!AS300","v":0},{"$f":"All!AT300","v":0}]
[null,{"$f":"All!B301","v":"4"},{"$f":"All!C301","v":"4.5"},{"$f":"All!D301","v":"4.5.1"},{"$f":"All!E301","v":""},{"$f":"All!F301","v":"4.5.1.3"},{"$f":"All!G301","v":"4.5.1.3: RELEASE MANAGEMENT - TESTING\nReleases should be built and tested in a separate testing environment prior to deployment to the live system. The testing environment should be a valid representation of the production environment. All releases should be tested before being released to production.\n\nUser Acceptance Testing (functional testing) should be done to ensure that the release fulfils the functional requirements and design. The release should be verified against service acceptance criteria agreed in advance by the mobile money business operations manager.\n\nOperational Acceptance Testing (non-functional testing) should be done to ensure that the release meets technical acceptance criteria, which should be agreed in advance of testing. At minimum, the following should be tested in every major release:\n- failover capability;\n- system security;\n- system performance;\n- operational requirements (e.g. logging, alerting).\n"},{"$f":"All!H301","v":"ISO 20000-1:2019 Sec. 8.5.3\nISO 27002: 2013 Sec. 12.5"},{"$f":"All!I301","v":"4.5.1.3.1"},{"$f":"All!J301","v":"4.5.1.3.1: is there a separate testing environment, which is a valid representation of the production environment?\n"},{"$f":"All!K301","v":"1) System architecture specification\n- Check that the testing environment is a valid representation of the live environment (i.e. comparable architecture, and the same version and configuration as the live system). If the test environment has a scaled-down architecture then there should be a documented risk assessment or reasoning."},{"$f":"All!L301","v":0},{"$f":"All!M301","v":"Urgent Required"},{"$f":"All!N301","v":"Required"},{"$f":"All!O301","v":"TechOps"},{"$f":"All!P301","v":0},{"$f":"All!Q301","v":0},{"$f":"All!R301","v":0},{"$f":"All!S301","v":0},{"$f":"All!T301","v":0},{"$f":"All!U301","v":0},{"$f":"All!V301","v":0},{"$f":"All!W301","v":0},{"$f":"All!X301","v":0},{"$f":"All!Y301","v":0},{"$f":"All!Z301","v":0},{"$f":"All!AA301","v":0},{"$f":"All!AB301","v":0},{"$f":"All!AC301","v":0},{"$f":"All!AD301","v":0},{"$f":"All!AE301","v":0},{"$f":"All!AF301","v":0},{"$f":"All!AG301","v":0},{"$f":"All!AH301","v":0},{"$f":"All!AI301","v":0},{"$f":"All!AJ301","v":0},{"$f":"All!AK301","v":0},{"$f":"All!AL301","v":0},{"$f":"All!AM301","v":0},{"$f":"All!AN301","v":0},{"$f":"All!AO301","v":0},{"$f":"All!AP301","v":0},{"$f":"All!AQ301","v":0},{"$f":"All!AR301","v":0},{"$f":"All!AS301","v":0},{"$f":"All!AT301","v":0}]
[null,{"$f":"All!B302","v":"4"},{"$f":"All!C302","v":"4.5"},{"$f":"All!D302","v":"4.5.1"},{"$f":"All!E302","v":""},{"$f":"All!F302","v":"4.5.1.3"},{"$f":"All!G302","v":0},{"$f":"All!H302","v":0},{"$f":"All!I302","v":"4.5.1.3.2"},{"$f":"All!J302","v":"4.5.1.3.2: Is User Acceptance Testing (functional testing) done to verify each release against acceptance criteria agreed in advance by the mobile money business operations manager?\n"},{"$f":"All!K302","v":"1) Release Management Process or testing specifications \n- Check there is a process to verify each release against agreed acceptance criteria (i.e. functional / user acceptance testing). \n- Check the process requires that all releases are built and tested in a separate testing environment prior to being deployed on the live system. \n"},{"$f":"All!L302","v":0},{"$f":"All!M302","v":"Urgent Required"},{"$f":"All!N302","v":"Required"},{"$f":"All!O302","v":"TechOps"},{"$f":"All!P302","v":0},{"$f":"All!Q302","v":0},{"$f":"All!R302","v":0},{"$f":"All!S302","v":0},{"$f":"All!T302","v":0},{"$f":"All!U302","v":0},{"$f":"All!V302","v":0},{"$f":"All!W302","v":0},{"$f":"All!X302","v":0},{"$f":"All!Y302","v":0},{"$f":"All!Z302","v":0},{"$f":"All!AA302","v":0},{"$f":"All!AB302","v":0},{"$f":"All!AC302","v":0},{"$f":"All!AD302","v":0},{"$f":"All!AE302","v":0},{"$f":"All!AF302","v":0},{"$f":"All!AG302","v":0},{"$f":"All!AH302","v":0},{"$f":"All!AI302","v":0},{"$f":"All!AJ302","v":0},{"$f":"All!AK302","v":0},{"$f":"All!AL302","v":0},{"$f":"All!AM302","v":0},{"$f":"All!AN302","v":0},{"$f":"All!AO302","v":0},{"$f":"All!AP302","v":0},{"$f":"All!AQ302","v":0},{"$f":"All!AR302","v":0},{"$f":"All!AS302","v":0},{"$f":"All!AT302","v":0}]
[null,{"$f":"All!B303","v":"4"},{"$f":"All!C303","v":"4.5"},{"$f":"All!D303","v":"4.5.1"},{"$f":"All!E303","v":""},{"$f":"All!F303","v":"4.5.1.3"},{"$f":"All!G303","v":0},{"$f":"All!H303","v":0},{"$f":"All!I303","v":"4.5.1.3.3"},{"$f":"All!J303","v":"4.5.1.3.3: Is Operational Acceptance Testing (non-functional testing) done on each major release?\n"},{"$f":"All!K303","v":"1) Release Management Process or testing specifications \n- Check there is a process to verify each major release against agreed operational acceptance criteria (i.e. non-functional / operational acceptance testing). "},{"$f":"All!L303","v":0},{"$f":"All!M303","v":"Standard Required"},{"$f":"All!N303","v":"Required"},{"$f":"All!O303","v":"TechOps"},{"$f":"All!P303","v":0},{"$f":"All!Q303","v":0},{"$f":"All!R303","v":0},{"$f":"All!S303","v":0},{"$f":"All!T303","v":0},{"$f":"All!U303","v":0},{"$f":"All!V303","v":0},{"$f":"All!W303","v":0},{"$f":"All!X303","v":0},{"$f":"All!Y303","v":0},{"$f":"All!Z303","v":0},{"$f":"All!AA303","v":0},{"$f":"All!AB303","v":0},{"$f":"All!AC303","v":0},{"$f":"All!AD303","v":0},{"$f":"All!AE303","v":0},{"$f":"All!AF303","v":0},{"$f":"All!AG303","v":0},{"$f":"All!AH303","v":0},{"$f":"All!AI303","v":0},{"$f":"All!AJ303","v":0},{"$f":"All!AK303","v":0},{"$f":"All!AL303","v":0},{"$f":"All!AM303","v":0},{"$f":"All!AN303","v":0},{"$f":"All!AO303","v":0},{"$f":"All!AP303","v":0},{"$f":"All!AQ303","v":0},{"$f":"All!AR303","v":0},{"$f":"All!AS303","v":0},{"$f":"All!AT303","v":0}]
[null,{"$f":"All!B304","v":"4"},{"$f":"All!C304","v":"4.5"},{"$f":"All!D304","v":"4.5.1"},{"$f":"All!E304","v":""},{"$f":"All!F304","v":"4.5.1.3"},{"$f":"All!G304","v":0},{"$f":"All!H304","v":0},{"$f":"All!I304","v":"4.5.1.3.4"},{"$f":"All!J304","v":"4.5.1.3.4: Does operational acceptance testing test failover capability, system security, system performance, and operational requirements in every major release?\n"},{"$f":"All!K304","v":0},{"$f":"All!L304","v":0},{"$f":"All!M304","v":"Recommended"},{"$f":"All!N304","v":"Recommended"},{"$f":"All!O304","v":"TechOps"},{"$f":"All!P304","v":0},{"$f":"All!Q304","v":0},{"$f":"All!R304","v":0},{"$f":"All!S304","v":0},{"$f":"All!T304","v":0},{"$f":"All!U304","v":0},{"$f":"All!V304","v":0},{"$f":"All!W304","v":0},{"$f":"All!X304","v":0},{"$f":"All!Y304","v":0},{"$f":"All!Z304","v":0},{"$f":"All!AA304","v":0},{"$f":"All!AB304","v":0},{"$f":"All!AC304","v":0},{"$f":"All!AD304","v":0},{"$f":"All!AE304","v":0},{"$f":"All!AF304","v":0},{"$f":"All!AG304","v":0},{"$f":"All!AH304","v":0},{"$f":"All!AI304","v":0},{"$f":"All!AJ304","v":0},{"$f":"All!AK304","v":0},{"$f":"All!AL304","v":0},{"$f":"All!AM304","v":0},{"$f":"All!AN304","v":0},{"$f":"All!AO304","v":0},{"$f":"All!AP304","v":0},{"$f":"All!AQ304","v":0},{"$f":"All!AR304","v":0},{"$f":"All!AS304","v":0},{"$f":"All!AT304","v":0}]
[null,{"$f":"All!B305","v":"4"},{"$f":"All!C305","v":"4.5"},{"$f":"All!D305","v":"4.5.1"},{"$f":"All!E305","v":""},{"$f":"All!F305","v":"4.5.1.4"},{"$f":"All!G305","v":"4.5.1.4: CONFIGURATION MANAGEMENT\nConfiguration management is used to maintain a detailed record of the mobile money system's hardware and software and their configuration and documentation.\n\nProviders should record all software and hardware components in a configuration management database. All system documentation should also be stored.\n\nPrevious versions of application software and configurations should be retained as a contingency measure: old versions of software and their configuration should be archived for as long as the data are retained in archive.\n\nThe configuration management database should be updated as part of the release management process when changes are made to the system.\n"},{"$f":"All!H305","v":"PCI DSS, ISO 20000-1:2011 Sec. 9.1\nISO 27002: 2013 Sec. 12.5 "},{"$f":"All!I305","v":"4.5.1.4.1"},{"$f":"All!J305","v":"4.5.1.4.1: Is a configuration management database used to maintain a detailed record of the mobile money system's hardware and software and their configuration and documentation?\n"},{"$f":"All!K305","v":"Configuration management specification"},{"$f":"All!L305","v":0},{"$f":"All!M305","v":"Recommended"},{"$f":"All!N305","v":"Recommended"},{"$f":"All!O305","v":"TechOps"},{"$f":"All!P305","v":0},{"$f":"All!Q305","v":0},{"$f":"All!R305","v":0},{"$f":"All!S305","v":0},{"$f":"All!T305","v":0},{"$f":"All!U305","v":0},{"$f":"All!V305","v":0},{"$f":"All!W305","v":0},{"$f":"All!X305","v":0},{"$f":"All!Y305","v":0},{"$f":"All!Z305","v":0},{"$f":"All!AA305","v":0},{"$f":"All!AB305","v":0},{"$f":"All!AC305","v":0},{"$f":"All!AD305","v":0},{"$f":"All!AE305","v":0},{"$f":"All!AF305","v":0},{"$f":"All!AG305","v":0},{"$f":"All!AH305","v":0},{"$f":"All!AI305","v":0},{"$f":"All!AJ305","v":0},{"$f":"All!AK305","v":0},{"$f":"All!AL305","v":0},{"$f":"All!AM305","v":0},{"$f":"All!AN305","v":0},{"$f":"All!AO305","v":0},{"$f":"All!AP305","v":0},{"$f":"All!AQ305","v":0},{"$f":"All!AR305","v":0},{"$f":"All!AS305","v":0},{"$f":"All!AT305","v":0}]
[null,{"$f":"All!B306","v":"4"},{"$f":"All!C306","v":"4.5"},{"$f":"All!D306","v":"4.5.1"},{"$f":"All!E306","v":""},{"$f":"All!F306","v":"4.5.1.4"},{"$f":"All!G306","v":0},{"$f":"All!H306","v":0},{"$f":"All!I306","v":"4.5.1.4.2"},{"$f":"All!J306","v":"4.5.1.4.2: Are previous versions of application software and configurations retained as a contingency measure for as long as the data are retained in archive?\n"},{"$f":"All!K306","v":0},{"$f":"All!L306","v":0},{"$f":"All!M306","v":"Recommended"},{"$f":"All!N306","v":"Recommended"},{"$f":"All!O306","v":"TechOps"},{"$f":"All!P306","v":0},{"$f":"All!Q306","v":0},{"$f":"All!R306","v":0},{"$f":"All!S306","v":0},{"$f":"All!T306","v":0},{"$f":"All!U306","v":0},{"$f":"All!V306","v":0},{"$f":"All!W306","v":0},{"$f":"All!X306","v":0},{"$f":"All!Y306","v":0},{"$f":"All!Z306","v":0},{"$f":"All!AA306","v":0},{"$f":"All!AB306","v":0},{"$f":"All!AC306","v":0},{"$f":"All!AD306","v":0},{"$f":"All!AE306","v":0},{"$f":"All!AF306","v":0},{"$f":"All!AG306","v":0},{"$f":"All!AH306","v":0},{"$f":"All!AI306","v":0},{"$f":"All!AJ306","v":0},{"$f":"All!AK306","v":0},{"$f":"All!AL306","v":0},{"$f":"All!AM306","v":0},{"$f":"All!AN306","v":0},{"$f":"All!AO306","v":0},{"$f":"All!AP306","v":0},{"$f":"All!AQ306","v":0},{"$f":"All!AR306","v":0},{"$f":"All!AS306","v":0},{"$f":"All!AT306","v":0}]
[null,{"$f":"All!B307","v":"4"},{"$f":"All!C307","v":"4.5"},{"$f":"All!D307","v":"4.5.1"},{"$f":"All!E307","v":""},{"$f":"All!F307","v":"4.5.1.4"},{"$f":"All!G307","v":0},{"$f":"All!H307","v":0},{"$f":"All!I307","v":"4.5.1.4.3"},{"$f":"All!J307","v":"4.5.1.4.3: Is the configuration management database updated as part of the release management process when changes are made to the system?\n"},{"$f":"All!K307","v":0},{"$f":"All!L307","v":0},{"$f":"All!M307","v":"Recommended"},{"$f":"All!N307","v":"Recommended"},{"$f":"All!O307","v":"TechOps"},{"$f":"All!P307","v":0},{"$f":"All!Q307","v":0},{"$f":"All!R307","v":0},{"$f":"All!S307","v":0},{"$f":"All!T307","v":0},{"$f":"All!U307","v":0},{"$f":"All!V307","v":0},{"$f":"All!W307","v":0},{"$f":"All!X307","v":0},{"$f":"All!Y307","v":0},{"$f":"All!Z307","v":0},{"$f":"All!AA307","v":0},{"$f":"All!AB307","v":0},{"$f":"All!AC307","v":0},{"$f":"All!AD307","v":0},{"$f":"All!AE307","v":0},{"$f":"All!AF307","v":0},{"$f":"All!AG307","v":0},{"$f":"All!AH307","v":0},{"$f":"All!AI307","v":0},{"$f":"All!AJ307","v":0},{"$f":"All!AK307","v":0},{"$f":"All!AL307","v":0},{"$f":"All!AM307","v":0},{"$f":"All!AN307","v":0},{"$f":"All!AO307","v":0},{"$f":"All!AP307","v":0},{"$f":"All!AQ307","v":0},{"$f":"All!AR307","v":0},{"$f":"All!AS307","v":0},{"$f":"All!AT307","v":0}]
[null,{"$f":"All!B308","v":"4"},{"$f":"All!C308","v":"4.5"},{"$f":"All!D308","v":"4.5.1"},{"$f":"All!E308","v":""},{"$f":"All!F308","v":"4.5.1.5"},{"$f":"All!G308","v":"4.5.1.5: REMOVAL OF SERVICES\nWhen services are to be removed, the removal should be performed under a formal process. \n\nCustomer data related to the removed service should be archived in a form that is retrievable. Archived data should be kept according to the data retention policy."},{"$f":"All!H308","v":"ISO 20000-1:2011 Sec. 5.2"},{"$f":"All!I308","v":"4.5.1.5.1"},{"$f":"All!J308","v":"4.5.1.5.1: When services are to be removed, is the removal performed under a formal process?\n"},{"$f":"All!K308","v":"1) Release management process \n- Check there is a documented process for the removal of services e.g. a formal project-management process for all changes to services.\n"},{"$f":"All!L308","v":0},{"$f":"All!M308","v":"Recommended"},{"$f":"All!N308","v":"Recommended"},{"$f":"All!O308","v":"BizOps"},{"$f":"All!P308","v":0},{"$f":"All!Q308","v":0},{"$f":"All!R308","v":0},{"$f":"All!S308","v":0},{"$f":"All!T308","v":0},{"$f":"All!U308","v":0},{"$f":"All!V308","v":0},{"$f":"All!W308","v":0},{"$f":"All!X308","v":0},{"$f":"All!Y308","v":0},{"$f":"All!Z308","v":0},{"$f":"All!AA308","v":0},{"$f":"All!AB308","v":0},{"$f":"All!AC308","v":0},{"$f":"All!AD308","v":0},{"$f":"All!AE308","v":0},{"$f":"All!AF308","v":0},{"$f":"All!AG308","v":0},{"$f":"All!AH308","v":0},{"$f":"All!AI308","v":0},{"$f":"All!AJ308","v":0},{"$f":"All!AK308","v":0},{"$f":"All!AL308","v":0},{"$f":"All!AM308","v":0},{"$f":"All!AN308","v":0},{"$f":"All!AO308","v":0},{"$f":"All!AP308","v":0},{"$f":"All!AQ308","v":0},{"$f":"All!AR308","v":0},{"$f":"All!AS308","v":0},{"$f":"All!AT308","v":0}]
[null,{"$f":"All!B309","v":"4"},{"$f":"All!C309","v":"4.5"},{"$f":"All!D309","v":"4.5.1"},{"$f":"All!E309","v":""},{"$f":"All!F309","v":"4.5.1.5"},{"$f":"All!G309","v":0},{"$f":"All!H309","v":0},{"$f":"All!I309","v":"4.5.1.5.2"},{"$f":"All!J309","v":"4.5.1.5.2: Is customer data related to the removed service archived in a form that is retrievable?\n"},{"$f":"All!K309","v":0},{"$f":"All!L309","v":0},{"$f":"All!M309","v":"Recommended"},{"$f":"All!N309","v":"Recommended"},{"$f":"All!O309","v":"TechOps"},{"$f":"All!P309","v":0},{"$f":"All!Q309","v":0},{"$f":"All!R309","v":0},{"$f":"All!S309","v":0},{"$f":"All!T309","v":0},{"$f":"All!U309","v":0},{"$f":"All!V309","v":0},{"$f":"All!W309","v":0},{"$f":"All!X309","v":0},{"$f":"All!Y309","v":0},{"$f":"All!Z309","v":0},{"$f":"All!AA309","v":0},{"$f":"All!AB309","v":0},{"$f":"All!AC309","v":0},{"$f":"All!AD309","v":0},{"$f":"All!AE309","v":0},{"$f":"All!AF309","v":0},{"$f":"All!AG309","v":0},{"$f":"All!AH309","v":0},{"$f":"All!AI309","v":0},{"$f":"All!AJ309","v":0},{"$f":"All!AK309","v":0},{"$f":"All!AL309","v":0},{"$f":"All!AM309","v":0},{"$f":"All!AN309","v":0},{"$f":"All!AO309","v":0},{"$f":"All!AP309","v":0},{"$f":"All!AQ309","v":0},{"$f":"All!AR309","v":0},{"$f":"All!AS309","v":0},{"$f":"All!AT309","v":0}]
[null,{"$f":"All!B310","v":"4"},{"$f":"All!C310","v":"4.6"},{"$f":"All!D310","v":"4.6.1"},{"$f":"All!E310","v":"4.6.1: Providers should establish a risk management framework for identifying, assessing and controlling risks"},{"$f":"All!F310","v":"4.6.1.1"},{"$f":"All!G310","v":"4.6.1.1: MOBILE MONEY RISK MANAGEMENT GOVERNANCE\nA mobile money risk management policy should be documented that defines the framework for mobile money risk management, including scope, process, governance and organization. The framework should be focused on mobile money risks, which are distinct from the usual mobile operator risks.\n\nA Risk Manager should be appointed as the single point of contact with responsibility for mobile money risk management.  This need not be a dedicated role and the individual could have other responsibilities.\n\nIf the provider has an enterprise risk management function, the mobile money Risk Manager should inform that team of the key mobile money risks.\n\nNote: GSMA has published a separate Risk Management Toolkit, which has examples of the risk management process and mobile money risks and controls."},{"$f":"All!H310","v":"ISO 27005:2018 Sec. 7.1"},{"$f":"All!I310","v":"4.6.1.1.1"},{"$f":"All!J310","v":"4.6.1.1.1: Has a mobile money risk management framework been documented that defines the mobile money risk management scope, process, governance and organization?\n"},{"$f":"All!K310","v":"1) Risk management framework, process or similar document\n- Check that the process has been documented\n- Check that it defines the framework for mobile money risk management, including:\na) Scope\nb) Process \nc) Governance\nd) Organization"},{"$f":"All!L310","v":0},{"$f":"All!M310","v":"Standard Required"},{"$f":"All!N310","v":"Required"},{"$f":"All!O310","v":"FraudRisk"},{"$f":"All!P310","v":0},{"$f":"All!Q310","v":0},{"$f":"All!R310","v":0},{"$f":"All!S310","v":0},{"$f":"All!T310","v":0},{"$f":"All!U310","v":0},{"$f":"All!V310","v":0},{"$f":"All!W310","v":0},{"$f":"All!X310","v":0},{"$f":"All!Y310","v":0},{"$f":"All!Z310","v":0},{"$f":"All!AA310","v":0},{"$f":"All!AB310","v":0},{"$f":"All!AC310","v":0},{"$f":"All!AD310","v":0},{"$f":"All!AE310","v":0},{"$f":"All!AF310","v":0},{"$f":"All!AG310","v":0},{"$f":"All!AH310","v":0},{"$f":"All!AI310","v":0},{"$f":"All!AJ310","v":0},{"$f":"All!AK310","v":0},{"$f":"All!AL310","v":0},{"$f":"All!AM310","v":0},{"$f":"All!AN310","v":0},{"$f":"All!AO310","v":0},{"$f":"All!AP310","v":0},{"$f":"All!AQ310","v":0},{"$f":"All!AR310","v":0},{"$f":"All!AS310","v":0},{"$f":"All!AT310","v":0}]
[null,{"$f":"All!B311","v":"4"},{"$f":"All!C311","v":"4.6"},{"$f":"All!D311","v":"4.6.1"},{"$f":"All!E311","v":0},{"$f":"All!F311","v":"4.6.1.1"},{"$f":"All!G311","v":0},{"$f":"All!H311","v":0},{"$f":"All!I311","v":"4.6.1.1.2"},{"$f":"All!J311","v":"4.6.1.1.2: Has an individual been appointed with responsibility for mobile money risk management?\n"},{"$f":"All!K311","v":"1) Risk management organization chart and/or risk manager job description\n- Check that an individual been appointed with responsibility for mobile money risk management, to be the single point of contact. "},{"$f":"All!L311","v":0},{"$f":"All!M311","v":"Standard Required"},{"$f":"All!N311","v":"Required"},{"$f":"All!O311","v":"FraudRisk"},{"$f":"All!P311","v":0},{"$f":"All!Q311","v":0},{"$f":"All!R311","v":0},{"$f":"All!S311","v":0},{"$f":"All!T311","v":0},{"$f":"All!U311","v":0},{"$f":"All!V311","v":0},{"$f":"All!W311","v":0},{"$f":"All!X311","v":0},{"$f":"All!Y311","v":0},{"$f":"All!Z311","v":0},{"$f":"All!AA311","v":0},{"$f":"All!AB311","v":0},{"$f":"All!AC311","v":0},{"$f":"All!AD311","v":0},{"$f":"All!AE311","v":0},{"$f":"All!AF311","v":0},{"$f":"All!AG311","v":0},{"$f":"All!AH311","v":0},{"$f":"All!AI311","v":0},{"$f":"All!AJ311","v":0},{"$f":"All!AK311","v":0},{"$f":"All!AL311","v":0},{"$f":"All!AM311","v":0},{"$f":"All!AN311","v":0},{"$f":"All!AO311","v":0},{"$f":"All!AP311","v":0},{"$f":"All!AQ311","v":0},{"$f":"All!AR311","v":0},{"$f":"All!AS311","v":0},{"$f":"All!AT311","v":0}]
[null,{"$f":"All!B312","v":"4"},{"$f":"All!C312","v":"4.6"},{"$f":"All!D312","v":"4.6.1"},{"$f":"All!E312","v":""},{"$f":"All!F312","v":"4.6.1.2"},{"$f":"All!G312","v":"4.6.1.2: RISK ASSESSMENT PROCESS\nRisk assessments should be carried out:\n- Regularly (at least annually);\n- Following a significant change to the mobile money system. \nThe assessment of each risk should be documented in a risk register.\n\nAll types of known risk that could impact the mobile money business should be included, including the following:\n- Fraud risks;\n- ML/ TF risks;\n- Financial risks;\n- Compliance risks;\n- Operational risks; and\n- Strategic risks.\n\nRisk management should be applied to all functions and systems delivering the mobile money service, including agents and other external parties that are part of the delivery of the mobile money service."},{"$f":"All!H312","v":"PCI DSS, ISO 27005:2018 Sec. 8 & 12.1, \nECB RSMP"},{"$f":"All!I312","v":"4.6.1.2.1"},{"$f":"All!J312","v":"4.6.1.2.1: Are risk assessments carried out at least annualy as well as following a significant change to the mobile money service?\n"},{"$f":"All!K312","v":"1) Risk register (extract)\n2) Risk management framework, process or similar document\n- Check a risk assessment has been performed in at least the last year, and following a significant change to the mobile money service.\n- If no significant changes made in the last year, check the process documentation.\nNote: it may not be possible to view the contents of the risk register, as it is sensitive, but is should be possible to view its change log"},{"$f":"All!L312","v":0},{"$f":"All!M312","v":"Urgent Required"},{"$f":"All!N312","v":"Required"},{"$f":"All!O312","v":"FraudRisk"},{"$f":"All!P312","v":0},{"$f":"All!Q312","v":0},{"$f":"All!R312","v":0},{"$f":"All!S312","v":0},{"$f":"All!T312","v":0},{"$f":"All!U312","v":0},{"$f":"All!V312","v":0},{"$f":"All!W312","v":0},{"$f":"All!X312","v":0},{"$f":"All!Y312","v":0},{"$f":"All!Z312","v":0},{"$f":"All!AA312","v":0},{"$f":"All!AB312","v":0},{"$f":"All!AC312","v":0},{"$f":"All!AD312","v":0},{"$f":"All!AE312","v":0},{"$f":"All!AF312","v":0},{"$f":"All!AG312","v":0},{"$f":"All!AH312","v":0},{"$f":"All!AI312","v":0},{"$f":"All!AJ312","v":0},{"$f":"All!AK312","v":0},{"$f":"All!AL312","v":0},{"$f":"All!AM312","v":0},{"$f":"All!AN312","v":0},{"$f":"All!AO312","v":0},{"$f":"All!AP312","v":0},{"$f":"All!AQ312","v":0},{"$f":"All!AR312","v":0},{"$f":"All!AS312","v":0},{"$f":"All!AT312","v":0}]
[null,{"$f":"All!B313","v":"4"},{"$f":"All!C313","v":"4.6"},{"$f":"All!D313","v":"4.6.1"},{"$f":"All!E313","v":""},{"$f":"All!F313","v":"4.6.1.2"},{"$f":"All!G313","v":0},{"$f":"All!H313","v":0},{"$f":"All!I313","v":"4.6.1.2.2"},{"$f":"All!J313","v":"4.6.1.2.2: Are risk assessments documented in a risk register?\n"},{"$f":"All!K313","v":"1) Risk register (extract)\n- Check that there is a documented risk register that has been updated/reviewed in at least the last year. \nNote: it may not be possible to view the contents of the risk register, as it is sensitive, but is should be possible to view a heat map showing number of risks identified and categorized, or similar extract. "},{"$f":"All!L313","v":0},{"$f":"All!M313","v":"Standard Required"},{"$f":"All!N313","v":"Required"},{"$f":"All!O313","v":"FraudRisk"},{"$f":"All!P313","v":0},{"$f":"All!Q313","v":0},{"$f":"All!R313","v":0},{"$f":"All!S313","v":0},{"$f":"All!T313","v":0},{"$f":"All!U313","v":0},{"$f":"All!V313","v":0},{"$f":"All!W313","v":0},{"$f":"All!X313","v":0},{"$f":"All!Y313","v":0},{"$f":"All!Z313","v":0},{"$f":"All!AA313","v":0},{"$f":"All!AB313","v":0},{"$f":"All!AC313","v":0},{"$f":"All!AD313","v":0},{"$f":"All!AE313","v":0},{"$f":"All!AF313","v":0},{"$f":"All!AG313","v":0},{"$f":"All!AH313","v":0},{"$f":"All!AI313","v":0},{"$f":"All!AJ313","v":0},{"$f":"All!AK313","v":0},{"$f":"All!AL313","v":0},{"$f":"All!AM313","v":0},{"$f":"All!AN313","v":0},{"$f":"All!AO313","v":0},{"$f":"All!AP313","v":0},{"$f":"All!AQ313","v":0},{"$f":"All!AR313","v":0},{"$f":"All!AS313","v":0},{"$f":"All!AT313","v":0}]
[null,{"$f":"All!B314","v":"4"},{"$f":"All!C314","v":"4.6"},{"$f":"All!D314","v":"4.6.1"},{"$f":"All!E314","v":""},{"$f":"All!F314","v":"4.6.1.2"},{"$f":"All!G314","v":0},{"$f":"All!H314","v":0},{"$f":"All!I314","v":"4.6.1.2.3"},{"$f":"All!J314","v":"4.6.1.2.3: Are all types of known risk that could impact the mobile money business included in risk assessments, including fraud risks, ML/ TF risks, financial risks, compliance risks, operational risks, strategic risks, agent risks, 3rd party risks?\n"},{"$f":"All!K314","v":"1) Risk management process or framework\n- Check there are suitable / sufficient categories including, for example\na) Fraud\nb) ML/CFT\nc) Financial\nd) Compliance\ne) Operational and strategic risks\nf) Agent and 3rd party risks\n"},{"$f":"All!L314","v":0},{"$f":"All!M314","v":"Standard Required"},{"$f":"All!N314","v":"Required"},{"$f":"All!O314","v":"FraudRisk"},{"$f":"All!P314","v":0},{"$f":"All!Q314","v":0},{"$f":"All!R314","v":0},{"$f":"All!S314","v":0},{"$f":"All!T314","v":0},{"$f":"All!U314","v":0},{"$f":"All!V314","v":0},{"$f":"All!W314","v":0},{"$f":"All!X314","v":0},{"$f":"All!Y314","v":0},{"$f":"All!Z314","v":0},{"$f":"All!AA314","v":0},{"$f":"All!AB314","v":0},{"$f":"All!AC314","v":0},{"$f":"All!AD314","v":0},{"$f":"All!AE314","v":0},{"$f":"All!AF314","v":0},{"$f":"All!AG314","v":0},{"$f":"All!AH314","v":0},{"$f":"All!AI314","v":0},{"$f":"All!AJ314","v":0},{"$f":"All!AK314","v":0},{"$f":"All!AL314","v":0},{"$f":"All!AM314","v":0},{"$f":"All!AN314","v":0},{"$f":"All!AO314","v":0},{"$f":"All!AP314","v":0},{"$f":"All!AQ314","v":0},{"$f":"All!AR314","v":0},{"$f":"All!AS314","v":0},{"$f":"All!AT314","v":0}]
[null,{"$f":"All!B315","v":"4"},{"$f":"All!C315","v":"4.6"},{"$f":"All!D315","v":"4.6.1"},{"$f":"All!E315","v":""},{"$f":"All!F315","v":"4.6.1.3"},{"$f":"All!G315","v":"4.6.1.3: RISK IDENTIFICATION AND EVALUATION \nEach risk assessment should identify new risks and evaluate their severity. It should also re-evaluate risks that were reviewed in the previous risk assessment. This information can be used to prioritize the application of resources to address these risks.\n\nAn owner should be assigned to each risk, which is usually the relevant functional manager.\n\nThe severity of each risk should be assessed. Usually, this is calculated using a formula combining risk impact and likelihood:\n- Impact - the impact that the risk would have if it materialized;\n- Likelihood - the probability (or frequency) that the risk will materialize.\nThe impact and likelihood scores should take into account the existing controls that are in place to mitigate the risk (net risk). Additionally, if desired, scoring can be done on the assumption of no controls (gross risk).\n\nOne way to measure severity is to assign a score (e.g. 1-5) to Impact and to Likelihood and to multiply these values together to give a combined score for Severity (1-25).\n\nExamples of types of impact that should be considered include:\n- Financial loss for the provider or customers;\n- Reputation / brand damage;\n- Non-compliance with regulatory requirements; and\n- Operational impact on the mobile money business."},{"$f":"All!H315","v":"ISO 27005:2018 Sec. 7 & 7.2.3"},{"$f":"All!I315","v":"4.6.1.3.1"},{"$f":"All!J315","v":"4.6.1.3.1: Do risk assessments identify and evaluate new risks that have emerged since the previous risk assessment?\n"},{"$f":"All!K315","v":0},{"$f":"All!L315","v":0},{"$f":"All!M315","v":"Recommended"},{"$f":"All!N315","v":"Recommended"},{"$f":"All!O315","v":"FraudRisk"},{"$f":"All!P315","v":0},{"$f":"All!Q315","v":0},{"$f":"All!R315","v":0},{"$f":"All!S315","v":0},{"$f":"All!T315","v":0},{"$f":"All!U315","v":0},{"$f":"All!V315","v":0},{"$f":"All!W315","v":0},{"$f":"All!X315","v":0},{"$f":"All!Y315","v":0},{"$f":"All!Z315","v":0},{"$f":"All!AA315","v":0},{"$f":"All!AB315","v":0},{"$f":"All!AC315","v":0},{"$f":"All!AD315","v":0},{"$f":"All!AE315","v":0},{"$f":"All!AF315","v":0},{"$f":"All!AG315","v":0},{"$f":"All!AH315","v":0},{"$f":"All!AI315","v":0},{"$f":"All!AJ315","v":0},{"$f":"All!AK315","v":0},{"$f":"All!AL315","v":0},{"$f":"All!AM315","v":0},{"$f":"All!AN315","v":0},{"$f":"All!AO315","v":0},{"$f":"All!AP315","v":0},{"$f":"All!AQ315","v":0},{"$f":"All!AR315","v":0},{"$f":"All!AS315","v":0},{"$f":"All!AT315","v":0}]
[null,{"$f":"All!B316","v":"4"},{"$f":"All!C316","v":"4.6"},{"$f":"All!D316","v":"4.6.1"},{"$f":"All!E316","v":""},{"$f":"All!F316","v":"4.6.1.3"},{"$f":"All!G316","v":0},{"$f":"All!H316","v":0},{"$f":"All!I316","v":"4.6.1.3.2"},{"$f":"All!J316","v":"4.6.1.3.2: Do risk assessments re-evaluate risks that were reviewed in the previous risk assessment?\n"},{"$f":"All!K316","v":0},{"$f":"All!L316","v":0},{"$f":"All!M316","v":"Recommended"},{"$f":"All!N316","v":"Recommended"},{"$f":"All!O316","v":"FraudRisk"},{"$f":"All!P316","v":0},{"$f":"All!Q316","v":0},{"$f":"All!R316","v":0},{"$f":"All!S316","v":0},{"$f":"All!T316","v":0},{"$f":"All!U316","v":0},{"$f":"All!V316","v":0},{"$f":"All!W316","v":0},{"$f":"All!X316","v":0},{"$f":"All!Y316","v":0},{"$f":"All!Z316","v":0},{"$f":"All!AA316","v":0},{"$f":"All!AB316","v":0},{"$f":"All!AC316","v":0},{"$f":"All!AD316","v":0},{"$f":"All!AE316","v":0},{"$f":"All!AF316","v":0},{"$f":"All!AG316","v":0},{"$f":"All!AH316","v":0},{"$f":"All!AI316","v":0},{"$f":"All!AJ316","v":0},{"$f":"All!AK316","v":0},{"$f":"All!AL316","v":0},{"$f":"All!AM316","v":0},{"$f":"All!AN316","v":0},{"$f":"All!AO316","v":0},{"$f":"All!AP316","v":0},{"$f":"All!AQ316","v":0},{"$f":"All!AR316","v":0},{"$f":"All!AS316","v":0},{"$f":"All!AT316","v":0}]
[null,{"$f":"All!B317","v":"4"},{"$f":"All!C317","v":"4.6"},{"$f":"All!D317","v":"4.6.1"},{"$f":"All!E317","v":""},{"$f":"All!F317","v":"4.6.1.3"},{"$f":"All!G317","v":0},{"$f":"All!H317","v":0},{"$f":"All!I317","v":"4.6.1.3.3"},{"$f":"All!J317","v":"4.6.1.3.3: Is an owner assigned to each risk (e.g. the relevant functional manager)?\n"},{"$f":"All!K317","v":"1) Risk register (extract)\n2) Risk management framework, process or similar document\n- Check that all risks in the register have an owner assigned from the relevant functional department."},{"$f":"All!L317","v":0},{"$f":"All!M317","v":"Standard Required"},{"$f":"All!N317","v":"Required"},{"$f":"All!O317","v":"FraudRisk"},{"$f":"All!P317","v":0},{"$f":"All!Q317","v":0},{"$f":"All!R317","v":0},{"$f":"All!S317","v":0},{"$f":"All!T317","v":0},{"$f":"All!U317","v":0},{"$f":"All!V317","v":0},{"$f":"All!W317","v":0},{"$f":"All!X317","v":0},{"$f":"All!Y317","v":0},{"$f":"All!Z317","v":0},{"$f":"All!AA317","v":0},{"$f":"All!AB317","v":0},{"$f":"All!AC317","v":0},{"$f":"All!AD317","v":0},{"$f":"All!AE317","v":0},{"$f":"All!AF317","v":0},{"$f":"All!AG317","v":0},{"$f":"All!AH317","v":0},{"$f":"All!AI317","v":0},{"$f":"All!AJ317","v":0},{"$f":"All!AK317","v":0},{"$f":"All!AL317","v":0},{"$f":"All!AM317","v":0},{"$f":"All!AN317","v":0},{"$f":"All!AO317","v":0},{"$f":"All!AP317","v":0},{"$f":"All!AQ317","v":0},{"$f":"All!AR317","v":0},{"$f":"All!AS317","v":0},{"$f":"All!AT317","v":0}]
[null,{"$f":"All!B318","v":"4"},{"$f":"All!C318","v":"4.6"},{"$f":"All!D318","v":"4.6.1"},{"$f":"All!E318","v":""},{"$f":"All!F318","v":"4.6.1.3"},{"$f":"All!G318","v":0},{"$f":"All!H318","v":0},{"$f":"All!I318","v":"4.6.1.3.4"},{"$f":"All!J318","v":"4.6.1.3.4: Is the severity of each risk assessed by considering the impact and likelihood of the risk occurring, taking into account the controls that are in place to mitigate the risk?\n"},{"$f":"All!K318","v":"1) Risk register (extract)\n2) Risk management framework, process or similar document\n- Check that all risks in the register have a severity rating assigned."},{"$f":"All!L318","v":0},{"$f":"All!M318","v":"Standard Required"},{"$f":"All!N318","v":"Required"},{"$f":"All!O318","v":"FraudRisk"},{"$f":"All!P318","v":0},{"$f":"All!Q318","v":0},{"$f":"All!R318","v":0},{"$f":"All!S318","v":0},{"$f":"All!T318","v":0},{"$f":"All!U318","v":0},{"$f":"All!V318","v":0},{"$f":"All!W318","v":0},{"$f":"All!X318","v":0},{"$f":"All!Y318","v":0},{"$f":"All!Z318","v":0},{"$f":"All!AA318","v":0},{"$f":"All!AB318","v":0},{"$f":"All!AC318","v":0},{"$f":"All!AD318","v":0},{"$f":"All!AE318","v":0},{"$f":"All!AF318","v":0},{"$f":"All!AG318","v":0},{"$f":"All!AH318","v":0},{"$f":"All!AI318","v":0},{"$f":"All!AJ318","v":0},{"$f":"All!AK318","v":0},{"$f":"All!AL318","v":0},{"$f":"All!AM318","v":0},{"$f":"All!AN318","v":0},{"$f":"All!AO318","v":0},{"$f":"All!AP318","v":0},{"$f":"All!AQ318","v":0},{"$f":"All!AR318","v":0},{"$f":"All!AS318","v":0},{"$f":"All!AT318","v":0}]
[null,{"$f":"All!B319","v":"4"},{"$f":"All!C319","v":"4.6"},{"$f":"All!D319","v":"4.6.1"},{"$f":"All!E319","v":""},{"$f":"All!F319","v":"4.6.1.4"},{"$f":"All!G319","v":"4.6.1.4: RISK ACTIONS\nThe risk management process should identify actions to be taken to manage each risk. Actions include:\n- treat (apply additional controls);\n- tolerate (accept the level of risk);\n- transfer (pass the risk onto another party - e.g. insurance); or\n- terminate (cease the business activity that has the risk).\n\nThe usual course of action is to implement improved controls to improve the risk severity score to an acceptable level. Controls reduce the severity of the risk by reducing the impact and/or likelihood.\n\nActions should be assigned to the owners of the risks, which are usually the functional managers and not the Risk Manager."},{"$f":"All!H319","v":"ISO 27005:2018 Sec. 9"},{"$f":"All!I319","v":"4.6.1.4.1"},{"$f":"All!J319","v":"4.6.1.4.1: Does the risk management process identify actions to be taken to manage each risk, such as improving controls where necessary (i.e. treat / tolerate / transfer / terminate)?\n"},{"$f":"All!K319","v":"1) Risk register (extract)\n2) Risk management framework, process or similar document\n- Check the risk management process has actions identified for each risk,  (e.g. treat / tolerate / transfer / terminate), with a responsible party for each action."},{"$f":"All!L319","v":0},{"$f":"All!M319","v":"Standard Required"},{"$f":"All!N319","v":"Required"},{"$f":"All!O319","v":"FraudRisk"},{"$f":"All!P319","v":0},{"$f":"All!Q319","v":0},{"$f":"All!R319","v":0},{"$f":"All!S319","v":0},{"$f":"All!T319","v":0},{"$f":"All!U319","v":0},{"$f":"All!V319","v":0},{"$f":"All!W319","v":0},{"$f":"All!X319","v":0},{"$f":"All!Y319","v":0},{"$f":"All!Z319","v":0},{"$f":"All!AA319","v":0},{"$f":"All!AB319","v":0},{"$f":"All!AC319","v":0},{"$f":"All!AD319","v":0},{"$f":"All!AE319","v":0},{"$f":"All!AF319","v":0},{"$f":"All!AG319","v":0},{"$f":"All!AH319","v":0},{"$f":"All!AI319","v":0},{"$f":"All!AJ319","v":0},{"$f":"All!AK319","v":0},{"$f":"All!AL319","v":0},{"$f":"All!AM319","v":0},{"$f":"All!AN319","v":0},{"$f":"All!AO319","v":0},{"$f":"All!AP319","v":0},{"$f":"All!AQ319","v":0},{"$f":"All!AR319","v":0},{"$f":"All!AS319","v":0},{"$f":"All!AT319","v":0}]
[null,{"$f":"All!B320","v":"4"},{"$f":"All!C320","v":"4.6"},{"$f":"All!D320","v":"4.6.1"},{"$f":"All!E320","v":""},{"$f":"All!F320","v":"4.6.1.5"},{"$f":"All!G320","v":"4.6.1.5: RISK ACCEPTANCE \nRisks cannot, in general, be reduced to zero. This means that the provider should make a formal decision to tolerate certain levels of risk. This requires acceptance of the risk at the appropriate level of management, with the justification documented.\n\nRisk acceptance criteria should be set to help determine when to accept risks. Typically, a maximum target level of risk should be set. Exceptions may be allowed under certain circumstances. For example:\n- Provisions may be included for senior managers to accept risks above the maximum level under defined circumstances;\n- Higher risks may be accepted by comparing estimated profit (or other business benefit) to the cost of controlling the risk;\n- Higher risks may be accepted temporarily pending controls to be implemented within a defined time period.\n\nNOTE: A lower threshold of risk acceptability may be established for compliance risks.\n"},{"$f":"All!H320","v":"ISO 27005:2011 Sec. 7.2.4, Sec. 10"},{"$f":"All!I320","v":"4.6.1.5.1"},{"$f":"All!J320","v":"4.6.1.5.1: Has the decision to tolerate certain levels of risk been signed off at the appropriate level of management?\n"},{"$f":"All!K320","v":0},{"$f":"All!L320","v":0},{"$f":"All!M320","v":"Recommended"},{"$f":"All!N320","v":"Recommended"},{"$f":"All!O320","v":"FraudRisk"},{"$f":"All!P320","v":0},{"$f":"All!Q320","v":0},{"$f":"All!R320","v":0},{"$f":"All!S320","v":0},{"$f":"All!T320","v":0},{"$f":"All!U320","v":0},{"$f":"All!V320","v":0},{"$f":"All!W320","v":0},{"$f":"All!X320","v":0},{"$f":"All!Y320","v":0},{"$f":"All!Z320","v":0},{"$f":"All!AA320","v":0},{"$f":"All!AB320","v":0},{"$f":"All!AC320","v":0},{"$f":"All!AD320","v":0},{"$f":"All!AE320","v":0},{"$f":"All!AF320","v":0},{"$f":"All!AG320","v":0},{"$f":"All!AH320","v":0},{"$f":"All!AI320","v":0},{"$f":"All!AJ320","v":0},{"$f":"All!AK320","v":0},{"$f":"All!AL320","v":0},{"$f":"All!AM320","v":0},{"$f":"All!AN320","v":0},{"$f":"All!AO320","v":0},{"$f":"All!AP320","v":0},{"$f":"All!AQ320","v":0},{"$f":"All!AR320","v":0},{"$f":"All!AS320","v":0},{"$f":"All!AT320","v":0}]
[null,{"$f":"All!B321","v":"4"},{"$f":"All!C321","v":"4.6"},{"$f":"All!D321","v":"4.6.1"},{"$f":"All!E321","v":""},{"$f":"All!F321","v":"4.6.1.5"},{"$f":"All!G321","v":0},{"$f":"All!H321","v":0},{"$f":"All!I321","v":"4.6.1.5.2"},{"$f":"All!J321","v":"4.6.1.5.2: Have risk acceptance criteria been defined to help determine when to accept risks and to establish maximum target levels of risk?\n"},{"$f":"All!K321","v":0},{"$f":"All!L321","v":0},{"$f":"All!M321","v":"Recommended"},{"$f":"All!N321","v":"Recommended"},{"$f":"All!O321","v":"FraudRisk"},{"$f":"All!P321","v":0},{"$f":"All!Q321","v":0},{"$f":"All!R321","v":0},{"$f":"All!S321","v":0},{"$f":"All!T321","v":0},{"$f":"All!U321","v":0},{"$f":"All!V321","v":0},{"$f":"All!W321","v":0},{"$f":"All!X321","v":0},{"$f":"All!Y321","v":0},{"$f":"All!Z321","v":0},{"$f":"All!AA321","v":0},{"$f":"All!AB321","v":0},{"$f":"All!AC321","v":0},{"$f":"All!AD321","v":0},{"$f":"All!AE321","v":0},{"$f":"All!AF321","v":0},{"$f":"All!AG321","v":0},{"$f":"All!AH321","v":0},{"$f":"All!AI321","v":0},{"$f":"All!AJ321","v":0},{"$f":"All!AK321","v":0},{"$f":"All!AL321","v":0},{"$f":"All!AM321","v":0},{"$f":"All!AN321","v":0},{"$f":"All!AO321","v":0},{"$f":"All!AP321","v":0},{"$f":"All!AQ321","v":0},{"$f":"All!AR321","v":0},{"$f":"All!AS321","v":0},{"$f":"All!AT321","v":0}]
[null,{"$f":"All!B322","v":"4"},{"$f":"All!C322","v":"4.6"},{"$f":"All!D322","v":"4.6.1"},{"$f":"All!E322","v":""},{"$f":"All!F322","v":"4.6.1.5"},{"$f":"All!G322","v":0},{"$f":"All!H322","v":0},{"$f":"All!I322","v":"4.6.1.5.3"},{"$f":"All!J322","v":"4.6.1.5.3: Do risk acceptance criteria allow exceptions, such as higher risks being approved by senior management or higher risks being accepted temporarily pending planned implementation of controls?\n"},{"$f":"All!K322","v":0},{"$f":"All!L322","v":0},{"$f":"All!M322","v":"Recommended"},{"$f":"All!N322","v":"Recommended"},{"$f":"All!O322","v":"FraudRisk"},{"$f":"All!P322","v":0},{"$f":"All!Q322","v":0},{"$f":"All!R322","v":0},{"$f":"All!S322","v":0},{"$f":"All!T322","v":0},{"$f":"All!U322","v":0},{"$f":"All!V322","v":0},{"$f":"All!W322","v":0},{"$f":"All!X322","v":0},{"$f":"All!Y322","v":0},{"$f":"All!Z322","v":0},{"$f":"All!AA322","v":0},{"$f":"All!AB322","v":0},{"$f":"All!AC322","v":0},{"$f":"All!AD322","v":0},{"$f":"All!AE322","v":0},{"$f":"All!AF322","v":0},{"$f":"All!AG322","v":0},{"$f":"All!AH322","v":0},{"$f":"All!AI322","v":0},{"$f":"All!AJ322","v":0},{"$f":"All!AK322","v":0},{"$f":"All!AL322","v":0},{"$f":"All!AM322","v":0},{"$f":"All!AN322","v":0},{"$f":"All!AO322","v":0},{"$f":"All!AP322","v":0},{"$f":"All!AQ322","v":0},{"$f":"All!AR322","v":0},{"$f":"All!AS322","v":0},{"$f":"All!AT322","v":0}]
[null,{"$f":"All!B323","v":"4"},{"$f":"All!C323","v":"4.6"},{"$f":"All!D323","v":"4.6.1"},{"$f":"All!E323","v":""},{"$f":"All!F323","v":"4.6.1.5"},{"$f":"All!G323","v":0},{"$f":"All!H323","v":0},{"$f":"All!I323","v":"4.6.1.5.4"},{"$f":"All!J323","v":"4.6.1.5.4: Do compliance risks have a lower threshold of risk acceptability?\n"},{"$f":"All!K323","v":0},{"$f":"All!L323","v":0},{"$f":"All!M323","v":"Recommended"},{"$f":"All!N323","v":"Recommended"},{"$f":"All!O323","v":"FraudRisk"},{"$f":"All!P323","v":0},{"$f":"All!Q323","v":0},{"$f":"All!R323","v":0},{"$f":"All!S323","v":0},{"$f":"All!T323","v":0},{"$f":"All!U323","v":0},{"$f":"All!V323","v":0},{"$f":"All!W323","v":0},{"$f":"All!X323","v":0},{"$f":"All!Y323","v":0},{"$f":"All!Z323","v":0},{"$f":"All!AA323","v":0},{"$f":"All!AB323","v":0},{"$f":"All!AC323","v":0},{"$f":"All!AD323","v":0},{"$f":"All!AE323","v":0},{"$f":"All!AF323","v":0},{"$f":"All!AG323","v":0},{"$f":"All!AH323","v":0},{"$f":"All!AI323","v":0},{"$f":"All!AJ323","v":0},{"$f":"All!AK323","v":0},{"$f":"All!AL323","v":0},{"$f":"All!AM323","v":0},{"$f":"All!AN323","v":0},{"$f":"All!AO323","v":0},{"$f":"All!AP323","v":0},{"$f":"All!AQ323","v":0},{"$f":"All!AR323","v":0},{"$f":"All!AS323","v":0},{"$f":"All!AT323","v":0}]
[null,{"$f":"All!B324","v":"4"},{"$f":"All!C324","v":"4.6"},{"$f":"All!D324","v":"4.6.1"},{"$f":"All!E324","v":""},{"$f":"All!F324","v":"4.6.1.6"},{"$f":"All!G324","v":"4.6.1.6: RISK COMMUNICATION AND MONITORING\nThe risk register should be communicated to risk owners and the head of mobile money at least every 12 months. High-severity risks should be highlighted to senior management.\n\nRisk owners should be informed of the required actions for implementing further controls, and these actions should be monitored by the Risk Manager to ensure that they are implemented.\n\nRegular reporting should be implemented to track Key Risk Indicators (KRIs) which will show whether risks are materializing. KRIs fall into two categories:\n - Leading indicators, which give an indication of risks that may be about to materialize;\n - Lagging indicators, which report on risks that are already starting to materialize.\n"},{"$f":"All!H324","v":"ISO 27005:2018 Sec. 11"},{"$f":"All!I324","v":"4.6.1.6.1"},{"$f":"All!J324","v":"4.6.1.6.1: Is the risk register been communicated to risk owners, the head of mobile money and senior management at least every 12 months?\n"},{"$f":"All!K324","v":"1) Risk management process \n-  Check that in the last 12 months the risk register has been communicated to risk owners, the head of mobile money and senior management (including the board risk committee or similar governance entity). "},{"$f":"All!L324","v":0},{"$f":"All!M324","v":"Standard Required"},{"$f":"All!N324","v":"Required"},{"$f":"All!O324","v":"FraudRisk"},{"$f":"All!P324","v":0},{"$f":"All!Q324","v":0},{"$f":"All!R324","v":0},{"$f":"All!S324","v":0},{"$f":"All!T324","v":0},{"$f":"All!U324","v":0},{"$f":"All!V324","v":0},{"$f":"All!W324","v":0},{"$f":"All!X324","v":0},{"$f":"All!Y324","v":0},{"$f":"All!Z324","v":0},{"$f":"All!AA324","v":0},{"$f":"All!AB324","v":0},{"$f":"All!AC324","v":0},{"$f":"All!AD324","v":0},{"$f":"All!AE324","v":0},{"$f":"All!AF324","v":0},{"$f":"All!AG324","v":0},{"$f":"All!AH324","v":0},{"$f":"All!AI324","v":0},{"$f":"All!AJ324","v":0},{"$f":"All!AK324","v":0},{"$f":"All!AL324","v":0},{"$f":"All!AM324","v":0},{"$f":"All!AN324","v":0},{"$f":"All!AO324","v":0},{"$f":"All!AP324","v":0},{"$f":"All!AQ324","v":0},{"$f":"All!AR324","v":0},{"$f":"All!AS324","v":0},{"$f":"All!AT324","v":0}]
[null,{"$f":"All!B325","v":"4"},{"$f":"All!C325","v":"4.6"},{"$f":"All!D325","v":"4.6.1"},{"$f":"All!E325","v":""},{"$f":"All!F325","v":"4.6.1.6"},{"$f":"All!G325","v":0},{"$f":"All!H325","v":0},{"$f":"All!I325","v":"4.6.1.6.2"},{"$f":"All!J325","v":"4.6.1.6.2: Are the required actions for implementing further controls monitored by the Risk Manager to ensure that they are implemented by the risk owners?\n"},{"$f":"All!K325","v":0},{"$f":"All!L325","v":0},{"$f":"All!M325","v":"Recommended"},{"$f":"All!N325","v":"Recommended"},{"$f":"All!O325","v":"FraudRisk"},{"$f":"All!P325","v":0},{"$f":"All!Q325","v":0},{"$f":"All!R325","v":0},{"$f":"All!S325","v":0},{"$f":"All!T325","v":0},{"$f":"All!U325","v":0},{"$f":"All!V325","v":0},{"$f":"All!W325","v":0},{"$f":"All!X325","v":0},{"$f":"All!Y325","v":0},{"$f":"All!Z325","v":0},{"$f":"All!AA325","v":0},{"$f":"All!AB325","v":0},{"$f":"All!AC325","v":0},{"$f":"All!AD325","v":0},{"$f":"All!AE325","v":0},{"$f":"All!AF325","v":0},{"$f":"All!AG325","v":0},{"$f":"All!AH325","v":0},{"$f":"All!AI325","v":0},{"$f":"All!AJ325","v":0},{"$f":"All!AK325","v":0},{"$f":"All!AL325","v":0},{"$f":"All!AM325","v":0},{"$f":"All!AN325","v":0},{"$f":"All!AO325","v":0},{"$f":"All!AP325","v":0},{"$f":"All!AQ325","v":0},{"$f":"All!AR325","v":0},{"$f":"All!AS325","v":0},{"$f":"All!AT325","v":0}]
[null,{"$f":"All!B326","v":"4"},{"$f":"All!C326","v":"4.6"},{"$f":"All!D326","v":"4.6.1"},{"$f":"All!E326","v":0},{"$f":"All!F326","v":"4.6.1.6"},{"$f":"All!G326","v":0},{"$f":"All!H326","v":0},{"$f":"All!I326","v":"4.6.1.6.3"},{"$f":"All!J326","v":"4.6.1.6.3: Has regular reporting been implemented to track Key Risk Indicators (KRIs), showing risks that may be about to materialize or which have started to materialize?\n"},{"$f":"All!K326","v":0},{"$f":"All!L326","v":0},{"$f":"All!M326","v":"Recommended"},{"$f":"All!N326","v":"Recommended"},{"$f":"All!O326","v":"FraudRisk"},{"$f":"All!P326","v":0},{"$f":"All!Q326","v":0},{"$f":"All!R326","v":0},{"$f":"All!S326","v":0},{"$f":"All!T326","v":0},{"$f":"All!U326","v":0},{"$f":"All!V326","v":0},{"$f":"All!W326","v":0},{"$f":"All!X326","v":0},{"$f":"All!Y326","v":0},{"$f":"All!Z326","v":0},{"$f":"All!AA326","v":0},{"$f":"All!AB326","v":0},{"$f":"All!AC326","v":0},{"$f":"All!AD326","v":0},{"$f":"All!AE326","v":0},{"$f":"All!AF326","v":0},{"$f":"All!AG326","v":0},{"$f":"All!AH326","v":0},{"$f":"All!AI326","v":0},{"$f":"All!AJ326","v":0},{"$f":"All!AK326","v":0},{"$f":"All!AL326","v":0},{"$f":"All!AM326","v":0},{"$f":"All!AN326","v":0},{"$f":"All!AO326","v":0},{"$f":"All!AP326","v":0},{"$f":"All!AQ326","v":0},{"$f":"All!AR326","v":0},{"$f":"All!AS326","v":0},{"$f":"All!AT326","v":0}]
[null,{"$f":"All!B327","v":"4"},{"$f":"All!C327","v":"4.7"},{"$f":"All!D327","v":"4.7.1"},{"$f":"All!E327","v":"4.7.1: Providers shall develop effective business continuity and contingency plans"},{"$f":"All!F327","v":"4.7.1.1"},{"$f":"All!G327","v":"4.7.1.1: BUSINESS CONTINUITY FRAMEWORK\nProviders should define their approach to maintaining continuity of mobile money business functions in the event of major disruptions (such as fire, flood or earthquake). The framework should define the process, roles and responsibilities for managing the Business Continuity Plan (see 4.7.1.3).  This could be documented as part of a mobile operator-wide framework.\n\nBusiness continuity should address all critical mobile money business functions. Special consideration should be given to disaster recovery for the mobile money technical system - see 4.7.1.4.\n\nSomeone with sufficient seniority should be appointed as the single point of contact for business continuity planning, with responsibility for ensuring that all functions set up appropriate business continuity plans and that the plans are co-ordinated. \n\nThe policy should be communicated and made available to senior management, the head of mobile money and all managers. It should be reviewed and updated at least every two years.\n"},{"$f":"All!H327","v":"ISO 22313:2020 Sec. 5.2 & 5.3"},{"$f":"All!I327","v":"4.7.1.1.1"},{"$f":"All!J327","v":"4.7.1.1.1: Is there a business continuity framework that defines the approach to maintaining continuity of mobile money business functions in the event of major disruptions?\n"},{"$f":"All!K327","v":"1) Business Continuity Framework or Process\n-  Check the documentation defines the approach to maintaining continuity of mobile money business operations in the event of disruption\n- Check that the policy/process  has been signed by a current member of senior management in the last 2 years.  "},{"$f":"All!L327","v":0},{"$f":"All!M327","v":"Urgent Required"},{"$f":"All!N327","v":"Required"},{"$f":"All!O327","v":"BizOps"},{"$f":"All!P327","v":0},{"$f":"All!Q327","v":0},{"$f":"All!R327","v":0},{"$f":"All!S327","v":0},{"$f":"All!T327","v":0},{"$f":"All!U327","v":0},{"$f":"All!V327","v":0},{"$f":"All!W327","v":0},{"$f":"All!X327","v":0},{"$f":"All!Y327","v":0},{"$f":"All!Z327","v":0},{"$f":"All!AA327","v":0},{"$f":"All!AB327","v":0},{"$f":"All!AC327","v":0},{"$f":"All!AD327","v":0},{"$f":"All!AE327","v":0},{"$f":"All!AF327","v":0},{"$f":"All!AG327","v":0},{"$f":"All!AH327","v":0},{"$f":"All!AI327","v":0},{"$f":"All!AJ327","v":0},{"$f":"All!AK327","v":0},{"$f":"All!AL327","v":0},{"$f":"All!AM327","v":0},{"$f":"All!AN327","v":0},{"$f":"All!AO327","v":0},{"$f":"All!AP327","v":0},{"$f":"All!AQ327","v":0},{"$f":"All!AR327","v":0},{"$f":"All!AS327","v":0},{"$f":"All!AT327","v":0}]
[null,{"$f":"All!B328","v":"4"},{"$f":"All!C328","v":"4.7"},{"$f":"All!D328","v":"4.7.1"},{"$f":"All!E328","v":""},{"$f":"All!F328","v":"4.7.1.1"},{"$f":"All!G328","v":0},{"$f":"All!H328","v":0},{"$f":"All!I328","v":"4.7.1.1.2"},{"$f":"All!J328","v":"4.7.1.1.2: Does someone with sufficient seniority have overall responsibility and accountability for the business continuity of the mobile money service?\n"},{"$f":"All!K328","v":"1) Business Continuity Process\n-  Check a senior member of management has been allocated direct responsibility for business continuity of the mobile money service"},{"$f":"All!L328","v":0},{"$f":"All!M328","v":"Standard Required"},{"$f":"All!N328","v":"Required"},{"$f":"All!O328","v":"BizOps"},{"$f":"All!P328","v":0},{"$f":"All!Q328","v":0},{"$f":"All!R328","v":0},{"$f":"All!S328","v":0},{"$f":"All!T328","v":0},{"$f":"All!U328","v":0},{"$f":"All!V328","v":0},{"$f":"All!W328","v":0},{"$f":"All!X328","v":0},{"$f":"All!Y328","v":0},{"$f":"All!Z328","v":0},{"$f":"All!AA328","v":0},{"$f":"All!AB328","v":0},{"$f":"All!AC328","v":0},{"$f":"All!AD328","v":0},{"$f":"All!AE328","v":0},{"$f":"All!AF328","v":0},{"$f":"All!AG328","v":0},{"$f":"All!AH328","v":0},{"$f":"All!AI328","v":0},{"$f":"All!AJ328","v":0},{"$f":"All!AK328","v":0},{"$f":"All!AL328","v":0},{"$f":"All!AM328","v":0},{"$f":"All!AN328","v":0},{"$f":"All!AO328","v":0},{"$f":"All!AP328","v":0},{"$f":"All!AQ328","v":0},{"$f":"All!AR328","v":0},{"$f":"All!AS328","v":0},{"$f":"All!AT328","v":0}]
[null,{"$f":"All!B329","v":"4"},{"$f":"All!C329","v":"4.7"},{"$f":"All!D329","v":"4.7.1"},{"$f":"All!E329","v":""},{"$f":"All!F329","v":"4.7.1.1"},{"$f":"All!G329","v":0},{"$f":"All!H329","v":0},{"$f":"All!I329","v":"4.7.1.1.3"},{"$f":"All!J329","v":"4.7.1.1.3: Are roles and responsibilities defined for design and management of Business Continuity?\n"},{"$f":"All!K329","v":0},{"$f":"All!L329","v":0},{"$f":"All!M329","v":"Recommended"},{"$f":"All!N329","v":"Recommended"},{"$f":"All!O329","v":"BizOps"},{"$f":"All!P329","v":0},{"$f":"All!Q329","v":0},{"$f":"All!R329","v":0},{"$f":"All!S329","v":0},{"$f":"All!T329","v":0},{"$f":"All!U329","v":0},{"$f":"All!V329","v":0},{"$f":"All!W329","v":0},{"$f":"All!X329","v":0},{"$f":"All!Y329","v":0},{"$f":"All!Z329","v":0},{"$f":"All!AA329","v":0},{"$f":"All!AB329","v":0},{"$f":"All!AC329","v":0},{"$f":"All!AD329","v":0},{"$f":"All!AE329","v":0},{"$f":"All!AF329","v":0},{"$f":"All!AG329","v":0},{"$f":"All!AH329","v":0},{"$f":"All!AI329","v":0},{"$f":"All!AJ329","v":0},{"$f":"All!AK329","v":0},{"$f":"All!AL329","v":0},{"$f":"All!AM329","v":0},{"$f":"All!AN329","v":0},{"$f":"All!AO329","v":0},{"$f":"All!AP329","v":0},{"$f":"All!AQ329","v":0},{"$f":"All!AR329","v":0},{"$f":"All!AS329","v":0},{"$f":"All!AT329","v":0}]
[null,{"$f":"All!B330","v":"4"},{"$f":"All!C330","v":"4.7"},{"$f":"All!D330","v":"4.7.1"},{"$f":"All!E330","v":""},{"$f":"All!F330","v":"4.7.1.1"},{"$f":"All!G330","v":0},{"$f":"All!H330","v":0},{"$f":"All!I330","v":"4.7.1.1.4"},{"$f":"All!J330","v":"4.7.1.1.4: Is the business continuity framework communicated and made available to senior management, the head of mobile money and all managers?\n"},{"$f":"All!K330","v":0},{"$f":"All!L330","v":0},{"$f":"All!M330","v":"Recommended"},{"$f":"All!N330","v":"Recommended"},{"$f":"All!O330","v":"BizOps"},{"$f":"All!P330","v":0},{"$f":"All!Q330","v":0},{"$f":"All!R330","v":0},{"$f":"All!S330","v":0},{"$f":"All!T330","v":0},{"$f":"All!U330","v":0},{"$f":"All!V330","v":0},{"$f":"All!W330","v":0},{"$f":"All!X330","v":0},{"$f":"All!Y330","v":0},{"$f":"All!Z330","v":0},{"$f":"All!AA330","v":0},{"$f":"All!AB330","v":0},{"$f":"All!AC330","v":0},{"$f":"All!AD330","v":0},{"$f":"All!AE330","v":0},{"$f":"All!AF330","v":0},{"$f":"All!AG330","v":0},{"$f":"All!AH330","v":0},{"$f":"All!AI330","v":0},{"$f":"All!AJ330","v":0},{"$f":"All!AK330","v":0},{"$f":"All!AL330","v":0},{"$f":"All!AM330","v":0},{"$f":"All!AN330","v":0},{"$f":"All!AO330","v":0},{"$f":"All!AP330","v":0},{"$f":"All!AQ330","v":0},{"$f":"All!AR330","v":0},{"$f":"All!AS330","v":0},{"$f":"All!AT330","v":0}]
[null,{"$f":"All!B331","v":"4"},{"$f":"All!C331","v":"4.7"},{"$f":"All!D331","v":"4.7.1"},{"$f":"All!E331","v":""},{"$f":"All!F331","v":"4.7.1.2"},{"$f":"All!G331","v":"4.7.1.2: BUSINESS CONTINUITY RISK ASSESSMENT\nProviders should carry out a business continuity risk assessment as an input into the Business Continuity Plan. \n\nThe risk assessment should include:\n1. Business Impact Analysis (BIA)\n2. Threat evaluation.\n\nThe BIA determines the key business activities that should be maintained in the event of a major disruption. The BIA:\n- identifies key mobile money business activities;\n- sets a recovery objective for each activity (a minimum timeframe for recovery); and\n- identifies dependencies and 3rd party resources for these activities.\n\nThe threat evaluation identifies risks of disruption, such as fire, flood, power failure, staff loss or disruptive incidents. Each threat should be evaluated in terms of its potential impact on business activities in the BIA. This is normally documented in the Business Continuity Plan (see 4.7.1.3)."},{"$f":"All!H331","v":"ISO 22313:2020 Sec. 8.2.2 & 8.2.3"},{"$f":"All!I331","v":"4.7.1.2.1"},{"$f":"All!J331","v":"4.7.1.2.1: Has a business continuity risk assessment been carried out?\n"},{"$f":"All!K331","v":"1) Business Continuity Risk Assessment or Impact Analysis (or similar document)\n- Check that the BIA has been updated in the last year"},{"$f":"All!L331","v":0},{"$f":"All!M331","v":"Standard Required"},{"$f":"All!N331","v":"Required"},{"$f":"All!O331","v":"BizOps"},{"$f":"All!P331","v":0},{"$f":"All!Q331","v":0},{"$f":"All!R331","v":0},{"$f":"All!S331","v":0},{"$f":"All!T331","v":0},{"$f":"All!U331","v":0},{"$f":"All!V331","v":0},{"$f":"All!W331","v":0},{"$f":"All!X331","v":0},{"$f":"All!Y331","v":0},{"$f":"All!Z331","v":0},{"$f":"All!AA331","v":0},{"$f":"All!AB331","v":0},{"$f":"All!AC331","v":0},{"$f":"All!AD331","v":0},{"$f":"All!AE331","v":0},{"$f":"All!AF331","v":0},{"$f":"All!AG331","v":0},{"$f":"All!AH331","v":0},{"$f":"All!AI331","v":0},{"$f":"All!AJ331","v":0},{"$f":"All!AK331","v":0},{"$f":"All!AL331","v":0},{"$f":"All!AM331","v":0},{"$f":"All!AN331","v":0},{"$f":"All!AO331","v":0},{"$f":"All!AP331","v":0},{"$f":"All!AQ331","v":0},{"$f":"All!AR331","v":0},{"$f":"All!AS331","v":0},{"$f":"All!AT331","v":0}]
[null,{"$f":"All!B332","v":"4"},{"$f":"All!C332","v":"4.7"},{"$f":"All!D332","v":"4.7.1"},{"$f":"All!E332","v":""},{"$f":"All!F332","v":"4.7.1.2"},{"$f":"All!G332","v":0},{"$f":"All!H332","v":0},{"$f":"All!I332","v":"4.7.1.2.2"},{"$f":"All!J332","v":"4.7.1.2.2: Does the risk assessment include a Business Impact Analysis (BIA) that determines the key business activities that should be maintained in the event of a major disruption, and the minimum timeframe for recovery of each activity?\n"},{"$f":"All!K332","v":"1) Business Continuity Risk Assessment or Impact Analysis (or similar document)\n- Check the document identifies key business activities that should be maintained in the event of a disruption.\n- Check that the documentation sets the minimum timeframe for recovery of each key business activity."},{"$f":"All!L332","v":0},{"$f":"All!M332","v":"Standard Required"},{"$f":"All!N332","v":"Required"},{"$f":"All!O332","v":"BizOps"},{"$f":"All!P332","v":0},{"$f":"All!Q332","v":0},{"$f":"All!R332","v":0},{"$f":"All!S332","v":0},{"$f":"All!T332","v":0},{"$f":"All!U332","v":0},{"$f":"All!V332","v":0},{"$f":"All!W332","v":0},{"$f":"All!X332","v":0},{"$f":"All!Y332","v":0},{"$f":"All!Z332","v":0},{"$f":"All!AA332","v":0},{"$f":"All!AB332","v":0},{"$f":"All!AC332","v":0},{"$f":"All!AD332","v":0},{"$f":"All!AE332","v":0},{"$f":"All!AF332","v":0},{"$f":"All!AG332","v":0},{"$f":"All!AH332","v":0},{"$f":"All!AI332","v":0},{"$f":"All!AJ332","v":0},{"$f":"All!AK332","v":0},{"$f":"All!AL332","v":0},{"$f":"All!AM332","v":0},{"$f":"All!AN332","v":0},{"$f":"All!AO332","v":0},{"$f":"All!AP332","v":0},{"$f":"All!AQ332","v":0},{"$f":"All!AR332","v":0},{"$f":"All!AS332","v":0},{"$f":"All!AT332","v":0}]
[null,{"$f":"All!B333","v":"4"},{"$f":"All!C333","v":"4.7"},{"$f":"All!D333","v":"4.7.1"},{"$f":"All!E333","v":""},{"$f":"All!F333","v":"4.7.1.2"},{"$f":"All!G333","v":0},{"$f":"All!H333","v":0},{"$f":"All!I333","v":"4.7.1.2.3"},{"$f":"All!J333","v":"4.7.1.2.3: Does the risk assessment include a threat evaluation to identify risks of disruption (such as fire, flood, power failure, staff loss or disruptive incidents), with each threat evaluated in terms of its potential impact on business activities?\n"},{"$f":"All!K333","v":"1) Business Continuity Risk Assessment or Impact Analysis (or similar document)\n- Check the documenation includes a threat evaluation to identify risks of disruption (such as fire, flood, power failure, staff loss or disruptive incidents).\n- Check  each threat has been evaluated in terms of its potential impact on each key mobile money business activity."},{"$f":"All!L333","v":0},{"$f":"All!M333","v":"Standard Required"},{"$f":"All!N333","v":"Required"},{"$f":"All!O333","v":"BizOps"},{"$f":"All!P333","v":0},{"$f":"All!Q333","v":0},{"$f":"All!R333","v":0},{"$f":"All!S333","v":0},{"$f":"All!T333","v":0},{"$f":"All!U333","v":0},{"$f":"All!V333","v":0},{"$f":"All!W333","v":0},{"$f":"All!X333","v":0},{"$f":"All!Y333","v":0},{"$f":"All!Z333","v":0},{"$f":"All!AA333","v":0},{"$f":"All!AB333","v":0},{"$f":"All!AC333","v":0},{"$f":"All!AD333","v":0},{"$f":"All!AE333","v":0},{"$f":"All!AF333","v":0},{"$f":"All!AG333","v":0},{"$f":"All!AH333","v":0},{"$f":"All!AI333","v":0},{"$f":"All!AJ333","v":0},{"$f":"All!AK333","v":0},{"$f":"All!AL333","v":0},{"$f":"All!AM333","v":0},{"$f":"All!AN333","v":0},{"$f":"All!AO333","v":0},{"$f":"All!AP333","v":0},{"$f":"All!AQ333","v":0},{"$f":"All!AR333","v":0},{"$f":"All!AS333","v":0},{"$f":"All!AT333","v":0}]
[null,{"$f":"All!B334","v":"4"},{"$f":"All!C334","v":"4.7"},{"$f":"All!D334","v":"4.7.1"},{"$f":"All!E334","v":""},{"$f":"All!F334","v":"4.7.1.2"},{"$f":"All!G334","v":0},{"$f":"All!H334","v":0},{"$f":"All!I334","v":"4.7.1.2.4"},{"$f":"All!J334","v":"4.7.1.2.4: Does the BIA identify dependencies and 3rd party resources for each key business activity?\n"},{"$f":"All!K334","v":0},{"$f":"All!L334","v":0},{"$f":"All!M334","v":"Recommended"},{"$f":"All!N334","v":"Recommended"},{"$f":"All!O334","v":"BizOps"},{"$f":"All!P334","v":0},{"$f":"All!Q334","v":0},{"$f":"All!R334","v":0},{"$f":"All!S334","v":0},{"$f":"All!T334","v":0},{"$f":"All!U334","v":0},{"$f":"All!V334","v":0},{"$f":"All!W334","v":0},{"$f":"All!X334","v":0},{"$f":"All!Y334","v":0},{"$f":"All!Z334","v":0},{"$f":"All!AA334","v":0},{"$f":"All!AB334","v":0},{"$f":"All!AC334","v":0},{"$f":"All!AD334","v":0},{"$f":"All!AE334","v":0},{"$f":"All!AF334","v":0},{"$f":"All!AG334","v":0},{"$f":"All!AH334","v":0},{"$f":"All!AI334","v":0},{"$f":"All!AJ334","v":0},{"$f":"All!AK334","v":0},{"$f":"All!AL334","v":0},{"$f":"All!AM334","v":0},{"$f":"All!AN334","v":0},{"$f":"All!AO334","v":0},{"$f":"All!AP334","v":0},{"$f":"All!AQ334","v":0},{"$f":"All!AR334","v":0},{"$f":"All!AS334","v":0},{"$f":"All!AT334","v":0}]
[null,{"$f":"All!B335","v":"4"},{"$f":"All!C335","v":"4.7"},{"$f":"All!D335","v":"4.7.1"},{"$f":"All!E335","v":""},{"$f":"All!F335","v":"4.7.1.3"},{"$f":"All!G335","v":"4.7.1.3: BUSINESS CONTINUITY PLAN\nA Business Continuity Plan (BCP) should be documented that defines the responses in the event of a disruptive incident. It should be implemented by all affected business functions, including agents and 3rd parties where relevant. The BCP should be updated regularly and following significant changes to the mobile money business. \n\nThe BCP should identify how each key mobile money activity will be resumed within its recovery objective, considering each threat identified in the business continuity risk assessment. It should also cover potential disruption of outsourced services.\n\nThe BCP should create:\n- an incident response management structure, including resources responsible for responding to the major incident;\n- the procedures for returning to 'business as usual'; and\n- a communications plan to be actioned during a disruptive event.\n\nThe BCP should be:\n- specific – with regard to the immediate steps that should be taken by staff, agents and 3rd parties if an identified threat materialises;\n- flexible – to respond to unanticipated threat scenarios and changing conditions; and\n- focused on the key business activities to be resumed.\n\nThe BCP should consider a range of response options and assign the appropriate response to each activity/risk. Response options include:\n- Activity relocation: re-establish operations at an alternate location;\n- Resource reallocation: resources, including staff, may be transferred from another activity or from a third party; or\n- Alternate processes: using workaround processes temporarily.\n"},{"$f":"All!H335","v":"ISO 22313:2020 Sec. 8.3 & 8.4"},{"$f":"All!I335","v":"4.7.1.3.1"},{"$f":"All!J335","v":"4.7.1.3.1: Has a Business Continuity Plan (BCP) been documented and updated everey two years and following significant changes to the mobile money business?\n"},{"$f":"All!K335","v":"1) Business Continuity Plan (BCP) \n- Check that the business continuity plan is documented \n- Check that the BCP has been updated in the last 24 months\n- Check the BCP has been reviewed and updated following significant changes to the mobile money business. If there have been no major changes, refer to the BCP process / framework."},{"$f":"All!L335","v":0},{"$f":"All!M335","v":"Urgent Required"},{"$f":"All!N335","v":"Required"},{"$f":"All!O335","v":"BizOps"},{"$f":"All!P335","v":0},{"$f":"All!Q335","v":0},{"$f":"All!R335","v":0},{"$f":"All!S335","v":0},{"$f":"All!T335","v":0},{"$f":"All!U335","v":0},{"$f":"All!V335","v":0},{"$f":"All!W335","v":0},{"$f":"All!X335","v":0},{"$f":"All!Y335","v":0},{"$f":"All!Z335","v":0},{"$f":"All!AA335","v":0},{"$f":"All!AB335","v":0},{"$f":"All!AC335","v":0},{"$f":"All!AD335","v":0},{"$f":"All!AE335","v":0},{"$f":"All!AF335","v":0},{"$f":"All!AG335","v":0},{"$f":"All!AH335","v":0},{"$f":"All!AI335","v":0},{"$f":"All!AJ335","v":0},{"$f":"All!AK335","v":0},{"$f":"All!AL335","v":0},{"$f":"All!AM335","v":0},{"$f":"All!AN335","v":0},{"$f":"All!AO335","v":0},{"$f":"All!AP335","v":0},{"$f":"All!AQ335","v":0},{"$f":"All!AR335","v":0},{"$f":"All!AS335","v":0},{"$f":"All!AT335","v":0}]
[null,{"$f":"All!B336","v":"4"},{"$f":"All!C336","v":"4.7"},{"$f":"All!D336","v":"4.7.1"},{"$f":"All!E336","v":""},{"$f":"All!F336","v":"4.7.1.3"},{"$f":"All!G336","v":0},{"$f":"All!H336","v":0},{"$f":"All!I336","v":"4.7.1.3.2"},{"$f":"All!J336","v":"4.7.1.3.2: Has the BCP been implemented by all affected business functions and 3rd parties?\n"},{"$f":"All!K336","v":"1) Business Continuity Plan (BCP) \n- Check the acceptance of the BCP by all business functions and key 3rd parties identified in the BCP. Acceptance should be indicated by signature of the BCP.\n"},{"$f":"All!L336","v":0},{"$f":"All!M336","v":"Standard Required"},{"$f":"All!N336","v":"Required"},{"$f":"All!O336","v":"BizOps"},{"$f":"All!P336","v":0},{"$f":"All!Q336","v":0},{"$f":"All!R336","v":0},{"$f":"All!S336","v":0},{"$f":"All!T336","v":0},{"$f":"All!U336","v":0},{"$f":"All!V336","v":0},{"$f":"All!W336","v":0},{"$f":"All!X336","v":0},{"$f":"All!Y336","v":0},{"$f":"All!Z336","v":0},{"$f":"All!AA336","v":0},{"$f":"All!AB336","v":0},{"$f":"All!AC336","v":0},{"$f":"All!AD336","v":0},{"$f":"All!AE336","v":0},{"$f":"All!AF336","v":0},{"$f":"All!AG336","v":0},{"$f":"All!AH336","v":0},{"$f":"All!AI336","v":0},{"$f":"All!AJ336","v":0},{"$f":"All!AK336","v":0},{"$f":"All!AL336","v":0},{"$f":"All!AM336","v":0},{"$f":"All!AN336","v":0},{"$f":"All!AO336","v":0},{"$f":"All!AP336","v":0},{"$f":"All!AQ336","v":0},{"$f":"All!AR336","v":0},{"$f":"All!AS336","v":0},{"$f":"All!AT336","v":0}]
[null,{"$f":"All!B337","v":"4"},{"$f":"All!C337","v":"4.7"},{"$f":"All!D337","v":"4.7.1"},{"$f":"All!E337","v":""},{"$f":"All!F337","v":"4.7.1.3"},{"$f":"All!G337","v":0},{"$f":"All!H337","v":0},{"$f":"All!I337","v":"4.7.1.3.3"},{"$f":"All!J337","v":"4.7.1.3.3: Does the BCP identify how each key mobile money activity will be resumed within its recovery objective, considering each threat identified in the business continuity risk assessment?\n"},{"$f":"All!K337","v":"1) Business Continuity Plan (BCP)\n- Check the BCP contains processes for how each key mobile money activity will be resumed within its recovery objective.\n- Check the BCP processes identify responses for each threat identified in the business continuity risk assessment."},{"$f":"All!L337","v":0},{"$f":"All!M337","v":"Standard Required"},{"$f":"All!N337","v":"Required"},{"$f":"All!O337","v":"BizOps"},{"$f":"All!P337","v":0},{"$f":"All!Q337","v":0},{"$f":"All!R337","v":0},{"$f":"All!S337","v":0},{"$f":"All!T337","v":0},{"$f":"All!U337","v":0},{"$f":"All!V337","v":0},{"$f":"All!W337","v":0},{"$f":"All!X337","v":0},{"$f":"All!Y337","v":0},{"$f":"All!Z337","v":0},{"$f":"All!AA337","v":0},{"$f":"All!AB337","v":0},{"$f":"All!AC337","v":0},{"$f":"All!AD337","v":0},{"$f":"All!AE337","v":0},{"$f":"All!AF337","v":0},{"$f":"All!AG337","v":0},{"$f":"All!AH337","v":0},{"$f":"All!AI337","v":0},{"$f":"All!AJ337","v":0},{"$f":"All!AK337","v":0},{"$f":"All!AL337","v":0},{"$f":"All!AM337","v":0},{"$f":"All!AN337","v":0},{"$f":"All!AO337","v":0},{"$f":"All!AP337","v":0},{"$f":"All!AQ337","v":0},{"$f":"All!AR337","v":0},{"$f":"All!AS337","v":0},{"$f":"All!AT337","v":0}]
[null,{"$f":"All!B338","v":"4"},{"$f":"All!C338","v":"4.7"},{"$f":"All!D338","v":"4.7.1"},{"$f":"All!E338","v":""},{"$f":"All!F338","v":"4.7.1.3"},{"$f":"All!G338","v":0},{"$f":"All!H338","v":0},{"$f":"All!I338","v":"4.7.1.3.4"},{"$f":"All!J338","v":"4.7.1.3.4: Does the BCP define an incident response management structure, including individual roles responsible for responding to the major incident?\n"},{"$f":"All!K338","v":"1) Business Continuity Plan (BCP) \n- Check the BCP defines an incident response management structure and individual roles responsible for responding to major incidents."},{"$f":"All!L338","v":0},{"$f":"All!M338","v":"Standard Required"},{"$f":"All!N338","v":"Required"},{"$f":"All!O338","v":"BizOps"},{"$f":"All!P338","v":0},{"$f":"All!Q338","v":0},{"$f":"All!R338","v":0},{"$f":"All!S338","v":0},{"$f":"All!T338","v":0},{"$f":"All!U338","v":0},{"$f":"All!V338","v":0},{"$f":"All!W338","v":0},{"$f":"All!X338","v":0},{"$f":"All!Y338","v":0},{"$f":"All!Z338","v":0},{"$f":"All!AA338","v":0},{"$f":"All!AB338","v":0},{"$f":"All!AC338","v":0},{"$f":"All!AD338","v":0},{"$f":"All!AE338","v":0},{"$f":"All!AF338","v":0},{"$f":"All!AG338","v":0},{"$f":"All!AH338","v":0},{"$f":"All!AI338","v":0},{"$f":"All!AJ338","v":0},{"$f":"All!AK338","v":0},{"$f":"All!AL338","v":0},{"$f":"All!AM338","v":0},{"$f":"All!AN338","v":0},{"$f":"All!AO338","v":0},{"$f":"All!AP338","v":0},{"$f":"All!AQ338","v":0},{"$f":"All!AR338","v":0},{"$f":"All!AS338","v":0},{"$f":"All!AT338","v":0}]
[null,{"$f":"All!B339","v":"4"},{"$f":"All!C339","v":"4.7"},{"$f":"All!D339","v":"4.7.1"},{"$f":"All!E339","v":""},{"$f":"All!F339","v":"4.7.1.3"},{"$f":"All!G339","v":0},{"$f":"All!H339","v":0},{"$f":"All!I339","v":"4.7.1.3.5"},{"$f":"All!J339","v":"4.7.1.3.5: Does the BCP define contingency plans for each entity providing material outsourced services and have they accepted the BCP?\n"},{"$f":"All!K339","v":"1) Business Continuity Plan (BCP) \n- Check the acceptance of the BCP by all business functions and key 3rd parties identified in the BCP. Acceptance should be indicated by signature of the BCP.\n\n"},{"$f":"All!L339","v":0},{"$f":"All!M339","v":"Recommended"},{"$f":"All!N339","v":"Recommended"},{"$f":"All!O339","v":"BizOps"},{"$f":"All!P339","v":0},{"$f":"All!Q339","v":0},{"$f":"All!R339","v":0},{"$f":"All!S339","v":0},{"$f":"All!T339","v":0},{"$f":"All!U339","v":0},{"$f":"All!V339","v":0},{"$f":"All!W339","v":0},{"$f":"All!X339","v":0},{"$f":"All!Y339","v":0},{"$f":"All!Z339","v":0},{"$f":"All!AA339","v":0},{"$f":"All!AB339","v":0},{"$f":"All!AC339","v":0},{"$f":"All!AD339","v":0},{"$f":"All!AE339","v":0},{"$f":"All!AF339","v":0},{"$f":"All!AG339","v":0},{"$f":"All!AH339","v":0},{"$f":"All!AI339","v":0},{"$f":"All!AJ339","v":0},{"$f":"All!AK339","v":0},{"$f":"All!AL339","v":0},{"$f":"All!AM339","v":0},{"$f":"All!AN339","v":0},{"$f":"All!AO339","v":0},{"$f":"All!AP339","v":0},{"$f":"All!AQ339","v":0},{"$f":"All!AR339","v":0},{"$f":"All!AS339","v":0},{"$f":"All!AT339","v":0}]
[null,{"$f":"All!B340","v":"4"},{"$f":"All!C340","v":"4.7"},{"$f":"All!D340","v":"4.7.1"},{"$f":"All!E340","v":""},{"$f":"All!F340","v":"4.7.1.3"},{"$f":"All!G340","v":0},{"$f":"All!H340","v":0},{"$f":"All!I340","v":"4.7.1.3.6"},{"$f":"All!J340","v":"4.7.1.3.6: Does the BCP contain the immediate steps that should be taken by staff, agents and 3rd parties if an identified threat materialises?\n"},{"$f":"All!K340","v":0},{"$f":"All!L340","v":0},{"$f":"All!M340","v":"Recommended"},{"$f":"All!N340","v":"Recommended"},{"$f":"All!O340","v":"BizOps"},{"$f":"All!P340","v":0},{"$f":"All!Q340","v":0},{"$f":"All!R340","v":0},{"$f":"All!S340","v":0},{"$f":"All!T340","v":0},{"$f":"All!U340","v":0},{"$f":"All!V340","v":0},{"$f":"All!W340","v":0},{"$f":"All!X340","v":0},{"$f":"All!Y340","v":0},{"$f":"All!Z340","v":0},{"$f":"All!AA340","v":0},{"$f":"All!AB340","v":0},{"$f":"All!AC340","v":0},{"$f":"All!AD340","v":0},{"$f":"All!AE340","v":0},{"$f":"All!AF340","v":0},{"$f":"All!AG340","v":0},{"$f":"All!AH340","v":0},{"$f":"All!AI340","v":0},{"$f":"All!AJ340","v":0},{"$f":"All!AK340","v":0},{"$f":"All!AL340","v":0},{"$f":"All!AM340","v":0},{"$f":"All!AN340","v":0},{"$f":"All!AO340","v":0},{"$f":"All!AP340","v":0},{"$f":"All!AQ340","v":0},{"$f":"All!AR340","v":0},{"$f":"All!AS340","v":0},{"$f":"All!AT340","v":0}]
[null,{"$f":"All!B341","v":"4"},{"$f":"All!C341","v":"4.7"},{"$f":"All!D341","v":"4.7.1"},{"$f":"All!E341","v":""},{"$f":"All!F341","v":"4.7.1.3"},{"$f":"All!G341","v":0},{"$f":"All!H341","v":0},{"$f":"All!I341","v":"4.7.1.3.7"},{"$f":"All!J341","v":"4.7.1.3.7: Does the BCP contain the procedures for returning to 'business as usual' following the occurrence of an identified threat?\n"},{"$f":"All!K341","v":0},{"$f":"All!L341","v":0},{"$f":"All!M341","v":"Recommended"},{"$f":"All!N341","v":"Recommended"},{"$f":"All!O341","v":"BizOps"},{"$f":"All!P341","v":0},{"$f":"All!Q341","v":0},{"$f":"All!R341","v":0},{"$f":"All!S341","v":0},{"$f":"All!T341","v":0},{"$f":"All!U341","v":0},{"$f":"All!V341","v":0},{"$f":"All!W341","v":0},{"$f":"All!X341","v":0},{"$f":"All!Y341","v":0},{"$f":"All!Z341","v":0},{"$f":"All!AA341","v":0},{"$f":"All!AB341","v":0},{"$f":"All!AC341","v":0},{"$f":"All!AD341","v":0},{"$f":"All!AE341","v":0},{"$f":"All!AF341","v":0},{"$f":"All!AG341","v":0},{"$f":"All!AH341","v":0},{"$f":"All!AI341","v":0},{"$f":"All!AJ341","v":0},{"$f":"All!AK341","v":0},{"$f":"All!AL341","v":0},{"$f":"All!AM341","v":0},{"$f":"All!AN341","v":0},{"$f":"All!AO341","v":0},{"$f":"All!AP341","v":0},{"$f":"All!AQ341","v":0},{"$f":"All!AR341","v":0},{"$f":"All!AS341","v":0},{"$f":"All!AT341","v":0}]
[null,{"$f":"All!B342","v":"4"},{"$f":"All!C342","v":"4.7"},{"$f":"All!D342","v":"4.7.1"},{"$f":"All!E342","v":0},{"$f":"All!F342","v":"4.7.1.3"},{"$f":"All!G342","v":0},{"$f":"All!H342","v":0},{"$f":"All!I342","v":"4.7.1.3.8"},{"$f":"All!J342","v":"4.7.1.3.8: Does the BCP contain protocols for communicating internally and externally (including to agents) in the event of a major incident?\n"},{"$f":"All!K342","v":0},{"$f":"All!L342","v":0},{"$f":"All!M342","v":"Recommended"},{"$f":"All!N342","v":"Recommended"},{"$f":"All!O342","v":"BizOps"},{"$f":"All!P342","v":0},{"$f":"All!Q342","v":0},{"$f":"All!R342","v":0},{"$f":"All!S342","v":0},{"$f":"All!T342","v":0},{"$f":"All!U342","v":0},{"$f":"All!V342","v":0},{"$f":"All!W342","v":0},{"$f":"All!X342","v":0},{"$f":"All!Y342","v":0},{"$f":"All!Z342","v":0},{"$f":"All!AA342","v":0},{"$f":"All!AB342","v":0},{"$f":"All!AC342","v":0},{"$f":"All!AD342","v":0},{"$f":"All!AE342","v":0},{"$f":"All!AF342","v":0},{"$f":"All!AG342","v":0},{"$f":"All!AH342","v":0},{"$f":"All!AI342","v":0},{"$f":"All!AJ342","v":0},{"$f":"All!AK342","v":0},{"$f":"All!AL342","v":0},{"$f":"All!AM342","v":0},{"$f":"All!AN342","v":0},{"$f":"All!AO342","v":0},{"$f":"All!AP342","v":0},{"$f":"All!AQ342","v":0},{"$f":"All!AR342","v":0},{"$f":"All!AS342","v":0},{"$f":"All!AT342","v":0}]
[null,{"$f":"All!B343","v":"4"},{"$f":"All!C343","v":"4.7"},{"$f":"All!D343","v":"4.7.1"},{"$f":"All!E343","v":""},{"$f":"All!F343","v":"4.7.1.4"},{"$f":"All!G343","v":"4.7.1.4: DISASTER RECOVERY (TECHNICAL SYSTEMS)\nA disaster recovery (DR) plan should be implemented for the mobile money technical system. The DR plan defines how the system will be recovered if one or more of the identified threats in the BCP materialises.\n\nIt is essential that the DR plan minimize the loss of customer transaction data, otherwise customer accounts will be incorrect. This is particularly significant given that the accounts contain money rather than airtime. At minimum, all transaction and account data should be replicated to a database hosted with geographical separation.\n\nRecovery objectives should be set for the mobile money system:\n- Recovery Time Objective (RTO) defines the time it should take to recover the system, usually in a separate DR data centre.\n- Recovery Point Objective (RPO) defines the amount of data loss that can be accepted, expressed as a time - i.e. how out-of-date the accounts can become. This should be minimized and set to zero if possible.\n\nThe DR plan should include:\n- The Recovery Time Objective (RTO) and Recovery Point Objective (RPO)\n- Technical architecture for disaster recovery (e.g. data replication);\n- A plan for recovery of systems following a disaster (for  example, acquisition of hardware, relocation of processing into second datacentre) to achieve both RTO and RPO in case any of the identified threats materializes;\n- Management and staffing arrangements for each identified scenario."},{"$f":"All!H343","v":0},{"$f":"All!I343","v":"4.7.1.4.1"},{"$f":"All!J343","v":"4.7.1.4.1: Has a disaster recovery (DR) plan been implemented for the mobile money technical system that defines how the system will be recovered if one or more of the identified risks materialises?\n"},{"$f":"All!K343","v":"1) Disaster Recovery Plan \n- Check the DRP has been documented\n- Check the DRP defines how each technical system will be recovered if any identified risks materialise. \n"},{"$f":"All!L343","v":0},{"$f":"All!M343","v":"Urgent Required"},{"$f":"All!N343","v":"Required"},{"$f":"All!O343","v":"TechOps"},{"$f":"All!P343","v":0},{"$f":"All!Q343","v":0},{"$f":"All!R343","v":0},{"$f":"All!S343","v":0},{"$f":"All!T343","v":0},{"$f":"All!U343","v":0},{"$f":"All!V343","v":0},{"$f":"All!W343","v":0},{"$f":"All!X343","v":0},{"$f":"All!Y343","v":0},{"$f":"All!Z343","v":0},{"$f":"All!AA343","v":0},{"$f":"All!AB343","v":0},{"$f":"All!AC343","v":0},{"$f":"All!AD343","v":0},{"$f":"All!AE343","v":0},{"$f":"All!AF343","v":0},{"$f":"All!AG343","v":0},{"$f":"All!AH343","v":0},{"$f":"All!AI343","v":0},{"$f":"All!AJ343","v":0},{"$f":"All!AK343","v":0},{"$f":"All!AL343","v":0},{"$f":"All!AM343","v":0},{"$f":"All!AN343","v":0},{"$f":"All!AO343","v":0},{"$f":"All!AP343","v":0},{"$f":"All!AQ343","v":0},{"$f":"All!AR343","v":0},{"$f":"All!AS343","v":0},{"$f":"All!AT343","v":0}]
[null,{"$f":"All!B344","v":"4"},{"$f":"All!C344","v":"4.7"},{"$f":"All!D344","v":"4.7.1"},{"$f":"All!E344","v":""},{"$f":"All!F344","v":"4.7.1.4"},{"$f":"All!G344","v":0},{"$f":"All!H344","v":0},{"$f":"All!I344","v":"4.7.1.4.2"},{"$f":"All!J344","v":"4.7.1.4.2: Is all transaction and account data replicated to a second database hosted with geographcal separation?\n"},{"$f":"All!K344","v":"1) Disaster Recovery Plan and/or \n2) System architecture spec.\n- Check there is a process for all transaction and account data to be replicated to a second database with geographic separation"},{"$f":"All!L344","v":0},{"$f":"All!M344","v":"Urgent Required"},{"$f":"All!N344","v":"Required"},{"$f":"All!O344","v":"TechOps"},{"$f":"All!P344","v":0},{"$f":"All!Q344","v":0},{"$f":"All!R344","v":0},{"$f":"All!S344","v":0},{"$f":"All!T344","v":0},{"$f":"All!U344","v":0},{"$f":"All!V344","v":0},{"$f":"All!W344","v":0},{"$f":"All!X344","v":0},{"$f":"All!Y344","v":0},{"$f":"All!Z344","v":0},{"$f":"All!AA344","v":0},{"$f":"All!AB344","v":0},{"$f":"All!AC344","v":0},{"$f":"All!AD344","v":0},{"$f":"All!AE344","v":0},{"$f":"All!AF344","v":0},{"$f":"All!AG344","v":0},{"$f":"All!AH344","v":0},{"$f":"All!AI344","v":0},{"$f":"All!AJ344","v":0},{"$f":"All!AK344","v":0},{"$f":"All!AL344","v":0},{"$f":"All!AM344","v":0},{"$f":"All!AN344","v":0},{"$f":"All!AO344","v":0},{"$f":"All!AP344","v":0},{"$f":"All!AQ344","v":0},{"$f":"All!AR344","v":0},{"$f":"All!AS344","v":0},{"$f":"All!AT344","v":0}]
[null,{"$f":"All!B345","v":"4"},{"$f":"All!C345","v":"4.7"},{"$f":"All!D345","v":"4.7.1"},{"$f":"All!E345","v":""},{"$f":"All!F345","v":"4.7.1.4"},{"$f":"All!G345","v":0},{"$f":"All!H345","v":0},{"$f":"All!I345","v":"4.7.1.4.3"},{"$f":"All!J345","v":"4.7.1.4.3: Has a Recovery Time Objective (RTO) been set to define the time it should take to recover the system, usually in a separate DR data centre?\n"},{"$f":"All!K345","v":"1) Disaster Recovery Plan (DRP) \n- Check that a recovery time objective (RTO) has been set.\n- Check the RTO has been accepted by the head of mobile money and the board risk committee (or similar governance entity)."},{"$f":"All!L345","v":0},{"$f":"All!M345","v":"Standard Required"},{"$f":"All!N345","v":"Required"},{"$f":"All!O345","v":"TechOps"},{"$f":"All!P345","v":0},{"$f":"All!Q345","v":0},{"$f":"All!R345","v":0},{"$f":"All!S345","v":0},{"$f":"All!T345","v":0},{"$f":"All!U345","v":0},{"$f":"All!V345","v":0},{"$f":"All!W345","v":0},{"$f":"All!X345","v":0},{"$f":"All!Y345","v":0},{"$f":"All!Z345","v":0},{"$f":"All!AA345","v":0},{"$f":"All!AB345","v":0},{"$f":"All!AC345","v":0},{"$f":"All!AD345","v":0},{"$f":"All!AE345","v":0},{"$f":"All!AF345","v":0},{"$f":"All!AG345","v":0},{"$f":"All!AH345","v":0},{"$f":"All!AI345","v":0},{"$f":"All!AJ345","v":0},{"$f":"All!AK345","v":0},{"$f":"All!AL345","v":0},{"$f":"All!AM345","v":0},{"$f":"All!AN345","v":0},{"$f":"All!AO345","v":0},{"$f":"All!AP345","v":0},{"$f":"All!AQ345","v":0},{"$f":"All!AR345","v":0},{"$f":"All!AS345","v":0},{"$f":"All!AT345","v":0}]
[null,{"$f":"All!B346","v":"4"},{"$f":"All!C346","v":"4.7"},{"$f":"All!D346","v":"4.7.1"},{"$f":"All!E346","v":""},{"$f":"All!F346","v":"4.7.1.4"},{"$f":"All!G346","v":0},{"$f":"All!H346","v":0},{"$f":"All!I346","v":"4.7.1.4.4"},{"$f":"All!J346","v":"4.7.1.4.4: Has a Recovery Point Objective (RPO) been set close to zero to define the amount of data loss that can be accepted, expressed as a time (i.e. how out-of-date the accounts can become)?\n"},{"$f":"All!K346","v":"1) Disaster Recovery Plan (DRP) \n- Check that a low or zero recovery point objective (RPO) has been set.\n- Check the RPO has been accepted by the head of mobile money and the board risk committee (or similar governance entity)."},{"$f":"All!L346","v":0},{"$f":"All!M346","v":"Standard Required"},{"$f":"All!N346","v":"Required"},{"$f":"All!O346","v":"TechOps"},{"$f":"All!P346","v":0},{"$f":"All!Q346","v":0},{"$f":"All!R346","v":0},{"$f":"All!S346","v":0},{"$f":"All!T346","v":0},{"$f":"All!U346","v":0},{"$f":"All!V346","v":0},{"$f":"All!W346","v":0},{"$f":"All!X346","v":0},{"$f":"All!Y346","v":0},{"$f":"All!Z346","v":0},{"$f":"All!AA346","v":0},{"$f":"All!AB346","v":0},{"$f":"All!AC346","v":0},{"$f":"All!AD346","v":0},{"$f":"All!AE346","v":0},{"$f":"All!AF346","v":0},{"$f":"All!AG346","v":0},{"$f":"All!AH346","v":0},{"$f":"All!AI346","v":0},{"$f":"All!AJ346","v":0},{"$f":"All!AK346","v":0},{"$f":"All!AL346","v":0},{"$f":"All!AM346","v":0},{"$f":"All!AN346","v":0},{"$f":"All!AO346","v":0},{"$f":"All!AP346","v":0},{"$f":"All!AQ346","v":0},{"$f":"All!AR346","v":0},{"$f":"All!AS346","v":0},{"$f":"All!AT346","v":0}]
[null,{"$f":"All!B347","v":"4"},{"$f":"All!C347","v":"4.7"},{"$f":"All!D347","v":"4.7.1"},{"$f":"All!E347","v":""},{"$f":"All!F347","v":"4.7.1.5"},{"$f":"All!G347","v":"4.7.1.5: DISASTER RECOVERY TESTING\nDisaster recovery (failover) plans for the mobile money system should be tested every two years at minimum and annually if possible.\n\nDR testing should test the failover scenarios for all identified threats and evaluate whether the recovery time objective (RTO) and recovery point objective (RPO) is met for each identified threat.\n\nDR testing should evaluate internal procedures as well as dependencies on 3rd party suppliers.\n\nRecords of all periodic evaluations and their results should be maintained. DR testing reports should be sent to mobile money technical and business managers."},{"$f":"All!H347","v":"ISO 22313:2020 Sec. 8.5, 9.1 & 9.3"},{"$f":"All!I347","v":"4.7.1.5.1"},{"$f":"All!J347","v":"4.7.1.5.1: Are disaster recovery (failover) plans for the mobile money system tested every two years at minimum?\n"},{"$f":"All!K347","v":"1) Disaster Recovery testing plan\n- Check that the disaster recover (failover) plan has been tested in at least the last 2 years for the core mobile money system as well as any other systems identified as mission critical to the mobile money service.  "},{"$f":"All!L347","v":0},{"$f":"All!M347","v":"Standard Required"},{"$f":"All!N347","v":"Required"},{"$f":"All!O347","v":"TechOps"},{"$f":"All!P347","v":0},{"$f":"All!Q347","v":0},{"$f":"All!R347","v":0},{"$f":"All!S347","v":0},{"$f":"All!T347","v":0},{"$f":"All!U347","v":0},{"$f":"All!V347","v":0},{"$f":"All!W347","v":0},{"$f":"All!X347","v":0},{"$f":"All!Y347","v":0},{"$f":"All!Z347","v":0},{"$f":"All!AA347","v":0},{"$f":"All!AB347","v":0},{"$f":"All!AC347","v":0},{"$f":"All!AD347","v":0},{"$f":"All!AE347","v":0},{"$f":"All!AF347","v":0},{"$f":"All!AG347","v":0},{"$f":"All!AH347","v":0},{"$f":"All!AI347","v":0},{"$f":"All!AJ347","v":0},{"$f":"All!AK347","v":0},{"$f":"All!AL347","v":0},{"$f":"All!AM347","v":0},{"$f":"All!AN347","v":0},{"$f":"All!AO347","v":0},{"$f":"All!AP347","v":0},{"$f":"All!AQ347","v":0},{"$f":"All!AR347","v":0},{"$f":"All!AS347","v":0},{"$f":"All!AT347","v":0}]
[null,{"$f":"All!B348","v":"4"},{"$f":"All!C348","v":"4.7"},{"$f":"All!D348","v":"4.7.1"},{"$f":"All!E348","v":""},{"$f":"All!F348","v":"4.7.1.5"},{"$f":"All!G348","v":0},{"$f":"All!H348","v":0},{"$f":"All!I348","v":"4.7.1.5.2"},{"$f":"All!J348","v":"4.7.1.5.2: Does DR testing evaluate whether the recovery time objective (RTO) and recovery point objective (RPO) is met for each identified risk?\n"},{"$f":"All!K348","v":"1) Disaster Recovery testing plan\n-  Check that the targeted recovery time objective (RTO) and the recovery point objective (RPO) where evaluated during the last failover test performed."},{"$f":"All!L348","v":0},{"$f":"All!M348","v":"Standard Required"},{"$f":"All!N348","v":"Required"},{"$f":"All!O348","v":"TechOps"},{"$f":"All!P348","v":0},{"$f":"All!Q348","v":0},{"$f":"All!R348","v":0},{"$f":"All!S348","v":0},{"$f":"All!T348","v":0},{"$f":"All!U348","v":0},{"$f":"All!V348","v":0},{"$f":"All!W348","v":0},{"$f":"All!X348","v":0},{"$f":"All!Y348","v":0},{"$f":"All!Z348","v":0},{"$f":"All!AA348","v":0},{"$f":"All!AB348","v":0},{"$f":"All!AC348","v":0},{"$f":"All!AD348","v":0},{"$f":"All!AE348","v":0},{"$f":"All!AF348","v":0},{"$f":"All!AG348","v":0},{"$f":"All!AH348","v":0},{"$f":"All!AI348","v":0},{"$f":"All!AJ348","v":0},{"$f":"All!AK348","v":0},{"$f":"All!AL348","v":0},{"$f":"All!AM348","v":0},{"$f":"All!AN348","v":0},{"$f":"All!AO348","v":0},{"$f":"All!AP348","v":0},{"$f":"All!AQ348","v":0},{"$f":"All!AR348","v":0},{"$f":"All!AS348","v":0},{"$f":"All!AT348","v":0}]
[null,{"$f":"All!B349","v":"4"},{"$f":"All!C349","v":"4.7"},{"$f":"All!D349","v":"4.7.1"},{"$f":"All!E349","v":""},{"$f":"All!F349","v":"4.7.1.5"},{"$f":"All!G349","v":0},{"$f":"All!H349","v":0},{"$f":"All!I349","v":"4.7.1.5.3"},{"$f":"All!J349","v":"4.7.1.5.3: Does DR testing evaluate internal continuity procedures as well as dependencies on 3rd party suppliers?\n"},{"$f":"All!K349","v":0},{"$f":"All!L349","v":0},{"$f":"All!M349","v":"Recommended"},{"$f":"All!N349","v":"Recommended"},{"$f":"All!O349","v":"TechOps"},{"$f":"All!P349","v":0},{"$f":"All!Q349","v":0},{"$f":"All!R349","v":0},{"$f":"All!S349","v":0},{"$f":"All!T349","v":0},{"$f":"All!U349","v":0},{"$f":"All!V349","v":0},{"$f":"All!W349","v":0},{"$f":"All!X349","v":0},{"$f":"All!Y349","v":0},{"$f":"All!Z349","v":0},{"$f":"All!AA349","v":0},{"$f":"All!AB349","v":0},{"$f":"All!AC349","v":0},{"$f":"All!AD349","v":0},{"$f":"All!AE349","v":0},{"$f":"All!AF349","v":0},{"$f":"All!AG349","v":0},{"$f":"All!AH349","v":0},{"$f":"All!AI349","v":0},{"$f":"All!AJ349","v":0},{"$f":"All!AK349","v":0},{"$f":"All!AL349","v":0},{"$f":"All!AM349","v":0},{"$f":"All!AN349","v":0},{"$f":"All!AO349","v":0},{"$f":"All!AP349","v":0},{"$f":"All!AQ349","v":0},{"$f":"All!AR349","v":0},{"$f":"All!AS349","v":0},{"$f":"All!AT349","v":0}]
[null,{"$f":"All!B350","v":"4"},{"$f":"All!C350","v":"4.7"},{"$f":"All!D350","v":"4.7.1"},{"$f":"All!E350","v":""},{"$f":"All!F350","v":"4.7.1.5"},{"$f":"All!G350","v":0},{"$f":"All!H350","v":0},{"$f":"All!I350","v":"4.7.1.5.4"},{"$f":"All!J350","v":"4.7.1.5.4: Are DR testing reports sent to mobile money technical and business managers?\n"},{"$f":"All!K350","v":0},{"$f":"All!L350","v":0},{"$f":"All!M350","v":"Recommended"},{"$f":"All!N350","v":"Recommended"},{"$f":"All!O350","v":"TechOps"},{"$f":"All!P350","v":0},{"$f":"All!Q350","v":0},{"$f":"All!R350","v":0},{"$f":"All!S350","v":0},{"$f":"All!T350","v":0},{"$f":"All!U350","v":0},{"$f":"All!V350","v":0},{"$f":"All!W350","v":0},{"$f":"All!X350","v":0},{"$f":"All!Y350","v":0},{"$f":"All!Z350","v":0},{"$f":"All!AA350","v":0},{"$f":"All!AB350","v":0},{"$f":"All!AC350","v":0},{"$f":"All!AD350","v":0},{"$f":"All!AE350","v":0},{"$f":"All!AF350","v":0},{"$f":"All!AG350","v":0},{"$f":"All!AH350","v":0},{"$f":"All!AI350","v":0},{"$f":"All!AJ350","v":0},{"$f":"All!AK350","v":0},{"$f":"All!AL350","v":0},{"$f":"All!AM350","v":0},{"$f":"All!AN350","v":0},{"$f":"All!AO350","v":0},{"$f":"All!AP350","v":0},{"$f":"All!AQ350","v":0},{"$f":"All!AR350","v":0},{"$f":"All!AS350","v":0},{"$f":"All!AT350","v":0}]
[null,{"$f":"All!B351","v":"5"},{"$f":"All!C351","v":"5.1"},{"$f":"All!D351","v":"5.1.1"},{"$f":"All!E351","v":"5.1.1: Providers shall develop, implement, and regularly review a formal security policy for mobile money services"},{"$f":"All!F351","v":"5.1.1.1"},{"$f":"All!G351","v":"5.1.1.1: SECURITY POLICY\nProviders should define an information security policy which should be:\n- properly documented;\n- approved by senior technical management and the head of mobile money;\n- reviewed at least annually and updated when the environment changes.\n\nThe policy should require a security manager with sufficient seniority that has responsibility for implementing the security policy across the mobile money system and its operations. Other key roles and responsibilities for fulfilling the security objectives should also be defined.\n\nThe policy should ensure that all relevant legal and regulatory requirements related to information security are identified and met (e.g. cryptographic controls)."},{"$f":"All!H351","v":"ECB RSMP, PCI DSS, ISO 27002:2013 Sec. 5"},{"$f":"All!I351","v":"5.1.1.1.1"},{"$f":"All!J351","v":"5.1.1.1.1: Is there an information security policy that is properly documented and approved by senior technical management?\n"},{"$f":"All!K351","v":"1) Security policy or equivalent compliance framework or audit documentation\n- Check the security policy is properly documented \n- Check the document has been approved by senior technical management "},{"$f":"All!L351","v":0},{"$f":"All!M351","v":"Urgent Required"},{"$f":"All!N351","v":"Required"},{"$f":"All!O351","v":"TechOps"},{"$f":"All!P351","v":0},{"$f":"All!Q351","v":0},{"$f":"All!R351","v":0},{"$f":"All!S351","v":0},{"$f":"All!T351","v":0},{"$f":"All!U351","v":0},{"$f":"All!V351","v":0},{"$f":"All!W351","v":0},{"$f":"All!X351","v":0},{"$f":"All!Y351","v":0},{"$f":"All!Z351","v":0},{"$f":"All!AA351","v":0},{"$f":"All!AB351","v":0},{"$f":"All!AC351","v":0},{"$f":"All!AD351","v":0},{"$f":"All!AE351","v":0},{"$f":"All!AF351","v":0},{"$f":"All!AG351","v":0},{"$f":"All!AH351","v":0},{"$f":"All!AI351","v":0},{"$f":"All!AJ351","v":0},{"$f":"All!AK351","v":0},{"$f":"All!AL351","v":0},{"$f":"All!AM351","v":0},{"$f":"All!AN351","v":0},{"$f":"All!AO351","v":0},{"$f":"All!AP351","v":0},{"$f":"All!AQ351","v":0},{"$f":"All!AR351","v":0},{"$f":"All!AS351","v":0},{"$f":"All!AT351","v":0}]
[null,{"$f":"All!B352","v":"5"},{"$f":"All!C352","v":"5.1"},{"$f":"All!D352","v":"5.1.1"},{"$f":"All!E352","v":0},{"$f":"All!F352","v":"5.1.1.1"},{"$f":"All!G352","v":0},{"$f":"All!H352","v":0},{"$f":"All!I352","v":"5.1.1.1.2"},{"$f":"All!J352","v":"5.1.1.1.2: Is there someone with sufficient seniority that has responsibility for implementing the security policy across the mobile money system and its operations?\n"},{"$f":"All!K352","v":"1) Technical operations organisation chart\n- Check that an officer has responsibility for implementing security policy across the mobile money system and its operations\n- Check that the officer's grade/rank/band is sufficiently senior to carry out their role effectively\n- Check the officer's job description to see that they are charged with the implementation of security polices for mobile system and its operations."},{"$f":"All!L352","v":0},{"$f":"All!M352","v":"Standard Required"},{"$f":"All!N352","v":"Required"},{"$f":"All!O352","v":"TechOps"},{"$f":"All!P352","v":0},{"$f":"All!Q352","v":0},{"$f":"All!R352","v":0},{"$f":"All!S352","v":0},{"$f":"All!T352","v":0},{"$f":"All!U352","v":0},{"$f":"All!V352","v":0},{"$f":"All!W352","v":0},{"$f":"All!X352","v":0},{"$f":"All!Y352","v":0},{"$f":"All!Z352","v":0},{"$f":"All!AA352","v":0},{"$f":"All!AB352","v":0},{"$f":"All!AC352","v":0},{"$f":"All!AD352","v":0},{"$f":"All!AE352","v":0},{"$f":"All!AF352","v":0},{"$f":"All!AG352","v":0},{"$f":"All!AH352","v":0},{"$f":"All!AI352","v":0},{"$f":"All!AJ352","v":0},{"$f":"All!AK352","v":0},{"$f":"All!AL352","v":0},{"$f":"All!AM352","v":0},{"$f":"All!AN352","v":0},{"$f":"All!AO352","v":0},{"$f":"All!AP352","v":0},{"$f":"All!AQ352","v":0},{"$f":"All!AR352","v":0},{"$f":"All!AS352","v":0},{"$f":"All!AT352","v":0}]
[null,{"$f":"All!B353","v":"5"},{"$f":"All!C353","v":"5.1"},{"$f":"All!D353","v":"5.1.1"},{"$f":"All!E353","v":0},{"$f":"All!F353","v":"5.1.1.1"},{"$f":"All!G353","v":0},{"$f":"All!H353","v":0},{"$f":"All!I353","v":"5.1.1.1.3"},{"$f":"All!J353","v":"5.1.1.1.3: Is the information security policy reviewed at least annually and updated when the environment changes?\n"},{"$f":"All!K353","v":0},{"$f":"All!L353","v":0},{"$f":"All!M353","v":"Recommended"},{"$f":"All!N353","v":"Recommended"},{"$f":"All!O353","v":"TechOps"},{"$f":"All!P353","v":0},{"$f":"All!Q353","v":0},{"$f":"All!R353","v":0},{"$f":"All!S353","v":0},{"$f":"All!T353","v":0},{"$f":"All!U353","v":0},{"$f":"All!V353","v":0},{"$f":"All!W353","v":0},{"$f":"All!X353","v":0},{"$f":"All!Y353","v":0},{"$f":"All!Z353","v":0},{"$f":"All!AA353","v":0},{"$f":"All!AB353","v":0},{"$f":"All!AC353","v":0},{"$f":"All!AD353","v":0},{"$f":"All!AE353","v":0},{"$f":"All!AF353","v":0},{"$f":"All!AG353","v":0},{"$f":"All!AH353","v":0},{"$f":"All!AI353","v":0},{"$f":"All!AJ353","v":0},{"$f":"All!AK353","v":0},{"$f":"All!AL353","v":0},{"$f":"All!AM353","v":0},{"$f":"All!AN353","v":0},{"$f":"All!AO353","v":0},{"$f":"All!AP353","v":0},{"$f":"All!AQ353","v":0},{"$f":"All!AR353","v":0},{"$f":"All!AS353","v":0},{"$f":"All!AT353","v":0}]
[null,{"$f":"All!B354","v":"5"},{"$f":"All!C354","v":"5.1"},{"$f":"All!D354","v":"5.1.1"},{"$f":"All!E354","v":""},{"$f":"All!F354","v":"5.1.1.2"},{"$f":"All!G354","v":"5.1.1.2: SECURITY OBJECTIVES AND APPROACH\nThe information security policy should set the security objectives, including objectives created by:\n- regulations, legislation and contracts;\n- the current and projected information security threat environment;\n- business appetite for risk.\n\nThe policy should set out the approach to managing the security objectives. The approach should provide multiple levels of security risk monitoring and mitigation e.g. Three Lines of Defence (3LoD) or similar model. This typically means:\n - operational security management (5.3 - especially 5.3.5);\n - security risk management (5.3.1);\n - auditing of security (5.1.1.4)."},{"$f":"All!H354","v":"ECB RSMP, ISO 27002:2013 Sec. 6.1"},{"$f":"All!I354","v":"5.1.1.2.1"},{"$f":"All!J354","v":"5.1.1.2.1: Does the security policy specify security objectives that provide for multiple levels of security risk monitoring and mitigation (e.g.3LoD or similar)?\n"},{"$f":"All!K354","v":"1) Security policy or equivalent compliance framework or audit documentation\n- Check the security policy specifies security objectives that provide multiple levels of security risk monitoring, for example 3 line of defence etc."},{"$f":"All!L354","v":0},{"$f":"All!M354","v":"Recommended"},{"$f":"All!N354","v":"Recommended"},{"$f":"All!O354","v":"TechOps"},{"$f":"All!P354","v":0},{"$f":"All!Q354","v":0},{"$f":"All!R354","v":0},{"$f":"All!S354","v":0},{"$f":"All!T354","v":0},{"$f":"All!U354","v":0},{"$f":"All!V354","v":0},{"$f":"All!W354","v":0},{"$f":"All!X354","v":0},{"$f":"All!Y354","v":0},{"$f":"All!Z354","v":0},{"$f":"All!AA354","v":0},{"$f":"All!AB354","v":0},{"$f":"All!AC354","v":0},{"$f":"All!AD354","v":0},{"$f":"All!AE354","v":0},{"$f":"All!AF354","v":0},{"$f":"All!AG354","v":0},{"$f":"All!AH354","v":0},{"$f":"All!AI354","v":0},{"$f":"All!AJ354","v":0},{"$f":"All!AK354","v":0},{"$f":"All!AL354","v":0},{"$f":"All!AM354","v":0},{"$f":"All!AN354","v":0},{"$f":"All!AO354","v":0},{"$f":"All!AP354","v":0},{"$f":"All!AQ354","v":0},{"$f":"All!AR354","v":0},{"$f":"All!AS354","v":0},{"$f":"All!AT354","v":0}]
[null,{"$f":"All!B355","v":"5"},{"$f":"All!C355","v":"5.1"},{"$f":"All!D355","v":"5.1.1"},{"$f":"All!E355","v":""},{"$f":"All!F355","v":"5.1.1.3"},{"$f":"All!G355","v":"5.1.1.3: SECURITY AUDIT\nThe provider's approach to managing information security, and its implementation (i.e. security policy, procedures and controls), should be independently audited at planned intervals, and when significant changes occur. Management should initiate the independent review, which should include:\n- assessing compliance of the security processes with the security policy and standards;\n- identifying required improvements to the security policy and its approach and control objectives.\n\nThe security audit / compliance review could be carried out by an internal audit team, provided it is independent.\n\nIn addition, technical operations managers should regularly review the compliance of their procedures with the security policy."},{"$f":"All!H355","v":"ISO 27002:2013 Sec. 18.2 "},{"$f":"All!I355","v":"5.1.1.3.1"},{"$f":"All!J355","v":"5.1.1.3.1: Are security audits / compliance reviews carried out regularly to assess compliance of the security processes with the mobile money security policy?\n"},{"$f":"All!K355","v":"1) Security policy or equivalent compliance framework or audit documentation (Note this could be a  group-level document)\n- Check the policy includes requirements security processes to be audited against policy requirements, its approach and control objectives.\n- Check the policy set out frequency for the audits.\n- Check the most recent security audit report to ensure it is within the timescales set out in the policy (if not, look for evidence of change to ensure future audits will be timely).\n- Check there is a process for reporting and following up actions.\n\n"},{"$f":"All!L355","v":0},{"$f":"All!M355","v":"Standard Required"},{"$f":"All!N355","v":"Required"},{"$f":"All!O355","v":"TechOps"},{"$f":"All!P355","v":0},{"$f":"All!Q355","v":0},{"$f":"All!R355","v":0},{"$f":"All!S355","v":0},{"$f":"All!T355","v":0},{"$f":"All!U355","v":0},{"$f":"All!V355","v":0},{"$f":"All!W355","v":0},{"$f":"All!X355","v":0},{"$f":"All!Y355","v":0},{"$f":"All!Z355","v":0},{"$f":"All!AA355","v":0},{"$f":"All!AB355","v":0},{"$f":"All!AC355","v":0},{"$f":"All!AD355","v":0},{"$f":"All!AE355","v":0},{"$f":"All!AF355","v":0},{"$f":"All!AG355","v":0},{"$f":"All!AH355","v":0},{"$f":"All!AI355","v":0},{"$f":"All!AJ355","v":0},{"$f":"All!AK355","v":0},{"$f":"All!AL355","v":0},{"$f":"All!AM355","v":0},{"$f":"All!AN355","v":0},{"$f":"All!AO355","v":0},{"$f":"All!AP355","v":0},{"$f":"All!AQ355","v":0},{"$f":"All!AR355","v":0},{"$f":"All!AS355","v":0},{"$f":"All!AT355","v":0}]
[null,{"$f":"All!B356","v":"5"},{"$f":"All!C356","v":"5.1"},{"$f":"All!D356","v":"5.1.2"},{"$f":"All!E356","v":"5.1.2: Providers shall train internal staff about their security responsibilities"},{"$f":"All!F356","v":"5.1.2.1"},{"$f":"All!G356","v":"5.1.2.1: EMPLOYEE SECURITY TRAINING\nAll mobile money staff (including contractors) should receive training in the security policy and procedures before being granted access to the mobile money system.\n\nThe security training programme should be updated regularly to account for changes in procedures and staff should be given regular security training updates. Staff should be briefed on any relevant emerging threats. \n\nThe training should ensure that staff are properly briefed on their security responsibilities including:\n - security of customer data;\n - protection of user IDs and passwords."},{"$f":"All!H356","v":"ISO 27002:2013 Sec. 7.2"},{"$f":"All!I356","v":"5.1.2.1.1"},{"$f":"All!J356","v":"5.1.2.1.1: Do all mobile money staff (including contractors) receive training in security policies and procedures before being granted access to the mobile money system?\n"},{"$f":"All!K356","v":"1) Security training plan\n- Check the plan includes a process to deliver relevant job specific training to all staff and contractors prior to them being granted access to the system.\n"},{"$f":"All!L356","v":0},{"$f":"All!M356","v":"Urgent Required"},{"$f":"All!N356","v":"Required"},{"$f":"All!O356","v":"TechOps"},{"$f":"All!P356","v":0},{"$f":"All!Q356","v":0},{"$f":"All!R356","v":0},{"$f":"All!S356","v":0},{"$f":"All!T356","v":0},{"$f":"All!U356","v":0},{"$f":"All!V356","v":0},{"$f":"All!W356","v":0},{"$f":"All!X356","v":0},{"$f":"All!Y356","v":0},{"$f":"All!Z356","v":0},{"$f":"All!AA356","v":0},{"$f":"All!AB356","v":0},{"$f":"All!AC356","v":0},{"$f":"All!AD356","v":0},{"$f":"All!AE356","v":0},{"$f":"All!AF356","v":0},{"$f":"All!AG356","v":0},{"$f":"All!AH356","v":0},{"$f":"All!AI356","v":0},{"$f":"All!AJ356","v":0},{"$f":"All!AK356","v":0},{"$f":"All!AL356","v":0},{"$f":"All!AM356","v":0},{"$f":"All!AN356","v":0},{"$f":"All!AO356","v":0},{"$f":"All!AP356","v":0},{"$f":"All!AQ356","v":0},{"$f":"All!AR356","v":0},{"$f":"All!AS356","v":0},{"$f":"All!AT356","v":0}]
[null,{"$f":"All!B357","v":"5"},{"$f":"All!C357","v":"5.1"},{"$f":"All!D357","v":"5.1.2"},{"$f":"All!E357","v":""},{"$f":"All!F357","v":"5.1.2.1"},{"$f":"All!G357","v":0},{"$f":"All!H357","v":0},{"$f":"All!I357","v":"5.1.2.1.2"},{"$f":"All!J357","v":"5.1.2.1.2: Does senior management arrange a regular audit of the mobile money service (at least every two years) to evaluate whether the MM governance, internal control and risk management processes are operating effectively.\n"},{"$f":"All!K357","v":"1. Header page of last audit, or audit policy/process/plan, or compliance framework\n- Check that an audit of mobile money is performed at least every 2 years by an independent function (e.g. internal audit or compliance team).\n"},{"$f":"All!L357","v":0},{"$f":"All!M357","v":"Recommended"},{"$f":"All!N357","v":"Recommended"},{"$f":"All!O357","v":"TechOps"},{"$f":"All!P357","v":0},{"$f":"All!Q357","v":0},{"$f":"All!R357","v":0},{"$f":"All!S357","v":0},{"$f":"All!T357","v":0},{"$f":"All!U357","v":0},{"$f":"All!V357","v":0},{"$f":"All!W357","v":0},{"$f":"All!X357","v":0},{"$f":"All!Y357","v":0},{"$f":"All!Z357","v":0},{"$f":"All!AA357","v":0},{"$f":"All!AB357","v":0},{"$f":"All!AC357","v":0},{"$f":"All!AD357","v":0},{"$f":"All!AE357","v":0},{"$f":"All!AF357","v":0},{"$f":"All!AG357","v":0},{"$f":"All!AH357","v":0},{"$f":"All!AI357","v":0},{"$f":"All!AJ357","v":0},{"$f":"All!AK357","v":0},{"$f":"All!AL357","v":0},{"$f":"All!AM357","v":0},{"$f":"All!AN357","v":0},{"$f":"All!AO357","v":0},{"$f":"All!AP357","v":0},{"$f":"All!AQ357","v":0},{"$f":"All!AR357","v":0},{"$f":"All!AS357","v":0},{"$f":"All!AT357","v":0}]
[null,{"$f":"All!B358","v":"5"},{"$f":"All!C358","v":"5.1"},{"$f":"All!D358","v":"5.1.2"},{"$f":"All!E358","v":""},{"$f":"All!F358","v":"5.1.2.1"},{"$f":"All!G358","v":0},{"$f":"All!H358","v":0},{"$f":"All!I358","v":"5.1.2.1.3"},{"$f":"All!J358","v":"5.1.2.1.3: Are issues raised by audits being followed up by senior management to ensure they are addressed promptly?\n"},{"$f":"All!K358","v":"1) Records of last audit, or audit policy/process/plan, or compliance framework\n- Check that issues raised by audits are being followed up by senior management to ensure they are addressed promptly\n(Note: Records of the last audit could be redacted to remove sensitive contents but to show that actions are being followed up. Alternatively, the process documentation could be reviewed)"},{"$f":"All!L358","v":0},{"$f":"All!M358","v":"Recommended"},{"$f":"All!N358","v":"Recommended"},{"$f":"All!O358","v":"TechOps"},{"$f":"All!P358","v":0},{"$f":"All!Q358","v":0},{"$f":"All!R358","v":0},{"$f":"All!S358","v":0},{"$f":"All!T358","v":0},{"$f":"All!U358","v":0},{"$f":"All!V358","v":0},{"$f":"All!W358","v":0},{"$f":"All!X358","v":0},{"$f":"All!Y358","v":0},{"$f":"All!Z358","v":0},{"$f":"All!AA358","v":0},{"$f":"All!AB358","v":0},{"$f":"All!AC358","v":0},{"$f":"All!AD358","v":0},{"$f":"All!AE358","v":0},{"$f":"All!AF358","v":0},{"$f":"All!AG358","v":0},{"$f":"All!AH358","v":0},{"$f":"All!AI358","v":0},{"$f":"All!AJ358","v":0},{"$f":"All!AK358","v":0},{"$f":"All!AL358","v":0},{"$f":"All!AM358","v":0},{"$f":"All!AN358","v":0},{"$f":"All!AO358","v":0},{"$f":"All!AP358","v":0},{"$f":"All!AQ358","v":0},{"$f":"All!AR358","v":0},{"$f":"All!AS358","v":0},{"$f":"All!AT358","v":0}]
[null,{"$f":"All!B359","v":"5"},{"$f":"All!C359","v":"5.1"},{"$f":"All!D359","v":"5.1.2"},{"$f":"All!E359","v":""},{"$f":"All!F359","v":"5.1.2.2"},{"$f":"All!G359","v":"5.1.2.2: SECURITY RESPONSIBILITIES AFTER TERMINATION OF EMPLOYMENT\nProviders should define security responsibilities that will remain valid after termination or change of employment. These should be  communicated to staff (including contractors) and included in their terms and conditions of employment."},{"$f":"All!H359","v":"ISO 27002:2013 Sec. 7.3"},{"$f":"All!I359","v":"5.1.2.2.1"},{"$f":"All!J359","v":"5.1.2.2.1: Are security responsibilities that apply after termination of employment communicated to staff and enforced?\n"},{"$f":"All!K359","v":0},{"$f":"All!L359","v":0},{"$f":"All!M359","v":"Recommended"},{"$f":"All!N359","v":"Recommended"},{"$f":"All!O359","v":"TechOps"},{"$f":"All!P359","v":0},{"$f":"All!Q359","v":0},{"$f":"All!R359","v":0},{"$f":"All!S359","v":0},{"$f":"All!T359","v":0},{"$f":"All!U359","v":0},{"$f":"All!V359","v":0},{"$f":"All!W359","v":0},{"$f":"All!X359","v":0},{"$f":"All!Y359","v":0},{"$f":"All!Z359","v":0},{"$f":"All!AA359","v":0},{"$f":"All!AB359","v":0},{"$f":"All!AC359","v":0},{"$f":"All!AD359","v":0},{"$f":"All!AE359","v":0},{"$f":"All!AF359","v":0},{"$f":"All!AG359","v":0},{"$f":"All!AH359","v":0},{"$f":"All!AI359","v":0},{"$f":"All!AJ359","v":0},{"$f":"All!AK359","v":0},{"$f":"All!AL359","v":0},{"$f":"All!AM359","v":0},{"$f":"All!AN359","v":0},{"$f":"All!AO359","v":0},{"$f":"All!AP359","v":0},{"$f":"All!AQ359","v":0},{"$f":"All!AR359","v":0},{"$f":"All!AS359","v":0},{"$f":"All!AT359","v":0}]
[null,{"$f":"All!B360","v":"5"},{"$f":"All!C360","v":"5.1"},{"$f":"All!D360","v":"5.1.3"},{"$f":"All!E360","v":"5.1.3: Providers shall ensure policies are in place for the secure handling of information and assets"},{"$f":"All!F360","v":"5.1.3.1"},{"$f":"All!G360","v":"5.1.3.1: INVENTORY AND SECURITY CLASSIFICATION OF ALL DATA ASSETS\nProviders should identify all data assets associated with the mobile money system. An inventory of these assets should be maintained and an owner identified for each asset. The owner should be responsible for the customer data that is held by it. \n\nThe data sensitivity should be classified and documented for all mobile money data systems (databases, SANs etc.) and removable media, including laptops, smartphones, tablets, storage media, and paper receipts /reports /forms. Removable assets in particular risk exposure of the data they contain.\nSecurity requirements for each system and removable data asset should be determined according to data sensitivity.\n"},{"$f":"All!H360","v":"ISO 27002:2013 Sec. 8.1, Sec 8.3"},{"$f":"All!I360","v":"5.1.3.1.1"},{"$f":"All!J360","v":"5.1.3.1.1: Is each mobile money data asset identified with an owner who is responsible the customer data that is held by it?\n"},{"$f":"All!K360","v":"1) Asset management process\n- Check the policy to ensure there is a process for all assets to be added to the asset register.\n- Check the asset register includes an owner for each and every asset, and any personal data held on it."},{"$f":"All!L360","v":0},{"$f":"All!M360","v":"Standard Required"},{"$f":"All!N360","v":"Required"},{"$f":"All!O360","v":"TechOps"},{"$f":"All!P360","v":0},{"$f":"All!Q360","v":0},{"$f":"All!R360","v":0},{"$f":"All!S360","v":0},{"$f":"All!T360","v":0},{"$f":"All!U360","v":0},{"$f":"All!V360","v":0},{"$f":"All!W360","v":0},{"$f":"All!X360","v":0},{"$f":"All!Y360","v":0},{"$f":"All!Z360","v":0},{"$f":"All!AA360","v":0},{"$f":"All!AB360","v":0},{"$f":"All!AC360","v":0},{"$f":"All!AD360","v":0},{"$f":"All!AE360","v":0},{"$f":"All!AF360","v":0},{"$f":"All!AG360","v":0},{"$f":"All!AH360","v":0},{"$f":"All!AI360","v":0},{"$f":"All!AJ360","v":0},{"$f":"All!AK360","v":0},{"$f":"All!AL360","v":0},{"$f":"All!AM360","v":0},{"$f":"All!AN360","v":0},{"$f":"All!AO360","v":0},{"$f":"All!AP360","v":0},{"$f":"All!AQ360","v":0},{"$f":"All!AR360","v":0},{"$f":"All!AS360","v":0},{"$f":"All!AT360","v":0}]
[null,{"$f":"All!B361","v":"5"},{"$f":"All!C361","v":"5.1"},{"$f":"All!D361","v":"5.1.3"},{"$f":"All!E361","v":0},{"$f":"All!F361","v":"5.1.3.1"},{"$f":"All!G361","v":0},{"$f":"All!H361","v":0},{"$f":"All!I361","v":"5.1.3.1.2"},{"$f":"All!J361","v":"5.1.3.1.2: Has data sensitivity classification been documented for:\n - Mobile money data systems;\n - Removable media, including laptops, smartphones, tablets, storage media, and paper media (e.g. registration forms and agent log books)?\n"},{"$f":"All!K361","v":"1) Asset management process\n- Check that there is a documented process and standards for classifying all data held in mobile money systems and removable media."},{"$f":"All!L361","v":0},{"$f":"All!M361","v":"Standard Required"},{"$f":"All!N361","v":"Required"},{"$f":"All!O361","v":"TechOps"},{"$f":"All!P361","v":0},{"$f":"All!Q361","v":0},{"$f":"All!R361","v":0},{"$f":"All!S361","v":0},{"$f":"All!T361","v":0},{"$f":"All!U361","v":0},{"$f":"All!V361","v":0},{"$f":"All!W361","v":0},{"$f":"All!X361","v":0},{"$f":"All!Y361","v":0},{"$f":"All!Z361","v":0},{"$f":"All!AA361","v":0},{"$f":"All!AB361","v":0},{"$f":"All!AC361","v":0},{"$f":"All!AD361","v":0},{"$f":"All!AE361","v":0},{"$f":"All!AF361","v":0},{"$f":"All!AG361","v":0},{"$f":"All!AH361","v":0},{"$f":"All!AI361","v":0},{"$f":"All!AJ361","v":0},{"$f":"All!AK361","v":0},{"$f":"All!AL361","v":0},{"$f":"All!AM361","v":0},{"$f":"All!AN361","v":0},{"$f":"All!AO361","v":0},{"$f":"All!AP361","v":0},{"$f":"All!AQ361","v":0},{"$f":"All!AR361","v":0},{"$f":"All!AS361","v":0},{"$f":"All!AT361","v":0}]
[null,{"$f":"All!B362","v":"5"},{"$f":"All!C362","v":"5.1"},{"$f":"All!D362","v":"5.1.3"},{"$f":"All!E362","v":0},{"$f":"All!F362","v":"5.1.3.1"},{"$f":"All!G362","v":0},{"$f":"All!H362","v":0},{"$f":"All!I362","v":"5.1.3.1.3"},{"$f":"All!J362","v":"5.1.3.1.3: Are inventory logs of data systems and removable media maintained and updated at least annually?\n"},{"$f":"All!K362","v":0},{"$f":"All!L362","v":0},{"$f":"All!M362","v":"Recommended"},{"$f":"All!N362","v":"Recommended"},{"$f":"All!O362","v":"TechOps"},{"$f":"All!P362","v":0},{"$f":"All!Q362","v":0},{"$f":"All!R362","v":0},{"$f":"All!S362","v":0},{"$f":"All!T362","v":0},{"$f":"All!U362","v":0},{"$f":"All!V362","v":0},{"$f":"All!W362","v":0},{"$f":"All!X362","v":0},{"$f":"All!Y362","v":0},{"$f":"All!Z362","v":0},{"$f":"All!AA362","v":0},{"$f":"All!AB362","v":0},{"$f":"All!AC362","v":0},{"$f":"All!AD362","v":0},{"$f":"All!AE362","v":0},{"$f":"All!AF362","v":0},{"$f":"All!AG362","v":0},{"$f":"All!AH362","v":0},{"$f":"All!AI362","v":0},{"$f":"All!AJ362","v":0},{"$f":"All!AK362","v":0},{"$f":"All!AL362","v":0},{"$f":"All!AM362","v":0},{"$f":"All!AN362","v":0},{"$f":"All!AO362","v":0},{"$f":"All!AP362","v":0},{"$f":"All!AQ362","v":0},{"$f":"All!AR362","v":0},{"$f":"All!AS362","v":0},{"$f":"All!AT362","v":0}]
[null,{"$f":"All!B363","v":"5"},{"$f":"All!C363","v":"5.1"},{"$f":"All!D363","v":"5.1.3"},{"$f":"All!E363","v":""},{"$f":"All!F363","v":"5.1.3.2"},{"$f":"All!G363","v":"5.1.3.2: SECURE DISPOSAL OF DATA SYSTEMS AND MEDIA\nFormal procedures should be implemented for the secure disposal of data storage systems and media that are no longer needed. This is important to minimize the risk of confidential information leakage. The procedures for secure disposal of data systems and media should be proportionate to the sensitivity of the information stored. The procedured should also apply to paper and other non-electronic media.\n\nProviders should:\n- take steps to verify that customer data has been removed or securely overwritten prior to disposal or re-use of data storage systems or media;\n- render customer and financial data on electronic media unrecoverable so that the data cannot be reconstructed;\n- shred, incinerate, or pulp paper materials (e.g. agent log books) so that customer and financial data cannot be reconstructed; \n\nThis practice should extend to assets accessible by third parties (see 5.1.4)."},{"$f":"All!H363","v":"PCI DSS, ISO 27002:2013 Sec. 8.3 "},{"$f":"All!I363","v":"5.1.3.2.1"},{"$f":"All!J363","v":"5.1.3.2.1: Are there procedures for the secure reuse or disposal of all data storage systems to minimize the risk of confidential information leakage (e.g. by making electronic data unrecoverable?\nAre old paper records (e.g. agent log books) securely destroyed by shredding/incineration?\n"},{"$f":"All!K363","v":"1) Asset management process\n- Check there are documented procedures for the secure reuse or disposal of all data storage systems to minimize the risk of confidential information leakage (e.g. by making electronic data unrecoverable)\n- Check that old paper records (e.g. agent log books) are securely destroyed by shredding/incineration.\n"},{"$f":"All!L363","v":0},{"$f":"All!M363","v":"Standard Required"},{"$f":"All!N363","v":"Required"},{"$f":"All!O363","v":"TechOps"},{"$f":"All!P363","v":0},{"$f":"All!Q363","v":0},{"$f":"All!R363","v":0},{"$f":"All!S363","v":0},{"$f":"All!T363","v":0},{"$f":"All!U363","v":0},{"$f":"All!V363","v":0},{"$f":"All!W363","v":0},{"$f":"All!X363","v":0},{"$f":"All!Y363","v":0},{"$f":"All!Z363","v":0},{"$f":"All!AA363","v":0},{"$f":"All!AB363","v":0},{"$f":"All!AC363","v":0},{"$f":"All!AD363","v":0},{"$f":"All!AE363","v":0},{"$f":"All!AF363","v":0},{"$f":"All!AG363","v":0},{"$f":"All!AH363","v":0},{"$f":"All!AI363","v":0},{"$f":"All!AJ363","v":0},{"$f":"All!AK363","v":0},{"$f":"All!AL363","v":0},{"$f":"All!AM363","v":0},{"$f":"All!AN363","v":0},{"$f":"All!AO363","v":0},{"$f":"All!AP363","v":0},{"$f":"All!AQ363","v":0},{"$f":"All!AR363","v":0},{"$f":"All!AS363","v":0},{"$f":"All!AT363","v":0}]
[null,{"$f":"All!B364","v":"5"},{"$f":"All!C364","v":"5.1"},{"$f":"All!D364","v":"5.1.4"},{"$f":"All!E364","v":"5.1.4: Providers shall ensure the protection of their assets that are accessible by suppliers and third parties"},{"$f":"All!F364","v":"5.1.4.1"},{"$f":"All!G364","v":"5.1.4.1: SECURITY POLICY AND THIRD PARTIES\nThe information security policy should apply to suppliers and third parties and should include:\n- security controls for managing their access; \n- security training as and when needed;\n- processes that these parties have to follow.\nThis should be enforced in third party contracts."},{"$f":"All!H364","v":"ISO 27002:2013 Sec. 15.2 "},{"$f":"All!I364","v":"5.1.4.1.1"},{"$f":"All!J364","v":"5.1.4.1.1: Does the information security policy contractually apply to suppliers and third parties?\n"},{"$f":"All!K364","v":"1) Contracts with key third parties (e.g. mobile money system supplier)\n- Check the contracts specify adherence to the provider's security policy and processes.\n"},{"$f":"All!L364","v":0},{"$f":"All!M364","v":"Urgent Required"},{"$f":"All!N364","v":"Required"},{"$f":"All!O364","v":"TechOps"},{"$f":"All!P364","v":0},{"$f":"All!Q364","v":0},{"$f":"All!R364","v":0},{"$f":"All!S364","v":0},{"$f":"All!T364","v":0},{"$f":"All!U364","v":0},{"$f":"All!V364","v":0},{"$f":"All!W364","v":0},{"$f":"All!X364","v":0},{"$f":"All!Y364","v":0},{"$f":"All!Z364","v":0},{"$f":"All!AA364","v":0},{"$f":"All!AB364","v":0},{"$f":"All!AC364","v":0},{"$f":"All!AD364","v":0},{"$f":"All!AE364","v":0},{"$f":"All!AF364","v":0},{"$f":"All!AG364","v":0},{"$f":"All!AH364","v":0},{"$f":"All!AI364","v":0},{"$f":"All!AJ364","v":0},{"$f":"All!AK364","v":0},{"$f":"All!AL364","v":0},{"$f":"All!AM364","v":0},{"$f":"All!AN364","v":0},{"$f":"All!AO364","v":0},{"$f":"All!AP364","v":0},{"$f":"All!AQ364","v":0},{"$f":"All!AR364","v":0},{"$f":"All!AS364","v":0},{"$f":"All!AT364","v":0}]
[null,{"$f":"All!B365","v":"5"},{"$f":"All!C365","v":"5.1"},{"$f":"All!D365","v":"5.1.4"},{"$f":"All!E365","v":0},{"$f":"All!F365","v":"5.1.4.2"},{"$f":"All!G365","v":"5.1.4.2: SECURITY BRIEFING AND REVIEWS FOR THIRD PARTIES\nThird parties and suppliers should be briefed on the security policy and their security obligations before being granted access to the mobile money system, including:\n - protection of physical and information assets;\n - current security threats; and\n - promotion of the importance of customer data security.\n\nPeriodic reviews should be performed to ensure that the mobile money security policy is being adhered to."},{"$f":"All!H365","v":"ISO 27002:2013 Sec. 15.1 "},{"$f":"All!I365","v":"5.1.4.2.1"},{"$f":"All!J365","v":"5.1.4.2.1: Have suppliers and third parties been briefed on the security policy and their security obligations, and are periodic reviews performed to verify adherence to the security policy?\n"},{"$f":"All!K365","v":0},{"$f":"All!L365","v":0},{"$f":"All!M365","v":"Recommended"},{"$f":"All!N365","v":"Recommended"},{"$f":"All!O365","v":"TechOps"},{"$f":"All!P365","v":0},{"$f":"All!Q365","v":0},{"$f":"All!R365","v":0},{"$f":"All!S365","v":0},{"$f":"All!T365","v":0},{"$f":"All!U365","v":0},{"$f":"All!V365","v":0},{"$f":"All!W365","v":0},{"$f":"All!X365","v":0},{"$f":"All!Y365","v":0},{"$f":"All!Z365","v":0},{"$f":"All!AA365","v":0},{"$f":"All!AB365","v":0},{"$f":"All!AC365","v":0},{"$f":"All!AD365","v":0},{"$f":"All!AE365","v":0},{"$f":"All!AF365","v":0},{"$f":"All!AG365","v":0},{"$f":"All!AH365","v":0},{"$f":"All!AI365","v":0},{"$f":"All!AJ365","v":0},{"$f":"All!AK365","v":0},{"$f":"All!AL365","v":0},{"$f":"All!AM365","v":0},{"$f":"All!AN365","v":0},{"$f":"All!AO365","v":0},{"$f":"All!AP365","v":0},{"$f":"All!AQ365","v":0},{"$f":"All!AR365","v":0},{"$f":"All!AS365","v":0},{"$f":"All!AT365","v":0}]
[null,{"$f":"All!B366","v":"5"},{"$f":"All!C366","v":"5.2"},{"$f":"All!D366","v":"5.2.1"},{"$f":"All!E366","v":"5.2.1: Providers shall ensure that data is protected by cryptography and network security controls"},{"$f":"All!F366","v":"5.2.1.1"},{"$f":"All!G366","v":"5.2.1.1: ENCRYPTION POLICY\nProviders should develop a policy on the use of cryptographic controls for protection of customer data, transactions and security credentials. \n\nThe policy should define when encryption is required, and which data should be encrypted. For example, encryption may be required for:\n- sensitive data within the mobile money system;\n- data transmitted externally; and\n- security credentials or customer account data.\n\nThe approach to key management should also be defined in the policy (see 5.2.1.4).\n\nCryptographic algorithms and key lengths should be selected according to best practice and local laws."},{"$f":"All!H366","v":"ISO 27002:2013 Sec. 10"},{"$f":"All!I366","v":"5.2.1.1.1"},{"$f":"All!J366","v":"5.2.1.1.1: Is there a data encryption policy that defines when cryptographic controls are required to protect mobile money data, such as when data is transmitted externally or security credentials are held in the system?\n"},{"$f":"All!K366","v":"1) Security policy or equivalent compliance framework or audit documentation\n- Check that the policy is documented and approved by current senior management\n- Check it outlines when cryptographic controls required to protect mobile money data\n(note: this should include when data is transmitted externally or security credentials are held on the system etc.)"},{"$f":"All!L366","v":0},{"$f":"All!M366","v":"Recommended"},{"$f":"All!N366","v":"Recommended"},{"$f":"All!O366","v":"TechOps"},{"$f":"All!P366","v":0},{"$f":"All!Q366","v":0},{"$f":"All!R366","v":0},{"$f":"All!S366","v":0},{"$f":"All!T366","v":0},{"$f":"All!U366","v":0},{"$f":"All!V366","v":0},{"$f":"All!W366","v":0},{"$f":"All!X366","v":0},{"$f":"All!Y366","v":0},{"$f":"All!Z366","v":0},{"$f":"All!AA366","v":0},{"$f":"All!AB366","v":0},{"$f":"All!AC366","v":0},{"$f":"All!AD366","v":0},{"$f":"All!AE366","v":0},{"$f":"All!AF366","v":0},{"$f":"All!AG366","v":0},{"$f":"All!AH366","v":0},{"$f":"All!AI366","v":0},{"$f":"All!AJ366","v":0},{"$f":"All!AK366","v":0},{"$f":"All!AL366","v":0},{"$f":"All!AM366","v":0},{"$f":"All!AN366","v":0},{"$f":"All!AO366","v":0},{"$f":"All!AP366","v":0},{"$f":"All!AQ366","v":0},{"$f":"All!AR366","v":0},{"$f":"All!AS366","v":0},{"$f":"All!AT366","v":0}]
[null,{"$f":"All!B367","v":"5"},{"$f":"All!C367","v":"5.2"},{"$f":"All!D367","v":"5.2.1"},{"$f":"All!E367","v":"5.2.1: Providers shall ensure that data is protected by cryptography and network security controls"},{"$f":"All!F367","v":"5.2.1.2"},{"$f":"All!G367","v":"5.2.1.2: ENCRYPTION CONTROLS - SENSITIVE DATA\nAll security credentials (PINs, passwords, etc.) should be stored using at minimum a strong cryptographic hash function with a salted hash. It is recomended that a hash be chosen such that it is computationally impractical to generate any other string that generates the same hash.\n\nAlternatively, providers should consider encrypting PINs and passwords using a Hardware Security Module (HSM) or other method to harden the level of security. Providers may also consider encrypting all stored customer account data for additional security."},{"$f":"All!H367","v":"PCI DSS, ISO 27002: 2013 Sec. 10, 12.1 "},{"$f":"All!I367","v":"5.2.1.2.1"},{"$f":"All!J367","v":"5.2.1.2.1: Are all security credentials (PINs, passwords, etc.) stored using either a strong cryptograpic hash with salt or strong encryption?\n"},{"$f":"All!K367","v":"1) System architecture specification \n- Check the documentation outlines the encryption requirements for all security credentials \n- Check PINs and passwords are secured using a cryptographic hash with salt, or encryption with a Hardware Security Module (HSM) or equivalent.\n\n\n\n"},{"$f":"All!L367","v":0},{"$f":"All!M367","v":"Urgent Required"},{"$f":"All!N367","v":"Required"},{"$f":"All!O367","v":"TechOps"},{"$f":"All!P367","v":0},{"$f":"All!Q367","v":0},{"$f":"All!R367","v":0},{"$f":"All!S367","v":0},{"$f":"All!T367","v":0},{"$f":"All!U367","v":0},{"$f":"All!V367","v":0},{"$f":"All!W367","v":0},{"$f":"All!X367","v":0},{"$f":"All!Y367","v":0},{"$f":"All!Z367","v":0},{"$f":"All!AA367","v":0},{"$f":"All!AB367","v":0},{"$f":"All!AC367","v":0},{"$f":"All!AD367","v":0},{"$f":"All!AE367","v":0},{"$f":"All!AF367","v":0},{"$f":"All!AG367","v":0},{"$f":"All!AH367","v":0},{"$f":"All!AI367","v":0},{"$f":"All!AJ367","v":0},{"$f":"All!AK367","v":0},{"$f":"All!AL367","v":0},{"$f":"All!AM367","v":0},{"$f":"All!AN367","v":0},{"$f":"All!AO367","v":0},{"$f":"All!AP367","v":0},{"$f":"All!AQ367","v":0},{"$f":"All!AR367","v":0},{"$f":"All!AS367","v":0},{"$f":"All!AT367","v":0}]
[null,{"$f":"All!B368","v":"5"},{"$f":"All!C368","v":"5.2"},{"$f":"All!D368","v":"5.2.1"},{"$f":"All!E368","v":""},{"$f":"All!F368","v":"5.2.1.2"},{"$f":"All!G368","v":0},{"$f":"All!H368","v":0},{"$f":"All!I368","v":"5.2.1.2.2"},{"$f":"All!J368","v":"5.2.1.2.2: Has all stored customer account data been encrypted for additional security?\n"},{"$f":"All!K368","v":0},{"$f":"All!L368","v":0},{"$f":"All!M368","v":"Recommended"},{"$f":"All!N368","v":"Recommended"},{"$f":"All!O368","v":"TechOps"},{"$f":"All!P368","v":0},{"$f":"All!Q368","v":0},{"$f":"All!R368","v":0},{"$f":"All!S368","v":0},{"$f":"All!T368","v":0},{"$f":"All!U368","v":0},{"$f":"All!V368","v":0},{"$f":"All!W368","v":0},{"$f":"All!X368","v":0},{"$f":"All!Y368","v":0},{"$f":"All!Z368","v":0},{"$f":"All!AA368","v":0},{"$f":"All!AB368","v":0},{"$f":"All!AC368","v":0},{"$f":"All!AD368","v":0},{"$f":"All!AE368","v":0},{"$f":"All!AF368","v":0},{"$f":"All!AG368","v":0},{"$f":"All!AH368","v":0},{"$f":"All!AI368","v":0},{"$f":"All!AJ368","v":0},{"$f":"All!AK368","v":0},{"$f":"All!AL368","v":0},{"$f":"All!AM368","v":0},{"$f":"All!AN368","v":0},{"$f":"All!AO368","v":0},{"$f":"All!AP368","v":0},{"$f":"All!AQ368","v":0},{"$f":"All!AR368","v":0},{"$f":"All!AS368","v":0},{"$f":"All!AT368","v":0}]
[null,{"$f":"All!B369","v":"5"},{"$f":"All!C369","v":"5.2"},{"$f":"All!D369","v":"5.2.1"},{"$f":"All!E369","v":""},{"$f":"All!F369","v":"5.2.1.3"},{"$f":"All!G369","v":"5.2.1.3: ENCRYPTION CONTROLS - EXTERNAL CONNECTIONS\nTransactions and customer data (especially security credentials) should be encrypted with strong cryptography (e.g. SSL/TLS, IPSEC, SSH) whenever they are transmitted outside the mobile money system. Data transfer mechanisms must prevent data from interception, copying, modification, misrouting and destruction by ensuring:\n- data integrity (data has not been tampered with);\n- confidentiality (data can not be read by unauthorised party); and\n- authentication (connected parties are identified).\n\nEncryption should be implemented for these external connections, at minimum:\n- all connectivity over the Internet;\n- API connections to third parties; and\n- connectivity to smartphones and PoS devices.\n\nThe following cryptographic controls should be implemented:\n- Electronic signatures should be used by each of the parties involved in the transaction to verify identity of both client and server;\n- When exchanging transactions with external systems, electronic signatures / certificates should be used by each of the parties involved to verify identity of both client and server, and the end-to end certificate handling process should be secure;\n- Data integrity of all messages should be ensured via a suitable mechanism, such as digital signatures or message authentication codes;\n- The implemented security protocols should use only secure versions and secure configurations; and\n- Appropriate encryption strength should be implemented for the encryption methodology in use, following vendor recommendations/ best practices."},{"$f":"All!H369","v":"ISO 27002:2013 Sec. 10, PCI DSS"},{"$f":"All!I369","v":"5.2.1.3.1"},{"$f":"All!J369","v":"5.2.1.3.1: Is all transaction data and customer data encrypted when transmitted externally (e.g. to financial ecosystem partners / merchants / businesses)?\n"},{"$f":"All!K369","v":"1) System architecture specification / interface specifications\n- Check that every external interface and its encryption is documented.\n- Check that all transactions data encrypted when transmitted externally (e.g. to financial ecosystem partners / merchants / businesses)."},{"$f":"All!L369","v":0},{"$f":"All!M369","v":"Urgent Required"},{"$f":"All!N369","v":"Required"},{"$f":"All!O369","v":"TechOps"},{"$f":"All!P369","v":0},{"$f":"All!Q369","v":0},{"$f":"All!R369","v":0},{"$f":"All!S369","v":0},{"$f":"All!T369","v":0},{"$f":"All!U369","v":0},{"$f":"All!V369","v":0},{"$f":"All!W369","v":0},{"$f":"All!X369","v":0},{"$f":"All!Y369","v":0},{"$f":"All!Z369","v":0},{"$f":"All!AA369","v":0},{"$f":"All!AB369","v":0},{"$f":"All!AC369","v":0},{"$f":"All!AD369","v":0},{"$f":"All!AE369","v":0},{"$f":"All!AF369","v":0},{"$f":"All!AG369","v":0},{"$f":"All!AH369","v":0},{"$f":"All!AI369","v":0},{"$f":"All!AJ369","v":0},{"$f":"All!AK369","v":0},{"$f":"All!AL369","v":0},{"$f":"All!AM369","v":0},{"$f":"All!AN369","v":0},{"$f":"All!AO369","v":0},{"$f":"All!AP369","v":0},{"$f":"All!AQ369","v":0},{"$f":"All!AR369","v":0},{"$f":"All!AS369","v":0},{"$f":"All!AT369","v":0}]
[null,{"$f":"All!B370","v":"5"},{"$f":"All!C370","v":"5.2"},{"$f":"All!D370","v":"5.2.1"},{"$f":"All!E370","v":""},{"$f":"All!F370","v":"5.2.1.3"},{"$f":"All!G370","v":0},{"$f":"All!H370","v":0},{"$f":"All!I370","v":"5.2.1.3.2"},{"$f":"All!J370","v":"5.2.1.3.2: Are transactions encrypted when transmitted to and from smartphones?\n"},{"$f":"All!K370","v":0},{"$f":"All!L370","v":0},{"$f":"All!M370","v":"Recommended"},{"$f":"All!N370","v":"Recommended"},{"$f":"All!O370","v":"TechOps"},{"$f":"All!P370","v":0},{"$f":"All!Q370","v":0},{"$f":"All!R370","v":0},{"$f":"All!S370","v":0},{"$f":"All!T370","v":0},{"$f":"All!U370","v":0},{"$f":"All!V370","v":0},{"$f":"All!W370","v":0},{"$f":"All!X370","v":0},{"$f":"All!Y370","v":0},{"$f":"All!Z370","v":0},{"$f":"All!AA370","v":0},{"$f":"All!AB370","v":0},{"$f":"All!AC370","v":0},{"$f":"All!AD370","v":0},{"$f":"All!AE370","v":0},{"$f":"All!AF370","v":0},{"$f":"All!AG370","v":0},{"$f":"All!AH370","v":0},{"$f":"All!AI370","v":0},{"$f":"All!AJ370","v":0},{"$f":"All!AK370","v":0},{"$f":"All!AL370","v":0},{"$f":"All!AM370","v":0},{"$f":"All!AN370","v":0},{"$f":"All!AO370","v":0},{"$f":"All!AP370","v":0},{"$f":"All!AQ370","v":0},{"$f":"All!AR370","v":0},{"$f":"All!AS370","v":0},{"$f":"All!AT370","v":0}]
[null,{"$f":"All!B371","v":"5"},{"$f":"All!C371","v":"5.2"},{"$f":"All!D371","v":"5.2.1"},{"$f":"All!E371","v":""},{"$f":"All!F371","v":"5.2.1.3"},{"$f":"All!G371","v":0},{"$f":"All!H371","v":0},{"$f":"All!I371","v":"5.2.1.3.3"},{"$f":"All!J371","v":"5.2.1.3.3: When exchanging transactions with external systems, are electronic signatures / certificates used by each of the parties involved to verify identity of both client and server, and is the end-to end certificate handling process secure?\n"},{"$f":"All!K371","v":0},{"$f":"All!L371","v":0},{"$f":"All!M371","v":"Recommended"},{"$f":"All!N371","v":"Recommended"},{"$f":"All!O371","v":"TechOps"},{"$f":"All!P371","v":0},{"$f":"All!Q371","v":0},{"$f":"All!R371","v":0},{"$f":"All!S371","v":0},{"$f":"All!T371","v":0},{"$f":"All!U371","v":0},{"$f":"All!V371","v":0},{"$f":"All!W371","v":0},{"$f":"All!X371","v":0},{"$f":"All!Y371","v":0},{"$f":"All!Z371","v":0},{"$f":"All!AA371","v":0},{"$f":"All!AB371","v":0},{"$f":"All!AC371","v":0},{"$f":"All!AD371","v":0},{"$f":"All!AE371","v":0},{"$f":"All!AF371","v":0},{"$f":"All!AG371","v":0},{"$f":"All!AH371","v":0},{"$f":"All!AI371","v":0},{"$f":"All!AJ371","v":0},{"$f":"All!AK371","v":0},{"$f":"All!AL371","v":0},{"$f":"All!AM371","v":0},{"$f":"All!AN371","v":0},{"$f":"All!AO371","v":0},{"$f":"All!AP371","v":0},{"$f":"All!AQ371","v":0},{"$f":"All!AR371","v":0},{"$f":"All!AS371","v":0},{"$f":"All!AT371","v":0}]
[null,{"$f":"All!B372","v":"5"},{"$f":"All!C372","v":"5.2"},{"$f":"All!D372","v":"5.2.1"},{"$f":"All!E372","v":""},{"$f":"All!F372","v":"5.2.1.3"},{"$f":"All!G372","v":0},{"$f":"All!H372","v":0},{"$f":"All!I372","v":"5.2.1.3.4"},{"$f":"All!J372","v":"5.2.1.3.4: Have the security protocols for encrypting external data connections been implemented with secure versions and secure configurations?\n"},{"$f":"All!K372","v":0},{"$f":"All!L372","v":0},{"$f":"All!M372","v":"Recommended"},{"$f":"All!N372","v":"Recommended"},{"$f":"All!O372","v":"TechOps"},{"$f":"All!P372","v":0},{"$f":"All!Q372","v":0},{"$f":"All!R372","v":0},{"$f":"All!S372","v":0},{"$f":"All!T372","v":0},{"$f":"All!U372","v":0},{"$f":"All!V372","v":0},{"$f":"All!W372","v":0},{"$f":"All!X372","v":0},{"$f":"All!Y372","v":0},{"$f":"All!Z372","v":0},{"$f":"All!AA372","v":0},{"$f":"All!AB372","v":0},{"$f":"All!AC372","v":0},{"$f":"All!AD372","v":0},{"$f":"All!AE372","v":0},{"$f":"All!AF372","v":0},{"$f":"All!AG372","v":0},{"$f":"All!AH372","v":0},{"$f":"All!AI372","v":0},{"$f":"All!AJ372","v":0},{"$f":"All!AK372","v":0},{"$f":"All!AL372","v":0},{"$f":"All!AM372","v":0},{"$f":"All!AN372","v":0},{"$f":"All!AO372","v":0},{"$f":"All!AP372","v":0},{"$f":"All!AQ372","v":0},{"$f":"All!AR372","v":0},{"$f":"All!AS372","v":0},{"$f":"All!AT372","v":0}]
[null,{"$f":"All!B373","v":"5"},{"$f":"All!C373","v":"5.2"},{"$f":"All!D373","v":"5.2.1"},{"$f":"All!E373","v":""},{"$f":"All!F373","v":"5.2.1.3"},{"$f":"All!G373","v":0},{"$f":"All!H373","v":0},{"$f":"All!I373","v":"5.2.1.3.5"},{"$f":"All!J373","v":"5.2.1.3.5: Has appropriate encryption strength been implemented for the encryption methodology in use, following vendor recommendations/ best practices?\n"},{"$f":"All!K373","v":0},{"$f":"All!L373","v":0},{"$f":"All!M373","v":"Recommended"},{"$f":"All!N373","v":"Recommended"},{"$f":"All!O373","v":"TechOps"},{"$f":"All!P373","v":0},{"$f":"All!Q373","v":0},{"$f":"All!R373","v":0},{"$f":"All!S373","v":0},{"$f":"All!T373","v":0},{"$f":"All!U373","v":0},{"$f":"All!V373","v":0},{"$f":"All!W373","v":0},{"$f":"All!X373","v":0},{"$f":"All!Y373","v":0},{"$f":"All!Z373","v":0},{"$f":"All!AA373","v":0},{"$f":"All!AB373","v":0},{"$f":"All!AC373","v":0},{"$f":"All!AD373","v":0},{"$f":"All!AE373","v":0},{"$f":"All!AF373","v":0},{"$f":"All!AG373","v":0},{"$f":"All!AH373","v":0},{"$f":"All!AI373","v":0},{"$f":"All!AJ373","v":0},{"$f":"All!AK373","v":0},{"$f":"All!AL373","v":0},{"$f":"All!AM373","v":0},{"$f":"All!AN373","v":0},{"$f":"All!AO373","v":0},{"$f":"All!AP373","v":0},{"$f":"All!AQ373","v":0},{"$f":"All!AR373","v":0},{"$f":"All!AS373","v":0},{"$f":"All!AT373","v":0}]
[null,{"$f":"All!B374","v":"5"},{"$f":"All!C374","v":"5.2"},{"$f":"All!D374","v":"5.2.1"},{"$f":"All!E374","v":""},{"$f":"All!F374","v":"5.2.1.4"},{"$f":"All!G374","v":"5.2.1.4: ENCRYPTION KEY MANAGEMENT\nIf PINs/passwords are encrypted, providers should implement robust key-management procedures for protecting encryption keys. The whole lifecycle should be documented, including generating, storing, retrieving, distributing, retiring, archiving and destroying keys. \n\nKey custodians should be nominated and should formally acknowledge that they understand their key-custodian responsibilities and processes.\n\nKey management processes should include the following:\n- store keys securely and protect equipment used to generate, store and archive keys. \n- ideally, store keys in an encrypted format and store key-encrypting keys separately from data-encrypting keys;\n- restrict access to keys to the fewest custodians necessary;\n- store keys in the fewest possible locations and forms;\n- prevent reuse of retired security keys when changing keys;\n- replace keys when the integrity of the key has been weakened or is suspect;\n- split knowledge and control of keys where manual clear-text keys are used;\n- backup keys and certificates securely and sufficiently to protect against system failure or disaster;\n- use sufficiently random numbers for cryptographic key generation (this is a common failing).\n"},{"$f":"All!H374","v":"ISO 27002: 2013 Sec. 10, 12.1,\nPCI DSS"},{"$f":"All!I374","v":"5.2.1.4.1"},{"$f":"All!J374","v":"5.2.1.4.1: If PINs/passwords are encrypted, have robust procedures been implemented for protecting encryption keys throughout the whole lifecycle of generating, storing, retrieving, distributing, retiring, archiving and destroying keys?\n"},{"$f":"All!K374","v":"1) Encryption key management process.\n- Check there are processes for protecting encryption keys and certificates\n- Check the process covers requirements for:\na) Generating\nb) Storing\nc) Retrieving\nd) Distribution\ne) Retiring\nf) Archiving \ng) Destroying keys and certificates\n- Check that the procedure give consideration to both physical and logical security requirements\n\n[If encryption is not used to secure PINs/passwords/data then this can be marked N/A]"},{"$f":"All!L374","v":0},{"$f":"All!M374","v":"Recommended"},{"$f":"All!N374","v":"Recommended"},{"$f":"All!O374","v":"TechOps"},{"$f":"All!P374","v":0},{"$f":"All!Q374","v":0},{"$f":"All!R374","v":0},{"$f":"All!S374","v":0},{"$f":"All!T374","v":0},{"$f":"All!U374","v":0},{"$f":"All!V374","v":0},{"$f":"All!W374","v":0},{"$f":"All!X374","v":0},{"$f":"All!Y374","v":0},{"$f":"All!Z374","v":0},{"$f":"All!AA374","v":0},{"$f":"All!AB374","v":0},{"$f":"All!AC374","v":0},{"$f":"All!AD374","v":0},{"$f":"All!AE374","v":0},{"$f":"All!AF374","v":0},{"$f":"All!AG374","v":0},{"$f":"All!AH374","v":0},{"$f":"All!AI374","v":0},{"$f":"All!AJ374","v":0},{"$f":"All!AK374","v":0},{"$f":"All!AL374","v":0},{"$f":"All!AM374","v":0},{"$f":"All!AN374","v":0},{"$f":"All!AO374","v":0},{"$f":"All!AP374","v":0},{"$f":"All!AQ374","v":0},{"$f":"All!AR374","v":0},{"$f":"All!AS374","v":0},{"$f":"All!AT374","v":0}]
[null,{"$f":"All!B375","v":"5"},{"$f":"All!C375","v":"5.2"},{"$f":"All!D375","v":"5.2.1"},{"$f":"All!E375","v":""},{"$f":"All!F375","v":"5.2.1.4"},{"$f":"All!G375","v":0},{"$f":"All!H375","v":0},{"$f":"All!I375","v":"5.2.1.4.2"},{"$f":"All!J375","v":"5.2.1.4.2: If PINs/passwords are encrypted, have encryption key custodians been nominated and formally acknowledged that they understand their key-custodian responsibilities and processes?\n"},{"$f":"All!K375","v":"1) Encryption policy\n- Check the policy states who the custodians of the keys are\n- Check the custodians have received a briefing regarding their responsibilities and the processes they are required to undertake\n- Check the custodians have formally acknowledged and understand their role\n\n[If encryption is not used to secure PINs/passwords/data then this can be marked N/A]"},{"$f":"All!L375","v":0},{"$f":"All!M375","v":"Standard Required"},{"$f":"All!N375","v":"Required"},{"$f":"All!O375","v":"TechOps"},{"$f":"All!P375","v":0},{"$f":"All!Q375","v":0},{"$f":"All!R375","v":0},{"$f":"All!S375","v":0},{"$f":"All!T375","v":0},{"$f":"All!U375","v":0},{"$f":"All!V375","v":0},{"$f":"All!W375","v":0},{"$f":"All!X375","v":0},{"$f":"All!Y375","v":0},{"$f":"All!Z375","v":0},{"$f":"All!AA375","v":0},{"$f":"All!AB375","v":0},{"$f":"All!AC375","v":0},{"$f":"All!AD375","v":0},{"$f":"All!AE375","v":0},{"$f":"All!AF375","v":0},{"$f":"All!AG375","v":0},{"$f":"All!AH375","v":0},{"$f":"All!AI375","v":0},{"$f":"All!AJ375","v":0},{"$f":"All!AK375","v":0},{"$f":"All!AL375","v":0},{"$f":"All!AM375","v":0},{"$f":"All!AN375","v":0},{"$f":"All!AO375","v":0},{"$f":"All!AP375","v":0},{"$f":"All!AQ375","v":0},{"$f":"All!AR375","v":0},{"$f":"All!AS375","v":0},{"$f":"All!AT375","v":0}]
[null,{"$f":"All!B376","v":"5"},{"$f":"All!C376","v":"5.2"},{"$f":"All!D376","v":"5.2.1"},{"$f":"All!E376","v":""},{"$f":"All!F376","v":"5.2.1.4"},{"$f":"All!G376","v":0},{"$f":"All!H376","v":0},{"$f":"All!I376","v":"5.2.1.4.3"},{"$f":"All!J376","v":"5.2.1.4.3: If PINs/passwords are encrypted, are encryption keys stored securely and protected against disaster, and is equipment used to generate, store and archive keys protected?\n"},{"$f":"All!K376","v":"1) Encryption policy\n- Check there are processes for the secure storage of the keys\n- Check that keys are protected against key storage system failure or disaster.\n- Check that are security measures to protect any equipment that is used to store the keys.\n\n[If encryption is not used to secure PINs/passwords/data then this can be marked N/A]"},{"$f":"All!L376","v":0},{"$f":"All!M376","v":"Urgent Required"},{"$f":"All!N376","v":"Required"},{"$f":"All!O376","v":"TechOps"},{"$f":"All!P376","v":0},{"$f":"All!Q376","v":0},{"$f":"All!R376","v":0},{"$f":"All!S376","v":0},{"$f":"All!T376","v":0},{"$f":"All!U376","v":0},{"$f":"All!V376","v":0},{"$f":"All!W376","v":0},{"$f":"All!X376","v":0},{"$f":"All!Y376","v":0},{"$f":"All!Z376","v":0},{"$f":"All!AA376","v":0},{"$f":"All!AB376","v":0},{"$f":"All!AC376","v":0},{"$f":"All!AD376","v":0},{"$f":"All!AE376","v":0},{"$f":"All!AF376","v":0},{"$f":"All!AG376","v":0},{"$f":"All!AH376","v":0},{"$f":"All!AI376","v":0},{"$f":"All!AJ376","v":0},{"$f":"All!AK376","v":0},{"$f":"All!AL376","v":0},{"$f":"All!AM376","v":0},{"$f":"All!AN376","v":0},{"$f":"All!AO376","v":0},{"$f":"All!AP376","v":0},{"$f":"All!AQ376","v":0},{"$f":"All!AR376","v":0},{"$f":"All!AS376","v":0},{"$f":"All!AT376","v":0}]
[null,{"$f":"All!B377","v":"5"},{"$f":"All!C377","v":"5.2"},{"$f":"All!D377","v":"5.2.1"},{"$f":"All!E377","v":""},{"$f":"All!F377","v":"5.2.1.4"},{"$f":"All!G377","v":0},{"$f":"All!H377","v":0},{"$f":"All!I377","v":"5.2.1.4.4"},{"$f":"All!J377","v":"5.2.1.4.4: Are keys stored in an encrypted format and key-encrypting keys stored separately from data-encrypting keys?\n"},{"$f":"All!K377","v":0},{"$f":"All!L377","v":0},{"$f":"All!M377","v":"Recommended"},{"$f":"All!N377","v":"Recommended"},{"$f":"All!O377","v":"TechOps"},{"$f":"All!P377","v":0},{"$f":"All!Q377","v":0},{"$f":"All!R377","v":0},{"$f":"All!S377","v":0},{"$f":"All!T377","v":0},{"$f":"All!U377","v":0},{"$f":"All!V377","v":0},{"$f":"All!W377","v":0},{"$f":"All!X377","v":0},{"$f":"All!Y377","v":0},{"$f":"All!Z377","v":0},{"$f":"All!AA377","v":0},{"$f":"All!AB377","v":0},{"$f":"All!AC377","v":0},{"$f":"All!AD377","v":0},{"$f":"All!AE377","v":0},{"$f":"All!AF377","v":0},{"$f":"All!AG377","v":0},{"$f":"All!AH377","v":0},{"$f":"All!AI377","v":0},{"$f":"All!AJ377","v":0},{"$f":"All!AK377","v":0},{"$f":"All!AL377","v":0},{"$f":"All!AM377","v":0},{"$f":"All!AN377","v":0},{"$f":"All!AO377","v":0},{"$f":"All!AP377","v":0},{"$f":"All!AQ377","v":0},{"$f":"All!AR377","v":0},{"$f":"All!AS377","v":0},{"$f":"All!AT377","v":0}]
[null,{"$f":"All!B378","v":"5"},{"$f":"All!C378","v":"5.2"},{"$f":"All!D378","v":"5.2.1"},{"$f":"All!E378","v":""},{"$f":"All!F378","v":"5.2.1.4"},{"$f":"All!G378","v":0},{"$f":"All!H378","v":0},{"$f":"All!I378","v":"5.2.1.4.5"},{"$f":"All!J378","v":"5.2.1.4.5: If manual clear-text keys are used, do key-management procedures require split knowledge and dual control of keys?\n"},{"$f":"All!K378","v":0},{"$f":"All!L378","v":0},{"$f":"All!M378","v":"Recommended"},{"$f":"All!N378","v":"Recommended"},{"$f":"All!O378","v":"TechOps"},{"$f":"All!P378","v":0},{"$f":"All!Q378","v":0},{"$f":"All!R378","v":0},{"$f":"All!S378","v":0},{"$f":"All!T378","v":0},{"$f":"All!U378","v":0},{"$f":"All!V378","v":0},{"$f":"All!W378","v":0},{"$f":"All!X378","v":0},{"$f":"All!Y378","v":0},{"$f":"All!Z378","v":0},{"$f":"All!AA378","v":0},{"$f":"All!AB378","v":0},{"$f":"All!AC378","v":0},{"$f":"All!AD378","v":0},{"$f":"All!AE378","v":0},{"$f":"All!AF378","v":0},{"$f":"All!AG378","v":0},{"$f":"All!AH378","v":0},{"$f":"All!AI378","v":0},{"$f":"All!AJ378","v":0},{"$f":"All!AK378","v":0},{"$f":"All!AL378","v":0},{"$f":"All!AM378","v":0},{"$f":"All!AN378","v":0},{"$f":"All!AO378","v":0},{"$f":"All!AP378","v":0},{"$f":"All!AQ378","v":0},{"$f":"All!AR378","v":0},{"$f":"All!AS378","v":0},{"$f":"All!AT378","v":0}]
[null,{"$f":"All!B379","v":"5"},{"$f":"All!C379","v":"5.2"},{"$f":"All!D379","v":"5.2.1"},{"$f":"All!E379","v":""},{"$f":"All!F379","v":"5.2.1.4"},{"$f":"All!G379","v":0},{"$f":"All!H379","v":0},{"$f":"All!I379","v":"5.2.1.4.6"},{"$f":"All!J379","v":"5.2.1.4.6: Are sufficiently random numbers used for cryptographic key generation?\n"},{"$f":"All!K379","v":0},{"$f":"All!L379","v":0},{"$f":"All!M379","v":"Recommended"},{"$f":"All!N379","v":"Recommended"},{"$f":"All!O379","v":"TechOps"},{"$f":"All!P379","v":0},{"$f":"All!Q379","v":0},{"$f":"All!R379","v":0},{"$f":"All!S379","v":0},{"$f":"All!T379","v":0},{"$f":"All!U379","v":0},{"$f":"All!V379","v":0},{"$f":"All!W379","v":0},{"$f":"All!X379","v":0},{"$f":"All!Y379","v":0},{"$f":"All!Z379","v":0},{"$f":"All!AA379","v":0},{"$f":"All!AB379","v":0},{"$f":"All!AC379","v":0},{"$f":"All!AD379","v":0},{"$f":"All!AE379","v":0},{"$f":"All!AF379","v":0},{"$f":"All!AG379","v":0},{"$f":"All!AH379","v":0},{"$f":"All!AI379","v":0},{"$f":"All!AJ379","v":0},{"$f":"All!AK379","v":0},{"$f":"All!AL379","v":0},{"$f":"All!AM379","v":0},{"$f":"All!AN379","v":0},{"$f":"All!AO379","v":0},{"$f":"All!AP379","v":0},{"$f":"All!AQ379","v":0},{"$f":"All!AR379","v":0},{"$f":"All!AS379","v":0},{"$f":"All!AT379","v":0}]
[null,{"$f":"All!B380","v":"5"},{"$f":"All!C380","v":"5.2"},{"$f":"All!D380","v":"5.2.1"},{"$f":"All!E380","v":""},{"$f":"All!F380","v":"5.2.1.5"},{"$f":"All!G380","v":"5.2.1.5: AD-HOC AND OFFLINE DATA TRANSFER\nAn data transfer policy or process should be implemented that defines how offline and ad-hoc transfers of mobile money data to/from third parties should be done (i.e. to/from agents, entities providing outsourced services, and financial ecosystem partners).\n\nThe detailed security measures to ensure the confidentiality and integrity of the data should be documented (e.g. encryption, anonymization).\n"},{"$f":"All!H380","v":"ISO 27002:2013 Sec. 13.2 "},{"$f":"All!I380","v":"5.2.1.5.1"},{"$f":"All!J380","v":"5.2.1.5.1: Has a data transfer policy or process been implemented that defines how offline and ad-hoc transfers of mobile money data to/from third parties should be done, including the detailed security measures to ensure the confidentiality and integrity of the data?\n"},{"$f":"All!K380","v":"1) Data protection policy, security policy, process or equivalent.\n- Check the document specifies how the data should be protected (e.g. anonymisation, encryption).\n- Check the document identifies applicable data (e.g. via classification level).\n- Check the policy covers all ad-hoc and offline external data transfers.\n"},{"$f":"All!L380","v":0},{"$f":"All!M380","v":"Standard Required"},{"$f":"All!N380","v":"Required"},{"$f":"All!O380","v":"TechOps"},{"$f":"All!P380","v":0},{"$f":"All!Q380","v":0},{"$f":"All!R380","v":0},{"$f":"All!S380","v":0},{"$f":"All!T380","v":0},{"$f":"All!U380","v":0},{"$f":"All!V380","v":0},{"$f":"All!W380","v":0},{"$f":"All!X380","v":0},{"$f":"All!Y380","v":0},{"$f":"All!Z380","v":0},{"$f":"All!AA380","v":0},{"$f":"All!AB380","v":0},{"$f":"All!AC380","v":0},{"$f":"All!AD380","v":0},{"$f":"All!AE380","v":0},{"$f":"All!AF380","v":0},{"$f":"All!AG380","v":0},{"$f":"All!AH380","v":0},{"$f":"All!AI380","v":0},{"$f":"All!AJ380","v":0},{"$f":"All!AK380","v":0},{"$f":"All!AL380","v":0},{"$f":"All!AM380","v":0},{"$f":"All!AN380","v":0},{"$f":"All!AO380","v":0},{"$f":"All!AP380","v":0},{"$f":"All!AQ380","v":0},{"$f":"All!AR380","v":0},{"$f":"All!AS380","v":0},{"$f":"All!AT380","v":0}]
[null,{"$f":"All!B381","v":"5"},{"$f":"All!C381","v":"5.2"},{"$f":"All!D381","v":"5.2.1"},{"$f":"All!E381","v":""},{"$f":"All!F381","v":"5.2.1.6"},{"$f":"All!G381","v":"5.2.1.6: NETWORK SECURITY\nExternal connectivity of the mobile money system should be protected with firewalls to only allow authorized traffic and protect access to customer data. An external-facing DMZ should be established that is separate from the internal network segment (see 5.2.1.8). Sensitive mobile money system components should be located in the internal network segment, segregated from the DMZ and other untrusted networks.\n\nA network diagram should be documented, identifying connections between the mobile money network environment and external networks.\n\nFirewalls and routers should be set up as follows:\n- position firewalls on every Internet connection and between the DMZ and internal network segment;\n- position firewalls between the internal network segment and the network segment for the wireless phone network;\n- restrict inbound and outbound traffic to that which is necessary for the customer data environment and specifically deny all other traffic;\n- document the rule set for each firewall, including business justification for use of all services, protocols, and ports allowed;\n- ensure firewall and router configuration files are secure and backed up regularly;\n- review firewall and router rule sets at least every six months.\n\nThe DMZ should be set up to:\n- limit inbound Internet traffic to authorized publicly-accessible services, protocols, and ports within the DMZ to prevent direct connections to the mobile money network segment;\n- implement anti-spoofing measures to detect and block forged source IP addresses from entering the network;\n- implement stateful inspection (dynamic packet filtering), ensuring that only established connections are allowed into the network;\n- not disclose private IP addresses and routing information externally (e.g. using NAT).\n\nMeasures should be put in place to prevent devices from being simultaneously connected to the organization’s trusted internal network and untrusted external networks (e.g. establishing connectivity via Ethernet adapter and wireless adapter on the same device)."},{"$f":"All!H381","v":"PCI DSS, ISO 27002:2013 Sec. 13.1 "},{"$f":"All!I381","v":"5.2.1.6.1"},{"$f":"All!J381","v":"5.2.1.6.1: Is external connectivity of the mobile money system protected with firewalls to only allow authorized traffic and protect access to customer data, with external-facing components located in a DMZ?\n"},{"$f":"All!K381","v":"1) Network design and communications matrix\n- Check the Mobile Money System is protected by firewalls defining internal zone and DMZs.\n- Check the firewall only permits necessary traffic and denies all other traffic.\n- Check all routes through firewalls are documented."},{"$f":"All!L381","v":0},{"$f":"All!M381","v":"Urgent Required"},{"$f":"All!N381","v":"Required"},{"$f":"All!O381","v":"TechOps"},{"$f":"All!P381","v":0},{"$f":"All!Q381","v":0},{"$f":"All!R381","v":0},{"$f":"All!S381","v":0},{"$f":"All!T381","v":0},{"$f":"All!U381","v":0},{"$f":"All!V381","v":0},{"$f":"All!W381","v":0},{"$f":"All!X381","v":0},{"$f":"All!Y381","v":0},{"$f":"All!Z381","v":0},{"$f":"All!AA381","v":0},{"$f":"All!AB381","v":0},{"$f":"All!AC381","v":0},{"$f":"All!AD381","v":0},{"$f":"All!AE381","v":0},{"$f":"All!AF381","v":0},{"$f":"All!AG381","v":0},{"$f":"All!AH381","v":0},{"$f":"All!AI381","v":0},{"$f":"All!AJ381","v":0},{"$f":"All!AK381","v":0},{"$f":"All!AL381","v":0},{"$f":"All!AM381","v":0},{"$f":"All!AN381","v":0},{"$f":"All!AO381","v":0},{"$f":"All!AP381","v":0},{"$f":"All!AQ381","v":0},{"$f":"All!AR381","v":0},{"$f":"All!AS381","v":0},{"$f":"All!AT381","v":0}]
[null,{"$f":"All!B382","v":"5"},{"$f":"All!C382","v":"5.2"},{"$f":"All!D382","v":"5.2.1"},{"$f":"All!E382","v":""},{"$f":"All!F382","v":"5.2.1.6"},{"$f":"All!G382","v":0},{"$f":"All!H382","v":0},{"$f":"All!I382","v":"5.2.1.6.2"},{"$f":"All!J382","v":"5.2.1.6.2: Have the rule sets for all mobile money system firewalls been documented, including all services, protocols, and ports allowed and business justification for each?\n"},{"$f":"All!K382","v":"1) Network security policy (or equivalent documents) or firewall/router rules documentation\n- Check the document includes rules for all mobile money system firewalls\n- Check the document includes:\n     a) All services\n     b) Protocols\n     c) Allowed ports\n- Check there is a business justification for each of the above\n- Check all routes through firewalls are documented."},{"$f":"All!L382","v":0},{"$f":"All!M382","v":"Recommended"},{"$f":"All!N382","v":"Recommended"},{"$f":"All!O382","v":"TechOps"},{"$f":"All!P382","v":0},{"$f":"All!Q382","v":0},{"$f":"All!R382","v":0},{"$f":"All!S382","v":0},{"$f":"All!T382","v":0},{"$f":"All!U382","v":0},{"$f":"All!V382","v":0},{"$f":"All!W382","v":0},{"$f":"All!X382","v":0},{"$f":"All!Y382","v":0},{"$f":"All!Z382","v":0},{"$f":"All!AA382","v":0},{"$f":"All!AB382","v":0},{"$f":"All!AC382","v":0},{"$f":"All!AD382","v":0},{"$f":"All!AE382","v":0},{"$f":"All!AF382","v":0},{"$f":"All!AG382","v":0},{"$f":"All!AH382","v":0},{"$f":"All!AI382","v":0},{"$f":"All!AJ382","v":0},{"$f":"All!AK382","v":0},{"$f":"All!AL382","v":0},{"$f":"All!AM382","v":0},{"$f":"All!AN382","v":0},{"$f":"All!AO382","v":0},{"$f":"All!AP382","v":0},{"$f":"All!AQ382","v":0},{"$f":"All!AR382","v":0},{"$f":"All!AS382","v":0},{"$f":"All!AT382","v":0}]
[null,{"$f":"All!B383","v":"5"},{"$f":"All!C383","v":"5.2"},{"$f":"All!D383","v":"5.2.1"},{"$f":"All!E383","v":""},{"$f":"All!F383","v":"5.2.1.6"},{"$f":"All!G383","v":0},{"$f":"All!H383","v":0},{"$f":"All!I383","v":"5.2.1.6.3"},{"$f":"All!J383","v":"5.2.1.6.3: Is there a formal process for approval of all network connections and changes to firewall and router configurations?\n"},{"$f":"All!K383","v":"1) Network security policy (or equivalent documents) or firewall/router rules documentation\n- Check that there is a process for approving:\n     a) all network connections\n     b) all router configurations\n"},{"$f":"All!L383","v":0},{"$f":"All!M383","v":"Urgent Required"},{"$f":"All!N383","v":"Required"},{"$f":"All!O383","v":"TechOps"},{"$f":"All!P383","v":0},{"$f":"All!Q383","v":0},{"$f":"All!R383","v":0},{"$f":"All!S383","v":0},{"$f":"All!T383","v":0},{"$f":"All!U383","v":0},{"$f":"All!V383","v":0},{"$f":"All!W383","v":0},{"$f":"All!X383","v":0},{"$f":"All!Y383","v":0},{"$f":"All!Z383","v":0},{"$f":"All!AA383","v":0},{"$f":"All!AB383","v":0},{"$f":"All!AC383","v":0},{"$f":"All!AD383","v":0},{"$f":"All!AE383","v":0},{"$f":"All!AF383","v":0},{"$f":"All!AG383","v":0},{"$f":"All!AH383","v":0},{"$f":"All!AI383","v":0},{"$f":"All!AJ383","v":0},{"$f":"All!AK383","v":0},{"$f":"All!AL383","v":0},{"$f":"All!AM383","v":0},{"$f":"All!AN383","v":0},{"$f":"All!AO383","v":0},{"$f":"All!AP383","v":0},{"$f":"All!AQ383","v":0},{"$f":"All!AR383","v":0},{"$f":"All!AS383","v":0},{"$f":"All!AT383","v":0}]
[null,{"$f":"All!B384","v":"5"},{"$f":"All!C384","v":"5.2"},{"$f":"All!D384","v":"5.2.1"},{"$f":"All!E384","v":""},{"$f":"All!F384","v":"5.2.1.6"},{"$f":"All!G384","v":0},{"$f":"All!H384","v":0},{"$f":"All!I384","v":"5.2.1.6.4"},{"$f":"All!J384","v":"5.2.1.6.4: Is there a network diagram identifying connections within the mobile money network environment and to external networks?\n"},{"$f":"All!K384","v":"1) Network Diagram\n- Check that there is a network diagram details connections within the mobile money network environment and to the external network\n\n"},{"$f":"All!L384","v":0},{"$f":"All!M384","v":"Standard Required"},{"$f":"All!N384","v":"Required"},{"$f":"All!O384","v":"TechOps"},{"$f":"All!P384","v":0},{"$f":"All!Q384","v":0},{"$f":"All!R384","v":0},{"$f":"All!S384","v":0},{"$f":"All!T384","v":0},{"$f":"All!U384","v":0},{"$f":"All!V384","v":0},{"$f":"All!W384","v":0},{"$f":"All!X384","v":0},{"$f":"All!Y384","v":0},{"$f":"All!Z384","v":0},{"$f":"All!AA384","v":0},{"$f":"All!AB384","v":0},{"$f":"All!AC384","v":0},{"$f":"All!AD384","v":0},{"$f":"All!AE384","v":0},{"$f":"All!AF384","v":0},{"$f":"All!AG384","v":0},{"$f":"All!AH384","v":0},{"$f":"All!AI384","v":0},{"$f":"All!AJ384","v":0},{"$f":"All!AK384","v":0},{"$f":"All!AL384","v":0},{"$f":"All!AM384","v":0},{"$f":"All!AN384","v":0},{"$f":"All!AO384","v":0},{"$f":"All!AP384","v":0},{"$f":"All!AQ384","v":0},{"$f":"All!AR384","v":0},{"$f":"All!AS384","v":0},{"$f":"All!AT384","v":0}]
[null,{"$f":"All!B385","v":"5"},{"$f":"All!C385","v":"5.2"},{"$f":"All!D385","v":"5.2.1"},{"$f":"All!E385","v":""},{"$f":"All!F385","v":"5.2.1.6"},{"$f":"All!G385","v":0},{"$f":"All!H385","v":0},{"$f":"All!I385","v":"5.2.1.6.5"},{"$f":"All!J385","v":"5.2.1.6.5: Are all firewall and router configuration files secure and backed up regularly?\n"},{"$f":"All!K385","v":0},{"$f":"All!L385","v":0},{"$f":"All!M385","v":"Recommended"},{"$f":"All!N385","v":"Recommended"},{"$f":"All!O385","v":"TechOps"},{"$f":"All!P385","v":0},{"$f":"All!Q385","v":0},{"$f":"All!R385","v":0},{"$f":"All!S385","v":0},{"$f":"All!T385","v":0},{"$f":"All!U385","v":0},{"$f":"All!V385","v":0},{"$f":"All!W385","v":0},{"$f":"All!X385","v":0},{"$f":"All!Y385","v":0},{"$f":"All!Z385","v":0},{"$f":"All!AA385","v":0},{"$f":"All!AB385","v":0},{"$f":"All!AC385","v":0},{"$f":"All!AD385","v":0},{"$f":"All!AE385","v":0},{"$f":"All!AF385","v":0},{"$f":"All!AG385","v":0},{"$f":"All!AH385","v":0},{"$f":"All!AI385","v":0},{"$f":"All!AJ385","v":0},{"$f":"All!AK385","v":0},{"$f":"All!AL385","v":0},{"$f":"All!AM385","v":0},{"$f":"All!AN385","v":0},{"$f":"All!AO385","v":0},{"$f":"All!AP385","v":0},{"$f":"All!AQ385","v":0},{"$f":"All!AR385","v":0},{"$f":"All!AS385","v":0},{"$f":"All!AT385","v":0}]
[null,{"$f":"All!B386","v":"5"},{"$f":"All!C386","v":"5.2"},{"$f":"All!D386","v":"5.2.1"},{"$f":"All!E386","v":""},{"$f":"All!F386","v":"5.2.1.6"},{"$f":"All!G386","v":0},{"$f":"All!H386","v":0},{"$f":"All!I386","v":"5.2.1.6.6"},{"$f":"All!J386","v":"5.2.1.6.6: Are firewall and router rule sets reviewed at least every six months?\n"},{"$f":"All!K386","v":0},{"$f":"All!L386","v":0},{"$f":"All!M386","v":"Recommended"},{"$f":"All!N386","v":"Recommended"},{"$f":"All!O386","v":"TechOps"},{"$f":"All!P386","v":0},{"$f":"All!Q386","v":0},{"$f":"All!R386","v":0},{"$f":"All!S386","v":0},{"$f":"All!T386","v":0},{"$f":"All!U386","v":0},{"$f":"All!V386","v":0},{"$f":"All!W386","v":0},{"$f":"All!X386","v":0},{"$f":"All!Y386","v":0},{"$f":"All!Z386","v":0},{"$f":"All!AA386","v":0},{"$f":"All!AB386","v":0},{"$f":"All!AC386","v":0},{"$f":"All!AD386","v":0},{"$f":"All!AE386","v":0},{"$f":"All!AF386","v":0},{"$f":"All!AG386","v":0},{"$f":"All!AH386","v":0},{"$f":"All!AI386","v":0},{"$f":"All!AJ386","v":0},{"$f":"All!AK386","v":0},{"$f":"All!AL386","v":0},{"$f":"All!AM386","v":0},{"$f":"All!AN386","v":0},{"$f":"All!AO386","v":0},{"$f":"All!AP386","v":0},{"$f":"All!AQ386","v":0},{"$f":"All!AR386","v":0},{"$f":"All!AS386","v":0},{"$f":"All!AT386","v":0}]
[null,{"$f":"All!B387","v":"5"},{"$f":"All!C387","v":"5.2"},{"$f":"All!D387","v":"5.2.1"},{"$f":"All!E387","v":0},{"$f":"All!F387","v":"5.2.1.6"},{"$f":"All!G387","v":0},{"$f":"All!H387","v":0},{"$f":"All!I387","v":"5.2.1.6.7"},{"$f":"All!J387","v":"5.2.1.6.7: Are measures in place to prevent devices from being simultaneously connected to the organization’s trusted internal network and untrusted external network?\n(e.g. establishing connectivity via Ethernet adapter and wireless adapter on the same device).\n"},{"$f":"All!K387","v":0},{"$f":"All!L387","v":0},{"$f":"All!M387","v":"Recommended"},{"$f":"All!N387","v":"Recommended"},{"$f":"All!O387","v":"TechOps"},{"$f":"All!P387","v":0},{"$f":"All!Q387","v":0},{"$f":"All!R387","v":0},{"$f":"All!S387","v":0},{"$f":"All!T387","v":0},{"$f":"All!U387","v":0},{"$f":"All!V387","v":0},{"$f":"All!W387","v":0},{"$f":"All!X387","v":0},{"$f":"All!Y387","v":0},{"$f":"All!Z387","v":0},{"$f":"All!AA387","v":0},{"$f":"All!AB387","v":0},{"$f":"All!AC387","v":0},{"$f":"All!AD387","v":0},{"$f":"All!AE387","v":0},{"$f":"All!AF387","v":0},{"$f":"All!AG387","v":0},{"$f":"All!AH387","v":0},{"$f":"All!AI387","v":0},{"$f":"All!AJ387","v":0},{"$f":"All!AK387","v":0},{"$f":"All!AL387","v":0},{"$f":"All!AM387","v":0},{"$f":"All!AN387","v":0},{"$f":"All!AO387","v":0},{"$f":"All!AP387","v":0},{"$f":"All!AQ387","v":0},{"$f":"All!AR387","v":0},{"$f":"All!AS387","v":0},{"$f":"All!AT387","v":0}]
[null,{"$f":"All!B388","v":"5"},{"$f":"All!C388","v":"5.2"},{"$f":"All!D388","v":"5.2.2"},{"$f":"All!E388","v":"5.2.2: Providers shall ensure that systems and applications are designed and developed securely and are thoroughly tested"},{"$f":"All!F388","v":"5.2.2.1"},{"$f":"All!G388","v":"5.2.2.1: SECURE SOFTWARE DEVELOPMENT PROCESSES\nCustom development of mobile money system software should be developed using secure processes. Industry standard best practices should be followed (e.g. ISO 27034-01:2011, PCI-DSS v3.0) as well as other recommended practices (for example, secure authentication and logging). This practice is applicable to custom software development by either internal staff or outsourced suppliers.\n\nInformation security should be incorporated throughout the software-development life cycle to ensure that secure software is developed. \n\nProviders should train developers in secure coding techniques, including how to avoid common coding vulnerabilities, understanding how sensitive data is handled in memory, and developing applications based on secure coding guidelines."},{"$f":"All!H388","v":"PCI DSS, ISO 27002:2013 Sec. 14.2 "},{"$f":"All!I388","v":"5.2.2.1.1"},{"$f":"All!J388","v":"5.2.2.1.1: Are custom developments of mobile money system software developed using secure processes throughout the software development life cycle, following industry standard best practices?\n"},{"$f":"All!K388","v":0},{"$f":"All!L388","v":0},{"$f":"All!M388","v":"Recommended"},{"$f":"All!N388","v":"Recommended"},{"$f":"All!O388","v":"TechOps"},{"$f":"All!P388","v":0},{"$f":"All!Q388","v":0},{"$f":"All!R388","v":0},{"$f":"All!S388","v":0},{"$f":"All!T388","v":0},{"$f":"All!U388","v":0},{"$f":"All!V388","v":0},{"$f":"All!W388","v":0},{"$f":"All!X388","v":0},{"$f":"All!Y388","v":0},{"$f":"All!Z388","v":0},{"$f":"All!AA388","v":0},{"$f":"All!AB388","v":0},{"$f":"All!AC388","v":0},{"$f":"All!AD388","v":0},{"$f":"All!AE388","v":0},{"$f":"All!AF388","v":0},{"$f":"All!AG388","v":0},{"$f":"All!AH388","v":0},{"$f":"All!AI388","v":0},{"$f":"All!AJ388","v":0},{"$f":"All!AK388","v":0},{"$f":"All!AL388","v":0},{"$f":"All!AM388","v":0},{"$f":"All!AN388","v":0},{"$f":"All!AO388","v":0},{"$f":"All!AP388","v":0},{"$f":"All!AQ388","v":0},{"$f":"All!AR388","v":0},{"$f":"All!AS388","v":0},{"$f":"All!AT388","v":0}]
[null,{"$f":"All!B389","v":"5"},{"$f":"All!C389","v":"5.2"},{"$f":"All!D389","v":"5.2.2"},{"$f":"All!E389","v":0},{"$f":"All!F389","v":"5.2.2.1"},{"$f":"All!G389","v":0},{"$f":"All!H389","v":0},{"$f":"All!I389","v":"5.2.2.1.2"},{"$f":"All!J389","v":"5.2.2.1.2: Is best practice for development of secure software enforced on entities providing outsourced software development services?\n"},{"$f":"All!K389","v":0},{"$f":"All!L389","v":0},{"$f":"All!M389","v":"Recommended"},{"$f":"All!N389","v":"Recommended"},{"$f":"All!O389","v":"TechOps"},{"$f":"All!P389","v":0},{"$f":"All!Q389","v":0},{"$f":"All!R389","v":0},{"$f":"All!S389","v":0},{"$f":"All!T389","v":0},{"$f":"All!U389","v":0},{"$f":"All!V389","v":0},{"$f":"All!W389","v":0},{"$f":"All!X389","v":0},{"$f":"All!Y389","v":0},{"$f":"All!Z389","v":0},{"$f":"All!AA389","v":0},{"$f":"All!AB389","v":0},{"$f":"All!AC389","v":0},{"$f":"All!AD389","v":0},{"$f":"All!AE389","v":0},{"$f":"All!AF389","v":0},{"$f":"All!AG389","v":0},{"$f":"All!AH389","v":0},{"$f":"All!AI389","v":0},{"$f":"All!AJ389","v":0},{"$f":"All!AK389","v":0},{"$f":"All!AL389","v":0},{"$f":"All!AM389","v":0},{"$f":"All!AN389","v":0},{"$f":"All!AO389","v":0},{"$f":"All!AP389","v":0},{"$f":"All!AQ389","v":0},{"$f":"All!AR389","v":0},{"$f":"All!AS389","v":0},{"$f":"All!AT389","v":0}]
[null,{"$f":"All!B390","v":"5"},{"$f":"All!C390","v":"5.2"},{"$f":"All!D390","v":"5.2.2"},{"$f":"All!E390","v":""},{"$f":"All!F390","v":"5.2.2.2"},{"$f":"All!G390","v":"5.2.2.2: DEVELOPMENT OF SECURE MOBILE MONEY SOFTWARE\nNew software for the mobile money system should be developed so that it is secure. This applies to any new software component that forms part of the mobile money system, including:\n  - MM core system;\n  - MM ancillary systems (e.g. for use of agents / business customers);\n  - MM integrations with external systems such as banks and ATMs.\n\nNew software should include the following security features:\n- protection of transactions from unauthorized distortion, falsification, readdressing and destruction;\n- authentication and authorization of all transaction requests;\n- authentication and authorization of sensitive back end operator activities; and\n- authentication and authorization of all automated processes and external systems.\n"},{"$f":"All!H390","v":"ISO 27015: 2012 Sec. 12.1, \nISO 27002: 2013 Sec. 14.2 \nPCI DSS"},{"$f":"All!I390","v":"5.2.2.2.1"},{"$f":"All!J390","v":"5.2.2.2.1: Does new software for the mobile money system include security features that ensure that transactions are protected from unauthorized distortion, falsification, readdressing and destruction?\n"},{"$f":"All!K390","v":0},{"$f":"All!L390","v":0},{"$f":"All!M390","v":"Recommended"},{"$f":"All!N390","v":"Recommended"},{"$f":"All!O390","v":"TechOps"},{"$f":"All!P390","v":0},{"$f":"All!Q390","v":0},{"$f":"All!R390","v":0},{"$f":"All!S390","v":0},{"$f":"All!T390","v":0},{"$f":"All!U390","v":0},{"$f":"All!V390","v":0},{"$f":"All!W390","v":0},{"$f":"All!X390","v":0},{"$f":"All!Y390","v":0},{"$f":"All!Z390","v":0},{"$f":"All!AA390","v":0},{"$f":"All!AB390","v":0},{"$f":"All!AC390","v":0},{"$f":"All!AD390","v":0},{"$f":"All!AE390","v":0},{"$f":"All!AF390","v":0},{"$f":"All!AG390","v":0},{"$f":"All!AH390","v":0},{"$f":"All!AI390","v":0},{"$f":"All!AJ390","v":0},{"$f":"All!AK390","v":0},{"$f":"All!AL390","v":0},{"$f":"All!AM390","v":0},{"$f":"All!AN390","v":0},{"$f":"All!AO390","v":0},{"$f":"All!AP390","v":0},{"$f":"All!AQ390","v":0},{"$f":"All!AR390","v":0},{"$f":"All!AS390","v":0},{"$f":"All!AT390","v":0}]
[null,{"$f":"All!B391","v":"5"},{"$f":"All!C391","v":"5.2"},{"$f":"All!D391","v":"5.2.2"},{"$f":"All!E391","v":""},{"$f":"All!F391","v":"5.2.2.2"},{"$f":"All!G391","v":0},{"$f":"All!H391","v":0},{"$f":"All!I391","v":"5.2.2.2.2"},{"$f":"All!J391","v":"5.2.2.2.2: Does new software for the mobile money system include security features that ensure that all automated processes and external systems are authenticated and authorized correctly?\n"},{"$f":"All!K391","v":0},{"$f":"All!L391","v":0},{"$f":"All!M391","v":"Recommended"},{"$f":"All!N391","v":"Recommended"},{"$f":"All!O391","v":"TechOps"},{"$f":"All!P391","v":0},{"$f":"All!Q391","v":0},{"$f":"All!R391","v":0},{"$f":"All!S391","v":0},{"$f":"All!T391","v":0},{"$f":"All!U391","v":0},{"$f":"All!V391","v":0},{"$f":"All!W391","v":0},{"$f":"All!X391","v":0},{"$f":"All!Y391","v":0},{"$f":"All!Z391","v":0},{"$f":"All!AA391","v":0},{"$f":"All!AB391","v":0},{"$f":"All!AC391","v":0},{"$f":"All!AD391","v":0},{"$f":"All!AE391","v":0},{"$f":"All!AF391","v":0},{"$f":"All!AG391","v":0},{"$f":"All!AH391","v":0},{"$f":"All!AI391","v":0},{"$f":"All!AJ391","v":0},{"$f":"All!AK391","v":0},{"$f":"All!AL391","v":0},{"$f":"All!AM391","v":0},{"$f":"All!AN391","v":0},{"$f":"All!AO391","v":0},{"$f":"All!AP391","v":0},{"$f":"All!AQ391","v":0},{"$f":"All!AR391","v":0},{"$f":"All!AS391","v":0},{"$f":"All!AT391","v":0}]
[null,{"$f":"All!B392","v":"5"},{"$f":"All!C392","v":"5.2"},{"$f":"All!D392","v":"5.2.2"},{"$f":"All!E392","v":"5.2.2: Providers shall ensure that systems and applications are designed and developed securely and are thoroughly tested"},{"$f":"All!F392","v":"5.2.2.3"},{"$f":"All!G392","v":"5.2.2.3: SECURE MOBILE MONEY SMARTPHONE APPS\nMobile applications accessible via public networks are especially subject to a range of threats. A security review of the mobile money smartphone app(s) should be carried out to ensure that controls have been properly implemented. A suitably qualified and trusted third party should also be used to validate and test the provider's mobile money apps to certify that they are secure and conform to suitable security standards.\n\nInformation security considerations for mobile application transactions should include the following:\n-   Client-side authentication by the app should not be used. The user's authentication information should be presented by the app for every call to the system.\n-   User credentials and transaction information should be held securely by the app (and not stored in log files, for example).\n-   Transaction notifications and messages should be sent and received within the app and stored securely, not via SMS.\n-   Client and server should identify themselves with trusted certificates and the communications path between all parties should be encrypted (see 5.2.1.3).\n\nMark these indicators as N/A if a smartphone app is not supported."},{"$f":"All!H392","v":"PCI DSS, ISO 27002:2013 Sec. 14.1,\nFlorida uni app review"},{"$f":"All!I392","v":"5.2.2.3.1"},{"$f":"All!J392","v":"5.2.2.3.1: Has a qualified and trusted third party been employed to validate and test the provider's mobile money app(s) to certify that they are secure and conform to suitable security standards?\n"},{"$f":"All!K392","v":"1) Secure development requirements documentation or third party smartphone test report\n- Check that a third party has been employed to test the providers mobile money app(s)\n- Check that third party is qualified and trusted to carry out the validation and testing\n- Check that an assessment has been made to identify which security standards are required for the providers app(s)\n- Check that the third party has certified against the identified security standard"},{"$f":"All!L392","v":0},{"$f":"All!M392","v":"Standard Required"},{"$f":"All!N392","v":"Required"},{"$f":"All!O392","v":"TechOps"},{"$f":"All!P392","v":0},{"$f":"All!Q392","v":0},{"$f":"All!R392","v":0},{"$f":"All!S392","v":0},{"$f":"All!T392","v":0},{"$f":"All!U392","v":0},{"$f":"All!V392","v":0},{"$f":"All!W392","v":0},{"$f":"All!X392","v":0},{"$f":"All!Y392","v":0},{"$f":"All!Z392","v":0},{"$f":"All!AA392","v":0},{"$f":"All!AB392","v":0},{"$f":"All!AC392","v":0},{"$f":"All!AD392","v":0},{"$f":"All!AE392","v":0},{"$f":"All!AF392","v":0},{"$f":"All!AG392","v":0},{"$f":"All!AH392","v":0},{"$f":"All!AI392","v":0},{"$f":"All!AJ392","v":0},{"$f":"All!AK392","v":0},{"$f":"All!AL392","v":0},{"$f":"All!AM392","v":0},{"$f":"All!AN392","v":0},{"$f":"All!AO392","v":0},{"$f":"All!AP392","v":0},{"$f":"All!AQ392","v":0},{"$f":"All!AR392","v":0},{"$f":"All!AS392","v":0},{"$f":"All!AT392","v":0}]
[null,{"$f":"All!B393","v":"5"},{"$f":"All!C393","v":"5.2"},{"$f":"All!D393","v":"5.2.2"},{"$f":"All!E393","v":""},{"$f":"All!F393","v":"5.2.2.3"},{"$f":"All!G393","v":0},{"$f":"All!H393","v":0},{"$f":"All!I393","v":"5.2.2.3.2"},{"$f":"All!J393","v":"5.2.2.3.2: Is authentication of the mobile money app(s) secure (i.e., no use of client-side authentication; the user's authentication information is presented by the app for every call to the system)?\n"},{"$f":"All!K393","v":0},{"$f":"All!L393","v":0},{"$f":"All!M393","v":"Recommended"},{"$f":"All!N393","v":"Recommended"},{"$f":"All!O393","v":"TechOps"},{"$f":"All!P393","v":0},{"$f":"All!Q393","v":0},{"$f":"All!R393","v":0},{"$f":"All!S393","v":0},{"$f":"All!T393","v":0},{"$f":"All!U393","v":0},{"$f":"All!V393","v":0},{"$f":"All!W393","v":0},{"$f":"All!X393","v":0},{"$f":"All!Y393","v":0},{"$f":"All!Z393","v":0},{"$f":"All!AA393","v":0},{"$f":"All!AB393","v":0},{"$f":"All!AC393","v":0},{"$f":"All!AD393","v":0},{"$f":"All!AE393","v":0},{"$f":"All!AF393","v":0},{"$f":"All!AG393","v":0},{"$f":"All!AH393","v":0},{"$f":"All!AI393","v":0},{"$f":"All!AJ393","v":0},{"$f":"All!AK393","v":0},{"$f":"All!AL393","v":0},{"$f":"All!AM393","v":0},{"$f":"All!AN393","v":0},{"$f":"All!AO393","v":0},{"$f":"All!AP393","v":0},{"$f":"All!AQ393","v":0},{"$f":"All!AR393","v":0},{"$f":"All!AS393","v":0},{"$f":"All!AT393","v":0}]
[null,{"$f":"All!B394","v":"5"},{"$f":"All!C394","v":"5.2"},{"$f":"All!D394","v":"5.2.2"},{"$f":"All!E394","v":""},{"$f":"All!F394","v":"5.2.2.3"},{"$f":"All!G394","v":0},{"$f":"All!H394","v":0},{"$f":"All!I394","v":"5.2.2.3.3"},{"$f":"All!J394","v":"5.2.2.3.3: Are user credentials and transaction information held securely by the mobile money app(s) (and not stored in log files, for example)?\n"},{"$f":"All!K394","v":0},{"$f":"All!L394","v":0},{"$f":"All!M394","v":"Recommended"},{"$f":"All!N394","v":"Recommended"},{"$f":"All!O394","v":"TechOps"},{"$f":"All!P394","v":0},{"$f":"All!Q394","v":0},{"$f":"All!R394","v":0},{"$f":"All!S394","v":0},{"$f":"All!T394","v":0},{"$f":"All!U394","v":0},{"$f":"All!V394","v":0},{"$f":"All!W394","v":0},{"$f":"All!X394","v":0},{"$f":"All!Y394","v":0},{"$f":"All!Z394","v":0},{"$f":"All!AA394","v":0},{"$f":"All!AB394","v":0},{"$f":"All!AC394","v":0},{"$f":"All!AD394","v":0},{"$f":"All!AE394","v":0},{"$f":"All!AF394","v":0},{"$f":"All!AG394","v":0},{"$f":"All!AH394","v":0},{"$f":"All!AI394","v":0},{"$f":"All!AJ394","v":0},{"$f":"All!AK394","v":0},{"$f":"All!AL394","v":0},{"$f":"All!AM394","v":0},{"$f":"All!AN394","v":0},{"$f":"All!AO394","v":0},{"$f":"All!AP394","v":0},{"$f":"All!AQ394","v":0},{"$f":"All!AR394","v":0},{"$f":"All!AS394","v":0},{"$f":"All!AT394","v":0}]
[null,{"$f":"All!B395","v":"5"},{"$f":"All!C395","v":"5.2"},{"$f":"All!D395","v":"5.2.2"},{"$f":"All!E395","v":""},{"$f":"All!F395","v":"5.2.2.3"},{"$f":"All!G395","v":0},{"$f":"All!H395","v":0},{"$f":"All!I395","v":"5.2.2.3.4"},{"$f":"All!J395","v":"5.2.2.3.4: Are transaction notifications and messages sent and received within the mobile money app(s) and stored securely, and not exchanged via SMS?\n"},{"$f":"All!K395","v":0},{"$f":"All!L395","v":0},{"$f":"All!M395","v":"Recommended"},{"$f":"All!N395","v":"Recommended"},{"$f":"All!O395","v":"TechOps"},{"$f":"All!P395","v":0},{"$f":"All!Q395","v":0},{"$f":"All!R395","v":0},{"$f":"All!S395","v":0},{"$f":"All!T395","v":0},{"$f":"All!U395","v":0},{"$f":"All!V395","v":0},{"$f":"All!W395","v":0},{"$f":"All!X395","v":0},{"$f":"All!Y395","v":0},{"$f":"All!Z395","v":0},{"$f":"All!AA395","v":0},{"$f":"All!AB395","v":0},{"$f":"All!AC395","v":0},{"$f":"All!AD395","v":0},{"$f":"All!AE395","v":0},{"$f":"All!AF395","v":0},{"$f":"All!AG395","v":0},{"$f":"All!AH395","v":0},{"$f":"All!AI395","v":0},{"$f":"All!AJ395","v":0},{"$f":"All!AK395","v":0},{"$f":"All!AL395","v":0},{"$f":"All!AM395","v":0},{"$f":"All!AN395","v":0},{"$f":"All!AO395","v":0},{"$f":"All!AP395","v":0},{"$f":"All!AQ395","v":0},{"$f":"All!AR395","v":0},{"$f":"All!AS395","v":0},{"$f":"All!AT395","v":0}]
[null,{"$f":"All!B396","v":"5"},{"$f":"All!C396","v":"5.2"},{"$f":"All!D396","v":"5.2.2"},{"$f":"All!E396","v":""},{"$f":"All!F396","v":"5.2.2.3"},{"$f":"All!G396","v":0},{"$f":"All!H396","v":0},{"$f":"All!I396","v":"5.2.2.3.5"},{"$f":"All!J396","v":"5.2.2.3.5: In mobile money app communication, do client and server identify themselves with trusted certificates and is the communications path between all parties encrypted?\n"},{"$f":"All!K396","v":0},{"$f":"All!L396","v":0},{"$f":"All!M396","v":"Recommended"},{"$f":"All!N396","v":"Recommended"},{"$f":"All!O396","v":"TechOps"},{"$f":"All!P396","v":0},{"$f":"All!Q396","v":0},{"$f":"All!R396","v":0},{"$f":"All!S396","v":0},{"$f":"All!T396","v":0},{"$f":"All!U396","v":0},{"$f":"All!V396","v":0},{"$f":"All!W396","v":0},{"$f":"All!X396","v":0},{"$f":"All!Y396","v":0},{"$f":"All!Z396","v":0},{"$f":"All!AA396","v":0},{"$f":"All!AB396","v":0},{"$f":"All!AC396","v":0},{"$f":"All!AD396","v":0},{"$f":"All!AE396","v":0},{"$f":"All!AF396","v":0},{"$f":"All!AG396","v":0},{"$f":"All!AH396","v":0},{"$f":"All!AI396","v":0},{"$f":"All!AJ396","v":0},{"$f":"All!AK396","v":0},{"$f":"All!AL396","v":0},{"$f":"All!AM396","v":0},{"$f":"All!AN396","v":0},{"$f":"All!AO396","v":0},{"$f":"All!AP396","v":0},{"$f":"All!AQ396","v":0},{"$f":"All!AR396","v":0},{"$f":"All!AS396","v":0},{"$f":"All!AT396","v":0}]
[null,{"$f":"All!B397","v":"5"},{"$f":"All!C397","v":"5.2"},{"$f":"All!D397","v":"5.2.2"},{"$f":"All!E397","v":""},{"$f":"All!F397","v":"5.2.2.4"},{"$f":"All!G397","v":"5.2.2.4: SECURITY TESTING OF NEW MOBILE MONEY SOFTWARE\nProviders should test major changes to software prior to release into production in order to identify any potential security vulnerabilities. Security testing should include all system components involved in providing the mobile money service (application servers, databases, gateways, etc.) and also handset and other terminals such as smartphones and PoS devices. For more information, please refer to security testing in the definitions.\n\nSecurity testing should be part of Operational Acceptance Testing (OAT) in the software release process (refer to 4.5.1.3). \n\nAutomated security testing is a useful tool but is not sufficient to discover all security weaknesses, so manual white-box security testing should also be performed.\n\nSecurity testing should be performed by individuals other than the originating code author. Security testers should be knowledgeable about code-review techniques and secure coding practices. Significant changes should be reviewed by external security experts before release. \n\nSecurity issues should be risk-assessed and higher-risk bugs fixed before software is released to production."},{"$f":"All!H397","v":"PCI-DSS, ISO 27002:2013 Sec. 14.2 "},{"$f":"All!I397","v":"5.2.2.4.1"},{"$f":"All!J397","v":"5.2.2.4.1: Is security testing done on all major software changes to the mobile money system prior to release into production?\n"},{"$f":"All!K397","v":"1) Security testing process documentation\n- Check there is a process for security testing of all major software changes.\n- Check the process requires testing to be completed prior to the release into production."},{"$f":"All!L397","v":0},{"$f":"All!M397","v":"Urgent Required"},{"$f":"All!N397","v":"Required"},{"$f":"All!O397","v":"TechOps"},{"$f":"All!P397","v":0},{"$f":"All!Q397","v":0},{"$f":"All!R397","v":0},{"$f":"All!S397","v":0},{"$f":"All!T397","v":0},{"$f":"All!U397","v":0},{"$f":"All!V397","v":0},{"$f":"All!W397","v":0},{"$f":"All!X397","v":0},{"$f":"All!Y397","v":0},{"$f":"All!Z397","v":0},{"$f":"All!AA397","v":0},{"$f":"All!AB397","v":0},{"$f":"All!AC397","v":0},{"$f":"All!AD397","v":0},{"$f":"All!AE397","v":0},{"$f":"All!AF397","v":0},{"$f":"All!AG397","v":0},{"$f":"All!AH397","v":0},{"$f":"All!AI397","v":0},{"$f":"All!AJ397","v":0},{"$f":"All!AK397","v":0},{"$f":"All!AL397","v":0},{"$f":"All!AM397","v":0},{"$f":"All!AN397","v":0},{"$f":"All!AO397","v":0},{"$f":"All!AP397","v":0},{"$f":"All!AQ397","v":0},{"$f":"All!AR397","v":0},{"$f":"All!AS397","v":0},{"$f":"All!AT397","v":0}]
[null,{"$f":"All!B398","v":"5"},{"$f":"All!C398","v":"5.2"},{"$f":"All!D398","v":"5.2.2"},{"$f":"All!E398","v":""},{"$f":"All!F398","v":"5.2.2.4"},{"$f":"All!G398","v":0},{"$f":"All!H398","v":0},{"$f":"All!I398","v":"5.2.2.4.2"},{"$f":"All!J398","v":"5.2.2.4.2: Are all security issues risk-assessed and higher-risk bugs fixed before software is released to production?\n"},{"$f":"All!K398","v":"1) Security testing process documentation\n- Check that the process requires all security issues to be risk-assessed and higher-risk bugs fixed before software is released to production."},{"$f":"All!L398","v":0},{"$f":"All!M398","v":"Standard Required"},{"$f":"All!N398","v":"Required"},{"$f":"All!O398","v":"TechOps"},{"$f":"All!P398","v":0},{"$f":"All!Q398","v":0},{"$f":"All!R398","v":0},{"$f":"All!S398","v":0},{"$f":"All!T398","v":0},{"$f":"All!U398","v":0},{"$f":"All!V398","v":0},{"$f":"All!W398","v":0},{"$f":"All!X398","v":0},{"$f":"All!Y398","v":0},{"$f":"All!Z398","v":0},{"$f":"All!AA398","v":0},{"$f":"All!AB398","v":0},{"$f":"All!AC398","v":0},{"$f":"All!AD398","v":0},{"$f":"All!AE398","v":0},{"$f":"All!AF398","v":0},{"$f":"All!AG398","v":0},{"$f":"All!AH398","v":0},{"$f":"All!AI398","v":0},{"$f":"All!AJ398","v":0},{"$f":"All!AK398","v":0},{"$f":"All!AL398","v":0},{"$f":"All!AM398","v":0},{"$f":"All!AN398","v":0},{"$f":"All!AO398","v":0},{"$f":"All!AP398","v":0},{"$f":"All!AQ398","v":0},{"$f":"All!AR398","v":0},{"$f":"All!AS398","v":0},{"$f":"All!AT398","v":0}]
[null,{"$f":"All!B399","v":"5"},{"$f":"All!C399","v":"5.2"},{"$f":"All!D399","v":"5.2.2"},{"$f":"All!E399","v":0},{"$f":"All!F399","v":"5.2.2.4"},{"$f":"All!G399","v":0},{"$f":"All!H399","v":0},{"$f":"All!I399","v":"5.2.2.4.3"},{"$f":"All!J399","v":"5.2.2.4.3: Does security testing of new software include testing of all system components of mobile money as well as handsets and other terminals (e.g. smartphones, PoS devices)?\n"},{"$f":"All!K399","v":0},{"$f":"All!L399","v":0},{"$f":"All!M399","v":"Recommended"},{"$f":"All!N399","v":"Recommended"},{"$f":"All!O399","v":"TechOps"},{"$f":"All!P399","v":0},{"$f":"All!Q399","v":0},{"$f":"All!R399","v":0},{"$f":"All!S399","v":0},{"$f":"All!T399","v":0},{"$f":"All!U399","v":0},{"$f":"All!V399","v":0},{"$f":"All!W399","v":0},{"$f":"All!X399","v":0},{"$f":"All!Y399","v":0},{"$f":"All!Z399","v":0},{"$f":"All!AA399","v":0},{"$f":"All!AB399","v":0},{"$f":"All!AC399","v":0},{"$f":"All!AD399","v":0},{"$f":"All!AE399","v":0},{"$f":"All!AF399","v":0},{"$f":"All!AG399","v":0},{"$f":"All!AH399","v":0},{"$f":"All!AI399","v":0},{"$f":"All!AJ399","v":0},{"$f":"All!AK399","v":0},{"$f":"All!AL399","v":0},{"$f":"All!AM399","v":0},{"$f":"All!AN399","v":0},{"$f":"All!AO399","v":0},{"$f":"All!AP399","v":0},{"$f":"All!AQ399","v":0},{"$f":"All!AR399","v":0},{"$f":"All!AS399","v":0},{"$f":"All!AT399","v":0}]
[null,{"$f":"All!B400","v":"5"},{"$f":"All!C400","v":"5.2"},{"$f":"All!D400","v":"5.2.2"},{"$f":"All!E400","v":""},{"$f":"All!F400","v":"5.2.2.4"},{"$f":"All!G400","v":0},{"$f":"All!H400","v":0},{"$f":"All!I400","v":"5.2.2.4.4"},{"$f":"All!J400","v":"5.2.2.4.4: Is new software reviewed by individuals other than the originating code author who are knowledgeable about code-review techniques and secure coding practices?\n"},{"$f":"All!K400","v":0},{"$f":"All!L400","v":0},{"$f":"All!M400","v":"Recommended"},{"$f":"All!N400","v":"Recommended"},{"$f":"All!O400","v":"TechOps"},{"$f":"All!P400","v":0},{"$f":"All!Q400","v":0},{"$f":"All!R400","v":0},{"$f":"All!S400","v":0},{"$f":"All!T400","v":0},{"$f":"All!U400","v":0},{"$f":"All!V400","v":0},{"$f":"All!W400","v":0},{"$f":"All!X400","v":0},{"$f":"All!Y400","v":0},{"$f":"All!Z400","v":0},{"$f":"All!AA400","v":0},{"$f":"All!AB400","v":0},{"$f":"All!AC400","v":0},{"$f":"All!AD400","v":0},{"$f":"All!AE400","v":0},{"$f":"All!AF400","v":0},{"$f":"All!AG400","v":0},{"$f":"All!AH400","v":0},{"$f":"All!AI400","v":0},{"$f":"All!AJ400","v":0},{"$f":"All!AK400","v":0},{"$f":"All!AL400","v":0},{"$f":"All!AM400","v":0},{"$f":"All!AN400","v":0},{"$f":"All!AO400","v":0},{"$f":"All!AP400","v":0},{"$f":"All!AQ400","v":0},{"$f":"All!AR400","v":0},{"$f":"All!AS400","v":0},{"$f":"All!AT400","v":0}]
[null,{"$f":"All!B401","v":"5"},{"$f":"All!C401","v":"5.2"},{"$f":"All!D401","v":"5.2.2"},{"$f":"All!E401","v":""},{"$f":"All!F401","v":"5.2.2.5"},{"$f":"All!G401","v":"5.2.2.5: REMOVAL OF TEST DATA FROM SOFTWARE\nDevelopment and test accounts and test data should be removed from mobile money software before it is released to production, since these items may give away sensitive information or present back-doors for attackers.\n\nDevelopment code or compilers should also be removed from software before it is released into the live mobile money system.\n\nActual customer data should be anonymised if it is used in development or test environments (see also 8.1.1.9)."},{"$f":"All!H401","v":"PCI-DSS, ISO 27002:2013 Sec. 14.3 "},{"$f":"All!I401","v":"5.2.2.5.1"},{"$f":"All!J401","v":"5.2.2.5.1: Are development and test accounts and test data removed from mobile money software before it is released to production?\n"},{"$f":"All!K401","v":"1) User acceptance testing specification\n- Check that there is a process to remove all test accounts and test data from the mobile money system  software prior to its release to production"},{"$f":"All!L401","v":0},{"$f":"All!M401","v":"Standard Required"},{"$f":"All!N401","v":"Required"},{"$f":"All!O401","v":"TechOps"},{"$f":"All!P401","v":0},{"$f":"All!Q401","v":0},{"$f":"All!R401","v":0},{"$f":"All!S401","v":0},{"$f":"All!T401","v":0},{"$f":"All!U401","v":0},{"$f":"All!V401","v":0},{"$f":"All!W401","v":0},{"$f":"All!X401","v":0},{"$f":"All!Y401","v":0},{"$f":"All!Z401","v":0},{"$f":"All!AA401","v":0},{"$f":"All!AB401","v":0},{"$f":"All!AC401","v":0},{"$f":"All!AD401","v":0},{"$f":"All!AE401","v":0},{"$f":"All!AF401","v":0},{"$f":"All!AG401","v":0},{"$f":"All!AH401","v":0},{"$f":"All!AI401","v":0},{"$f":"All!AJ401","v":0},{"$f":"All!AK401","v":0},{"$f":"All!AL401","v":0},{"$f":"All!AM401","v":0},{"$f":"All!AN401","v":0},{"$f":"All!AO401","v":0},{"$f":"All!AP401","v":0},{"$f":"All!AQ401","v":0},{"$f":"All!AR401","v":0},{"$f":"All!AS401","v":0},{"$f":"All!AT401","v":0}]
[null,{"$f":"All!B402","v":"5"},{"$f":"All!C402","v":"5.2"},{"$f":"All!D402","v":"5.2.2"},{"$f":"All!E402","v":""},{"$f":"All!F402","v":"5.2.2.5"},{"$f":"All!G402","v":0},{"$f":"All!H402","v":0},{"$f":"All!I402","v":"5.2.2.5.2"},{"$f":"All!J402","v":"5.2.2.5.2: Are all development code and compilers removed from software before it is released into the live mobile money system?\n"},{"$f":"All!K402","v":"1) User acceptance testing specification\n- Check that there is a process to remove all code and compliers from the mobile money system  software prior to its release to production"},{"$f":"All!L402","v":0},{"$f":"All!M402","v":"Standard Required"},{"$f":"All!N402","v":"Required"},{"$f":"All!O402","v":"TechOps"},{"$f":"All!P402","v":0},{"$f":"All!Q402","v":0},{"$f":"All!R402","v":0},{"$f":"All!S402","v":0},{"$f":"All!T402","v":0},{"$f":"All!U402","v":0},{"$f":"All!V402","v":0},{"$f":"All!W402","v":0},{"$f":"All!X402","v":0},{"$f":"All!Y402","v":0},{"$f":"All!Z402","v":0},{"$f":"All!AA402","v":0},{"$f":"All!AB402","v":0},{"$f":"All!AC402","v":0},{"$f":"All!AD402","v":0},{"$f":"All!AE402","v":0},{"$f":"All!AF402","v":0},{"$f":"All!AG402","v":0},{"$f":"All!AH402","v":0},{"$f":"All!AI402","v":0},{"$f":"All!AJ402","v":0},{"$f":"All!AK402","v":0},{"$f":"All!AL402","v":0},{"$f":"All!AM402","v":0},{"$f":"All!AN402","v":0},{"$f":"All!AO402","v":0},{"$f":"All!AP402","v":0},{"$f":"All!AQ402","v":0},{"$f":"All!AR402","v":0},{"$f":"All!AS402","v":0},{"$f":"All!AT402","v":0}]
[null,{"$f":"All!B403","v":"5"},{"$f":"All!C403","v":"5.2"},{"$f":"All!D403","v":"5.2.2"},{"$f":"All!E403","v":""},{"$f":"All!F403","v":"5.2.2.5"},{"$f":"All!G403","v":0},{"$f":"All!H403","v":0},{"$f":"All!I403","v":"5.2.2.5.3"},{"$f":"All!J403","v":"5.2.2.5.3: If actual customer data is used in development or test environments, is it anonymised ?\n"},{"$f":"All!K403","v":"1) User acceptance testing specification\n- Check that there is a process to anonymise customer data if it is used in the development or test environments\n[Mark as N/A if customer data is not used for development/test purposes]"},{"$f":"All!L403","v":0},{"$f":"All!M403","v":"Standard Required"},{"$f":"All!N403","v":"Required"},{"$f":"All!O403","v":"TechOps"},{"$f":"All!P403","v":0},{"$f":"All!Q403","v":0},{"$f":"All!R403","v":0},{"$f":"All!S403","v":0},{"$f":"All!T403","v":0},{"$f":"All!U403","v":0},{"$f":"All!V403","v":0},{"$f":"All!W403","v":0},{"$f":"All!X403","v":0},{"$f":"All!Y403","v":0},{"$f":"All!Z403","v":0},{"$f":"All!AA403","v":0},{"$f":"All!AB403","v":0},{"$f":"All!AC403","v":0},{"$f":"All!AD403","v":0},{"$f":"All!AE403","v":0},{"$f":"All!AF403","v":0},{"$f":"All!AG403","v":0},{"$f":"All!AH403","v":0},{"$f":"All!AI403","v":0},{"$f":"All!AJ403","v":0},{"$f":"All!AK403","v":0},{"$f":"All!AL403","v":0},{"$f":"All!AM403","v":0},{"$f":"All!AN403","v":0},{"$f":"All!AO403","v":0},{"$f":"All!AP403","v":0},{"$f":"All!AQ403","v":0},{"$f":"All!AR403","v":0},{"$f":"All!AS403","v":0},{"$f":"All!AT403","v":0}]
[null,{"$f":"All!B404","v":"5"},{"$f":"All!C404","v":"5.2"},{"$f":"All!D404","v":"5.2.2"},{"$f":"All!E404","v":""},{"$f":"All!F404","v":"5.2.2.6"},{"$f":"All!G404","v":"5.2.2.6: VENDOR SOFTWARE VERSIONS AND SECURITY PATCHES\nVendor-supplied software used in the mobile money system should be maintained at a level supported by the supplier. In particular, security patches should be applied promptly.\n\nSecurity patches should be implemented as soon as possible after they  are released by vendors. Critical security patches should be installed within 30 days, and other lower-risk patches should be installed within 2-3 months. \n\nAny decision to upgrade to a new release should take into account the security of the release, including:\n- the introduction of new information security functionality; and\n- the number and severity of information security problems affecting the new release.\n\nSecurity patches should be implemented on all mobile money components, including:\n - infrastructure components (routers, gateways, etc.); and\n - application components (accounting system, middleware, etc.)."},{"$f":"All!H404","v":"PCI DSS, ISO 27002: 2013 Sec. 12.5, 14.1 "},{"$f":"All!I404","v":"5.2.2.6.1"},{"$f":"All!J404","v":"5.2.2.6.1: Are critical security patches from vendors prioritized and installed within one month of release on mobile money infrastructure components (routers, gateways, etc.)?\n"},{"$f":"All!K404","v":"1) Security Operations Manual or Technical Operations documentation\n- Check that there is a process for critical security patches from vendors to be installed on the mobile money infrastructure components\n- Check that infrastructure patches are installed within a month of release\n"},{"$f":"All!L404","v":0},{"$f":"All!M404","v":"Standard Required"},{"$f":"All!N404","v":"Required"},{"$f":"All!O404","v":"TechOps"},{"$f":"All!P404","v":0},{"$f":"All!Q404","v":0},{"$f":"All!R404","v":0},{"$f":"All!S404","v":0},{"$f":"All!T404","v":0},{"$f":"All!U404","v":0},{"$f":"All!V404","v":0},{"$f":"All!W404","v":0},{"$f":"All!X404","v":0},{"$f":"All!Y404","v":0},{"$f":"All!Z404","v":0},{"$f":"All!AA404","v":0},{"$f":"All!AB404","v":0},{"$f":"All!AC404","v":0},{"$f":"All!AD404","v":0},{"$f":"All!AE404","v":0},{"$f":"All!AF404","v":0},{"$f":"All!AG404","v":0},{"$f":"All!AH404","v":0},{"$f":"All!AI404","v":0},{"$f":"All!AJ404","v":0},{"$f":"All!AK404","v":0},{"$f":"All!AL404","v":0},{"$f":"All!AM404","v":0},{"$f":"All!AN404","v":0},{"$f":"All!AO404","v":0},{"$f":"All!AP404","v":0},{"$f":"All!AQ404","v":0},{"$f":"All!AR404","v":0},{"$f":"All!AS404","v":0},{"$f":"All!AT404","v":0}]
[null,{"$f":"All!B405","v":"5"},{"$f":"All!C405","v":"5.2"},{"$f":"All!D405","v":"5.2.2"},{"$f":"All!E405","v":""},{"$f":"All!F405","v":"5.2.2.6"},{"$f":"All!G405","v":0},{"$f":"All!H405","v":0},{"$f":"All!I405","v":"5.2.2.6.2"},{"$f":"All!J405","v":"5.2.2.6.2: Are critical security patches from vendors prioritized and installed within one month of release on mobile money application components (accounting system, middleware, etc.)?\n"},{"$f":"All!K405","v":"1) Security Operations Manual or Technical Operations documentation\n- Check that there is a process for critical security patches from vendors to be installed on the mobile money application components\n- Check that application patches are installed within a month of release\n"},{"$f":"All!L405","v":0},{"$f":"All!M405","v":"Standard Required"},{"$f":"All!N405","v":"Required"},{"$f":"All!O405","v":"TechOps"},{"$f":"All!P405","v":0},{"$f":"All!Q405","v":0},{"$f":"All!R405","v":0},{"$f":"All!S405","v":0},{"$f":"All!T405","v":0},{"$f":"All!U405","v":0},{"$f":"All!V405","v":0},{"$f":"All!W405","v":0},{"$f":"All!X405","v":0},{"$f":"All!Y405","v":0},{"$f":"All!Z405","v":0},{"$f":"All!AA405","v":0},{"$f":"All!AB405","v":0},{"$f":"All!AC405","v":0},{"$f":"All!AD405","v":0},{"$f":"All!AE405","v":0},{"$f":"All!AF405","v":0},{"$f":"All!AG405","v":0},{"$f":"All!AH405","v":0},{"$f":"All!AI405","v":0},{"$f":"All!AJ405","v":0},{"$f":"All!AK405","v":0},{"$f":"All!AL405","v":0},{"$f":"All!AM405","v":0},{"$f":"All!AN405","v":0},{"$f":"All!AO405","v":0},{"$f":"All!AP405","v":0},{"$f":"All!AQ405","v":0},{"$f":"All!AR405","v":0},{"$f":"All!AS405","v":0},{"$f":"All!AT405","v":0}]
[null,{"$f":"All!B406","v":"5"},{"$f":"All!C406","v":"5.2"},{"$f":"All!D406","v":"5.2.2"},{"$f":"All!E406","v":""},{"$f":"All!F406","v":"5.2.2.6"},{"$f":"All!G406","v":0},{"$f":"All!H406","v":0},{"$f":"All!I406","v":"5.2.2.6.3"},{"$f":"All!J406","v":"5.2.2.6.3: Are all other lower-risk vendor-supplied security patches installed within an appropriate time frame - i.e. within three months?\n"},{"$f":"All!K406","v":0},{"$f":"All!L406","v":0},{"$f":"All!M406","v":"Recommended"},{"$f":"All!N406","v":"Recommended"},{"$f":"All!O406","v":"TechOps"},{"$f":"All!P406","v":0},{"$f":"All!Q406","v":0},{"$f":"All!R406","v":0},{"$f":"All!S406","v":0},{"$f":"All!T406","v":0},{"$f":"All!U406","v":0},{"$f":"All!V406","v":0},{"$f":"All!W406","v":0},{"$f":"All!X406","v":0},{"$f":"All!Y406","v":0},{"$f":"All!Z406","v":0},{"$f":"All!AA406","v":0},{"$f":"All!AB406","v":0},{"$f":"All!AC406","v":0},{"$f":"All!AD406","v":0},{"$f":"All!AE406","v":0},{"$f":"All!AF406","v":0},{"$f":"All!AG406","v":0},{"$f":"All!AH406","v":0},{"$f":"All!AI406","v":0},{"$f":"All!AJ406","v":0},{"$f":"All!AK406","v":0},{"$f":"All!AL406","v":0},{"$f":"All!AM406","v":0},{"$f":"All!AN406","v":0},{"$f":"All!AO406","v":0},{"$f":"All!AP406","v":0},{"$f":"All!AQ406","v":0},{"$f":"All!AR406","v":0},{"$f":"All!AS406","v":0},{"$f":"All!AT406","v":0}]
[null,{"$f":"All!B407","v":"5"},{"$f":"All!C407","v":"5.2"},{"$f":"All!D407","v":"5.2.2"},{"$f":"All!E407","v":""},{"$f":"All!F407","v":"5.2.2.6"},{"$f":"All!G407","v":0},{"$f":"All!H407","v":0},{"$f":"All!I407","v":"5.2.2.6.4"},{"$f":"All!J407","v":"5.2.2.6.4: Does the decision whether to upgrade to a new release of vendor software consider both the introduction of new information security functionality and the number and severity of information security problems affecting the new release?\n"},{"$f":"All!K407","v":0},{"$f":"All!L407","v":0},{"$f":"All!M407","v":"Recommended"},{"$f":"All!N407","v":"Recommended"},{"$f":"All!O407","v":"TechOps"},{"$f":"All!P407","v":0},{"$f":"All!Q407","v":0},{"$f":"All!R407","v":0},{"$f":"All!S407","v":0},{"$f":"All!T407","v":0},{"$f":"All!U407","v":0},{"$f":"All!V407","v":0},{"$f":"All!W407","v":0},{"$f":"All!X407","v":0},{"$f":"All!Y407","v":0},{"$f":"All!Z407","v":0},{"$f":"All!AA407","v":0},{"$f":"All!AB407","v":0},{"$f":"All!AC407","v":0},{"$f":"All!AD407","v":0},{"$f":"All!AE407","v":0},{"$f":"All!AF407","v":0},{"$f":"All!AG407","v":0},{"$f":"All!AH407","v":0},{"$f":"All!AI407","v":0},{"$f":"All!AJ407","v":0},{"$f":"All!AK407","v":0},{"$f":"All!AL407","v":0},{"$f":"All!AM407","v":0},{"$f":"All!AN407","v":0},{"$f":"All!AO407","v":0},{"$f":"All!AP407","v":0},{"$f":"All!AQ407","v":0},{"$f":"All!AR407","v":0},{"$f":"All!AS407","v":0},{"$f":"All!AT407","v":0}]
[null,{"$f":"All!B408","v":"5"},{"$f":"All!C408","v":"5.3"},{"$f":"All!D408","v":"5.3.1"},{"$f":"All!E408","v":"5.3.1: Providers shall identify and assess security risks prior to offering mobile money services and shall continue to monitor such risks on an ongoing basis."},{"$f":"All!F408","v":"5.3.1.1"},{"$f":"All!G408","v":"5.3.1.1: SECURITY RISK MANAGEMENT\nProviders should establish an Information Security Risk Management process and deploy sufficient resources to implement it. Security risks should be assessed at least annually, following a significant change in infrastructure or operating systems, and when new threats or vulnerabilities have been identified.\n\nSecurity risk assessments should be applied to all information systems and processes delivering the mobile money service (both internal and 3rd party). "},{"$f":"All!H408","v":"ISO 27005: 2011, \nPCI DSS, \nECB RSMP"},{"$f":"All!I408","v":"5.3.1.1.1"},{"$f":"All!J408","v":"5.3.1.1.1: Has an information security risk management process been documented?\n"},{"$f":"All!K408","v":"1) Information security risk management process and security risk register\n- Check that the security risk management process has been documented. \nNote that security risk management could be done either at operator-level or at group level\n"},{"$f":"All!L408","v":0},{"$f":"All!M408","v":"Standard Required"},{"$f":"All!N408","v":"Required"},{"$f":"All!O408","v":"TechOps"},{"$f":"All!P408","v":0},{"$f":"All!Q408","v":0},{"$f":"All!R408","v":0},{"$f":"All!S408","v":0},{"$f":"All!T408","v":0},{"$f":"All!U408","v":0},{"$f":"All!V408","v":0},{"$f":"All!W408","v":0},{"$f":"All!X408","v":0},{"$f":"All!Y408","v":0},{"$f":"All!Z408","v":0},{"$f":"All!AA408","v":0},{"$f":"All!AB408","v":0},{"$f":"All!AC408","v":0},{"$f":"All!AD408","v":0},{"$f":"All!AE408","v":0},{"$f":"All!AF408","v":0},{"$f":"All!AG408","v":0},{"$f":"All!AH408","v":0},{"$f":"All!AI408","v":0},{"$f":"All!AJ408","v":0},{"$f":"All!AK408","v":0},{"$f":"All!AL408","v":0},{"$f":"All!AM408","v":0},{"$f":"All!AN408","v":0},{"$f":"All!AO408","v":0},{"$f":"All!AP408","v":0},{"$f":"All!AQ408","v":0},{"$f":"All!AR408","v":0},{"$f":"All!AS408","v":0},{"$f":"All!AT408","v":0}]
[null,{"$f":"All!B409","v":"5"},{"$f":"All!C409","v":"5.3"},{"$f":"All!D409","v":"5.3.1"},{"$f":"All!E409","v":0},{"$f":"All!F409","v":"5.3.1.1"},{"$f":"All!G409","v":0},{"$f":"All!H409","v":0},{"$f":"All!I409","v":"5.3.1.1.2"},{"$f":"All!J409","v":"5.3.1.1.2: Are security risks assessed at least annually, following a significant change to the mobile money system, and when new threats or vulnerabilities have been identified?\n"},{"$f":"All!K409","v":"1) Information security risk management process\n- Check that security risk assessments are carried out at least annually.\n- Check that the date of the last documented risk assessment has occurred in the last 12 months.\n"},{"$f":"All!L409","v":0},{"$f":"All!M409","v":"Standard Required"},{"$f":"All!N409","v":"Required"},{"$f":"All!O409","v":"TechOps"},{"$f":"All!P409","v":0},{"$f":"All!Q409","v":0},{"$f":"All!R409","v":0},{"$f":"All!S409","v":0},{"$f":"All!T409","v":0},{"$f":"All!U409","v":0},{"$f":"All!V409","v":0},{"$f":"All!W409","v":0},{"$f":"All!X409","v":0},{"$f":"All!Y409","v":0},{"$f":"All!Z409","v":0},{"$f":"All!AA409","v":0},{"$f":"All!AB409","v":0},{"$f":"All!AC409","v":0},{"$f":"All!AD409","v":0},{"$f":"All!AE409","v":0},{"$f":"All!AF409","v":0},{"$f":"All!AG409","v":0},{"$f":"All!AH409","v":0},{"$f":"All!AI409","v":0},{"$f":"All!AJ409","v":0},{"$f":"All!AK409","v":0},{"$f":"All!AL409","v":0},{"$f":"All!AM409","v":0},{"$f":"All!AN409","v":0},{"$f":"All!AO409","v":0},{"$f":"All!AP409","v":0},{"$f":"All!AQ409","v":0},{"$f":"All!AR409","v":0},{"$f":"All!AS409","v":0},{"$f":"All!AT409","v":0}]
[null,{"$f":"All!B410","v":"5"},{"$f":"All!C410","v":"5.3"},{"$f":"All!D410","v":"5.3.1"},{"$f":"All!E410","v":0},{"$f":"All!F410","v":"5.3.1.2"},{"$f":"All!G410","v":"5.3.1.2: OBTAIN INFORMATION ABOUT KNOWN SECURITY RISKS\nProviders should establish a process to identify security vulnerabilities, using reputable outside sources for security vulnerability information.\n\nProviders should keep up to date with new vulnerabilities that may impact their environment. Sources for vulnerability information should be trustworthy and may include (among others) vendor websites, industry news groups, mailing lists, or RSS feeds."},{"$f":"All!H410","v":"PCI DSS, ISO 27002: 2013 Sec. 14.1 "},{"$f":"All!I410","v":"5.3.1.2.1"},{"$f":"All!J410","v":"5.3.1.2.1: Are processes in place to identify new security vulnerabilities using information from reputable outside sources?\n"},{"$f":"All!K410","v":"1) Information security risk management process\n- Check that there is a process to identify new security vulnerabilities\n- Check that the process includes information from reputable outside sources "},{"$f":"All!L410","v":0},{"$f":"All!M410","v":"Urgent Required"},{"$f":"All!N410","v":"Required"},{"$f":"All!O410","v":"TechOps"},{"$f":"All!P410","v":0},{"$f":"All!Q410","v":0},{"$f":"All!R410","v":0},{"$f":"All!S410","v":0},{"$f":"All!T410","v":0},{"$f":"All!U410","v":0},{"$f":"All!V410","v":0},{"$f":"All!W410","v":0},{"$f":"All!X410","v":0},{"$f":"All!Y410","v":0},{"$f":"All!Z410","v":0},{"$f":"All!AA410","v":0},{"$f":"All!AB410","v":0},{"$f":"All!AC410","v":0},{"$f":"All!AD410","v":0},{"$f":"All!AE410","v":0},{"$f":"All!AF410","v":0},{"$f":"All!AG410","v":0},{"$f":"All!AH410","v":0},{"$f":"All!AI410","v":0},{"$f":"All!AJ410","v":0},{"$f":"All!AK410","v":0},{"$f":"All!AL410","v":0},{"$f":"All!AM410","v":0},{"$f":"All!AN410","v":0},{"$f":"All!AO410","v":0},{"$f":"All!AP410","v":0},{"$f":"All!AQ410","v":0},{"$f":"All!AR410","v":0},{"$f":"All!AS410","v":0},{"$f":"All!AT410","v":0}]
[null,{"$f":"All!B411","v":"5"},{"$f":"All!C411","v":"5.3"},{"$f":"All!D411","v":"5.3.1"},{"$f":"All!E411","v":""},{"$f":"All!F411","v":"5.3.1.3"},{"$f":"All!G411","v":"5.3.1.3: SECURITY RISK MANAGEMENT PROCESS\nSecurity risk assessments should be conducted to identify new risks and evaluate their severity. They should also re-evaluate risks that were reviewed in the previous risk assessment. \n\nThe severity of each risk should be assessed by evaluating the risk's impact (if it materialised) and likelihood of materialising. Examples of types of impact include:\n- Impairment of operations or service availability;\n- Loss of integrity of financial data;\n- Loss of financial value;\n- Damage to reputation;\n- Breaches of legal/ regulatory requirements;\n- Loss of customer confidentiality.\n\nThe security risk management process should identify controls that are in place or which could be implemented to reduce the severity of the risk by reducing the impact and/or likelihood. Actions should be identified to manage each risk, such as treating the risk by applying additional controls or deciding to tolerate the level of risk. The decision to tolerate risks should be confirmed at the appropriate level of management, and the justification should be documented."},{"$f":"All!H411","v":"ISO 27005: 2011, \nPCI DSS, \nECB RSMP"},{"$f":"All!I411","v":"5.3.1.3.1"},{"$f":"All!J411","v":"5.3.1.3.1: Do security risk assessments evaluate both new risks and previously-assessed risks?\n"},{"$f":"All!K411","v":"1) Information security risk management process\n- Check that the security risk assessments evaluate new risk and previously -assessed risk\n- Check that there is a populated risk register"},{"$f":"All!L411","v":0},{"$f":"All!M411","v":"Recommended"},{"$f":"All!N411","v":"Recommended"},{"$f":"All!O411","v":"TechOps"},{"$f":"All!P411","v":0},{"$f":"All!Q411","v":0},{"$f":"All!R411","v":0},{"$f":"All!S411","v":0},{"$f":"All!T411","v":0},{"$f":"All!U411","v":0},{"$f":"All!V411","v":0},{"$f":"All!W411","v":0},{"$f":"All!X411","v":0},{"$f":"All!Y411","v":0},{"$f":"All!Z411","v":0},{"$f":"All!AA411","v":0},{"$f":"All!AB411","v":0},{"$f":"All!AC411","v":0},{"$f":"All!AD411","v":0},{"$f":"All!AE411","v":0},{"$f":"All!AF411","v":0},{"$f":"All!AG411","v":0},{"$f":"All!AH411","v":0},{"$f":"All!AI411","v":0},{"$f":"All!AJ411","v":0},{"$f":"All!AK411","v":0},{"$f":"All!AL411","v":0},{"$f":"All!AM411","v":0},{"$f":"All!AN411","v":0},{"$f":"All!AO411","v":0},{"$f":"All!AP411","v":0},{"$f":"All!AQ411","v":0},{"$f":"All!AR411","v":0},{"$f":"All!AS411","v":0},{"$f":"All!AT411","v":0}]
[null,{"$f":"All!B412","v":"5"},{"$f":"All!C412","v":"5.3"},{"$f":"All!D412","v":"5.3.1"},{"$f":"All!E412","v":""},{"$f":"All!F412","v":"5.3.1.3"},{"$f":"All!G412","v":0},{"$f":"All!H412","v":0},{"$f":"All!I412","v":"5.3.1.3.2"},{"$f":"All!J412","v":"5.3.1.3.2: Is the severity of each security risk assessed by considering the impact and likelihood of the risk occurring, taking into account the controls that are in place to mitigate the risk?\n"},{"$f":"All!K412","v":"1) Information security risk management process\n- Check that there is a process to assess security risks\n- Check that the assessment process includes the assessment of the impact and likelihood of a risk occurring\n- Check that the assessment includes consideration of controls that are in place to mitigate the risk"},{"$f":"All!L412","v":0},{"$f":"All!M412","v":"Recommended"},{"$f":"All!N412","v":"Recommended"},{"$f":"All!O412","v":"TechOps"},{"$f":"All!P412","v":0},{"$f":"All!Q412","v":0},{"$f":"All!R412","v":0},{"$f":"All!S412","v":0},{"$f":"All!T412","v":0},{"$f":"All!U412","v":0},{"$f":"All!V412","v":0},{"$f":"All!W412","v":0},{"$f":"All!X412","v":0},{"$f":"All!Y412","v":0},{"$f":"All!Z412","v":0},{"$f":"All!AA412","v":0},{"$f":"All!AB412","v":0},{"$f":"All!AC412","v":0},{"$f":"All!AD412","v":0},{"$f":"All!AE412","v":0},{"$f":"All!AF412","v":0},{"$f":"All!AG412","v":0},{"$f":"All!AH412","v":0},{"$f":"All!AI412","v":0},{"$f":"All!AJ412","v":0},{"$f":"All!AK412","v":0},{"$f":"All!AL412","v":0},{"$f":"All!AM412","v":0},{"$f":"All!AN412","v":0},{"$f":"All!AO412","v":0},{"$f":"All!AP412","v":0},{"$f":"All!AQ412","v":0},{"$f":"All!AR412","v":0},{"$f":"All!AS412","v":0},{"$f":"All!AT412","v":0}]
[null,{"$f":"All!B413","v":"5"},{"$f":"All!C413","v":"5.3"},{"$f":"All!D413","v":"5.3.1"},{"$f":"All!E413","v":""},{"$f":"All!F413","v":"5.3.1.3"},{"$f":"All!G413","v":0},{"$f":"All!H413","v":0},{"$f":"All!I413","v":"5.3.1.3.3"},{"$f":"All!J413","v":"5.3.1.3.3: Does the security risk management process identify controls which could be implemented to reduce the severity of the risk by reducing the impact and/or likelihood?\n"},{"$f":"All!K413","v":"1) Information security risk management process\n- Check that there is a process identifies controls that should be implemented to reduce the severity of the risk by reducing the impact and/or likelihood of the risk occurring"},{"$f":"All!L413","v":0},{"$f":"All!M413","v":"Recommended"},{"$f":"All!N413","v":"Recommended"},{"$f":"All!O413","v":"TechOps"},{"$f":"All!P413","v":0},{"$f":"All!Q413","v":0},{"$f":"All!R413","v":0},{"$f":"All!S413","v":0},{"$f":"All!T413","v":0},{"$f":"All!U413","v":0},{"$f":"All!V413","v":0},{"$f":"All!W413","v":0},{"$f":"All!X413","v":0},{"$f":"All!Y413","v":0},{"$f":"All!Z413","v":0},{"$f":"All!AA413","v":0},{"$f":"All!AB413","v":0},{"$f":"All!AC413","v":0},{"$f":"All!AD413","v":0},{"$f":"All!AE413","v":0},{"$f":"All!AF413","v":0},{"$f":"All!AG413","v":0},{"$f":"All!AH413","v":0},{"$f":"All!AI413","v":0},{"$f":"All!AJ413","v":0},{"$f":"All!AK413","v":0},{"$f":"All!AL413","v":0},{"$f":"All!AM413","v":0},{"$f":"All!AN413","v":0},{"$f":"All!AO413","v":0},{"$f":"All!AP413","v":0},{"$f":"All!AQ413","v":0},{"$f":"All!AR413","v":0},{"$f":"All!AS413","v":0},{"$f":"All!AT413","v":0}]
[null,{"$f":"All!B414","v":"5"},{"$f":"All!C414","v":"5.3"},{"$f":"All!D414","v":"5.3.1"},{"$f":"All!E414","v":""},{"$f":"All!F414","v":"5.3.1.3"},{"$f":"All!G414","v":0},{"$f":"All!H414","v":0},{"$f":"All!I414","v":"5.3.1.3.4"},{"$f":"All!J414","v":"5.3.1.3.4: Does the security risk management process identify actions to be taken to treat each risk by applying additional controls or deciding to tolerate the level of risk?\n"},{"$f":"All!K414","v":"1) Information security risk management process\n- Check that there is a process identifies actions to be taken to treat each risk by applying additional controls or deciding to tolerate the level of risk"},{"$f":"All!L414","v":0},{"$f":"All!M414","v":"Recommended"},{"$f":"All!N414","v":"Recommended"},{"$f":"All!O414","v":"TechOps"},{"$f":"All!P414","v":0},{"$f":"All!Q414","v":0},{"$f":"All!R414","v":0},{"$f":"All!S414","v":0},{"$f":"All!T414","v":0},{"$f":"All!U414","v":0},{"$f":"All!V414","v":0},{"$f":"All!W414","v":0},{"$f":"All!X414","v":0},{"$f":"All!Y414","v":0},{"$f":"All!Z414","v":0},{"$f":"All!AA414","v":0},{"$f":"All!AB414","v":0},{"$f":"All!AC414","v":0},{"$f":"All!AD414","v":0},{"$f":"All!AE414","v":0},{"$f":"All!AF414","v":0},{"$f":"All!AG414","v":0},{"$f":"All!AH414","v":0},{"$f":"All!AI414","v":0},{"$f":"All!AJ414","v":0},{"$f":"All!AK414","v":0},{"$f":"All!AL414","v":0},{"$f":"All!AM414","v":0},{"$f":"All!AN414","v":0},{"$f":"All!AO414","v":0},{"$f":"All!AP414","v":0},{"$f":"All!AQ414","v":0},{"$f":"All!AR414","v":0},{"$f":"All!AS414","v":0},{"$f":"All!AT414","v":0}]
[null,{"$f":"All!B415","v":"5"},{"$f":"All!C415","v":"5.3"},{"$f":"All!D415","v":"5.3.1"},{"$f":"All!E415","v":""},{"$f":"All!F415","v":"5.3.1.3"},{"$f":"All!G415","v":0},{"$f":"All!H415","v":0},{"$f":"All!I415","v":"5.3.1.3.5"},{"$f":"All!J415","v":"5.3.1.3.5: Are all decisions to tolerate security risks confirmed at the appropriate level of management and documented?\n"},{"$f":"All!K415","v":"1) Information security risk management process\n- Check that where a decision is taken to tolerate a security risk that this is confirmed by an appropriate level of management\n- Check that the process identifies what level of management is required to confirm a decision to tolerate a risk\n- Check that the decision and confirmation is records including the details of the confirmer\n- Check that the process is documented"},{"$f":"All!L415","v":0},{"$f":"All!M415","v":"Recommended"},{"$f":"All!N415","v":"Recommended"},{"$f":"All!O415","v":"TechOps"},{"$f":"All!P415","v":0},{"$f":"All!Q415","v":0},{"$f":"All!R415","v":0},{"$f":"All!S415","v":0},{"$f":"All!T415","v":0},{"$f":"All!U415","v":0},{"$f":"All!V415","v":0},{"$f":"All!W415","v":0},{"$f":"All!X415","v":0},{"$f":"All!Y415","v":0},{"$f":"All!Z415","v":0},{"$f":"All!AA415","v":0},{"$f":"All!AB415","v":0},{"$f":"All!AC415","v":0},{"$f":"All!AD415","v":0},{"$f":"All!AE415","v":0},{"$f":"All!AF415","v":0},{"$f":"All!AG415","v":0},{"$f":"All!AH415","v":0},{"$f":"All!AI415","v":0},{"$f":"All!AJ415","v":0},{"$f":"All!AK415","v":0},{"$f":"All!AL415","v":0},{"$f":"All!AM415","v":0},{"$f":"All!AN415","v":0},{"$f":"All!AO415","v":0},{"$f":"All!AP415","v":0},{"$f":"All!AQ415","v":0},{"$f":"All!AR415","v":0},{"$f":"All!AS415","v":0},{"$f":"All!AT415","v":0}]
[null,{"$f":"All!B416","v":"5"},{"$f":"All!C416","v":"5.3"},{"$f":"All!D416","v":"5.3.1"},{"$f":"All!E416","v":""},{"$f":"All!F416","v":"5.3.1.4"},{"$f":"All!G416","v":"5.3.1.4: SECURITY RISK COMMUNICATION AND ACTION MONITORING\nThe results of the security risk assessment should be communicated to risk owners and technical & business managers. High-severity risks should be highlighted.\n\nSecurity risk owners should be informed of their actions for implementing further controls, and these actions should be monitored by the IT Security team to ensure that they are implemented."},{"$f":"All!H416","v":"ISO 27005: 2011, \nPCI DSS, \nECB RSMP"},{"$f":"All!I416","v":"5.3.1.4.1"},{"$f":"All!J416","v":"5.3.1.4.1: Have the results of the security risk assessment been communicated to risk owners and technical & business managers?\n"},{"$f":"All!K416","v":0},{"$f":"All!L416","v":0},{"$f":"All!M416","v":"Recommended"},{"$f":"All!N416","v":"Recommended"},{"$f":"All!O416","v":"TechOps"},{"$f":"All!P416","v":0},{"$f":"All!Q416","v":0},{"$f":"All!R416","v":0},{"$f":"All!S416","v":0},{"$f":"All!T416","v":0},{"$f":"All!U416","v":0},{"$f":"All!V416","v":0},{"$f":"All!W416","v":0},{"$f":"All!X416","v":0},{"$f":"All!Y416","v":0},{"$f":"All!Z416","v":0},{"$f":"All!AA416","v":0},{"$f":"All!AB416","v":0},{"$f":"All!AC416","v":0},{"$f":"All!AD416","v":0},{"$f":"All!AE416","v":0},{"$f":"All!AF416","v":0},{"$f":"All!AG416","v":0},{"$f":"All!AH416","v":0},{"$f":"All!AI416","v":0},{"$f":"All!AJ416","v":0},{"$f":"All!AK416","v":0},{"$f":"All!AL416","v":0},{"$f":"All!AM416","v":0},{"$f":"All!AN416","v":0},{"$f":"All!AO416","v":0},{"$f":"All!AP416","v":0},{"$f":"All!AQ416","v":0},{"$f":"All!AR416","v":0},{"$f":"All!AS416","v":0},{"$f":"All!AT416","v":0}]
[null,{"$f":"All!B417","v":"5"},{"$f":"All!C417","v":"5.3"},{"$f":"All!D417","v":"5.3.1"},{"$f":"All!E417","v":""},{"$f":"All!F417","v":"5.3.1.4"},{"$f":"All!G417","v":0},{"$f":"All!H417","v":0},{"$f":"All!I417","v":"5.3.1.4.2"},{"$f":"All!J417","v":"5.3.1.4.2: Are the actions for implementing further controls monitored by the IT Security team to ensure they are implemented by the risk owners?\n"},{"$f":"All!K417","v":"1) Information security risk management process\n- Check that the IT Security team have a process to monitor that the required additional controls are being implemented by the risk owners\n"},{"$f":"All!L417","v":0},{"$f":"All!M417","v":"Recommended"},{"$f":"All!N417","v":"Recommended"},{"$f":"All!O417","v":"TechOps"},{"$f":"All!P417","v":0},{"$f":"All!Q417","v":0},{"$f":"All!R417","v":0},{"$f":"All!S417","v":0},{"$f":"All!T417","v":0},{"$f":"All!U417","v":0},{"$f":"All!V417","v":0},{"$f":"All!W417","v":0},{"$f":"All!X417","v":0},{"$f":"All!Y417","v":0},{"$f":"All!Z417","v":0},{"$f":"All!AA417","v":0},{"$f":"All!AB417","v":0},{"$f":"All!AC417","v":0},{"$f":"All!AD417","v":0},{"$f":"All!AE417","v":0},{"$f":"All!AF417","v":0},{"$f":"All!AG417","v":0},{"$f":"All!AH417","v":0},{"$f":"All!AI417","v":0},{"$f":"All!AJ417","v":0},{"$f":"All!AK417","v":0},{"$f":"All!AL417","v":0},{"$f":"All!AM417","v":0},{"$f":"All!AN417","v":0},{"$f":"All!AO417","v":0},{"$f":"All!AP417","v":0},{"$f":"All!AQ417","v":0},{"$f":"All!AR417","v":0},{"$f":"All!AS417","v":0},{"$f":"All!AT417","v":0}]
[null,{"$f":"All!B418","v":"5"},{"$f":"All!C418","v":"5.3"},{"$f":"All!D418","v":"5.3.2"},{"$f":"All!E418","v":"5.3.2: Providers shall properly identify and authenticate system users"},{"$f":"All!F418","v":"5.3.2.1"},{"$f":"All!G418","v":"5.3.2.1: ACCESS CONTROL POLICY - AUTHENTICATION\nAn access control policy should be documented. The policy should specify how authentication of users for access to the mobile money back end system and service will be managed.\n\nProviders should implement authentication measures for access to the mobile money application and system components. This should include the following:\n- assign all users and administrators a unique ID;\n- disable or remove generic user IDs;\n- control the addition, deletion, and modification accounts and credentials;\n- promptly revoke access for any terminated users;\n- review user accounts at least every 90 days and remove or disable inactive/inappropriate accounts;\n- manage IDs used by vendors to access, support, or maintain system components via remote access;\n- disable interactive login for all system-to-system accounts.\n\nProviders may also wish to:\n- limit repeated access attempts by locking out the user ID after not more than six attempts;\n- require the user to re-authenticate to re-activate the terminal or session after a session has been idle for more than 15 minutes.\n\nSteps should be taken to ensure that IDs are not shared by multiple users. For example, a security awareness programme should be run, backed up by discliplinary action for non-compliance."},{"$f":"All!H418","v":"PCI DSS, ISO 27002: 2013 Sec. 9.1"},{"$f":"All!I418","v":"5.3.2.1.1"},{"$f":"All!J418","v":"5.3.2.1.1: Is there a documented access control policy, standard or procedure that specifies how authentication of users will be managed, both for mobile money application users and system components?\n"},{"$f":"All!K418","v":"1) Access control standard or security policy or similar document\n- Check there is a documented access control policy\n- Check that it specifies how authentication of users will be managed, both  for mobile money application users and system components."},{"$f":"All!L418","v":0},{"$f":"All!M418","v":"Standard Required"},{"$f":"All!N418","v":"Required"},{"$f":"All!O418","v":"TechOps"},{"$f":"All!P418","v":0},{"$f":"All!Q418","v":0},{"$f":"All!R418","v":0},{"$f":"All!S418","v":0},{"$f":"All!T418","v":0},{"$f":"All!U418","v":0},{"$f":"All!V418","v":0},{"$f":"All!W418","v":0},{"$f":"All!X418","v":0},{"$f":"All!Y418","v":0},{"$f":"All!Z418","v":0},{"$f":"All!AA418","v":0},{"$f":"All!AB418","v":0},{"$f":"All!AC418","v":0},{"$f":"All!AD418","v":0},{"$f":"All!AE418","v":0},{"$f":"All!AF418","v":0},{"$f":"All!AG418","v":0},{"$f":"All!AH418","v":0},{"$f":"All!AI418","v":0},{"$f":"All!AJ418","v":0},{"$f":"All!AK418","v":0},{"$f":"All!AL418","v":0},{"$f":"All!AM418","v":0},{"$f":"All!AN418","v":0},{"$f":"All!AO418","v":0},{"$f":"All!AP418","v":0},{"$f":"All!AQ418","v":0},{"$f":"All!AR418","v":0},{"$f":"All!AS418","v":0},{"$f":"All!AT418","v":0}]
[null,{"$f":"All!B419","v":"5"},{"$f":"All!C419","v":"5.3"},{"$f":"All!D419","v":"5.3.2"},{"$f":"All!E419","v":0},{"$f":"All!F419","v":"5.3.2.1"},{"$f":"All!G419","v":0},{"$f":"All!H419","v":0},{"$f":"All!I419","v":"5.3.2.1.2"},{"$f":"All!J419","v":"5.3.2.1.2: Are all users that access the mobile money application and system components assigned a unique ID and have generic user IDs been disabled or removed?\n"},{"$f":"All!K419","v":"1) Access control standard or security policy or similar document\n- Check there is a process to allocate a unique ID to any user who accesses the mobile money application.\n- Check there is a process to allocate a unique ID to any user who accesses the mobile money system components.\n- Check that generic/system user IDs are disabled, removed or allocated to a single named owner."},{"$f":"All!L419","v":0},{"$f":"All!M419","v":"Urgent Required"},{"$f":"All!N419","v":"Required"},{"$f":"All!O419","v":"TechOps"},{"$f":"All!P419","v":0},{"$f":"All!Q419","v":0},{"$f":"All!R419","v":0},{"$f":"All!S419","v":0},{"$f":"All!T419","v":0},{"$f":"All!U419","v":0},{"$f":"All!V419","v":0},{"$f":"All!W419","v":0},{"$f":"All!X419","v":0},{"$f":"All!Y419","v":0},{"$f":"All!Z419","v":0},{"$f":"All!AA419","v":0},{"$f":"All!AB419","v":0},{"$f":"All!AC419","v":0},{"$f":"All!AD419","v":0},{"$f":"All!AE419","v":0},{"$f":"All!AF419","v":0},{"$f":"All!AG419","v":0},{"$f":"All!AH419","v":0},{"$f":"All!AI419","v":0},{"$f":"All!AJ419","v":0},{"$f":"All!AK419","v":0},{"$f":"All!AL419","v":0},{"$f":"All!AM419","v":0},{"$f":"All!AN419","v":0},{"$f":"All!AO419","v":0},{"$f":"All!AP419","v":0},{"$f":"All!AQ419","v":0},{"$f":"All!AR419","v":0},{"$f":"All!AS419","v":0},{"$f":"All!AT419","v":0}]
[null,{"$f":"All!B420","v":"5"},{"$f":"All!C420","v":"5.3"},{"$f":"All!D420","v":"5.3.2"},{"$f":"All!E420","v":""},{"$f":"All!F420","v":"5.3.2.1"},{"$f":"All!G420","v":0},{"$f":"All!H420","v":0},{"$f":"All!I420","v":"5.3.2.1.3"},{"$f":"All!J420","v":"5.3.2.1.3: Is the addition, deletion, and modification of user accounts and credentials properly controlled?\n"},{"$f":"All!K420","v":"1) Access control standard or security policy or similar document\n- Check there is a process for managing back-end user accounts\n- Check this covers addition, deletion and modification of accounts\n- Check the process is properly controlled"},{"$f":"All!L420","v":0},{"$f":"All!M420","v":"Urgent Required"},{"$f":"All!N420","v":"Required"},{"$f":"All!O420","v":"TechOps"},{"$f":"All!P420","v":0},{"$f":"All!Q420","v":0},{"$f":"All!R420","v":0},{"$f":"All!S420","v":0},{"$f":"All!T420","v":0},{"$f":"All!U420","v":0},{"$f":"All!V420","v":0},{"$f":"All!W420","v":0},{"$f":"All!X420","v":0},{"$f":"All!Y420","v":0},{"$f":"All!Z420","v":0},{"$f":"All!AA420","v":0},{"$f":"All!AB420","v":0},{"$f":"All!AC420","v":0},{"$f":"All!AD420","v":0},{"$f":"All!AE420","v":0},{"$f":"All!AF420","v":0},{"$f":"All!AG420","v":0},{"$f":"All!AH420","v":0},{"$f":"All!AI420","v":0},{"$f":"All!AJ420","v":0},{"$f":"All!AK420","v":0},{"$f":"All!AL420","v":0},{"$f":"All!AM420","v":0},{"$f":"All!AN420","v":0},{"$f":"All!AO420","v":0},{"$f":"All!AP420","v":0},{"$f":"All!AQ420","v":0},{"$f":"All!AR420","v":0},{"$f":"All!AS420","v":0},{"$f":"All!AT420","v":0}]
[null,{"$f":"All!B421","v":"5"},{"$f":"All!C421","v":"5.3"},{"$f":"All!D421","v":"5.3.2"},{"$f":"All!E421","v":""},{"$f":"All!F421","v":"5.3.2.1"},{"$f":"All!G421","v":0},{"$f":"All!H421","v":0},{"$f":"All!I421","v":"5.3.2.1.4"},{"$f":"All!J421","v":"5.3.2.1.4: Is user access promptly revoked for any terminated users?\n"},{"$f":"All!K421","v":"1) Access control standard or security policy or similar document\n- Check there is a process for the prompt revocation of access rights for any terminated user"},{"$f":"All!L421","v":0},{"$f":"All!M421","v":"Standard Required"},{"$f":"All!N421","v":"Required"},{"$f":"All!O421","v":"TechOps"},{"$f":"All!P421","v":0},{"$f":"All!Q421","v":0},{"$f":"All!R421","v":0},{"$f":"All!S421","v":0},{"$f":"All!T421","v":0},{"$f":"All!U421","v":0},{"$f":"All!V421","v":0},{"$f":"All!W421","v":0},{"$f":"All!X421","v":0},{"$f":"All!Y421","v":0},{"$f":"All!Z421","v":0},{"$f":"All!AA421","v":0},{"$f":"All!AB421","v":0},{"$f":"All!AC421","v":0},{"$f":"All!AD421","v":0},{"$f":"All!AE421","v":0},{"$f":"All!AF421","v":0},{"$f":"All!AG421","v":0},{"$f":"All!AH421","v":0},{"$f":"All!AI421","v":0},{"$f":"All!AJ421","v":0},{"$f":"All!AK421","v":0},{"$f":"All!AL421","v":0},{"$f":"All!AM421","v":0},{"$f":"All!AN421","v":0},{"$f":"All!AO421","v":0},{"$f":"All!AP421","v":0},{"$f":"All!AQ421","v":0},{"$f":"All!AR421","v":0},{"$f":"All!AS421","v":0},{"$f":"All!AT421","v":0}]
[null,{"$f":"All!B422","v":"5"},{"$f":"All!C422","v":"5.3"},{"$f":"All!D422","v":"5.3.2"},{"$f":"All!E422","v":""},{"$f":"All!F422","v":"5.3.2.1"},{"$f":"All!G422","v":0},{"$f":"All!H422","v":0},{"$f":"All!I422","v":"5.3.2.1.5"},{"$f":"All!J422","v":"5.3.2.1.5: Are steps taken to ensure that IDs are not shared by multiple users?\n"},{"$f":"All!K422","v":"1) Security awareness programme\n- Check there is a process to educate staff about not sharing login credentials, for example, training, screen notices, disciplinary processes etc."},{"$f":"All!L422","v":0},{"$f":"All!M422","v":"Urgent Required"},{"$f":"All!N422","v":"Required"},{"$f":"All!O422","v":"TechOps"},{"$f":"All!P422","v":0},{"$f":"All!Q422","v":0},{"$f":"All!R422","v":0},{"$f":"All!S422","v":0},{"$f":"All!T422","v":0},{"$f":"All!U422","v":0},{"$f":"All!V422","v":0},{"$f":"All!W422","v":0},{"$f":"All!X422","v":0},{"$f":"All!Y422","v":0},{"$f":"All!Z422","v":0},{"$f":"All!AA422","v":0},{"$f":"All!AB422","v":0},{"$f":"All!AC422","v":0},{"$f":"All!AD422","v":0},{"$f":"All!AE422","v":0},{"$f":"All!AF422","v":0},{"$f":"All!AG422","v":0},{"$f":"All!AH422","v":0},{"$f":"All!AI422","v":0},{"$f":"All!AJ422","v":0},{"$f":"All!AK422","v":0},{"$f":"All!AL422","v":0},{"$f":"All!AM422","v":0},{"$f":"All!AN422","v":0},{"$f":"All!AO422","v":0},{"$f":"All!AP422","v":0},{"$f":"All!AQ422","v":0},{"$f":"All!AR422","v":0},{"$f":"All!AS422","v":0},{"$f":"All!AT422","v":0}]
[null,{"$f":"All!B423","v":"5"},{"$f":"All!C423","v":"5.3"},{"$f":"All!D423","v":"5.3.2"},{"$f":"All!E423","v":""},{"$f":"All!F423","v":"5.3.2.1"},{"$f":"All!G423","v":0},{"$f":"All!H423","v":0},{"$f":"All!I423","v":"5.3.2.1.6"},{"$f":"All!J423","v":"5.3.2.1.6: Are user accounts reviewed at least every 90 days, and are inactive/inappropriate accounts removed or disabled?\n"},{"$f":"All!K423","v":0},{"$f":"All!L423","v":0},{"$f":"All!M423","v":"Recommended"},{"$f":"All!N423","v":"Recommended"},{"$f":"All!O423","v":"TechOps"},{"$f":"All!P423","v":0},{"$f":"All!Q423","v":0},{"$f":"All!R423","v":0},{"$f":"All!S423","v":0},{"$f":"All!T423","v":0},{"$f":"All!U423","v":0},{"$f":"All!V423","v":0},{"$f":"All!W423","v":0},{"$f":"All!X423","v":0},{"$f":"All!Y423","v":0},{"$f":"All!Z423","v":0},{"$f":"All!AA423","v":0},{"$f":"All!AB423","v":0},{"$f":"All!AC423","v":0},{"$f":"All!AD423","v":0},{"$f":"All!AE423","v":0},{"$f":"All!AF423","v":0},{"$f":"All!AG423","v":0},{"$f":"All!AH423","v":0},{"$f":"All!AI423","v":0},{"$f":"All!AJ423","v":0},{"$f":"All!AK423","v":0},{"$f":"All!AL423","v":0},{"$f":"All!AM423","v":0},{"$f":"All!AN423","v":0},{"$f":"All!AO423","v":0},{"$f":"All!AP423","v":0},{"$f":"All!AQ423","v":0},{"$f":"All!AR423","v":0},{"$f":"All!AS423","v":0},{"$f":"All!AT423","v":0}]
[null,{"$f":"All!B424","v":"5"},{"$f":"All!C424","v":"5.3"},{"$f":"All!D424","v":"5.3.2"},{"$f":"All!E424","v":""},{"$f":"All!F424","v":"5.3.2.1"},{"$f":"All!G424","v":0},{"$f":"All!H424","v":0},{"$f":"All!I424","v":"5.3.2.1.7"},{"$f":"All!J424","v":"5.3.2.1.7: Is interactive login disabled for all system-to-system accounts?\n"},{"$f":"All!K424","v":0},{"$f":"All!L424","v":0},{"$f":"All!M424","v":"Recommended"},{"$f":"All!N424","v":"Recommended"},{"$f":"All!O424","v":"TechOps"},{"$f":"All!P424","v":0},{"$f":"All!Q424","v":0},{"$f":"All!R424","v":0},{"$f":"All!S424","v":0},{"$f":"All!T424","v":0},{"$f":"All!U424","v":0},{"$f":"All!V424","v":0},{"$f":"All!W424","v":0},{"$f":"All!X424","v":0},{"$f":"All!Y424","v":0},{"$f":"All!Z424","v":0},{"$f":"All!AA424","v":0},{"$f":"All!AB424","v":0},{"$f":"All!AC424","v":0},{"$f":"All!AD424","v":0},{"$f":"All!AE424","v":0},{"$f":"All!AF424","v":0},{"$f":"All!AG424","v":0},{"$f":"All!AH424","v":0},{"$f":"All!AI424","v":0},{"$f":"All!AJ424","v":0},{"$f":"All!AK424","v":0},{"$f":"All!AL424","v":0},{"$f":"All!AM424","v":0},{"$f":"All!AN424","v":0},{"$f":"All!AO424","v":0},{"$f":"All!AP424","v":0},{"$f":"All!AQ424","v":0},{"$f":"All!AR424","v":0},{"$f":"All!AS424","v":0},{"$f":"All!AT424","v":0}]
[null,{"$f":"All!B425","v":"5"},{"$f":"All!C425","v":"5.3"},{"$f":"All!D425","v":"5.3.2"},{"$f":"All!E425","v":""},{"$f":"All!F425","v":"5.3.2.2"},{"$f":"All!G425","v":"5.3.2.2: TWO-FACTOR AUTHENTICATION\nTwo-factor authentication means identifying users by two means. One factor is usually a security credential (such as a PIN or password), and the second factor is normally the user's handset.\n\nTwo-factor authentication should be employed for any access route that is higher risk. For mobile money, two-factor authentication should be enforced for the following access:\n- USSD or STK handset transactions should identify the handset via the MSISDN associated with the SIM;\n- Smartphone users should have their handset securely associated with their account before it is used for transactions;\n- Web and PoS transactions should include a customer confirmation step which involves use of both their handset and PIN.\n- Each user of the mobile money application should have a certificate installed on their computer to identify it (e.g. customer service staff and agents);\n- Remote access to mobile money system components (from outside the premises) should require a certificate on the user's computer or an access card that generates a pass code."},{"$f":"All!H425","v":"PCI DSS, ISO 27002: 2013 Sec. 9.1"},{"$f":"All!I425","v":"5.3.2.2.1"},{"$f":"All!J425","v":"5.3.2.2.1: Are both handset and PIN required for all account-debiting customer transactions?\n"},{"$f":"All!K425","v":"1) Access control standard or security policy or similar document\n- Check that both handset and PIN are required for all account-debiting customer transactions (including transactions from both feature phones and smartphones).\n\n2) Demonstration of a customer and agent login on feature phone and smartphone (if applicable).\n- Review transaction initiation to confirm authentication is effective (both positive and negative cases)"},{"$f":"All!L425","v":0},{"$f":"All!M425","v":"Urgent Required"},{"$f":"All!N425","v":"Required"},{"$f":"All!O425","v":"TechOps"},{"$f":"All!P425","v":0},{"$f":"All!Q425","v":0},{"$f":"All!R425","v":0},{"$f":"All!S425","v":0},{"$f":"All!T425","v":0},{"$f":"All!U425","v":0},{"$f":"All!V425","v":0},{"$f":"All!W425","v":0},{"$f":"All!X425","v":0},{"$f":"All!Y425","v":0},{"$f":"All!Z425","v":0},{"$f":"All!AA425","v":0},{"$f":"All!AB425","v":0},{"$f":"All!AC425","v":0},{"$f":"All!AD425","v":0},{"$f":"All!AE425","v":0},{"$f":"All!AF425","v":0},{"$f":"All!AG425","v":0},{"$f":"All!AH425","v":0},{"$f":"All!AI425","v":0},{"$f":"All!AJ425","v":0},{"$f":"All!AK425","v":0},{"$f":"All!AL425","v":0},{"$f":"All!AM425","v":0},{"$f":"All!AN425","v":0},{"$f":"All!AO425","v":0},{"$f":"All!AP425","v":0},{"$f":"All!AQ425","v":0},{"$f":"All!AR425","v":0},{"$f":"All!AS425","v":0},{"$f":"All!AT425","v":0}]
[null,{"$f":"All!B426","v":"5"},{"$f":"All!C426","v":"5.3"},{"$f":"All!D426","v":"5.3.2"},{"$f":"All!E426","v":0},{"$f":"All!F426","v":"5.3.2.2"},{"$f":"All!G426","v":0},{"$f":"All!H426","v":0},{"$f":"All!I426","v":0},{"$f":"All!J426","v":"5.3.2.2.2: Do all online purchase, ATM and PoS transactions (both merchant and cash-out if applicable) include a customer confirmation step which involves use of both their handset and PIN?\n"},{"$f":"All!K426","v":"1) Access control standard or security policy or similar document\n- Check that all online purchase and PoS transactions (both merchant and cash-out if applicable) include a customer confirmation step which involves use of both their handset and PIN.\n\n2) Demonstration of web and PoS transactions (if possible)\n- Check that all web and PoS merchant / cash-out transactions include a customer confirmation step which involves use of both their handset and PIN."},{"$f":"All!L426","v":0},{"$f":"All!M426","v":"Urgent Required"},{"$f":"All!N426","v":"Required"},{"$f":"All!O426","v":"TechOps"},{"$f":"All!P426","v":0},{"$f":"All!Q426","v":0},{"$f":"All!R426","v":0},{"$f":"All!S426","v":0},{"$f":"All!T426","v":0},{"$f":"All!U426","v":0},{"$f":"All!V426","v":0},{"$f":"All!W426","v":0},{"$f":"All!X426","v":0},{"$f":"All!Y426","v":0},{"$f":"All!Z426","v":0},{"$f":"All!AA426","v":0},{"$f":"All!AB426","v":0},{"$f":"All!AC426","v":0},{"$f":"All!AD426","v":0},{"$f":"All!AE426","v":0},{"$f":"All!AF426","v":0},{"$f":"All!AG426","v":0},{"$f":"All!AH426","v":0},{"$f":"All!AI426","v":0},{"$f":"All!AJ426","v":0},{"$f":"All!AK426","v":0},{"$f":"All!AL426","v":0},{"$f":"All!AM426","v":0},{"$f":"All!AN426","v":0},{"$f":"All!AO426","v":0},{"$f":"All!AP426","v":0},{"$f":"All!AQ426","v":0},{"$f":"All!AR426","v":0},{"$f":"All!AS426","v":0},{"$f":"All!AT426","v":0}]
[null,{"$f":"All!B427","v":"5"},{"$f":"All!C427","v":"5.3"},{"$f":"All!D427","v":"5.3.2"},{"$f":"All!E427","v":""},{"$f":"All!F427","v":"5.3.2.2"},{"$f":"All!G427","v":0},{"$f":"All!H427","v":0},{"$f":"All!I427","v":"5.3.2.2.3"},{"$f":"All!J427","v":"5.3.2.2.3: Do all mobile money application users (e.g. customer service staff and agents) have certificates installed on their computers (or another two-factor authentication mechanism)?\n"},{"$f":"All!K427","v":"1) Access control standard or security policy or similar document\n- Check that all mobile money application users (e.g. customer service staff and agents) have certificates installed on their computers (or another two-factor authentication mechanism)\n"},{"$f":"All!L427","v":0},{"$f":"All!M427","v":"Urgent Required"},{"$f":"All!N427","v":"Required"},{"$f":"All!O427","v":"TechOps"},{"$f":"All!P427","v":0},{"$f":"All!Q427","v":0},{"$f":"All!R427","v":0},{"$f":"All!S427","v":0},{"$f":"All!T427","v":0},{"$f":"All!U427","v":0},{"$f":"All!V427","v":0},{"$f":"All!W427","v":0},{"$f":"All!X427","v":0},{"$f":"All!Y427","v":0},{"$f":"All!Z427","v":0},{"$f":"All!AA427","v":0},{"$f":"All!AB427","v":0},{"$f":"All!AC427","v":0},{"$f":"All!AD427","v":0},{"$f":"All!AE427","v":0},{"$f":"All!AF427","v":0},{"$f":"All!AG427","v":0},{"$f":"All!AH427","v":0},{"$f":"All!AI427","v":0},{"$f":"All!AJ427","v":0},{"$f":"All!AK427","v":0},{"$f":"All!AL427","v":0},{"$f":"All!AM427","v":0},{"$f":"All!AN427","v":0},{"$f":"All!AO427","v":0},{"$f":"All!AP427","v":0},{"$f":"All!AQ427","v":0},{"$f":"All!AR427","v":0},{"$f":"All!AS427","v":0},{"$f":"All!AT427","v":0}]
[null,{"$f":"All!B428","v":"5"},{"$f":"All!C428","v":"5.3"},{"$f":"All!D428","v":"5.3.2"},{"$f":"All!E428","v":""},{"$f":"All!F428","v":"5.3.2.2"},{"$f":"All!G428","v":0},{"$f":"All!H428","v":0},{"$f":"All!I428","v":"5.3.2.2.4"},{"$f":"All!J428","v":"5.3.2.2.4: Is two-factor authentication required for any remote access by staff or third parties to mobile money system components (e.g. a certificate on their computer or an access card that generates a pass code)?\n"},{"$f":"All!K428","v":"1) Access control standard or security policy or similar document\n- Check that two-factor authentication is required for any remote access (from outside the premises) by staff or third parties to mobile money system components (e.g. a certificate on their computer or an access card that generates a pass code)."},{"$f":"All!L428","v":0},{"$f":"All!M428","v":"Standard Required"},{"$f":"All!N428","v":"Required"},{"$f":"All!O428","v":"TechOps"},{"$f":"All!P428","v":0},{"$f":"All!Q428","v":0},{"$f":"All!R428","v":0},{"$f":"All!S428","v":0},{"$f":"All!T428","v":0},{"$f":"All!U428","v":0},{"$f":"All!V428","v":0},{"$f":"All!W428","v":0},{"$f":"All!X428","v":0},{"$f":"All!Y428","v":0},{"$f":"All!Z428","v":0},{"$f":"All!AA428","v":0},{"$f":"All!AB428","v":0},{"$f":"All!AC428","v":0},{"$f":"All!AD428","v":0},{"$f":"All!AE428","v":0},{"$f":"All!AF428","v":0},{"$f":"All!AG428","v":0},{"$f":"All!AH428","v":0},{"$f":"All!AI428","v":0},{"$f":"All!AJ428","v":0},{"$f":"All!AK428","v":0},{"$f":"All!AL428","v":0},{"$f":"All!AM428","v":0},{"$f":"All!AN428","v":0},{"$f":"All!AO428","v":0},{"$f":"All!AP428","v":0},{"$f":"All!AQ428","v":0},{"$f":"All!AR428","v":0},{"$f":"All!AS428","v":0},{"$f":"All!AT428","v":0}]
[null,{"$f":"All!B429","v":"5"},{"$f":"All!C429","v":"5.3"},{"$f":"All!D429","v":"5.3.2"},{"$f":"All!E429","v":""},{"$f":"All!F429","v":"5.3.2.3"},{"$f":"All!G429","v":"5.3.2.3: ALLOCATION OF SECURITY CREDENTIALS (PINs) TO CUSTOMERS\nProcedures should be implemented to verify the identity of a customer/agent prior to providing new or replacement security credentials (e.g. PIN or password).\n\nUsers should set their own PIN/password, and steps should be taken to prevent third parties from interference in the setup of customer security credentials. For example, agents should  be made aware that they should not set or change a customer's PIN. \n\nIf customers are provided initially with a temporary PIN/password it should be unique and not guessable and customers should be required to change it on first use. It should be sent in a secure manner: the use of clear text email messages should be avoided. \n\nCustomers and agents should be able to change their own PIN or password."},{"$f":"All!H429","v":"PCI DSS, ISO 27002: 2013 Sec. 9.1, 9.2"},{"$f":"All!I429","v":"5.3.2.3.1"},{"$f":"All!J429","v":"5.3.2.3.1: Are procedures implemented to verify the identity of a customer/agent prior to providing replacement security credentials (e.g. PIN/password)?\n"},{"$f":"All!K429","v":"1) Access control standard or security policy or similar document\n- Check that there is a process to verify the identity of a customer/agent prior to providing replacement security credential (e.g. the process in 7.1.1.5)\n2) Demonstration of self-service PIN / password change process (if applicable)\n- Check the process has been implemented"},{"$f":"All!L429","v":0},{"$f":"All!M429","v":"Urgent Required"},{"$f":"All!N429","v":"Required"},{"$f":"All!O429","v":"TechOps"},{"$f":"All!P429","v":0},{"$f":"All!Q429","v":0},{"$f":"All!R429","v":0},{"$f":"All!S429","v":0},{"$f":"All!T429","v":0},{"$f":"All!U429","v":0},{"$f":"All!V429","v":0},{"$f":"All!W429","v":0},{"$f":"All!X429","v":0},{"$f":"All!Y429","v":0},{"$f":"All!Z429","v":0},{"$f":"All!AA429","v":0},{"$f":"All!AB429","v":0},{"$f":"All!AC429","v":0},{"$f":"All!AD429","v":0},{"$f":"All!AE429","v":0},{"$f":"All!AF429","v":0},{"$f":"All!AG429","v":0},{"$f":"All!AH429","v":0},{"$f":"All!AI429","v":0},{"$f":"All!AJ429","v":0},{"$f":"All!AK429","v":0},{"$f":"All!AL429","v":0},{"$f":"All!AM429","v":0},{"$f":"All!AN429","v":0},{"$f":"All!AO429","v":0},{"$f":"All!AP429","v":0},{"$f":"All!AQ429","v":0},{"$f":"All!AR429","v":0},{"$f":"All!AS429","v":0},{"$f":"All!AT429","v":0}]
[null,{"$f":"All!B430","v":"5"},{"$f":"All!C430","v":"5.3"},{"$f":"All!D430","v":"5.3.2"},{"$f":"All!E430","v":""},{"$f":"All!F430","v":"5.3.2.3"},{"$f":"All!G430","v":0},{"$f":"All!H430","v":0},{"$f":"All!I430","v":"5.3.2.3.2"},{"$f":"All!J430","v":"5.3.2.3.2: If customers and agents are sent temporary PINs / passwords are they required to change them prior to using the mobile money service?\n"},{"$f":"All!K430","v":"1) Access control standard or security policy or similar document or demonstration of account creation\n- Check that if temporary PINs/passwords are sent to users they have to change them prior to using the mobile money service.\n"},{"$f":"All!L430","v":0},{"$f":"All!M430","v":"Standard Required"},{"$f":"All!N430","v":"Required"},{"$f":"All!O430","v":"TechOps"},{"$f":"All!P430","v":0},{"$f":"All!Q430","v":0},{"$f":"All!R430","v":0},{"$f":"All!S430","v":0},{"$f":"All!T430","v":0},{"$f":"All!U430","v":0},{"$f":"All!V430","v":0},{"$f":"All!W430","v":0},{"$f":"All!X430","v":0},{"$f":"All!Y430","v":0},{"$f":"All!Z430","v":0},{"$f":"All!AA430","v":0},{"$f":"All!AB430","v":0},{"$f":"All!AC430","v":0},{"$f":"All!AD430","v":0},{"$f":"All!AE430","v":0},{"$f":"All!AF430","v":0},{"$f":"All!AG430","v":0},{"$f":"All!AH430","v":0},{"$f":"All!AI430","v":0},{"$f":"All!AJ430","v":0},{"$f":"All!AK430","v":0},{"$f":"All!AL430","v":0},{"$f":"All!AM430","v":0},{"$f":"All!AN430","v":0},{"$f":"All!AO430","v":0},{"$f":"All!AP430","v":0},{"$f":"All!AQ430","v":0},{"$f":"All!AR430","v":0},{"$f":"All!AS430","v":0},{"$f":"All!AT430","v":0}]
[null,{"$f":"All!B431","v":"5"},{"$f":"All!C431","v":"5.3"},{"$f":"All!D431","v":"5.3.2"},{"$f":"All!E431","v":""},{"$f":"All!F431","v":"5.3.2.3"},{"$f":"All!G431","v":0},{"$f":"All!H431","v":0},{"$f":"All!I431","v":"5.3.2.3.3"},{"$f":"All!J431","v":"5.3.2.3.3: Are temporary PINs sent to customers securely, and are all temporary PINs unique and not guessable?\n"},{"$f":"All!K431","v":0},{"$f":"All!L431","v":0},{"$f":"All!M431","v":"Recommended"},{"$f":"All!N431","v":"Recommended"},{"$f":"All!O431","v":"TechOps"},{"$f":"All!P431","v":0},{"$f":"All!Q431","v":0},{"$f":"All!R431","v":0},{"$f":"All!S431","v":0},{"$f":"All!T431","v":0},{"$f":"All!U431","v":0},{"$f":"All!V431","v":0},{"$f":"All!W431","v":0},{"$f":"All!X431","v":0},{"$f":"All!Y431","v":0},{"$f":"All!Z431","v":0},{"$f":"All!AA431","v":0},{"$f":"All!AB431","v":0},{"$f":"All!AC431","v":0},{"$f":"All!AD431","v":0},{"$f":"All!AE431","v":0},{"$f":"All!AF431","v":0},{"$f":"All!AG431","v":0},{"$f":"All!AH431","v":0},{"$f":"All!AI431","v":0},{"$f":"All!AJ431","v":0},{"$f":"All!AK431","v":0},{"$f":"All!AL431","v":0},{"$f":"All!AM431","v":0},{"$f":"All!AN431","v":0},{"$f":"All!AO431","v":0},{"$f":"All!AP431","v":0},{"$f":"All!AQ431","v":0},{"$f":"All!AR431","v":0},{"$f":"All!AS431","v":0},{"$f":"All!AT431","v":0}]
[null,{"$f":"All!B432","v":"5"},{"$f":"All!C432","v":"5.3"},{"$f":"All!D432","v":"5.3.2"},{"$f":"All!E432","v":0},{"$f":"All!F432","v":"5.3.2.3"},{"$f":"All!G432","v":0},{"$f":"All!H432","v":0},{"$f":"All!I432","v":0},{"$f":"All!J432","v":"5.3.2.3.4: Can customers and agents change their own PIN or password?\n"},{"$f":"All!K432","v":0},{"$f":"All!L432","v":0},{"$f":"All!M432","v":"Recommended"},{"$f":"All!N432","v":"Recommended"},{"$f":"All!O432","v":"TechOps"},{"$f":"All!P432","v":0},{"$f":"All!Q432","v":0},{"$f":"All!R432","v":0},{"$f":"All!S432","v":0},{"$f":"All!T432","v":0},{"$f":"All!U432","v":0},{"$f":"All!V432","v":0},{"$f":"All!W432","v":0},{"$f":"All!X432","v":0},{"$f":"All!Y432","v":0},{"$f":"All!Z432","v":0},{"$f":"All!AA432","v":0},{"$f":"All!AB432","v":0},{"$f":"All!AC432","v":0},{"$f":"All!AD432","v":0},{"$f":"All!AE432","v":0},{"$f":"All!AF432","v":0},{"$f":"All!AG432","v":0},{"$f":"All!AH432","v":0},{"$f":"All!AI432","v":0},{"$f":"All!AJ432","v":0},{"$f":"All!AK432","v":0},{"$f":"All!AL432","v":0},{"$f":"All!AM432","v":0},{"$f":"All!AN432","v":0},{"$f":"All!AO432","v":0},{"$f":"All!AP432","v":0},{"$f":"All!AQ432","v":0},{"$f":"All!AR432","v":0},{"$f":"All!AS432","v":0},{"$f":"All!AT432","v":0}]
[null,{"$f":"All!B433","v":"5"},{"$f":"All!C433","v":"5.3"},{"$f":"All!D433","v":"5.3.2"},{"$f":"All!E433","v":""},{"$f":"All!F433","v":"5.3.2.3"},{"$f":"All!G433","v":0},{"$f":"All!H433","v":0},{"$f":"All!I433","v":"5.3.2.3.5"},{"$f":"All!J433","v":"5.3.2.3.5: Are agents made aware that they should not set up or change a customer's security credentials?\n"},{"$f":"All!K433","v":0},{"$f":"All!L433","v":0},{"$f":"All!M433","v":"Recommended"},{"$f":"All!N433","v":"Recommended"},{"$f":"All!O433","v":"TechOps"},{"$f":"All!P433","v":0},{"$f":"All!Q433","v":0},{"$f":"All!R433","v":0},{"$f":"All!S433","v":0},{"$f":"All!T433","v":0},{"$f":"All!U433","v":0},{"$f":"All!V433","v":0},{"$f":"All!W433","v":0},{"$f":"All!X433","v":0},{"$f":"All!Y433","v":0},{"$f":"All!Z433","v":0},{"$f":"All!AA433","v":0},{"$f":"All!AB433","v":0},{"$f":"All!AC433","v":0},{"$f":"All!AD433","v":0},{"$f":"All!AE433","v":0},{"$f":"All!AF433","v":0},{"$f":"All!AG433","v":0},{"$f":"All!AH433","v":0},{"$f":"All!AI433","v":0},{"$f":"All!AJ433","v":0},{"$f":"All!AK433","v":0},{"$f":"All!AL433","v":0},{"$f":"All!AM433","v":0},{"$f":"All!AN433","v":0},{"$f":"All!AO433","v":0},{"$f":"All!AP433","v":0},{"$f":"All!AQ433","v":0},{"$f":"All!AR433","v":0},{"$f":"All!AS433","v":0},{"$f":"All!AT433","v":0}]
[null,{"$f":"All!B434","v":"5"},{"$f":"All!C434","v":"5.3"},{"$f":"All!D434","v":"5.3.3"},{"$f":"All!E434","v":"5.3.3: Providers shall limit access to customer data on a “need to know” basis"},{"$f":"All!F434","v":"5.3.3.1"},{"$f":"All!G434","v":"5.3.3.1: ROLE-BASED AUTHORIZATION FOR MOBILE MONEY APPLICATION USERS\nRole-based permissions should be employed for operator accounts in the mobile money system so that specific functions can be assigned to individuals on a granular level, so that users can be restricted to access only the data and perform only the functions that they are supposed to.\n\nMaker-checker should be implemented to prevent a single person from accessing or modifying financial information without authorization or detection. Maker-checker should be enforced for these functions:\n  - financially-sensitive actions/events such as moving money between accounts, \n  - creating more operator accounts (which could be used to steal funds);\n  - accessing and modifying audit records to hide their tracks.\n\nThe possibility of collusion should be considered in designing the controls. Whenever it is difficult to segregate, other controls such as monitoring of activities, audit trails and management supervision should be prioritised."},{"$f":"All!H434","v":"ISO 27002:2013 Sec. 9.2, BCBS RMPEB"},{"$f":"All!I434","v":"5.3.3.1.1"},{"$f":"All!J434","v":"5.3.3.1.1: Are role-based permissions employed to restrict users to access only the data and perform only the functions that they are supposed to?\n"},{"$f":"All!K434","v":"1) Role permission report / matrix\n- Check that operator accounts in the mobile money system are role-based.\n- Check that there is an assessment on what roles are required and what permissions each role should have."},{"$f":"All!L434","v":0},{"$f":"All!M434","v":"Urgent Required"},{"$f":"All!N434","v":"Required"},{"$f":"All!O434","v":"TechOps"},{"$f":"All!P434","v":0},{"$f":"All!Q434","v":0},{"$f":"All!R434","v":0},{"$f":"All!S434","v":0},{"$f":"All!T434","v":0},{"$f":"All!U434","v":0},{"$f":"All!V434","v":0},{"$f":"All!W434","v":0},{"$f":"All!X434","v":0},{"$f":"All!Y434","v":0},{"$f":"All!Z434","v":0},{"$f":"All!AA434","v":0},{"$f":"All!AB434","v":0},{"$f":"All!AC434","v":0},{"$f":"All!AD434","v":0},{"$f":"All!AE434","v":0},{"$f":"All!AF434","v":0},{"$f":"All!AG434","v":0},{"$f":"All!AH434","v":0},{"$f":"All!AI434","v":0},{"$f":"All!AJ434","v":0},{"$f":"All!AK434","v":0},{"$f":"All!AL434","v":0},{"$f":"All!AM434","v":0},{"$f":"All!AN434","v":0},{"$f":"All!AO434","v":0},{"$f":"All!AP434","v":0},{"$f":"All!AQ434","v":0},{"$f":"All!AR434","v":0},{"$f":"All!AS434","v":0},{"$f":"All!AT434","v":0}]
[null,{"$f":"All!B435","v":"5"},{"$f":"All!C435","v":"5.3"},{"$f":"All!D435","v":"5.3.3"},{"$f":"All!E435","v":0},{"$f":"All!F435","v":"5.3.3.1"},{"$f":"All!G435","v":0},{"$f":"All!H435","v":0},{"$f":"All!I435","v":"5.3.3.1.2"},{"$f":"All!J435","v":"5.3.3.1.2: Is maker-checker enforced for all financially-sensitive actions (e.g. moving money between accounts)?\n"},{"$f":"All!K435","v":"1) Role permission report / matrix\n- Check that maker-checker controls are in place for all financially-sensitive actions.\n"},{"$f":"All!L435","v":0},{"$f":"All!M435","v":"Urgent Required"},{"$f":"All!N435","v":"Required"},{"$f":"All!O435","v":"TechOps"},{"$f":"All!P435","v":0},{"$f":"All!Q435","v":0},{"$f":"All!R435","v":0},{"$f":"All!S435","v":0},{"$f":"All!T435","v":0},{"$f":"All!U435","v":0},{"$f":"All!V435","v":0},{"$f":"All!W435","v":0},{"$f":"All!X435","v":0},{"$f":"All!Y435","v":0},{"$f":"All!Z435","v":0},{"$f":"All!AA435","v":0},{"$f":"All!AB435","v":0},{"$f":"All!AC435","v":0},{"$f":"All!AD435","v":0},{"$f":"All!AE435","v":0},{"$f":"All!AF435","v":0},{"$f":"All!AG435","v":0},{"$f":"All!AH435","v":0},{"$f":"All!AI435","v":0},{"$f":"All!AJ435","v":0},{"$f":"All!AK435","v":0},{"$f":"All!AL435","v":0},{"$f":"All!AM435","v":0},{"$f":"All!AN435","v":0},{"$f":"All!AO435","v":0},{"$f":"All!AP435","v":0},{"$f":"All!AQ435","v":0},{"$f":"All!AR435","v":0},{"$f":"All!AS435","v":0},{"$f":"All!AT435","v":0}]
[null,{"$f":"All!B436","v":"5"},{"$f":"All!C436","v":"5.3"},{"$f":"All!D436","v":"5.3.3"},{"$f":"All!E436","v":0},{"$f":"All!F436","v":"5.3.3.1"},{"$f":"All!G436","v":0},{"$f":"All!H436","v":0},{"$f":"All!I436","v":"5.3.3.1.3"},{"$f":"All!J436","v":"5.3.3.1.3: Is maker-checker enforced for operator-creation functions, so that normal operators cannot create more operator accounts (which could potentially be used to steal funds)?\n"},{"$f":"All!K436","v":"1) Role permission report / matrix\n- Check there is maker-checker in place for operator-creation functions.\n- Check that regular operator permissions do not include the ability to create more operators."},{"$f":"All!L436","v":0},{"$f":"All!M436","v":"Urgent Required"},{"$f":"All!N436","v":"Required"},{"$f":"All!O436","v":"TechOps"},{"$f":"All!P436","v":0},{"$f":"All!Q436","v":0},{"$f":"All!R436","v":0},{"$f":"All!S436","v":0},{"$f":"All!T436","v":0},{"$f":"All!U436","v":0},{"$f":"All!V436","v":0},{"$f":"All!W436","v":0},{"$f":"All!X436","v":0},{"$f":"All!Y436","v":0},{"$f":"All!Z436","v":0},{"$f":"All!AA436","v":0},{"$f":"All!AB436","v":0},{"$f":"All!AC436","v":0},{"$f":"All!AD436","v":0},{"$f":"All!AE436","v":0},{"$f":"All!AF436","v":0},{"$f":"All!AG436","v":0},{"$f":"All!AH436","v":0},{"$f":"All!AI436","v":0},{"$f":"All!AJ436","v":0},{"$f":"All!AK436","v":0},{"$f":"All!AL436","v":0},{"$f":"All!AM436","v":0},{"$f":"All!AN436","v":0},{"$f":"All!AO436","v":0},{"$f":"All!AP436","v":0},{"$f":"All!AQ436","v":0},{"$f":"All!AR436","v":0},{"$f":"All!AS436","v":0},{"$f":"All!AT436","v":0}]
[null,{"$f":"All!B437","v":"5"},{"$f":"All!C437","v":"5.3"},{"$f":"All!D437","v":"5.3.3"},{"$f":"All!E437","v":""},{"$f":"All!F437","v":"5.3.3.1"},{"$f":"All!G437","v":0},{"$f":"All!H437","v":0},{"$f":"All!I437","v":"5.3.3.1.4"},{"$f":"All!J437","v":"5.3.3.1.4: Where segregation of duties is difficult, are other controls such as monitoring of activities, audit trails, and management supervision prioritised?\n"},{"$f":"All!K437","v":0},{"$f":"All!L437","v":0},{"$f":"All!M437","v":"Recommended"},{"$f":"All!N437","v":"Recommended"},{"$f":"All!O437","v":"TechOps"},{"$f":"All!P437","v":0},{"$f":"All!Q437","v":0},{"$f":"All!R437","v":0},{"$f":"All!S437","v":0},{"$f":"All!T437","v":0},{"$f":"All!U437","v":0},{"$f":"All!V437","v":0},{"$f":"All!W437","v":0},{"$f":"All!X437","v":0},{"$f":"All!Y437","v":0},{"$f":"All!Z437","v":0},{"$f":"All!AA437","v":0},{"$f":"All!AB437","v":0},{"$f":"All!AC437","v":0},{"$f":"All!AD437","v":0},{"$f":"All!AE437","v":0},{"$f":"All!AF437","v":0},{"$f":"All!AG437","v":0},{"$f":"All!AH437","v":0},{"$f":"All!AI437","v":0},{"$f":"All!AJ437","v":0},{"$f":"All!AK437","v":0},{"$f":"All!AL437","v":0},{"$f":"All!AM437","v":0},{"$f":"All!AN437","v":0},{"$f":"All!AO437","v":0},{"$f":"All!AP437","v":0},{"$f":"All!AQ437","v":0},{"$f":"All!AR437","v":0},{"$f":"All!AS437","v":0},{"$f":"All!AT437","v":0}]
[null,{"$f":"All!B438","v":"5"},{"$f":"All!C438","v":"5.3"},{"$f":"All!D438","v":"5.3.3"},{"$f":"All!E438","v":0},{"$f":"All!F438","v":"5.3.3.2"},{"$f":"All!G438","v":"5.3.3.2: AUTHORIZATION FOR MOBILE MONEY SYSTEM COMPONENTS\nProviders should limit access to system components, databases and log files to only those individuals whose job requires such access, following the principle of \"least privilege\". Providers should: \n- restrict access to the system components and data resources that each user needs to access for their job function;\n- restrict access to the least privilege necessary to perform job responsibilities;\n- require documented approval (electronically or in writing) by authorized parties for all new and changed account privileges.\n\nSpecific controls should be applied to databases containing financial and customer data:\n- Direct access to databases should be carefully controlled and only granted to database administrators.\n- Application IDs for database applications must only be used by the applications (and not by individual users or other non-application processes). It is recommended that monitoring is implemented to check for this.\n\nA user account and role/permissions report should be run at least every three months to highlight those accounts with inappropriate permissions."},{"$f":"All!H438","v":"PCI DSS, ISO 27002: 2013 Sec. 9.2, 9.4"},{"$f":"All!I438","v":"5.3.3.2.1"},{"$f":"All!J438","v":"5.3.3.2.1: Is access to back-end mobile money system components/ databases/log files restricted to only those individuals whose job requires such access, restricting access to the least privilege and only those components necessary to perform job responsibilities?\n"},{"$f":"All!K438","v":"1) Access control standard or security policy or similar document\n- Check there is a process to give access to back-end mobile money system components/databases/log files.\n- Check the process include assessment as to what access is required.\n- Check the process only gives the access permissions that are required and only to the required components.\n"},{"$f":"All!L438","v":0},{"$f":"All!M438","v":"Urgent Required"},{"$f":"All!N438","v":"Required"},{"$f":"All!O438","v":"TechOps"},{"$f":"All!P438","v":0},{"$f":"All!Q438","v":0},{"$f":"All!R438","v":0},{"$f":"All!S438","v":0},{"$f":"All!T438","v":0},{"$f":"All!U438","v":0},{"$f":"All!V438","v":0},{"$f":"All!W438","v":0},{"$f":"All!X438","v":0},{"$f":"All!Y438","v":0},{"$f":"All!Z438","v":0},{"$f":"All!AA438","v":0},{"$f":"All!AB438","v":0},{"$f":"All!AC438","v":0},{"$f":"All!AD438","v":0},{"$f":"All!AE438","v":0},{"$f":"All!AF438","v":0},{"$f":"All!AG438","v":0},{"$f":"All!AH438","v":0},{"$f":"All!AI438","v":0},{"$f":"All!AJ438","v":0},{"$f":"All!AK438","v":0},{"$f":"All!AL438","v":0},{"$f":"All!AM438","v":0},{"$f":"All!AN438","v":0},{"$f":"All!AO438","v":0},{"$f":"All!AP438","v":0},{"$f":"All!AQ438","v":0},{"$f":"All!AR438","v":0},{"$f":"All!AS438","v":0},{"$f":"All!AT438","v":0}]
[null,{"$f":"All!B439","v":"5"},{"$f":"All!C439","v":"5.3"},{"$f":"All!D439","v":"5.3.3"},{"$f":"All!E439","v":""},{"$f":"All!F439","v":"5.3.3.2"},{"$f":"All!G439","v":0},{"$f":"All!H439","v":0},{"$f":"All!I439","v":"5.3.3.2.2"},{"$f":"All!J439","v":"5.3.3.2.2: Is documented approval by authorized parties required for all new and changed account privileges?\n"},{"$f":"All!K439","v":"1) Access control standard or security policy or similar document\n- Check that there is a process that requires documented approval by authorised parties required for all:\na) new account privileges\nb) changes in account privileges\n- Check that there is a process to identify who is authorised to approve new and changes to account privileges\n"},{"$f":"All!L439","v":0},{"$f":"All!M439","v":"Urgent Required"},{"$f":"All!N439","v":"Required"},{"$f":"All!O439","v":"TechOps"},{"$f":"All!P439","v":0},{"$f":"All!Q439","v":0},{"$f":"All!R439","v":0},{"$f":"All!S439","v":0},{"$f":"All!T439","v":0},{"$f":"All!U439","v":0},{"$f":"All!V439","v":0},{"$f":"All!W439","v":0},{"$f":"All!X439","v":0},{"$f":"All!Y439","v":0},{"$f":"All!Z439","v":0},{"$f":"All!AA439","v":0},{"$f":"All!AB439","v":0},{"$f":"All!AC439","v":0},{"$f":"All!AD439","v":0},{"$f":"All!AE439","v":0},{"$f":"All!AF439","v":0},{"$f":"All!AG439","v":0},{"$f":"All!AH439","v":0},{"$f":"All!AI439","v":0},{"$f":"All!AJ439","v":0},{"$f":"All!AK439","v":0},{"$f":"All!AL439","v":0},{"$f":"All!AM439","v":0},{"$f":"All!AN439","v":0},{"$f":"All!AO439","v":0},{"$f":"All!AP439","v":0},{"$f":"All!AQ439","v":0},{"$f":"All!AR439","v":0},{"$f":"All!AS439","v":0},{"$f":"All!AT439","v":0}]
[null,{"$f":"All!B440","v":"5"},{"$f":"All!C440","v":"5.3"},{"$f":"All!D440","v":"5.3.3"},{"$f":"All!E440","v":""},{"$f":"All!F440","v":"5.3.3.2"},{"$f":"All!G440","v":0},{"$f":"All!H440","v":0},{"$f":"All!I440","v":"5.3.3.2.3"},{"$f":"All!J440","v":"5.3.3.2.3: Is direct access to databases carefully controlled and only given to database administrators?\n"},{"$f":"All!K440","v":"1) Access control standard or security policy or similar document\n- Check that there is a process that restricts direct access to databases with only database administrators granted access\n- Check that there are controls in place for granting direct access to the database\n"},{"$f":"All!L440","v":0},{"$f":"All!M440","v":"Standard Required"},{"$f":"All!N440","v":"Required"},{"$f":"All!O440","v":"TechOps"},{"$f":"All!P440","v":0},{"$f":"All!Q440","v":0},{"$f":"All!R440","v":0},{"$f":"All!S440","v":0},{"$f":"All!T440","v":0},{"$f":"All!U440","v":0},{"$f":"All!V440","v":0},{"$f":"All!W440","v":0},{"$f":"All!X440","v":0},{"$f":"All!Y440","v":0},{"$f":"All!Z440","v":0},{"$f":"All!AA440","v":0},{"$f":"All!AB440","v":0},{"$f":"All!AC440","v":0},{"$f":"All!AD440","v":0},{"$f":"All!AE440","v":0},{"$f":"All!AF440","v":0},{"$f":"All!AG440","v":0},{"$f":"All!AH440","v":0},{"$f":"All!AI440","v":0},{"$f":"All!AJ440","v":0},{"$f":"All!AK440","v":0},{"$f":"All!AL440","v":0},{"$f":"All!AM440","v":0},{"$f":"All!AN440","v":0},{"$f":"All!AO440","v":0},{"$f":"All!AP440","v":0},{"$f":"All!AQ440","v":0},{"$f":"All!AR440","v":0},{"$f":"All!AS440","v":0},{"$f":"All!AT440","v":0}]
[null,{"$f":"All!B441","v":"5"},{"$f":"All!C441","v":"5.3"},{"$f":"All!D441","v":"5.3.3"},{"$f":"All!E441","v":""},{"$f":"All!F441","v":"5.3.3.2"},{"$f":"All!G441","v":0},{"$f":"All!H441","v":0},{"$f":"All!I441","v":"5.3.3.2.4"},{"$f":"All!J441","v":"5.3.3.2.4: Are application IDs for database applications only used by the applications and not by individual users or other non-application processes?\n"},{"$f":"All!K441","v":"1) Access control standard or security policy or similar document\n- Check there is a process to ensure application IDs for databases are not used by individuals or other non-application processes."},{"$f":"All!L441","v":0},{"$f":"All!M441","v":"Recommended"},{"$f":"All!N441","v":"Recommended"},{"$f":"All!O441","v":"TechOps"},{"$f":"All!P441","v":0},{"$f":"All!Q441","v":0},{"$f":"All!R441","v":0},{"$f":"All!S441","v":0},{"$f":"All!T441","v":0},{"$f":"All!U441","v":0},{"$f":"All!V441","v":0},{"$f":"All!W441","v":0},{"$f":"All!X441","v":0},{"$f":"All!Y441","v":0},{"$f":"All!Z441","v":0},{"$f":"All!AA441","v":0},{"$f":"All!AB441","v":0},{"$f":"All!AC441","v":0},{"$f":"All!AD441","v":0},{"$f":"All!AE441","v":0},{"$f":"All!AF441","v":0},{"$f":"All!AG441","v":0},{"$f":"All!AH441","v":0},{"$f":"All!AI441","v":0},{"$f":"All!AJ441","v":0},{"$f":"All!AK441","v":0},{"$f":"All!AL441","v":0},{"$f":"All!AM441","v":0},{"$f":"All!AN441","v":0},{"$f":"All!AO441","v":0},{"$f":"All!AP441","v":0},{"$f":"All!AQ441","v":0},{"$f":"All!AR441","v":0},{"$f":"All!AS441","v":0},{"$f":"All!AT441","v":0}]
[null,{"$f":"All!B442","v":"5"},{"$f":"All!C442","v":"5.3"},{"$f":"All!D442","v":"5.3.3"},{"$f":"All!E442","v":""},{"$f":"All!F442","v":"5.3.3.2"},{"$f":"All!G442","v":0},{"$f":"All!H442","v":0},{"$f":"All!I442","v":"5.3.3.2.5"},{"$f":"All!J442","v":"5.3.3.2.5: Is a user account and role/ permissions report run at least every three months to highlight those accounts with inappropriate permissions?\n"},{"$f":"All!K442","v":"1) Access control standard or security policy or similar document\n- Check that there is a process to run reports on user account and role permissions to highlight accounts with inappropriate permissions\n- Check that the process is scheduled to be run at least every three months\n- Check the records of reports to assess that the process is being run at least every three months\n"},{"$f":"All!L442","v":0},{"$f":"All!M442","v":"Standard Required"},{"$f":"All!N442","v":"Required"},{"$f":"All!O442","v":"TechOps"},{"$f":"All!P442","v":0},{"$f":"All!Q442","v":0},{"$f":"All!R442","v":0},{"$f":"All!S442","v":0},{"$f":"All!T442","v":0},{"$f":"All!U442","v":0},{"$f":"All!V442","v":0},{"$f":"All!W442","v":0},{"$f":"All!X442","v":0},{"$f":"All!Y442","v":0},{"$f":"All!Z442","v":0},{"$f":"All!AA442","v":0},{"$f":"All!AB442","v":0},{"$f":"All!AC442","v":0},{"$f":"All!AD442","v":0},{"$f":"All!AE442","v":0},{"$f":"All!AF442","v":0},{"$f":"All!AG442","v":0},{"$f":"All!AH442","v":0},{"$f":"All!AI442","v":0},{"$f":"All!AJ442","v":0},{"$f":"All!AK442","v":0},{"$f":"All!AL442","v":0},{"$f":"All!AM442","v":0},{"$f":"All!AN442","v":0},{"$f":"All!AO442","v":0},{"$f":"All!AP442","v":0},{"$f":"All!AQ442","v":0},{"$f":"All!AR442","v":0},{"$f":"All!AS442","v":0},{"$f":"All!AT442","v":0}]
[null,{"$f":"All!B443","v":"5"},{"$f":"All!C443","v":"5.3"},{"$f":"All!D443","v":"5.3.4"},{"$f":"All!E443","v":"5.3.4: Providers shall limit physical access to systems"},{"$f":"All!F443","v":"5.3.4.1"},{"$f":"All!G443","v":"5.3.4.1: ACCESS CONTROL POLICY - PHYSICAL ACCESS\nProviders should control physical access for onsite personnel to sensitive areas such as data centres. Access must be authorized and based on individual job function. \n\nThe policy should require that physical access privileges should be assigned only to those users that require it. Visitor access should be strictly controlled.\n\nPhysical access rights should be revoked promptly upon termination, and all physical access mechanisms (such as keys and access cards) should be returned or disabled."},{"$f":"All!H443","v":"PCI DSS, ISO 27002:2013 Sec. 11.1"},{"$f":"All!I443","v":"5.3.4.1.1"},{"$f":"All!J443","v":"5.3.4.1.1: Is access to mobile money system data centres restricted to authorized personnel, and only when required for the individual’s job function?\n"},{"$f":"All!K443","v":"1) Access control standard or security policy or similar document\n- Check physical access to the mobile money system's data centre is restricted to authorised personnel.\n- Check those who have authorised access the data-centre only access it when their individual job requires it.\n(Note: if practical, visit the datacentre to assess if the above is operational)\n"},{"$f":"All!L443","v":0},{"$f":"All!M443","v":"Urgent Required"},{"$f":"All!N443","v":"Required"},{"$f":"All!O443","v":"TechOps"},{"$f":"All!P443","v":0},{"$f":"All!Q443","v":0},{"$f":"All!R443","v":0},{"$f":"All!S443","v":0},{"$f":"All!T443","v":0},{"$f":"All!U443","v":0},{"$f":"All!V443","v":0},{"$f":"All!W443","v":0},{"$f":"All!X443","v":0},{"$f":"All!Y443","v":0},{"$f":"All!Z443","v":0},{"$f":"All!AA443","v":0},{"$f":"All!AB443","v":0},{"$f":"All!AC443","v":0},{"$f":"All!AD443","v":0},{"$f":"All!AE443","v":0},{"$f":"All!AF443","v":0},{"$f":"All!AG443","v":0},{"$f":"All!AH443","v":0},{"$f":"All!AI443","v":0},{"$f":"All!AJ443","v":0},{"$f":"All!AK443","v":0},{"$f":"All!AL443","v":0},{"$f":"All!AM443","v":0},{"$f":"All!AN443","v":0},{"$f":"All!AO443","v":0},{"$f":"All!AP443","v":0},{"$f":"All!AQ443","v":0},{"$f":"All!AR443","v":0},{"$f":"All!AS443","v":0},{"$f":"All!AT443","v":0}]
[null,{"$f":"All!B444","v":"5"},{"$f":"All!C444","v":"5.3"},{"$f":"All!D444","v":"5.3.4"},{"$f":"All!E444","v":""},{"$f":"All!F444","v":"5.3.4.1"},{"$f":"All!G444","v":0},{"$f":"All!H444","v":0},{"$f":"All!I444","v":"5.3.4.1.2"},{"$f":"All!J444","v":"5.3.4.1.2: Are physical access rights revoked promptly upon termination of an employee, and all physical access mechanisms (such as keys and access cards) returned or disabled?\n"},{"$f":"All!K444","v":"1) Access control standard or security policy or similar document\n- Check that there is a process to revoke all physical access rights promptly upon the termination of an employee\n- Check that the process includes the return/disabling of access mechanisms (i.e. keys and access cards)\n(Note: if practical, visit the data centre to assess if the above is operational)\n"},{"$f":"All!L444","v":0},{"$f":"All!M444","v":"Standard Required"},{"$f":"All!N444","v":"Required"},{"$f":"All!O444","v":"TechOps"},{"$f":"All!P444","v":0},{"$f":"All!Q444","v":0},{"$f":"All!R444","v":0},{"$f":"All!S444","v":0},{"$f":"All!T444","v":0},{"$f":"All!U444","v":0},{"$f":"All!V444","v":0},{"$f":"All!W444","v":0},{"$f":"All!X444","v":0},{"$f":"All!Y444","v":0},{"$f":"All!Z444","v":0},{"$f":"All!AA444","v":0},{"$f":"All!AB444","v":0},{"$f":"All!AC444","v":0},{"$f":"All!AD444","v":0},{"$f":"All!AE444","v":0},{"$f":"All!AF444","v":0},{"$f":"All!AG444","v":0},{"$f":"All!AH444","v":0},{"$f":"All!AI444","v":0},{"$f":"All!AJ444","v":0},{"$f":"All!AK444","v":0},{"$f":"All!AL444","v":0},{"$f":"All!AM444","v":0},{"$f":"All!AN444","v":0},{"$f":"All!AO444","v":0},{"$f":"All!AP444","v":0},{"$f":"All!AQ444","v":0},{"$f":"All!AR444","v":0},{"$f":"All!AS444","v":0},{"$f":"All!AT444","v":0}]
[null,{"$f":"All!B445","v":"5"},{"$f":"All!C445","v":"5.3"},{"$f":"All!D445","v":"5.3.4"},{"$f":"All!E445","v":""},{"$f":"All!F445","v":"5.3.4.2"},{"$f":"All!G445","v":"5.3.4.2: PHYSICAL ACCESS - ENTRY CONTROLS\nProviders should use appropriate facility entry controls to limit and monitor physical access to computer rooms, data centres, and other physical areas with mobile money system components. Providers should:\n- control entry with locked doors and mechanisms to avoid tailgating (unauthorized people following authorized users into the area);\n- maintain logs of people entering the data centre and keep the logs for at least three months;\n- implement controls to restrict access to network points and telecommunication lines.\n"},{"$f":"All!H445","v":"PCI DSS, ISO 27002: 2013 Sec. 11.1"},{"$f":"All!I445","v":"5.3.4.2.1"},{"$f":"All!J445","v":"5.3.4.2.1: Are there physical security controls for each computer room, data centre, and other physical areas with mobile money system components?\n"},{"$f":"All!K445","v":"1) Access control standard or security policy or similar document\n- Check that there are physical security controls for each computer room, data centre and any other physical areas that contain mobile money system components\n(Note: if practical, visit the data centre to assess if the above is operational)\n"},{"$f":"All!L445","v":0},{"$f":"All!M445","v":"Urgent Required"},{"$f":"All!N445","v":"Required"},{"$f":"All!O445","v":"TechOps"},{"$f":"All!P445","v":0},{"$f":"All!Q445","v":0},{"$f":"All!R445","v":0},{"$f":"All!S445","v":0},{"$f":"All!T445","v":0},{"$f":"All!U445","v":0},{"$f":"All!V445","v":0},{"$f":"All!W445","v":0},{"$f":"All!X445","v":0},{"$f":"All!Y445","v":0},{"$f":"All!Z445","v":0},{"$f":"All!AA445","v":0},{"$f":"All!AB445","v":0},{"$f":"All!AC445","v":0},{"$f":"All!AD445","v":0},{"$f":"All!AE445","v":0},{"$f":"All!AF445","v":0},{"$f":"All!AG445","v":0},{"$f":"All!AH445","v":0},{"$f":"All!AI445","v":0},{"$f":"All!AJ445","v":0},{"$f":"All!AK445","v":0},{"$f":"All!AL445","v":0},{"$f":"All!AM445","v":0},{"$f":"All!AN445","v":0},{"$f":"All!AO445","v":0},{"$f":"All!AP445","v":0},{"$f":"All!AQ445","v":0},{"$f":"All!AR445","v":0},{"$f":"All!AS445","v":0},{"$f":"All!AT445","v":0}]
[null,{"$f":"All!B446","v":"5"},{"$f":"All!C446","v":"5.3"},{"$f":"All!D446","v":"5.3.4"},{"$f":"All!E446","v":""},{"$f":"All!F446","v":"5.3.4.2"},{"$f":"All!G446","v":0},{"$f":"All!H446","v":0},{"$f":"All!I446","v":"5.3.4.2.2"},{"$f":"All!J446","v":"5.3.4.2.2: Are logs maintained of people entering the mobile money data centre and kept for at least three months?\n"},{"$f":"All!K446","v":"1)  Access control standard or security policy or similar document\n- Check there is a process to log all people that access the mobile money data-centres.\n- Check the log is kept for at least three months.\n\n2) Access log \n- Review log to confirm that logs are maintained of people entering the mobile money data centre and kept for at least three months.\n\n"},{"$f":"All!L446","v":0},{"$f":"All!M446","v":"Urgent Required"},{"$f":"All!N446","v":"Required"},{"$f":"All!O446","v":"TechOps"},{"$f":"All!P446","v":0},{"$f":"All!Q446","v":0},{"$f":"All!R446","v":0},{"$f":"All!S446","v":0},{"$f":"All!T446","v":0},{"$f":"All!U446","v":0},{"$f":"All!V446","v":0},{"$f":"All!W446","v":0},{"$f":"All!X446","v":0},{"$f":"All!Y446","v":0},{"$f":"All!Z446","v":0},{"$f":"All!AA446","v":0},{"$f":"All!AB446","v":0},{"$f":"All!AC446","v":0},{"$f":"All!AD446","v":0},{"$f":"All!AE446","v":0},{"$f":"All!AF446","v":0},{"$f":"All!AG446","v":0},{"$f":"All!AH446","v":0},{"$f":"All!AI446","v":0},{"$f":"All!AJ446","v":0},{"$f":"All!AK446","v":0},{"$f":"All!AL446","v":0},{"$f":"All!AM446","v":0},{"$f":"All!AN446","v":0},{"$f":"All!AO446","v":0},{"$f":"All!AP446","v":0},{"$f":"All!AQ446","v":0},{"$f":"All!AR446","v":0},{"$f":"All!AS446","v":0},{"$f":"All!AT446","v":0}]
[null,{"$f":"All!B447","v":"5"},{"$f":"All!C447","v":"5.3"},{"$f":"All!D447","v":"5.3.4"},{"$f":"All!E447","v":""},{"$f":"All!F447","v":"5.3.4.2"},{"$f":"All!G447","v":0},{"$f":"All!H447","v":0},{"$f":"All!I447","v":"5.3.4.2.3"},{"$f":"All!J447","v":"5.3.4.2.3: Have controls been implemented in the mobile money data centre to restrict access to network points and telecommunication lines?\n"},{"$f":"All!K447","v":"1) Access control standard or security policy or similar document\n- Check that there are security controls that restrict access to network points and telecommunication lines."},{"$f":"All!L447","v":0},{"$f":"All!M447","v":"Standard Required"},{"$f":"All!N447","v":"Required"},{"$f":"All!O447","v":"TechOps"},{"$f":"All!P447","v":0},{"$f":"All!Q447","v":0},{"$f":"All!R447","v":0},{"$f":"All!S447","v":0},{"$f":"All!T447","v":0},{"$f":"All!U447","v":0},{"$f":"All!V447","v":0},{"$f":"All!W447","v":0},{"$f":"All!X447","v":0},{"$f":"All!Y447","v":0},{"$f":"All!Z447","v":0},{"$f":"All!AA447","v":0},{"$f":"All!AB447","v":0},{"$f":"All!AC447","v":0},{"$f":"All!AD447","v":0},{"$f":"All!AE447","v":0},{"$f":"All!AF447","v":0},{"$f":"All!AG447","v":0},{"$f":"All!AH447","v":0},{"$f":"All!AI447","v":0},{"$f":"All!AJ447","v":0},{"$f":"All!AK447","v":0},{"$f":"All!AL447","v":0},{"$f":"All!AM447","v":0},{"$f":"All!AN447","v":0},{"$f":"All!AO447","v":0},{"$f":"All!AP447","v":0},{"$f":"All!AQ447","v":0},{"$f":"All!AR447","v":0},{"$f":"All!AS447","v":0},{"$f":"All!AT447","v":0}]
[null,{"$f":"All!B448","v":"5"},{"$f":"All!C448","v":"5.3"},{"$f":"All!D448","v":"5.3.4"},{"$f":"All!E448","v":""},{"$f":"All!F448","v":"5.3.4.2"},{"$f":"All!G448","v":0},{"$f":"All!H448","v":0},{"$f":"All!I448","v":"5.3.4.2.4"},{"$f":"All!J448","v":"5.3.4.2.4: Is entry to the mobile money data centre controlled with locked doors and mechanisms to avoid tailgating (unauthorized people following authorized users into the area)?\n"},{"$f":"All!K448","v":0},{"$f":"All!L448","v":0},{"$f":"All!M448","v":"Recommended"},{"$f":"All!N448","v":"Recommended"},{"$f":"All!O448","v":"TechOps"},{"$f":"All!P448","v":0},{"$f":"All!Q448","v":0},{"$f":"All!R448","v":0},{"$f":"All!S448","v":0},{"$f":"All!T448","v":0},{"$f":"All!U448","v":0},{"$f":"All!V448","v":0},{"$f":"All!W448","v":0},{"$f":"All!X448","v":0},{"$f":"All!Y448","v":0},{"$f":"All!Z448","v":0},{"$f":"All!AA448","v":0},{"$f":"All!AB448","v":0},{"$f":"All!AC448","v":0},{"$f":"All!AD448","v":0},{"$f":"All!AE448","v":0},{"$f":"All!AF448","v":0},{"$f":"All!AG448","v":0},{"$f":"All!AH448","v":0},{"$f":"All!AI448","v":0},{"$f":"All!AJ448","v":0},{"$f":"All!AK448","v":0},{"$f":"All!AL448","v":0},{"$f":"All!AM448","v":0},{"$f":"All!AN448","v":0},{"$f":"All!AO448","v":0},{"$f":"All!AP448","v":0},{"$f":"All!AQ448","v":0},{"$f":"All!AR448","v":0},{"$f":"All!AS448","v":0},{"$f":"All!AT448","v":0}]
[null,{"$f":"All!B449","v":"5"},{"$f":"All!C449","v":"5.3"},{"$f":"All!D449","v":"5.3.4"},{"$f":"All!E449","v":""},{"$f":"All!F449","v":"5.3.4.3"},{"$f":"All!G449","v":"5.3.4.3: PHYSICAL ACCESS - VISITORS/ EXTERNAL PERSONS\nProviders should implement procedures to identify and authorize visitors/ external persons. Providers should ensure that:\n- visitors are authorized before entering - and escorted at all times within - areas where customer data is processed or maintained;\n- visitors are identified and given a badge or other identification that expires and that visibly distinguishes the visitors from onsite personnel;\n- visitors are asked to surrender the badge or identification before leaving the facility or at the date of expiration; and\n- a visitor log is used to maintain a physical audit trail of visitor activity to the facility as well as computer rooms and data centres where customer and financial data is stored or transmitted."},{"$f":"All!H449","v":"PCI DSS, ISO 27002: 2013 Sec. 11.1"},{"$f":"All!I449","v":"5.3.4.3.1"},{"$f":"All!J449","v":"5.3.4.3.1: Are there procedures defined for identifying and authorizing datacentre visitors / external persons and ensuring that they can be distinguished from onsite personnel?\n"},{"$f":"All!K449","v":"1) Access control standard or security policy or similar document\n- Check there are process to identify and authorise external persons visiting the mobile money datacentres\n- Check there is a process to distinguish external persons from onsite datacentre personnel\n(Note: if practical, visit the datacentre to assess if the above is operational)\n"},{"$f":"All!L449","v":0},{"$f":"All!M449","v":"Standard Required"},{"$f":"All!N449","v":"Required"},{"$f":"All!O449","v":"TechOps"},{"$f":"All!P449","v":0},{"$f":"All!Q449","v":0},{"$f":"All!R449","v":0},{"$f":"All!S449","v":0},{"$f":"All!T449","v":0},{"$f":"All!U449","v":0},{"$f":"All!V449","v":0},{"$f":"All!W449","v":0},{"$f":"All!X449","v":0},{"$f":"All!Y449","v":0},{"$f":"All!Z449","v":0},{"$f":"All!AA449","v":0},{"$f":"All!AB449","v":0},{"$f":"All!AC449","v":0},{"$f":"All!AD449","v":0},{"$f":"All!AE449","v":0},{"$f":"All!AF449","v":0},{"$f":"All!AG449","v":0},{"$f":"All!AH449","v":0},{"$f":"All!AI449","v":0},{"$f":"All!AJ449","v":0},{"$f":"All!AK449","v":0},{"$f":"All!AL449","v":0},{"$f":"All!AM449","v":0},{"$f":"All!AN449","v":0},{"$f":"All!AO449","v":0},{"$f":"All!AP449","v":0},{"$f":"All!AQ449","v":0},{"$f":"All!AR449","v":0},{"$f":"All!AS449","v":0},{"$f":"All!AT449","v":0}]
[null,{"$f":"All!B450","v":"5"},{"$f":"All!C450","v":"5.3"},{"$f":"All!D450","v":"5.3.4"},{"$f":"All!E450","v":""},{"$f":"All!F450","v":"5.3.4.3"},{"$f":"All!G450","v":0},{"$f":"All!H450","v":0},{"$f":"All!I450","v":"5.3.4.3.2"},{"$f":"All!J450","v":"5.3.4.3.2: Are external persons accompanied whenever visiting computer rooms and data centres where customer and financial data is stored or transmitted?\n"},{"$f":"All!K450","v":""},{"$f":"All!L450","v":0},{"$f":"All!M450","v":"Recommended"},{"$f":"All!N450","v":"Recommended"},{"$f":"All!O450","v":"TechOps"},{"$f":"All!P450","v":0},{"$f":"All!Q450","v":0},{"$f":"All!R450","v":0},{"$f":"All!S450","v":0},{"$f":"All!T450","v":0},{"$f":"All!U450","v":0},{"$f":"All!V450","v":0},{"$f":"All!W450","v":0},{"$f":"All!X450","v":0},{"$f":"All!Y450","v":0},{"$f":"All!Z450","v":0},{"$f":"All!AA450","v":0},{"$f":"All!AB450","v":0},{"$f":"All!AC450","v":0},{"$f":"All!AD450","v":0},{"$f":"All!AE450","v":0},{"$f":"All!AF450","v":0},{"$f":"All!AG450","v":0},{"$f":"All!AH450","v":0},{"$f":"All!AI450","v":0},{"$f":"All!AJ450","v":0},{"$f":"All!AK450","v":0},{"$f":"All!AL450","v":0},{"$f":"All!AM450","v":0},{"$f":"All!AN450","v":0},{"$f":"All!AO450","v":0},{"$f":"All!AP450","v":0},{"$f":"All!AQ450","v":0},{"$f":"All!AR450","v":0},{"$f":"All!AS450","v":0},{"$f":"All!AT450","v":0}]
[null,{"$f":"All!B451","v":"5"},{"$f":"All!C451","v":"5.3"},{"$f":"All!D451","v":"5.3.5"},{"$f":"All!E451","v":"5.3.5: Providers shall ensure correct and secure operations of information processing"},{"$f":"All!F451","v":"5.3.5.1"},{"$f":"All!G451","v":"5.3.5.1: MALWARE PROTECTION\nUp-to-date malware detection and anti-virus prevention software should be run regularly on any Windows components of the mobile money system.\n\nThe following controls should be implemented on staff devices that have access to the mobile money system (Windows computers and smartphones):\n- regularly run up-to-date malware detection and anti-virus prevention software;\n- prevent the use of unauthorized software;\n- prevent or detect the use of known or suspected malicious websites."},{"$f":"All!H451","v":"ISO 27002:2013 Sec. 12.2 \nPCI DSS "},{"$f":"All!I451","v":"5.3.5.1.1"},{"$f":"All!J451","v":"5.3.5.1.1: Is up-to-date malware detection and anti-virus prevention software run regularly on Windows components of the mobile money system?\n"},{"$f":"All!K451","v":"1) Security Operations Manual or Technical Operations documentation\n- Check that there is a process to run malware detection and anti-virus prevention on the mobile money system\n- Check that the process includes the regular updating of the software\n- Check that the process is scheduled to run regularly\n- Check the date of the last malware and anti-virus screen is recent\n\n2) Malware update logs\n- Confirm that anti-malware software is run regularly on Windows components of the mobile money system. Note: if there are no Windows system components, mark this as N/A."},{"$f":"All!L451","v":0},{"$f":"All!M451","v":"Standard Required"},{"$f":"All!N451","v":"Required"},{"$f":"All!O451","v":"TechOps"},{"$f":"All!P451","v":0},{"$f":"All!Q451","v":0},{"$f":"All!R451","v":0},{"$f":"All!S451","v":0},{"$f":"All!T451","v":0},{"$f":"All!U451","v":0},{"$f":"All!V451","v":0},{"$f":"All!W451","v":0},{"$f":"All!X451","v":0},{"$f":"All!Y451","v":0},{"$f":"All!Z451","v":0},{"$f":"All!AA451","v":0},{"$f":"All!AB451","v":0},{"$f":"All!AC451","v":0},{"$f":"All!AD451","v":0},{"$f":"All!AE451","v":0},{"$f":"All!AF451","v":0},{"$f":"All!AG451","v":0},{"$f":"All!AH451","v":0},{"$f":"All!AI451","v":0},{"$f":"All!AJ451","v":0},{"$f":"All!AK451","v":0},{"$f":"All!AL451","v":0},{"$f":"All!AM451","v":0},{"$f":"All!AN451","v":0},{"$f":"All!AO451","v":0},{"$f":"All!AP451","v":0},{"$f":"All!AQ451","v":0},{"$f":"All!AR451","v":0},{"$f":"All!AS451","v":0},{"$f":"All!AT451","v":0}]
[null,{"$f":"All!B452","v":"5"},{"$f":"All!C452","v":"5.3"},{"$f":"All!D452","v":"5.3.5"},{"$f":"All!E452","v":""},{"$f":"All!F452","v":"5.3.5.1"},{"$f":"All!G452","v":0},{"$f":"All!H452","v":0},{"$f":"All!I452","v":"5.3.5.1.2"},{"$f":"All!J452","v":"5.3.5.1.2: Is up-to-date malware detection and anti-virus prevention software run regularly on Windows computers that staff use to access to the mobile money system?\n"},{"$f":"All!K452","v":"1) Security Operations Manual or Technical Operations documentation\n- Check that there is a process to regularly run malware detection and anti-virus prevention on Windows computers that staff use to access to the mobile money system.\n- Check that the process includes the regular updating of the software.\n- Check the date of the last malware and anti-virus screen is recent.\n\n2) Malware update logs\n- Confirm that anti-malware software is run regularly on Windows computers that staff use to access to the mobile money system."},{"$f":"All!L452","v":0},{"$f":"All!M452","v":"Standard Required"},{"$f":"All!N452","v":"Required"},{"$f":"All!O452","v":"TechOps"},{"$f":"All!P452","v":0},{"$f":"All!Q452","v":0},{"$f":"All!R452","v":0},{"$f":"All!S452","v":0},{"$f":"All!T452","v":0},{"$f":"All!U452","v":0},{"$f":"All!V452","v":0},{"$f":"All!W452","v":0},{"$f":"All!X452","v":0},{"$f":"All!Y452","v":0},{"$f":"All!Z452","v":0},{"$f":"All!AA452","v":0},{"$f":"All!AB452","v":0},{"$f":"All!AC452","v":0},{"$f":"All!AD452","v":0},{"$f":"All!AE452","v":0},{"$f":"All!AF452","v":0},{"$f":"All!AG452","v":0},{"$f":"All!AH452","v":0},{"$f":"All!AI452","v":0},{"$f":"All!AJ452","v":0},{"$f":"All!AK452","v":0},{"$f":"All!AL452","v":0},{"$f":"All!AM452","v":0},{"$f":"All!AN452","v":0},{"$f":"All!AO452","v":0},{"$f":"All!AP452","v":0},{"$f":"All!AQ452","v":0},{"$f":"All!AR452","v":0},{"$f":"All!AS452","v":0},{"$f":"All!AT452","v":0}]
[null,{"$f":"All!B453","v":"5"},{"$f":"All!C453","v":"5.3"},{"$f":"All!D453","v":"5.3.5"},{"$f":"All!E453","v":""},{"$f":"All!F453","v":"5.3.5.1"},{"$f":"All!G453","v":0},{"$f":"All!H453","v":0},{"$f":"All!I453","v":"5.3.5.1.3"},{"$f":"All!J453","v":"5.3.5.1.3: Are controls implemented on staff devices that have access to the mobile money system to prevent the use of unauthorized software and prevent or detect the use of known or suspected malicious websites?\n"},{"$f":"All!K453","v":0},{"$f":"All!L453","v":0},{"$f":"All!M453","v":"Recommended"},{"$f":"All!N453","v":"Recommended"},{"$f":"All!O453","v":"TechOps"},{"$f":"All!P453","v":0},{"$f":"All!Q453","v":0},{"$f":"All!R453","v":0},{"$f":"All!S453","v":0},{"$f":"All!T453","v":0},{"$f":"All!U453","v":0},{"$f":"All!V453","v":0},{"$f":"All!W453","v":0},{"$f":"All!X453","v":0},{"$f":"All!Y453","v":0},{"$f":"All!Z453","v":0},{"$f":"All!AA453","v":0},{"$f":"All!AB453","v":0},{"$f":"All!AC453","v":0},{"$f":"All!AD453","v":0},{"$f":"All!AE453","v":0},{"$f":"All!AF453","v":0},{"$f":"All!AG453","v":0},{"$f":"All!AH453","v":0},{"$f":"All!AI453","v":0},{"$f":"All!AJ453","v":0},{"$f":"All!AK453","v":0},{"$f":"All!AL453","v":0},{"$f":"All!AM453","v":0},{"$f":"All!AN453","v":0},{"$f":"All!AO453","v":0},{"$f":"All!AP453","v":0},{"$f":"All!AQ453","v":0},{"$f":"All!AR453","v":0},{"$f":"All!AS453","v":0},{"$f":"All!AT453","v":0}]
[null,{"$f":"All!B454","v":"5"},{"$f":"All!C454","v":"5.3"},{"$f":"All!D454","v":"5.3.5"},{"$f":"All!E454","v":""},{"$f":"All!F454","v":"5.3.5.2"},{"$f":"All!G454","v":"5.3.5.2: INTRUSION DETECTION\nIntrusion-detection and/or intrusion-prevention systems should be implemented to detect and/or prevent intrusions into the network. \n\nAll traffic should be monitored at the perimeter of the user data environment as well as at critical points in the user data environment. Alerts should be raised when there is a suspicion that a system may be compromised.\n\nIntrusion detection/ prevention systems should be configured, maintained, and updated per vendor instructions to ensure optimal protection."},{"$f":"All!H454","v":"ISO 27002:2013 Sec. 12.5, PCI DSS "},{"$f":"All!I454","v":"5.3.5.2.1"},{"$f":"All!J454","v":"5.3.5.2.1: Are intrusion detection/ prevention systems in use, such that all traffic at the perimeter of the data environment as well as at critical points in the service data environment is monitored for intrusion attempts?\n"},{"$f":"All!K454","v":0},{"$f":"All!L454","v":0},{"$f":"All!M454","v":"Recommended"},{"$f":"All!N454","v":"Recommended"},{"$f":"All!O454","v":"TechOps"},{"$f":"All!P454","v":0},{"$f":"All!Q454","v":0},{"$f":"All!R454","v":0},{"$f":"All!S454","v":0},{"$f":"All!T454","v":0},{"$f":"All!U454","v":0},{"$f":"All!V454","v":0},{"$f":"All!W454","v":0},{"$f":"All!X454","v":0},{"$f":"All!Y454","v":0},{"$f":"All!Z454","v":0},{"$f":"All!AA454","v":0},{"$f":"All!AB454","v":0},{"$f":"All!AC454","v":0},{"$f":"All!AD454","v":0},{"$f":"All!AE454","v":0},{"$f":"All!AF454","v":0},{"$f":"All!AG454","v":0},{"$f":"All!AH454","v":0},{"$f":"All!AI454","v":0},{"$f":"All!AJ454","v":0},{"$f":"All!AK454","v":0},{"$f":"All!AL454","v":0},{"$f":"All!AM454","v":0},{"$f":"All!AN454","v":0},{"$f":"All!AO454","v":0},{"$f":"All!AP454","v":0},{"$f":"All!AQ454","v":0},{"$f":"All!AR454","v":0},{"$f":"All!AS454","v":0},{"$f":"All!AT454","v":0}]
[null,{"$f":"All!B455","v":"5"},{"$f":"All!C455","v":"5.3"},{"$f":"All!D455","v":"5.3.5"},{"$f":"All!E455","v":""},{"$f":"All!F455","v":"5.3.5.2"},{"$f":"All!G455","v":0},{"$f":"All!H455","v":0},{"$f":"All!I455","v":"5.3.5.2.2"},{"$f":"All!J455","v":"5.3.5.2.2: Are intrusion detection/ prevention systems configured to raise alerts whenever there is a suspicion that a system may be compromised?\n"},{"$f":"All!K455","v":0},{"$f":"All!L455","v":0},{"$f":"All!M455","v":"Recommended"},{"$f":"All!N455","v":"Recommended"},{"$f":"All!O455","v":"TechOps"},{"$f":"All!P455","v":0},{"$f":"All!Q455","v":0},{"$f":"All!R455","v":0},{"$f":"All!S455","v":0},{"$f":"All!T455","v":0},{"$f":"All!U455","v":0},{"$f":"All!V455","v":0},{"$f":"All!W455","v":0},{"$f":"All!X455","v":0},{"$f":"All!Y455","v":0},{"$f":"All!Z455","v":0},{"$f":"All!AA455","v":0},{"$f":"All!AB455","v":0},{"$f":"All!AC455","v":0},{"$f":"All!AD455","v":0},{"$f":"All!AE455","v":0},{"$f":"All!AF455","v":0},{"$f":"All!AG455","v":0},{"$f":"All!AH455","v":0},{"$f":"All!AI455","v":0},{"$f":"All!AJ455","v":0},{"$f":"All!AK455","v":0},{"$f":"All!AL455","v":0},{"$f":"All!AM455","v":0},{"$f":"All!AN455","v":0},{"$f":"All!AO455","v":0},{"$f":"All!AP455","v":0},{"$f":"All!AQ455","v":0},{"$f":"All!AR455","v":0},{"$f":"All!AS455","v":0},{"$f":"All!AT455","v":0}]
[null,{"$f":"All!B456","v":"5"},{"$f":"All!C456","v":"5.3"},{"$f":"All!D456","v":"5.3.5"},{"$f":"All!E456","v":""},{"$f":"All!F456","v":"5.3.5.3"},{"$f":"All!G456","v":"5.3.5.3: MOBILE DEVICES AND TELEWORKING\nMobile devices (e.g., laptops, phones, tablets) that can connect to the mobile money system remotely or which contain sensitive customer data present a security risk. Such devices may be used by developers or by system support staff to provide remote operational support, for example. Particular care should be taken by sagents and by staff with privileged roles that can be accessed via handsets.\n\nAll such devices should be password-protected and sensitive customer data should be encrypted. Firewall software should be set up on the devices. Mobile devices should also be physically protected against theft and should be locked away when not in use.\n\nA procedure should be established for cases of theft or loss of mobile devices that (1) can connect to the mobile money system remotely or (2) which contain sensitive data. \n\nA policy should be documented for teleworking, indicating which staff may connect remotely to the system and the controls that should be implemented.\n\nStaff using mobile devices to connect to the mobile money system should be trained regarding (1) the risks that these devices present and (2) the controls that should be implemented."},{"$f":"All!H456","v":"ISO 27002:2013 Sec. 6.2"},{"$f":"All!I456","v":"5.3.5.3.1"},{"$f":"All!J456","v":"5.3.5.3.1: Is data encryption and password protection enabled on all mobile devices (e.g., laptops, phones, tablets) that can connect to the mobile money system remotely or which contain sensitive customer data?\n"},{"$f":"All!K456","v":0},{"$f":"All!L456","v":0},{"$f":"All!M456","v":"Recommended"},{"$f":"All!N456","v":"Recommended"},{"$f":"All!O456","v":"TechOps"},{"$f":"All!P456","v":0},{"$f":"All!Q456","v":0},{"$f":"All!R456","v":0},{"$f":"All!S456","v":0},{"$f":"All!T456","v":0},{"$f":"All!U456","v":0},{"$f":"All!V456","v":0},{"$f":"All!W456","v":0},{"$f":"All!X456","v":0},{"$f":"All!Y456","v":0},{"$f":"All!Z456","v":0},{"$f":"All!AA456","v":0},{"$f":"All!AB456","v":0},{"$f":"All!AC456","v":0},{"$f":"All!AD456","v":0},{"$f":"All!AE456","v":0},{"$f":"All!AF456","v":0},{"$f":"All!AG456","v":0},{"$f":"All!AH456","v":0},{"$f":"All!AI456","v":0},{"$f":"All!AJ456","v":0},{"$f":"All!AK456","v":0},{"$f":"All!AL456","v":0},{"$f":"All!AM456","v":0},{"$f":"All!AN456","v":0},{"$f":"All!AO456","v":0},{"$f":"All!AP456","v":0},{"$f":"All!AQ456","v":0},{"$f":"All!AR456","v":0},{"$f":"All!AS456","v":0},{"$f":"All!AT456","v":0}]
[null,{"$f":"All!B457","v":"5"},{"$f":"All!C457","v":"5.3"},{"$f":"All!D457","v":"5.3.5"},{"$f":"All!E457","v":""},{"$f":"All!F457","v":"5.3.5.3"},{"$f":"All!G457","v":0},{"$f":"All!H457","v":0},{"$f":"All!I457","v":"5.3.5.3.2"},{"$f":"All!J457","v":"5.3.5.3.2: Is firewall software set up on all mobile devices that can connect to the mobile money system remotely or which contain sensitive customer data?\n"},{"$f":"All!K457","v":0},{"$f":"All!L457","v":0},{"$f":"All!M457","v":"Recommended"},{"$f":"All!N457","v":"Recommended"},{"$f":"All!O457","v":"TechOps"},{"$f":"All!P457","v":0},{"$f":"All!Q457","v":0},{"$f":"All!R457","v":0},{"$f":"All!S457","v":0},{"$f":"All!T457","v":0},{"$f":"All!U457","v":0},{"$f":"All!V457","v":0},{"$f":"All!W457","v":0},{"$f":"All!X457","v":0},{"$f":"All!Y457","v":0},{"$f":"All!Z457","v":0},{"$f":"All!AA457","v":0},{"$f":"All!AB457","v":0},{"$f":"All!AC457","v":0},{"$f":"All!AD457","v":0},{"$f":"All!AE457","v":0},{"$f":"All!AF457","v":0},{"$f":"All!AG457","v":0},{"$f":"All!AH457","v":0},{"$f":"All!AI457","v":0},{"$f":"All!AJ457","v":0},{"$f":"All!AK457","v":0},{"$f":"All!AL457","v":0},{"$f":"All!AM457","v":0},{"$f":"All!AN457","v":0},{"$f":"All!AO457","v":0},{"$f":"All!AP457","v":0},{"$f":"All!AQ457","v":0},{"$f":"All!AR457","v":0},{"$f":"All!AS457","v":0},{"$f":"All!AT457","v":0}]
[null,{"$f":"All!B458","v":"5"},{"$f":"All!C458","v":"5.3"},{"$f":"All!D458","v":"5.3.5"},{"$f":"All!E458","v":""},{"$f":"All!F458","v":"5.3.5.3"},{"$f":"All!G458","v":0},{"$f":"All!H458","v":0},{"$f":"All!I458","v":"5.3.5.3.3"},{"$f":"All!J458","v":"5.3.5.3.3: Are specific procedures established for cases of theft or loss of mobile devices that can connect to the mobile money system remotely or which contain sensitive customer data?\n"},{"$f":"All!K458","v":0},{"$f":"All!L458","v":0},{"$f":"All!M458","v":"Recommended"},{"$f":"All!N458","v":"Recommended"},{"$f":"All!O458","v":"TechOps"},{"$f":"All!P458","v":0},{"$f":"All!Q458","v":0},{"$f":"All!R458","v":0},{"$f":"All!S458","v":0},{"$f":"All!T458","v":0},{"$f":"All!U458","v":0},{"$f":"All!V458","v":0},{"$f":"All!W458","v":0},{"$f":"All!X458","v":0},{"$f":"All!Y458","v":0},{"$f":"All!Z458","v":0},{"$f":"All!AA458","v":0},{"$f":"All!AB458","v":0},{"$f":"All!AC458","v":0},{"$f":"All!AD458","v":0},{"$f":"All!AE458","v":0},{"$f":"All!AF458","v":0},{"$f":"All!AG458","v":0},{"$f":"All!AH458","v":0},{"$f":"All!AI458","v":0},{"$f":"All!AJ458","v":0},{"$f":"All!AK458","v":0},{"$f":"All!AL458","v":0},{"$f":"All!AM458","v":0},{"$f":"All!AN458","v":0},{"$f":"All!AO458","v":0},{"$f":"All!AP458","v":0},{"$f":"All!AQ458","v":0},{"$f":"All!AR458","v":0},{"$f":"All!AS458","v":0},{"$f":"All!AT458","v":0}]
[null,{"$f":"All!B459","v":"5"},{"$f":"All!C459","v":"5.3"},{"$f":"All!D459","v":"5.3.5"},{"$f":"All!E459","v":""},{"$f":"All!F459","v":"5.3.5.3"},{"$f":"All!G459","v":0},{"$f":"All!H459","v":0},{"$f":"All!I459","v":"5.3.5.3.4"},{"$f":"All!J459","v":"5.3.5.3.4: Has a policy been documented for teleworking, indicating which staff may connect remotely to the system and the controls that should be implemented?\n"},{"$f":"All!K459","v":0},{"$f":"All!L459","v":0},{"$f":"All!M459","v":"Recommended"},{"$f":"All!N459","v":"Recommended"},{"$f":"All!O459","v":"TechOps"},{"$f":"All!P459","v":0},{"$f":"All!Q459","v":0},{"$f":"All!R459","v":0},{"$f":"All!S459","v":0},{"$f":"All!T459","v":0},{"$f":"All!U459","v":0},{"$f":"All!V459","v":0},{"$f":"All!W459","v":0},{"$f":"All!X459","v":0},{"$f":"All!Y459","v":0},{"$f":"All!Z459","v":0},{"$f":"All!AA459","v":0},{"$f":"All!AB459","v":0},{"$f":"All!AC459","v":0},{"$f":"All!AD459","v":0},{"$f":"All!AE459","v":0},{"$f":"All!AF459","v":0},{"$f":"All!AG459","v":0},{"$f":"All!AH459","v":0},{"$f":"All!AI459","v":0},{"$f":"All!AJ459","v":0},{"$f":"All!AK459","v":0},{"$f":"All!AL459","v":0},{"$f":"All!AM459","v":0},{"$f":"All!AN459","v":0},{"$f":"All!AO459","v":0},{"$f":"All!AP459","v":0},{"$f":"All!AQ459","v":0},{"$f":"All!AR459","v":0},{"$f":"All!AS459","v":0},{"$f":"All!AT459","v":0}]
[null,{"$f":"All!B460","v":"5"},{"$f":"All!C460","v":"5.3"},{"$f":"All!D460","v":"5.3.5"},{"$f":"All!E460","v":""},{"$f":"All!F460","v":"5.3.5.3"},{"$f":"All!G460","v":0},{"$f":"All!H460","v":0},{"$f":"All!I460","v":"5.3.5.3.5"},{"$f":"All!J460","v":"5.3.5.3.5: Have staff using mobile devices to connect to the mobile money system been trained regarding (1) the risks that these devices present and (2) the controls that should be implemented?\n"},{"$f":"All!K460","v":0},{"$f":"All!L460","v":0},{"$f":"All!M460","v":"Recommended"},{"$f":"All!N460","v":"Recommended"},{"$f":"All!O460","v":"TechOps"},{"$f":"All!P460","v":0},{"$f":"All!Q460","v":0},{"$f":"All!R460","v":0},{"$f":"All!S460","v":0},{"$f":"All!T460","v":0},{"$f":"All!U460","v":0},{"$f":"All!V460","v":0},{"$f":"All!W460","v":0},{"$f":"All!X460","v":0},{"$f":"All!Y460","v":0},{"$f":"All!Z460","v":0},{"$f":"All!AA460","v":0},{"$f":"All!AB460","v":0},{"$f":"All!AC460","v":0},{"$f":"All!AD460","v":0},{"$f":"All!AE460","v":0},{"$f":"All!AF460","v":0},{"$f":"All!AG460","v":0},{"$f":"All!AH460","v":0},{"$f":"All!AI460","v":0},{"$f":"All!AJ460","v":0},{"$f":"All!AK460","v":0},{"$f":"All!AL460","v":0},{"$f":"All!AM460","v":0},{"$f":"All!AN460","v":0},{"$f":"All!AO460","v":0},{"$f":"All!AP460","v":0},{"$f":"All!AQ460","v":0},{"$f":"All!AR460","v":0},{"$f":"All!AS460","v":0},{"$f":"All!AT460","v":0}]
[null,{"$f":"All!B461","v":"5"},{"$f":"All!C461","v":"5.3"},{"$f":"All!D461","v":"5.3.6"},{"$f":"All!E461","v":"5.3.6: Providers shall develop processes to ensure that all transactions and user activities are logged with appropriate audit trails."},{"$f":"All!F461","v":"5.3.6.1"},{"$f":"All!G461","v":"5.3.6.1: LOGGING: MOBILE MONEY SYSTEM COMPONENTS \nLogging should be set up on all mobile money system components to track all important events. Logging should include the following events:\n- all actions by administrators (i.e. people with root or administrative privileges);\n- all logical access attempts (e.g. log-on and log-off, whether successful or failed);\n- creation, modification, and deletion of system-level objects and configuration;\n- access to audit trails;\n- all access to customer data; and\n- key system activities/ events.\n\nFor each event the following should be included in the log, when relevant:\n- user ID;\n- date & time;\n- device identity/ location/ network address;\n- type of event;\n- success or failure of the event; and\n- origination of event."},{"$f":"All!H461","v":"ISO 27002: 2013 Sec. 12.4 \nPCI DSS"},{"$f":"All!I461","v":"5.3.6.1.1"},{"$f":"All!J461","v":"5.3.6.1.1: Has logging been set up on all mobile money system components to track all important events?\n"},{"$f":"All!K461","v":"1) Monitoring / logging specification\n- Check that system-level logging has been set up on all mobile money system components."},{"$f":"All!L461","v":0},{"$f":"All!M461","v":"Urgent Required"},{"$f":"All!N461","v":"Required"},{"$f":"All!O461","v":"TechOps"},{"$f":"All!P461","v":0},{"$f":"All!Q461","v":0},{"$f":"All!R461","v":0},{"$f":"All!S461","v":0},{"$f":"All!T461","v":0},{"$f":"All!U461","v":0},{"$f":"All!V461","v":0},{"$f":"All!W461","v":0},{"$f":"All!X461","v":0},{"$f":"All!Y461","v":0},{"$f":"All!Z461","v":0},{"$f":"All!AA461","v":0},{"$f":"All!AB461","v":0},{"$f":"All!AC461","v":0},{"$f":"All!AD461","v":0},{"$f":"All!AE461","v":0},{"$f":"All!AF461","v":0},{"$f":"All!AG461","v":0},{"$f":"All!AH461","v":0},{"$f":"All!AI461","v":0},{"$f":"All!AJ461","v":0},{"$f":"All!AK461","v":0},{"$f":"All!AL461","v":0},{"$f":"All!AM461","v":0},{"$f":"All!AN461","v":0},{"$f":"All!AO461","v":0},{"$f":"All!AP461","v":0},{"$f":"All!AQ461","v":0},{"$f":"All!AR461","v":0},{"$f":"All!AS461","v":0},{"$f":"All!AT461","v":0}]
[null,{"$f":"All!B462","v":"5"},{"$f":"All!C462","v":"5.3"},{"$f":"All!D462","v":"5.3.6"},{"$f":"All!E462","v":0},{"$f":"All!F462","v":"5.3.6.1"},{"$f":"All!G462","v":0},{"$f":"All!H462","v":0},{"$f":"All!I462","v":"5.3.6.1.2"},{"$f":"All!J462","v":"5.3.6.1.2: Does mobile money system-level logging include all actions by administrators, all logical access attempts, creation/ modification/ deletion of system objects and configuration, access to logs, access to customer data, and key system events?\n"},{"$f":"All!K462","v":"1) Monitoring / logging specification\n- Check that mobile money system level logging includes all the following:\na) Actions by administrators\nb) Logical access attempts, \nc) creation/ modification/ deletion of system objects and configuration, \nd) access to audit trails, \ne) access to customer data, \nf) key system events"},{"$f":"All!L462","v":0},{"$f":"All!M462","v":"Urgent Required"},{"$f":"All!N462","v":"Required"},{"$f":"All!O462","v":"TechOps"},{"$f":"All!P462","v":0},{"$f":"All!Q462","v":0},{"$f":"All!R462","v":0},{"$f":"All!S462","v":0},{"$f":"All!T462","v":0},{"$f":"All!U462","v":0},{"$f":"All!V462","v":0},{"$f":"All!W462","v":0},{"$f":"All!X462","v":0},{"$f":"All!Y462","v":0},{"$f":"All!Z462","v":0},{"$f":"All!AA462","v":0},{"$f":"All!AB462","v":0},{"$f":"All!AC462","v":0},{"$f":"All!AD462","v":0},{"$f":"All!AE462","v":0},{"$f":"All!AF462","v":0},{"$f":"All!AG462","v":0},{"$f":"All!AH462","v":0},{"$f":"All!AI462","v":0},{"$f":"All!AJ462","v":0},{"$f":"All!AK462","v":0},{"$f":"All!AL462","v":0},{"$f":"All!AM462","v":0},{"$f":"All!AN462","v":0},{"$f":"All!AO462","v":0},{"$f":"All!AP462","v":0},{"$f":"All!AQ462","v":0},{"$f":"All!AR462","v":0},{"$f":"All!AS462","v":0},{"$f":"All!AT462","v":0}]
[null,{"$f":"All!B463","v":"5"},{"$f":"All!C463","v":"5.3"},{"$f":"All!D463","v":"5.3.6"},{"$f":"All!E463","v":""},{"$f":"All!F463","v":"5.3.6.1"},{"$f":"All!G463","v":0},{"$f":"All!H463","v":0},{"$f":"All!I463","v":"5.3.6.1.3"},{"$f":"All!J463","v":"5.3.6.1.3: For each event in the mobile money system-level log is the following logged (as relevant): user ID, date & time, device identity/ location/ network address, type of event, success or failure of the event, and origination of event?\n"},{"$f":"All!K463","v":"1) Monitoring / logging specification\n- Check that mobile money system level logging captures the following for each event:\na) The user ID, \nb) Date & time,\nc)  Device identity/ location/ network address, \nd) Type of event, \ne) Success or failure of the event, \nf) Origination of the event\n\n"},{"$f":"All!L463","v":0},{"$f":"All!M463","v":"Urgent Required"},{"$f":"All!N463","v":"Required"},{"$f":"All!O463","v":"TechOps"},{"$f":"All!P463","v":0},{"$f":"All!Q463","v":0},{"$f":"All!R463","v":0},{"$f":"All!S463","v":0},{"$f":"All!T463","v":0},{"$f":"All!U463","v":0},{"$f":"All!V463","v":0},{"$f":"All!W463","v":0},{"$f":"All!X463","v":0},{"$f":"All!Y463","v":0},{"$f":"All!Z463","v":0},{"$f":"All!AA463","v":0},{"$f":"All!AB463","v":0},{"$f":"All!AC463","v":0},{"$f":"All!AD463","v":0},{"$f":"All!AE463","v":0},{"$f":"All!AF463","v":0},{"$f":"All!AG463","v":0},{"$f":"All!AH463","v":0},{"$f":"All!AI463","v":0},{"$f":"All!AJ463","v":0},{"$f":"All!AK463","v":0},{"$f":"All!AL463","v":0},{"$f":"All!AM463","v":0},{"$f":"All!AN463","v":0},{"$f":"All!AO463","v":0},{"$f":"All!AP463","v":0},{"$f":"All!AQ463","v":0},{"$f":"All!AR463","v":0},{"$f":"All!AS463","v":0},{"$f":"All!AT463","v":0}]
[null,{"$f":"All!B464","v":"5"},{"$f":"All!C464","v":"5.3"},{"$f":"All!D464","v":"5.3.6"},{"$f":"All!E464","v":""},{"$f":"All!F464","v":"5.3.6.2"},{"$f":"All!G464","v":"5.3.6.2: AUDIT TRAIL: MOBILE MONEY APPLICATION\nFull audit trails should be implemented in the mobile money system in order to be able to track all transactions and events in the mobile money application.\n\nThe following events should be included in the audit trail:\n- all transactions initiated by any party (including failed transactions and automated transactions);\n- all logical access attempts (e.g. log-on and log-off, whether successful or failed);\n- creation, deletion and modification of operator accounts;\n- access to audit trails;\n- all access to customer data by service operators (e.g. customer service operators, finance operators); and\n- key system activities/ events.\n\nFor each event the following should be included in the audit trail, when relevant:\n- date & time;\n- credit party and debit party account details;\n- transaction/event ID;\n- transaction/event initiator (ID of customer/ agent/ operator/ system process that initiates transaction/event);\n- type of event/ transaction; and\n- success or failure of the event/ transaction."},{"$f":"All!H464","v":"ECB RSMP, ISO 27002:2013 Sec. 12.4 "},{"$f":"All!I464","v":"5.3.6.2.1"},{"$f":"All!J464","v":"5.3.6.2.1: Does the mobile money audit trail include all transactions initiated by any party (including failed transactions and automated transactions)?\n"},{"$f":"All!K464","v":"1) Monitoring / logging / audit trail specification\n- Check that the process to log all event includes capturing all transactions initiated by any party (including failed transactions and automated transactions)\n\n"},{"$f":"All!L464","v":0},{"$f":"All!M464","v":"Urgent Required"},{"$f":"All!N464","v":"Required"},{"$f":"All!O464","v":"TechOps"},{"$f":"All!P464","v":0},{"$f":"All!Q464","v":0},{"$f":"All!R464","v":0},{"$f":"All!S464","v":0},{"$f":"All!T464","v":0},{"$f":"All!U464","v":0},{"$f":"All!V464","v":0},{"$f":"All!W464","v":0},{"$f":"All!X464","v":0},{"$f":"All!Y464","v":0},{"$f":"All!Z464","v":0},{"$f":"All!AA464","v":0},{"$f":"All!AB464","v":0},{"$f":"All!AC464","v":0},{"$f":"All!AD464","v":0},{"$f":"All!AE464","v":0},{"$f":"All!AF464","v":0},{"$f":"All!AG464","v":0},{"$f":"All!AH464","v":0},{"$f":"All!AI464","v":0},{"$f":"All!AJ464","v":0},{"$f":"All!AK464","v":0},{"$f":"All!AL464","v":0},{"$f":"All!AM464","v":0},{"$f":"All!AN464","v":0},{"$f":"All!AO464","v":0},{"$f":"All!AP464","v":0},{"$f":"All!AQ464","v":0},{"$f":"All!AR464","v":0},{"$f":"All!AS464","v":0},{"$f":"All!AT464","v":0}]
[null,{"$f":"All!B465","v":"5"},{"$f":"All!C465","v":"5.3"},{"$f":"All!D465","v":"5.3.6"},{"$f":"All!E465","v":""},{"$f":"All!F465","v":"5.3.6.2"},{"$f":"All!G465","v":0},{"$f":"All!H465","v":0},{"$f":"All!I465","v":"5.3.6.2.2"},{"$f":"All!J465","v":"5.3.6.2.2: Does the mobile money audit trail include all actions on the mobile money system (logical access attempts, creation/ deletion/ modification of operator accounts, access to audit trails, access to customer data, and key system activities/ events)?\n"},{"$f":"All!K465","v":"1) Monitoring / logging / audit trail specification\n- Check that there is an audit trail of the all actions on the mobile money system including:\na) Logical access attempts, \nb) Creation/ deletion/ modification of operator accounts, \nc) Access to audit trails, \nd) Access to customer data, \ne) Key system activities/ events\n\n\n\n"},{"$f":"All!L465","v":0},{"$f":"All!M465","v":"Urgent Required"},{"$f":"All!N465","v":"Required"},{"$f":"All!O465","v":"TechOps"},{"$f":"All!P465","v":0},{"$f":"All!Q465","v":0},{"$f":"All!R465","v":0},{"$f":"All!S465","v":0},{"$f":"All!T465","v":0},{"$f":"All!U465","v":0},{"$f":"All!V465","v":0},{"$f":"All!W465","v":0},{"$f":"All!X465","v":0},{"$f":"All!Y465","v":0},{"$f":"All!Z465","v":0},{"$f":"All!AA465","v":0},{"$f":"All!AB465","v":0},{"$f":"All!AC465","v":0},{"$f":"All!AD465","v":0},{"$f":"All!AE465","v":0},{"$f":"All!AF465","v":0},{"$f":"All!AG465","v":0},{"$f":"All!AH465","v":0},{"$f":"All!AI465","v":0},{"$f":"All!AJ465","v":0},{"$f":"All!AK465","v":0},{"$f":"All!AL465","v":0},{"$f":"All!AM465","v":0},{"$f":"All!AN465","v":0},{"$f":"All!AO465","v":0},{"$f":"All!AP465","v":0},{"$f":"All!AQ465","v":0},{"$f":"All!AR465","v":0},{"$f":"All!AS465","v":0},{"$f":"All!AT465","v":0}]
[null,{"$f":"All!B466","v":"5"},{"$f":"All!C466","v":"5.3"},{"$f":"All!D466","v":"5.3.6"},{"$f":"All!E466","v":""},{"$f":"All!F466","v":"5.3.6.2"},{"$f":"All!G466","v":0},{"$f":"All!H466","v":0},{"$f":"All!I466","v":"5.3.6.2.3"},{"$f":"All!J466","v":"5.3.6.2.3: For each event in the mobile money audit trail, is the following logged (as relevant): credit and debit party, transaction ID, date & time, initiator ID (i.e. operator/ customer/ agent/ system ID), type of event, and success or failure of the event?\n"},{"$f":"All!K466","v":"1) Monitoring / logging / audit trail specification\n- Check that for each event in the audit trail the following is captured:\na) Credit and debit party,\nb) Transaction ID, \nc) Date & time, \nd) Initiator ID (i.e. operator/ customer/ agent/ system ID), \ne) Type of event,  \nf) Success or failure of the event\n\n\n\n\n"},{"$f":"All!L466","v":0},{"$f":"All!M466","v":"Urgent Required"},{"$f":"All!N466","v":"Required"},{"$f":"All!O466","v":"TechOps"},{"$f":"All!P466","v":0},{"$f":"All!Q466","v":0},{"$f":"All!R466","v":0},{"$f":"All!S466","v":0},{"$f":"All!T466","v":0},{"$f":"All!U466","v":0},{"$f":"All!V466","v":0},{"$f":"All!W466","v":0},{"$f":"All!X466","v":0},{"$f":"All!Y466","v":0},{"$f":"All!Z466","v":0},{"$f":"All!AA466","v":0},{"$f":"All!AB466","v":0},{"$f":"All!AC466","v":0},{"$f":"All!AD466","v":0},{"$f":"All!AE466","v":0},{"$f":"All!AF466","v":0},{"$f":"All!AG466","v":0},{"$f":"All!AH466","v":0},{"$f":"All!AI466","v":0},{"$f":"All!AJ466","v":0},{"$f":"All!AK466","v":0},{"$f":"All!AL466","v":0},{"$f":"All!AM466","v":0},{"$f":"All!AN466","v":0},{"$f":"All!AO466","v":0},{"$f":"All!AP466","v":0},{"$f":"All!AQ466","v":0},{"$f":"All!AR466","v":0},{"$f":"All!AS466","v":0},{"$f":"All!AT466","v":0}]
[null,{"$f":"All!B467","v":"5"},{"$f":"All!C467","v":"5.3"},{"$f":"All!D467","v":"5.3.6"},{"$f":"All!E467","v":""},{"$f":"All!F467","v":"5.3.6.3"},{"$f":"All!G467","v":"5.3.6.3: PROTECTION OF LOGS & AUDIT TRAILS\nMobile money system logs and application audit trails should be protected to prevent tampering by users and administrators to cover their tracks. \nControls should include:\n- prevention of alterations to the message types that are recorded in system log files and application audit trails;\n- prevention of edits or deletions to system log files and application audit trails; \n- steps to avoid exceeding the storage capacity of the log file media, resulting in either the failure to record events or over-writing of past recorded events;\n- ensuring only individuals who have a job-related need can view logs and audit trail files (see 5.3.3);\n- using file-integrity monitoring or change-detection software for logs and audit trail files; and\n- real-time copying of logs and audit trails to a separate secure logging system, particularly for external-facing systems.\n\nIt is recommended that a centralised log storage system be used.\n\nProviders should retain logs and audit trails for at least one year, with a minimum of three months immediately available online for analysis."},{"$f":"All!H467","v":"ISO 27002: 2013 Sec. 12.4, \nPCI DSS"},{"$f":"All!I467","v":"5.3.6.3.1"},{"$f":"All!J467","v":"5.3.6.3.1: Are system logs and application audit trails protected to restrict access, to prevent alterations to the message types that are recorded, and to prevent edits or deletions to the log files themselves?\n"},{"$f":"All!K467","v":"1) Monitoring / logging / audit trail specification\n- Check that there are controls in place to restrict access to logs, to prevent alterations to the message types that are recorded, and to prevent edits or deletions to the log files themselves.\n\n\n\n\n"},{"$f":"All!L467","v":0},{"$f":"All!M467","v":"Standard Required"},{"$f":"All!N467","v":"Required"},{"$f":"All!O467","v":"TechOps"},{"$f":"All!P467","v":0},{"$f":"All!Q467","v":0},{"$f":"All!R467","v":0},{"$f":"All!S467","v":0},{"$f":"All!T467","v":0},{"$f":"All!U467","v":0},{"$f":"All!V467","v":0},{"$f":"All!W467","v":0},{"$f":"All!X467","v":0},{"$f":"All!Y467","v":0},{"$f":"All!Z467","v":0},{"$f":"All!AA467","v":0},{"$f":"All!AB467","v":0},{"$f":"All!AC467","v":0},{"$f":"All!AD467","v":0},{"$f":"All!AE467","v":0},{"$f":"All!AF467","v":0},{"$f":"All!AG467","v":0},{"$f":"All!AH467","v":0},{"$f":"All!AI467","v":0},{"$f":"All!AJ467","v":0},{"$f":"All!AK467","v":0},{"$f":"All!AL467","v":0},{"$f":"All!AM467","v":0},{"$f":"All!AN467","v":0},{"$f":"All!AO467","v":0},{"$f":"All!AP467","v":0},{"$f":"All!AQ467","v":0},{"$f":"All!AR467","v":0},{"$f":"All!AS467","v":0},{"$f":"All!AT467","v":0}]
[null,{"$f":"All!B468","v":"5"},{"$f":"All!C468","v":"5.3"},{"$f":"All!D468","v":"5.3.6"},{"$f":"All!E468","v":""},{"$f":"All!F468","v":"5.3.6.3"},{"$f":"All!G468","v":0},{"$f":"All!H468","v":0},{"$f":"All!I468","v":"5.3.6.3.2"},{"$f":"All!J468","v":"5.3.6.3.2: Are there controls in place that protect against exceeding the storage capacity of the log file media?\n"},{"$f":"All!K468","v":"1) Monitoring / logging / audit trail specification\n- Check that there are controls in place to protect against exceeding the storage capacity of the log file media\n\n\n\n\n"},{"$f":"All!L468","v":0},{"$f":"All!M468","v":"Standard Required"},{"$f":"All!N468","v":"Required"},{"$f":"All!O468","v":"TechOps"},{"$f":"All!P468","v":0},{"$f":"All!Q468","v":0},{"$f":"All!R468","v":0},{"$f":"All!S468","v":0},{"$f":"All!T468","v":0},{"$f":"All!U468","v":0},{"$f":"All!V468","v":0},{"$f":"All!W468","v":0},{"$f":"All!X468","v":0},{"$f":"All!Y468","v":0},{"$f":"All!Z468","v":0},{"$f":"All!AA468","v":0},{"$f":"All!AB468","v":0},{"$f":"All!AC468","v":0},{"$f":"All!AD468","v":0},{"$f":"All!AE468","v":0},{"$f":"All!AF468","v":0},{"$f":"All!AG468","v":0},{"$f":"All!AH468","v":0},{"$f":"All!AI468","v":0},{"$f":"All!AJ468","v":0},{"$f":"All!AK468","v":0},{"$f":"All!AL468","v":0},{"$f":"All!AM468","v":0},{"$f":"All!AN468","v":0},{"$f":"All!AO468","v":0},{"$f":"All!AP468","v":0},{"$f":"All!AQ468","v":0},{"$f":"All!AR468","v":0},{"$f":"All!AS468","v":0},{"$f":"All!AT468","v":0}]
[null,{"$f":"All!B469","v":"5"},{"$f":"All!C469","v":"5.3"},{"$f":"All!D469","v":"5.3.6"},{"$f":"All!E469","v":0},{"$f":"All!F469","v":"5.3.6.3"},{"$f":"All!G469","v":0},{"$f":"All!H469","v":0},{"$f":"All!I469","v":0},{"$f":"All!J469","v":"5.3.6.3.3: Has a centralized log storage system been implemented?\n"},{"$f":"All!K469","v":0},{"$f":"All!L469","v":0},{"$f":"All!M469","v":"Recommended"},{"$f":"All!N469","v":"Recommended"},{"$f":"All!O469","v":"TechOps"},{"$f":"All!P469","v":0},{"$f":"All!Q469","v":0},{"$f":"All!R469","v":0},{"$f":"All!S469","v":0},{"$f":"All!T469","v":0},{"$f":"All!U469","v":0},{"$f":"All!V469","v":0},{"$f":"All!W469","v":0},{"$f":"All!X469","v":0},{"$f":"All!Y469","v":0},{"$f":"All!Z469","v":0},{"$f":"All!AA469","v":0},{"$f":"All!AB469","v":0},{"$f":"All!AC469","v":0},{"$f":"All!AD469","v":0},{"$f":"All!AE469","v":0},{"$f":"All!AF469","v":0},{"$f":"All!AG469","v":0},{"$f":"All!AH469","v":0},{"$f":"All!AI469","v":0},{"$f":"All!AJ469","v":0},{"$f":"All!AK469","v":0},{"$f":"All!AL469","v":0},{"$f":"All!AM469","v":0},{"$f":"All!AN469","v":0},{"$f":"All!AO469","v":0},{"$f":"All!AP469","v":0},{"$f":"All!AQ469","v":0},{"$f":"All!AR469","v":0},{"$f":"All!AS469","v":0},{"$f":"All!AT469","v":0}]
[null,{"$f":"All!B470","v":"5"},{"$f":"All!C470","v":"5.3"},{"$f":"All!D470","v":"5.3.6"},{"$f":"All!E470","v":""},{"$f":"All!F470","v":"5.3.6.3"},{"$f":"All!G470","v":0},{"$f":"All!H470","v":0},{"$f":"All!I470","v":"5.3.6.3.4"},{"$f":"All!J470","v":"5.3.6.3.4: Is file-integrity monitoring or change-detection software in use for logs and audit trail files?\n"},{"$f":"All!K470","v":0},{"$f":"All!L470","v":0},{"$f":"All!M470","v":"Recommended"},{"$f":"All!N470","v":"Recommended"},{"$f":"All!O470","v":"TechOps"},{"$f":"All!P470","v":0},{"$f":"All!Q470","v":0},{"$f":"All!R470","v":0},{"$f":"All!S470","v":0},{"$f":"All!T470","v":0},{"$f":"All!U470","v":0},{"$f":"All!V470","v":0},{"$f":"All!W470","v":0},{"$f":"All!X470","v":0},{"$f":"All!Y470","v":0},{"$f":"All!Z470","v":0},{"$f":"All!AA470","v":0},{"$f":"All!AB470","v":0},{"$f":"All!AC470","v":0},{"$f":"All!AD470","v":0},{"$f":"All!AE470","v":0},{"$f":"All!AF470","v":0},{"$f":"All!AG470","v":0},{"$f":"All!AH470","v":0},{"$f":"All!AI470","v":0},{"$f":"All!AJ470","v":0},{"$f":"All!AK470","v":0},{"$f":"All!AL470","v":0},{"$f":"All!AM470","v":0},{"$f":"All!AN470","v":0},{"$f":"All!AO470","v":0},{"$f":"All!AP470","v":0},{"$f":"All!AQ470","v":0},{"$f":"All!AR470","v":0},{"$f":"All!AS470","v":0},{"$f":"All!AT470","v":0}]
[null,{"$f":"All!B471","v":"5"},{"$f":"All!C471","v":"5.3"},{"$f":"All!D471","v":"5.3.6"},{"$f":"All!E471","v":""},{"$f":"All!F471","v":"5.3.6.3"},{"$f":"All!G471","v":0},{"$f":"All!H471","v":0},{"$f":"All!I471","v":"5.3.6.3.5"},{"$f":"All!J471","v":"5.3.6.3.5: Are logs and audit trails copied in real time to a separate secure logging system, particularly for external-facing systems?\n"},{"$f":"All!K471","v":0},{"$f":"All!L471","v":0},{"$f":"All!M471","v":"Recommended"},{"$f":"All!N471","v":"Recommended"},{"$f":"All!O471","v":"TechOps"},{"$f":"All!P471","v":0},{"$f":"All!Q471","v":0},{"$f":"All!R471","v":0},{"$f":"All!S471","v":0},{"$f":"All!T471","v":0},{"$f":"All!U471","v":0},{"$f":"All!V471","v":0},{"$f":"All!W471","v":0},{"$f":"All!X471","v":0},{"$f":"All!Y471","v":0},{"$f":"All!Z471","v":0},{"$f":"All!AA471","v":0},{"$f":"All!AB471","v":0},{"$f":"All!AC471","v":0},{"$f":"All!AD471","v":0},{"$f":"All!AE471","v":0},{"$f":"All!AF471","v":0},{"$f":"All!AG471","v":0},{"$f":"All!AH471","v":0},{"$f":"All!AI471","v":0},{"$f":"All!AJ471","v":0},{"$f":"All!AK471","v":0},{"$f":"All!AL471","v":0},{"$f":"All!AM471","v":0},{"$f":"All!AN471","v":0},{"$f":"All!AO471","v":0},{"$f":"All!AP471","v":0},{"$f":"All!AQ471","v":0},{"$f":"All!AR471","v":0},{"$f":"All!AS471","v":0},{"$f":"All!AT471","v":0}]
[null,{"$f":"All!B472","v":"5"},{"$f":"All!C472","v":"5.3"},{"$f":"All!D472","v":"5.3.6"},{"$f":"All!E472","v":""},{"$f":"All!F472","v":"5.3.6.3"},{"$f":"All!G472","v":0},{"$f":"All!H472","v":0},{"$f":"All!I472","v":"5.3.6.3.6"},{"$f":"All!J472","v":"5.3.6.3.6: Are logs and audit trail files retained for at least one year, with at least three months of logs available online for analysis?\n"},{"$f":"All!K472","v":0},{"$f":"All!L472","v":0},{"$f":"All!M472","v":"Recommended"},{"$f":"All!N472","v":"Recommended"},{"$f":"All!O472","v":"TechOps"},{"$f":"All!P472","v":0},{"$f":"All!Q472","v":0},{"$f":"All!R472","v":0},{"$f":"All!S472","v":0},{"$f":"All!T472","v":0},{"$f":"All!U472","v":0},{"$f":"All!V472","v":0},{"$f":"All!W472","v":0},{"$f":"All!X472","v":0},{"$f":"All!Y472","v":0},{"$f":"All!Z472","v":0},{"$f":"All!AA472","v":0},{"$f":"All!AB472","v":0},{"$f":"All!AC472","v":0},{"$f":"All!AD472","v":0},{"$f":"All!AE472","v":0},{"$f":"All!AF472","v":0},{"$f":"All!AG472","v":0},{"$f":"All!AH472","v":0},{"$f":"All!AI472","v":0},{"$f":"All!AJ472","v":0},{"$f":"All!AK472","v":0},{"$f":"All!AL472","v":0},{"$f":"All!AM472","v":0},{"$f":"All!AN472","v":0},{"$f":"All!AO472","v":0},{"$f":"All!AP472","v":0},{"$f":"All!AQ472","v":0},{"$f":"All!AR472","v":0},{"$f":"All!AS472","v":0},{"$f":"All!AT472","v":0}]
[null,{"$f":"All!B473","v":"5"},{"$f":"All!C473","v":"5.3"},{"$f":"All!D473","v":"5.3.7"},{"$f":"All!E473","v":"5.3.7: Providers shall regularly test security systems and processes."},{"$f":"All!F473","v":"5.3.7.1"},{"$f":"All!G473","v":"5.3.7.1: VULNERABILITY SCANS\nVulnerability scans should be performed on the mobile money system to search for security weaknesses. Vulnerability scans should be performed at least every three months and after any significant change to the mobile money system or the network supporting it.\n\nVulnerability scans should include:\n - System: scans of the mobile money application.\n - Network: internal and external (public API) scans on the network supporting the mobile money system;\n\nRemedial actions should be determined and prioritized according to criticality. Additional scans should be run to ensure that the fixes have been implemented correctly.\n\nVulnerability scans should be performed by qualified internal personnel or a qualified external third party, and the organizational independence of the tester should be assured.\n\nFor more information, please refer to security testing in the definitions."},{"$f":"All!H473","v":"ISO 27002:2013 Sec. 12.6, PCI DSS"},{"$f":"All!I473","v":"5.3.7.1.1"},{"$f":"All!J473","v":"5.3.7.1.1: Are vulnerability scans of the mobile money system performed at least every six months and after any significant change to the mobile money system?\n"},{"$f":"All!K473","v":"1) Security testing process documentation\n- Check that there is a process to perform vulnerability scans of the mobile money system.\n- Check that the process schedules scans at least every six months.\n- Check that the process requires a scan after any significant change to the mobile money platform.\n- Check that a scan has been completed in the last six months (and if not, look for evidence that the process will be run in future)."},{"$f":"All!L473","v":0},{"$f":"All!M473","v":"Standard Required"},{"$f":"All!N473","v":"Required"},{"$f":"All!O473","v":"TechOps"},{"$f":"All!P473","v":0},{"$f":"All!Q473","v":0},{"$f":"All!R473","v":0},{"$f":"All!S473","v":0},{"$f":"All!T473","v":0},{"$f":"All!U473","v":0},{"$f":"All!V473","v":0},{"$f":"All!W473","v":0},{"$f":"All!X473","v":0},{"$f":"All!Y473","v":0},{"$f":"All!Z473","v":0},{"$f":"All!AA473","v":0},{"$f":"All!AB473","v":0},{"$f":"All!AC473","v":0},{"$f":"All!AD473","v":0},{"$f":"All!AE473","v":0},{"$f":"All!AF473","v":0},{"$f":"All!AG473","v":0},{"$f":"All!AH473","v":0},{"$f":"All!AI473","v":0},{"$f":"All!AJ473","v":0},{"$f":"All!AK473","v":0},{"$f":"All!AL473","v":0},{"$f":"All!AM473","v":0},{"$f":"All!AN473","v":0},{"$f":"All!AO473","v":0},{"$f":"All!AP473","v":0},{"$f":"All!AQ473","v":0},{"$f":"All!AR473","v":0},{"$f":"All!AS473","v":0},{"$f":"All!AT473","v":0}]
[null,{"$f":"All!B474","v":"5"},{"$f":"All!C474","v":"5.3"},{"$f":"All!D474","v":"5.3.7"},{"$f":"All!E474","v":""},{"$f":"All!F474","v":"5.3.7.1"},{"$f":"All!G474","v":0},{"$f":"All!H474","v":0},{"$f":"All!I474","v":"5.3.7.1.2"},{"$f":"All!J474","v":"5.3.7.1.2: Are remedial actions prioritized and dealt with according to criticality?\n"},{"$f":"All!K474","v":"1) Security testing process documentation\n- Check there is a process to address remedial issues identified by scans\n- Check these are prioritised using a risk-based approach\n\n"},{"$f":"All!L474","v":0},{"$f":"All!M474","v":"Standard Required"},{"$f":"All!N474","v":"Required"},{"$f":"All!O474","v":"TechOps"},{"$f":"All!P474","v":0},{"$f":"All!Q474","v":0},{"$f":"All!R474","v":0},{"$f":"All!S474","v":0},{"$f":"All!T474","v":0},{"$f":"All!U474","v":0},{"$f":"All!V474","v":0},{"$f":"All!W474","v":0},{"$f":"All!X474","v":0},{"$f":"All!Y474","v":0},{"$f":"All!Z474","v":0},{"$f":"All!AA474","v":0},{"$f":"All!AB474","v":0},{"$f":"All!AC474","v":0},{"$f":"All!AD474","v":0},{"$f":"All!AE474","v":0},{"$f":"All!AF474","v":0},{"$f":"All!AG474","v":0},{"$f":"All!AH474","v":0},{"$f":"All!AI474","v":0},{"$f":"All!AJ474","v":0},{"$f":"All!AK474","v":0},{"$f":"All!AL474","v":0},{"$f":"All!AM474","v":0},{"$f":"All!AN474","v":0},{"$f":"All!AO474","v":0},{"$f":"All!AP474","v":0},{"$f":"All!AQ474","v":0},{"$f":"All!AR474","v":0},{"$f":"All!AS474","v":0},{"$f":"All!AT474","v":0}]
[null,{"$f":"All!B475","v":"5"},{"$f":"All!C475","v":"5.3"},{"$f":"All!D475","v":"5.3.7"},{"$f":"All!E475","v":""},{"$f":"All!F475","v":"5.3.7.2"},{"$f":"All!G475","v":"5.3.7.2: PENETRATION TESTING\nPenetration testing of the mobile money system should be performed annually and whenever a significant change is made to the mobile money system (e.g. a major release). Testing should be done on all external interfaces to the system.\n\nThe methodology for penetration testing should:\n- be based on industry-accepted penetration testing approaches (for example, NIST SP800-115);\n- include all system components involved in providing the mobile money service (application servers, databases, gateways, etc.);\n- include handset and other terminals such as smartphones and PoS devices;\n- test the network segmentation that separates mobile money from other systems in the network;\n- include both application-layer tests (using real accounts) and network-layer penetration testing; and\n- include consideration of threats and vulnerabilities experienced in the last 12 months.\n\nRemedial actions should be determined and prioritized according to criticality. The actions should be tracked and followed up to ensure completion.\n\nPenetration testing should be performed by a qualified internal resource(s) or qualified external third party, and the independence of the tester should be assured.\n\nFor more information, please refer to security testing in the definitions."},{"$f":"All!H475","v":"PCI DSS "},{"$f":"All!I475","v":"5.3.7.2.1"},{"$f":"All!J475","v":"5.3.7.2.1: Is penetration testing of the mobile money system performed annually and after any significant changes, using all external interfaces?\n"},{"$f":"All!K475","v":"1) Security testing process documentation\n-  Check there is a process to perform penetration testing of the mobile money application system annually and after any significant changes to the mobile money platform.\n\n2) Header page of penetration test report or purchase prder for penetration testing\n- Review document to confirm penetration testing has been conducted in the last year"},{"$f":"All!L475","v":0},{"$f":"All!M475","v":"Standard Required"},{"$f":"All!N475","v":"Required"},{"$f":"All!O475","v":"TechOps"},{"$f":"All!P475","v":0},{"$f":"All!Q475","v":0},{"$f":"All!R475","v":0},{"$f":"All!S475","v":0},{"$f":"All!T475","v":0},{"$f":"All!U475","v":0},{"$f":"All!V475","v":0},{"$f":"All!W475","v":0},{"$f":"All!X475","v":0},{"$f":"All!Y475","v":0},{"$f":"All!Z475","v":0},{"$f":"All!AA475","v":0},{"$f":"All!AB475","v":0},{"$f":"All!AC475","v":0},{"$f":"All!AD475","v":0},{"$f":"All!AE475","v":0},{"$f":"All!AF475","v":0},{"$f":"All!AG475","v":0},{"$f":"All!AH475","v":0},{"$f":"All!AI475","v":0},{"$f":"All!AJ475","v":0},{"$f":"All!AK475","v":0},{"$f":"All!AL475","v":0},{"$f":"All!AM475","v":0},{"$f":"All!AN475","v":0},{"$f":"All!AO475","v":0},{"$f":"All!AP475","v":0},{"$f":"All!AQ475","v":0},{"$f":"All!AR475","v":0},{"$f":"All!AS475","v":0},{"$f":"All!AT475","v":0}]
[null,{"$f":"All!B476","v":"5"},{"$f":"All!C476","v":"5.3"},{"$f":"All!D476","v":"5.3.7"},{"$f":"All!E476","v":""},{"$f":"All!F476","v":"5.3.7.2"},{"$f":"All!G476","v":0},{"$f":"All!H476","v":0},{"$f":"All!I476","v":"5.3.7.2.2"},{"$f":"All!J476","v":"5.3.7.2.2: Are remedial actions prioritized according to criticality and actions tracked and followed up to ensure completion?\n"},{"$f":"All!K476","v":"1) Security Testing Process Documentation\n- Check there is a process to address remedial issues identified by scans\n- Check these are prioritised using a risk-based approach\n- Check there is a process to track actions until they are closed\n"},{"$f":"All!L476","v":0},{"$f":"All!M476","v":"Standard Required"},{"$f":"All!N476","v":"Required"},{"$f":"All!O476","v":"TechOps"},{"$f":"All!P476","v":0},{"$f":"All!Q476","v":0},{"$f":"All!R476","v":0},{"$f":"All!S476","v":0},{"$f":"All!T476","v":0},{"$f":"All!U476","v":0},{"$f":"All!V476","v":0},{"$f":"All!W476","v":0},{"$f":"All!X476","v":0},{"$f":"All!Y476","v":0},{"$f":"All!Z476","v":0},{"$f":"All!AA476","v":0},{"$f":"All!AB476","v":0},{"$f":"All!AC476","v":0},{"$f":"All!AD476","v":0},{"$f":"All!AE476","v":0},{"$f":"All!AF476","v":0},{"$f":"All!AG476","v":0},{"$f":"All!AH476","v":0},{"$f":"All!AI476","v":0},{"$f":"All!AJ476","v":0},{"$f":"All!AK476","v":0},{"$f":"All!AL476","v":0},{"$f":"All!AM476","v":0},{"$f":"All!AN476","v":0},{"$f":"All!AO476","v":0},{"$f":"All!AP476","v":0},{"$f":"All!AQ476","v":0},{"$f":"All!AR476","v":0},{"$f":"All!AS476","v":0},{"$f":"All!AT476","v":0}]
[null,{"$f":"All!B477","v":"5"},{"$f":"All!C477","v":"5.3"},{"$f":"All!D477","v":"5.3.7"},{"$f":"All!E477","v":""},{"$f":"All!F477","v":"5.3.7.2"},{"$f":"All!G477","v":0},{"$f":"All!H477","v":0},{"$f":"All!I477","v":"5.3.7.2.3"},{"$f":"All!J477","v":"5.3.7.2.3: Are penetration tests performed by qualified internal resource(s) or a qualified external third party, and is the independence of the tester assured?\n"},{"$f":"All!K477","v":"1) Security Testing Process Documentation\n- Check the penetration tests are carried out by qualified person(s)\n- Check there are controls in place to assure the independence of the tester\n\n2) Purchase Order for penetration testing\n- Check purchase order to confirm the above\n"},{"$f":"All!L477","v":0},{"$f":"All!M477","v":"Standard Required"},{"$f":"All!N477","v":"Required"},{"$f":"All!O477","v":"TechOps"},{"$f":"All!P477","v":0},{"$f":"All!Q477","v":0},{"$f":"All!R477","v":0},{"$f":"All!S477","v":0},{"$f":"All!T477","v":0},{"$f":"All!U477","v":0},{"$f":"All!V477","v":0},{"$f":"All!W477","v":0},{"$f":"All!X477","v":0},{"$f":"All!Y477","v":0},{"$f":"All!Z477","v":0},{"$f":"All!AA477","v":0},{"$f":"All!AB477","v":0},{"$f":"All!AC477","v":0},{"$f":"All!AD477","v":0},{"$f":"All!AE477","v":0},{"$f":"All!AF477","v":0},{"$f":"All!AG477","v":0},{"$f":"All!AH477","v":0},{"$f":"All!AI477","v":0},{"$f":"All!AJ477","v":0},{"$f":"All!AK477","v":0},{"$f":"All!AL477","v":0},{"$f":"All!AM477","v":0},{"$f":"All!AN477","v":0},{"$f":"All!AO477","v":0},{"$f":"All!AP477","v":0},{"$f":"All!AQ477","v":0},{"$f":"All!AR477","v":0},{"$f":"All!AS477","v":0},{"$f":"All!AT477","v":0}]
[null,{"$f":"All!B478","v":"5"},{"$f":"All!C478","v":"5.3"},{"$f":"All!D478","v":"5.3.7"},{"$f":"All!E478","v":""},{"$f":"All!F478","v":"5.3.7.2"},{"$f":"All!G478","v":0},{"$f":"All!H478","v":0},{"$f":"All!I478","v":"5.3.7.2.4"},{"$f":"All!J478","v":"5.3.7.2.4: Does penetration testing validate the network segmentation that separates mobile money from other systems in the network?\n"},{"$f":"All!K478","v":0},{"$f":"All!L478","v":0},{"$f":"All!M478","v":"Recommended"},{"$f":"All!N478","v":"Recommended"},{"$f":"All!O478","v":"TechOps"},{"$f":"All!P478","v":0},{"$f":"All!Q478","v":0},{"$f":"All!R478","v":0},{"$f":"All!S478","v":0},{"$f":"All!T478","v":0},{"$f":"All!U478","v":0},{"$f":"All!V478","v":0},{"$f":"All!W478","v":0},{"$f":"All!X478","v":0},{"$f":"All!Y478","v":0},{"$f":"All!Z478","v":0},{"$f":"All!AA478","v":0},{"$f":"All!AB478","v":0},{"$f":"All!AC478","v":0},{"$f":"All!AD478","v":0},{"$f":"All!AE478","v":0},{"$f":"All!AF478","v":0},{"$f":"All!AG478","v":0},{"$f":"All!AH478","v":0},{"$f":"All!AI478","v":0},{"$f":"All!AJ478","v":0},{"$f":"All!AK478","v":0},{"$f":"All!AL478","v":0},{"$f":"All!AM478","v":0},{"$f":"All!AN478","v":0},{"$f":"All!AO478","v":0},{"$f":"All!AP478","v":0},{"$f":"All!AQ478","v":0},{"$f":"All!AR478","v":0},{"$f":"All!AS478","v":0},{"$f":"All!AT478","v":0}]
[null,{"$f":"All!B479","v":"5"},{"$f":"All!C479","v":"5.3"},{"$f":"All!D479","v":"5.3.7"},{"$f":"All!E479","v":""},{"$f":"All!F479","v":"5.3.7.2"},{"$f":"All!G479","v":0},{"$f":"All!H479","v":0},{"$f":"All!I479","v":"5.3.7.2.5"},{"$f":"All!J479","v":"5.3.7.2.5: Does penetration testing include both application-layer tests (using real accounts) and network-layer penetration testing?\n"},{"$f":"All!K479","v":0},{"$f":"All!L479","v":0},{"$f":"All!M479","v":"Recommended"},{"$f":"All!N479","v":"Recommended"},{"$f":"All!O479","v":"TechOps"},{"$f":"All!P479","v":0},{"$f":"All!Q479","v":0},{"$f":"All!R479","v":0},{"$f":"All!S479","v":0},{"$f":"All!T479","v":0},{"$f":"All!U479","v":0},{"$f":"All!V479","v":0},{"$f":"All!W479","v":0},{"$f":"All!X479","v":0},{"$f":"All!Y479","v":0},{"$f":"All!Z479","v":0},{"$f":"All!AA479","v":0},{"$f":"All!AB479","v":0},{"$f":"All!AC479","v":0},{"$f":"All!AD479","v":0},{"$f":"All!AE479","v":0},{"$f":"All!AF479","v":0},{"$f":"All!AG479","v":0},{"$f":"All!AH479","v":0},{"$f":"All!AI479","v":0},{"$f":"All!AJ479","v":0},{"$f":"All!AK479","v":0},{"$f":"All!AL479","v":0},{"$f":"All!AM479","v":0},{"$f":"All!AN479","v":0},{"$f":"All!AO479","v":0},{"$f":"All!AP479","v":0},{"$f":"All!AQ479","v":0},{"$f":"All!AR479","v":0},{"$f":"All!AS479","v":0},{"$f":"All!AT479","v":0}]
[null,{"$f":"All!B480","v":"5"},{"$f":"All!C480","v":"5.3"},{"$f":"All!D480","v":"5.3.7"},{"$f":"All!E480","v":""},{"$f":"All!F480","v":"5.3.7.2"},{"$f":"All!G480","v":0},{"$f":"All!H480","v":0},{"$f":"All!I480","v":"5.3.7.2.6"},{"$f":"All!J480","v":"5.3.7.2.6: Does penetration testing include consideration of threats and vulnerabilities experienced in the last 12 months?\n"},{"$f":"All!K480","v":0},{"$f":"All!L480","v":0},{"$f":"All!M480","v":"Recommended"},{"$f":"All!N480","v":"Recommended"},{"$f":"All!O480","v":"TechOps"},{"$f":"All!P480","v":0},{"$f":"All!Q480","v":0},{"$f":"All!R480","v":0},{"$f":"All!S480","v":0},{"$f":"All!T480","v":0},{"$f":"All!U480","v":0},{"$f":"All!V480","v":0},{"$f":"All!W480","v":0},{"$f":"All!X480","v":0},{"$f":"All!Y480","v":0},{"$f":"All!Z480","v":0},{"$f":"All!AA480","v":0},{"$f":"All!AB480","v":0},{"$f":"All!AC480","v":0},{"$f":"All!AD480","v":0},{"$f":"All!AE480","v":0},{"$f":"All!AF480","v":0},{"$f":"All!AG480","v":0},{"$f":"All!AH480","v":0},{"$f":"All!AI480","v":0},{"$f":"All!AJ480","v":0},{"$f":"All!AK480","v":0},{"$f":"All!AL480","v":0},{"$f":"All!AM480","v":0},{"$f":"All!AN480","v":0},{"$f":"All!AO480","v":0},{"$f":"All!AP480","v":0},{"$f":"All!AQ480","v":0},{"$f":"All!AR480","v":0},{"$f":"All!AS480","v":0},{"$f":"All!AT480","v":0}]
[null,{"$f":"All!B481","v":"5"},{"$f":"All!C481","v":"5.3"},{"$f":"All!D481","v":"5.3.8"},{"$f":"All!E481","v":"5.3.8: Providers shall ensure continuity of information security."},{"$f":"All!F481","v":"5.3.8.1"},{"$f":"All!G481","v":"5.3.8.1: SECURITY AND DISASTER RECOVERY\nIt is important that security is maintained in a crisis situation, especially one in which the Disaster Recovery Plan is implemented.\n\nThe security team should provide input into the Disaster Recovery Plan to ensure that security is maintained in the case of each threat identified in the Business Continuity risk assessment. \nIn particular:\n- The disaster recovery site should have the same standard of physical security controls as the primary datacentre;\n- Entities providing outsourced services should be included in the disaster recovery plan to ensure that they maintain security levels following major service failures or disasters."},{"$f":"All!H481","v":"ISO 27002:2013 Sec. 17.1 "},{"$f":"All!I481","v":"5.3.8.1.1"},{"$f":"All!J481","v":"5.3.8.1.1: Are the physical security controls at the disaster recovery site the same standard as those at the the primary datacentre?\n"},{"$f":"All!K481","v":"1) Disaster recovery plan\n- Check the the physical security controls at the disaster recovery site are the same standard as those at the the primary datacentre."},{"$f":"All!L481","v":0},{"$f":"All!M481","v":"Standard Required"},{"$f":"All!N481","v":"Required"},{"$f":"All!O481","v":"TechOps"},{"$f":"All!P481","v":0},{"$f":"All!Q481","v":0},{"$f":"All!R481","v":0},{"$f":"All!S481","v":0},{"$f":"All!T481","v":0},{"$f":"All!U481","v":0},{"$f":"All!V481","v":0},{"$f":"All!W481","v":0},{"$f":"All!X481","v":0},{"$f":"All!Y481","v":0},{"$f":"All!Z481","v":0},{"$f":"All!AA481","v":0},{"$f":"All!AB481","v":0},{"$f":"All!AC481","v":0},{"$f":"All!AD481","v":0},{"$f":"All!AE481","v":0},{"$f":"All!AF481","v":0},{"$f":"All!AG481","v":0},{"$f":"All!AH481","v":0},{"$f":"All!AI481","v":0},{"$f":"All!AJ481","v":0},{"$f":"All!AK481","v":0},{"$f":"All!AL481","v":0},{"$f":"All!AM481","v":0},{"$f":"All!AN481","v":0},{"$f":"All!AO481","v":0},{"$f":"All!AP481","v":0},{"$f":"All!AQ481","v":0},{"$f":"All!AR481","v":0},{"$f":"All!AS481","v":0},{"$f":"All!AT481","v":0}]
[null,{"$f":"All!B482","v":"5"},{"$f":"All!C482","v":"5.3"},{"$f":"All!D482","v":"5.3.8"},{"$f":"All!E482","v":""},{"$f":"All!F482","v":"5.3.8.1"},{"$f":"All!G482","v":0},{"$f":"All!H482","v":0},{"$f":"All!I482","v":"5.3.8.1.2"},{"$f":"All!J482","v":"5.3.8.1.2: Are entities providing outsourced services included in the disaster recovery plan to ensure that they maintain security levels following major service failures or disasters?\n"},{"$f":"All!K482","v":0},{"$f":"All!L482","v":0},{"$f":"All!M482","v":"Recommended"},{"$f":"All!N482","v":"Recommended"},{"$f":"All!O482","v":"TechOps"},{"$f":"All!P482","v":0},{"$f":"All!Q482","v":0},{"$f":"All!R482","v":0},{"$f":"All!S482","v":0},{"$f":"All!T482","v":0},{"$f":"All!U482","v":0},{"$f":"All!V482","v":0},{"$f":"All!W482","v":0},{"$f":"All!X482","v":0},{"$f":"All!Y482","v":0},{"$f":"All!Z482","v":0},{"$f":"All!AA482","v":0},{"$f":"All!AB482","v":0},{"$f":"All!AC482","v":0},{"$f":"All!AD482","v":0},{"$f":"All!AE482","v":0},{"$f":"All!AF482","v":0},{"$f":"All!AG482","v":0},{"$f":"All!AH482","v":0},{"$f":"All!AI482","v":0},{"$f":"All!AJ482","v":0},{"$f":"All!AK482","v":0},{"$f":"All!AL482","v":0},{"$f":"All!AM482","v":0},{"$f":"All!AN482","v":0},{"$f":"All!AO482","v":0},{"$f":"All!AP482","v":0},{"$f":"All!AQ482","v":0},{"$f":"All!AR482","v":0},{"$f":"All!AS482","v":0},{"$f":"All!AT482","v":0}]
[null,{"$f":"All!B483","v":"5"},{"$f":"All!C483","v":"5.3"},{"$f":"All!D483","v":"5.3.9"},{"$f":"All!E483","v":"5.3.9: Providers shall develop a process to identify, address, and monitor security incidents and security-related complaints."},{"$f":"All!F483","v":"5.3.9.1"},{"$f":"All!G483","v":"5.3.9.1: REPORTING SECURITY INCIDENTS\nSecurity incidents may be detected by system monitoring, but often they are reported by users. Processes to enable reporting of security incidents should be implemented.\n\nAll mobile money employees, agents, and third parties should be educated on reporting security incidents, including:\n- their contractual responsibility to report security events as quickly as possible;\n- the procedure for reporting information security events, including noting all details of the incident such as names, data and messages on the screen; and\n- deferring all action and communication to the security incident team.\n\nExamples of security events that could be reported include:\n- ineffective security control;\n- breach of information integrity, confidentiality or availability expectations;\n- non-compliance with regulation;\n- breach of logical or physical security arrangements; and\n- uncontrolled system changes.\n\nProviders should prepare security event reporting forms to help the person reporting to remember all necessary actions in case of an information security event.\n\nThere should be a channel for staff to anonymously report security incidents and violations of information security policies or procedures (i.e., 'whistle blowing')."},{"$f":"All!H483","v":"ISO 27002: 2013 Sec. 16 "},{"$f":"All!I483","v":"5.3.9.1.1"},{"$f":"All!J483","v":"5.3.9.1.1: Are employees, agents, and third parties aware of their responsibility to report information security events as quickly as possible?\n"},{"$f":"All!K483","v":0},{"$f":"All!L483","v":0},{"$f":"All!M483","v":"Recommended"},{"$f":"All!N483","v":"Recommended"},{"$f":"All!O483","v":"TechOps"},{"$f":"All!P483","v":0},{"$f":"All!Q483","v":0},{"$f":"All!R483","v":0},{"$f":"All!S483","v":0},{"$f":"All!T483","v":0},{"$f":"All!U483","v":0},{"$f":"All!V483","v":0},{"$f":"All!W483","v":0},{"$f":"All!X483","v":0},{"$f":"All!Y483","v":0},{"$f":"All!Z483","v":0},{"$f":"All!AA483","v":0},{"$f":"All!AB483","v":0},{"$f":"All!AC483","v":0},{"$f":"All!AD483","v":0},{"$f":"All!AE483","v":0},{"$f":"All!AF483","v":0},{"$f":"All!AG483","v":0},{"$f":"All!AH483","v":0},{"$f":"All!AI483","v":0},{"$f":"All!AJ483","v":0},{"$f":"All!AK483","v":0},{"$f":"All!AL483","v":0},{"$f":"All!AM483","v":0},{"$f":"All!AN483","v":0},{"$f":"All!AO483","v":0},{"$f":"All!AP483","v":0},{"$f":"All!AQ483","v":0},{"$f":"All!AR483","v":0},{"$f":"All!AS483","v":0},{"$f":"All!AT483","v":0}]
[null,{"$f":"All!B484","v":"5"},{"$f":"All!C484","v":"5.3"},{"$f":"All!D484","v":"5.3.9"},{"$f":"All!E484","v":0},{"$f":"All!F484","v":"5.3.9.1"},{"$f":"All!G484","v":0},{"$f":"All!H484","v":0},{"$f":"All!I484","v":"5.3.9.1.2"},{"$f":"All!J484","v":"5.3.9.1.2: Have employees, agents, and third parties been educated in the procedure for reporting security incidents, including (1) noting all details of the incident such as names, data and messages on the screen; (2) deferring all action and communication to the security incident team?\n"},{"$f":"All!K484","v":0},{"$f":"All!L484","v":0},{"$f":"All!M484","v":"Recommended"},{"$f":"All!N484","v":"Recommended"},{"$f":"All!O484","v":"TechOps"},{"$f":"All!P484","v":0},{"$f":"All!Q484","v":0},{"$f":"All!R484","v":0},{"$f":"All!S484","v":0},{"$f":"All!T484","v":0},{"$f":"All!U484","v":0},{"$f":"All!V484","v":0},{"$f":"All!W484","v":0},{"$f":"All!X484","v":0},{"$f":"All!Y484","v":0},{"$f":"All!Z484","v":0},{"$f":"All!AA484","v":0},{"$f":"All!AB484","v":0},{"$f":"All!AC484","v":0},{"$f":"All!AD484","v":0},{"$f":"All!AE484","v":0},{"$f":"All!AF484","v":0},{"$f":"All!AG484","v":0},{"$f":"All!AH484","v":0},{"$f":"All!AI484","v":0},{"$f":"All!AJ484","v":0},{"$f":"All!AK484","v":0},{"$f":"All!AL484","v":0},{"$f":"All!AM484","v":0},{"$f":"All!AN484","v":0},{"$f":"All!AO484","v":0},{"$f":"All!AP484","v":0},{"$f":"All!AQ484","v":0},{"$f":"All!AR484","v":0},{"$f":"All!AS484","v":0},{"$f":"All!AT484","v":0}]
[null,{"$f":"All!B485","v":"5"},{"$f":"All!C485","v":"5.3"},{"$f":"All!D485","v":"5.3.9"},{"$f":"All!E485","v":""},{"$f":"All!F485","v":"5.3.9.1"},{"$f":"All!G485","v":0},{"$f":"All!H485","v":0},{"$f":"All!I485","v":"5.3.9.1.3"},{"$f":"All!J485","v":"5.3.9.1.3: Are employees, agents, and third parties provided with an anonymous reporting channel to report security incidents or violations of security policies or procedures (i.e. 'whistle blowing')?\n"},{"$f":"All!K485","v":0},{"$f":"All!L485","v":0},{"$f":"All!M485","v":"Recommended"},{"$f":"All!N485","v":"Recommended"},{"$f":"All!O485","v":"TechOps"},{"$f":"All!P485","v":0},{"$f":"All!Q485","v":0},{"$f":"All!R485","v":0},{"$f":"All!S485","v":0},{"$f":"All!T485","v":0},{"$f":"All!U485","v":0},{"$f":"All!V485","v":0},{"$f":"All!W485","v":0},{"$f":"All!X485","v":0},{"$f":"All!Y485","v":0},{"$f":"All!Z485","v":0},{"$f":"All!AA485","v":0},{"$f":"All!AB485","v":0},{"$f":"All!AC485","v":0},{"$f":"All!AD485","v":0},{"$f":"All!AE485","v":0},{"$f":"All!AF485","v":0},{"$f":"All!AG485","v":0},{"$f":"All!AH485","v":0},{"$f":"All!AI485","v":0},{"$f":"All!AJ485","v":0},{"$f":"All!AK485","v":0},{"$f":"All!AL485","v":0},{"$f":"All!AM485","v":0},{"$f":"All!AN485","v":0},{"$f":"All!AO485","v":0},{"$f":"All!AP485","v":0},{"$f":"All!AQ485","v":0},{"$f":"All!AR485","v":0},{"$f":"All!AS485","v":0},{"$f":"All!AT485","v":0}]
[null,{"$f":"All!B486","v":"5"},{"$f":"All!C486","v":"5.3"},{"$f":"All!D486","v":"5.3.9"},{"$f":"All!E486","v":"5.3.9: Providers shall develop a process to identify, address, and monitor security incidents and security-related complaints."},{"$f":"All!F486","v":"5.3.9.2"},{"$f":"All!G486","v":"5.3.9.2: RESPONSE TO SECURITY INCIDENTS\nProviders should implement a documented procedure for responding to major security incidents. The response should include the following:\n- collecting evidence as soon as possible after the occurrence;\n- conducting information security forensics analysis;\n- escalation of the incident, as required;\n- ensuring that all response activities are logged;\n- communicating the information security incident to internal and external people or organizations with a need to know;\n- recovering systems and data that may have been damaged by the incident;\n- addressing information security weaknesses found to cause or contribute to the incident; \n- once the incident has been successfully addressed, formally closing and recording it.\n\nIn the event of a major security incident, a nominated point of contact in the provider should report information security incidents as quickly as possible, through appropriate management channels, to relevant authorities. The security incident procedure should specify which security incidents should be reported (e.g. if intrusion has been detected, systemic risks have been created, and/or it is suspected that laws may have been broken) and how to report them promptly."},{"$f":"All!H486","v":"ISO 27002: 2013 \nSec. 16\nSec. 6.1"},{"$f":"All!I486","v":"5.3.9.2.1"},{"$f":"All!J486","v":"5.3.9.2.1: Is there a documented procedure for managing and responding to security incidents (including escalation when required) and fixing the root cause?\n"},{"$f":"All!K486","v":"1) Security incident response plan \n- Check that there is process for managing and responding to security incidents and fixing the root cause.\n- Check that the process is documented.\n- Check that the process includes escalation steps, including when and incident should be escalated and to whom."},{"$f":"All!L486","v":0},{"$f":"All!M486","v":"Standard Required"},{"$f":"All!N486","v":"Required"},{"$f":"All!O486","v":"TechOps"},{"$f":"All!P486","v":0},{"$f":"All!Q486","v":0},{"$f":"All!R486","v":0},{"$f":"All!S486","v":0},{"$f":"All!T486","v":0},{"$f":"All!U486","v":0},{"$f":"All!V486","v":0},{"$f":"All!W486","v":0},{"$f":"All!X486","v":0},{"$f":"All!Y486","v":0},{"$f":"All!Z486","v":0},{"$f":"All!AA486","v":0},{"$f":"All!AB486","v":0},{"$f":"All!AC486","v":0},{"$f":"All!AD486","v":0},{"$f":"All!AE486","v":0},{"$f":"All!AF486","v":0},{"$f":"All!AG486","v":0},{"$f":"All!AH486","v":0},{"$f":"All!AI486","v":0},{"$f":"All!AJ486","v":0},{"$f":"All!AK486","v":0},{"$f":"All!AL486","v":0},{"$f":"All!AM486","v":0},{"$f":"All!AN486","v":0},{"$f":"All!AO486","v":0},{"$f":"All!AP486","v":0},{"$f":"All!AQ486","v":0},{"$f":"All!AR486","v":0},{"$f":"All!AS486","v":0},{"$f":"All!AT486","v":0}]
[null,{"$f":"All!B487","v":"5"},{"$f":"All!C487","v":"5.3"},{"$f":"All!D487","v":"5.3.9"},{"$f":"All!E487","v":""},{"$f":"All!F487","v":"5.3.9.2"},{"$f":"All!G487","v":0},{"$f":"All!H487","v":0},{"$f":"All!I487","v":"5.3.9.2.2"},{"$f":"All!J487","v":"5.3.9.2.2: Does the response to security incidents require collecting evidence as soon as possible after the occurrence and conducting information security forensics analysis?\n"},{"$f":"All!K487","v":0},{"$f":"All!L487","v":0},{"$f":"All!M487","v":"Recommended"},{"$f":"All!N487","v":"Recommended"},{"$f":"All!O487","v":"TechOps"},{"$f":"All!P487","v":0},{"$f":"All!Q487","v":0},{"$f":"All!R487","v":0},{"$f":"All!S487","v":0},{"$f":"All!T487","v":0},{"$f":"All!U487","v":0},{"$f":"All!V487","v":0},{"$f":"All!W487","v":0},{"$f":"All!X487","v":0},{"$f":"All!Y487","v":0},{"$f":"All!Z487","v":0},{"$f":"All!AA487","v":0},{"$f":"All!AB487","v":0},{"$f":"All!AC487","v":0},{"$f":"All!AD487","v":0},{"$f":"All!AE487","v":0},{"$f":"All!AF487","v":0},{"$f":"All!AG487","v":0},{"$f":"All!AH487","v":0},{"$f":"All!AI487","v":0},{"$f":"All!AJ487","v":0},{"$f":"All!AK487","v":0},{"$f":"All!AL487","v":0},{"$f":"All!AM487","v":0},{"$f":"All!AN487","v":0},{"$f":"All!AO487","v":0},{"$f":"All!AP487","v":0},{"$f":"All!AQ487","v":0},{"$f":"All!AR487","v":0},{"$f":"All!AS487","v":0},{"$f":"All!AT487","v":0}]
[null,{"$f":"All!B488","v":"5"},{"$f":"All!C488","v":"5.3"},{"$f":"All!D488","v":"5.3.9"},{"$f":"All!E488","v":""},{"$f":"All!F488","v":"5.3.9.2"},{"$f":"All!G488","v":0},{"$f":"All!H488","v":0},{"$f":"All!I488","v":"5.3.9.2.3"},{"$f":"All!J488","v":"5.3.9.2.3: Are all activities in response to a security incident properly logged?\n"},{"$f":"All!K488","v":0},{"$f":"All!L488","v":0},{"$f":"All!M488","v":"Recommended"},{"$f":"All!N488","v":"Recommended"},{"$f":"All!O488","v":"TechOps"},{"$f":"All!P488","v":0},{"$f":"All!Q488","v":0},{"$f":"All!R488","v":0},{"$f":"All!S488","v":0},{"$f":"All!T488","v":0},{"$f":"All!U488","v":0},{"$f":"All!V488","v":0},{"$f":"All!W488","v":0},{"$f":"All!X488","v":0},{"$f":"All!Y488","v":0},{"$f":"All!Z488","v":0},{"$f":"All!AA488","v":0},{"$f":"All!AB488","v":0},{"$f":"All!AC488","v":0},{"$f":"All!AD488","v":0},{"$f":"All!AE488","v":0},{"$f":"All!AF488","v":0},{"$f":"All!AG488","v":0},{"$f":"All!AH488","v":0},{"$f":"All!AI488","v":0},{"$f":"All!AJ488","v":0},{"$f":"All!AK488","v":0},{"$f":"All!AL488","v":0},{"$f":"All!AM488","v":0},{"$f":"All!AN488","v":0},{"$f":"All!AO488","v":0},{"$f":"All!AP488","v":0},{"$f":"All!AQ488","v":0},{"$f":"All!AR488","v":0},{"$f":"All!AS488","v":0},{"$f":"All!AT488","v":0}]
[null,{"$f":"All!B489","v":"5"},{"$f":"All!C489","v":"5.3"},{"$f":"All!D489","v":"5.3.9"},{"$f":"All!E489","v":""},{"$f":"All!F489","v":"5.3.9.2"},{"$f":"All!G489","v":0},{"$f":"All!H489","v":0},{"$f":"All!I489","v":"5.3.9.2.4"},{"$f":"All!J489","v":"5.3.9.2.4: Does the security and fraud incident procedure include a communications plan that addresses internal and external communications?\n"},{"$f":"All!K489","v":0},{"$f":"All!L489","v":0},{"$f":"All!M489","v":"Recommended"},{"$f":"All!N489","v":"Recommended"},{"$f":"All!O489","v":"TechOps"},{"$f":"All!P489","v":0},{"$f":"All!Q489","v":0},{"$f":"All!R489","v":0},{"$f":"All!S489","v":0},{"$f":"All!T489","v":0},{"$f":"All!U489","v":0},{"$f":"All!V489","v":0},{"$f":"All!W489","v":0},{"$f":"All!X489","v":0},{"$f":"All!Y489","v":0},{"$f":"All!Z489","v":0},{"$f":"All!AA489","v":0},{"$f":"All!AB489","v":0},{"$f":"All!AC489","v":0},{"$f":"All!AD489","v":0},{"$f":"All!AE489","v":0},{"$f":"All!AF489","v":0},{"$f":"All!AG489","v":0},{"$f":"All!AH489","v":0},{"$f":"All!AI489","v":0},{"$f":"All!AJ489","v":0},{"$f":"All!AK489","v":0},{"$f":"All!AL489","v":0},{"$f":"All!AM489","v":0},{"$f":"All!AN489","v":0},{"$f":"All!AO489","v":0},{"$f":"All!AP489","v":0},{"$f":"All!AQ489","v":0},{"$f":"All!AR489","v":0},{"$f":"All!AS489","v":0},{"$f":"All!AT489","v":0}]
[null,{"$f":"All!B490","v":"5"},{"$f":"All!C490","v":"5.1"},{"$f":"All!D490","v":"5.1.1"},{"$f":"All!E490","v":""},{"$f":"All!F490","v":"5.1.1.3"},{"$f":"All!G490","v":0},{"$f":"All!H490","v":0},{"$f":"All!I490","v":"5.3.9.2.5"},{"$f":"All!J490","v":"5.3.9.2.5: Does the information security policy specify which security incidents should be reported to the relevant authorities and how to report them promptly?\n(e.g. if intrusion has been detected, systemic risks have been created, and/or it is suspected that laws may have been broken) \n"},{"$f":"All!K490","v":0},{"$f":"All!L490","v":0},{"$f":"All!M490","v":"Recommended"},{"$f":"All!N490","v":"Recommended"},{"$f":"All!O490","v":"TechOps"},{"$f":"All!P490","v":0},{"$f":"All!Q490","v":0},{"$f":"All!R490","v":0},{"$f":"All!S490","v":0},{"$f":"All!T490","v":0},{"$f":"All!U490","v":0},{"$f":"All!V490","v":0},{"$f":"All!W490","v":0},{"$f":"All!X490","v":0},{"$f":"All!Y490","v":0},{"$f":"All!Z490","v":0},{"$f":"All!AA490","v":0},{"$f":"All!AB490","v":0},{"$f":"All!AC490","v":0},{"$f":"All!AD490","v":0},{"$f":"All!AE490","v":0},{"$f":"All!AF490","v":0},{"$f":"All!AG490","v":0},{"$f":"All!AH490","v":0},{"$f":"All!AI490","v":0},{"$f":"All!AJ490","v":0},{"$f":"All!AK490","v":0},{"$f":"All!AL490","v":0},{"$f":"All!AM490","v":0},{"$f":"All!AN490","v":0},{"$f":"All!AO490","v":0},{"$f":"All!AP490","v":0},{"$f":"All!AQ490","v":0},{"$f":"All!AR490","v":0},{"$f":"All!AS490","v":0},{"$f":"All!AT490","v":0}]
[null,{"$f":"All!B491","v":"6"},{"$f":"All!C491","v":"6.1"},{"$f":"All!D491","v":"6.1.1"},{"$f":"All!E491","v":"6.1.1: Providers shall ensure that customers are provided with clear, prominent, and timely information regarding fees and terms and conditions."},{"$f":"All!F491","v":"6.1.1.1"},{"$f":"All!G491","v":"6.1.1.1: INFORM CUSTOMERS OF ALL FEES AND TERMS & CONDITIONS \nFees: Customers should be informed of all applicable fees, including transaction-based fees, non-transaction-based fees and exceptional fees In-scope services may include the following, depending on the provider.\n1. Transaction-based fees (The fee schedule should make clear the factors that determine the rates, such as transaction size):\n   • Transfers on-net (to registered and unregistered users)\n   • Transfers off-net (e.g. to interoperability partners & banks)\n   • Transfers internationally (IMT)\n   • Deposits/withdrawals at agent or ATM\n   • Bill payments (as payment channel only)\n   • Merchant payments (as payment channel only)\n2. Non-transaction-based fees:\n   • Balance enquiry or mini statement\n   • Recurring charges \n   • PIN change\n   • Loan / savings / insurance offered as part of mobile money\n3. Fees for exceptional events:\n   • Penalty fees (e.g. for non-repayment of loan)\n   • Additional SMS charges for service use while roaming\n\nT&Cs: Customers should be provided with the T&Cs in an accessible manner (e.g. physical copy, or summary on posters) before they start using mobile money services. Good practice is to make a summary of key points from the T&Cs available on posters or handouts.\n\nGood practice is to make key information available to customers via handset menus. This should ideally include fees, key points from T&Cs, FAQs, how to use the service, and how to contact customer support."},{"$f":"All!H491","v":0},{"$f":"All!I491","v":"6.1.1.1.1"},{"$f":"All!J491","v":"6.1.1.1.1: Are customers informed of complete fee schedules before using the service, including transaction-based, non-transaction-based and exceptional fees (e.g. at agents, on leaflets, posters etc.)?\n"},{"$f":"All!K491","v":"1) Point of sale (agent) material or publicity material or handset interface or other mechanism for informing customers of fees (different services could have different mechanisms)\n- Check that customers are informed of all fees before using the service, including the following examples, where applicable:\n1. Transaction-based fees:\n   • Transfers on-net (to registered and unregistered users)\n   • Transfers off-net (e.g. to interoperability partners & banks)\n   • Transfers internationally (IMT)\n   • Deposits/withdrawals at agent or ATM\n   • Bill payments (as payment channel only)\n   • Merchant payments (as payment channel only)\n2. Non-transaction-based fees:\n   • Balance enquiry or mini statement\n   • Recurring charges \n   • PIN change\n   • Loan / savings / insurance offered as part of mobile money\n3. Fees for exceptional events:\n   • Penalty fees (e.g. for non-repayment of loan)\n   • Additional SMS charges for service use while roaming\n\nNote: in-scope services are defined in the Definitions - see \"Mobile Money Services in scope of MMC\"\nNote: fees could be viewed by customer as part of acceptance process when signing up to the service."},{"$f":"All!L491","v":0},{"$f":"All!M491","v":"Urgent Required"},{"$f":"All!N491","v":"Required"},{"$f":"All!O491","v":"BizOps"},{"$f":"All!P491","v":0},{"$f":"All!Q491","v":0},{"$f":"All!R491","v":0},{"$f":"All!S491","v":0},{"$f":"All!T491","v":0},{"$f":"All!U491","v":0},{"$f":"All!V491","v":0},{"$f":"All!W491","v":0},{"$f":"All!X491","v":0},{"$f":"All!Y491","v":0},{"$f":"All!Z491","v":0},{"$f":"All!AA491","v":0},{"$f":"All!AB491","v":0},{"$f":"All!AC491","v":0},{"$f":"All!AD491","v":0},{"$f":"All!AE491","v":0},{"$f":"All!AF491","v":0},{"$f":"All!AG491","v":0},{"$f":"All!AH491","v":0},{"$f":"All!AI491","v":0},{"$f":"All!AJ491","v":0},{"$f":"All!AK491","v":0},{"$f":"All!AL491","v":0},{"$f":"All!AM491","v":0},{"$f":"All!AN491","v":0},{"$f":"All!AO491","v":0},{"$f":"All!AP491","v":0},{"$f":"All!AQ491","v":0},{"$f":"All!AR491","v":0},{"$f":"All!AS491","v":0},{"$f":"All!AT491","v":0}]
[null,{"$f":"All!B492","v":"6"},{"$f":"All!C492","v":"6.1"},{"$f":"All!D492","v":"6.1.1"},{"$f":"All!E492","v":0},{"$f":"All!F492","v":"6.1.1.1"},{"$f":"All!G492","v":0},{"$f":"All!H492","v":0},{"$f":"All!I492","v":"6.1.1.1.2"},{"$f":"All!J492","v":"6.1.1.1.2: Are the T&Cs provided to customers in an accessible manner (e.g. physical copy, or summary on posters) before using the service?\n"},{"$f":"All!K492","v":"Point of sale (agent) material or publicity material or handset interface or other mechanism for informing customers of T&Cs\n- Check the T&Cs are provided to customers in an accessible manner (e.g. physical copy, or summary on posters) before using the service.\nNote: Different services may have separate T&Cs (e.g. loans/savings), which should also be provided to customers before using the service."},{"$f":"All!L492","v":0},{"$f":"All!M492","v":"Urgent Required"},{"$f":"All!N492","v":"Required"},{"$f":"All!O492","v":"BizOps"},{"$f":"All!P492","v":0},{"$f":"All!Q492","v":0},{"$f":"All!R492","v":0},{"$f":"All!S492","v":0},{"$f":"All!T492","v":0},{"$f":"All!U492","v":0},{"$f":"All!V492","v":0},{"$f":"All!W492","v":0},{"$f":"All!X492","v":0},{"$f":"All!Y492","v":0},{"$f":"All!Z492","v":0},{"$f":"All!AA492","v":0},{"$f":"All!AB492","v":0},{"$f":"All!AC492","v":0},{"$f":"All!AD492","v":0},{"$f":"All!AE492","v":0},{"$f":"All!AF492","v":0},{"$f":"All!AG492","v":0},{"$f":"All!AH492","v":0},{"$f":"All!AI492","v":0},{"$f":"All!AJ492","v":0},{"$f":"All!AK492","v":0},{"$f":"All!AL492","v":0},{"$f":"All!AM492","v":0},{"$f":"All!AN492","v":0},{"$f":"All!AO492","v":0},{"$f":"All!AP492","v":0},{"$f":"All!AQ492","v":0},{"$f":"All!AR492","v":0},{"$f":"All!AS492","v":0},{"$f":"All!AT492","v":0}]
[null,{"$f":"All!B493","v":"6"},{"$f":"All!C493","v":"6.1"},{"$f":"All!D493","v":"6.1.1"},{"$f":"All!E493","v":0},{"$f":"All!F493","v":"6.1.1.1"},{"$f":"All!G493","v":0},{"$f":"All!H493","v":0},{"$f":"All!I493","v":"6.1.1.1.3"},{"$f":"All!J493","v":"6.1.1.1.3: Is a summary of key points from the T&Cs clarified to customers on posters or handouts?\n"},{"$f":"All!K493","v":0},{"$f":"All!L493","v":0},{"$f":"All!M493","v":"Recommended"},{"$f":"All!N493","v":"Recommended"},{"$f":"All!O493","v":"BizOps"},{"$f":"All!P493","v":0},{"$f":"All!Q493","v":0},{"$f":"All!R493","v":0},{"$f":"All!S493","v":0},{"$f":"All!T493","v":0},{"$f":"All!U493","v":0},{"$f":"All!V493","v":0},{"$f":"All!W493","v":0},{"$f":"All!X493","v":0},{"$f":"All!Y493","v":0},{"$f":"All!Z493","v":0},{"$f":"All!AA493","v":0},{"$f":"All!AB493","v":0},{"$f":"All!AC493","v":0},{"$f":"All!AD493","v":0},{"$f":"All!AE493","v":0},{"$f":"All!AF493","v":0},{"$f":"All!AG493","v":0},{"$f":"All!AH493","v":0},{"$f":"All!AI493","v":0},{"$f":"All!AJ493","v":0},{"$f":"All!AK493","v":0},{"$f":"All!AL493","v":0},{"$f":"All!AM493","v":0},{"$f":"All!AN493","v":0},{"$f":"All!AO493","v":0},{"$f":"All!AP493","v":0},{"$f":"All!AQ493","v":0},{"$f":"All!AR493","v":0},{"$f":"All!AS493","v":0},{"$f":"All!AT493","v":0}]
[null,{"$f":"All!B494","v":"6"},{"$f":"All!C494","v":"6.1"},{"$f":"All!D494","v":"6.1.1"},{"$f":"All!E494","v":0},{"$f":"All!F494","v":"6.1.1.1"},{"$f":"All!G494","v":0},{"$f":"All!H494","v":0},{"$f":"All!I494","v":"6.1.1.1.4"},{"$f":"All!J494","v":"6.1.1.1.4: Are fees, T&Cs, FAQ, and contact information for customer support available to customers via handset menus?\n"},{"$f":"All!K494","v":0},{"$f":"All!L494","v":0},{"$f":"All!M494","v":"Recommended"},{"$f":"All!N494","v":"Recommended"},{"$f":"All!O494","v":"BizOps"},{"$f":"All!P494","v":0},{"$f":"All!Q494","v":0},{"$f":"All!R494","v":0},{"$f":"All!S494","v":0},{"$f":"All!T494","v":0},{"$f":"All!U494","v":0},{"$f":"All!V494","v":0},{"$f":"All!W494","v":0},{"$f":"All!X494","v":0},{"$f":"All!Y494","v":0},{"$f":"All!Z494","v":0},{"$f":"All!AA494","v":0},{"$f":"All!AB494","v":0},{"$f":"All!AC494","v":0},{"$f":"All!AD494","v":0},{"$f":"All!AE494","v":0},{"$f":"All!AF494","v":0},{"$f":"All!AG494","v":0},{"$f":"All!AH494","v":0},{"$f":"All!AI494","v":0},{"$f":"All!AJ494","v":0},{"$f":"All!AK494","v":0},{"$f":"All!AL494","v":0},{"$f":"All!AM494","v":0},{"$f":"All!AN494","v":0},{"$f":"All!AO494","v":0},{"$f":"All!AP494","v":0},{"$f":"All!AQ494","v":0},{"$f":"All!AR494","v":0},{"$f":"All!AS494","v":0},{"$f":"All!AT494","v":0}]
[null,{"$f":"All!B495","v":"6"},{"$f":"All!C495","v":"6.1"},{"$f":"All!D495","v":"6.1.1"},{"$f":"All!E495","v":0},{"$f":"All!F495","v":"6.1.1.2"},{"$f":"All!G495","v":"6.1.1.2: PROPERLY ORGANISE AND FORMAT TERMS & CONDITIONS AND FEE SCHEDULES\nProviders should ensure that T&Cs and fees schedules are structured such that they reflect proper subject issues, e.g. fees, customer care, consumer rights, processes to follow in case of problems, etc."},{"$f":"All!H495","v":0},{"$f":"All!I495","v":"6.1.1.2.1"},{"$f":"All!J495","v":"6.1.1.2.1: Have the T&Cs and the fee schedule been properly organised and structured under clear and appropriate subject headings?\n"},{"$f":"All!K495","v":0},{"$f":"All!L495","v":0},{"$f":"All!M495","v":"Recommended"},{"$f":"All!N495","v":"Recommended"},{"$f":"All!O495","v":"BizOps"},{"$f":"All!P495","v":0},{"$f":"All!Q495","v":0},{"$f":"All!R495","v":0},{"$f":"All!S495","v":0},{"$f":"All!T495","v":0},{"$f":"All!U495","v":0},{"$f":"All!V495","v":0},{"$f":"All!W495","v":0},{"$f":"All!X495","v":0},{"$f":"All!Y495","v":0},{"$f":"All!Z495","v":0},{"$f":"All!AA495","v":0},{"$f":"All!AB495","v":0},{"$f":"All!AC495","v":0},{"$f":"All!AD495","v":0},{"$f":"All!AE495","v":0},{"$f":"All!AF495","v":0},{"$f":"All!AG495","v":0},{"$f":"All!AH495","v":0},{"$f":"All!AI495","v":0},{"$f":"All!AJ495","v":0},{"$f":"All!AK495","v":0},{"$f":"All!AL495","v":0},{"$f":"All!AM495","v":0},{"$f":"All!AN495","v":0},{"$f":"All!AO495","v":0},{"$f":"All!AP495","v":0},{"$f":"All!AQ495","v":0},{"$f":"All!AR495","v":0},{"$f":"All!AS495","v":0},{"$f":"All!AT495","v":0}]
[null,{"$f":"All!B496","v":"6"},{"$f":"All!C496","v":"6.1"},{"$f":"All!D496","v":"6.1.1"},{"$f":"All!E496","v":0},{"$f":"All!F496","v":"6.1.1.3"},{"$f":"All!G496","v":"6.1.1.3: PUBLISH T&CS IN PLAIN LANGUAGE WHERE POSSIBLE\nProviders should ensure that all T&Cs should be written in plain language as much as possible, unless specific sections and wording are required by law & regulation to be written in a specific legalistic way.\n\nThe information should be presented in ways that the customers can be expected to comprehend, taking due account of the literacy and numeracy constraints of the customer base. For example, providers may wish to use diagrams where feasible."},{"$f":"All!H496","v":0},{"$f":"All!I496","v":"6.1.1.3.1"},{"$f":"All!J496","v":"6.1.1.3.1: Have the T&Cs been written in plain language to the greatest extent possible, while both complying with regulatory requirements and taking due account of the literacy and numeracy constraints of the customer base?\n"},{"$f":"All!K496","v":0},{"$f":"All!L496","v":0},{"$f":"All!M496","v":"Recommended"},{"$f":"All!N496","v":"Recommended"},{"$f":"All!O496","v":"BizOps"},{"$f":"All!P496","v":0},{"$f":"All!Q496","v":0},{"$f":"All!R496","v":0},{"$f":"All!S496","v":0},{"$f":"All!T496","v":0},{"$f":"All!U496","v":0},{"$f":"All!V496","v":0},{"$f":"All!W496","v":0},{"$f":"All!X496","v":0},{"$f":"All!Y496","v":0},{"$f":"All!Z496","v":0},{"$f":"All!AA496","v":0},{"$f":"All!AB496","v":0},{"$f":"All!AC496","v":0},{"$f":"All!AD496","v":0},{"$f":"All!AE496","v":0},{"$f":"All!AF496","v":0},{"$f":"All!AG496","v":0},{"$f":"All!AH496","v":0},{"$f":"All!AI496","v":0},{"$f":"All!AJ496","v":0},{"$f":"All!AK496","v":0},{"$f":"All!AL496","v":0},{"$f":"All!AM496","v":0},{"$f":"All!AN496","v":0},{"$f":"All!AO496","v":0},{"$f":"All!AP496","v":0},{"$f":"All!AQ496","v":0},{"$f":"All!AR496","v":0},{"$f":"All!AS496","v":0},{"$f":"All!AT496","v":0}]
[null,{"$f":"All!B497","v":"6"},{"$f":"All!C497","v":"6.1"},{"$f":"All!D497","v":"6.1.1"},{"$f":"All!E497","v":0},{"$f":"All!F497","v":"6.1.1.4"},{"$f":"All!G497","v":"6.1.1.4: NOTIFY CUSTOMERS IN ADVANCE OF CHANGES TO TERMS & CONDITIONS OR FEE SCHEDULES\nProviders should notify customers of any changes to T&Cs or fee schedules before these take effect, with an appropriate notice period. The notification should be pushed to customers (for example, in the form of an SMS or notification through a mobile app). The method of notifying customer should take account of the significance of the change; major changes to fees and/or T&Cs also should be advertised through methods such as posters and/or media campaigns.\n\nProviders should have internal processes in place to ensure that updated materials are developed and disseminated prior to the implementation of new T&Cs or fee schedules. Materials should be updated at all agents and retail outlets where services are provided."},{"$f":"All!H497","v":0},{"$f":"All!I497","v":"6.1.1.4.1"},{"$f":"All!J497","v":"6.1.1.4.1: Are customers notified of any changes to the T&Cs or fee schedules?\n"},{"$f":"All!K497","v":"1) Process for changes to fees & T&Cs, or customer communication plan\n- Check there is a process for notifying customers of changes to T&Cs and/or fee schedules.\n- Check that the process includes timescales for the customer to be notified with appropriate notice.\n"},{"$f":"All!L497","v":0},{"$f":"All!M497","v":"Standard Required"},{"$f":"All!N497","v":"Required"},{"$f":"All!O497","v":"BizOps"},{"$f":"All!P497","v":0},{"$f":"All!Q497","v":0},{"$f":"All!R497","v":0},{"$f":"All!S497","v":0},{"$f":"All!T497","v":0},{"$f":"All!U497","v":0},{"$f":"All!V497","v":0},{"$f":"All!W497","v":0},{"$f":"All!X497","v":0},{"$f":"All!Y497","v":0},{"$f":"All!Z497","v":0},{"$f":"All!AA497","v":0},{"$f":"All!AB497","v":0},{"$f":"All!AC497","v":0},{"$f":"All!AD497","v":0},{"$f":"All!AE497","v":0},{"$f":"All!AF497","v":0},{"$f":"All!AG497","v":0},{"$f":"All!AH497","v":0},{"$f":"All!AI497","v":0},{"$f":"All!AJ497","v":0},{"$f":"All!AK497","v":0},{"$f":"All!AL497","v":0},{"$f":"All!AM497","v":0},{"$f":"All!AN497","v":0},{"$f":"All!AO497","v":0},{"$f":"All!AP497","v":0},{"$f":"All!AQ497","v":0},{"$f":"All!AR497","v":0},{"$f":"All!AS497","v":0},{"$f":"All!AT497","v":0}]
[null,{"$f":"All!B498","v":"6"},{"$f":"All!C498","v":"6.1"},{"$f":"All!D498","v":"6.1.1"},{"$f":"All!E498","v":0},{"$f":"All!F498","v":"6.1.1.4"},{"$f":"All!G498","v":0},{"$f":"All!H498","v":0},{"$f":"All!I498","v":"6.1.1.4.2"},{"$f":"All!J498","v":"6.1.1.4.2: Are customers given advance notice of any changes to the T&Cs or fee schedules before these changes take effect, with an appropriate notice period?\n"},{"$f":"All!K498","v":0},{"$f":"All!L498","v":0},{"$f":"All!M498","v":"Recommended"},{"$f":"All!N498","v":"Recommended"},{"$f":"All!O498","v":"BizOps"},{"$f":"All!P498","v":0},{"$f":"All!Q498","v":0},{"$f":"All!R498","v":0},{"$f":"All!S498","v":0},{"$f":"All!T498","v":0},{"$f":"All!U498","v":0},{"$f":"All!V498","v":0},{"$f":"All!W498","v":0},{"$f":"All!X498","v":0},{"$f":"All!Y498","v":0},{"$f":"All!Z498","v":0},{"$f":"All!AA498","v":0},{"$f":"All!AB498","v":0},{"$f":"All!AC498","v":0},{"$f":"All!AD498","v":0},{"$f":"All!AE498","v":0},{"$f":"All!AF498","v":0},{"$f":"All!AG498","v":0},{"$f":"All!AH498","v":0},{"$f":"All!AI498","v":0},{"$f":"All!AJ498","v":0},{"$f":"All!AK498","v":0},{"$f":"All!AL498","v":0},{"$f":"All!AM498","v":0},{"$f":"All!AN498","v":0},{"$f":"All!AO498","v":0},{"$f":"All!AP498","v":0},{"$f":"All!AQ498","v":0},{"$f":"All!AR498","v":0},{"$f":"All!AS498","v":0},{"$f":"All!AT498","v":0}]
[null,{"$f":"All!B499","v":"6"},{"$f":"All!C499","v":"6.1"},{"$f":"All!D499","v":"6.1.1"},{"$f":"All!E499","v":0},{"$f":"All!F499","v":"6.1.1.4"},{"$f":"All!G499","v":0},{"$f":"All!H499","v":0},{"$f":"All!I499","v":"6.1.1.4.3"},{"$f":"All!J499","v":"6.1.1.4.3: Are major changes to fees and/or T&Cs also advertised through methods such as posters and/or media campaigns?\n"},{"$f":"All!K499","v":0},{"$f":"All!L499","v":0},{"$f":"All!M499","v":"Recommended"},{"$f":"All!N499","v":"Recommended"},{"$f":"All!O499","v":"BizOps"},{"$f":"All!P499","v":0},{"$f":"All!Q499","v":0},{"$f":"All!R499","v":0},{"$f":"All!S499","v":0},{"$f":"All!T499","v":0},{"$f":"All!U499","v":0},{"$f":"All!V499","v":0},{"$f":"All!W499","v":0},{"$f":"All!X499","v":0},{"$f":"All!Y499","v":0},{"$f":"All!Z499","v":0},{"$f":"All!AA499","v":0},{"$f":"All!AB499","v":0},{"$f":"All!AC499","v":0},{"$f":"All!AD499","v":0},{"$f":"All!AE499","v":0},{"$f":"All!AF499","v":0},{"$f":"All!AG499","v":0},{"$f":"All!AH499","v":0},{"$f":"All!AI499","v":0},{"$f":"All!AJ499","v":0},{"$f":"All!AK499","v":0},{"$f":"All!AL499","v":0},{"$f":"All!AM499","v":0},{"$f":"All!AN499","v":0},{"$f":"All!AO499","v":0},{"$f":"All!AP499","v":0},{"$f":"All!AQ499","v":0},{"$f":"All!AR499","v":0},{"$f":"All!AS499","v":0},{"$f":"All!AT499","v":0}]
[null,{"$f":"All!B500","v":"6"},{"$f":"All!C500","v":"6.1"},{"$f":"All!D500","v":"6.1.1"},{"$f":"All!E500","v":0},{"$f":"All!F500","v":"6.1.1.4"},{"$f":"All!G500","v":0},{"$f":"All!H500","v":0},{"$f":"All!I500","v":"6.1.1.4.4"},{"$f":"All!J500","v":"6.1.1.4.4: Are internal processes in place to ensure that updated T&C or fee schedule materials have been developed and disseminated prior to the implementation of the new T&Cs or fee schedules?\n"},{"$f":"All!K500","v":0},{"$f":"All!L500","v":0},{"$f":"All!M500","v":"Recommended"},{"$f":"All!N500","v":"Recommended"},{"$f":"All!O500","v":"BizOps"},{"$f":"All!P500","v":0},{"$f":"All!Q500","v":0},{"$f":"All!R500","v":0},{"$f":"All!S500","v":0},{"$f":"All!T500","v":0},{"$f":"All!U500","v":0},{"$f":"All!V500","v":0},{"$f":"All!W500","v":0},{"$f":"All!X500","v":0},{"$f":"All!Y500","v":0},{"$f":"All!Z500","v":0},{"$f":"All!AA500","v":0},{"$f":"All!AB500","v":0},{"$f":"All!AC500","v":0},{"$f":"All!AD500","v":0},{"$f":"All!AE500","v":0},{"$f":"All!AF500","v":0},{"$f":"All!AG500","v":0},{"$f":"All!AH500","v":0},{"$f":"All!AI500","v":0},{"$f":"All!AJ500","v":0},{"$f":"All!AK500","v":0},{"$f":"All!AL500","v":0},{"$f":"All!AM500","v":0},{"$f":"All!AN500","v":0},{"$f":"All!AO500","v":0},{"$f":"All!AP500","v":0},{"$f":"All!AQ500","v":0},{"$f":"All!AR500","v":0},{"$f":"All!AS500","v":0},{"$f":"All!AT500","v":0}]
[null,{"$f":"All!B501","v":"6"},{"$f":"All!C501","v":"6.1"},{"$f":"All!D501","v":"6.1.1"},{"$f":"All!E501","v":0},{"$f":"All!F501","v":"6.1.1.5"},{"$f":"All!G501","v":"6.1.1.5: USE OFFICIAL AND LOCAL LANGUAGES\nWhere feasible, information for customers should be available in the official language(s) and/or other commonly spoken languages (including regional languages). All channels through which information is made available (leaflets, posters, media campaigns, handset menus, etc.) should support the customer's language preferences. \n\nNOTE:  It may not be feasible or commercially sustainable to provide information in the official language(s) and/or other commonly spoken languages. Where feasible and commercially sustainable, however, providers should make a reasonable effort to communicate in languages that can be comprehended by people from different regions and with varying levels of education."},{"$f":"All!H501","v":0},{"$f":"All!I501","v":"6.1.1.5.1"},{"$f":"All!J501","v":"6.1.1.5.1: Are fees, T&Cs, FAQs, contact information for customer support, media campaigns, and other relevant information communicated in languages that can be comprehended by people from different regions and with varying levels of education?\n"},{"$f":"All!K501","v":0},{"$f":"All!L501","v":0},{"$f":"All!M501","v":"Recommended"},{"$f":"All!N501","v":"Recommended"},{"$f":"All!O501","v":"BizOps"},{"$f":"All!P501","v":0},{"$f":"All!Q501","v":0},{"$f":"All!R501","v":0},{"$f":"All!S501","v":0},{"$f":"All!T501","v":0},{"$f":"All!U501","v":0},{"$f":"All!V501","v":0},{"$f":"All!W501","v":0},{"$f":"All!X501","v":0},{"$f":"All!Y501","v":0},{"$f":"All!Z501","v":0},{"$f":"All!AA501","v":0},{"$f":"All!AB501","v":0},{"$f":"All!AC501","v":0},{"$f":"All!AD501","v":0},{"$f":"All!AE501","v":0},{"$f":"All!AF501","v":0},{"$f":"All!AG501","v":0},{"$f":"All!AH501","v":0},{"$f":"All!AI501","v":0},{"$f":"All!AJ501","v":0},{"$f":"All!AK501","v":0},{"$f":"All!AL501","v":0},{"$f":"All!AM501","v":0},{"$f":"All!AN501","v":0},{"$f":"All!AO501","v":0},{"$f":"All!AP501","v":0},{"$f":"All!AQ501","v":0},{"$f":"All!AR501","v":0},{"$f":"All!AS501","v":0},{"$f":"All!AT501","v":0}]
[null,{"$f":"All!B502","v":"6"},{"$f":"All!C502","v":"6.1"},{"$f":"All!D502","v":"6.1.1"},{"$f":"All!E502","v":0},{"$f":"All!F502","v":"6.1.1.6"},{"$f":"All!G502","v":"6.1.1.6: INFORM CUSTOMERS OF EXPECTED DOWNTIME AND COMMUNICATE UNEXPECTED OUTAGES\nProviders should inform customers if the mobile money system is experiencing an extended outage or processing delays. \n\nProviders should inform customers of periods of scheduled downtime, particularly for extended outages. Providers should give sufficient notice of scheduled downtime to ensure that customers can plan accordingly.\n\nIn case of a complete outage, users should receive a 'system down' message on their handset and transactions should not accepted. Handset messages should also be used in the case of significant delays. This will help to avoid problems due to a lack of clarity regarding whether a transaction has gone through.\n\nCustomers should be educated on what to do if a transaction confirmation message is not received (for example, the customer could be advised to check their account balance and to contact customer care prior to repeating the transaction).\n"},{"$f":"All!H502","v":0},{"$f":"All!I502","v":"6.1.1.6.1"},{"$f":"All!J502","v":"6.1.1.6.1: Are customers given advance notice of scheduled downtime?\n"},{"$f":"All!K502","v":"1)  Customer communication plan / materal\n- Check there is a process for notifying customers of planned system downtime (e.g. MM system messages or other mechanism)\n- Check that the process includes timescales for the customer to be notified with appropriate notice \n"},{"$f":"All!L502","v":0},{"$f":"All!M502","v":"Standard Required"},{"$f":"All!N502","v":"Required"},{"$f":"All!O502","v":"BizOps"},{"$f":"All!P502","v":0},{"$f":"All!Q502","v":0},{"$f":"All!R502","v":0},{"$f":"All!S502","v":0},{"$f":"All!T502","v":0},{"$f":"All!U502","v":0},{"$f":"All!V502","v":0},{"$f":"All!W502","v":0},{"$f":"All!X502","v":0},{"$f":"All!Y502","v":0},{"$f":"All!Z502","v":0},{"$f":"All!AA502","v":0},{"$f":"All!AB502","v":0},{"$f":"All!AC502","v":0},{"$f":"All!AD502","v":0},{"$f":"All!AE502","v":0},{"$f":"All!AF502","v":0},{"$f":"All!AG502","v":0},{"$f":"All!AH502","v":0},{"$f":"All!AI502","v":0},{"$f":"All!AJ502","v":0},{"$f":"All!AK502","v":0},{"$f":"All!AL502","v":0},{"$f":"All!AM502","v":0},{"$f":"All!AN502","v":0},{"$f":"All!AO502","v":0},{"$f":"All!AP502","v":0},{"$f":"All!AQ502","v":0},{"$f":"All!AR502","v":0},{"$f":"All!AS502","v":0},{"$f":"All!AT502","v":0}]
[null,{"$f":"All!B503","v":"6"},{"$f":"All!C503","v":"6.1"},{"$f":"All!D503","v":"6.1.1"},{"$f":"All!E503","v":0},{"$f":"All!F503","v":"6.1.1.6"},{"$f":"All!G503","v":0},{"$f":"All!H503","v":0},{"$f":"All!I503","v":"6.1.1.6.2"},{"$f":"All!J503","v":"6.1.1.6.2: In the event of an extended unexpected system outage, do users receive a 'system down' message via the handset?\n"},{"$f":"All!K503","v":0},{"$f":"All!L503","v":0},{"$f":"All!M503","v":"Recommended"},{"$f":"All!N503","v":"Recommended"},{"$f":"All!O503","v":"BizOps"},{"$f":"All!P503","v":0},{"$f":"All!Q503","v":0},{"$f":"All!R503","v":0},{"$f":"All!S503","v":0},{"$f":"All!T503","v":0},{"$f":"All!U503","v":0},{"$f":"All!V503","v":0},{"$f":"All!W503","v":0},{"$f":"All!X503","v":0},{"$f":"All!Y503","v":0},{"$f":"All!Z503","v":0},{"$f":"All!AA503","v":0},{"$f":"All!AB503","v":0},{"$f":"All!AC503","v":0},{"$f":"All!AD503","v":0},{"$f":"All!AE503","v":0},{"$f":"All!AF503","v":0},{"$f":"All!AG503","v":0},{"$f":"All!AH503","v":0},{"$f":"All!AI503","v":0},{"$f":"All!AJ503","v":0},{"$f":"All!AK503","v":0},{"$f":"All!AL503","v":0},{"$f":"All!AM503","v":0},{"$f":"All!AN503","v":0},{"$f":"All!AO503","v":0},{"$f":"All!AP503","v":0},{"$f":"All!AQ503","v":0},{"$f":"All!AR503","v":0},{"$f":"All!AS503","v":0},{"$f":"All!AT503","v":0}]
[null,{"$f":"All!B504","v":"6"},{"$f":"All!C504","v":"6.1"},{"$f":"All!D504","v":"6.1.1"},{"$f":"All!E504","v":0},{"$f":"All!F504","v":"6.1.1.6"},{"$f":"All!G504","v":0},{"$f":"All!H504","v":0},{"$f":"All!I504","v":"6.1.1.6.3"},{"$f":"All!J504","v":"6.1.1.6.3: Are customers told what to do if a transaction confirmation is not received, such as check their account balance and contact customer care prior to repeating the transaction?\n"},{"$f":"All!K504","v":0},{"$f":"All!L504","v":0},{"$f":"All!M504","v":"Recommended"},{"$f":"All!N504","v":"Recommended"},{"$f":"All!O504","v":"BizOps"},{"$f":"All!P504","v":0},{"$f":"All!Q504","v":0},{"$f":"All!R504","v":0},{"$f":"All!S504","v":0},{"$f":"All!T504","v":0},{"$f":"All!U504","v":0},{"$f":"All!V504","v":0},{"$f":"All!W504","v":0},{"$f":"All!X504","v":0},{"$f":"All!Y504","v":0},{"$f":"All!Z504","v":0},{"$f":"All!AA504","v":0},{"$f":"All!AB504","v":0},{"$f":"All!AC504","v":0},{"$f":"All!AD504","v":0},{"$f":"All!AE504","v":0},{"$f":"All!AF504","v":0},{"$f":"All!AG504","v":0},{"$f":"All!AH504","v":0},{"$f":"All!AI504","v":0},{"$f":"All!AJ504","v":0},{"$f":"All!AK504","v":0},{"$f":"All!AL504","v":0},{"$f":"All!AM504","v":0},{"$f":"All!AN504","v":0},{"$f":"All!AO504","v":0},{"$f":"All!AP504","v":0},{"$f":"All!AQ504","v":0},{"$f":"All!AR504","v":0},{"$f":"All!AS504","v":0},{"$f":"All!AT504","v":0}]
[null,{"$f":"All!B505","v":"6"},{"$f":"All!C505","v":"6.1"},{"$f":"All!D505","v":"6.1.1"},{"$f":"All!E505","v":0},{"$f":"All!F505","v":"6.1.1.7"},{"$f":"All!G505","v":"6.1.1.7: TRAIN CUSTOMER SERVICE PERSONNEL IN TERMS & CONDITIONS AND THE FEE SCHEDULE\nProviders should ensure that first-level customer service personnel have sufficient access to T&Cs and fee schedules and are trained to provide the information accurately and efficiently to customers.\n\nProviders should ensure that customer service personnel are properly trained to understand changes to T&Cs or fee schedules and the potential impacts of these changes. This training should be completed before any changes are made."},{"$f":"All!H505","v":0},{"$f":"All!I505","v":"6.1.1.7.1"},{"$f":"All!J505","v":"6.1.1.7.1: Do customer service personnel have access to information so that they can provide customers with accurate information on T&Cs and the full set of fees?\n"},{"$f":"All!K505","v":"1) Training plan / material for customer service staff, or customer service process documentation\n- Check that customer care are provided with information on T&Cs and the full set of fees.\n"},{"$f":"All!L505","v":0},{"$f":"All!M505","v":"Standard Required"},{"$f":"All!N505","v":"Required"},{"$f":"All!O505","v":"CustServ"},{"$f":"All!P505","v":0},{"$f":"All!Q505","v":0},{"$f":"All!R505","v":0},{"$f":"All!S505","v":0},{"$f":"All!T505","v":0},{"$f":"All!U505","v":0},{"$f":"All!V505","v":0},{"$f":"All!W505","v":0},{"$f":"All!X505","v":0},{"$f":"All!Y505","v":0},{"$f":"All!Z505","v":0},{"$f":"All!AA505","v":0},{"$f":"All!AB505","v":0},{"$f":"All!AC505","v":0},{"$f":"All!AD505","v":0},{"$f":"All!AE505","v":0},{"$f":"All!AF505","v":0},{"$f":"All!AG505","v":0},{"$f":"All!AH505","v":0},{"$f":"All!AI505","v":0},{"$f":"All!AJ505","v":0},{"$f":"All!AK505","v":0},{"$f":"All!AL505","v":0},{"$f":"All!AM505","v":0},{"$f":"All!AN505","v":0},{"$f":"All!AO505","v":0},{"$f":"All!AP505","v":0},{"$f":"All!AQ505","v":0},{"$f":"All!AR505","v":0},{"$f":"All!AS505","v":0},{"$f":"All!AT505","v":0}]
[null,{"$f":"All!B506","v":"6"},{"$f":"All!C506","v":"6.1"},{"$f":"All!D506","v":"6.1.1"},{"$f":"All!E506","v":0},{"$f":"All!F506","v":"6.1.1.7"},{"$f":"All!G506","v":0},{"$f":"All!H506","v":0},{"$f":"All!I506","v":"6.1.1.7.2"},{"$f":"All!J506","v":"6.1.1.7.2: When changes are made to to T&Cs or fee schedules, are customer service personnel briefed to understand the impact of these changes before the changes are made?\n"},{"$f":"All!K506","v":"1) Training plan / material for customer service staff, or customer service process documentation\n- Check that when changes are made to T&Cs / fees, the process requires a briefing to be given to customer care personnel prior to any changes being made."},{"$f":"All!L506","v":0},{"$f":"All!M506","v":"Standard Required"},{"$f":"All!N506","v":"Required"},{"$f":"All!O506","v":"CustServ"},{"$f":"All!P506","v":0},{"$f":"All!Q506","v":0},{"$f":"All!R506","v":0},{"$f":"All!S506","v":0},{"$f":"All!T506","v":0},{"$f":"All!U506","v":0},{"$f":"All!V506","v":0},{"$f":"All!W506","v":0},{"$f":"All!X506","v":0},{"$f":"All!Y506","v":0},{"$f":"All!Z506","v":0},{"$f":"All!AA506","v":0},{"$f":"All!AB506","v":0},{"$f":"All!AC506","v":0},{"$f":"All!AD506","v":0},{"$f":"All!AE506","v":0},{"$f":"All!AF506","v":0},{"$f":"All!AG506","v":0},{"$f":"All!AH506","v":0},{"$f":"All!AI506","v":0},{"$f":"All!AJ506","v":0},{"$f":"All!AK506","v":0},{"$f":"All!AL506","v":0},{"$f":"All!AM506","v":0},{"$f":"All!AN506","v":0},{"$f":"All!AO506","v":0},{"$f":"All!AP506","v":0},{"$f":"All!AQ506","v":0},{"$f":"All!AR506","v":0},{"$f":"All!AS506","v":0},{"$f":"All!AT506","v":0}]
[null,{"$f":"All!B507","v":"6"},{"$f":"All!C507","v":"6.1"},{"$f":"All!D507","v":"6.1.1"},{"$f":"All!E507","v":0},{"$f":"All!F507","v":"6.1.1.8"},{"$f":"All!G507","v":"6.1.1.8: INFORM CUSTOMERS OF KYC REQUIREMENTS FOR OPENING ACCOUNTS IN DIFFERENT KYC TIERS\nProviders should ensure that customers are made aware of all KYC requirements for opening an account, and where relevant, the KYC requirements for different KYC tiers. These requirements should be included in the T&Cs or be available on request from agents or customer care.\n\nAccount transaction / balance limits for each KYC tier should be made explicit in the T&Cs. If additional KYC verification must be carried out by the provider then this should be explained, especially if the customer's ability to use the service is limited until the KYC verification is completed."},{"$f":"All!H507","v":0},{"$f":"All!I507","v":"6.1.1.8.1"},{"$f":"All!J507","v":"6.1.1.8.1: Are the KYC requirements for opening an account and for different KYC tiers made clear to customers, and particularly at the point of registration?\n"},{"$f":"All!K507","v":"1) Point of sale (agent) material / customer T&Cs / customer service training material / customer communication material\n- Check that registering agents have material to give customers full information on the KYC requirements for opening an account.\n- Check the material includes the KYC requirements for opening an account/different KYC tiers.\n"},{"$f":"All!L507","v":0},{"$f":"All!M507","v":"Urgent Required"},{"$f":"All!N507","v":"Required"},{"$f":"All!O507","v":"BizOps"},{"$f":"All!P507","v":0},{"$f":"All!Q507","v":0},{"$f":"All!R507","v":0},{"$f":"All!S507","v":0},{"$f":"All!T507","v":0},{"$f":"All!U507","v":0},{"$f":"All!V507","v":0},{"$f":"All!W507","v":0},{"$f":"All!X507","v":0},{"$f":"All!Y507","v":0},{"$f":"All!Z507","v":0},{"$f":"All!AA507","v":0},{"$f":"All!AB507","v":0},{"$f":"All!AC507","v":0},{"$f":"All!AD507","v":0},{"$f":"All!AE507","v":0},{"$f":"All!AF507","v":0},{"$f":"All!AG507","v":0},{"$f":"All!AH507","v":0},{"$f":"All!AI507","v":0},{"$f":"All!AJ507","v":0},{"$f":"All!AK507","v":0},{"$f":"All!AL507","v":0},{"$f":"All!AM507","v":0},{"$f":"All!AN507","v":0},{"$f":"All!AO507","v":0},{"$f":"All!AP507","v":0},{"$f":"All!AQ507","v":0},{"$f":"All!AR507","v":0},{"$f":"All!AS507","v":0},{"$f":"All!AT507","v":0}]
[null,{"$f":"All!B508","v":"6"},{"$f":"All!C508","v":"6.1"},{"$f":"All!D508","v":"6.1.1"},{"$f":"All!E508","v":0},{"$f":"All!F508","v":"6.1.1.9"},{"$f":"All!G508","v":"6.1.1.9: HELP CUSTOMERS TO LOCATE AGENTS, SERVICE CENTRES, AND OTHER RETAIL LOCATIONS\nProviders should provide tools to help customers locate agents, service centres, and other retail locations. These tools should be tailored to the needs of the target market.\n\nSuitable resources may include posters, customer care personnel and/or handset menus."},{"$f":"All!H508","v":0},{"$f":"All!I508","v":"6.1.1.9.1"},{"$f":"All!J508","v":"6.1.1.9.1: Are customers provided with tools to locate agents, service centres, and other retail locations (e.g. posters, customer care personnel and/or handset menus)?\n"},{"$f":"All!K508","v":0},{"$f":"All!L508","v":0},{"$f":"All!M508","v":"Recommended"},{"$f":"All!N508","v":"Recommended"},{"$f":"All!O508","v":"BizOps"},{"$f":"All!P508","v":0},{"$f":"All!Q508","v":0},{"$f":"All!R508","v":0},{"$f":"All!S508","v":0},{"$f":"All!T508","v":0},{"$f":"All!U508","v":0},{"$f":"All!V508","v":0},{"$f":"All!W508","v":0},{"$f":"All!X508","v":0},{"$f":"All!Y508","v":0},{"$f":"All!Z508","v":0},{"$f":"All!AA508","v":0},{"$f":"All!AB508","v":0},{"$f":"All!AC508","v":0},{"$f":"All!AD508","v":0},{"$f":"All!AE508","v":0},{"$f":"All!AF508","v":0},{"$f":"All!AG508","v":0},{"$f":"All!AH508","v":0},{"$f":"All!AI508","v":0},{"$f":"All!AJ508","v":0},{"$f":"All!AK508","v":0},{"$f":"All!AL508","v":0},{"$f":"All!AM508","v":0},{"$f":"All!AN508","v":0},{"$f":"All!AO508","v":0},{"$f":"All!AP508","v":0},{"$f":"All!AQ508","v":0},{"$f":"All!AR508","v":0},{"$f":"All!AS508","v":0},{"$f":"All!AT508","v":0}]
[null,{"$f":"All!B509","v":"6"},{"$f":"All!C509","v":"6.2"},{"$f":"All!D509","v":"6.2.1"},{"$f":"All!E509","v":"6.2.1: Providers shall educate customers about how to use mobile money services safely and securely"},{"$f":"All!F509","v":"6.2.1.1"},{"$f":"All!G509","v":"6.2.1.1: EDUCATE CUSTOMERS ON HOW TO USE THE SERVICE SECURELY\nProviders should educate customers on how to use the mobile money service securely. Additional guidance may be required for customers who are not familiar with financial services. Guidance should include at least the following advice:\n- Lock phones with a code and do not leave phones unattended or accessible by other people;\n- Choose security credentials (PIN, password and/or any other credentials) that are difficult to guess;\n- Do not share security credentials with anyone, including customer care agents and mobile money agents;\n- Do not store security credentials in a manner that would allow them to easily be read by another person (e.g., taped to phone, on home screen, etc.); \n- Change security credentials if they may have compromised; and\n- Be aware of the risks of social engineering, such as phishing.\n\nProviders should inform customers that it is their responsibility to safeguard access to their account. Providers should also inform customers of any liability that they may assume for losses resulting from their failure to protect their security credentials and/or safeguard access to their accounts.\n\nPossible delivery channels include electronic content included in welcome messages, verbal explanations from agents or staff during account opening, physical documentation (e.g., brochures), and in the T&Cs."},{"$f":"All!H509","v":0},{"$f":"All!I509","v":"6.2.1.1.1"},{"$f":"All!J509","v":"6.2.1.1.1: Are customers advised not to share security credentials (PIN) with anyone, including customer care agents and mobile money agents?\n"},{"$f":"All!K509","v":"1) Customer communication plan / material\n- Check there is an awareness program for customers informing them not to share security credentials i.e. PIN\n- Check the program includes reference to not sharing PINs with customer care staff and agents."},{"$f":"All!L509","v":0},{"$f":"All!M509","v":"Standard Required"},{"$f":"All!N509","v":"Required"},{"$f":"All!O509","v":"BizOps"},{"$f":"All!P509","v":0},{"$f":"All!Q509","v":0},{"$f":"All!R509","v":0},{"$f":"All!S509","v":0},{"$f":"All!T509","v":0},{"$f":"All!U509","v":0},{"$f":"All!V509","v":0},{"$f":"All!W509","v":0},{"$f":"All!X509","v":0},{"$f":"All!Y509","v":0},{"$f":"All!Z509","v":0},{"$f":"All!AA509","v":0},{"$f":"All!AB509","v":0},{"$f":"All!AC509","v":0},{"$f":"All!AD509","v":0},{"$f":"All!AE509","v":0},{"$f":"All!AF509","v":0},{"$f":"All!AG509","v":0},{"$f":"All!AH509","v":0},{"$f":"All!AI509","v":0},{"$f":"All!AJ509","v":0},{"$f":"All!AK509","v":0},{"$f":"All!AL509","v":0},{"$f":"All!AM509","v":0},{"$f":"All!AN509","v":0},{"$f":"All!AO509","v":0},{"$f":"All!AP509","v":0},{"$f":"All!AQ509","v":0},{"$f":"All!AR509","v":0},{"$f":"All!AS509","v":0},{"$f":"All!AT509","v":0}]
[null,{"$f":"All!B510","v":"6"},{"$f":"All!C510","v":"6.2"},{"$f":"All!D510","v":"6.2.1"},{"$f":"All!E510","v":0},{"$f":"All!F510","v":"6.2.1.1"},{"$f":"All!G510","v":0},{"$f":"All!H510","v":0},{"$f":"All!I510","v":"6.2.1.1.2"},{"$f":"All!J510","v":"6.2.1.1.2: Are customers advised not to store security credentials (PIN) in a manner that would allow them to easily be read by another person (e.g. taped to phone, on home screen, etc.)?\n"},{"$f":"All!K510","v":"1) Customer communication plan / material\n- Check there is an awareness program for customers informing them not to write/store security credentials  (i.e. PIN) in a way that can be easily read by another person."},{"$f":"All!L510","v":0},{"$f":"All!M510","v":"Standard Required"},{"$f":"All!N510","v":"Required"},{"$f":"All!O510","v":"BizOps"},{"$f":"All!P510","v":0},{"$f":"All!Q510","v":0},{"$f":"All!R510","v":0},{"$f":"All!S510","v":0},{"$f":"All!T510","v":0},{"$f":"All!U510","v":0},{"$f":"All!V510","v":0},{"$f":"All!W510","v":0},{"$f":"All!X510","v":0},{"$f":"All!Y510","v":0},{"$f":"All!Z510","v":0},{"$f":"All!AA510","v":0},{"$f":"All!AB510","v":0},{"$f":"All!AC510","v":0},{"$f":"All!AD510","v":0},{"$f":"All!AE510","v":0},{"$f":"All!AF510","v":0},{"$f":"All!AG510","v":0},{"$f":"All!AH510","v":0},{"$f":"All!AI510","v":0},{"$f":"All!AJ510","v":0},{"$f":"All!AK510","v":0},{"$f":"All!AL510","v":0},{"$f":"All!AM510","v":0},{"$f":"All!AN510","v":0},{"$f":"All!AO510","v":0},{"$f":"All!AP510","v":0},{"$f":"All!AQ510","v":0},{"$f":"All!AR510","v":0},{"$f":"All!AS510","v":0},{"$f":"All!AT510","v":0}]
[null,{"$f":"All!B511","v":"6"},{"$f":"All!C511","v":"6.2"},{"$f":"All!D511","v":"6.2.1"},{"$f":"All!E511","v":0},{"$f":"All!F511","v":"6.2.1.1"},{"$f":"All!G511","v":0},{"$f":"All!H511","v":0},{"$f":"All!I511","v":"6.2.1.1.3"},{"$f":"All!J511","v":"6.2.1.1.3: Are customers advised to change security credentials (PIN) if they may be compromised?\n"},{"$f":"All!K511","v":"1) Customer communication plan / material\n- Check there is an awareness program for customers informing them change security credentials (i.e. PIN) if they think they have been compromised."},{"$f":"All!L511","v":0},{"$f":"All!M511","v":"Standard Required"},{"$f":"All!N511","v":"Required"},{"$f":"All!O511","v":"BizOps"},{"$f":"All!P511","v":0},{"$f":"All!Q511","v":0},{"$f":"All!R511","v":0},{"$f":"All!S511","v":0},{"$f":"All!T511","v":0},{"$f":"All!U511","v":0},{"$f":"All!V511","v":0},{"$f":"All!W511","v":0},{"$f":"All!X511","v":0},{"$f":"All!Y511","v":0},{"$f":"All!Z511","v":0},{"$f":"All!AA511","v":0},{"$f":"All!AB511","v":0},{"$f":"All!AC511","v":0},{"$f":"All!AD511","v":0},{"$f":"All!AE511","v":0},{"$f":"All!AF511","v":0},{"$f":"All!AG511","v":0},{"$f":"All!AH511","v":0},{"$f":"All!AI511","v":0},{"$f":"All!AJ511","v":0},{"$f":"All!AK511","v":0},{"$f":"All!AL511","v":0},{"$f":"All!AM511","v":0},{"$f":"All!AN511","v":0},{"$f":"All!AO511","v":0},{"$f":"All!AP511","v":0},{"$f":"All!AQ511","v":0},{"$f":"All!AR511","v":0},{"$f":"All!AS511","v":0},{"$f":"All!AT511","v":0}]
[null,{"$f":"All!B512","v":"6"},{"$f":"All!C512","v":"6.2"},{"$f":"All!D512","v":"6.2.1"},{"$f":"All!E512","v":0},{"$f":"All!F512","v":"6.2.1.1"},{"$f":"All!G512","v":0},{"$f":"All!H512","v":0},{"$f":"All!I512","v":"6.2.1.1.4"},{"$f":"All!J512","v":"6.2.1.1.4: Have customers been informed of any liability that they may assume for losses resulting from their failure to protect their security credentials and/or safeguard access to their accounts.\n"},{"$f":"All!K512","v":"1) Customer communication plan / material \n- Check there are communication materials (or clause in the T&Cs) to tell customers that they could lose money if their PIN is not protected."},{"$f":"All!L512","v":0},{"$f":"All!M512","v":"Standard Required"},{"$f":"All!N512","v":"Required"},{"$f":"All!O512","v":"BizOps"},{"$f":"All!P512","v":0},{"$f":"All!Q512","v":0},{"$f":"All!R512","v":0},{"$f":"All!S512","v":0},{"$f":"All!T512","v":0},{"$f":"All!U512","v":0},{"$f":"All!V512","v":0},{"$f":"All!W512","v":0},{"$f":"All!X512","v":0},{"$f":"All!Y512","v":0},{"$f":"All!Z512","v":0},{"$f":"All!AA512","v":0},{"$f":"All!AB512","v":0},{"$f":"All!AC512","v":0},{"$f":"All!AD512","v":0},{"$f":"All!AE512","v":0},{"$f":"All!AF512","v":0},{"$f":"All!AG512","v":0},{"$f":"All!AH512","v":0},{"$f":"All!AI512","v":0},{"$f":"All!AJ512","v":0},{"$f":"All!AK512","v":0},{"$f":"All!AL512","v":0},{"$f":"All!AM512","v":0},{"$f":"All!AN512","v":0},{"$f":"All!AO512","v":0},{"$f":"All!AP512","v":0},{"$f":"All!AQ512","v":0},{"$f":"All!AR512","v":0},{"$f":"All!AS512","v":0},{"$f":"All!AT512","v":0}]
[null,{"$f":"All!B513","v":"6"},{"$f":"All!C513","v":"6.2"},{"$f":"All!D513","v":"6.2.1"},{"$f":"All!E513","v":0},{"$f":"All!F513","v":"6.2.1.1"},{"$f":"All!G513","v":0},{"$f":"All!H513","v":0},{"$f":"All!I513","v":"6.2.1.1.5"},{"$f":"All!J513","v":"6.2.1.1.5: Are customers advised to lock their phones with a code and not to leave their phone unattended or accessible by other people?\n"},{"$f":"All!K513","v":0},{"$f":"All!L513","v":0},{"$f":"All!M513","v":"Recommended"},{"$f":"All!N513","v":"Recommended"},{"$f":"All!O513","v":"BizOps"},{"$f":"All!P513","v":0},{"$f":"All!Q513","v":0},{"$f":"All!R513","v":0},{"$f":"All!S513","v":0},{"$f":"All!T513","v":0},{"$f":"All!U513","v":0},{"$f":"All!V513","v":0},{"$f":"All!W513","v":0},{"$f":"All!X513","v":0},{"$f":"All!Y513","v":0},{"$f":"All!Z513","v":0},{"$f":"All!AA513","v":0},{"$f":"All!AB513","v":0},{"$f":"All!AC513","v":0},{"$f":"All!AD513","v":0},{"$f":"All!AE513","v":0},{"$f":"All!AF513","v":0},{"$f":"All!AG513","v":0},{"$f":"All!AH513","v":0},{"$f":"All!AI513","v":0},{"$f":"All!AJ513","v":0},{"$f":"All!AK513","v":0},{"$f":"All!AL513","v":0},{"$f":"All!AM513","v":0},{"$f":"All!AN513","v":0},{"$f":"All!AO513","v":0},{"$f":"All!AP513","v":0},{"$f":"All!AQ513","v":0},{"$f":"All!AR513","v":0},{"$f":"All!AS513","v":0},{"$f":"All!AT513","v":0}]
[null,{"$f":"All!B514","v":"6"},{"$f":"All!C514","v":"6.2"},{"$f":"All!D514","v":"6.2.1"},{"$f":"All!E514","v":0},{"$f":"All!F514","v":"6.2.1.1"},{"$f":"All!G514","v":0},{"$f":"All!H514","v":0},{"$f":"All!I514","v":"6.2.1.1.6"},{"$f":"All!J514","v":"6.2.1.1.6: Are customers advised to choose security credentials (PIN, password and/or any other credentials) that are difficult to guess?\n"},{"$f":"All!K514","v":0},{"$f":"All!L514","v":0},{"$f":"All!M514","v":"Recommended"},{"$f":"All!N514","v":"Recommended"},{"$f":"All!O514","v":"BizOps"},{"$f":"All!P514","v":0},{"$f":"All!Q514","v":0},{"$f":"All!R514","v":0},{"$f":"All!S514","v":0},{"$f":"All!T514","v":0},{"$f":"All!U514","v":0},{"$f":"All!V514","v":0},{"$f":"All!W514","v":0},{"$f":"All!X514","v":0},{"$f":"All!Y514","v":0},{"$f":"All!Z514","v":0},{"$f":"All!AA514","v":0},{"$f":"All!AB514","v":0},{"$f":"All!AC514","v":0},{"$f":"All!AD514","v":0},{"$f":"All!AE514","v":0},{"$f":"All!AF514","v":0},{"$f":"All!AG514","v":0},{"$f":"All!AH514","v":0},{"$f":"All!AI514","v":0},{"$f":"All!AJ514","v":0},{"$f":"All!AK514","v":0},{"$f":"All!AL514","v":0},{"$f":"All!AM514","v":0},{"$f":"All!AN514","v":0},{"$f":"All!AO514","v":0},{"$f":"All!AP514","v":0},{"$f":"All!AQ514","v":0},{"$f":"All!AR514","v":0},{"$f":"All!AS514","v":0},{"$f":"All!AT514","v":0}]
[null,{"$f":"All!B515","v":"6"},{"$f":"All!C515","v":"6.2"},{"$f":"All!D515","v":"6.2.1"},{"$f":"All!E515","v":0},{"$f":"All!F515","v":"6.2.1.1"},{"$f":"All!G515","v":0},{"$f":"All!H515","v":0},{"$f":"All!I515","v":"6.2.1.1.7"},{"$f":"All!J515","v":"6.2.1.1.7: Are customers advised to be aware of the risks of social engineering, such as phishing?\n"},{"$f":"All!K515","v":0},{"$f":"All!L515","v":0},{"$f":"All!M515","v":"Recommended"},{"$f":"All!N515","v":"Recommended"},{"$f":"All!O515","v":"BizOps"},{"$f":"All!P515","v":0},{"$f":"All!Q515","v":0},{"$f":"All!R515","v":0},{"$f":"All!S515","v":0},{"$f":"All!T515","v":0},{"$f":"All!U515","v":0},{"$f":"All!V515","v":0},{"$f":"All!W515","v":0},{"$f":"All!X515","v":0},{"$f":"All!Y515","v":0},{"$f":"All!Z515","v":0},{"$f":"All!AA515","v":0},{"$f":"All!AB515","v":0},{"$f":"All!AC515","v":0},{"$f":"All!AD515","v":0},{"$f":"All!AE515","v":0},{"$f":"All!AF515","v":0},{"$f":"All!AG515","v":0},{"$f":"All!AH515","v":0},{"$f":"All!AI515","v":0},{"$f":"All!AJ515","v":0},{"$f":"All!AK515","v":0},{"$f":"All!AL515","v":0},{"$f":"All!AM515","v":0},{"$f":"All!AN515","v":0},{"$f":"All!AO515","v":0},{"$f":"All!AP515","v":0},{"$f":"All!AQ515","v":0},{"$f":"All!AR515","v":0},{"$f":"All!AS515","v":0},{"$f":"All!AT515","v":0}]
[null,{"$f":"All!B516","v":"6"},{"$f":"All!C516","v":"6.2"},{"$f":"All!D516","v":"6.2.1"},{"$f":"All!E516","v":0},{"$f":"All!F516","v":"6.2.1.2"},{"$f":"All!G516","v":"6.2.1.2: INFORM CUSTOMERS OF MOBILE MONEY FRAUD THREATS\nProviders should run information campaigns to inform customers of prevailing fraud threats (e.g. social engineering frauds, identity theft, or unsolicited offers etc.). Information should be distributed:\n- through the media; and/or\n- through direct contact with customers, e.g. by SMS or via agents.\n\nCampaigns should, where possible, be localized to areas or situations where fraudsters are known to be active."},{"$f":"All!H516","v":0},{"$f":"All!I516","v":"6.2.1.2.1"},{"$f":"All!J516","v":"6.2.1.2.1: Are customers informed of prevailing mobile money fraud threats?\n"},{"$f":"All!K516","v":0},{"$f":"All!L516","v":0},{"$f":"All!M516","v":"Recommended"},{"$f":"All!N516","v":"Recommended"},{"$f":"All!O516","v":"BizOps"},{"$f":"All!P516","v":0},{"$f":"All!Q516","v":0},{"$f":"All!R516","v":0},{"$f":"All!S516","v":0},{"$f":"All!T516","v":0},{"$f":"All!U516","v":0},{"$f":"All!V516","v":0},{"$f":"All!W516","v":0},{"$f":"All!X516","v":0},{"$f":"All!Y516","v":0},{"$f":"All!Z516","v":0},{"$f":"All!AA516","v":0},{"$f":"All!AB516","v":0},{"$f":"All!AC516","v":0},{"$f":"All!AD516","v":0},{"$f":"All!AE516","v":0},{"$f":"All!AF516","v":0},{"$f":"All!AG516","v":0},{"$f":"All!AH516","v":0},{"$f":"All!AI516","v":0},{"$f":"All!AJ516","v":0},{"$f":"All!AK516","v":0},{"$f":"All!AL516","v":0},{"$f":"All!AM516","v":0},{"$f":"All!AN516","v":0},{"$f":"All!AO516","v":0},{"$f":"All!AP516","v":0},{"$f":"All!AQ516","v":0},{"$f":"All!AR516","v":0},{"$f":"All!AS516","v":0},{"$f":"All!AT516","v":0}]
[null,{"$f":"All!B517","v":"6"},{"$f":"All!C517","v":"6.2"},{"$f":"All!D517","v":"6.2.1"},{"$f":"All!E517","v":0},{"$f":"All!F517","v":"6.2.1.2"},{"$f":"All!G517","v":0},{"$f":"All!H517","v":0},{"$f":"All!I517","v":"6.2.1.2.2"},{"$f":"All!J517","v":"6.2.1.2.2: Are information campaigns localized to inform customers of threats where fraudsters are known to be active?\n"},{"$f":"All!K517","v":0},{"$f":"All!L517","v":0},{"$f":"All!M517","v":"Recommended"},{"$f":"All!N517","v":"Recommended"},{"$f":"All!O517","v":"BizOps"},{"$f":"All!P517","v":0},{"$f":"All!Q517","v":0},{"$f":"All!R517","v":0},{"$f":"All!S517","v":0},{"$f":"All!T517","v":0},{"$f":"All!U517","v":0},{"$f":"All!V517","v":0},{"$f":"All!W517","v":0},{"$f":"All!X517","v":0},{"$f":"All!Y517","v":0},{"$f":"All!Z517","v":0},{"$f":"All!AA517","v":0},{"$f":"All!AB517","v":0},{"$f":"All!AC517","v":0},{"$f":"All!AD517","v":0},{"$f":"All!AE517","v":0},{"$f":"All!AF517","v":0},{"$f":"All!AG517","v":0},{"$f":"All!AH517","v":0},{"$f":"All!AI517","v":0},{"$f":"All!AJ517","v":0},{"$f":"All!AK517","v":0},{"$f":"All!AL517","v":0},{"$f":"All!AM517","v":0},{"$f":"All!AN517","v":0},{"$f":"All!AO517","v":0},{"$f":"All!AP517","v":0},{"$f":"All!AQ517","v":0},{"$f":"All!AR517","v":0},{"$f":"All!AS517","v":0},{"$f":"All!AT517","v":0}]
[null,{"$f":"All!B518","v":"6"},{"$f":"All!C518","v":"6.2"},{"$f":"All!D518","v":"6.2.1"},{"$f":"All!E518","v":0},{"$f":"All!F518","v":"6.2.1.3"},{"$f":"All!G518","v":"6.2.1.3: EMERGENCY CONTACT DETAILS FOR LOSS OF HANDSET/SIM OR SUSPICIOUS ACTIVITY\nProviders should give customers emergency contact numbers for reporting (i) loss or theft of handset or SIM or (ii) suspicious or potentially illegal activity relating to the mobile money service. Where possible, providers should ensure that contact numbers are toll-free in order to reduce any barriers that customers may face when they need to call the emergency contact service, particularly when reporting loss or theft of a handset or SIM."},{"$f":"All!H518","v":0},{"$f":"All!I518","v":"6.2.1.3.1"},{"$f":"All!J518","v":"6.2.1.3.1: Have contact numbers for reporting (i) loss or theft of handset or SIM or (ii) suspicious or illegal activity relating to the service been provided to customers?\n"},{"$f":"All!K518","v":"1) Customer communication plan / material\n- Check there is a contact number for customers to call in the event of:\na) Loss or theft of handset/SIM\nb) Suspicious or potentially illegal activity relating to the service\n"},{"$f":"All!L518","v":0},{"$f":"All!M518","v":"Standard Required"},{"$f":"All!N518","v":"Required"},{"$f":"All!O518","v":"BizOps"},{"$f":"All!P518","v":0},{"$f":"All!Q518","v":0},{"$f":"All!R518","v":0},{"$f":"All!S518","v":0},{"$f":"All!T518","v":0},{"$f":"All!U518","v":0},{"$f":"All!V518","v":0},{"$f":"All!W518","v":0},{"$f":"All!X518","v":0},{"$f":"All!Y518","v":0},{"$f":"All!Z518","v":0},{"$f":"All!AA518","v":0},{"$f":"All!AB518","v":0},{"$f":"All!AC518","v":0},{"$f":"All!AD518","v":0},{"$f":"All!AE518","v":0},{"$f":"All!AF518","v":0},{"$f":"All!AG518","v":0},{"$f":"All!AH518","v":0},{"$f":"All!AI518","v":0},{"$f":"All!AJ518","v":0},{"$f":"All!AK518","v":0},{"$f":"All!AL518","v":0},{"$f":"All!AM518","v":0},{"$f":"All!AN518","v":0},{"$f":"All!AO518","v":0},{"$f":"All!AP518","v":0},{"$f":"All!AQ518","v":0},{"$f":"All!AR518","v":0},{"$f":"All!AS518","v":0},{"$f":"All!AT518","v":0}]
[null,{"$f":"All!B519","v":"6"},{"$f":"All!C519","v":"6.2"},{"$f":"All!D519","v":"6.2.1"},{"$f":"All!E519","v":0},{"$f":"All!F519","v":"6.2.1.3"},{"$f":"All!G519","v":0},{"$f":"All!H519","v":0},{"$f":"All!I519","v":"6.2.1.3.2"},{"$f":"All!J519","v":"6.2.1.3.2: Has a national toll-free number been provided to customers for reporting lost or stolen handsets or SIMs?\n"},{"$f":"All!K519","v":0},{"$f":"All!L519","v":0},{"$f":"All!M519","v":"Recommended"},{"$f":"All!N519","v":"Recommended"},{"$f":"All!O519","v":"BizOps"},{"$f":"All!P519","v":0},{"$f":"All!Q519","v":0},{"$f":"All!R519","v":0},{"$f":"All!S519","v":0},{"$f":"All!T519","v":0},{"$f":"All!U519","v":0},{"$f":"All!V519","v":0},{"$f":"All!W519","v":0},{"$f":"All!X519","v":0},{"$f":"All!Y519","v":0},{"$f":"All!Z519","v":0},{"$f":"All!AA519","v":0},{"$f":"All!AB519","v":0},{"$f":"All!AC519","v":0},{"$f":"All!AD519","v":0},{"$f":"All!AE519","v":0},{"$f":"All!AF519","v":0},{"$f":"All!AG519","v":0},{"$f":"All!AH519","v":0},{"$f":"All!AI519","v":0},{"$f":"All!AJ519","v":0},{"$f":"All!AK519","v":0},{"$f":"All!AL519","v":0},{"$f":"All!AM519","v":0},{"$f":"All!AN519","v":0},{"$f":"All!AO519","v":0},{"$f":"All!AP519","v":0},{"$f":"All!AQ519","v":0},{"$f":"All!AR519","v":0},{"$f":"All!AS519","v":0},{"$f":"All!AT519","v":0}]
[null,{"$f":"All!B520","v":"6"},{"$f":"All!C520","v":"6.2"},{"$f":"All!D520","v":"6.2.1"},{"$f":"All!E520","v":0},{"$f":"All!F520","v":"6.2.1.4"},{"$f":"All!G520","v":"6.2.1.4: ENTERING SECURITY CREDENTIALS AND RESETTING ACCOUNT ACCESS\nCustomers should be: \n- instructed on how to properly input security credentials;\n- informed of the impact of incorrectly inputting security credentials (e.g., account access locked).\n\nCustomer service personnel should be trained in how to reset PINs securely when a customer's account has been locked because security credentials have been incorrectly input a certain number of times."},{"$f":"All!H520","v":0},{"$f":"All!I520","v":"6.2.1.4.1"},{"$f":"All!J520","v":"6.2.1.4.1: Are customers informed of the impact of incorrectly entering security credentials (e.g. account access locked)?\n"},{"$f":"All!K520","v":"1) Customer communication plan / material\n- Check there is some customer communication to make customers aware of the impact of entering security credentials incorrectly (e.g. T&Cs, system message)."},{"$f":"All!L520","v":0},{"$f":"All!M520","v":"Standard Required"},{"$f":"All!N520","v":"Required"},{"$f":"All!O520","v":"CustServ"},{"$f":"All!P520","v":0},{"$f":"All!Q520","v":0},{"$f":"All!R520","v":0},{"$f":"All!S520","v":0},{"$f":"All!T520","v":0},{"$f":"All!U520","v":0},{"$f":"All!V520","v":0},{"$f":"All!W520","v":0},{"$f":"All!X520","v":0},{"$f":"All!Y520","v":0},{"$f":"All!Z520","v":0},{"$f":"All!AA520","v":0},{"$f":"All!AB520","v":0},{"$f":"All!AC520","v":0},{"$f":"All!AD520","v":0},{"$f":"All!AE520","v":0},{"$f":"All!AF520","v":0},{"$f":"All!AG520","v":0},{"$f":"All!AH520","v":0},{"$f":"All!AI520","v":0},{"$f":"All!AJ520","v":0},{"$f":"All!AK520","v":0},{"$f":"All!AL520","v":0},{"$f":"All!AM520","v":0},{"$f":"All!AN520","v":0},{"$f":"All!AO520","v":0},{"$f":"All!AP520","v":0},{"$f":"All!AQ520","v":0},{"$f":"All!AR520","v":0},{"$f":"All!AS520","v":0},{"$f":"All!AT520","v":0}]
[null,{"$f":"All!B521","v":"6"},{"$f":"All!C521","v":"6.2"},{"$f":"All!D521","v":"6.2.1"},{"$f":"All!E521","v":0},{"$f":"All!F521","v":"6.2.1.4"},{"$f":"All!G521","v":0},{"$f":"All!H521","v":0},{"$f":"All!I521","v":"6.2.1.4.2"},{"$f":"All!J521","v":"6.2.1.4.2: Are customer service staff trained in how to reset PINs securely when a customer's account has been locked?\n"},{"$f":"All!K521","v":"1) Training plan / material for customer service staff, or customer service process documentation\n- Check that customer service personnel are trained in how to reset PINs securely when a customer's account has been locked.\n"},{"$f":"All!L521","v":0},{"$f":"All!M521","v":"Urgent Required"},{"$f":"All!N521","v":"Required"},{"$f":"All!O521","v":"CustServ"},{"$f":"All!P521","v":0},{"$f":"All!Q521","v":0},{"$f":"All!R521","v":0},{"$f":"All!S521","v":0},{"$f":"All!T521","v":0},{"$f":"All!U521","v":0},{"$f":"All!V521","v":0},{"$f":"All!W521","v":0},{"$f":"All!X521","v":0},{"$f":"All!Y521","v":0},{"$f":"All!Z521","v":0},{"$f":"All!AA521","v":0},{"$f":"All!AB521","v":0},{"$f":"All!AC521","v":0},{"$f":"All!AD521","v":0},{"$f":"All!AE521","v":0},{"$f":"All!AF521","v":0},{"$f":"All!AG521","v":0},{"$f":"All!AH521","v":0},{"$f":"All!AI521","v":0},{"$f":"All!AJ521","v":0},{"$f":"All!AK521","v":0},{"$f":"All!AL521","v":0},{"$f":"All!AM521","v":0},{"$f":"All!AN521","v":0},{"$f":"All!AO521","v":0},{"$f":"All!AP521","v":0},{"$f":"All!AQ521","v":0},{"$f":"All!AR521","v":0},{"$f":"All!AS521","v":0},{"$f":"All!AT521","v":0}]
[null,{"$f":"All!B522","v":"6"},{"$f":"All!C522","v":"6.2"},{"$f":"All!D522","v":"6.2.1"},{"$f":"All!E522","v":0},{"$f":"All!F522","v":"6.2.1.5"},{"$f":"All!G522","v":"6.2.1.5: EXERCISING CAUTION WITH CASH-IN/-OUT TRANSACTIONS AT AGENTS\nProviders should advise customers on how to exercise caution when conducting cash-in or cash-out transactions at agent locations. Customers should confirm the following while still at the agent or other cash-in or cash-out location:\n- For cash-in transactions, confirm that the balance on their mobile money account includes the full amount that they have deposited (less any authorised fees); and\n- For cash-out transactions, confirm that they have the correct amount of cash, that the notes appear genuine, and that the remaining balance in their account is correct."},{"$f":"All!H522","v":0},{"$f":"All!I522","v":"6.2.1.5.1"},{"$f":"All!J522","v":"6.2.1.5.1: For cash-in transactions, are customers advised to make sure that their transaction has completed successfully and that the balance on their mobile money account includes the full amount that they have deposited (less any authorised fees)?\n"},{"$f":"All!K522","v":"1) Customer communication plan / material \n- Check there are communication mechanisms or T&Cs to make customers aware that they should:\n     a) Check their cash-in transaction has completed successfully;\n     b) Check the balance on their mobile money account includes the full amount that they have deposited (less any authorised fees)."},{"$f":"All!L522","v":0},{"$f":"All!M522","v":"Urgent Required"},{"$f":"All!N522","v":"Required"},{"$f":"All!O522","v":"BizOps"},{"$f":"All!P522","v":0},{"$f":"All!Q522","v":0},{"$f":"All!R522","v":0},{"$f":"All!S522","v":0},{"$f":"All!T522","v":0},{"$f":"All!U522","v":0},{"$f":"All!V522","v":0},{"$f":"All!W522","v":0},{"$f":"All!X522","v":0},{"$f":"All!Y522","v":0},{"$f":"All!Z522","v":0},{"$f":"All!AA522","v":0},{"$f":"All!AB522","v":0},{"$f":"All!AC522","v":0},{"$f":"All!AD522","v":0},{"$f":"All!AE522","v":0},{"$f":"All!AF522","v":0},{"$f":"All!AG522","v":0},{"$f":"All!AH522","v":0},{"$f":"All!AI522","v":0},{"$f":"All!AJ522","v":0},{"$f":"All!AK522","v":0},{"$f":"All!AL522","v":0},{"$f":"All!AM522","v":0},{"$f":"All!AN522","v":0},{"$f":"All!AO522","v":0},{"$f":"All!AP522","v":0},{"$f":"All!AQ522","v":0},{"$f":"All!AR522","v":0},{"$f":"All!AS522","v":0},{"$f":"All!AT522","v":0}]
[null,{"$f":"All!B523","v":"6"},{"$f":"All!C523","v":"6.2"},{"$f":"All!D523","v":"6.2.1"},{"$f":"All!E523","v":0},{"$f":"All!F523","v":"6.2.1.5"},{"$f":"All!G523","v":0},{"$f":"All!H523","v":0},{"$f":"All!I523","v":"6.2.1.5.2"},{"$f":"All!J523","v":"6.2.1.5.2: For cash-out transactions, are customers advised to make sure that their transaction has completed successfully, that they have the correct amount of cash, and that the remaining balance in their account is correct?\n"},{"$f":"All!K523","v":"1) Customer communication plan / material\n- Check there is a process to make customers aware they should check that their cash-out transaction has:\n     a) Completed successfully, \n     b) That they have the correct amount of cash, \n     c) That the remaining balance in their account is correct"},{"$f":"All!L523","v":0},{"$f":"All!M523","v":"Urgent Required"},{"$f":"All!N523","v":"Required"},{"$f":"All!O523","v":"BizOps"},{"$f":"All!P523","v":0},{"$f":"All!Q523","v":0},{"$f":"All!R523","v":0},{"$f":"All!S523","v":0},{"$f":"All!T523","v":0},{"$f":"All!U523","v":0},{"$f":"All!V523","v":0},{"$f":"All!W523","v":0},{"$f":"All!X523","v":0},{"$f":"All!Y523","v":0},{"$f":"All!Z523","v":0},{"$f":"All!AA523","v":0},{"$f":"All!AB523","v":0},{"$f":"All!AC523","v":0},{"$f":"All!AD523","v":0},{"$f":"All!AE523","v":0},{"$f":"All!AF523","v":0},{"$f":"All!AG523","v":0},{"$f":"All!AH523","v":0},{"$f":"All!AI523","v":0},{"$f":"All!AJ523","v":0},{"$f":"All!AK523","v":0},{"$f":"All!AL523","v":0},{"$f":"All!AM523","v":0},{"$f":"All!AN523","v":0},{"$f":"All!AO523","v":0},{"$f":"All!AP523","v":0},{"$f":"All!AQ523","v":0},{"$f":"All!AR523","v":0},{"$f":"All!AS523","v":0},{"$f":"All!AT523","v":0}]
[null,{"$f":"All!B524","v":"6"},{"$f":"All!C524","v":"6.2"},{"$f":"All!D524","v":"6.2.1"},{"$f":"All!E524","v":0},{"$f":"All!F524","v":"6.2.1.6"},{"$f":"All!G524","v":"6.2.1.6: PROVIDING ALERTS ON SUSPICIOUS ACTIVITY ON CUSTOMER ACCOUNTS\nProviders should provide customers with timely alerts on suspicious activity relating to their accounts. The alerts should be sent electronically to the customer's mobile device, through a direct call from customer care personnel, and/or via other relevant channels. Alerts should contain sufficient information to enable customers to react to the alert by checking their account details (e.g. confirm balance or transactions) and/or taking other steps to safeguard their accounts (e.g. call customer care, visit a service centre or agent, change PIN, etc.).\n\nNote: Providers should not necessarily contact the customer if an investigation is initiated (as this would be 'tipping off'). Detection of suspicious activity is detailed in other toolkits:\n - Money laundering/terrorist financing: 2.4\n - Fraud: 5.3.10"},{"$f":"All!H524","v":0},{"$f":"All!I524","v":"6.2.1.6.1"},{"$f":"All!J524","v":"6.2.1.6.1: Do providers alert customers of suspicious activity in a timely fashion using one or more relevant channels (e.g., electronic communication to the customer's mobile device, direct call from customer care personnel, and/or other channels)?\n"},{"$f":"All!K524","v":0},{"$f":"All!L524","v":0},{"$f":"All!M524","v":"Recommended"},{"$f":"All!N524","v":"Recommended"},{"$f":"All!O524","v":"CustServ"},{"$f":"All!P524","v":0},{"$f":"All!Q524","v":0},{"$f":"All!R524","v":0},{"$f":"All!S524","v":0},{"$f":"All!T524","v":0},{"$f":"All!U524","v":0},{"$f":"All!V524","v":0},{"$f":"All!W524","v":0},{"$f":"All!X524","v":0},{"$f":"All!Y524","v":0},{"$f":"All!Z524","v":0},{"$f":"All!AA524","v":0},{"$f":"All!AB524","v":0},{"$f":"All!AC524","v":0},{"$f":"All!AD524","v":0},{"$f":"All!AE524","v":0},{"$f":"All!AF524","v":0},{"$f":"All!AG524","v":0},{"$f":"All!AH524","v":0},{"$f":"All!AI524","v":0},{"$f":"All!AJ524","v":0},{"$f":"All!AK524","v":0},{"$f":"All!AL524","v":0},{"$f":"All!AM524","v":0},{"$f":"All!AN524","v":0},{"$f":"All!AO524","v":0},{"$f":"All!AP524","v":0},{"$f":"All!AQ524","v":0},{"$f":"All!AR524","v":0},{"$f":"All!AS524","v":0},{"$f":"All!AT524","v":0}]
[null,{"$f":"All!B525","v":"6"},{"$f":"All!C525","v":"6.2"},{"$f":"All!D525","v":"6.2.1"},{"$f":"All!E525","v":0},{"$f":"All!F525","v":"6.2.1.6"},{"$f":"All!G525","v":0},{"$f":"All!H525","v":0},{"$f":"All!I525","v":"6.2.1.6.2"},{"$f":"All!J525","v":"6.2.1.6.2: Do alerts contain sufficient information to enable customers to react to the alert by checking their account details (e.g. confirm balance or transactions) and/or taking other steps to safeguard their accounts (e.g. call customer care, visit a service centre or agent, change PIN, etc.)?\n"},{"$f":"All!K525","v":0},{"$f":"All!L525","v":0},{"$f":"All!M525","v":"Recommended"},{"$f":"All!N525","v":"Recommended"},{"$f":"All!O525","v":"CustServ"},{"$f":"All!P525","v":0},{"$f":"All!Q525","v":0},{"$f":"All!R525","v":0},{"$f":"All!S525","v":0},{"$f":"All!T525","v":0},{"$f":"All!U525","v":0},{"$f":"All!V525","v":0},{"$f":"All!W525","v":0},{"$f":"All!X525","v":0},{"$f":"All!Y525","v":0},{"$f":"All!Z525","v":0},{"$f":"All!AA525","v":0},{"$f":"All!AB525","v":0},{"$f":"All!AC525","v":0},{"$f":"All!AD525","v":0},{"$f":"All!AE525","v":0},{"$f":"All!AF525","v":0},{"$f":"All!AG525","v":0},{"$f":"All!AH525","v":0},{"$f":"All!AI525","v":0},{"$f":"All!AJ525","v":0},{"$f":"All!AK525","v":0},{"$f":"All!AL525","v":0},{"$f":"All!AM525","v":0},{"$f":"All!AN525","v":0},{"$f":"All!AO525","v":0},{"$f":"All!AP525","v":0},{"$f":"All!AQ525","v":0},{"$f":"All!AR525","v":0},{"$f":"All!AS525","v":0},{"$f":"All!AT525","v":0}]
[null,{"$f":"All!B526","v":"6"},{"$f":"All!C526","v":"6.2"},{"$f":"All!D526","v":"6.2.1"},{"$f":"All!E526","v":0},{"$f":"All!F526","v":"6.2.1.7"},{"$f":"All!G526","v":"6.2.1.7: ADVISING CUSTOMERS THAT USER INTERFACE WILL CHANGE\nProviders should inform customers when there is an upcoming major re-design of the user interface, e.g. a new menu hierarchy in the USSD service. Customers should be given advance notice, ideally 15-30 days before the change is made."},{"$f":"All!H526","v":0},{"$f":"All!I526","v":"6.2.1.7.1"},{"$f":"All!J526","v":"6.2.1.7.1: Are customers provided with prior notice when there is an upcoming major re-design of the user interface for the mobile money service?\n"},{"$f":"All!K526","v":0},{"$f":"All!L526","v":0},{"$f":"All!M526","v":"Recommended"},{"$f":"All!N526","v":"Recommended"},{"$f":"All!O526","v":"BizOps"},{"$f":"All!P526","v":0},{"$f":"All!Q526","v":0},{"$f":"All!R526","v":0},{"$f":"All!S526","v":0},{"$f":"All!T526","v":0},{"$f":"All!U526","v":0},{"$f":"All!V526","v":0},{"$f":"All!W526","v":0},{"$f":"All!X526","v":0},{"$f":"All!Y526","v":0},{"$f":"All!Z526","v":0},{"$f":"All!AA526","v":0},{"$f":"All!AB526","v":0},{"$f":"All!AC526","v":0},{"$f":"All!AD526","v":0},{"$f":"All!AE526","v":0},{"$f":"All!AF526","v":0},{"$f":"All!AG526","v":0},{"$f":"All!AH526","v":0},{"$f":"All!AI526","v":0},{"$f":"All!AJ526","v":0},{"$f":"All!AK526","v":0},{"$f":"All!AL526","v":0},{"$f":"All!AM526","v":0},{"$f":"All!AN526","v":0},{"$f":"All!AO526","v":0},{"$f":"All!AP526","v":0},{"$f":"All!AQ526","v":0},{"$f":"All!AR526","v":0},{"$f":"All!AS526","v":0},{"$f":"All!AT526","v":0}]
[null,{"$f":"All!B527","v":"7"},{"$f":"All!C527","v":"7.1"},{"$f":"All!D527","v":"7.1.1"},{"$f":"All!E527","v":"7.1.1: Providers shall develop customer service policies and procedures"},{"$f":"All!F527","v":"7.1.1.1"},{"$f":"All!G527","v":"7.1.1.1: PROCESS FOR CUSTOMERS TO FILE COMPLAINTS\nProviders should document procedures for handling requests and complaints from mobile money customers. Processes should include:\n- acceptance/lodging of complaints/requests;\n- processing/investigation of complaints/requests;\n- measures to reduce the risk of fraud in the customer service process (e.g. vetting customers when they call customer service);\n- resolution of complaints/requests, including scenarios where refunds / reversals are made;\n- an escalation process in case complaints cannot be resolved;\n- external recourse once the complaints and escalation process with the provider has been exhausted;\n- management of the complaints/requests process.\n\nThe policy detail should include all aspects of the complaints management process and should be regularly updated to incorporate feedback from analysis of records of customer complaints. \n\nThe customer service procedures should be made known to all customer service staff."},{"$f":"All!H527","v":0},{"$f":"All!I527","v":"7.1.1.1.1"},{"$f":"All!J527","v":"7.1.1.1.1: Are all procedures for handling requests and complaints from mobile money customers documented?\n"},{"$f":"All!K527","v":"1) Customer service process documentation, \n- Check that it contains at least:\n     a) Customer call logging \n     b) a Closing process\n- Verify that the customer service process is documented satisfactorily \n\nAlso see: \n7.1.1.3 (escalation)\n7.1.1.4 (off-net transactions)\n7.1.1.5 (customer identity verification)"},{"$f":"All!L527","v":0},{"$f":"All!M527","v":"Urgent Required"},{"$f":"All!N527","v":"Required"},{"$f":"All!O527","v":"CustServ"},{"$f":"All!P527","v":0},{"$f":"All!Q527","v":0},{"$f":"All!R527","v":0},{"$f":"All!S527","v":0},{"$f":"All!T527","v":0},{"$f":"All!U527","v":0},{"$f":"All!V527","v":0},{"$f":"All!W527","v":0},{"$f":"All!X527","v":0},{"$f":"All!Y527","v":0},{"$f":"All!Z527","v":0},{"$f":"All!AA527","v":0},{"$f":"All!AB527","v":0},{"$f":"All!AC527","v":0},{"$f":"All!AD527","v":0},{"$f":"All!AE527","v":0},{"$f":"All!AF527","v":0},{"$f":"All!AG527","v":0},{"$f":"All!AH527","v":0},{"$f":"All!AI527","v":0},{"$f":"All!AJ527","v":0},{"$f":"All!AK527","v":0},{"$f":"All!AL527","v":0},{"$f":"All!AM527","v":0},{"$f":"All!AN527","v":0},{"$f":"All!AO527","v":0},{"$f":"All!AP527","v":0},{"$f":"All!AQ527","v":0},{"$f":"All!AR527","v":0},{"$f":"All!AS527","v":0},{"$f":"All!AT527","v":0}]
[null,{"$f":"All!B528","v":"7"},{"$f":"All!C528","v":"7.1"},{"$f":"All!D528","v":"7.1.1"},{"$f":"All!E528","v":""},{"$f":"All!F528","v":"7.1.1.2"},{"$f":"All!G528","v":"7.1.1.2: REFERENCE NUMBER AND RESOLUTION TIME FOR COMPLAINTS\nComplaints lodged by customers should be given reference/ticket numbers. Tickets would normally be system-generated (e.g. by CRM or mobile money system).\n\nThe complaints management policy should define timeframes for both the investigation and the resolution of complaints. Timeframes should be tailored to the type of complaint and should consider both the urgency of the complaint and the procedures required to resolve it. For example, timeframes may be longer for complaints involving off-net transactions (see 7.1.1.6 below).\n\nIt is good practice for the system to guide customer service staff through the process and monitor response times against the SLA. Staff can be alerted before the response SLA is breached."},{"$f":"All!H528","v":0},{"$f":"All!I528","v":"7.1.1.2.1"},{"$f":"All!J528","v":"7.1.1.2.1: When a complaint is received by the mobile money provider, are customers provided with reference/ticket numbers for their complaint?\n"},{"$f":"All!K528","v":0},{"$f":"All!L528","v":0},{"$f":"All!M528","v":"Recommended"},{"$f":"All!N528","v":"Recommended"},{"$f":"All!O528","v":"CustServ"},{"$f":"All!P528","v":0},{"$f":"All!Q528","v":0},{"$f":"All!R528","v":0},{"$f":"All!S528","v":0},{"$f":"All!T528","v":0},{"$f":"All!U528","v":0},{"$f":"All!V528","v":0},{"$f":"All!W528","v":0},{"$f":"All!X528","v":0},{"$f":"All!Y528","v":0},{"$f":"All!Z528","v":0},{"$f":"All!AA528","v":0},{"$f":"All!AB528","v":0},{"$f":"All!AC528","v":0},{"$f":"All!AD528","v":0},{"$f":"All!AE528","v":0},{"$f":"All!AF528","v":0},{"$f":"All!AG528","v":0},{"$f":"All!AH528","v":0},{"$f":"All!AI528","v":0},{"$f":"All!AJ528","v":0},{"$f":"All!AK528","v":0},{"$f":"All!AL528","v":0},{"$f":"All!AM528","v":0},{"$f":"All!AN528","v":0},{"$f":"All!AO528","v":0},{"$f":"All!AP528","v":0},{"$f":"All!AQ528","v":0},{"$f":"All!AR528","v":0},{"$f":"All!AS528","v":0},{"$f":"All!AT528","v":0}]
[null,{"$f":"All!B529","v":"7"},{"$f":"All!C529","v":"7.1"},{"$f":"All!D529","v":"7.1.1"},{"$f":"All!E529","v":""},{"$f":"All!F529","v":"7.1.1.2"},{"$f":"All!G529","v":0},{"$f":"All!H529","v":0},{"$f":"All!I529","v":"7.1.1.2.2"},{"$f":"All!J529","v":"7.1.1.2.2: Are complaint resolution timeframes (which may be tailored to the type and urgency of complaint) defined and the customer informed of expected complaint resolution time?\n"},{"$f":"All!K529","v":0},{"$f":"All!L529","v":0},{"$f":"All!M529","v":"Recommended"},{"$f":"All!N529","v":"Recommended"},{"$f":"All!O529","v":"CustServ"},{"$f":"All!P529","v":0},{"$f":"All!Q529","v":0},{"$f":"All!R529","v":0},{"$f":"All!S529","v":0},{"$f":"All!T529","v":0},{"$f":"All!U529","v":0},{"$f":"All!V529","v":0},{"$f":"All!W529","v":0},{"$f":"All!X529","v":0},{"$f":"All!Y529","v":0},{"$f":"All!Z529","v":0},{"$f":"All!AA529","v":0},{"$f":"All!AB529","v":0},{"$f":"All!AC529","v":0},{"$f":"All!AD529","v":0},{"$f":"All!AE529","v":0},{"$f":"All!AF529","v":0},{"$f":"All!AG529","v":0},{"$f":"All!AH529","v":0},{"$f":"All!AI529","v":0},{"$f":"All!AJ529","v":0},{"$f":"All!AK529","v":0},{"$f":"All!AL529","v":0},{"$f":"All!AM529","v":0},{"$f":"All!AN529","v":0},{"$f":"All!AO529","v":0},{"$f":"All!AP529","v":0},{"$f":"All!AQ529","v":0},{"$f":"All!AR529","v":0},{"$f":"All!AS529","v":0},{"$f":"All!AT529","v":0}]
[null,{"$f":"All!B530","v":"7"},{"$f":"All!C530","v":"7.1"},{"$f":"All!D530","v":"7.1.1"},{"$f":"All!E530","v":""},{"$f":"All!F530","v":"7.1.1.3"},{"$f":"All!G530","v":"7.1.1.3: CUSTOMER COMPLAINTS ESCALATION PROCESS\nProviders should offer a complaints escalation process, which may be invoked if customers are not satisfied with the initial outcome of the complaints process.\n\nStaff should be allocated to support the escalation process and trained accordingly."},{"$f":"All!H530","v":0},{"$f":"All!I530","v":"7.1.1.3.1"},{"$f":"All!J530","v":"7.1.1.3.1: Has the provider defined a complaints escalation process, which may be invoked if customers are not satisfied with the initial outcome of the complaints process?\n"},{"$f":"All!K530","v":"1) Customer service process documentation, containing at least:\n-  Verify that the customer service process documentation contains at least the customer call escalation process to second-level support or call centre supervisor."},{"$f":"All!L530","v":0},{"$f":"All!M530","v":"Urgent Required"},{"$f":"All!N530","v":"Required"},{"$f":"All!O530","v":"CustServ"},{"$f":"All!P530","v":0},{"$f":"All!Q530","v":0},{"$f":"All!R530","v":0},{"$f":"All!S530","v":0},{"$f":"All!T530","v":0},{"$f":"All!U530","v":0},{"$f":"All!V530","v":0},{"$f":"All!W530","v":0},{"$f":"All!X530","v":0},{"$f":"All!Y530","v":0},{"$f":"All!Z530","v":0},{"$f":"All!AA530","v":0},{"$f":"All!AB530","v":0},{"$f":"All!AC530","v":0},{"$f":"All!AD530","v":0},{"$f":"All!AE530","v":0},{"$f":"All!AF530","v":0},{"$f":"All!AG530","v":0},{"$f":"All!AH530","v":0},{"$f":"All!AI530","v":0},{"$f":"All!AJ530","v":0},{"$f":"All!AK530","v":0},{"$f":"All!AL530","v":0},{"$f":"All!AM530","v":0},{"$f":"All!AN530","v":0},{"$f":"All!AO530","v":0},{"$f":"All!AP530","v":0},{"$f":"All!AQ530","v":0},{"$f":"All!AR530","v":0},{"$f":"All!AS530","v":0},{"$f":"All!AT530","v":0}]
[null,{"$f":"All!B531","v":"7"},{"$f":"All!C531","v":"7.1"},{"$f":"All!D531","v":"7.1.1"},{"$f":"All!E531","v":""},{"$f":"All!F531","v":"7.1.1.4"},{"$f":"All!G531","v":"7.1.1.4: CUSTOMER COMPLAINTS INVOLVING OFF-NET TRANSACTIONS\nThe provider should always be the single point for its customers to raise complaints when they send transactions to banks / other providers (domestic and international). \n\nATM complaints may be more efficiently handled by the ATM provider. However, the provider must efficiently support customers who call them instead of the ATM provider.\n\nA service level agreement and procedure should be agreed with each financial ecosystem partner for resolving customer complaints related to transactions between the provider and partner.\n\nProviders should ensure that, where possible, the process for resolving complaints regarding off-net transactions should be identical (from the customer's perspective) to the process for resolving complaints regarding on-net transactions; in addition, providers should make every effort to keep the service level similar (with the understanding that timeframes for resolution may be significantly longer). \n\nWhere any complaint about an off-net transaction is raised, providers should communicate to the customer:\n- The expected timeframe for resolution of the issue;\n- Potential outcomes;\n- Any limitations on the scope of resolution due to its being an off-net transaction (for example, some off-net transactions may be irreversible)."},{"$f":"All!H531","v":0},{"$f":"All!I531","v":"7.1.1.4.1"},{"$f":"All!J531","v":"7.1.1.4.1: Is the provider always the single point for its customers to raise complaints when they send transactions to banks / other providers (domestic and international)?\n"},{"$f":"All!K531","v":"1) Customer service process documentation, containing at least:\n -  Resolution process for transactions to banks or other providers\n- Verify from the customer service process documentation that the provider is always the single point of contact for its customers when they send transactions to banks / other providers (domestic and international).\n"},{"$f":"All!L531","v":0},{"$f":"All!M531","v":"Urgent Required"},{"$f":"All!N531","v":"Required"},{"$f":"All!O531","v":"CustServ"},{"$f":"All!P531","v":0},{"$f":"All!Q531","v":0},{"$f":"All!R531","v":0},{"$f":"All!S531","v":0},{"$f":"All!T531","v":0},{"$f":"All!U531","v":0},{"$f":"All!V531","v":0},{"$f":"All!W531","v":0},{"$f":"All!X531","v":0},{"$f":"All!Y531","v":0},{"$f":"All!Z531","v":0},{"$f":"All!AA531","v":0},{"$f":"All!AB531","v":0},{"$f":"All!AC531","v":0},{"$f":"All!AD531","v":0},{"$f":"All!AE531","v":0},{"$f":"All!AF531","v":0},{"$f":"All!AG531","v":0},{"$f":"All!AH531","v":0},{"$f":"All!AI531","v":0},{"$f":"All!AJ531","v":0},{"$f":"All!AK531","v":0},{"$f":"All!AL531","v":0},{"$f":"All!AM531","v":0},{"$f":"All!AN531","v":0},{"$f":"All!AO531","v":0},{"$f":"All!AP531","v":0},{"$f":"All!AQ531","v":0},{"$f":"All!AR531","v":0},{"$f":"All!AS531","v":0},{"$f":"All!AT531","v":0}]
[null,{"$f":"All!B532","v":"7"},{"$f":"All!C532","v":"7.1"},{"$f":"All!D532","v":"7.1.1"},{"$f":"All!E532","v":""},{"$f":"All!F532","v":"7.1.1.4"},{"$f":"All!G532","v":0},{"$f":"All!H532","v":0},{"$f":"All!I532","v":"7.1.1.4.2"},{"$f":"All!J532","v":"7.1.1.4.2: Are reciprocal mechanisms in place with each financial ecosystem partner to resolve issues raised by customers related to off-net transactions?\n"},{"$f":"All!K532","v":0},{"$f":"All!L532","v":0},{"$f":"All!M532","v":"Recommended"},{"$f":"All!N532","v":"Recommended"},{"$f":"All!O532","v":"CustServ"},{"$f":"All!P532","v":0},{"$f":"All!Q532","v":0},{"$f":"All!R532","v":0},{"$f":"All!S532","v":0},{"$f":"All!T532","v":0},{"$f":"All!U532","v":0},{"$f":"All!V532","v":0},{"$f":"All!W532","v":0},{"$f":"All!X532","v":0},{"$f":"All!Y532","v":0},{"$f":"All!Z532","v":0},{"$f":"All!AA532","v":0},{"$f":"All!AB532","v":0},{"$f":"All!AC532","v":0},{"$f":"All!AD532","v":0},{"$f":"All!AE532","v":0},{"$f":"All!AF532","v":0},{"$f":"All!AG532","v":0},{"$f":"All!AH532","v":0},{"$f":"All!AI532","v":0},{"$f":"All!AJ532","v":0},{"$f":"All!AK532","v":0},{"$f":"All!AL532","v":0},{"$f":"All!AM532","v":0},{"$f":"All!AN532","v":0},{"$f":"All!AO532","v":0},{"$f":"All!AP532","v":0},{"$f":"All!AQ532","v":0},{"$f":"All!AR532","v":0},{"$f":"All!AS532","v":0},{"$f":"All!AT532","v":0}]
[null,{"$f":"All!B533","v":"7"},{"$f":"All!C533","v":"7.1"},{"$f":"All!D533","v":"7.1.1"},{"$f":"All!E533","v":""},{"$f":"All!F533","v":"7.1.1.4"},{"$f":"All!G533","v":0},{"$f":"All!H533","v":0},{"$f":"All!I533","v":"7.1.1.4.3"},{"$f":"All!J533","v":"7.1.1.4.3: Is a service level agreement in place with each financial ecosystem partner for responding to and resolving customer complaints?\n"},{"$f":"All!K533","v":0},{"$f":"All!L533","v":0},{"$f":"All!M533","v":"Recommended"},{"$f":"All!N533","v":"Recommended"},{"$f":"All!O533","v":"CustServ"},{"$f":"All!P533","v":0},{"$f":"All!Q533","v":0},{"$f":"All!R533","v":0},{"$f":"All!S533","v":0},{"$f":"All!T533","v":0},{"$f":"All!U533","v":0},{"$f":"All!V533","v":0},{"$f":"All!W533","v":0},{"$f":"All!X533","v":0},{"$f":"All!Y533","v":0},{"$f":"All!Z533","v":0},{"$f":"All!AA533","v":0},{"$f":"All!AB533","v":0},{"$f":"All!AC533","v":0},{"$f":"All!AD533","v":0},{"$f":"All!AE533","v":0},{"$f":"All!AF533","v":0},{"$f":"All!AG533","v":0},{"$f":"All!AH533","v":0},{"$f":"All!AI533","v":0},{"$f":"All!AJ533","v":0},{"$f":"All!AK533","v":0},{"$f":"All!AL533","v":0},{"$f":"All!AM533","v":0},{"$f":"All!AN533","v":0},{"$f":"All!AO533","v":0},{"$f":"All!AP533","v":0},{"$f":"All!AQ533","v":0},{"$f":"All!AR533","v":0},{"$f":"All!AS533","v":0},{"$f":"All!AT533","v":0}]
[null,{"$f":"All!B534","v":"7"},{"$f":"All!C534","v":"7.1"},{"$f":"All!D534","v":"7.1.1"},{"$f":"All!E534","v":""},{"$f":"All!F534","v":"7.1.1.4"},{"$f":"All!G534","v":0},{"$f":"All!H534","v":0},{"$f":"All!I534","v":"7.1.1.4.4"},{"$f":"All!J534","v":"7.1.1.4.4: Is the process for resolving complaints regarding off-net transactions identical (from the customer's perspective) to the process for resolving complaints regarding on-net transactions (with the understanding that timeframes for resolution may be significantly longer)?\n"},{"$f":"All!K534","v":0},{"$f":"All!L534","v":0},{"$f":"All!M534","v":"Recommended"},{"$f":"All!N534","v":"Recommended"},{"$f":"All!O534","v":"CustServ"},{"$f":"All!P534","v":0},{"$f":"All!Q534","v":0},{"$f":"All!R534","v":0},{"$f":"All!S534","v":0},{"$f":"All!T534","v":0},{"$f":"All!U534","v":0},{"$f":"All!V534","v":0},{"$f":"All!W534","v":0},{"$f":"All!X534","v":0},{"$f":"All!Y534","v":0},{"$f":"All!Z534","v":0},{"$f":"All!AA534","v":0},{"$f":"All!AB534","v":0},{"$f":"All!AC534","v":0},{"$f":"All!AD534","v":0},{"$f":"All!AE534","v":0},{"$f":"All!AF534","v":0},{"$f":"All!AG534","v":0},{"$f":"All!AH534","v":0},{"$f":"All!AI534","v":0},{"$f":"All!AJ534","v":0},{"$f":"All!AK534","v":0},{"$f":"All!AL534","v":0},{"$f":"All!AM534","v":0},{"$f":"All!AN534","v":0},{"$f":"All!AO534","v":0},{"$f":"All!AP534","v":0},{"$f":"All!AQ534","v":0},{"$f":"All!AR534","v":0},{"$f":"All!AS534","v":0},{"$f":"All!AT534","v":0}]
[null,{"$f":"All!B535","v":"7"},{"$f":"All!C535","v":"7.1"},{"$f":"All!D535","v":"7.1.1"},{"$f":"All!E535","v":""},{"$f":"All!F535","v":"7.1.1.4"},{"$f":"All!G535","v":0},{"$f":"All!H535","v":0},{"$f":"All!I535","v":"7.1.1.4.5"},{"$f":"All!J535","v":"7.1.1.4.5: When any complaint about an off-net transaction is raised, are customers notified of the expected timeframe for resolution of the issue, potential outcomes, and any limitations on the scope of resolution due to its being an off-net transaction?\n"},{"$f":"All!K535","v":0},{"$f":"All!L535","v":0},{"$f":"All!M535","v":"Recommended"},{"$f":"All!N535","v":"Recommended"},{"$f":"All!O535","v":"CustServ"},{"$f":"All!P535","v":0},{"$f":"All!Q535","v":0},{"$f":"All!R535","v":0},{"$f":"All!S535","v":0},{"$f":"All!T535","v":0},{"$f":"All!U535","v":0},{"$f":"All!V535","v":0},{"$f":"All!W535","v":0},{"$f":"All!X535","v":0},{"$f":"All!Y535","v":0},{"$f":"All!Z535","v":0},{"$f":"All!AA535","v":0},{"$f":"All!AB535","v":0},{"$f":"All!AC535","v":0},{"$f":"All!AD535","v":0},{"$f":"All!AE535","v":0},{"$f":"All!AF535","v":0},{"$f":"All!AG535","v":0},{"$f":"All!AH535","v":0},{"$f":"All!AI535","v":0},{"$f":"All!AJ535","v":0},{"$f":"All!AK535","v":0},{"$f":"All!AL535","v":0},{"$f":"All!AM535","v":0},{"$f":"All!AN535","v":0},{"$f":"All!AO535","v":0},{"$f":"All!AP535","v":0},{"$f":"All!AQ535","v":0},{"$f":"All!AR535","v":0},{"$f":"All!AS535","v":0},{"$f":"All!AT535","v":0}]
[null,{"$f":"All!B536","v":"7"},{"$f":"All!C536","v":"7.1"},{"$f":"All!D536","v":"7.1.1"},{"$f":"All!E536","v":""},{"$f":"All!F536","v":"7.1.1.5"},{"$f":"All!G536","v":"7.1.1.5: VERIFICATION OF CUSTOMER IDENTITY\nWhen customers call to lodge complaints, their identity should be verified to mitigate fraud risk. Support staff should be trained to verify customer identity properly (e.g. with a secret word or other information that only the customer should know) and to use alternate processes to verify customers who are unable to provide the requested information to verify identity."},{"$f":"All!H536","v":0},{"$f":"All!I536","v":"7.1.1.5.1"},{"$f":"All!J536","v":"7.1.1.5.1: Are customer support staff trained to verify the identity of customers who make complaints using a secret word or other information that only the customer should know?\n"},{"$f":"All!K536","v":"1. Customer service process documentation \n - Check the customer service process documentation contains at least the customer call verification procedure.\n- Check the customer verification procedure uses a secret word or other information that only the customer should know\n\n2. Customer service training documentation\n- Confirm that the training documentation covers at least customer verification procedure"},{"$f":"All!L536","v":0},{"$f":"All!M536","v":"Urgent Required"},{"$f":"All!N536","v":"Required"},{"$f":"All!O536","v":"CustServ"},{"$f":"All!P536","v":0},{"$f":"All!Q536","v":0},{"$f":"All!R536","v":0},{"$f":"All!S536","v":0},{"$f":"All!T536","v":0},{"$f":"All!U536","v":0},{"$f":"All!V536","v":0},{"$f":"All!W536","v":0},{"$f":"All!X536","v":0},{"$f":"All!Y536","v":0},{"$f":"All!Z536","v":0},{"$f":"All!AA536","v":0},{"$f":"All!AB536","v":0},{"$f":"All!AC536","v":0},{"$f":"All!AD536","v":0},{"$f":"All!AE536","v":0},{"$f":"All!AF536","v":0},{"$f":"All!AG536","v":0},{"$f":"All!AH536","v":0},{"$f":"All!AI536","v":0},{"$f":"All!AJ536","v":0},{"$f":"All!AK536","v":0},{"$f":"All!AL536","v":0},{"$f":"All!AM536","v":0},{"$f":"All!AN536","v":0},{"$f":"All!AO536","v":0},{"$f":"All!AP536","v":0},{"$f":"All!AQ536","v":0},{"$f":"All!AR536","v":0},{"$f":"All!AS536","v":0},{"$f":"All!AT536","v":0}]
[null,{"$f":"All!B537","v":"7"},{"$f":"All!C537","v":"7.1"},{"$f":"All!D537","v":"7.1.1"},{"$f":"All!E537","v":""},{"$f":"All!F537","v":"7.1.1.5"},{"$f":"All!G537","v":0},{"$f":"All!H537","v":0},{"$f":"All!I537","v":"7.1.1.5.2"},{"$f":"All!J537","v":"7.1.1.5.2: Are alternate processes established to verify customer identity if the customer is unable to provide the requested information to verify identity?\n"},{"$f":"All!K537","v":0},{"$f":"All!L537","v":0},{"$f":"All!M537","v":"Recommended"},{"$f":"All!N537","v":"Recommended"},{"$f":"All!O537","v":"CustServ"},{"$f":"All!P537","v":0},{"$f":"All!Q537","v":0},{"$f":"All!R537","v":0},{"$f":"All!S537","v":0},{"$f":"All!T537","v":0},{"$f":"All!U537","v":0},{"$f":"All!V537","v":0},{"$f":"All!W537","v":0},{"$f":"All!X537","v":0},{"$f":"All!Y537","v":0},{"$f":"All!Z537","v":0},{"$f":"All!AA537","v":0},{"$f":"All!AB537","v":0},{"$f":"All!AC537","v":0},{"$f":"All!AD537","v":0},{"$f":"All!AE537","v":0},{"$f":"All!AF537","v":0},{"$f":"All!AG537","v":0},{"$f":"All!AH537","v":0},{"$f":"All!AI537","v":0},{"$f":"All!AJ537","v":0},{"$f":"All!AK537","v":0},{"$f":"All!AL537","v":0},{"$f":"All!AM537","v":0},{"$f":"All!AN537","v":0},{"$f":"All!AO537","v":0},{"$f":"All!AP537","v":0},{"$f":"All!AQ537","v":0},{"$f":"All!AR537","v":0},{"$f":"All!AS537","v":0},{"$f":"All!AT537","v":0}]
[null,{"$f":"All!B538","v":"7"},{"$f":"All!C538","v":"7.1"},{"$f":"All!D538","v":"7.1.1"},{"$f":"All!E538","v":""},{"$f":"All!F538","v":"7.1.1.6"},{"$f":"All!G538","v":"7.1.1.6: TRAIN CUSTOMER SERVICE STAFF \nProviders should ensure that customer service staff are fully trained to handle the wide range of issues that customers may complain about. Training should be designed to encompass the full lifecycle of complaint management:\n- initial contact with complainants (verify identity, confirm complaint should be logged, etc.);\n- initiate investigation;\n- resolve (including informing customer of resolution); and\n- close complaint (log complaint resolution, etc.).\n\nA knowledge portal can be a good resource for customer service staff, containing FAQs that are updated based upon questions received from customers.\n\nCustomer service staff training should be repeated periodically, and the content of the training course should be updated as the service changes and evolves. \n\nComplex issues requiring higher levels of support should be addressed through second-level customer service personnel, who should have more advanced training - refer to 7.2.1.2.\n\nTo ensure effective complaint management, providers should monitor the performance of staff in addressing and resolving customer complaints."},{"$f":"All!H538","v":0},{"$f":"All!I538","v":"7.1.1.6.1"},{"$f":"All!J538","v":"7.1.1.6.1: Are customer service staff trained to deal with a range of issues that customers may complain about?\n"},{"$f":"All!K538","v":"1) Customer service training documentation\n - Check that records of trained customer service staff show that all have been trained).\n - Check that training dates are within the last two years\n - Check that training covers a range of issues that customers may complain about."},{"$f":"All!L538","v":0},{"$f":"All!M538","v":"Standard Required"},{"$f":"All!N538","v":"Required"},{"$f":"All!O538","v":"CustServ"},{"$f":"All!P538","v":0},{"$f":"All!Q538","v":0},{"$f":"All!R538","v":0},{"$f":"All!S538","v":0},{"$f":"All!T538","v":0},{"$f":"All!U538","v":0},{"$f":"All!V538","v":0},{"$f":"All!W538","v":0},{"$f":"All!X538","v":0},{"$f":"All!Y538","v":0},{"$f":"All!Z538","v":0},{"$f":"All!AA538","v":0},{"$f":"All!AB538","v":0},{"$f":"All!AC538","v":0},{"$f":"All!AD538","v":0},{"$f":"All!AE538","v":0},{"$f":"All!AF538","v":0},{"$f":"All!AG538","v":0},{"$f":"All!AH538","v":0},{"$f":"All!AI538","v":0},{"$f":"All!AJ538","v":0},{"$f":"All!AK538","v":0},{"$f":"All!AL538","v":0},{"$f":"All!AM538","v":0},{"$f":"All!AN538","v":0},{"$f":"All!AO538","v":0},{"$f":"All!AP538","v":0},{"$f":"All!AQ538","v":0},{"$f":"All!AR538","v":0},{"$f":"All!AS538","v":0},{"$f":"All!AT538","v":0}]
[null,{"$f":"All!B539","v":"7"},{"$f":"All!C539","v":"7.1"},{"$f":"All!D539","v":"7.1.1"},{"$f":"All!E539","v":""},{"$f":"All!F539","v":"7.1.1.6"},{"$f":"All!G539","v":0},{"$f":"All!H539","v":0},{"$f":"All!I539","v":"7.1.1.6.2"},{"$f":"All!J539","v":"7.1.1.6.2: Does training for complaints management staff encompass the full lifecycle of complaint management, including initial contact with complainants, analysis of the complaint, resolution, logging the call and closure?\n"},{"$f":"All!K539","v":"1) Customer service training documentation \n- Check it contains training at least:\na) initial contact with complainants, \nb) initiating analysis of complaints \nc) resolution, \nd) logging the call and closure"},{"$f":"All!L539","v":0},{"$f":"All!M539","v":"Standard Required"},{"$f":"All!N539","v":"Required"},{"$f":"All!O539","v":"CustServ"},{"$f":"All!P539","v":0},{"$f":"All!Q539","v":0},{"$f":"All!R539","v":0},{"$f":"All!S539","v":0},{"$f":"All!T539","v":0},{"$f":"All!U539","v":0},{"$f":"All!V539","v":0},{"$f":"All!W539","v":0},{"$f":"All!X539","v":0},{"$f":"All!Y539","v":0},{"$f":"All!Z539","v":0},{"$f":"All!AA539","v":0},{"$f":"All!AB539","v":0},{"$f":"All!AC539","v":0},{"$f":"All!AD539","v":0},{"$f":"All!AE539","v":0},{"$f":"All!AF539","v":0},{"$f":"All!AG539","v":0},{"$f":"All!AH539","v":0},{"$f":"All!AI539","v":0},{"$f":"All!AJ539","v":0},{"$f":"All!AK539","v":0},{"$f":"All!AL539","v":0},{"$f":"All!AM539","v":0},{"$f":"All!AN539","v":0},{"$f":"All!AO539","v":0},{"$f":"All!AP539","v":0},{"$f":"All!AQ539","v":0},{"$f":"All!AR539","v":0},{"$f":"All!AS539","v":0},{"$f":"All!AT539","v":0}]
[null,{"$f":"All!B540","v":"7"},{"$f":"All!C540","v":"7.1"},{"$f":"All!D540","v":"7.1.1"},{"$f":"All!E540","v":""},{"$f":"All!F540","v":"7.1.1.6"},{"$f":"All!G540","v":0},{"$f":"All!H540","v":0},{"$f":"All!I540","v":"7.1.1.6.3"},{"$f":"All!J540","v":"7.1.1.6.3: Is staff training repeated periodically, with training content updated as the service changes and evolves?\n"},{"$f":"All!K540","v":0},{"$f":"All!L540","v":0},{"$f":"All!M540","v":"Recommended"},{"$f":"All!N540","v":"Recommended"},{"$f":"All!O540","v":"CustServ"},{"$f":"All!P540","v":0},{"$f":"All!Q540","v":0},{"$f":"All!R540","v":0},{"$f":"All!S540","v":0},{"$f":"All!T540","v":0},{"$f":"All!U540","v":0},{"$f":"All!V540","v":0},{"$f":"All!W540","v":0},{"$f":"All!X540","v":0},{"$f":"All!Y540","v":0},{"$f":"All!Z540","v":0},{"$f":"All!AA540","v":0},{"$f":"All!AB540","v":0},{"$f":"All!AC540","v":0},{"$f":"All!AD540","v":0},{"$f":"All!AE540","v":0},{"$f":"All!AF540","v":0},{"$f":"All!AG540","v":0},{"$f":"All!AH540","v":0},{"$f":"All!AI540","v":0},{"$f":"All!AJ540","v":0},{"$f":"All!AK540","v":0},{"$f":"All!AL540","v":0},{"$f":"All!AM540","v":0},{"$f":"All!AN540","v":0},{"$f":"All!AO540","v":0},{"$f":"All!AP540","v":0},{"$f":"All!AQ540","v":0},{"$f":"All!AR540","v":0},{"$f":"All!AS540","v":0},{"$f":"All!AT540","v":0}]
[null,{"$f":"All!B541","v":"7"},{"$f":"All!C541","v":"7.1"},{"$f":"All!D541","v":"7.1.1"},{"$f":"All!E541","v":""},{"$f":"All!F541","v":"7.1.1.6"},{"$f":"All!G541","v":0},{"$f":"All!H541","v":0},{"$f":"All!I541","v":"7.1.1.6.4"},{"$f":"All!J541","v":"7.1.1.6.4: Is the performance of complaints management staff regularly monitored?\n"},{"$f":"All!K541","v":0},{"$f":"All!L541","v":0},{"$f":"All!M541","v":"Recommended"},{"$f":"All!N541","v":"Recommended"},{"$f":"All!O541","v":"CustServ"},{"$f":"All!P541","v":0},{"$f":"All!Q541","v":0},{"$f":"All!R541","v":0},{"$f":"All!S541","v":0},{"$f":"All!T541","v":0},{"$f":"All!U541","v":0},{"$f":"All!V541","v":0},{"$f":"All!W541","v":0},{"$f":"All!X541","v":0},{"$f":"All!Y541","v":0},{"$f":"All!Z541","v":0},{"$f":"All!AA541","v":0},{"$f":"All!AB541","v":0},{"$f":"All!AC541","v":0},{"$f":"All!AD541","v":0},{"$f":"All!AE541","v":0},{"$f":"All!AF541","v":0},{"$f":"All!AG541","v":0},{"$f":"All!AH541","v":0},{"$f":"All!AI541","v":0},{"$f":"All!AJ541","v":0},{"$f":"All!AK541","v":0},{"$f":"All!AL541","v":0},{"$f":"All!AM541","v":0},{"$f":"All!AN541","v":0},{"$f":"All!AO541","v":0},{"$f":"All!AP541","v":0},{"$f":"All!AQ541","v":0},{"$f":"All!AR541","v":0},{"$f":"All!AS541","v":0},{"$f":"All!AT541","v":0}]
[null,{"$f":"All!B542","v":"7"},{"$f":"All!C542","v":"7.1"},{"$f":"All!D542","v":"7.1.1"},{"$f":"All!E542","v":""},{"$f":"All!F542","v":"7.1.1.7"},{"$f":"All!G542","v":"7.1.1.7: RECORDING COMPLAINTS\nProviders should keep detailed records of complaints made by customers, including\n- detailed information about the nature of the complaint;\n- actions taken to address the complaint; \n- any escalations raised during the complaints process; and \n- how the complaint was ultimately resolved. \n\nThe head of customer service should receive reports on customer complaints to analyse complaints and resolutions according to the type of complaint."},{"$f":"All!H542","v":0},{"$f":"All!I542","v":"7.1.1.7.1"},{"$f":"All!J542","v":"7.1.1.7.1: Are detailed records of customer complaints maintained?\n"},{"$f":"All!K542","v":"1) Customer service call records for the last month.\n- Check that the customer service call records for the last month exist and appear complete."},{"$f":"All!L542","v":0},{"$f":"All!M542","v":"Standard Required"},{"$f":"All!N542","v":"Required"},{"$f":"All!O542","v":"CustServ"},{"$f":"All!P542","v":0},{"$f":"All!Q542","v":0},{"$f":"All!R542","v":0},{"$f":"All!S542","v":0},{"$f":"All!T542","v":0},{"$f":"All!U542","v":0},{"$f":"All!V542","v":0},{"$f":"All!W542","v":0},{"$f":"All!X542","v":0},{"$f":"All!Y542","v":0},{"$f":"All!Z542","v":0},{"$f":"All!AA542","v":0},{"$f":"All!AB542","v":0},{"$f":"All!AC542","v":0},{"$f":"All!AD542","v":0},{"$f":"All!AE542","v":0},{"$f":"All!AF542","v":0},{"$f":"All!AG542","v":0},{"$f":"All!AH542","v":0},{"$f":"All!AI542","v":0},{"$f":"All!AJ542","v":0},{"$f":"All!AK542","v":0},{"$f":"All!AL542","v":0},{"$f":"All!AM542","v":0},{"$f":"All!AN542","v":0},{"$f":"All!AO542","v":0},{"$f":"All!AP542","v":0},{"$f":"All!AQ542","v":0},{"$f":"All!AR542","v":0},{"$f":"All!AS542","v":0},{"$f":"All!AT542","v":0}]
[null,{"$f":"All!B543","v":"7"},{"$f":"All!C543","v":"7.1"},{"$f":"All!D543","v":"7.1.1"},{"$f":"All!E543","v":""},{"$f":"All!F543","v":"7.1.1.7"},{"$f":"All!G543","v":0},{"$f":"All!H543","v":0},{"$f":"All!I543","v":"7.1.1.7.2"},{"$f":"All!J543","v":"7.1.1.7.2: Do complaint records include all of the following\n"},{"$f":"All!K543","v":0},{"$f":"All!L543","v":0},{"$f":"All!M543","v":"Recommended"},{"$f":"All!N543","v":"Recommended"},{"$f":"All!O543","v":"CustServ"},{"$f":"All!P543","v":0},{"$f":"All!Q543","v":0},{"$f":"All!R543","v":0},{"$f":"All!S543","v":0},{"$f":"All!T543","v":0},{"$f":"All!U543","v":0},{"$f":"All!V543","v":0},{"$f":"All!W543","v":0},{"$f":"All!X543","v":0},{"$f":"All!Y543","v":0},{"$f":"All!Z543","v":0},{"$f":"All!AA543","v":0},{"$f":"All!AB543","v":0},{"$f":"All!AC543","v":0},{"$f":"All!AD543","v":0},{"$f":"All!AE543","v":0},{"$f":"All!AF543","v":0},{"$f":"All!AG543","v":0},{"$f":"All!AH543","v":0},{"$f":"All!AI543","v":0},{"$f":"All!AJ543","v":0},{"$f":"All!AK543","v":0},{"$f":"All!AL543","v":0},{"$f":"All!AM543","v":0},{"$f":"All!AN543","v":0},{"$f":"All!AO543","v":0},{"$f":"All!AP543","v":0},{"$f":"All!AQ543","v":0},{"$f":"All!AR543","v":0},{"$f":"All!AS543","v":0},{"$f":"All!AT543","v":0}]
[null,{"$f":"All!B544","v":"7"},{"$f":"All!C544","v":"7.1"},{"$f":"All!D544","v":"7.1.1"},{"$f":"All!E544","v":""},{"$f":"All!F544","v":"7.1.1.7"},{"$f":"All!G544","v":0},{"$f":"All!H544","v":0},{"$f":"All!I544","v":"7.1.1.7.3"},{"$f":"All!J544","v":"7.1.1.7.3: Does the head of customer service receive reports on customer complaints to analyse complaints and resolutions according to the type of complaint?\n"},{"$f":"All!K544","v":0},{"$f":"All!L544","v":0},{"$f":"All!M544","v":"Recommended"},{"$f":"All!N544","v":"Recommended"},{"$f":"All!O544","v":"CustServ"},{"$f":"All!P544","v":0},{"$f":"All!Q544","v":0},{"$f":"All!R544","v":0},{"$f":"All!S544","v":0},{"$f":"All!T544","v":0},{"$f":"All!U544","v":0},{"$f":"All!V544","v":0},{"$f":"All!W544","v":0},{"$f":"All!X544","v":0},{"$f":"All!Y544","v":0},{"$f":"All!Z544","v":0},{"$f":"All!AA544","v":0},{"$f":"All!AB544","v":0},{"$f":"All!AC544","v":0},{"$f":"All!AD544","v":0},{"$f":"All!AE544","v":0},{"$f":"All!AF544","v":0},{"$f":"All!AG544","v":0},{"$f":"All!AH544","v":0},{"$f":"All!AI544","v":0},{"$f":"All!AJ544","v":0},{"$f":"All!AK544","v":0},{"$f":"All!AL544","v":0},{"$f":"All!AM544","v":0},{"$f":"All!AN544","v":0},{"$f":"All!AO544","v":0},{"$f":"All!AP544","v":0},{"$f":"All!AQ544","v":0},{"$f":"All!AR544","v":0},{"$f":"All!AS544","v":0},{"$f":"All!AT544","v":0}]
[null,{"$f":"All!B545","v":"7"},{"$f":"All!C545","v":"7.1"},{"$f":"All!D545","v":"7.1.2"},{"$f":"All!E545","v":"7.1.2: Providers shall inform customers of customer service policies and procedures"},{"$f":"All!F545","v":"7.1.2.1"},{"$f":"All!G545","v":"7.1.2.1: INFORMING CUSTOMERS OF COMPLAINT POLICIES AND PROCEDURES\nThe methods for contacting customer care (e.g. phone number, electronic communication) should be advertised at agents and other points of service (e.g. on posters, brochures, etc.) and through the customer's mobile phone, for example as a separate menu item on USSD, Web & STK menus.\n\nAgents and staff involved in account opening should be trained to inform customers of complaint and escalation procedures both upon account opening and in the event of a complaint.\n\nCustomer care staff should be trained to inform customers of the quality of service that they should expect in the management of their complaints. (For example, providers should describe how the complaint will be addressed and specify the maximum time that customers should expect to wait for a response.)\n"},{"$f":"All!H545","v":0},{"$f":"All!I545","v":"7.1.2.1.1"},{"$f":"All!J545","v":"7.1.2.1.1: Are the methods for contacting customer care clearly advertised to customers - e.g. at agents and other points of service, or on posters?\n"},{"$f":"All!K545","v":"1) Agent outlet advertising plan or customer communications plan\n- Check the agent/comms/point of sale material includes details of how customer can contact customer care\n- Check there is a process to ensure agents have all appropriate point of sale material\n"},{"$f":"All!L545","v":0},{"$f":"All!M545","v":"Urgent Required"},{"$f":"All!N545","v":"Required"},{"$f":"All!O545","v":"CustServ"},{"$f":"All!P545","v":0},{"$f":"All!Q545","v":0},{"$f":"All!R545","v":0},{"$f":"All!S545","v":0},{"$f":"All!T545","v":0},{"$f":"All!U545","v":0},{"$f":"All!V545","v":0},{"$f":"All!W545","v":0},{"$f":"All!X545","v":0},{"$f":"All!Y545","v":0},{"$f":"All!Z545","v":0},{"$f":"All!AA545","v":0},{"$f":"All!AB545","v":0},{"$f":"All!AC545","v":0},{"$f":"All!AD545","v":0},{"$f":"All!AE545","v":0},{"$f":"All!AF545","v":0},{"$f":"All!AG545","v":0},{"$f":"All!AH545","v":0},{"$f":"All!AI545","v":0},{"$f":"All!AJ545","v":0},{"$f":"All!AK545","v":0},{"$f":"All!AL545","v":0},{"$f":"All!AM545","v":0},{"$f":"All!AN545","v":0},{"$f":"All!AO545","v":0},{"$f":"All!AP545","v":0},{"$f":"All!AQ545","v":0},{"$f":"All!AR545","v":0},{"$f":"All!AS545","v":0},{"$f":"All!AT545","v":0}]
[null,{"$f":"All!B546","v":"7"},{"$f":"All!C546","v":"7.1"},{"$f":"All!D546","v":"7.1.2"},{"$f":"All!E546","v":0},{"$f":"All!F546","v":"7.1.2.1"},{"$f":"All!G546","v":0},{"$f":"All!H546","v":0},{"$f":"All!I546","v":"7.1.2.1.2"},{"$f":"All!J546","v":"7.1.2.1.2: Are customers informed of customer service channels / procedures upon account opening?\n"},{"$f":"All!K546","v":"1) Registering-agent training materials or customer registration handout\n- Check that customers are informed of customer service channels / procedures upon account opening."},{"$f":"All!L546","v":0},{"$f":"All!M546","v":"Standard Required"},{"$f":"All!N546","v":"Required"},{"$f":"All!O546","v":"CustServ"},{"$f":"All!P546","v":0},{"$f":"All!Q546","v":0},{"$f":"All!R546","v":0},{"$f":"All!S546","v":0},{"$f":"All!T546","v":0},{"$f":"All!U546","v":0},{"$f":"All!V546","v":0},{"$f":"All!W546","v":0},{"$f":"All!X546","v":0},{"$f":"All!Y546","v":0},{"$f":"All!Z546","v":0},{"$f":"All!AA546","v":0},{"$f":"All!AB546","v":0},{"$f":"All!AC546","v":0},{"$f":"All!AD546","v":0},{"$f":"All!AE546","v":0},{"$f":"All!AF546","v":0},{"$f":"All!AG546","v":0},{"$f":"All!AH546","v":0},{"$f":"All!AI546","v":0},{"$f":"All!AJ546","v":0},{"$f":"All!AK546","v":0},{"$f":"All!AL546","v":0},{"$f":"All!AM546","v":0},{"$f":"All!AN546","v":0},{"$f":"All!AO546","v":0},{"$f":"All!AP546","v":0},{"$f":"All!AQ546","v":0},{"$f":"All!AR546","v":0},{"$f":"All!AS546","v":0},{"$f":"All!AT546","v":0}]
[null,{"$f":"All!B547","v":"7"},{"$f":"All!C547","v":"7.1"},{"$f":"All!D547","v":"7.1.2"},{"$f":"All!E547","v":""},{"$f":"All!F547","v":"7.1.2.1"},{"$f":"All!G547","v":0},{"$f":"All!H547","v":0},{"$f":"All!I547","v":"7.1.2.1.3"},{"$f":"All!J547","v":"7.1.2.1.3: Is a description of the external recourse options included in the customer terms & conditions or customer contract?\n"},{"$f":"All!K547","v":"1) Customer T&Cs or customer contract\n- Check the document includes when and how to escalate complaints to external authorities after exhausting the provider's resolution process."},{"$f":"All!L547","v":0},{"$f":"All!M547","v":"Standard Required"},{"$f":"All!N547","v":"Required"},{"$f":"All!O547","v":"CustServ"},{"$f":"All!P547","v":0},{"$f":"All!Q547","v":0},{"$f":"All!R547","v":0},{"$f":"All!S547","v":0},{"$f":"All!T547","v":0},{"$f":"All!U547","v":0},{"$f":"All!V547","v":0},{"$f":"All!W547","v":0},{"$f":"All!X547","v":0},{"$f":"All!Y547","v":0},{"$f":"All!Z547","v":0},{"$f":"All!AA547","v":0},{"$f":"All!AB547","v":0},{"$f":"All!AC547","v":0},{"$f":"All!AD547","v":0},{"$f":"All!AE547","v":0},{"$f":"All!AF547","v":0},{"$f":"All!AG547","v":0},{"$f":"All!AH547","v":0},{"$f":"All!AI547","v":0},{"$f":"All!AJ547","v":0},{"$f":"All!AK547","v":0},{"$f":"All!AL547","v":0},{"$f":"All!AM547","v":0},{"$f":"All!AN547","v":0},{"$f":"All!AO547","v":0},{"$f":"All!AP547","v":0},{"$f":"All!AQ547","v":0},{"$f":"All!AR547","v":0},{"$f":"All!AS547","v":0},{"$f":"All!AT547","v":0}]
[null,{"$f":"All!B548","v":"7"},{"$f":"All!C548","v":"7.1"},{"$f":"All!D548","v":"7.1.2"},{"$f":"All!E548","v":0},{"$f":"All!F548","v":"7.1.2.1"},{"$f":"All!G548","v":0},{"$f":"All!H548","v":0},{"$f":"All!I548","v":"7.1.2.1.4"},{"$f":"All!J548","v":"7.1.2.1.4: Do handset menus provide contact details for customer support?\n"},{"$f":"All!K548","v":0},{"$f":"All!L548","v":0},{"$f":"All!M548","v":"Recommended"},{"$f":"All!N548","v":"Recommended"},{"$f":"All!O548","v":"CustServ"},{"$f":"All!P548","v":0},{"$f":"All!Q548","v":0},{"$f":"All!R548","v":0},{"$f":"All!S548","v":0},{"$f":"All!T548","v":0},{"$f":"All!U548","v":0},{"$f":"All!V548","v":0},{"$f":"All!W548","v":0},{"$f":"All!X548","v":0},{"$f":"All!Y548","v":0},{"$f":"All!Z548","v":0},{"$f":"All!AA548","v":0},{"$f":"All!AB548","v":0},{"$f":"All!AC548","v":0},{"$f":"All!AD548","v":0},{"$f":"All!AE548","v":0},{"$f":"All!AF548","v":0},{"$f":"All!AG548","v":0},{"$f":"All!AH548","v":0},{"$f":"All!AI548","v":0},{"$f":"All!AJ548","v":0},{"$f":"All!AK548","v":0},{"$f":"All!AL548","v":0},{"$f":"All!AM548","v":0},{"$f":"All!AN548","v":0},{"$f":"All!AO548","v":0},{"$f":"All!AP548","v":0},{"$f":"All!AQ548","v":0},{"$f":"All!AR548","v":0},{"$f":"All!AS548","v":0},{"$f":"All!AT548","v":0}]
[null,{"$f":"All!B549","v":"7"},{"$f":"All!C549","v":"7.1"},{"$f":"All!D549","v":"7.1.2"},{"$f":"All!E549","v":0},{"$f":"All!F549","v":"7.1.2.1"},{"$f":"All!G549","v":0},{"$f":"All!H549","v":0},{"$f":"All!I549","v":"7.1.2.1.5"},{"$f":"All!J549","v":"7.1.2.1.5: Are customers informed how and when to escalate complaints to more senior staff?\n"},{"$f":"All!K549","v":0},{"$f":"All!L549","v":0},{"$f":"All!M549","v":"Recommended"},{"$f":"All!N549","v":"Recommended"},{"$f":"All!O549","v":"CustServ"},{"$f":"All!P549","v":0},{"$f":"All!Q549","v":0},{"$f":"All!R549","v":0},{"$f":"All!S549","v":0},{"$f":"All!T549","v":0},{"$f":"All!U549","v":0},{"$f":"All!V549","v":0},{"$f":"All!W549","v":0},{"$f":"All!X549","v":0},{"$f":"All!Y549","v":0},{"$f":"All!Z549","v":0},{"$f":"All!AA549","v":0},{"$f":"All!AB549","v":0},{"$f":"All!AC549","v":0},{"$f":"All!AD549","v":0},{"$f":"All!AE549","v":0},{"$f":"All!AF549","v":0},{"$f":"All!AG549","v":0},{"$f":"All!AH549","v":0},{"$f":"All!AI549","v":0},{"$f":"All!AJ549","v":0},{"$f":"All!AK549","v":0},{"$f":"All!AL549","v":0},{"$f":"All!AM549","v":0},{"$f":"All!AN549","v":0},{"$f":"All!AO549","v":0},{"$f":"All!AP549","v":0},{"$f":"All!AQ549","v":0},{"$f":"All!AR549","v":0},{"$f":"All!AS549","v":0},{"$f":"All!AT549","v":0}]
[null,{"$f":"All!B550","v":"7"},{"$f":"All!C550","v":"7.1"},{"$f":"All!D550","v":"7.1.2"},{"$f":"All!E550","v":0},{"$f":"All!F550","v":"7.1.2.1"},{"$f":"All!G550","v":0},{"$f":"All!H550","v":0},{"$f":"All!I550","v":"7.1.2.1.6"},{"$f":"All!J550","v":"7.1.2.1.6: Do customer care staff make clear to customers the quality of service that they should expect in the management of their complaints, including how the complaint will be addressed and the maximum time that customers should expect to wait for a resolution?\n"},{"$f":"All!K550","v":0},{"$f":"All!L550","v":0},{"$f":"All!M550","v":"Recommended"},{"$f":"All!N550","v":"Recommended"},{"$f":"All!O550","v":"CustServ"},{"$f":"All!P550","v":0},{"$f":"All!Q550","v":0},{"$f":"All!R550","v":0},{"$f":"All!S550","v":0},{"$f":"All!T550","v":0},{"$f":"All!U550","v":0},{"$f":"All!V550","v":0},{"$f":"All!W550","v":0},{"$f":"All!X550","v":0},{"$f":"All!Y550","v":0},{"$f":"All!Z550","v":0},{"$f":"All!AA550","v":0},{"$f":"All!AB550","v":0},{"$f":"All!AC550","v":0},{"$f":"All!AD550","v":0},{"$f":"All!AE550","v":0},{"$f":"All!AF550","v":0},{"$f":"All!AG550","v":0},{"$f":"All!AH550","v":0},{"$f":"All!AI550","v":0},{"$f":"All!AJ550","v":0},{"$f":"All!AK550","v":0},{"$f":"All!AL550","v":0},{"$f":"All!AM550","v":0},{"$f":"All!AN550","v":0},{"$f":"All!AO550","v":0},{"$f":"All!AP550","v":0},{"$f":"All!AQ550","v":0},{"$f":"All!AR550","v":0},{"$f":"All!AS550","v":0},{"$f":"All!AT550","v":0}]
[null,{"$f":"All!B551","v":"7"},{"$f":"All!C551","v":"7.1"},{"$f":"All!D551","v":"7.1.2"},{"$f":"All!E551","v":""},{"$f":"All!F551","v":"7.1.2.2"},{"$f":"All!G551","v":"7.1.2.2: CHANGES TO COMPLAINT PROCEDURES\nAll changes to complaint handling procedures and timeframes should be updated in the Terms & Conditions and clearly communicated to customers before the changes take effect."},{"$f":"All!H551","v":0},{"$f":"All!I551","v":"7.1.2.2.1"},{"$f":"All!J551","v":"7.1.2.2.1: Are all changes to complaint handling procedures and timeframes updated in the T&Cs?\n"},{"$f":"All!K551","v":0},{"$f":"All!L551","v":0},{"$f":"All!M551","v":"Recommended"},{"$f":"All!N551","v":"Recommended"},{"$f":"All!O551","v":"CustServ"},{"$f":"All!P551","v":0},{"$f":"All!Q551","v":0},{"$f":"All!R551","v":0},{"$f":"All!S551","v":0},{"$f":"All!T551","v":0},{"$f":"All!U551","v":0},{"$f":"All!V551","v":0},{"$f":"All!W551","v":0},{"$f":"All!X551","v":0},{"$f":"All!Y551","v":0},{"$f":"All!Z551","v":0},{"$f":"All!AA551","v":0},{"$f":"All!AB551","v":0},{"$f":"All!AC551","v":0},{"$f":"All!AD551","v":0},{"$f":"All!AE551","v":0},{"$f":"All!AF551","v":0},{"$f":"All!AG551","v":0},{"$f":"All!AH551","v":0},{"$f":"All!AI551","v":0},{"$f":"All!AJ551","v":0},{"$f":"All!AK551","v":0},{"$f":"All!AL551","v":0},{"$f":"All!AM551","v":0},{"$f":"All!AN551","v":0},{"$f":"All!AO551","v":0},{"$f":"All!AP551","v":0},{"$f":"All!AQ551","v":0},{"$f":"All!AR551","v":0},{"$f":"All!AS551","v":0},{"$f":"All!AT551","v":0}]
[null,{"$f":"All!B552","v":"7"},{"$f":"All!C552","v":"7.1"},{"$f":"All!D552","v":"7.1.2"},{"$f":"All!E552","v":""},{"$f":"All!F552","v":"7.1.2.2"},{"$f":"All!G552","v":0},{"$f":"All!H552","v":0},{"$f":"All!I552","v":"7.1.2.2.2"},{"$f":"All!J552","v":"7.1.2.2.2: Are all changes to complaint handling procedures and timeframes communicated to customers before they take effect?\n"},{"$f":"All!K552","v":0},{"$f":"All!L552","v":0},{"$f":"All!M552","v":"Recommended"},{"$f":"All!N552","v":"Recommended"},{"$f":"All!O552","v":"CustServ"},{"$f":"All!P552","v":0},{"$f":"All!Q552","v":0},{"$f":"All!R552","v":0},{"$f":"All!S552","v":0},{"$f":"All!T552","v":0},{"$f":"All!U552","v":0},{"$f":"All!V552","v":0},{"$f":"All!W552","v":0},{"$f":"All!X552","v":0},{"$f":"All!Y552","v":0},{"$f":"All!Z552","v":0},{"$f":"All!AA552","v":0},{"$f":"All!AB552","v":0},{"$f":"All!AC552","v":0},{"$f":"All!AD552","v":0},{"$f":"All!AE552","v":0},{"$f":"All!AF552","v":0},{"$f":"All!AG552","v":0},{"$f":"All!AH552","v":0},{"$f":"All!AI552","v":0},{"$f":"All!AJ552","v":0},{"$f":"All!AK552","v":0},{"$f":"All!AL552","v":0},{"$f":"All!AM552","v":0},{"$f":"All!AN552","v":0},{"$f":"All!AO552","v":0},{"$f":"All!AP552","v":0},{"$f":"All!AQ552","v":0},{"$f":"All!AR552","v":0},{"$f":"All!AS552","v":0},{"$f":"All!AT552","v":0}]
[null,{"$f":"All!B553","v":"7"},{"$f":"All!C553","v":"7.1"},{"$f":"All!D553","v":"7.1.3"},{"$f":"All!E553","v":"7.1.3: Providers shall develop specific policies for handling reversals"},{"$f":"All!F553","v":"7.1.3.1"},{"$f":"All!G553","v":"7.1.3.1: TRANSACTION REVERSALS - POLICY\nProviders should develop a detailed policy for the management of transaction reversals, including:\n- the scenarios and transaction types which are valid for reversal\n- the procedures for handling transaction reversals; \n- the rules that apply to reversals (e.g. whether to refund fees).\n\nThe policy should be regularly updated to ensure:\n- compliance with applicable regulations, which may change over time; and\n- that customers are satisfied with the transaction reversal process.\n\nPolicy should specify that reversals will be authorised where the provider is at fault for a transaction that should not have occurred."},{"$f":"All!H553","v":"GSMA RMT"},{"$f":"All!I553","v":"7.1.3.1.1"},{"$f":"All!J553","v":"7.1.3.1.1: Is there a policy for the management of transaction reversals, and is it kept updated as new transaction types are developed?\n"},{"$f":"All!K553","v":"1) Reversals policy or process\n- Check there is a  policy/process for the management of reversals,\n- Check the policy/process has been revised in the last 24 months."},{"$f":"All!L553","v":0},{"$f":"All!M553","v":"Urgent Required"},{"$f":"All!N553","v":"Required"},{"$f":"All!O553","v":"CustServ"},{"$f":"All!P553","v":0},{"$f":"All!Q553","v":0},{"$f":"All!R553","v":0},{"$f":"All!S553","v":0},{"$f":"All!T553","v":0},{"$f":"All!U553","v":0},{"$f":"All!V553","v":0},{"$f":"All!W553","v":0},{"$f":"All!X553","v":0},{"$f":"All!Y553","v":0},{"$f":"All!Z553","v":0},{"$f":"All!AA553","v":0},{"$f":"All!AB553","v":0},{"$f":"All!AC553","v":0},{"$f":"All!AD553","v":0},{"$f":"All!AE553","v":0},{"$f":"All!AF553","v":0},{"$f":"All!AG553","v":0},{"$f":"All!AH553","v":0},{"$f":"All!AI553","v":0},{"$f":"All!AJ553","v":0},{"$f":"All!AK553","v":0},{"$f":"All!AL553","v":0},{"$f":"All!AM553","v":0},{"$f":"All!AN553","v":0},{"$f":"All!AO553","v":0},{"$f":"All!AP553","v":0},{"$f":"All!AQ553","v":0},{"$f":"All!AR553","v":0},{"$f":"All!AS553","v":0},{"$f":"All!AT553","v":0}]
[null,{"$f":"All!B554","v":"7"},{"$f":"All!C554","v":"7.1"},{"$f":"All!D554","v":"7.1.3"},{"$f":"All!E554","v":""},{"$f":"All!F554","v":"7.1.3.1"},{"$f":"All!G554","v":0},{"$f":"All!H554","v":0},{"$f":"All!I554","v":"7.1.3.1.2"},{"$f":"All!J554","v":"7.1.3.1.2: Is there a list of all transaction types can be reversed, explaining conditions for the reversal to be completed (e.g. time limit for raising reversal; funds available to be reversed)?\n"},{"$f":"All!K554","v":"1) Reversals policy or process\n- Check the policy/process identifies all customer transactions that may be reversed (and those that cannot be reversed).\n- Check the policy/process identifies all business transactions that may be reversed.\n- Check that the process includes conditions where transactions may be reversed, including time limits and how reversals are handled if the funds are no longer available."},{"$f":"All!L554","v":0},{"$f":"All!M554","v":"Urgent Required"},{"$f":"All!N554","v":"Required"},{"$f":"All!O554","v":"CustServ"},{"$f":"All!P554","v":0},{"$f":"All!Q554","v":0},{"$f":"All!R554","v":0},{"$f":"All!S554","v":0},{"$f":"All!T554","v":0},{"$f":"All!U554","v":0},{"$f":"All!V554","v":0},{"$f":"All!W554","v":0},{"$f":"All!X554","v":0},{"$f":"All!Y554","v":0},{"$f":"All!Z554","v":0},{"$f":"All!AA554","v":0},{"$f":"All!AB554","v":0},{"$f":"All!AC554","v":0},{"$f":"All!AD554","v":0},{"$f":"All!AE554","v":0},{"$f":"All!AF554","v":0},{"$f":"All!AG554","v":0},{"$f":"All!AH554","v":0},{"$f":"All!AI554","v":0},{"$f":"All!AJ554","v":0},{"$f":"All!AK554","v":0},{"$f":"All!AL554","v":0},{"$f":"All!AM554","v":0},{"$f":"All!AN554","v":0},{"$f":"All!AO554","v":0},{"$f":"All!AP554","v":0},{"$f":"All!AQ554","v":0},{"$f":"All!AR554","v":0},{"$f":"All!AS554","v":0},{"$f":"All!AT554","v":0}]
[null,{"$f":"All!B555","v":"7"},{"$f":"All!C555","v":"7.1"},{"$f":"All!D555","v":"7.1.3"},{"$f":"All!E555","v":""},{"$f":"All!F555","v":"7.1.3.1"},{"$f":"All!G555","v":0},{"$f":"All!H555","v":0},{"$f":"All!I555","v":"7.1.3.1.3"},{"$f":"All!J555","v":"7.1.3.1.3: Has it been determined whether fees/ commissions/ taxes will be reversed as part of each reversible transaction?\n"},{"$f":"All!K555","v":"1) Reversals policy or process\n- Check the policy/process identifies what, if any, fees/commissions/taxes are to be included in each reversal."},{"$f":"All!L555","v":0},{"$f":"All!M555","v":"Standard Required"},{"$f":"All!N555","v":"Required"},{"$f":"All!O555","v":"CustServ"},{"$f":"All!P555","v":0},{"$f":"All!Q555","v":0},{"$f":"All!R555","v":0},{"$f":"All!S555","v":0},{"$f":"All!T555","v":0},{"$f":"All!U555","v":0},{"$f":"All!V555","v":0},{"$f":"All!W555","v":0},{"$f":"All!X555","v":0},{"$f":"All!Y555","v":0},{"$f":"All!Z555","v":0},{"$f":"All!AA555","v":0},{"$f":"All!AB555","v":0},{"$f":"All!AC555","v":0},{"$f":"All!AD555","v":0},{"$f":"All!AE555","v":0},{"$f":"All!AF555","v":0},{"$f":"All!AG555","v":0},{"$f":"All!AH555","v":0},{"$f":"All!AI555","v":0},{"$f":"All!AJ555","v":0},{"$f":"All!AK555","v":0},{"$f":"All!AL555","v":0},{"$f":"All!AM555","v":0},{"$f":"All!AN555","v":0},{"$f":"All!AO555","v":0},{"$f":"All!AP555","v":0},{"$f":"All!AQ555","v":0},{"$f":"All!AR555","v":0},{"$f":"All!AS555","v":0},{"$f":"All!AT555","v":0}]
[null,{"$f":"All!B556","v":"7"},{"$f":"All!C556","v":"7.1"},{"$f":"All!D556","v":"7.1.3"},{"$f":"All!E556","v":0},{"$f":"All!F556","v":"7.1.3.1"},{"$f":"All!G556","v":0},{"$f":"All!H556","v":0},{"$f":"All!I556","v":"7.1.3.1.4"},{"$f":"All!J556","v":"7.1.3.1.4: Does the reversals policy specify that the provider will correct mistakes where the provider is at fault for a debit or transaction that should not have occurred (e.g. mistake by customer service staff or system error)?\n"},{"$f":"All!K556","v":"1) Reversals policy or process / Customer service process\n- Check the policy/process specifies that the provider will correct mistakes where the provider is at fault for a debit or transaction that should not have occurred (e.g. mistake by customer service staff or system error)"},{"$f":"All!L556","v":0},{"$f":"All!M556","v":"Standard Required"},{"$f":"All!N556","v":"Required"},{"$f":"All!O556","v":"CustServ"},{"$f":"All!P556","v":0},{"$f":"All!Q556","v":0},{"$f":"All!R556","v":0},{"$f":"All!S556","v":0},{"$f":"All!T556","v":0},{"$f":"All!U556","v":0},{"$f":"All!V556","v":0},{"$f":"All!W556","v":0},{"$f":"All!X556","v":0},{"$f":"All!Y556","v":0},{"$f":"All!Z556","v":0},{"$f":"All!AA556","v":0},{"$f":"All!AB556","v":0},{"$f":"All!AC556","v":0},{"$f":"All!AD556","v":0},{"$f":"All!AE556","v":0},{"$f":"All!AF556","v":0},{"$f":"All!AG556","v":0},{"$f":"All!AH556","v":0},{"$f":"All!AI556","v":0},{"$f":"All!AJ556","v":0},{"$f":"All!AK556","v":0},{"$f":"All!AL556","v":0},{"$f":"All!AM556","v":0},{"$f":"All!AN556","v":0},{"$f":"All!AO556","v":0},{"$f":"All!AP556","v":0},{"$f":"All!AQ556","v":0},{"$f":"All!AR556","v":0},{"$f":"All!AS556","v":0},{"$f":"All!AT556","v":0}]
[null,{"$f":"All!B557","v":"7"},{"$f":"All!C557","v":"7.1"},{"$f":"All!D557","v":"7.1.3"},{"$f":"All!E557","v":""},{"$f":"All!F557","v":"7.1.3.2"},{"$f":"All!G557","v":"7.1.3.2: TRANSACTION REVERSALS - PROCESS\nThe mobile money provider should implement the policy for handling transaction reversal requests from customers, agents, merchants, or other parties. This should be backed up by system workflow and business processes for common scenarios in which users may request a transaction to be reversed. \nThe following controls within the policy should be implemented:\n- Staff responsible for managing reversals should confirm that the transaction actually happened before reversal; \n- Providers should determine the appropriate reversal mechanism for cases where the amount sent or the receiver was mistyped;\n- Providers should approve by default reversal of transactions made to suspended/dormant/inactive accounts (because the sending party cannot directly obtain refund from the receiving party);\n- Providers should reverse transactions where the provider is at fault for a transaction that should not have occurred (e.g. system error);\n- Providers should take steps to avoid fraudulent reversals, particularly those related to agent and merchant transactions where cash or goods are exchanged (e.g. contact recipient to agree the reversal).\n\nProviders should set a budget for bearing the cost of reversals where the value is unrecoverable - It is often not possible for the provider to avoid absorbing the cost of making a reversal, so there should be a budget set for unrecoverable reversals.\n\nA process should be defined for when the reversals process cannot be resolved to the satisfaction of the customer, agent, merchant, or other party; this may require closing the case or referring the aggrieved party to external recourse mechanisms (see 7.3)."},{"$f":"All!H557","v":"GSMA RMT"},{"$f":"All!I557","v":"7.1.3.2.1"},{"$f":"All!J557","v":"7.1.3.2.1: Are processes defined for customer service staff to conduct reversals?\n"},{"$f":"All!K557","v":"1) Reversals business process\n- Check a reversal process is defined.\n- Check the reversal process includes all common transactions for which customers, agents, merchants, or other parties may request a reversal."},{"$f":"All!L557","v":0},{"$f":"All!M557","v":"Standard Required"},{"$f":"All!N557","v":"Required"},{"$f":"All!O557","v":"CustServ"},{"$f":"All!P557","v":0},{"$f":"All!Q557","v":0},{"$f":"All!R557","v":0},{"$f":"All!S557","v":0},{"$f":"All!T557","v":0},{"$f":"All!U557","v":0},{"$f":"All!V557","v":0},{"$f":"All!W557","v":0},{"$f":"All!X557","v":0},{"$f":"All!Y557","v":0},{"$f":"All!Z557","v":0},{"$f":"All!AA557","v":0},{"$f":"All!AB557","v":0},{"$f":"All!AC557","v":0},{"$f":"All!AD557","v":0},{"$f":"All!AE557","v":0},{"$f":"All!AF557","v":0},{"$f":"All!AG557","v":0},{"$f":"All!AH557","v":0},{"$f":"All!AI557","v":0},{"$f":"All!AJ557","v":0},{"$f":"All!AK557","v":0},{"$f":"All!AL557","v":0},{"$f":"All!AM557","v":0},{"$f":"All!AN557","v":0},{"$f":"All!AO557","v":0},{"$f":"All!AP557","v":0},{"$f":"All!AQ557","v":0},{"$f":"All!AR557","v":0},{"$f":"All!AS557","v":0},{"$f":"All!AT557","v":0}]
[null,{"$f":"All!B558","v":"7"},{"$f":"All!C558","v":"7.1"},{"$f":"All!D558","v":"7.1.3"},{"$f":"All!E558","v":""},{"$f":"All!F558","v":"7.1.3.2"},{"$f":"All!G558","v":0},{"$f":"All!H558","v":0},{"$f":"All!I558","v":"7.1.3.2.2"},{"$f":"All!J558","v":"7.1.3.2.2: Are steps taken to avoid fraudulent reversals, particularly those related to agent and merchant transactions where cash or goods are exchanged (e.g. contact recipient to agree the reversal)?\n"},{"$f":"All!K558","v":"1) Reversals business process\n- Check the process includes steps to avoid fraudulent reversals, for example by calling the recipient to get agreement for the reversal."},{"$f":"All!L558","v":0},{"$f":"All!M558","v":"Urgent Required"},{"$f":"All!N558","v":"Required"},{"$f":"All!O558","v":"CustServ"},{"$f":"All!P558","v":0},{"$f":"All!Q558","v":0},{"$f":"All!R558","v":0},{"$f":"All!S558","v":0},{"$f":"All!T558","v":0},{"$f":"All!U558","v":0},{"$f":"All!V558","v":0},{"$f":"All!W558","v":0},{"$f":"All!X558","v":0},{"$f":"All!Y558","v":0},{"$f":"All!Z558","v":0},{"$f":"All!AA558","v":0},{"$f":"All!AB558","v":0},{"$f":"All!AC558","v":0},{"$f":"All!AD558","v":0},{"$f":"All!AE558","v":0},{"$f":"All!AF558","v":0},{"$f":"All!AG558","v":0},{"$f":"All!AH558","v":0},{"$f":"All!AI558","v":0},{"$f":"All!AJ558","v":0},{"$f":"All!AK558","v":0},{"$f":"All!AL558","v":0},{"$f":"All!AM558","v":0},{"$f":"All!AN558","v":0},{"$f":"All!AO558","v":0},{"$f":"All!AP558","v":0},{"$f":"All!AQ558","v":0},{"$f":"All!AR558","v":0},{"$f":"All!AS558","v":0},{"$f":"All!AT558","v":0}]
[null,{"$f":"All!B559","v":"7"},{"$f":"All!C559","v":"7.1"},{"$f":"All!D559","v":"7.1.3"},{"$f":"All!E559","v":""},{"$f":"All!F559","v":"7.1.3.2"},{"$f":"All!G559","v":0},{"$f":"All!H559","v":0},{"$f":"All!I559","v":"7.1.3.2.3"},{"$f":"All!J559","v":"7.1.3.2.3: Is a budget set for bearing the costs of reversals?\n"},{"$f":"All!K559","v":0},{"$f":"All!L559","v":0},{"$f":"All!M559","v":"Recommended"},{"$f":"All!N559","v":"Recommended"},{"$f":"All!O559","v":"CustServ"},{"$f":"All!P559","v":0},{"$f":"All!Q559","v":0},{"$f":"All!R559","v":0},{"$f":"All!S559","v":0},{"$f":"All!T559","v":0},{"$f":"All!U559","v":0},{"$f":"All!V559","v":0},{"$f":"All!W559","v":0},{"$f":"All!X559","v":0},{"$f":"All!Y559","v":0},{"$f":"All!Z559","v":0},{"$f":"All!AA559","v":0},{"$f":"All!AB559","v":0},{"$f":"All!AC559","v":0},{"$f":"All!AD559","v":0},{"$f":"All!AE559","v":0},{"$f":"All!AF559","v":0},{"$f":"All!AG559","v":0},{"$f":"All!AH559","v":0},{"$f":"All!AI559","v":0},{"$f":"All!AJ559","v":0},{"$f":"All!AK559","v":0},{"$f":"All!AL559","v":0},{"$f":"All!AM559","v":0},{"$f":"All!AN559","v":0},{"$f":"All!AO559","v":0},{"$f":"All!AP559","v":0},{"$f":"All!AQ559","v":0},{"$f":"All!AR559","v":0},{"$f":"All!AS559","v":0},{"$f":"All!AT559","v":0}]
[null,{"$f":"All!B560","v":"7"},{"$f":"All!C560","v":"7.1"},{"$f":"All!D560","v":"7.1.3"},{"$f":"All!E560","v":""},{"$f":"All!F560","v":"7.1.3.3"},{"$f":"All!G560","v":"7.1.3.3: TRANSACTION REVERSALS IN THE MOBILE MONEY SYSTEM\nThe provider should implement functions within the mobile money system to support the reversal procedures:\n- System workflow should guide customer care staff through the reversal procedures;\n- System should hold funds in a reserved state while investigations are conducted; and\n- System functionality should reduce the likelihood of mistakes requiring reversal (e.g. phone address book for customer; recipient name look-up and confirmation; making customer enter recipient’s number twice).\n\nNOTE: Transaction reversals should be completed as soon as possible after the reversal is approved by the responsible officer (ideally within one business day). Providers should also consider implementing a \"sweep\" process in the system to collect the reversal payment from the customer when they next add funds to their account."},{"$f":"All!H560","v":"GSMA RMT"},{"$f":"All!I560","v":"7.1.3.3.1"},{"$f":"All!J560","v":"7.1.3.3.1: Does the mobile money system implement workflow to guide customer care staff through the reversal procedures?\n"},{"$f":"All!K560","v":0},{"$f":"All!L560","v":0},{"$f":"All!M560","v":"Recommended"},{"$f":"All!N560","v":"Recommended"},{"$f":"All!O560","v":"CustServ"},{"$f":"All!P560","v":0},{"$f":"All!Q560","v":0},{"$f":"All!R560","v":0},{"$f":"All!S560","v":0},{"$f":"All!T560","v":0},{"$f":"All!U560","v":0},{"$f":"All!V560","v":0},{"$f":"All!W560","v":0},{"$f":"All!X560","v":0},{"$f":"All!Y560","v":0},{"$f":"All!Z560","v":0},{"$f":"All!AA560","v":0},{"$f":"All!AB560","v":0},{"$f":"All!AC560","v":0},{"$f":"All!AD560","v":0},{"$f":"All!AE560","v":0},{"$f":"All!AF560","v":0},{"$f":"All!AG560","v":0},{"$f":"All!AH560","v":0},{"$f":"All!AI560","v":0},{"$f":"All!AJ560","v":0},{"$f":"All!AK560","v":0},{"$f":"All!AL560","v":0},{"$f":"All!AM560","v":0},{"$f":"All!AN560","v":0},{"$f":"All!AO560","v":0},{"$f":"All!AP560","v":0},{"$f":"All!AQ560","v":0},{"$f":"All!AR560","v":0},{"$f":"All!AS560","v":0},{"$f":"All!AT560","v":0}]
[null,{"$f":"All!B561","v":"7"},{"$f":"All!C561","v":"7.1"},{"$f":"All!D561","v":"7.1.3"},{"$f":"All!E561","v":""},{"$f":"All!F561","v":"7.1.3.3"},{"$f":"All!G561","v":0},{"$f":"All!H561","v":0},{"$f":"All!I561","v":"7.1.3.3.2"},{"$f":"All!J561","v":"7.1.3.3.2: Does the system hold funds in a reserved state while investigations are conducted?\n"},{"$f":"All!K561","v":0},{"$f":"All!L561","v":0},{"$f":"All!M561","v":"Recommended"},{"$f":"All!N561","v":"Recommended"},{"$f":"All!O561","v":"CustServ"},{"$f":"All!P561","v":0},{"$f":"All!Q561","v":0},{"$f":"All!R561","v":0},{"$f":"All!S561","v":0},{"$f":"All!T561","v":0},{"$f":"All!U561","v":0},{"$f":"All!V561","v":0},{"$f":"All!W561","v":0},{"$f":"All!X561","v":0},{"$f":"All!Y561","v":0},{"$f":"All!Z561","v":0},{"$f":"All!AA561","v":0},{"$f":"All!AB561","v":0},{"$f":"All!AC561","v":0},{"$f":"All!AD561","v":0},{"$f":"All!AE561","v":0},{"$f":"All!AF561","v":0},{"$f":"All!AG561","v":0},{"$f":"All!AH561","v":0},{"$f":"All!AI561","v":0},{"$f":"All!AJ561","v":0},{"$f":"All!AK561","v":0},{"$f":"All!AL561","v":0},{"$f":"All!AM561","v":0},{"$f":"All!AN561","v":0},{"$f":"All!AO561","v":0},{"$f":"All!AP561","v":0},{"$f":"All!AQ561","v":0},{"$f":"All!AR561","v":0},{"$f":"All!AS561","v":0},{"$f":"All!AT561","v":0}]
[null,{"$f":"All!B562","v":"7"},{"$f":"All!C562","v":"7.1"},{"$f":"All!D562","v":"7.1.3"},{"$f":"All!E562","v":""},{"$f":"All!F562","v":"7.1.3.3"},{"$f":"All!G562","v":0},{"$f":"All!H562","v":0},{"$f":"All!I562","v":"7.1.3.3.3"},{"$f":"All!J562","v":"7.1.3.3.3: Are mechanisms implemented to reduce the likelihood of mistakes requiring reversal (e.g. phone address book for customer; recipient name look-up and confirmation; making customer enter recipient’s number twice)?\n"},{"$f":"All!K562","v":0},{"$f":"All!L562","v":0},{"$f":"All!M562","v":"Recommended"},{"$f":"All!N562","v":"Recommended"},{"$f":"All!O562","v":"CustServ"},{"$f":"All!P562","v":0},{"$f":"All!Q562","v":0},{"$f":"All!R562","v":0},{"$f":"All!S562","v":0},{"$f":"All!T562","v":0},{"$f":"All!U562","v":0},{"$f":"All!V562","v":0},{"$f":"All!W562","v":0},{"$f":"All!X562","v":0},{"$f":"All!Y562","v":0},{"$f":"All!Z562","v":0},{"$f":"All!AA562","v":0},{"$f":"All!AB562","v":0},{"$f":"All!AC562","v":0},{"$f":"All!AD562","v":0},{"$f":"All!AE562","v":0},{"$f":"All!AF562","v":0},{"$f":"All!AG562","v":0},{"$f":"All!AH562","v":0},{"$f":"All!AI562","v":0},{"$f":"All!AJ562","v":0},{"$f":"All!AK562","v":0},{"$f":"All!AL562","v":0},{"$f":"All!AM562","v":0},{"$f":"All!AN562","v":0},{"$f":"All!AO562","v":0},{"$f":"All!AP562","v":0},{"$f":"All!AQ562","v":0},{"$f":"All!AR562","v":0},{"$f":"All!AS562","v":0},{"$f":"All!AT562","v":0}]
[null,{"$f":"All!B563","v":"7"},{"$f":"All!C563","v":"7.1"},{"$f":"All!D563","v":"7.1.3"},{"$f":"All!E563","v":""},{"$f":"All!F563","v":"7.1.3.4"},{"$f":"All!G563","v":"7.1.3.4: OFF-NET TRANSACTION REVERSALS\nProviders should develop additional controls for off-net reversals, including transactions with financial ecosystem partners such as other interoperable mobile money systems, international money transfer providers, banks, and ATM networks. \nThe following controls should be implemented:\n- A service-level agreement for responding to and resolving off-net reversals should be agreed with financial ecosystem partners;\n- Process for reversals and returning failed payments should be agreed with financial ecosystem partners. The process should include the role of a processor (hub/ clearing house), if used;\n- Process for determining the validity of reversal requests should be agreed with financial ecosystem partners, including details of which party will conduct investigations and how information and notifications will be shared. Depending on local regulation, providers may not be allowed to contact the customers of other providers, in which case a joint investigation process should be agreed;\n- Extending recipient name look-up functionality to include off-net customer name lookup for domestic interoperability; and\n- The system should hold funds in a reserved state for off-net transactions while investigations are conducted, particularly in the case of a dispute.\n"},{"$f":"All!H563","v":0},{"$f":"All!I563","v":"7.1.3.4.1"},{"$f":"All!J563","v":"7.1.3.4.1: Have detailed procedures been defined with each financial partner to accommodate off-net transaction reversals?\n"},{"$f":"All!K563","v":"1) Reversals business process\n- Check that detailed procedures have been defined with each financial partner to accommodate off-net transaction reversals.\n"},{"$f":"All!L563","v":0},{"$f":"All!M563","v":"Standard Required"},{"$f":"All!N563","v":"Required"},{"$f":"All!O563","v":"CustServ"},{"$f":"All!P563","v":0},{"$f":"All!Q563","v":0},{"$f":"All!R563","v":0},{"$f":"All!S563","v":0},{"$f":"All!T563","v":0},{"$f":"All!U563","v":0},{"$f":"All!V563","v":0},{"$f":"All!W563","v":0},{"$f":"All!X563","v":0},{"$f":"All!Y563","v":0},{"$f":"All!Z563","v":0},{"$f":"All!AA563","v":0},{"$f":"All!AB563","v":0},{"$f":"All!AC563","v":0},{"$f":"All!AD563","v":0},{"$f":"All!AE563","v":0},{"$f":"All!AF563","v":0},{"$f":"All!AG563","v":0},{"$f":"All!AH563","v":0},{"$f":"All!AI563","v":0},{"$f":"All!AJ563","v":0},{"$f":"All!AK563","v":0},{"$f":"All!AL563","v":0},{"$f":"All!AM563","v":0},{"$f":"All!AN563","v":0},{"$f":"All!AO563","v":0},{"$f":"All!AP563","v":0},{"$f":"All!AQ563","v":0},{"$f":"All!AR563","v":0},{"$f":"All!AS563","v":0},{"$f":"All!AT563","v":0}]
[null,{"$f":"All!B564","v":"7"},{"$f":"All!C564","v":"7.1"},{"$f":"All!D564","v":"7.1.3"},{"$f":"All!E564","v":""},{"$f":"All!F564","v":"7.1.3.4"},{"$f":"All!G564","v":0},{"$f":"All!H564","v":0},{"$f":"All!I564","v":"7.1.3.4.2"},{"$f":"All!J564","v":"7.1.3.4.2: Has a service-level agreement for responding to and resolving off-net reversals been agreed with each financial ecosystem partner?\n"},{"$f":"All!K564","v":"1) Reversals business process\n- Check that there is a service level agreement for responding to and resolving off-net reversals\n- Check that this has been agreed with ecosystem partners"},{"$f":"All!L564","v":0},{"$f":"All!M564","v":"Standard Required"},{"$f":"All!N564","v":"Required"},{"$f":"All!O564","v":"CustServ"},{"$f":"All!P564","v":0},{"$f":"All!Q564","v":0},{"$f":"All!R564","v":0},{"$f":"All!S564","v":0},{"$f":"All!T564","v":0},{"$f":"All!U564","v":0},{"$f":"All!V564","v":0},{"$f":"All!W564","v":0},{"$f":"All!X564","v":0},{"$f":"All!Y564","v":0},{"$f":"All!Z564","v":0},{"$f":"All!AA564","v":0},{"$f":"All!AB564","v":0},{"$f":"All!AC564","v":0},{"$f":"All!AD564","v":0},{"$f":"All!AE564","v":0},{"$f":"All!AF564","v":0},{"$f":"All!AG564","v":0},{"$f":"All!AH564","v":0},{"$f":"All!AI564","v":0},{"$f":"All!AJ564","v":0},{"$f":"All!AK564","v":0},{"$f":"All!AL564","v":0},{"$f":"All!AM564","v":0},{"$f":"All!AN564","v":0},{"$f":"All!AO564","v":0},{"$f":"All!AP564","v":0},{"$f":"All!AQ564","v":0},{"$f":"All!AR564","v":0},{"$f":"All!AS564","v":0},{"$f":"All!AT564","v":0}]
[null,{"$f":"All!B565","v":"7"},{"$f":"All!C565","v":"7.1"},{"$f":"All!D565","v":"7.1.3"},{"$f":"All!E565","v":""},{"$f":"All!F565","v":"7.1.3.4"},{"$f":"All!G565","v":0},{"$f":"All!H565","v":0},{"$f":"All!I565","v":"7.1.3.4.3"},{"$f":"All!J565","v":"7.1.3.4.3: Does the system hold funds in a reserved state for off-net transactions while investigations are conducted?\n"},{"$f":"All!K565","v":0},{"$f":"All!L565","v":0},{"$f":"All!M565","v":"Recommended"},{"$f":"All!N565","v":"Recommended"},{"$f":"All!O565","v":"CustServ"},{"$f":"All!P565","v":0},{"$f":"All!Q565","v":0},{"$f":"All!R565","v":0},{"$f":"All!S565","v":0},{"$f":"All!T565","v":0},{"$f":"All!U565","v":0},{"$f":"All!V565","v":0},{"$f":"All!W565","v":0},{"$f":"All!X565","v":0},{"$f":"All!Y565","v":0},{"$f":"All!Z565","v":0},{"$f":"All!AA565","v":0},{"$f":"All!AB565","v":0},{"$f":"All!AC565","v":0},{"$f":"All!AD565","v":0},{"$f":"All!AE565","v":0},{"$f":"All!AF565","v":0},{"$f":"All!AG565","v":0},{"$f":"All!AH565","v":0},{"$f":"All!AI565","v":0},{"$f":"All!AJ565","v":0},{"$f":"All!AK565","v":0},{"$f":"All!AL565","v":0},{"$f":"All!AM565","v":0},{"$f":"All!AN565","v":0},{"$f":"All!AO565","v":0},{"$f":"All!AP565","v":0},{"$f":"All!AQ565","v":0},{"$f":"All!AR565","v":0},{"$f":"All!AS565","v":0},{"$f":"All!AT565","v":0}]
[null,{"$f":"All!B566","v":"7"},{"$f":"All!C566","v":"7.1"},{"$f":"All!D566","v":"7.1.3"},{"$f":"All!E566","v":""},{"$f":"All!F566","v":"7.1.3.5"},{"$f":"All!G566","v":"7.1.3.5: MULTI-CURRENCY REVERSALS\nFor international money transfers (or domestic multi-currency transactions), there is a risk of currency fluctuations during the period between the initial transaction and the reversal. Options for mitigating this include:\n- Use of a third party to manage currency exchange and ensuring that this party bears the risk of exchange rate fluctuations during reversals;\n- Passing the risk of currency fluctuations on to the customer in case of reversals (if clearly stated in the T&Cs); and\n- Including sufficient exchange rate margin to allow for fluctuations in the case of reversals."},{"$f":"All!H566","v":0},{"$f":"All!I566","v":"7.1.3.5.1"},{"$f":"All!J566","v":"7.1.3.5.1: For international money transfers (or domestic multi-currency transactions), have steps been taken to mitigate exchange rate risk (i.e. currency fluctuations during the period between the initial transaction and the reversal)?\n"},{"$f":"All!K566","v":0},{"$f":"All!L566","v":0},{"$f":"All!M566","v":"Recommended"},{"$f":"All!N566","v":"Recommended"},{"$f":"All!O566","v":"CustServ"},{"$f":"All!P566","v":0},{"$f":"All!Q566","v":0},{"$f":"All!R566","v":0},{"$f":"All!S566","v":0},{"$f":"All!T566","v":0},{"$f":"All!U566","v":0},{"$f":"All!V566","v":0},{"$f":"All!W566","v":0},{"$f":"All!X566","v":0},{"$f":"All!Y566","v":0},{"$f":"All!Z566","v":0},{"$f":"All!AA566","v":0},{"$f":"All!AB566","v":0},{"$f":"All!AC566","v":0},{"$f":"All!AD566","v":0},{"$f":"All!AE566","v":0},{"$f":"All!AF566","v":0},{"$f":"All!AG566","v":0},{"$f":"All!AH566","v":0},{"$f":"All!AI566","v":0},{"$f":"All!AJ566","v":0},{"$f":"All!AK566","v":0},{"$f":"All!AL566","v":0},{"$f":"All!AM566","v":0},{"$f":"All!AN566","v":0},{"$f":"All!AO566","v":0},{"$f":"All!AP566","v":0},{"$f":"All!AQ566","v":0},{"$f":"All!AR566","v":0},{"$f":"All!AS566","v":0},{"$f":"All!AT566","v":0}]
[null,{"$f":"All!B567","v":"7"},{"$f":"All!C567","v":"7.1"},{"$f":"All!D567","v":"7.1.3"},{"$f":"All!E567","v":""},{"$f":"All!F567","v":"7.1.3.6"},{"$f":"All!G567","v":"7.1.3.6: CUSTOMER AWARENESS OF TRANSACTION REVERSALS\nProviders should inform customers of the rules governing transaction reversals, including:\n- how reversal requests may be initiated; \n- criteria for approving a reversal;\n- the list of reversible transactions (refer to 7.1.3.4);\n- reversal procedures and anticipated timeframes for investigating and resolving reversal requests;\n- conditions that apply to the refund of transaction fees in case of mistake or dispute; \n- customer recourse in the event that a transaction cannot be reversed because the funds are no longer in the recipient's wallet;\n- reversal procedures for merchant payment transactions (if applicable); \n- reversal procedures for bill payment transactions (if applicable); \n- reversal procedures for off-net transactions (if applicable), including information on:\n     - The expected timescale for resolution;\n     - Potential outcomes; and\n     - Any limitations on the scope of any reversal due to its being an off-net transaction.\n\nThe information on the rules governing transaction reversals should be made clear to customers through the T&Cs or on request from agents or customer care."},{"$f":"All!H567","v":0},{"$f":"All!I567","v":"7.1.3.6.1"},{"$f":"All!J567","v":"7.1.3.6.1: Is information on how and when transactions can be reversed made clear to customers through the T&Cs or available on request from agents or customer care?\n"},{"$f":"All!K567","v":"1) Customer T&Cs and/or agent point of sale materials\n- Check how and when transactions can be reversed are included in the T&Cs or available on request from agents or customer care.\n- Check it is set out in clear language."},{"$f":"All!L567","v":0},{"$f":"All!M567","v":"Urgent Required"},{"$f":"All!N567","v":"Required"},{"$f":"All!O567","v":"CustServ"},{"$f":"All!P567","v":0},{"$f":"All!Q567","v":0},{"$f":"All!R567","v":0},{"$f":"All!S567","v":0},{"$f":"All!T567","v":0},{"$f":"All!U567","v":0},{"$f":"All!V567","v":0},{"$f":"All!W567","v":0},{"$f":"All!X567","v":0},{"$f":"All!Y567","v":0},{"$f":"All!Z567","v":0},{"$f":"All!AA567","v":0},{"$f":"All!AB567","v":0},{"$f":"All!AC567","v":0},{"$f":"All!AD567","v":0},{"$f":"All!AE567","v":0},{"$f":"All!AF567","v":0},{"$f":"All!AG567","v":0},{"$f":"All!AH567","v":0},{"$f":"All!AI567","v":0},{"$f":"All!AJ567","v":0},{"$f":"All!AK567","v":0},{"$f":"All!AL567","v":0},{"$f":"All!AM567","v":0},{"$f":"All!AN567","v":0},{"$f":"All!AO567","v":0},{"$f":"All!AP567","v":0},{"$f":"All!AQ567","v":0},{"$f":"All!AR567","v":0},{"$f":"All!AS567","v":0},{"$f":"All!AT567","v":0}]
[null,{"$f":"All!B568","v":"7"},{"$f":"All!C568","v":"7.2"},{"$f":"All!D568","v":"7.2.1"},{"$f":"All!E568","v":"7.2.1: Providers shall provide an appropriate mechanism to address customers' questions and problems"},{"$f":"All!F568","v":"7.2.1.1"},{"$f":"All!G568","v":"7.2.1.1: ACCESS TO DEDICATED CUSTOMER SUPPORT\nProviders should have a customer care team dedicated to providing customer support for mobile money. A dedicated mobile money support team will be able to deal with the complexities and risks surrounding mobile money."},{"$f":"All!H568","v":0},{"$f":"All!I568","v":"7.2.1.1.1"},{"$f":"All!J568","v":"7.2.1.1.1: Is there a dedicated mobile money support team (not shared with other telco customer support)\n"},{"$f":"All!K568","v":0},{"$f":"All!L568","v":0},{"$f":"All!M568","v":"Recommended"},{"$f":"All!N568","v":"Recommended"},{"$f":"All!O568","v":"CustServ"},{"$f":"All!P568","v":0},{"$f":"All!Q568","v":0},{"$f":"All!R568","v":0},{"$f":"All!S568","v":0},{"$f":"All!T568","v":0},{"$f":"All!U568","v":0},{"$f":"All!V568","v":0},{"$f":"All!W568","v":0},{"$f":"All!X568","v":0},{"$f":"All!Y568","v":0},{"$f":"All!Z568","v":0},{"$f":"All!AA568","v":0},{"$f":"All!AB568","v":0},{"$f":"All!AC568","v":0},{"$f":"All!AD568","v":0},{"$f":"All!AE568","v":0},{"$f":"All!AF568","v":0},{"$f":"All!AG568","v":0},{"$f":"All!AH568","v":0},{"$f":"All!AI568","v":0},{"$f":"All!AJ568","v":0},{"$f":"All!AK568","v":0},{"$f":"All!AL568","v":0},{"$f":"All!AM568","v":0},{"$f":"All!AN568","v":0},{"$f":"All!AO568","v":0},{"$f":"All!AP568","v":0},{"$f":"All!AQ568","v":0},{"$f":"All!AR568","v":0},{"$f":"All!AS568","v":0},{"$f":"All!AT568","v":0}]
[null,{"$f":"All!B569","v":"7"},{"$f":"All!C569","v":"7.2"},{"$f":"All!D569","v":"7.2.1"},{"$f":"All!E569","v":0},{"$f":"All!F569","v":"7.2.1.2"},{"$f":"All!G569","v":"7.2.1.2: ADDRESSING COMPLEX OR HIGH-RISK ISSUES \nComplex and/or high-risk issues requiring more detailed support should be addressed by a second-level customer service team which has more in-depth training. Examples of complex issues could include transaction errors, bulk payments or complaint escalations."},{"$f":"All!H569","v":0},{"$f":"All!I569","v":"7.2.1.2.1"},{"$f":"All!J569","v":"7.2.1.2.1: Does the provider's customer care capability include a second level of support trained to deal with complex and/or high-risk issues?\n"},{"$f":"All!K569","v":"1) Customer service organization chart / customer service process documentation / customer service training plan\n- Check there is a process to escalete complex and/or high-risk issues to second level of customer care\n- Check that the chart includes a second level of customer care that deals with complex and/or high-risk issues \n- Check that the second level of customer service receive additional training to manage complex and/or high-risk issues"},{"$f":"All!L569","v":0},{"$f":"All!M569","v":"Standard Required"},{"$f":"All!N569","v":"Required"},{"$f":"All!O569","v":"CustServ"},{"$f":"All!P569","v":0},{"$f":"All!Q569","v":0},{"$f":"All!R569","v":0},{"$f":"All!S569","v":0},{"$f":"All!T569","v":0},{"$f":"All!U569","v":0},{"$f":"All!V569","v":0},{"$f":"All!W569","v":0},{"$f":"All!X569","v":0},{"$f":"All!Y569","v":0},{"$f":"All!Z569","v":0},{"$f":"All!AA569","v":0},{"$f":"All!AB569","v":0},{"$f":"All!AC569","v":0},{"$f":"All!AD569","v":0},{"$f":"All!AE569","v":0},{"$f":"All!AF569","v":0},{"$f":"All!AG569","v":0},{"$f":"All!AH569","v":0},{"$f":"All!AI569","v":0},{"$f":"All!AJ569","v":0},{"$f":"All!AK569","v":0},{"$f":"All!AL569","v":0},{"$f":"All!AM569","v":0},{"$f":"All!AN569","v":0},{"$f":"All!AO569","v":0},{"$f":"All!AP569","v":0},{"$f":"All!AQ569","v":0},{"$f":"All!AR569","v":0},{"$f":"All!AS569","v":0},{"$f":"All!AT569","v":0}]
[null,{"$f":"All!B570","v":"7"},{"$f":"All!C570","v":"7.2"},{"$f":"All!D570","v":"7.2.1"},{"$f":"All!E570","v":0},{"$f":"All!F570","v":"7.2.1.3"},{"$f":"All!G570","v":"7.2.1.3: CLOSING MOBILE MONEY ACCOUNTS\nCustomers should be able to close their mobile money accounts and withdraw all remaining funds using one or more convenient mechanisms such as the following:\n- self-help, using tools available within the mobile money service;\n- with assistance from customer care personnel; and/or\n- at agents or other retail outlets.\n\nProviders should also have formal procedures in place for closing a relative’s account in case of death. "},{"$f":"All!H570","v":0},{"$f":"All!I570","v":"7.2.1.3.1"},{"$f":"All!J570","v":"7.2.1.3.1: Are customers able to close their mobile money accounts and withdraw all remaining funds using one or more convenient mechanisms?\n"},{"$f":"All!K570","v":0},{"$f":"All!L570","v":0},{"$f":"All!M570","v":"Recommended"},{"$f":"All!N570","v":"Recommended"},{"$f":"All!O570","v":"CustServ"},{"$f":"All!P570","v":0},{"$f":"All!Q570","v":0},{"$f":"All!R570","v":0},{"$f":"All!S570","v":0},{"$f":"All!T570","v":0},{"$f":"All!U570","v":0},{"$f":"All!V570","v":0},{"$f":"All!W570","v":0},{"$f":"All!X570","v":0},{"$f":"All!Y570","v":0},{"$f":"All!Z570","v":0},{"$f":"All!AA570","v":0},{"$f":"All!AB570","v":0},{"$f":"All!AC570","v":0},{"$f":"All!AD570","v":0},{"$f":"All!AE570","v":0},{"$f":"All!AF570","v":0},{"$f":"All!AG570","v":0},{"$f":"All!AH570","v":0},{"$f":"All!AI570","v":0},{"$f":"All!AJ570","v":0},{"$f":"All!AK570","v":0},{"$f":"All!AL570","v":0},{"$f":"All!AM570","v":0},{"$f":"All!AN570","v":0},{"$f":"All!AO570","v":0},{"$f":"All!AP570","v":0},{"$f":"All!AQ570","v":0},{"$f":"All!AR570","v":0},{"$f":"All!AS570","v":0},{"$f":"All!AT570","v":0}]
[null,{"$f":"All!B571","v":"7"},{"$f":"All!C571","v":"7.2"},{"$f":"All!D571","v":"7.2.1"},{"$f":"All!E571","v":0},{"$f":"All!F571","v":"7.2.1.3"},{"$f":"All!G571","v":0},{"$f":"All!H571","v":0},{"$f":"All!I571","v":"7.2.1.3.2"},{"$f":"All!J571","v":"7.2.1.3.2: Are formal procedures in place for closing a relative’s account in case of death?\n"},{"$f":"All!K571","v":0},{"$f":"All!L571","v":0},{"$f":"All!M571","v":"Recommended"},{"$f":"All!N571","v":"Recommended"},{"$f":"All!O571","v":"CustServ"},{"$f":"All!P571","v":0},{"$f":"All!Q571","v":0},{"$f":"All!R571","v":0},{"$f":"All!S571","v":0},{"$f":"All!T571","v":0},{"$f":"All!U571","v":0},{"$f":"All!V571","v":0},{"$f":"All!W571","v":0},{"$f":"All!X571","v":0},{"$f":"All!Y571","v":0},{"$f":"All!Z571","v":0},{"$f":"All!AA571","v":0},{"$f":"All!AB571","v":0},{"$f":"All!AC571","v":0},{"$f":"All!AD571","v":0},{"$f":"All!AE571","v":0},{"$f":"All!AF571","v":0},{"$f":"All!AG571","v":0},{"$f":"All!AH571","v":0},{"$f":"All!AI571","v":0},{"$f":"All!AJ571","v":0},{"$f":"All!AK571","v":0},{"$f":"All!AL571","v":0},{"$f":"All!AM571","v":0},{"$f":"All!AN571","v":0},{"$f":"All!AO571","v":0},{"$f":"All!AP571","v":0},{"$f":"All!AQ571","v":0},{"$f":"All!AR571","v":0},{"$f":"All!AS571","v":0},{"$f":"All!AT571","v":0}]
[null,{"$f":"All!B572","v":"7"},{"$f":"All!C572","v":"7.2"},{"$f":"All!D572","v":"7.2.1"},{"$f":"All!E572","v":0},{"$f":"All!F572","v":"7.2.1.4"},{"$f":"All!G572","v":"7.2.1.4: ACCESS TO ALL NECESSARY CUSTOMER DATA\nProviders should ensure that customer care personnel have access to relevant customer data, including transaction details and notes from previous contact with the provider. \n\nCustomers should not be required to repeat the details of issues unnecessarily when they need to contact customer care personnel more than once or are passed from one customer care team to another.\n\nTo facilitate this, each customer should be assigned a reference/ticket number for their call, and this number should be shared with customers."},{"$f":"All!H572","v":0},{"$f":"All!I572","v":"7.2.1.4.1"},{"$f":"All!J572","v":"7.2.1.4.1: Do customer care personnel have access to relevant customer data, including transaction details and notes from previous contact with the provider?\n"},{"$f":"All!K572","v":"1) Customer service system - customer service screens\n- Check customer care personnel have access to customer information, including transaction details and notes from previous contact with the provider.\n[Notes from previous calls could be tracked manually]"},{"$f":"All!L572","v":0},{"$f":"All!M572","v":"Standard Required"},{"$f":"All!N572","v":"Required"},{"$f":"All!O572","v":"CustServ"},{"$f":"All!P572","v":0},{"$f":"All!Q572","v":0},{"$f":"All!R572","v":0},{"$f":"All!S572","v":0},{"$f":"All!T572","v":0},{"$f":"All!U572","v":0},{"$f":"All!V572","v":0},{"$f":"All!W572","v":0},{"$f":"All!X572","v":0},{"$f":"All!Y572","v":0},{"$f":"All!Z572","v":0},{"$f":"All!AA572","v":0},{"$f":"All!AB572","v":0},{"$f":"All!AC572","v":0},{"$f":"All!AD572","v":0},{"$f":"All!AE572","v":0},{"$f":"All!AF572","v":0},{"$f":"All!AG572","v":0},{"$f":"All!AH572","v":0},{"$f":"All!AI572","v":0},{"$f":"All!AJ572","v":0},{"$f":"All!AK572","v":0},{"$f":"All!AL572","v":0},{"$f":"All!AM572","v":0},{"$f":"All!AN572","v":0},{"$f":"All!AO572","v":0},{"$f":"All!AP572","v":0},{"$f":"All!AQ572","v":0},{"$f":"All!AR572","v":0},{"$f":"All!AS572","v":0},{"$f":"All!AT572","v":0}]
[null,{"$f":"All!B573","v":"7"},{"$f":"All!C573","v":"7.2"},{"$f":"All!D573","v":"7.2.1"},{"$f":"All!E573","v":0},{"$f":"All!F573","v":"7.2.1.4"},{"$f":"All!G573","v":0},{"$f":"All!H573","v":0},{"$f":"All!I573","v":"7.2.1.4.2"},{"$f":"All!J573","v":"7.2.1.4.2: Are mechanisms in place to avoid requiring customers to repeat the details of issues unnecessarily when they need to contact customer care personnel more than once or are passed from one customer care team to another (such as assigning a reference/ticket number to each call by a customer)?\n"},{"$f":"All!K573","v":0},{"$f":"All!L573","v":0},{"$f":"All!M573","v":"Recommended"},{"$f":"All!N573","v":"Recommended"},{"$f":"All!O573","v":"CustServ"},{"$f":"All!P573","v":0},{"$f":"All!Q573","v":0},{"$f":"All!R573","v":0},{"$f":"All!S573","v":0},{"$f":"All!T573","v":0},{"$f":"All!U573","v":0},{"$f":"All!V573","v":0},{"$f":"All!W573","v":0},{"$f":"All!X573","v":0},{"$f":"All!Y573","v":0},{"$f":"All!Z573","v":0},{"$f":"All!AA573","v":0},{"$f":"All!AB573","v":0},{"$f":"All!AC573","v":0},{"$f":"All!AD573","v":0},{"$f":"All!AE573","v":0},{"$f":"All!AF573","v":0},{"$f":"All!AG573","v":0},{"$f":"All!AH573","v":0},{"$f":"All!AI573","v":0},{"$f":"All!AJ573","v":0},{"$f":"All!AK573","v":0},{"$f":"All!AL573","v":0},{"$f":"All!AM573","v":0},{"$f":"All!AN573","v":0},{"$f":"All!AO573","v":0},{"$f":"All!AP573","v":0},{"$f":"All!AQ573","v":0},{"$f":"All!AR573","v":0},{"$f":"All!AS573","v":0},{"$f":"All!AT573","v":0}]
[null,{"$f":"All!B574","v":"7"},{"$f":"All!C574","v":"7.2"},{"$f":"All!D574","v":"7.2.1"},{"$f":"All!E574","v":0},{"$f":"All!F574","v":"7.2.1.5"},{"$f":"All!G574","v":"7.2.1.5: AVAILABILITY OF CUSTOMER CARE SUPPORT\nProviders should ensure that customer care personnel are available during business hours at minimum and ideally 24 hours a day, 7 days a week. \n\nSecond-level customer service staff who address complex and/or high-risk issues (see 7.2.1.2) should be available during business hours, at a minimum."},{"$f":"All!H574","v":0},{"$f":"All!I574","v":"7.2.1.5.1"},{"$f":"All!J574","v":"7.2.1.5.1: Are customer care personnel available 24 hours a day, 7 days a week?\n"},{"$f":"All!K574","v":0},{"$f":"All!L574","v":0},{"$f":"All!M574","v":"Recommended"},{"$f":"All!N574","v":"Recommended"},{"$f":"All!O574","v":"CustServ"},{"$f":"All!P574","v":0},{"$f":"All!Q574","v":0},{"$f":"All!R574","v":0},{"$f":"All!S574","v":0},{"$f":"All!T574","v":0},{"$f":"All!U574","v":0},{"$f":"All!V574","v":0},{"$f":"All!W574","v":0},{"$f":"All!X574","v":0},{"$f":"All!Y574","v":0},{"$f":"All!Z574","v":0},{"$f":"All!AA574","v":0},{"$f":"All!AB574","v":0},{"$f":"All!AC574","v":0},{"$f":"All!AD574","v":0},{"$f":"All!AE574","v":0},{"$f":"All!AF574","v":0},{"$f":"All!AG574","v":0},{"$f":"All!AH574","v":0},{"$f":"All!AI574","v":0},{"$f":"All!AJ574","v":0},{"$f":"All!AK574","v":0},{"$f":"All!AL574","v":0},{"$f":"All!AM574","v":0},{"$f":"All!AN574","v":0},{"$f":"All!AO574","v":0},{"$f":"All!AP574","v":0},{"$f":"All!AQ574","v":0},{"$f":"All!AR574","v":0},{"$f":"All!AS574","v":0},{"$f":"All!AT574","v":0}]
[null,{"$f":"All!B575","v":"7"},{"$f":"All!C575","v":"7.2"},{"$f":"All!D575","v":"7.2.1"},{"$f":"All!E575","v":0},{"$f":"All!F575","v":"7.2.1.5"},{"$f":"All!G575","v":0},{"$f":"All!H575","v":0},{"$f":"All!I575","v":"7.2.1.5.2"},{"$f":"All!J575","v":"7.2.1.5.2: Are first- and  second-level customer service staff available during business hours, at a minimum?\n"},{"$f":"All!K575","v":"1) Customer service process documentation\n- Check the working times of the first- and second-level customer support staff cover standard business hours at a minimum."},{"$f":"All!L575","v":0},{"$f":"All!M575","v":"Standard Required"},{"$f":"All!N575","v":"Required"},{"$f":"All!O575","v":"CustServ"},{"$f":"All!P575","v":0},{"$f":"All!Q575","v":0},{"$f":"All!R575","v":0},{"$f":"All!S575","v":0},{"$f":"All!T575","v":0},{"$f":"All!U575","v":0},{"$f":"All!V575","v":0},{"$f":"All!W575","v":0},{"$f":"All!X575","v":0},{"$f":"All!Y575","v":0},{"$f":"All!Z575","v":0},{"$f":"All!AA575","v":0},{"$f":"All!AB575","v":0},{"$f":"All!AC575","v":0},{"$f":"All!AD575","v":0},{"$f":"All!AE575","v":0},{"$f":"All!AF575","v":0},{"$f":"All!AG575","v":0},{"$f":"All!AH575","v":0},{"$f":"All!AI575","v":0},{"$f":"All!AJ575","v":0},{"$f":"All!AK575","v":0},{"$f":"All!AL575","v":0},{"$f":"All!AM575","v":0},{"$f":"All!AN575","v":0},{"$f":"All!AO575","v":0},{"$f":"All!AP575","v":0},{"$f":"All!AQ575","v":0},{"$f":"All!AR575","v":0},{"$f":"All!AS575","v":0},{"$f":"All!AT575","v":0}]
[null,{"$f":"All!B576","v":"7"},{"$f":"All!C576","v":"7.2"},{"$f":"All!D576","v":"7.2.1"},{"$f":"All!E576","v":0},{"$f":"All!F576","v":"7.2.1.6"},{"$f":"All!G576","v":"7.2.1.6: ACCESS TO CUSTOMER CARE IN DIFFERENT LANGUAGES\nWhere feasible, customer care support should be available in the official language(s) and/or other commonly spoken languages (including regional languages) for all stages of the complaints process.\n\nNOTE:  It may not be feasible or commercially sustainable to provide customer care support in all official languages and/or other commonly spoken languages for all stages of the complaints process. Where feasible and commercially sustainable, however, providers should make a reasonable effort to communicate in languages that can be comprehended by people from different regions and with varying levels of education.\n"},{"$f":"All!H576","v":0},{"$f":"All!I576","v":"7.2.1.6.1"},{"$f":"All!J576","v":"7.2.1.6.1: Do customers have access to customer care personnel who speak all official languages and/or commonly-spoken languages (including regional languages) for all stages of the complaints process?\n"},{"$f":"All!K576","v":0},{"$f":"All!L576","v":0},{"$f":"All!M576","v":"Recommended"},{"$f":"All!N576","v":"Recommended"},{"$f":"All!O576","v":"CustServ"},{"$f":"All!P576","v":0},{"$f":"All!Q576","v":0},{"$f":"All!R576","v":0},{"$f":"All!S576","v":0},{"$f":"All!T576","v":0},{"$f":"All!U576","v":0},{"$f":"All!V576","v":0},{"$f":"All!W576","v":0},{"$f":"All!X576","v":0},{"$f":"All!Y576","v":0},{"$f":"All!Z576","v":0},{"$f":"All!AA576","v":0},{"$f":"All!AB576","v":0},{"$f":"All!AC576","v":0},{"$f":"All!AD576","v":0},{"$f":"All!AE576","v":0},{"$f":"All!AF576","v":0},{"$f":"All!AG576","v":0},{"$f":"All!AH576","v":0},{"$f":"All!AI576","v":0},{"$f":"All!AJ576","v":0},{"$f":"All!AK576","v":0},{"$f":"All!AL576","v":0},{"$f":"All!AM576","v":0},{"$f":"All!AN576","v":0},{"$f":"All!AO576","v":0},{"$f":"All!AP576","v":0},{"$f":"All!AQ576","v":0},{"$f":"All!AR576","v":0},{"$f":"All!AS576","v":0},{"$f":"All!AT576","v":0}]
[null,{"$f":"All!B577","v":"7"},{"$f":"All!C577","v":"7.2"},{"$f":"All!D577","v":"7.2.1"},{"$f":"All!E577","v":0},{"$f":"All!F577","v":"7.2.1.7"},{"$f":"All!G577","v":"7.2.1.7: SECURE COMMUNICATION WITH CUSTOMERS\nProviders should offer at least one secure channel for communicating with customers and addressing issues related to the use of the service (see definition). The choice of channel (e.g. call centre, in-person, secure messaging) should be appropriate for the target market. Providers should inform customers about this channel and explain that any other channels for communicating with the provider (such as e-mail) may not be secure.\n\nProviders should enable customers to verify that calls or messages from the provider are legitimate by using a published number or another reliable method to facilitate identification of the provider. This is an important action in tackling social engineering fraud."},{"$f":"All!H577","v":"ECB RSMP"},{"$f":"All!I577","v":"7.2.1.7.1"},{"$f":"All!J577","v":"7.2.1.7.1: Are customers advised of how to contact customer service securely (e.g. call centre, in-person, secure messaging) and that other channels (such as e-mail) may not be secure?\n"},{"$f":"All!K577","v":0},{"$f":"All!L577","v":0},{"$f":"All!M577","v":"Recommended"},{"$f":"All!N577","v":"Recommended"},{"$f":"All!O577","v":"CustServ"},{"$f":"All!P577","v":0},{"$f":"All!Q577","v":0},{"$f":"All!R577","v":0},{"$f":"All!S577","v":0},{"$f":"All!T577","v":0},{"$f":"All!U577","v":0},{"$f":"All!V577","v":0},{"$f":"All!W577","v":0},{"$f":"All!X577","v":0},{"$f":"All!Y577","v":0},{"$f":"All!Z577","v":0},{"$f":"All!AA577","v":0},{"$f":"All!AB577","v":0},{"$f":"All!AC577","v":0},{"$f":"All!AD577","v":0},{"$f":"All!AE577","v":0},{"$f":"All!AF577","v":0},{"$f":"All!AG577","v":0},{"$f":"All!AH577","v":0},{"$f":"All!AI577","v":0},{"$f":"All!AJ577","v":0},{"$f":"All!AK577","v":0},{"$f":"All!AL577","v":0},{"$f":"All!AM577","v":0},{"$f":"All!AN577","v":0},{"$f":"All!AO577","v":0},{"$f":"All!AP577","v":0},{"$f":"All!AQ577","v":0},{"$f":"All!AR577","v":0},{"$f":"All!AS577","v":0},{"$f":"All!AT577","v":0}]
[null,{"$f":"All!B578","v":"7"},{"$f":"All!C578","v":"7.2"},{"$f":"All!D578","v":"7.2.1"},{"$f":"All!E578","v":0},{"$f":"All!F578","v":"7.2.1.7"},{"$f":"All!G578","v":0},{"$f":"All!H578","v":0},{"$f":"All!I578","v":"7.2.1.7.2"},{"$f":"All!J578","v":"7.2.1.7.2: Does the provider enable customers to verify that calls / messages from the provider are legitimate by using a published number?\n"},{"$f":"All!K578","v":0},{"$f":"All!L578","v":0},{"$f":"All!M578","v":"Recommended"},{"$f":"All!N578","v":"Recommended"},{"$f":"All!O578","v":"CustServ"},{"$f":"All!P578","v":0},{"$f":"All!Q578","v":0},{"$f":"All!R578","v":0},{"$f":"All!S578","v":0},{"$f":"All!T578","v":0},{"$f":"All!U578","v":0},{"$f":"All!V578","v":0},{"$f":"All!W578","v":0},{"$f":"All!X578","v":0},{"$f":"All!Y578","v":0},{"$f":"All!Z578","v":0},{"$f":"All!AA578","v":0},{"$f":"All!AB578","v":0},{"$f":"All!AC578","v":0},{"$f":"All!AD578","v":0},{"$f":"All!AE578","v":0},{"$f":"All!AF578","v":0},{"$f":"All!AG578","v":0},{"$f":"All!AH578","v":0},{"$f":"All!AI578","v":0},{"$f":"All!AJ578","v":0},{"$f":"All!AK578","v":0},{"$f":"All!AL578","v":0},{"$f":"All!AM578","v":0},{"$f":"All!AN578","v":0},{"$f":"All!AO578","v":0},{"$f":"All!AP578","v":0},{"$f":"All!AQ578","v":0},{"$f":"All!AR578","v":0},{"$f":"All!AS578","v":0},{"$f":"All!AT578","v":0}]
[null,{"$f":"All!B579","v":"7"},{"$f":"All!C579","v":"7.2"},{"$f":"All!D579","v":"7.2.1"},{"$f":"All!E579","v":0},{"$f":"All!F579","v":"7.2.1.8"},{"$f":"All!G579","v":"7.2.1.8: TESTING CUSTOMER SUPPORT\nProviders should test customer support (e.g., using mystery callers) for all possible customer complaints to ensure that customer care personnel, including the second-level customer service team (see 7.2.1.2), are able to address and resolve specific complaints and requests raised by customers. "},{"$f":"All!H579","v":0},{"$f":"All!I579","v":"7.2.1.8.1"},{"$f":"All!J579","v":"7.2.1.8.1: Has customer support been tested for all possible mobile money issues to ensure that customer care personnel are able to address and resolve specific complaints and requests raised by customers?\n"},{"$f":"All!K579","v":0},{"$f":"All!L579","v":0},{"$f":"All!M579","v":"Recommended"},{"$f":"All!N579","v":"Recommended"},{"$f":"All!O579","v":"CustServ"},{"$f":"All!P579","v":0},{"$f":"All!Q579","v":0},{"$f":"All!R579","v":0},{"$f":"All!S579","v":0},{"$f":"All!T579","v":0},{"$f":"All!U579","v":0},{"$f":"All!V579","v":0},{"$f":"All!W579","v":0},{"$f":"All!X579","v":0},{"$f":"All!Y579","v":0},{"$f":"All!Z579","v":0},{"$f":"All!AA579","v":0},{"$f":"All!AB579","v":0},{"$f":"All!AC579","v":0},{"$f":"All!AD579","v":0},{"$f":"All!AE579","v":0},{"$f":"All!AF579","v":0},{"$f":"All!AG579","v":0},{"$f":"All!AH579","v":0},{"$f":"All!AI579","v":0},{"$f":"All!AJ579","v":0},{"$f":"All!AK579","v":0},{"$f":"All!AL579","v":0},{"$f":"All!AM579","v":0},{"$f":"All!AN579","v":0},{"$f":"All!AO579","v":0},{"$f":"All!AP579","v":0},{"$f":"All!AQ579","v":0},{"$f":"All!AR579","v":0},{"$f":"All!AS579","v":0},{"$f":"All!AT579","v":0}]
[null,{"$f":"All!B580","v":"7"},{"$f":"All!C580","v":"7.3"},{"$f":"All!D580","v":"7.3.1"},{"$f":"All!E580","v":"7.3.1: Providers shall specify how disputes can be resolved if internal resolution fails"},{"$f":"All!F580","v":"7.3.1.1"},{"$f":"All!G580","v":"7.3.1.1: INFORM CUSTOMERS OF THEIR RIGHT TO EXTERNAL RECOURSE\nProviders should ensure that customers are informed of the external recourse options available to them if the provider's internal complaints and escalation process fails to resolve the complaint to the customer's satisfaction. External recourse should not be initiated by the customer until efforts to resolve the issue using the provider's internal complaint and dispute process has been exhausted. \n\nMechanisms for informing customers of external recourse could include:\n- awareness campaigns such as posters / advertising / bulk messaging.\n- training customer service second level support (team leaders / supervisors) to know about external recourse options and when to tell customers about them.\nNote: including external recourse options in customer Terms & Conditions is important but not sufficient on its own."},{"$f":"All!H580","v":0},{"$f":"All!I580","v":"7.3.1.1.1"},{"$f":"All!J580","v":"7.3.1.1.1: Are customers informed how and when to escalate complaints to external recourse after exhausting the provider's resolution process?\n"},{"$f":"All!K580","v":"1) Customer service training materials / posters/leaflets / advertising materials \nCheck that:\n- EITHER customers are made aware of external recourse options through awareness campaigns such as posters / advertising / bulk messaging.\n- OR customer service second level support (team leaders / supervisors) are trained to know about external recourse options and when to tell customers about them.\nNote: including external recourse options in T&Cs is not sufficient."},{"$f":"All!L580","v":0},{"$f":"All!M580","v":"Standard Required"},{"$f":"All!N580","v":"Required"},{"$f":"All!O580","v":"CustServ"},{"$f":"All!P580","v":0},{"$f":"All!Q580","v":0},{"$f":"All!R580","v":0},{"$f":"All!S580","v":0},{"$f":"All!T580","v":0},{"$f":"All!U580","v":0},{"$f":"All!V580","v":0},{"$f":"All!W580","v":0},{"$f":"All!X580","v":0},{"$f":"All!Y580","v":0},{"$f":"All!Z580","v":0},{"$f":"All!AA580","v":0},{"$f":"All!AB580","v":0},{"$f":"All!AC580","v":0},{"$f":"All!AD580","v":0},{"$f":"All!AE580","v":0},{"$f":"All!AF580","v":0},{"$f":"All!AG580","v":0},{"$f":"All!AH580","v":0},{"$f":"All!AI580","v":0},{"$f":"All!AJ580","v":0},{"$f":"All!AK580","v":0},{"$f":"All!AL580","v":0},{"$f":"All!AM580","v":0},{"$f":"All!AN580","v":0},{"$f":"All!AO580","v":0},{"$f":"All!AP580","v":0},{"$f":"All!AQ580","v":0},{"$f":"All!AR580","v":0},{"$f":"All!AS580","v":0},{"$f":"All!AT580","v":0}]
[null,{"$f":"All!B581","v":"7"},{"$f":"All!C581","v":"7.3"},{"$f":"All!D581","v":"7.3.1"},{"$f":"All!E581","v":0},{"$f":"All!F581","v":"7.3.1.1"},{"$f":"All!G581","v":0},{"$f":"All!H581","v":0},{"$f":"All!I581","v":"7.3.1.1.2"},{"$f":"All!J581","v":"7.3.1.1.2: Is a description of the external recourse options included in the customer contract,Terms & Conditions or other customer documentation?\n"},{"$f":"All!K581","v":0},{"$f":"All!L581","v":0},{"$f":"All!M581","v":"Recommended"},{"$f":"All!N581","v":"Recommended"},{"$f":"All!O581","v":"CustServ"},{"$f":"All!P581","v":0},{"$f":"All!Q581","v":0},{"$f":"All!R581","v":0},{"$f":"All!S581","v":0},{"$f":"All!T581","v":0},{"$f":"All!U581","v":0},{"$f":"All!V581","v":0},{"$f":"All!W581","v":0},{"$f":"All!X581","v":0},{"$f":"All!Y581","v":0},{"$f":"All!Z581","v":0},{"$f":"All!AA581","v":0},{"$f":"All!AB581","v":0},{"$f":"All!AC581","v":0},{"$f":"All!AD581","v":0},{"$f":"All!AE581","v":0},{"$f":"All!AF581","v":0},{"$f":"All!AG581","v":0},{"$f":"All!AH581","v":0},{"$f":"All!AI581","v":0},{"$f":"All!AJ581","v":0},{"$f":"All!AK581","v":0},{"$f":"All!AL581","v":0},{"$f":"All!AM581","v":0},{"$f":"All!AN581","v":0},{"$f":"All!AO581","v":0},{"$f":"All!AP581","v":0},{"$f":"All!AQ581","v":0},{"$f":"All!AR581","v":0},{"$f":"All!AS581","v":0},{"$f":"All!AT581","v":0}]
[null,{"$f":"All!B582","v":"7"},{"$f":"All!C582","v":"7.3"},{"$f":"All!D582","v":"7.3.1"},{"$f":"All!E582","v":0},{"$f":"All!F582","v":"7.3.1.2"},{"$f":"All!G582","v":"7.3.1.2: WHETHER CUSTOMERS CAN BRING LEGAL COUNSEL TO EXTERNAL DISPUTE PROCEEDINGS\nProviders should inform customers whether they may bring legal counsel and/or other assistance to any external dispute resolution proceeding.\n\nCustomer care personnel should be able to communicate this information to customers, and it should be included in the customer contract and/or Terms & Conditions."},{"$f":"All!H582","v":0},{"$f":"All!I582","v":"7.3.1.2.1"},{"$f":"All!J582","v":"7.3.1.2.1: Are customer care personnel trained to inform customers whether they may bring legal counsel and/or other assistance to any alternative dispute resolution proceeding?\n"},{"$f":"All!K582","v":0},{"$f":"All!L582","v":0},{"$f":"All!M582","v":"Recommended"},{"$f":"All!N582","v":"Recommended"},{"$f":"All!O582","v":"CustServ"},{"$f":"All!P582","v":0},{"$f":"All!Q582","v":0},{"$f":"All!R582","v":0},{"$f":"All!S582","v":0},{"$f":"All!T582","v":0},{"$f":"All!U582","v":0},{"$f":"All!V582","v":0},{"$f":"All!W582","v":0},{"$f":"All!X582","v":0},{"$f":"All!Y582","v":0},{"$f":"All!Z582","v":0},{"$f":"All!AA582","v":0},{"$f":"All!AB582","v":0},{"$f":"All!AC582","v":0},{"$f":"All!AD582","v":0},{"$f":"All!AE582","v":0},{"$f":"All!AF582","v":0},{"$f":"All!AG582","v":0},{"$f":"All!AH582","v":0},{"$f":"All!AI582","v":0},{"$f":"All!AJ582","v":0},{"$f":"All!AK582","v":0},{"$f":"All!AL582","v":0},{"$f":"All!AM582","v":0},{"$f":"All!AN582","v":0},{"$f":"All!AO582","v":0},{"$f":"All!AP582","v":0},{"$f":"All!AQ582","v":0},{"$f":"All!AR582","v":0},{"$f":"All!AS582","v":0},{"$f":"All!AT582","v":0}]
[null,{"$f":"All!B583","v":"7"},{"$f":"All!C583","v":"7.3"},{"$f":"All!D583","v":"7.3.1"},{"$f":"All!E583","v":0},{"$f":"All!F583","v":"7.3.1.2"},{"$f":"All!G583","v":0},{"$f":"All!H583","v":0},{"$f":"All!I583","v":"7.3.1.2.2"},{"$f":"All!J583","v":"7.3.1.2.2: Is information on whether customers may bring legal counsel and/or other assistance to any alternative dispute resolution proceeding included in the customer contract and/or Terms & Conditions?\n"},{"$f":"All!K583","v":0},{"$f":"All!L583","v":0},{"$f":"All!M583","v":"Recommended"},{"$f":"All!N583","v":"Recommended"},{"$f":"All!O583","v":"CustServ"},{"$f":"All!P583","v":0},{"$f":"All!Q583","v":0},{"$f":"All!R583","v":0},{"$f":"All!S583","v":0},{"$f":"All!T583","v":0},{"$f":"All!U583","v":0},{"$f":"All!V583","v":0},{"$f":"All!W583","v":0},{"$f":"All!X583","v":0},{"$f":"All!Y583","v":0},{"$f":"All!Z583","v":0},{"$f":"All!AA583","v":0},{"$f":"All!AB583","v":0},{"$f":"All!AC583","v":0},{"$f":"All!AD583","v":0},{"$f":"All!AE583","v":0},{"$f":"All!AF583","v":0},{"$f":"All!AG583","v":0},{"$f":"All!AH583","v":0},{"$f":"All!AI583","v":0},{"$f":"All!AJ583","v":0},{"$f":"All!AK583","v":0},{"$f":"All!AL583","v":0},{"$f":"All!AM583","v":0},{"$f":"All!AN583","v":0},{"$f":"All!AO583","v":0},{"$f":"All!AP583","v":0},{"$f":"All!AQ583","v":0},{"$f":"All!AR583","v":0},{"$f":"All!AS583","v":0},{"$f":"All!AT583","v":0}]
[null,{"$f":"All!B584","v":"7"},{"$f":"All!C584","v":"7.3"},{"$f":"All!D584","v":"7.3.1"},{"$f":"All!E584","v":0},{"$f":"All!F584","v":"7.3.1.3"},{"$f":"All!G584","v":"7.3.1.3: INFORM CUSTOMERS OF LIABILITY FOR COSTS\nIf applicable, providers should inform customers that the losing party in external recourse proceedings may be liable for some or all of the winning party's costs:\n - if the customer loses, the customer may be liable for some or all of the provider's legal fees and/or other expenses; and\n - if the provider loses, the provider may be liable for some or all of the customer's legal fees and/or other expenses.\n\nCustomer care personnel should be able to communicate this information to customers, and it should be included in the customer contract and/or Terms & Conditions.\n"},{"$f":"All!H584","v":0},{"$f":"All!I584","v":"7.3.1.3.1"},{"$f":"All!J584","v":"7.3.1.3.1: If applicable, are customer care personnel trained to inform customers that the losing party in external recourse proceedings may be liable for some or all of the winning party's costs?\n"},{"$f":"All!K584","v":0},{"$f":"All!L584","v":0},{"$f":"All!M584","v":"Recommended"},{"$f":"All!N584","v":"Recommended"},{"$f":"All!O584","v":"CustServ"},{"$f":"All!P584","v":0},{"$f":"All!Q584","v":0},{"$f":"All!R584","v":0},{"$f":"All!S584","v":0},{"$f":"All!T584","v":0},{"$f":"All!U584","v":0},{"$f":"All!V584","v":0},{"$f":"All!W584","v":0},{"$f":"All!X584","v":0},{"$f":"All!Y584","v":0},{"$f":"All!Z584","v":0},{"$f":"All!AA584","v":0},{"$f":"All!AB584","v":0},{"$f":"All!AC584","v":0},{"$f":"All!AD584","v":0},{"$f":"All!AE584","v":0},{"$f":"All!AF584","v":0},{"$f":"All!AG584","v":0},{"$f":"All!AH584","v":0},{"$f":"All!AI584","v":0},{"$f":"All!AJ584","v":0},{"$f":"All!AK584","v":0},{"$f":"All!AL584","v":0},{"$f":"All!AM584","v":0},{"$f":"All!AN584","v":0},{"$f":"All!AO584","v":0},{"$f":"All!AP584","v":0},{"$f":"All!AQ584","v":0},{"$f":"All!AR584","v":0},{"$f":"All!AS584","v":0},{"$f":"All!AT584","v":0}]
[null,{"$f":"All!B585","v":"7"},{"$f":"All!C585","v":"7.3"},{"$f":"All!D585","v":"7.3.1"},{"$f":"All!E585","v":0},{"$f":"All!F585","v":"7.3.1.3"},{"$f":"All!G585","v":0},{"$f":"All!H585","v":0},{"$f":"All!I585","v":"7.3.1.3.2"},{"$f":"All!J585","v":"7.3.1.3.2: Is information on liability for the legal costs of external recourse included in the customer contract and/or Terms & Conditions?\n"},{"$f":"All!K585","v":0},{"$f":"All!L585","v":0},{"$f":"All!M585","v":"Recommended"},{"$f":"All!N585","v":"Recommended"},{"$f":"All!O585","v":"CustServ"},{"$f":"All!P585","v":0},{"$f":"All!Q585","v":0},{"$f":"All!R585","v":0},{"$f":"All!S585","v":0},{"$f":"All!T585","v":0},{"$f":"All!U585","v":0},{"$f":"All!V585","v":0},{"$f":"All!W585","v":0},{"$f":"All!X585","v":0},{"$f":"All!Y585","v":0},{"$f":"All!Z585","v":0},{"$f":"All!AA585","v":0},{"$f":"All!AB585","v":0},{"$f":"All!AC585","v":0},{"$f":"All!AD585","v":0},{"$f":"All!AE585","v":0},{"$f":"All!AF585","v":0},{"$f":"All!AG585","v":0},{"$f":"All!AH585","v":0},{"$f":"All!AI585","v":0},{"$f":"All!AJ585","v":0},{"$f":"All!AK585","v":0},{"$f":"All!AL585","v":0},{"$f":"All!AM585","v":0},{"$f":"All!AN585","v":0},{"$f":"All!AO585","v":0},{"$f":"All!AP585","v":0},{"$f":"All!AQ585","v":0},{"$f":"All!AR585","v":0},{"$f":"All!AS585","v":0},{"$f":"All!AT585","v":0}]
[null,{"$f":"All!B586","v":"7"},{"$f":"All!C586","v":"7.3"},{"$f":"All!D586","v":"7.3.1"},{"$f":"All!E586","v":0},{"$f":"All!F586","v":"7.3.1.4"},{"$f":"All!G586","v":"7.3.1.4: TERMS OR CONDITIONS THAT AFFECT POSSIBILITY OF CUSTOMER SUCCESS IN EXTERNAL DISPUTE RESOLUTION\nProviders should inform customers of any terms or conditions that may affect the possibility of customer success in external dispute resolution proceedings. For example, the Terms & Conditions may include a clause stating that the provider is not liable for customer losses under certain circumstances (such as some instances of fraud).\n\nCustomer care personnel should be able to communicate this information to customers, and it should be included in the customer contract and/or Terms & Conditions."},{"$f":"All!H586","v":0},{"$f":"All!I586","v":"7.3.1.4.1"},{"$f":"All!J586","v":"7.3.1.4.1: Are customer care personnel trained to inform customers of any terms or conditions that may affect the possibility of customer success in external dispute resolution proceedings?\n"},{"$f":"All!K586","v":0},{"$f":"All!L586","v":0},{"$f":"All!M586","v":"Recommended"},{"$f":"All!N586","v":"Recommended"},{"$f":"All!O586","v":"CustServ"},{"$f":"All!P586","v":0},{"$f":"All!Q586","v":0},{"$f":"All!R586","v":0},{"$f":"All!S586","v":0},{"$f":"All!T586","v":0},{"$f":"All!U586","v":0},{"$f":"All!V586","v":0},{"$f":"All!W586","v":0},{"$f":"All!X586","v":0},{"$f":"All!Y586","v":0},{"$f":"All!Z586","v":0},{"$f":"All!AA586","v":0},{"$f":"All!AB586","v":0},{"$f":"All!AC586","v":0},{"$f":"All!AD586","v":0},{"$f":"All!AE586","v":0},{"$f":"All!AF586","v":0},{"$f":"All!AG586","v":0},{"$f":"All!AH586","v":0},{"$f":"All!AI586","v":0},{"$f":"All!AJ586","v":0},{"$f":"All!AK586","v":0},{"$f":"All!AL586","v":0},{"$f":"All!AM586","v":0},{"$f":"All!AN586","v":0},{"$f":"All!AO586","v":0},{"$f":"All!AP586","v":0},{"$f":"All!AQ586","v":0},{"$f":"All!AR586","v":0},{"$f":"All!AS586","v":0},{"$f":"All!AT586","v":0}]
[null,{"$f":"All!B587","v":"7"},{"$f":"All!C587","v":"7.3"},{"$f":"All!D587","v":"7.3.1"},{"$f":"All!E587","v":0},{"$f":"All!F587","v":"7.3.1.4"},{"$f":"All!G587","v":0},{"$f":"All!H587","v":0},{"$f":"All!I587","v":"7.3.1.4.2"},{"$f":"All!J587","v":"7.3.1.4.2: Is information on any terms or conditions that may affect the possibility of customer success in external dispute resolution proceedings included in the customer contract and/or Terms & Conditions?\n"},{"$f":"All!K587","v":0},{"$f":"All!L587","v":0},{"$f":"All!M587","v":"Recommended"},{"$f":"All!N587","v":"Recommended"},{"$f":"All!O587","v":"CustServ"},{"$f":"All!P587","v":0},{"$f":"All!Q587","v":0},{"$f":"All!R587","v":0},{"$f":"All!S587","v":0},{"$f":"All!T587","v":0},{"$f":"All!U587","v":0},{"$f":"All!V587","v":0},{"$f":"All!W587","v":0},{"$f":"All!X587","v":0},{"$f":"All!Y587","v":0},{"$f":"All!Z587","v":0},{"$f":"All!AA587","v":0},{"$f":"All!AB587","v":0},{"$f":"All!AC587","v":0},{"$f":"All!AD587","v":0},{"$f":"All!AE587","v":0},{"$f":"All!AF587","v":0},{"$f":"All!AG587","v":0},{"$f":"All!AH587","v":0},{"$f":"All!AI587","v":0},{"$f":"All!AJ587","v":0},{"$f":"All!AK587","v":0},{"$f":"All!AL587","v":0},{"$f":"All!AM587","v":0},{"$f":"All!AN587","v":0},{"$f":"All!AO587","v":0},{"$f":"All!AP587","v":0},{"$f":"All!AQ587","v":0},{"$f":"All!AR587","v":0},{"$f":"All!AS587","v":0},{"$f":"All!AT587","v":0}]
[null,{"$f":"All!B588","v":"8"},{"$f":"All!C588","v":"8.1"},{"$f":"All!D588","v":"8.1.1"},{"$f":"All!E588","v":"8.1.1: Providers shall comply with good practices and relevant regulations governing customer data privacy.\n"},{"$f":"All!F588","v":"8.1.1.1"},{"$f":"All!G588","v":"8.1.1.1: DATA PRIVACY POLICY\nProviders should define and implement a data privacy policy. The policy should, at minimum: \n- commit to fair usage of personal data;\n- commit to protection of personal data; \n- outline the approach to identifying and managing personal data (through IPAs and PIAs - see 8.1.1.3);\n- identify the approach for responding to data privacy breaches (8.1.1.7);\n- specify principles for data privacy rules of behaviour (8.1.1.4); and\n- define requirements for maintaining data quality (8.1.1.6).\n\nThe data privacy policy should be communicated to employees and entities providing outsourced services, as appropriate. The policy should take account of relevant laws and other regulatory mandates.\n\nData Privacy protects customers personal data from misuse by the provider or other parties. Personal Data is private information of a customer that is held by the provider. Examples include KYC data, identity data and credit history. \nMisuse of personal data could include:\n  - fraud on the customer's account - impersonation of the customer may be facilitated by the use of the customer's personal data;\n  - identity theft - false accounts could be opened in the customer's name using their personal data;\n  - unwanted marketing - the customer could be sent unwanted marketing material (phone calls, SMS messages, emails or letters)."},{"$f":"All!H588","v":0},{"$f":"All!I588","v":"8.1.1.1.1"},{"$f":"All!J588","v":"8.1.1.1.1: Does the provider have a data privacy policy that commits to fair usage and protection of personal data?\n"},{"$f":"All!K588","v":"1) Data privacy policy or data privacy rules of behaviour document\n- Check that the document includes a commitment to fair usage of personal data\n-Check that the document includes details of how personal data is protected"},{"$f":"All!L588","v":0},{"$f":"All!M588","v":"Standard Required"},{"$f":"All!N588","v":"Required"},{"$f":"All!O588","v":"BizOps"},{"$f":"All!P588","v":0},{"$f":"All!Q588","v":0},{"$f":"All!R588","v":0},{"$f":"All!S588","v":0},{"$f":"All!T588","v":0},{"$f":"All!U588","v":0},{"$f":"All!V588","v":0},{"$f":"All!W588","v":0},{"$f":"All!X588","v":0},{"$f":"All!Y588","v":0},{"$f":"All!Z588","v":0},{"$f":"All!AA588","v":0},{"$f":"All!AB588","v":0},{"$f":"All!AC588","v":0},{"$f":"All!AD588","v":0},{"$f":"All!AE588","v":0},{"$f":"All!AF588","v":0},{"$f":"All!AG588","v":0},{"$f":"All!AH588","v":0},{"$f":"All!AI588","v":0},{"$f":"All!AJ588","v":0},{"$f":"All!AK588","v":0},{"$f":"All!AL588","v":0},{"$f":"All!AM588","v":0},{"$f":"All!AN588","v":0},{"$f":"All!AO588","v":0},{"$f":"All!AP588","v":0},{"$f":"All!AQ588","v":0},{"$f":"All!AR588","v":0},{"$f":"All!AS588","v":0},{"$f":"All!AT588","v":0}]
[null,{"$f":"All!B589","v":"8"},{"$f":"All!C589","v":"8.1"},{"$f":"All!D589","v":"8.1.1"},{"$f":"All!E589","v":0},{"$f":"All!F589","v":"8.1.1.2"},{"$f":"All!G589","v":"8.1.1.2: ASSIGN RESPONSIBILITY FOR CUSTOMER DATA PRIVACY\nProviders should assign responsibility for overseeing the implementation of processes and technology to meet the data privacy policy. An individual or a team could be assigned this responsibility. If a team is assigned the responsibility for data privacy then the manager should be assigned overall responsibility.\n\nIn providers that are part of a group of companies, data privacy responsibility could be assigned at group level instead of in the local company.\n"},{"$f":"All!H589","v":"IS029100 4.2"},{"$f":"All!I589","v":"8.1.1.2.1"},{"$f":"All!J589","v":"8.1.1.2.1: Has responsibility been assigned for overseeing the implementation of the data privacy policy?\n"},{"$f":"All!K589","v":"1) Organisation chart indicating Data Privacy responsibility (could be group-level or local-level organization)\n- Check that the data protection responsibilities are included in the organisation chart or role/team description, including the responsibility for overseeing implementation of the data privacy policy.\n- If a team is assigned the responsibility for data privacy then check that the manager has been assigned overall responsibility. "},{"$f":"All!L589","v":0},{"$f":"All!M589","v":"Standard Required"},{"$f":"All!N589","v":"Required"},{"$f":"All!O589","v":"BizOps"},{"$f":"All!P589","v":0},{"$f":"All!Q589","v":0},{"$f":"All!R589","v":0},{"$f":"All!S589","v":0},{"$f":"All!T589","v":0},{"$f":"All!U589","v":0},{"$f":"All!V589","v":0},{"$f":"All!W589","v":0},{"$f":"All!X589","v":0},{"$f":"All!Y589","v":0},{"$f":"All!Z589","v":0},{"$f":"All!AA589","v":0},{"$f":"All!AB589","v":0},{"$f":"All!AC589","v":0},{"$f":"All!AD589","v":0},{"$f":"All!AE589","v":0},{"$f":"All!AF589","v":0},{"$f":"All!AG589","v":0},{"$f":"All!AH589","v":0},{"$f":"All!AI589","v":0},{"$f":"All!AJ589","v":0},{"$f":"All!AK589","v":0},{"$f":"All!AL589","v":0},{"$f":"All!AM589","v":0},{"$f":"All!AN589","v":0},{"$f":"All!AO589","v":0},{"$f":"All!AP589","v":0},{"$f":"All!AQ589","v":0},{"$f":"All!AR589","v":0},{"$f":"All!AS589","v":0},{"$f":"All!AT589","v":0}]
[null,{"$f":"All!B590","v":"8"},{"$f":"All!C590","v":"8.1"},{"$f":"All!D590","v":"8.1.1"},{"$f":"All!E590","v":0},{"$f":"All!F590","v":"8.1.1.3"},{"$f":"All!G590","v":"8.1.1.3: IDENTIFY ALL PERSONAL DATA AND MANAGE PRIVACY RISKS\nA data privacy assessment process should be implemented to manage data privacy risks. The process should include two key steps: an Initial Privacy Assessment (IPA) to identify personal data, and a Privacy Impact Assessment (PIA) to manage risks to personal data.\n\nThe Initial Privacy Assessment (IPA) should identify all personal data that is stored and processed in the mobile money system. Business, technical, security and risk management teams should collaborate to complete the IPA.\n\nThe Privacy Impact Assessment (PIA) determines and mitigates privacy risks during collection and processing of personal data, more specifically: \n- identifies risks associated with mobile money customers' data that is being held, considering how the data is stored and transmitted and the people that have access to it; and\n- identifies protection processes for handling customers' data to mitigate privacy risks.\n\nData privacy risks identified by the PIA should be entered into the mobile money risk matrix (see 4.6.1.2).\n\nIPAs and PIAs should be conducted whenever changes are made to the mobile money service or system."},{"$f":"All!H590","v":"NIST 4.2.2\nIS029100 4.5"},{"$f":"All!I590","v":"8.1.1.3.1"},{"$f":"All!J590","v":"8.1.1.3.1: Does the data privacy assessment process include steps to identify all personal data that is stored and processed by mobile money (i.e. an Initial Privacy Assessment - IPA)?\n"},{"$f":"All!K590","v":"1) Data privacy assessment process\n- Check that the provider has conducted steps to identify all personal data that is stored and processed by mobile money (initial privacy assessment (IPA) process).\n- Check that data that is processed and stored has been documented."},{"$f":"All!L590","v":0},{"$f":"All!M590","v":"Standard Required"},{"$f":"All!N590","v":"Required"},{"$f":"All!O590","v":"BizOps"},{"$f":"All!P590","v":0},{"$f":"All!Q590","v":0},{"$f":"All!R590","v":0},{"$f":"All!S590","v":0},{"$f":"All!T590","v":0},{"$f":"All!U590","v":0},{"$f":"All!V590","v":0},{"$f":"All!W590","v":0},{"$f":"All!X590","v":0},{"$f":"All!Y590","v":0},{"$f":"All!Z590","v":0},{"$f":"All!AA590","v":0},{"$f":"All!AB590","v":0},{"$f":"All!AC590","v":0},{"$f":"All!AD590","v":0},{"$f":"All!AE590","v":0},{"$f":"All!AF590","v":0},{"$f":"All!AG590","v":0},{"$f":"All!AH590","v":0},{"$f":"All!AI590","v":0},{"$f":"All!AJ590","v":0},{"$f":"All!AK590","v":0},{"$f":"All!AL590","v":0},{"$f":"All!AM590","v":0},{"$f":"All!AN590","v":0},{"$f":"All!AO590","v":0},{"$f":"All!AP590","v":0},{"$f":"All!AQ590","v":0},{"$f":"All!AR590","v":0},{"$f":"All!AS590","v":0},{"$f":"All!AT590","v":0}]
[null,{"$f":"All!B591","v":"8"},{"$f":"All!C591","v":"8.1"},{"$f":"All!D591","v":"8.1.1"},{"$f":"All!E591","v":0},{"$f":"All!F591","v":"8.1.1.3"},{"$f":"All!G591","v":0},{"$f":"All!H591","v":0},{"$f":"All!I591","v":"8.1.1.3.2"},{"$f":"All!J591","v":"8.1.1.3.2: Does the data privacy assessment process include steps to determine and mitigate risks to data privacy (i.e. a Privacy Impact Assessment - PIA)?\n"},{"$f":"All!K591","v":"1) Data privacy assessment process\n- Check that the provider has conducted a process to determine and mitigate risks to data privacy within mobile money (privacy impact assessment (PIA) process).\n- Check that the risks and mitigations have been documented."},{"$f":"All!L591","v":0},{"$f":"All!M591","v":"Standard Required"},{"$f":"All!N591","v":"Required"},{"$f":"All!O591","v":"BizOps"},{"$f":"All!P591","v":0},{"$f":"All!Q591","v":0},{"$f":"All!R591","v":0},{"$f":"All!S591","v":0},{"$f":"All!T591","v":0},{"$f":"All!U591","v":0},{"$f":"All!V591","v":0},{"$f":"All!W591","v":0},{"$f":"All!X591","v":0},{"$f":"All!Y591","v":0},{"$f":"All!Z591","v":0},{"$f":"All!AA591","v":0},{"$f":"All!AB591","v":0},{"$f":"All!AC591","v":0},{"$f":"All!AD591","v":0},{"$f":"All!AE591","v":0},{"$f":"All!AF591","v":0},{"$f":"All!AG591","v":0},{"$f":"All!AH591","v":0},{"$f":"All!AI591","v":0},{"$f":"All!AJ591","v":0},{"$f":"All!AK591","v":0},{"$f":"All!AL591","v":0},{"$f":"All!AM591","v":0},{"$f":"All!AN591","v":0},{"$f":"All!AO591","v":0},{"$f":"All!AP591","v":0},{"$f":"All!AQ591","v":0},{"$f":"All!AR591","v":0},{"$f":"All!AS591","v":0},{"$f":"All!AT591","v":0}]
[null,{"$f":"All!B592","v":"8"},{"$f":"All!C592","v":"8.1"},{"$f":"All!D592","v":"8.1.1"},{"$f":"All!E592","v":0},{"$f":"All!F592","v":"8.1.1.3"},{"$f":"All!G592","v":0},{"$f":"All!H592","v":0},{"$f":"All!I592","v":"8.1.1.3.3"},{"$f":"All!J592","v":"8.1.1.3.3: Are IPAs and PIAs conducted whenever changes are made to the mobile money service or system?\n"},{"$f":"All!K592","v":0},{"$f":"All!L592","v":0},{"$f":"All!M592","v":"Recommended"},{"$f":"All!N592","v":"Recommended"},{"$f":"All!O592","v":"BizOps"},{"$f":"All!P592","v":0},{"$f":"All!Q592","v":0},{"$f":"All!R592","v":0},{"$f":"All!S592","v":0},{"$f":"All!T592","v":0},{"$f":"All!U592","v":0},{"$f":"All!V592","v":0},{"$f":"All!W592","v":0},{"$f":"All!X592","v":0},{"$f":"All!Y592","v":0},{"$f":"All!Z592","v":0},{"$f":"All!AA592","v":0},{"$f":"All!AB592","v":0},{"$f":"All!AC592","v":0},{"$f":"All!AD592","v":0},{"$f":"All!AE592","v":0},{"$f":"All!AF592","v":0},{"$f":"All!AG592","v":0},{"$f":"All!AH592","v":0},{"$f":"All!AI592","v":0},{"$f":"All!AJ592","v":0},{"$f":"All!AK592","v":0},{"$f":"All!AL592","v":0},{"$f":"All!AM592","v":0},{"$f":"All!AN592","v":0},{"$f":"All!AO592","v":0},{"$f":"All!AP592","v":0},{"$f":"All!AQ592","v":0},{"$f":"All!AR592","v":0},{"$f":"All!AS592","v":0},{"$f":"All!AT592","v":0}]
[null,{"$f":"All!B593","v":"8"},{"$f":"All!C593","v":"8.1"},{"$f":"All!D593","v":"8.1.1"},{"$f":"All!E593","v":0},{"$f":"All!F593","v":"8.1.1.4"},{"$f":"All!G593","v":"8.1.1.4: DATA PRIVACY RULES OF BEHAVIOUR\nUsing the results of the IPA and PIA, the provider should define data privacy rules of behaviour, which define controls for the handling of personal data. The privacy rules of behaviour should include:\n- Access rules for personal data;\n- Limitations on the collection, disclosure, sharing, and use of personal data;\n- Personal data retention schedules and procedures;\n- Data privacy in the system development lifecycle process; and\n- Consequences for failure to follow privacy rules of behaviour."},{"$f":"All!H593","v":"NIST 4.1.1\nISO 29100:2011:2011 4.6"},{"$f":"All!I593","v":"8.1.1.4.1"},{"$f":"All!J593","v":"8.1.1.4.1: Has the provider defined data privacy rules of behaviour that govern access, collection, disclosure, sharing, retention, and use of personal data?\n"},{"$f":"All!K593","v":"1) Data privacy rules of behaviour document\n- Check that the document defines data privacy rules of behaviour that govern how personal data is:\na) Accessed\nb) Collected \nc) Disclosed \nd) Shared \ne) Retained \nf) Used"},{"$f":"All!L593","v":0},{"$f":"All!M593","v":"Standard Required"},{"$f":"All!N593","v":"Required"},{"$f":"All!O593","v":"BizOps"},{"$f":"All!P593","v":0},{"$f":"All!Q593","v":0},{"$f":"All!R593","v":0},{"$f":"All!S593","v":0},{"$f":"All!T593","v":0},{"$f":"All!U593","v":0},{"$f":"All!V593","v":0},{"$f":"All!W593","v":0},{"$f":"All!X593","v":0},{"$f":"All!Y593","v":0},{"$f":"All!Z593","v":0},{"$f":"All!AA593","v":0},{"$f":"All!AB593","v":0},{"$f":"All!AC593","v":0},{"$f":"All!AD593","v":0},{"$f":"All!AE593","v":0},{"$f":"All!AF593","v":0},{"$f":"All!AG593","v":0},{"$f":"All!AH593","v":0},{"$f":"All!AI593","v":0},{"$f":"All!AJ593","v":0},{"$f":"All!AK593","v":0},{"$f":"All!AL593","v":0},{"$f":"All!AM593","v":0},{"$f":"All!AN593","v":0},{"$f":"All!AO593","v":0},{"$f":"All!AP593","v":0},{"$f":"All!AQ593","v":0},{"$f":"All!AR593","v":0},{"$f":"All!AS593","v":0},{"$f":"All!AT593","v":0}]
[null,{"$f":"All!B594","v":"8"},{"$f":"All!C594","v":"8.1"},{"$f":"All!D594","v":"8.1.1"},{"$f":"All!E594","v":0},{"$f":"All!F594","v":"8.1.1.4"},{"$f":"All!G594","v":0},{"$f":"All!H594","v":0},{"$f":"All!I594","v":"8.1.1.4.2"},{"$f":"All!J594","v":"8.1.1.4.2: Do the data privacy rules of behaviour discuss consequences for failure to follow these rules?\n"},{"$f":"All!K594","v":0},{"$f":"All!L594","v":0},{"$f":"All!M594","v":"Recommended"},{"$f":"All!N594","v":"Recommended"},{"$f":"All!O594","v":"BizOps"},{"$f":"All!P594","v":0},{"$f":"All!Q594","v":0},{"$f":"All!R594","v":0},{"$f":"All!S594","v":0},{"$f":"All!T594","v":0},{"$f":"All!U594","v":0},{"$f":"All!V594","v":0},{"$f":"All!W594","v":0},{"$f":"All!X594","v":0},{"$f":"All!Y594","v":0},{"$f":"All!Z594","v":0},{"$f":"All!AA594","v":0},{"$f":"All!AB594","v":0},{"$f":"All!AC594","v":0},{"$f":"All!AD594","v":0},{"$f":"All!AE594","v":0},{"$f":"All!AF594","v":0},{"$f":"All!AG594","v":0},{"$f":"All!AH594","v":0},{"$f":"All!AI594","v":0},{"$f":"All!AJ594","v":0},{"$f":"All!AK594","v":0},{"$f":"All!AL594","v":0},{"$f":"All!AM594","v":0},{"$f":"All!AN594","v":0},{"$f":"All!AO594","v":0},{"$f":"All!AP594","v":0},{"$f":"All!AQ594","v":0},{"$f":"All!AR594","v":0},{"$f":"All!AS594","v":0},{"$f":"All!AT594","v":0}]
[null,{"$f":"All!B595","v":"8"},{"$f":"All!C595","v":"8.1"},{"$f":"All!D595","v":"8.1.1"},{"$f":"All!E595","v":0},{"$f":"All!F595","v":"8.1.1.5"},{"$f":"All!G595","v":"8.1.1.5: DATA PRIVACY POLICIES OF THIRD PARTIES\nWritten agreements governing data privacy should be in place with all third parties that either process personal data or have access to personal data. This includes:\n(1) processing or transfer of personal data through third party systems;\n(2) sharing of personal data with third parties such as financial ecosystem partners or entities providing outsourced services.\n\nRelevant third parties could include:\n - suppliers, such as technical platform provider or agent management company;\n - financial partners, such ATM providers and banks.\n\nThese agreements should cover:\n- the third party's responsibility to ensure data privacy;\n- restrictions on further sharing of personal data;\n- notification requirements in case of a breach."},{"$f":"All!H595","v":"NIST 4.1.1\nISO 29100:2011:2011 4.6"},{"$f":"All!I595","v":"8.1.1.5.1"},{"$f":"All!J595","v":"8.1.1.5.1: Where necessary, do agreements with external parties cover responsibilities for data privacy and restrictions on further sharing of personal data?\n"},{"$f":"All!K595","v":"1) Data privacy policy or data privacy rules of behaviour document\n- Check that the document requires data privacy responsibilities to be contractually assigned to third parties with data access.\n\n2) Sample agreement with an external party that has access to customer data\n- Check that the agreement includes the 3rd party's responsibility for ensuring data privacy.\n- Check that the agreement prevents further sharing of customer data."},{"$f":"All!L595","v":0},{"$f":"All!M595","v":"Standard Required"},{"$f":"All!N595","v":"Required"},{"$f":"All!O595","v":"BizOps"},{"$f":"All!P595","v":0},{"$f":"All!Q595","v":0},{"$f":"All!R595","v":0},{"$f":"All!S595","v":0},{"$f":"All!T595","v":0},{"$f":"All!U595","v":0},{"$f":"All!V595","v":0},{"$f":"All!W595","v":0},{"$f":"All!X595","v":0},{"$f":"All!Y595","v":0},{"$f":"All!Z595","v":0},{"$f":"All!AA595","v":0},{"$f":"All!AB595","v":0},{"$f":"All!AC595","v":0},{"$f":"All!AD595","v":0},{"$f":"All!AE595","v":0},{"$f":"All!AF595","v":0},{"$f":"All!AG595","v":0},{"$f":"All!AH595","v":0},{"$f":"All!AI595","v":0},{"$f":"All!AJ595","v":0},{"$f":"All!AK595","v":0},{"$f":"All!AL595","v":0},{"$f":"All!AM595","v":0},{"$f":"All!AN595","v":0},{"$f":"All!AO595","v":0},{"$f":"All!AP595","v":0},{"$f":"All!AQ595","v":0},{"$f":"All!AR595","v":0},{"$f":"All!AS595","v":0},{"$f":"All!AT595","v":0}]
[null,{"$f":"All!B596","v":"8"},{"$f":"All!C596","v":"8.1"},{"$f":"All!D596","v":"8.1.1"},{"$f":"All!E596","v":0},{"$f":"All!F596","v":"8.1.1.5"},{"$f":"All!G596","v":0},{"$f":"All!H596","v":0},{"$f":"All!I596","v":"8.1.1.5.2"},{"$f":"All!J596","v":"8.1.1.5.2: Do agreements with all external parties describe notification requirements in case of a breach?\n"},{"$f":"All!K596","v":0},{"$f":"All!L596","v":0},{"$f":"All!M596","v":"Recommended"},{"$f":"All!N596","v":"Recommended"},{"$f":"All!O596","v":"BizOps"},{"$f":"All!P596","v":0},{"$f":"All!Q596","v":0},{"$f":"All!R596","v":0},{"$f":"All!S596","v":0},{"$f":"All!T596","v":0},{"$f":"All!U596","v":0},{"$f":"All!V596","v":0},{"$f":"All!W596","v":0},{"$f":"All!X596","v":0},{"$f":"All!Y596","v":0},{"$f":"All!Z596","v":0},{"$f":"All!AA596","v":0},{"$f":"All!AB596","v":0},{"$f":"All!AC596","v":0},{"$f":"All!AD596","v":0},{"$f":"All!AE596","v":0},{"$f":"All!AF596","v":0},{"$f":"All!AG596","v":0},{"$f":"All!AH596","v":0},{"$f":"All!AI596","v":0},{"$f":"All!AJ596","v":0},{"$f":"All!AK596","v":0},{"$f":"All!AL596","v":0},{"$f":"All!AM596","v":0},{"$f":"All!AN596","v":0},{"$f":"All!AO596","v":0},{"$f":"All!AP596","v":0},{"$f":"All!AQ596","v":0},{"$f":"All!AR596","v":0},{"$f":"All!AS596","v":0},{"$f":"All!AT596","v":0}]
[null,{"$f":"All!B597","v":"8"},{"$f":"All!C597","v":"8.1"},{"$f":"All!D597","v":"8.1.1"},{"$f":"All!E597","v":0},{"$f":"All!F597","v":"8.1.1.5"},{"$f":"All!G597","v":0},{"$f":"All!H597","v":0},{"$f":"All!I597","v":"8.1.1.5.3"},{"$f":"All!J597","v":"8.1.1.5.3: Do agreements with all external parties describe minimum security controls to limit access to personal data?\n"},{"$f":"All!K597","v":0},{"$f":"All!L597","v":0},{"$f":"All!M597","v":"Recommended"},{"$f":"All!N597","v":"Recommended"},{"$f":"All!O597","v":"BizOps"},{"$f":"All!P597","v":0},{"$f":"All!Q597","v":0},{"$f":"All!R597","v":0},{"$f":"All!S597","v":0},{"$f":"All!T597","v":0},{"$f":"All!U597","v":0},{"$f":"All!V597","v":0},{"$f":"All!W597","v":0},{"$f":"All!X597","v":0},{"$f":"All!Y597","v":0},{"$f":"All!Z597","v":0},{"$f":"All!AA597","v":0},{"$f":"All!AB597","v":0},{"$f":"All!AC597","v":0},{"$f":"All!AD597","v":0},{"$f":"All!AE597","v":0},{"$f":"All!AF597","v":0},{"$f":"All!AG597","v":0},{"$f":"All!AH597","v":0},{"$f":"All!AI597","v":0},{"$f":"All!AJ597","v":0},{"$f":"All!AK639","v":0},{"$f":"All!AL639","v":0},{"$f":"All!AM639","v":0},{"$f":"All!AN639","v":0},{"$f":"All!AO639","v":0},{"$f":"All!AP639","v":0},{"$f":"All!AQ639","v":0},{"$f":"All!AR639","v":0},{"$f":"All!AS639","v":0},{"$f":"All!AT639","v":0}]
[null,{"$f":"All!B598","v":"8"},{"$f":"All!C598","v":"8.1"},{"$f":"All!D598","v":"8.1.1"},{"$f":"All!E598","v":0},{"$f":"All!F598","v":"8.1.1.6"},{"$f":"All!G598","v":"8.1.1.6: PERSONAL DATA QUALITY AND ACCURACY\nProviders should maintain the accuracy and quality of personal data by: \n- reviewing customers' personal data periodically to ensure it is complete and free of obvious errors; \n- ensuring the reliability of personal data collected from a source other than the customer (e.g. a marketing agency) before it is processed; and\n- verifying the validity of personal data provided by the customer, where it is appropriate to do so. (Note that 2.5.1 elaborates on verification of personal data collected for KYC purposes during registration.)\n\nThis practice refers to all data collected for a customer, not just KYC data. For instance, other personal data such as address details or credit history could be collected.\nExamples of personal data sources other than the customer include marketing agencies and the provider's own subsidiaries or affiliates."},{"$f":"All!H598","v":"NIST Appendix D\nISO 29100:2011 5.7"},{"$f":"All!I598","v":"8.1.1.6.1"},{"$f":"All!J598","v":"8.1.1.6.1: Is customers' personal data reviewed periodically to ensure it is complete and free of obvious errors?\n"},{"$f":"All!K598","v":0},{"$f":"All!L598","v":0},{"$f":"All!M598","v":"Recommended"},{"$f":"All!N598","v":"Recommended"},{"$f":"All!O598","v":"BizOps"},{"$f":"All!P598","v":0},{"$f":"All!Q598","v":0},{"$f":"All!R598","v":0},{"$f":"All!S598","v":0},{"$f":"All!T598","v":0},{"$f":"All!U598","v":0},{"$f":"All!V598","v":0},{"$f":"All!W598","v":0},{"$f":"All!X598","v":0},{"$f":"All!Y598","v":0},{"$f":"All!Z598","v":0},{"$f":"All!AA598","v":0},{"$f":"All!AB598","v":0},{"$f":"All!AC598","v":0},{"$f":"All!AD598","v":0},{"$f":"All!AE598","v":0},{"$f":"All!AF598","v":0},{"$f":"All!AG598","v":0},{"$f":"All!AH598","v":0},{"$f":"All!AI598","v":0},{"$f":"All!AJ598","v":0},{"$f":"All!AK640","v":0},{"$f":"All!AL640","v":0},{"$f":"All!AM640","v":0},{"$f":"All!AN640","v":0},{"$f":"All!AO640","v":0},{"$f":"All!AP640","v":0},{"$f":"All!AQ640","v":0},{"$f":"All!AR640","v":0},{"$f":"All!AS640","v":0},{"$f":"All!AT640","v":0}]
[null,{"$f":"All!B599","v":"8"},{"$f":"All!C599","v":"8.1"},{"$f":"All!D599","v":"8.1.1"},{"$f":"All!E599","v":0},{"$f":"All!F599","v":"8.1.1.6"},{"$f":"All!G599","v":0},{"$f":"All!H599","v":0},{"$f":"All!I599","v":"8.1.1.6.2"},{"$f":"All!J599","v":"8.1.1.6.2: Is the reliability of personal data collected from a source other than the customer confirmed before it is processed?\n"},{"$f":"All!K599","v":0},{"$f":"All!L599","v":0},{"$f":"All!M599","v":"Recommended"},{"$f":"All!N599","v":"Recommended"},{"$f":"All!O599","v":"BizOps"},{"$f":"All!P599","v":0},{"$f":"All!Q599","v":0},{"$f":"All!R599","v":0},{"$f":"All!S599","v":0},{"$f":"All!T599","v":0},{"$f":"All!U599","v":0},{"$f":"All!V599","v":0},{"$f":"All!W599","v":0},{"$f":"All!X599","v":0},{"$f":"All!Y599","v":0},{"$f":"All!Z599","v":0},{"$f":"All!AA599","v":0},{"$f":"All!AB599","v":0},{"$f":"All!AC599","v":0},{"$f":"All!AD599","v":0},{"$f":"All!AE599","v":0},{"$f":"All!AF599","v":0},{"$f":"All!AG599","v":0},{"$f":"All!AH599","v":0},{"$f":"All!AI599","v":0},{"$f":"All!AJ599","v":0},{"$f":"All!AK641","v":0},{"$f":"All!AL641","v":0},{"$f":"All!AM641","v":0},{"$f":"All!AN641","v":0},{"$f":"All!AO641","v":0},{"$f":"All!AP641","v":0},{"$f":"All!AQ641","v":0},{"$f":"All!AR641","v":0},{"$f":"All!AS641","v":0},{"$f":"All!AT641","v":0}]
[null,{"$f":"All!B600","v":"8"},{"$f":"All!C600","v":"8.1"},{"$f":"All!D600","v":"8.1.1"},{"$f":"All!E600","v":0},{"$f":"All!F600","v":"8.1.1.7"},{"$f":"All!G600","v":"8.1.1.7: TRAINING AND EDUCATION ON DATA PRIVACY\nProviders should put in place a data protection training and awareness plan. The plan should (1) specify the content of the data protection training, (2) assign responsibility for its implementation, and (3) be tailored to the different roles receiving the training. All staff (and agents and entities providing outsourced services, if applicable) with access to personal data should be trained in data protection, with periodic refresher training.\n\nProviders should focus attention on the protection and fair usage of personal data. Training should include: \n- informing staff of new scams that are being used to steal identities; \n- providing updates on privacy items in the news such as government data breaches and their effect on individuals and the organization;\n- providing examples of how staff  have been held accountable for inappropriate actions; and \n- providing examples of recommended privacy practices. \nThe goal of training is to build knowledge and skills that will enable staff to protect personal data."},{"$f":"All!H600","v":"NIST 4.1.2"},{"$f":"All!I600","v":"8.1.1.7.1"},{"$f":"All!J600","v":"8.1.1.7.1: Is there a data protection training and awareness plan for educating staff and agents on the protection and fair usage of personal data?\n"},{"$f":"All!K600","v":"1) Staff training programme, 2) Agent training programme.\n- Check that the training/briefing  for employees and agents includes details on the protection and fair usage of personal data."},{"$f":"All!L600","v":0},{"$f":"All!M600","v":"Standard Required"},{"$f":"All!N600","v":"Required"},{"$f":"All!O600","v":"BizOps"},{"$f":"All!P600","v":0},{"$f":"All!Q600","v":0},{"$f":"All!R600","v":0},{"$f":"All!S600","v":0},{"$f":"All!T600","v":0},{"$f":"All!U600","v":0},{"$f":"All!V600","v":0},{"$f":"All!W600","v":0},{"$f":"All!X600","v":0},{"$f":"All!Y600","v":0},{"$f":"All!Z600","v":0},{"$f":"All!AA600","v":0},{"$f":"All!AB600","v":0},{"$f":"All!AC600","v":0},{"$f":"All!AD600","v":0},{"$f":"All!AE600","v":0},{"$f":"All!AF600","v":0},{"$f":"All!AG600","v":0},{"$f":"All!AH600","v":0},{"$f":"All!AI600","v":0},{"$f":"All!AJ600","v":0},{"$f":"All!AK642","v":0},{"$f":"All!AL642","v":0},{"$f":"All!AM642","v":0},{"$f":"All!AN642","v":0},{"$f":"All!AO642","v":0},{"$f":"All!AP642","v":0},{"$f":"All!AQ642","v":0},{"$f":"All!AR642","v":0},{"$f":"All!AS642","v":0},{"$f":"All!AT642","v":0}]
[null,{"$f":"All!B601","v":"8"},{"$f":"All!C601","v":"8.1"},{"$f":"All!D601","v":"8.1.1"},{"$f":"All!E601","v":0},{"$f":"All!F601","v":"8.1.1.8"},{"$f":"All!G601","v":"8.1.1.8: DATA PRIVACY INCIDENT-HANDLING\nProviders should develop procedures to handle breaches that involve personal data. \n\n1. Employees, agents, and entities providing outsourced services should be told what constitutes a breach involving personal data, how to report the breach to the provider (e.g. a form), and what information needs to be reported (e.g. what data was lost; which customers were affected; how and when the data was lost).\n\n2. A breach involving personal data may require notification to external entities such as law enforcement, affected customers, the media, and the public.  Therefore, providers should plan in advance how, when, and to whom notifications should be provided. They should also conduct training sessions on how to address incidents when interacting with the media and other external parties. \n\n3. Providers should determine the circumstances under which remedial assistance should be provided to customers affected by data privacy breaches. The impact of a data breach can be reduced by swift communication with the customers whose data was lost. Explicit instructions should be given on steps that the customers should take (e.g. changing PINs, if they have been made public).\n\nIf the data privacy incident is caused by a security incident, also see section 5.3.9.\n\nData breaches can be serious. Customers' personal data can be used by criminals for impersonation fraud or identity theft. Public disclosure of customers' personal data causes reputational damage and possibly financial loss if the provider is held liability for fraud committed using the data. For example, in April 2015, 15,000 files were leaked from Qatar National Bank. The leaked data included passwords, PINs and payment card data for hundreds of thousands of customer accounts."},{"$f":"All!H601","v":"NIST 5.0"},{"$f":"All!I601","v":"8.1.1.8.1"},{"$f":"All!J601","v":"8.1.1.8.1: Have incident response plans been developed to address breaches involving personal data?\n"},{"$f":"All!K601","v":"1) Data privacy incident response plan\n- Check that the response plan has been developed for breaches in personal data protection requirements "},{"$f":"All!L601","v":0},{"$f":"All!M601","v":"Standard Required"},{"$f":"All!N601","v":"Required"},{"$f":"All!O601","v":"BizOps"},{"$f":"All!P601","v":0},{"$f":"All!Q601","v":0},{"$f":"All!R601","v":0},{"$f":"All!S601","v":0},{"$f":"All!T601","v":0},{"$f":"All!U601","v":0},{"$f":"All!V601","v":0},{"$f":"All!W601","v":0},{"$f":"All!X601","v":0},{"$f":"All!Y601","v":0},{"$f":"All!Z601","v":0},{"$f":"All!AA601","v":0},{"$f":"All!AB601","v":0},{"$f":"All!AC601","v":0},{"$f":"All!AD601","v":0},{"$f":"All!AE601","v":0},{"$f":"All!AF601","v":0},{"$f":"All!AG601","v":0},{"$f":"All!AH601","v":0},{"$f":"All!AI601","v":0},{"$f":"All!AJ601","v":0},{"$f":"All!AK643","v":0},{"$f":"All!AL643","v":0},{"$f":"All!AM643","v":0},{"$f":"All!AN643","v":0},{"$f":"All!AO643","v":0},{"$f":"All!AP643","v":0},{"$f":"All!AQ643","v":0},{"$f":"All!AR643","v":0},{"$f":"All!AS643","v":0},{"$f":"All!AT643","v":0}]
[null,{"$f":"All!B602","v":"8"},{"$f":"All!C602","v":"8.1"},{"$f":"All!D602","v":"8.1.1"},{"$f":"All!E602","v":0},{"$f":"All!F602","v":"8.1.1.8"},{"$f":"All!G602","v":0},{"$f":"All!H602","v":0},{"$f":"All!I602","v":"8.1.1.8.2"},{"$f":"All!J602","v":"8.1.1.8.2: Have employees been told what constitutes a breach involving personal data, how to report the breach, and what information needs to be reported?\n"},{"$f":"All!K602","v":"1) Staff training programme\n- Check that the training/briefing  for employees includes:\na)  what constitutes a breach involving personal data.\nb) how to report the breach to the provider,\nc) what information needs to be reported\n\n2) Data Privacy Policy or data privacy rules of behaviour document\n- Check that there is a channel / mechanism for employees to report data privacy breaches."},{"$f":"All!L602","v":0},{"$f":"All!M602","v":"Standard Required"},{"$f":"All!N602","v":"Required"},{"$f":"All!O602","v":"BizOps"},{"$f":"All!P602","v":0},{"$f":"All!Q602","v":0},{"$f":"All!R602","v":0},{"$f":"All!S602","v":0},{"$f":"All!T602","v":0},{"$f":"All!U602","v":0},{"$f":"All!V602","v":0},{"$f":"All!W602","v":0},{"$f":"All!X602","v":0},{"$f":"All!Y602","v":0},{"$f":"All!Z602","v":0},{"$f":"All!AA602","v":0},{"$f":"All!AB602","v":0},{"$f":"All!AC602","v":0},{"$f":"All!AD602","v":0},{"$f":"All!AE602","v":0},{"$f":"All!AF602","v":0},{"$f":"All!AG602","v":0},{"$f":"All!AH602","v":0},{"$f":"All!AI602","v":0},{"$f":"All!AJ602","v":0},{"$f":"All!AK644","v":0},{"$f":"All!AL644","v":0},{"$f":"All!AM644","v":0},{"$f":"All!AN644","v":0},{"$f":"All!AO644","v":0},{"$f":"All!AP644","v":0},{"$f":"All!AQ644","v":0},{"$f":"All!AR644","v":0},{"$f":"All!AS644","v":0},{"$f":"All!AT644","v":0}]
[null,{"$f":"All!B603","v":"8"},{"$f":"All!C603","v":"8.1"},{"$f":"All!D603","v":"8.1.1"},{"$f":"All!E603","v":0},{"$f":"All!F603","v":"8.1.1.8"},{"$f":"All!G603","v":0},{"$f":"All!H603","v":0},{"$f":"All!I603","v":"8.1.1.8.3"},{"$f":"All!J603","v":"8.1.1.8.3: Is there a plan for notifying external entities such as law enforcement, affected customers, the media, and the public of personal data privacy breaches?\n"},{"$f":"All!K603","v":0},{"$f":"All!L603","v":0},{"$f":"All!M603","v":"Recommended"},{"$f":"All!N603","v":"Recommended"},{"$f":"All!O603","v":"BizOps"},{"$f":"All!P603","v":0},{"$f":"All!Q603","v":0},{"$f":"All!R603","v":0},{"$f":"All!S603","v":0},{"$f":"All!T603","v":0},{"$f":"All!U603","v":0},{"$f":"All!V603","v":0},{"$f":"All!W603","v":0},{"$f":"All!X603","v":0},{"$f":"All!Y603","v":0},{"$f":"All!Z603","v":0},{"$f":"All!AA603","v":0},{"$f":"All!AB603","v":0},{"$f":"All!AC603","v":0},{"$f":"All!AD603","v":0},{"$f":"All!AE603","v":0},{"$f":"All!AF603","v":0},{"$f":"All!AG603","v":0},{"$f":"All!AH603","v":0},{"$f":"All!AI603","v":0},{"$f":"All!AJ603","v":0},{"$f":"All!AK645","v":0},{"$f":"All!AL645","v":0},{"$f":"All!AM645","v":0},{"$f":"All!AN645","v":0},{"$f":"All!AO645","v":0},{"$f":"All!AP645","v":0},{"$f":"All!AQ645","v":0},{"$f":"All!AR645","v":0},{"$f":"All!AS645","v":0},{"$f":"All!AT645","v":0}]
[null,{"$f":"All!B604","v":"8"},{"$f":"All!C604","v":"8.1"},{"$f":"All!D604","v":"8.1.1"},{"$f":"All!E604","v":0},{"$f":"All!F604","v":"8.1.1.8"},{"$f":"All!G604","v":0},{"$f":"All!H604","v":0},{"$f":"All!I604","v":"8.1.1.8.4"},{"$f":"All!J604","v":"8.1.1.8.4: Is a process in place to determine any remedial assistance that should be provided to individuals or entities affected by data privacy breaches?\n"},{"$f":"All!K604","v":0},{"$f":"All!L604","v":0},{"$f":"All!M604","v":"Recommended"},{"$f":"All!N604","v":"Recommended"},{"$f":"All!O604","v":"BizOps"},{"$f":"All!P604","v":0},{"$f":"All!Q604","v":0},{"$f":"All!R604","v":0},{"$f":"All!S604","v":0},{"$f":"All!T604","v":0},{"$f":"All!U604","v":0},{"$f":"All!V604","v":0},{"$f":"All!W604","v":0},{"$f":"All!X604","v":0},{"$f":"All!Y604","v":0},{"$f":"All!Z604","v":0},{"$f":"All!AA604","v":0},{"$f":"All!AB604","v":0},{"$f":"All!AC604","v":0},{"$f":"All!AD604","v":0},{"$f":"All!AE604","v":0},{"$f":"All!AF604","v":0},{"$f":"All!AG604","v":0},{"$f":"All!AH604","v":0},{"$f":"All!AI604","v":0},{"$f":"All!AJ604","v":0},{"$f":"All!AK646","v":0},{"$f":"All!AL646","v":0},{"$f":"All!AM646","v":0},{"$f":"All!AN646","v":0},{"$f":"All!AO646","v":0},{"$f":"All!AP646","v":0},{"$f":"All!AQ646","v":0},{"$f":"All!AR646","v":0},{"$f":"All!AS646","v":0},{"$f":"All!AT646","v":0}]
[null,{"$f":"All!B605","v":"8"},{"$f":"All!C605","v":"8.1"},{"$f":"All!D605","v":"8.1.1"},{"$f":"All!E605","v":0},{"$f":"All!F605","v":"8.1.1.9"},{"$f":"All!G605","v":"8.1.1.9: DE-IDENTIFYING AND ANONYMISING PERSONAL DATA\nWhenever possible, providers should de-identify or anonymise personal data when full data records are not necessary, such as when performing certain types of research, analysing resource requirements, examining correlations and trends, and/or conducting system or application testing. \n\n\"De-identify\" means to remove, obscure, mask or obfuscate enough personal data from a record such that an individual can not be identified. De-identified information can be aggregated for the purposes of statistical analysis, such as making comparisons, analysing trends, or identifying patterns. De-identified information can be re-identified by using a code, algorithm, or pseudonym that is assigned to individual records.\n\n\"Anonymise\" means to take de-identified information and destroy any code or other association that would allow re-identification. Anonymising information usually involves the application of statistical disclosure limitation techniques to ensure that the data cannot be re-identified. Not all data can be readily anonymised (for example, biometric data)."},{"$f":"All!H605","v":"NIST 4.2.3"},{"$f":"All!I605","v":"8.1.1.9.1"},{"$f":"All!J605","v":"8.1.1.9.1: Is personal data de-identified or anonymised when full data records are not necessary, such as when performing certain types of research, analysing resource requirements, examining correlations and trends, and conducting system testing?\n"},{"$f":"All!K605","v":0},{"$f":"All!L605","v":0},{"$f":"All!M605","v":"Recommended"},{"$f":"All!N605","v":"Recommended"},{"$f":"All!O605","v":"BizOps"},{"$f":"All!P605","v":0},{"$f":"All!Q605","v":0},{"$f":"All!R605","v":0},{"$f":"All!S605","v":0},{"$f":"All!T605","v":0},{"$f":"All!U605","v":0},{"$f":"All!V605","v":0},{"$f":"All!W605","v":0},{"$f":"All!X605","v":0},{"$f":"All!Y605","v":0},{"$f":"All!Z605","v":0},{"$f":"All!AA605","v":0},{"$f":"All!AB605","v":0},{"$f":"All!AC605","v":0},{"$f":"All!AD605","v":0},{"$f":"All!AE605","v":0},{"$f":"All!AF605","v":0},{"$f":"All!AG605","v":0},{"$f":"All!AH605","v":0},{"$f":"All!AI605","v":0},{"$f":"All!AJ605","v":0},{"$f":"All!AK647","v":0},{"$f":"All!AL647","v":0},{"$f":"All!AM647","v":0},{"$f":"All!AN647","v":0},{"$f":"All!AO647","v":0},{"$f":"All!AP647","v":0},{"$f":"All!AQ647","v":0},{"$f":"All!AR647","v":0},{"$f":"All!AS647","v":0},{"$f":"All!AT647","v":0}]
[null,{"$f":"All!B606","v":"8"},{"$f":"All!C606","v":"8.2"},{"$f":"All!D606","v":"8.2.1"},{"$f":"All!E606","v":"8.2.1: Providers shall ensure that users are provided with clear, prominent, and timely information regarding their data privacy practices."},{"$f":"All!F606","v":"8.2.1.1"},{"$f":"All!G606","v":"8.2.1.1: TRANSPARENCY REGARDING DATA PRIVACY PRACTICES\nProviders should publish a statement of their commitment to data privacy. In particular the statement should make clear that data will be kept secure and not shared with third parties unless  explicitly agreed with the customer.\n\nThe statement could be published in the T&Cs, on posters, on handouts, or via the website.\n\nIn addition, it is good practice for providers to publish a summary of their data privacy practices available to customers, along with official address and contact details for customers interested in obtaining additional information. The summary could include:\n- the personal data required;\n- the purpose for personal data collection (e.g. to assess eligibility for other financial or non-financial services, for legal compliance, etc.);\n- the personal data retention and disposal policy.\n"},{"$f":"All!H606","v":"NIST Appendix D\nISO 29100:2011 5.8\nISO 29100:2011 4.6"},{"$f":"All!I606","v":"8.2.1.1.1"},{"$f":"All!J606","v":"8.2.1.1.1: Is a statement of the provider's commitment to data privacy practices made available to customers (e.g. in the T&Cs, on posters, on handouts, or via the website)?\n"},{"$f":"All!K606","v":0},{"$f":"All!L606","v":0},{"$f":"All!M606","v":"Recommended"},{"$f":"All!N606","v":"Recommended"},{"$f":"All!O606","v":"BizOps"},{"$f":"All!P606","v":0},{"$f":"All!Q606","v":0},{"$f":"All!R606","v":0},{"$f":"All!S606","v":0},{"$f":"All!T606","v":0},{"$f":"All!U606","v":0},{"$f":"All!V606","v":0},{"$f":"All!W606","v":0},{"$f":"All!X606","v":0},{"$f":"All!Y606","v":0},{"$f":"All!Z606","v":0},{"$f":"All!AA606","v":0},{"$f":"All!AB606","v":0},{"$f":"All!AC606","v":0},{"$f":"All!AD606","v":0},{"$f":"All!AE606","v":0},{"$f":"All!AF606","v":0},{"$f":"All!AG606","v":0},{"$f":"All!AH606","v":0},{"$f":"All!AI606","v":0},{"$f":"All!AJ606","v":0},{"$f":"All!AK648","v":0},{"$f":"All!AL648","v":0},{"$f":"All!AM648","v":0},{"$f":"All!AN648","v":0},{"$f":"All!AO648","v":0},{"$f":"All!AP648","v":0},{"$f":"All!AQ648","v":0},{"$f":"All!AR648","v":0},{"$f":"All!AS648","v":0},{"$f":"All!AT648","v":0}]
[null,{"$f":"All!B607","v":"8"},{"$f":"All!C607","v":"8.2"},{"$f":"All!D607","v":"8.2.1"},{"$f":"All!E607","v":0},{"$f":"All!F607","v":"8.2.1.1"},{"$f":"All!G607","v":0},{"$f":"All!H607","v":0},{"$f":"All!I607","v":"8.2.1.1.2"},{"$f":"All!J607","v":"8.2.1.1.2: Does the summary of data privacy practices inform customers of the personal data required from them?\n"},{"$f":"All!K607","v":0},{"$f":"All!L607","v":0},{"$f":"All!M607","v":"Recommended"},{"$f":"All!N607","v":"Recommended"},{"$f":"All!O607","v":"BizOps"},{"$f":"All!P607","v":0},{"$f":"All!Q607","v":0},{"$f":"All!R607","v":0},{"$f":"All!S607","v":0},{"$f":"All!T607","v":0},{"$f":"All!U607","v":0},{"$f":"All!V607","v":0},{"$f":"All!W607","v":0},{"$f":"All!X607","v":0},{"$f":"All!Y607","v":0},{"$f":"All!Z607","v":0},{"$f":"All!AA607","v":0},{"$f":"All!AB607","v":0},{"$f":"All!AC607","v":0},{"$f":"All!AD607","v":0},{"$f":"All!AE607","v":0},{"$f":"All!AF607","v":0},{"$f":"All!AG607","v":0},{"$f":"All!AH607","v":0},{"$f":"All!AI607","v":0},{"$f":"All!AJ607","v":0},{"$f":"All!AK649","v":0},{"$f":"All!AL649","v":0},{"$f":"All!AM649","v":0},{"$f":"All!AN649","v":0},{"$f":"All!AO649","v":0},{"$f":"All!AP649","v":0},{"$f":"All!AQ649","v":0},{"$f":"All!AR649","v":0},{"$f":"All!AS649","v":0},{"$f":"All!AT649","v":0}]
[null,{"$f":"All!B608","v":"8"},{"$f":"All!C608","v":"8.2"},{"$f":"All!D608","v":"8.2.1"},{"$f":"All!E608","v":0},{"$f":"All!F608","v":"8.2.1.1"},{"$f":"All!G608","v":0},{"$f":"All!H608","v":0},{"$f":"All!I608","v":"8.2.1.1.3"},{"$f":"All!J608","v":"8.2.1.1.3: Does the summary of data privacy practices inform customers of the purpose for collecting personal data from them?\n"},{"$f":"All!K608","v":0},{"$f":"All!L608","v":0},{"$f":"All!M608","v":"Recommended"},{"$f":"All!N608","v":"Recommended"},{"$f":"All!O608","v":"BizOps"},{"$f":"All!P608","v":0},{"$f":"All!Q608","v":0},{"$f":"All!R608","v":0},{"$f":"All!S608","v":0},{"$f":"All!T608","v":0},{"$f":"All!U608","v":0},{"$f":"All!V608","v":0},{"$f":"All!W608","v":0},{"$f":"All!X608","v":0},{"$f":"All!Y608","v":0},{"$f":"All!Z608","v":0},{"$f":"All!AA608","v":0},{"$f":"All!AB608","v":0},{"$f":"All!AC608","v":0},{"$f":"All!AD608","v":0},{"$f":"All!AE608","v":0},{"$f":"All!AF608","v":0},{"$f":"All!AG608","v":0},{"$f":"All!AH608","v":0},{"$f":"All!AI608","v":0},{"$f":"All!AJ608","v":0},{"$f":"All!AK650","v":0},{"$f":"All!AL650","v":0},{"$f":"All!AM650","v":0},{"$f":"All!AN650","v":0},{"$f":"All!AO650","v":0},{"$f":"All!AP650","v":0},{"$f":"All!AQ650","v":0},{"$f":"All!AR650","v":0},{"$f":"All!AS650","v":0},{"$f":"All!AT650","v":0}]
[null,{"$f":"All!B609","v":"8"},{"$f":"All!C609","v":"8.2"},{"$f":"All!D609","v":"8.2.1"},{"$f":"All!E609","v":0},{"$f":"All!F609","v":"8.2.1.1"},{"$f":"All!G609","v":0},{"$f":"All!H609","v":0},{"$f":"All!I609","v":"8.2.1.1.4"},{"$f":"All!J609","v":"8.2.1.1.4: Does the summary of data privacy practices make it clear that data will not be shared with third parties unless explicitly agreed with the customer?\n"},{"$f":"All!K609","v":0},{"$f":"All!L609","v":0},{"$f":"All!M609","v":"Recommended"},{"$f":"All!N609","v":"Recommended"},{"$f":"All!O609","v":"BizOps"},{"$f":"All!P609","v":0},{"$f":"All!Q609","v":0},{"$f":"All!R609","v":0},{"$f":"All!S609","v":0},{"$f":"All!T609","v":0},{"$f":"All!U609","v":0},{"$f":"All!V609","v":0},{"$f":"All!W609","v":0},{"$f":"All!X609","v":0},{"$f":"All!Y609","v":0},{"$f":"All!Z609","v":0},{"$f":"All!AA609","v":0},{"$f":"All!AB609","v":0},{"$f":"All!AC609","v":0},{"$f":"All!AD609","v":0},{"$f":"All!AE609","v":0},{"$f":"All!AF609","v":0},{"$f":"All!AG609","v":0},{"$f":"All!AH609","v":0},{"$f":"All!AI609","v":0},{"$f":"All!AJ609","v":0},{"$f":"All!AK651","v":0},{"$f":"All!AL651","v":0},{"$f":"All!AM651","v":0},{"$f":"All!AN651","v":0},{"$f":"All!AO651","v":0},{"$f":"All!AP651","v":0},{"$f":"All!AQ651","v":0},{"$f":"All!AR651","v":0},{"$f":"All!AS651","v":0},{"$f":"All!AT651","v":0}]
[null,{"$f":"All!B610","v":"8"},{"$f":"All!C610","v":"8.3"},{"$f":"All!D610","v":"8.3.1"},{"$f":"All!E610","v":"8.3.1: Providers shall ensure that customers are informed of their rights and have opportunities to exercise meaningful choice and control over their personal information."},{"$f":"All!F610","v":"8.3.1.1"},{"$f":"All!G610","v":"8.3.1.1: CUSTOMER CHOICE AND CONTROL OVER PROCESSING OF PERSONAL DATA\nProviders should offer customers choice and control over how their personal data is handled. Some personal data (e.g., data required for KYC purposes) must be provided and processed in order to use the service. However, for use of personal data that is not essential to the provision of the service (e.g. marketing messages), providers should (1) obtain opt-in consent for this use of the personal data; and (2) allow a customer to withdraw consent easily and free of charge.\n\nEven if consent is withdrawn, the provider might need to retain certain personal data for a period of time in order to comply with legal and/or contractual obligations (e.g. data retention, accountability). The customer should be informed that their data may be used or shared in accordance with such legal and/or contractual obligations."},{"$f":"All!H610","v":"ISO 29100:2011, 5.2"},{"$f":"All!I610","v":"8.3.1.1.1"},{"$f":"All!J610","v":"8.3.1.1.1: For the use of personal data that is not essential to the provision of the mobile money service (e.g. marketing messages), does the provider (1) obtain opt-in consent from customers, and (2) allow a customer to withdraw consent easily and free of charge?\n"},{"$f":"All!K610","v":0},{"$f":"All!L610","v":0},{"$f":"All!M610","v":"Recommended"},{"$f":"All!N610","v":"Recommended"},{"$f":"All!O610","v":"BizOps"},{"$f":"All!P610","v":0},{"$f":"All!Q610","v":0},{"$f":"All!R610","v":0},{"$f":"All!S610","v":0},{"$f":"All!T610","v":0},{"$f":"All!U610","v":0},{"$f":"All!V610","v":0},{"$f":"All!W610","v":0},{"$f":"All!X610","v":0},{"$f":"All!Y610","v":0},{"$f":"All!Z610","v":0},{"$f":"All!AA610","v":0},{"$f":"All!AB610","v":0},{"$f":"All!AC610","v":0},{"$f":"All!AD610","v":0},{"$f":"All!AE610","v":0},{"$f":"All!AF610","v":0},{"$f":"All!AG610","v":0},{"$f":"All!AH610","v":0},{"$f":"All!AI610","v":0},{"$f":"All!AJ610","v":0},{"$f":"All!AK652","v":0},{"$f":"All!AL652","v":0},{"$f":"All!AM652","v":0},{"$f":"All!AN652","v":0},{"$f":"All!AO652","v":0},{"$f":"All!AP652","v":0},{"$f":"All!AQ652","v":0},{"$f":"All!AR652","v":0},{"$f":"All!AS652","v":0},{"$f":"All!AT652","v":0}]
[null,{"$f":"All!B611","v":"8"},{"$f":"All!C611","v":"8.3"},{"$f":"All!D611","v":"8.3.1"},{"$f":"All!E611","v":0},{"$f":"All!F611","v":"8.3.1.2"},{"$f":"All!G611","v":"8.3.1.2: CUSTOMER RIGHTS TO REVIEW PERSONAL DATA\nProviders should grant customers the right to: \n- access and review their personal data (subject to proper verification of their identity);\n- challenge the accuracy and completeness of their personal data and have it amended or removed as appropriate; and \n- ensure that any amendment or removal is communicated to third parties to whom personal data has been disclosed.  \n\nCustomers should be informed of how they can access, review and request updates to their personal data.\n\nNOTE:  While this Practice applies to all mobile money services, customers may be particularly interested in reviewing personal data that is used to assess creditworthiness."},{"$f":"All!H611","v":"ISO 29100:2011, 5.9"},{"$f":"All!I611","v":"8.3.1.2.1"},{"$f":"All!J611","v":"8.3.1.2.1: Can customers access and review their personal data?\n"},{"$f":"All!K611","v":0},{"$f":"All!L611","v":0},{"$f":"All!M611","v":"Recommended"},{"$f":"All!N611","v":"Recommended"},{"$f":"All!O611","v":"BizOps"},{"$f":"All!P611","v":0},{"$f":"All!Q611","v":0},{"$f":"All!R611","v":0},{"$f":"All!S611","v":0},{"$f":"All!T611","v":0},{"$f":"All!U611","v":0},{"$f":"All!V611","v":0},{"$f":"All!W611","v":0},{"$f":"All!X611","v":0},{"$f":"All!Y611","v":0},{"$f":"All!Z611","v":0},{"$f":"All!AA611","v":0},{"$f":"All!AB611","v":0},{"$f":"All!AC611","v":0},{"$f":"All!AD611","v":0},{"$f":"All!AE611","v":0},{"$f":"All!AF611","v":0},{"$f":"All!AG611","v":0},{"$f":"All!AH611","v":0},{"$f":"All!AI611","v":0},{"$f":"All!AJ611","v":0},{"$f":"All!AK653","v":0},{"$f":"All!AL653","v":0},{"$f":"All!AM653","v":0},{"$f":"All!AN653","v":0},{"$f":"All!AO653","v":0},{"$f":"All!AP653","v":0},{"$f":"All!AQ653","v":0},{"$f":"All!AR653","v":0},{"$f":"All!AS653","v":0},{"$f":"All!AT653","v":0}]
[null,{"$f":"All!B612","v":"8"},{"$f":"All!C612","v":"8.3"},{"$f":"All!D612","v":"8.3.1"},{"$f":"All!E612","v":0},{"$f":"All!F612","v":"8.3.1.2"},{"$f":"All!G612","v":0},{"$f":"All!H612","v":0},{"$f":"All!I612","v":"8.3.1.2.2"},{"$f":"All!J612","v":"8.3.1.2.2: Can customers challenge the accuracy and completeness of the personal data and have it amended or removed?\n"},{"$f":"All!K612","v":0},{"$f":"All!L612","v":0},{"$f":"All!M612","v":"Recommended"},{"$f":"All!N612","v":"Recommended"},{"$f":"All!O612","v":"BizOps"},{"$f":"All!P612","v":0},{"$f":"All!Q612","v":0},{"$f":"All!R612","v":0},{"$f":"All!S612","v":0},{"$f":"All!T612","v":0},{"$f":"All!U612","v":0},{"$f":"All!V612","v":0},{"$f":"All!W612","v":0},{"$f":"All!X612","v":0},{"$f":"All!Y612","v":0},{"$f":"All!Z612","v":0},{"$f":"All!AA612","v":0},{"$f":"All!AB612","v":0},{"$f":"All!AC612","v":0},{"$f":"All!AD612","v":0},{"$f":"All!AE612","v":0},{"$f":"All!AF612","v":0},{"$f":"All!AG612","v":0},{"$f":"All!AH612","v":0},{"$f":"All!AI612","v":0},{"$f":"All!AJ612","v":0},{"$f":"All!AK654","v":0},{"$f":"All!AL654","v":0},{"$f":"All!AM654","v":0},{"$f":"All!AN654","v":0},{"$f":"All!AO654","v":0},{"$f":"All!AP654","v":0},{"$f":"All!AQ654","v":0},{"$f":"All!AR654","v":0},{"$f":"All!AS654","v":0},{"$f":"All!AT654","v":0}]
[null,{"$f":"All!B613","v":"8"},{"$f":"All!C613","v":"8.3"},{"$f":"All!D613","v":"8.3.1"},{"$f":"All!E613","v":0},{"$f":"All!F613","v":"8.3.1.2"},{"$f":"All!G613","v":0},{"$f":"All!H613","v":0},{"$f":"All!I613","v":"8.3.1.2.3"},{"$f":"All!J613","v":"8.3.1.2.3: Are third parties to whom personal data has been disclosed also informed of any amendment or removal of the personal data?\n"},{"$f":"All!K613","v":0},{"$f":"All!L613","v":0},{"$f":"All!M613","v":"Recommended"},{"$f":"All!N613","v":"Recommended"},{"$f":"All!O613","v":"BizOps"},{"$f":"All!P613","v":0},{"$f":"All!Q613","v":0},{"$f":"All!R613","v":0},{"$f":"All!S613","v":0},{"$f":"All!T613","v":0},{"$f":"All!U613","v":0},{"$f":"All!V613","v":0},{"$f":"All!W613","v":0},{"$f":"All!X613","v":0},{"$f":"All!Y613","v":0},{"$f":"All!Z613","v":0},{"$f":"All!AA613","v":0},{"$f":"All!AB613","v":0},{"$f":"All!AC613","v":0},{"$f":"All!AD613","v":0},{"$f":"All!AE613","v":0},{"$f":"All!AF613","v":0},{"$f":"All!AG613","v":0},{"$f":"All!AH613","v":0},{"$f":"All!AI613","v":0},{"$f":"All!AJ613","v":0},{"$f":"All!AK655","v":0},{"$f":"All!AL655","v":0},{"$f":"All!AM655","v":0},{"$f":"All!AN655","v":0},{"$f":"All!AO655","v":0},{"$f":"All!AP655","v":0},{"$f":"All!AQ655","v":0},{"$f":"All!AR655","v":0},{"$f":"All!AS655","v":0},{"$f":"All!AT655","v":0}]
[null,{"$f":"All!B614","v":"8"},{"$f":"All!C614","v":"8.3"},{"$f":"All!D614","v":"8.3.1"},{"$f":"All!E614","v":0},{"$f":"All!F614","v":"8.3.1.2"},{"$f":"All!G614","v":0},{"$f":"All!H614","v":0},{"$f":"All!I614","v":"8.3.1.2.4"},{"$f":"All!J614","v":"8.3.1.2.4: Are customers informed of how they can access, review and request updates to their personal data?\n"},{"$f":"All!K614","v":0},{"$f":"All!L614","v":0},{"$f":"All!M614","v":"Recommended"},{"$f":"All!N614","v":"Recommended"},{"$f":"All!O614","v":"BizOps"},{"$f":"All!P614","v":0},{"$f":"All!Q614","v":0},{"$f":"All!R614","v":0},{"$f":"All!S614","v":0},{"$f":"All!T614","v":0},{"$f":"All!U614","v":0},{"$f":"All!V614","v":0},{"$f":"All!W614","v":0},{"$f":"All!X614","v":0},{"$f":"All!Y614","v":0},{"$f":"All!Z614","v":0},{"$f":"All!AA614","v":0},{"$f":"All!AB614","v":0},{"$f":"All!AC614","v":0},{"$f":"All!AD614","v":0},{"$f":"All!AE614","v":0},{"$f":"All!AF614","v":0},{"$f":"All!AG614","v":0},{"$f":"All!AH614","v":0},{"$f":"All!AI614","v":0},{"$f":"All!AJ614","v":0},{"$f":"All!AK656","v":0},{"$f":"All!AL656","v":0},{"$f":"All!AM656","v":0},{"$f":"All!AN656","v":0},{"$f":"All!AO656","v":0},{"$f":"All!AP656","v":0},{"$f":"All!AQ656","v":0},{"$f":"All!AR656","v":0},{"$f":"All!AS656","v":0},{"$f":"All!AT656","v":0}]
[null,{"$f":"All!B615","v":"8"},{"$f":"All!C615","v":8.4},{"$f":"All!D615","v":"8.4.1"},{"$f":"All!E615","v":"8.4.1: Providers shall limit the personal information that is collected from customers and is retained, used, or shared."},{"$f":"All!F615","v":"8.4.1.1"},{"$f":"All!G615","v":"8.4.1.1: LIMIT PERSONAL DATA COLLECTION\nProviders should not collect personal data indiscriminately. By limiting personal data collection to the minimum necessary, providers may limit potential negative consequences in the event of a data breach involving personal data. Both the type and amount of personal data collected should be limited to that which is necessary to fulfil the well-defined, legitimate purpose(s). \n\nProviders should carefully consider what personal data will be needed to realize a particular purpose before proceeding with the collection of personal data. They should document the type of personal data collected, as well as their justification for doing so as part of their information-handling policies and practices."},{"$f":"All!H615","v":"ISO 29100:2011, 5.4"},{"$f":"All!I615","v":"8.4.1.1.1"},{"$f":"All!J615","v":"8.4.1.1.1: Is the amount and type of personal data collected limited to that which is required, and unnecessary data not collected?\n"},{"$f":"All!K615","v":0},{"$f":"All!L615","v":0},{"$f":"All!M615","v":"Recommended"},{"$f":"All!N615","v":"Recommended"},{"$f":"All!O615","v":"BizOps"},{"$f":"All!P615","v":0},{"$f":"All!Q615","v":0},{"$f":"All!R615","v":0},{"$f":"All!S615","v":0},{"$f":"All!T615","v":0},{"$f":"All!U615","v":0},{"$f":"All!V615","v":0},{"$f":"All!W615","v":0},{"$f":"All!X615","v":0},{"$f":"All!Y615","v":0},{"$f":"All!Z615","v":0},{"$f":"All!AA615","v":0},{"$f":"All!AB615","v":0},{"$f":"All!AC615","v":0},{"$f":"All!AD615","v":0},{"$f":"All!AE615","v":0},{"$f":"All!AF615","v":0},{"$f":"All!AG615","v":0},{"$f":"All!AH615","v":0},{"$f":"All!AI615","v":0},{"$f":"All!AJ615","v":0},{"$f":"All!AK657","v":0},{"$f":"All!AL657","v":0},{"$f":"All!AM657","v":0},{"$f":"All!AN657","v":0},{"$f":"All!AO657","v":0},{"$f":"All!AP657","v":0},{"$f":"All!AQ657","v":0},{"$f":"All!AR657","v":0},{"$f":"All!AS657","v":0},{"$f":"All!AT657","v":0}]
[null,{"$f":"All!B616","v":"8"},{"$f":"All!C616","v":8.4},{"$f":"All!D616","v":"8.4.1"},{"$f":"All!E616","v":0},{"$f":"All!F616","v":"8.4.1.2"},{"$f":"All!G616","v":"8.4.1.2: LIMIT THE USE OF PERSONAL DATA\nProviders should limit the use of personal data to a specific purpose (e.g., performing KYC, assessing creditworthiness). Additional purposes may be required by law. The purpose should be specified before the data is collected and stored."},{"$f":"All!H616","v":"ISO 29100:2011 5.6"},{"$f":"All!I616","v":"8.4.1.2.1"},{"$f":"All!J616","v":"8.4.1.2.1: Is the use of personal data limited to specified purposes (e.g. performing KYC, assessing creditworthiness)?\n"},{"$f":"All!K616","v":0},{"$f":"All!L616","v":0},{"$f":"All!M616","v":"Recommended"},{"$f":"All!N616","v":"Recommended"},{"$f":"All!O616","v":"BizOps"},{"$f":"All!P616","v":0},{"$f":"All!Q616","v":0},{"$f":"All!R616","v":0},{"$f":"All!S616","v":0},{"$f":"All!T616","v":0},{"$f":"All!U616","v":0},{"$f":"All!V616","v":0},{"$f":"All!W616","v":0},{"$f":"All!X616","v":0},{"$f":"All!Y616","v":0},{"$f":"All!Z616","v":0},{"$f":"All!AA616","v":0},{"$f":"All!AB616","v":0},{"$f":"All!AC616","v":0},{"$f":"All!AD616","v":0},{"$f":"All!AE616","v":0},{"$f":"All!AF616","v":0},{"$f":"All!AG616","v":0},{"$f":"All!AH616","v":0},{"$f":"All!AI616","v":0},{"$f":"All!AJ616","v":0},{"$f":"All!AK658","v":0},{"$f":"All!AL658","v":0},{"$f":"All!AM658","v":0},{"$f":"All!AN658","v":0},{"$f":"All!AO658","v":0},{"$f":"All!AP658","v":0},{"$f":"All!AQ658","v":0},{"$f":"All!AR658","v":0},{"$f":"All!AS658","v":0},{"$f":"All!AT658","v":0}]
[null,{"$f":"All!B617","v":"8"},{"$f":"All!C617","v":8.4},{"$f":"All!D617","v":"8.4.1"},{"$f":"All!E617","v":0},{"$f":"All!F617","v":"8.4.1.3"},{"$f":"All!G617","v":"8.4.1.3: LIMIT THE RETENTION OF PERSONAL INFORMATION\nPersonal data should only be retained as long as necessary to fulfil the stated purposes and should thereafter be securely destroyed or anonymised.  \n\nIn addition, when it is no longer in use, personal data should be locked (i.e. archived, secured and exempted from further processing) for as long as required by law."},{"$f":"All!H617","v":"ISO 29100:2011 5.6"},{"$f":"All!I617","v":"8.4.1.3.1"},{"$f":"All!J617","v":"8.4.1.3.1: Is personal data only retained as long as necessary to fulfil the stated purposes, and thereafter securely destroyed or anonymised?\n"},{"$f":"All!K617","v":0},{"$f":"All!L617","v":0},{"$f":"All!M617","v":"Recommended"},{"$f":"All!N617","v":"Recommended"},{"$f":"All!O617","v":"BizOps"},{"$f":"All!P617","v":0},{"$f":"All!Q617","v":0},{"$f":"All!R617","v":0},{"$f":"All!S617","v":0},{"$f":"All!T617","v":0},{"$f":"All!U617","v":0},{"$f":"All!V617","v":0},{"$f":"All!W617","v":0},{"$f":"All!X617","v":0},{"$f":"All!Y617","v":0},{"$f":"All!Z617","v":0},{"$f":"All!AA617","v":0},{"$f":"All!AB617","v":0},{"$f":"All!AC617","v":0},{"$f":"All!AD617","v":0},{"$f":"All!AE617","v":0},{"$f":"All!AF617","v":0},{"$f":"All!AG617","v":0},{"$f":"All!AH617","v":0},{"$f":"All!AI617","v":0},{"$f":"All!AJ617","v":0},{"$f":"All!AK659","v":0},{"$f":"All!AL659","v":0},{"$f":"All!AM659","v":0},{"$f":"All!AN659","v":0},{"$f":"All!AO659","v":0},{"$f":"All!AP659","v":0},{"$f":"All!AQ659","v":0},{"$f":"All!AR659","v":0},{"$f":"All!AS659","v":0},{"$f":"All!AT659","v":0}]
[null,{"$f":"All!B618","v":"8"},{"$f":"All!C618","v":8.4},{"$f":"All!D618","v":"8.4.1"},{"$f":"All!E618","v":0},{"$f":"All!F618","v":"8.4.1.3"},{"$f":"All!G618","v":0},{"$f":"All!H618","v":0},{"$f":"All!I618","v":"8.4.1.3.2"},{"$f":"All!J618","v":"8.4.1.3.2: When it is no longer in use, is personal data locked (i.e. archived, secured and exempted from further processing) for as long as required by law?\n"},{"$f":"All!K618","v":0},{"$f":"All!L618","v":0},{"$f":"All!M618","v":"Recommended"},{"$f":"All!N618","v":"Recommended"},{"$f":"All!O618","v":"BizOps"},{"$f":"All!P618","v":0},{"$f":"All!Q618","v":0},{"$f":"All!R618","v":0},{"$f":"All!S618","v":0},{"$f":"All!T618","v":0},{"$f":"All!U618","v":0},{"$f":"All!V618","v":0},{"$f":"All!W618","v":0},{"$f":"All!X618","v":0},{"$f":"All!Y618","v":0},{"$f":"All!Z618","v":0},{"$f":"All!AA618","v":0},{"$f":"All!AB618","v":0},{"$f":"All!AC618","v":0},{"$f":"All!AD618","v":0},{"$f":"All!AE618","v":0},{"$f":"All!AF618","v":0},{"$f":"All!AG618","v":0},{"$f":"All!AH618","v":0},{"$f":"All!AI618","v":0},{"$f":"All!AJ618","v":0},{"$f":"All!AK660","v":0},{"$f":"All!AL660","v":0},{"$f":"All!AM660","v":0},{"$f":"All!AN660","v":0},{"$f":"All!AO660","v":0},{"$f":"All!AP660","v":0},{"$f":"All!AQ660","v":0},{"$f":"All!AR660","v":0},{"$f":"All!AS660","v":0},{"$f":"All!AT660","v":0}]
[null,{"$f":"All!B619","v":"8"},{"$f":"All!C619","v":8.4},{"$f":"All!D619","v":"8.4.1"},{"$f":"All!E619","v":0},{"$f":"All!F619","v":"8.4.1.4"},{"$f":"All!G619","v":"8.4.1.4: LIMIT THE DISCLOSURE OF PERSONAL INFORMATION\nWhen personal data is transferred internationally, providers should be aware of any regulations specific to cross-border transfer of personal data."},{"$f":"All!H619","v":"ISO 29100:2011 5.6"},{"$f":"All!I619","v":"8.4.1.4.1"},{"$f":"All!J619","v":"8.4.1.4.1: Has an assessment been made to ensure that any international transfer of personal data (e.g. for data processing in another country) is compliant with regulations?\n"},{"$f":"All!K619","v":"1) Data Privacy Policy or data privacy rules of behaviour document\n- For international transfer of personal data, check that an assessment has been made to confirm any transfers are compliant with regulations specific to cross-border transfer of personal data."},{"$f":"All!L619","v":0},{"$f":"All!M619","v":"Standard Required"},{"$f":"All!N619","v":"Required"},{"$f":"All!O619","v":"BizOps"},{"$f":"All!P619","v":0},{"$f":"All!Q619","v":0},{"$f":"All!R619","v":0},{"$f":"All!S619","v":0},{"$f":"All!T619","v":0},{"$f":"All!U619","v":0},{"$f":"All!V619","v":0},{"$f":"All!W619","v":0},{"$f":"All!X619","v":0},{"$f":"All!Y619","v":0},{"$f":"All!Z619","v":0},{"$f":"All!AA619","v":0},{"$f":"All!AB619","v":0},{"$f":"All!AC619","v":0},{"$f":"All!AD619","v":0},{"$f":"All!AE619","v":0},{"$f":"All!AF619","v":0},{"$f":"All!AG619","v":0},{"$f":"All!AH619","v":0},{"$f":"All!AI619","v":0},{"$f":"All!AJ619","v":0},{"$f":"All!AK661","v":0},{"$f":"All!AL661","v":0},{"$f":"All!AM661","v":0},{"$f":"All!AN661","v":0},{"$f":"All!AO661","v":0},{"$f":"All!AP661","v":0},{"$f":"All!AQ661","v":0},{"$f":"All!AR661","v":0},{"$f":"All!AS661","v":0},{"$f":"All!AT661","v":0}]
[null,{"$f":"All!B620","v":0},{"$f":"All!C620","v":0},{"$f":"All!D620","v":0},{"$f":"All!E620","v":0},{"$f":"All!F620","v":0},{"$f":"All!G620","v":0},{"$f":"All!H620","v":0},{"$f":"All!I620","v":0},{"$f":"All!J620","v":0},{"$f":"All!K620","v":0},{"$f":"All!L620","v":0},{"$f":"All!M620","v":0},{"$f":"All!N620","v":0},{"$f":"All!O620","v":0},{"$f":"All!P620","v":0},{"$f":"All!Q620","v":0},{"$f":"All!R620","v":0},{"$f":"All!S620","v":0},{"$f":"All!T620","v":0},{"$f":"All!U620","v":0},{"$f":"All!V620","v":0},{"$f":"All!W620","v":0},{"$f":"All!X620","v":0},{"$f":"All!Y620","v":0},{"$f":"All!Z620","v":0},{"$f":"All!AA620","v":0},{"$f":"All!AB620","v":0},{"$f":"All!AC620","v":0},{"$f":"All!AD620","v":0},{"$f":"All!AE620","v":0},{"$f":"All!AF620","v":0},{"$f":"All!AG620","v":0},{"$f":"All!AH620","v":0},{"$f":"All!AI620","v":0},{"$f":"All!AJ620","v":0}]

{"sheet":"Definitions","index":16,"n_rows":124,"n_cols":20,"rows_kept":124,"cut":false,"hidden":false,"merged":[[1,1,1,2],[1,5,1,7],[1,9,1,11],[1,13,1,15],[1,17,1,19]]}
[]
[null,{"$f":"UPPER(CHOOSE(LanguageNumber,F2,J2,N2,R2))","v":"DEFINITIONS"},{"$f":"CHOOSE(LanguageNumber,H2,L2,P2,T2)","v":0},null,null,"Definitions",null,null,null,"Définition",null,null,null,"Definiciones"]
[null,{"$f":"CHOOSE(LanguageNumber,F3,J3,N3,R3)","v":"Terms"},"Definitions",null,null,"Terms","ID","Definitions",null,"Terme","ID","Définition",null,"Términos","ID","Definiciones",null,null,"ID"]
[null,"3LoD","See Three Lines of Defence - below.",null,null,"3LoD",1,"See Three Lines of Defence - below.",null,"3LD",{"$f":"$G4","v":1},"Voir \"trois lignes de défense\" ci-dessous.",null,"3LoD",{"$f":"$G4","v":1},"Ver Tres Líneas de Defensa - a continuación.",null,null,{"$f":"$G4","v":1}]
[null,{"$f":"CHOOSE(LanguageNumber,F5,J5,N5,R5)","v":"Access credentials"},{"$f":"CHOOSE(LanguageNumber,H5,L5,P5,T5)","v":"Information used to access a mobile money account, such as phone number, customer ID and security credentials. "},null,null,"Access credentials",2,"Information used to access a mobile money account, such as phone number, customer ID and security credentials. ",null,"Identifiants d'accès",{"$f":"$G5","v":2},"Informations permettant d'accéder à un compte d'argent mobile, telles que le numéro de téléphone, l'identifiant du client et ses informations de sécurité . ",null,"Credenciales de acceso",{"$f":"$G5","v":2},"Información utilizada para acceder a la cuenta del dinero móvil, como por ejemplo, número de teléfono, ID del cliente y credenciales de seguridad. ",null,null,{"$f":"$G5","v":2}]
[null,"Agent aggregator","An agent aggregator is an intermediary company between the provider and a set of agents. The agent aggregator recruits, contracts and manages the agents, and the provider has a single contract with the agent aggregator.",null,null,"Agent aggregator",3,"An agent aggregator is an intermediary company between the provider and a set of agents. The agent aggregator recruits, contracts and manages the agents, and the provider has a single contract with the agent aggregator.",null,"Agrégateur d'agents",3,"Un agrégateur d'agents est une société intermédiaire entre le prestataire et un ensemble d'agents. L'agrégateur recrute, forme et gère les agents, le prestataire n'étant en contrat qu'avec l'agrégateur d'agents.  ",null,"Agregador de agentes",3,"Un agregador de agentes es una compañía intermediaria entre el proveedor y un conjunto de agentes. El agregador de agentes recluta, contrata y gestiona los agentes, y el proveedor tiene un único contrato con el agregador de agentes.",null,null,3]
[null,"Agent Management (Agent)","Mobile Money Provider's function which manages the agent network. Responsible for recruiting, training and monitoring performance of agents, and ensuring an effective distribution network.",null,null,"Agent Management (Agent)",4,"Mobile Money Provider's function which manages the agent network. Responsible for recruiting, training and monitoring performance of agents, and ensuring an effective distribution network.",null,"Gestion des agents (Agent)",4,"Fonction du prestataire de service d’argent mobile chargée de la gestion du réseau d’agents. Elle est responsable du recrutement, de la formation et de la surveillance des agents et veille à l’efficacité du réseau de distribution. ",null,"Gestión de Agentes (Agente)",4,"Función del Proveedor del Dinero Móvil que gestiona la red de agentes. Responsable de contratar, capacitar y monitorear el desempeño de los agentes, así como de garantizar una red de distribución efectiva.",null,null,4]
[null,"Aggregate mobile money liabilities","The sum total of e-money held in the mobile money system across all accounts. The value of the custodial account(s) must be equal to or greater than the total value of e-money.",null,null,"Aggregate mobile money liabilities",5,"The sum total of e-money held in the mobile money system across all accounts. The value of the custodial account(s) must be equal to or greater than the total value of e-money.",null,"Total des engagements d'argent mobile",5,"Le montant total des sommes de monnaie électronique détenues sur l’ensemble des comptes du système d’argent mobile. Le montant total du ou des comptes séquestres doit être supérieur ou égal à l'encours total de monnaie électronique.",null,"Total de pasivos del dinero móvil",5,"La suma total del dinero electrónico incluido en todas las cuentas del sistema del dinero móvil. El valor de la(s) cuenta(s) de custodia debe ser igual o mayor que el valor total del dinero electrónico.",null,null,5]
[null,"AML / ML","Anti-Money Laundering / Money Laundering",null,null,"AML / ML",6,"Anti-Money Laundering / Money Laundering",null,"AML / ML",6,"Anti-Money Laundering / Money Laudering : Lutte contre le blanchiment de capitaux / blanchiment de capitaux ",null,"ALD / LD",6,"Anti lavado de activos / lavado de activos",null,null,6]
[null,"Audit","An audit is a high-level review of the mobile money business and reports to the senior governance that oversees the mobile money service.",null,null,"Audit",7,"An audit is a high-level review of the mobile money business and reports to the senior governance that oversees the mobile money service.",null,"Audit",7,"Un audit est un examen de haut niveau de l'activité d'argent mobile avec rapport aux dirigeants chargés de la supervision du service d'argent mobile. \n",null,"Auditoría",7,"Una auditoría es una revisión de alto nivel del negocio del dinero móvil y depende de la alta gobernanza que está a cargo del servicio del dinero móvil.",null,null,7]
[null,"Business continuity management / plan","Business continuity management (BCM) prepares the organization to continue delivery of products or services at acceptable predefined levels following a disruptive incident. BCM prepares an organization to deal with disruptive incidents that might otherwise prevent it from achieving its objectives.\nThe \"Business Continuity Plan\" (BCP) sets out how the business continuity requirements will be achieved.",null,null,"Business continuity management / plan",8,"Business continuity management (BCM) prepares the organization to continue delivery of products or services at acceptable predefined levels following a disruptive incident. BCM prepares an organization to deal with disruptive incidents that might otherwise prevent it from achieving its objectives.\nThe \"Business Continuity Plan\" (BCP) sets out how the business continuity requirements will be achieved.",null,"Plan de continuité de l'activité",8,"Le plan de continuité de l’activité (PCA) prépare l’organisation à maintenir son offre de produits ou de services à des niveaux acceptables prédéfinis à la suite d’un incident perturbateur. Le PCA aide les organisations à faire face à des incidents perturbateurs qui pourraient sinon les empêcher de réaliser leurs objectifs.\nLe plan de continuité de l’activité définit la manière dont les exigences en matière de continuité de l’activité devront être respectées.",null,"Gestión / plan de continuidad del negocio",8,"La Gestión de Continuidad del Negocio (BCM) prepara a la organización para continuar entregando los productos o servicios a niveles predefinidos aceptables después de un incidente disruptivo. BCM prepara a una organización para enfrentar incidentes disruptivos que de otro modo podrían impedir que se cumplan los objetivos.\nEl \"Plan de Continuidad del Negocio \" (BCP) establece cómo se cumplirán los requisitos de continuidad del negocio.",null,null,8]
[null,"Business Operations (BizOps)","Mobile Money Provider's function to manage the mobile money business and encompasses a number of business operations:\n - Mobile money product management;\n - Management of the day-to-day mobile money business;\n - Reporting to senior management.\nThe \"Business Operations Manager\" is in charge of the Business Operations function.",null,null,"Business Operations (BizOps)",9,"Mobile Money Provider's function to manage the mobile money business and encompasses a number of business operations:\n - Mobile money product management;\n - Management of the day-to-day mobile money business;\n - Reporting to senior management.\nThe \"Business Operations Manager\" is in charge of the Business Operations function.",null,"Exploitation (BizOps)",9,"Fonction du prestataire de service d’argent mobile chargée de la gestion de l’activité d’argent mobile. Elle englobe un certain nombre d’activités de l’entreprise :  \n - gestion des produits d’argent mobile ;\n - gestion courante de l’activité d’argent mobile ; \n - remontée d'informations vers la direction de l’entreprise.\nLe \"responsable de l’exploitation de l’activité d’argent mobile\" est en charge de cette fonction.",null,"Operaciones Comerciales (BizOps)",9,"Función del Proveedor del Dinero Móvil para gestionar el negocio del dinero móvil que abarca diversas operaciones comerciales:\n - Gestión de productos del dinero móvil;\n - Gestión diaria del negocio del dinero móvil;\n - Presentación de informes a la alta gerencia.\nEl \"Gerente de Operaciones Comerciales\" está a cargo de la función de Operaciones Comerciales.",null,null,9]
[null,"Capacity plan","A plan for the business and its systems that includes forecast growth and the planned expansion of business and system components to meet the forecast demand.",null,null,"Capacity plan",10,"A plan for the business and its systems that includes forecast growth and the planned expansion of business and system components to meet the forecast demand.",null,"Plan de capacité",10,"Plan relatif à l'entreprise et à ses systèmes qui prévoit la croissance attendue et le développement correspondant de l'activité et des systèmes pour répondre à la demande prévue.  ",null,"Plan de capacidades",10,"Un plan para el negocio y sus sistemas que incluye el crecimiento pronosticado y la expansión planificada del negocio y los componentes del sistema para satisfacer la demanda pronosticada.",null,null,10]
[null,"CFT / TF","Countering the Financing of Terrorism / Terrorist Financing",null,null,"CFT / TF",11,"Countering the Financing of Terrorism / Terrorist Financing",null,"CFT / FT",11,"Combatting the financing of terrorism / Financing of terrorism : lutte contre le financement du terrorisme / financement du terrorisme",null,"CFT / FT",11,"Contra el Financiamiento del Terrorismo / Financiamiento del Terrorismo",null,null,11]
[null,"Common law / civil law","Generally speaking, a country has a \"common-law\" legal tradition if its legal system (particularly with respect to commercial law) is derived from or heavily influenced by Anglo-American law. In contrast, a country has a \"civil-law\" legal tradition if its legal system (particularly with respect to commercial law) is derived from or heavily influenced by Continental European law.",null,null,"Common law / civil law",12,"Generally speaking, a country has a \"common-law\" legal tradition if its legal system (particularly with respect to commercial law) is derived from or heavily influenced by Anglo-American law. In contrast, a country has a \"civil-law\" legal tradition if its legal system (particularly with respect to commercial law) is derived from or heavily influenced by Continental European law.",null,"Droit commun / Droit civil",12,"De manière générale, un pays possède une tradition de « droit commun » lorsque son système juridique (notamment en ce qui concerne son droit commercial) provient de ou est profondément influencé par le droit anglo-américain. En revanche, un pays possède une tradition de « droit civil » lorsque son système juridique (notamment en ce qui concerne son droit commercial) provient de ou est profondément influencé par le droit européen continental.",null,"Common Law / derecho civil",12,"En términos generales, un país tiene una tradición jurídica de \"common-law\" si su sistema jurídico (particularmente respecto del derecho comercial) se deriva o está altamente influenciado por el derecho angloamericano. Por el contrario, un país tiene una tradición jurídica de \"derecho civil\" si su sistema jurídico (particularmente respecto del derecho comercial) se deriva o está altamente influenciado por el derecho continental europeo.",null,null,12]
[null,"Completed transactions","Transactions can pass through several pending stages, sometimes known as \"initiated\", \"authorized\", \"pending\" or similar terms. Funds may or may not be reserved during these pending stages. At the end of the process funds are moved between the relevant accounts and the transaction is termed completed.\nWhen counting transaction volumes and reconciling funds with the custodial bank or ecosystem partners, it is important that parties agree whether \"initiated\" or \"completed\" transactions should be counted.",null,null,"Completed transactions",13,"Transactions can pass through several pending stages, sometimes known as \"initiated\", \"authorized\", \"pending\" or similar terms. Funds may or may not be reserved during these pending stages. At the end of the process funds are moved between the relevant accounts and the transaction is termed completed.\nWhen counting transaction volumes and reconciling funds with the custodial bank or ecosystem partners, it is important that parties agree whether \"initiated\" or \"completed\" transactions should be counted.",null,"Transaction conclue",13,"Au cours de leur réalisation, les transactions peuvent passer par différents stades, parfois désignés par les termes \"initiées\", \"autorisées\", \"en attente\" ou d'autres termes similaires. Les fonds correspondants peuvent être retenus ou non pendant ces stades de réalisation. En fin de processus, les fonds sont transférés entre les comptes concernés et la transaction est considérée conclue. Lors de la comptabilisation des fonds et du rapprochement des opérations avec la banque dépositaire ou les partenaires de l'écosystème financier, il est important que les parties se mettent d'accord sur la question de savoir s'il faut inclure ou non les transactions \"initiées\" avec les transactions \"conclues\".",null,"Transacciones completadas",13,"Las transacciones pueden atravesar diversas etapas pendientes, en ocasiones denominadas como \"iniciadas\", \"autorizadas\", \"pendientes\" o términos similares. Los fondos pueden estar reservados, o no, durante estas etapas pendientes. Al finalizar el proceso, los fondos son transferidos entre las cuentas relevantes y se completa la transacción.\nAl contabilizar los volúmenes de transacciones y conciliar los fondos con el banco custodio o los socios del ecosistema financiero, es importante que las partes se pongan de acuerdo en si se deben contar las transacciones \"iniciadas\" o \"completadas\".",null,null,13]
[null,"CRM system","Customer Relationship Management system: A system that holds customer data and presents it to customer operations staff, often managing their interaction with the customer through workflow. Mobile operators typically have a CRM system for their mobile phone accounts, and some providers prefer to manage mobile money customers through their existing CRM system.",null,null,"CRM system",14,"Customer Relationship Management system: A system that holds customer data and presents it to customer operations staff, often managing their interaction with the customer through workflow. Mobile operators typically have a CRM system for their mobile phone accounts, and some providers prefer to manage mobile money customers through their existing CRM system.",null,"Système CRM",14,"De l'anglais \"Customer Relationship Management system\" (système de gestion des relations avec les clients): un système qui conserve les données relatives aux clients et les présente aux équipes commerciales, en gérant souvent leurs contacts avec les clients dans le cadre de processus normalisés. Les opérateurs mobiles ont généralement un système CRM pour leurs comptes de téléphonie mobile, et certains prestataires préfèrent gérer leurs clients de l'argent mobile dans le cadre de leur système CRM existant.",null,"Sistema CRM",14,"Sistema de Gestión de Relaciones con el Cliente: Un sistema que contiene datos de los clientes y los presenta al personal de operaciones con el cliente, generalmente gestionando su interacción con el cliente a través de un flujo de trabajo. Por lo general, los operadores móviles cuentan con un sistema CRM para sus cuentas de teléfonos móviles, y algunos proveedores prefieren gestionar sus clientes del dinero móvil mediante sus sistemas CRM existentes.",null,null,14]
[null,"Custodial bank / custodial account","Customer funds are normally held in a pooled account in one or more custodial banks. These funds are then covered by the normal financial regulations and protected against failure of the mobile money provider.\nCustodial banks are also sometimes known as Trust Banks.",null,null,"Custodial bank / custodial account",15,"Customer funds are normally held in a pooled account in one or more custodial banks. These funds are then covered by the normal financial regulations and protected against failure of the mobile money provider.\nCustodial banks are also sometimes known as Trust Banks.",null,"Banque dépositaire / compte séquestre",15,"Les fonds des clients sont généralement conservés sur un compte commun (appelé compte séquestre ou compte de cantonnement) auprès d'une ou plusieurs banques dépositaires. Ces fonds sont alors couverts par les réglementations financières habituelles et protégés contre la défaillance du prestataire de service d'argent mobile. Les banques dépositaires sont également parfois appelées banques mandataires ou fiduciaires.",null,"Banco custodio / cuenta de custodia",15,"Normalmente, los fondos de los clientes están incluidos en una cuenta común en uno o más bancos custodio. Por eso estos fondos están cubiertos por las regulaciones financieras normales y protegidos contra incumplimientos del proveedor del dinero móvil.\nEn ocasiones, los bancos custodios también son conocidos como Bancos Fiduciarios.",null,null,15]
[null,"Customer Service (CustServ)","Mobile Money Provider's function to provide an interface to customers, to resolve issues and answer questions. Typically includes a call centre, but may also employ walk-in service centres or other ways of reaching customers directly. Includes back-office functional expertise (second-line support to customer operations).",null,null,"Customer Service (CustServ)",16,"Mobile Money Provider's function to provide an interface to customers, to resolve issues and answer questions. Typically includes a call centre, but may also employ walk-in service centres or other ways of reaching customers directly. Includes back-office functional expertise (second-line support to customer operations).",null,"Service client (CustServ)",16,"Fonction du prestataire de service d’argent mobile chargée des contacts avec la clientèle pour résoudre les problèmes et répondre aux questions. Cette fonction comprend généralement un centre d’appels, mais peut également s'appuyer sur des centres de service sans rendez-vous ou d’autres canaux de contact direct avec les clients. Comprend l’expertise administrative opérationnelle (appui de deuxième ligne aux activités commerciales).",null,"Atención al Cliente (CustServ)",16,"Función del Proveedor del Dinero Móvil que brinda una interfaz con los clientes para resolver problemas y responder preguntas. Generalmente incluye un centro de atención telefónica, pero también puede emplear centros de atención en persona u otras formas de llegar a los clientes de manera directa. Incluye conocimientos técnicos de las funciones del back-office (soporte de segundo nivel a  operaciones del cliente).",null,null,16]
[null,"Direct Deposit","A Direct Deposit is a deposit made into a remote account – i.e. not the account belonging to the person giving money to the agent. This is done to bypass P2P charges and is probably the largest revenue leakage issue facing mobile operators at present. Deposits are normally free, so if a customer deposits into a recipient’s account then in effect they get a free P2P transfer. It’s doubly costly for the operator because they get no revenue and they have to pay commission to the agent for the transaction.",null,null,"Direct Deposit",17,"A Direct Deposit is a deposit made into a remote account – i.e. not the account belonging to the person giving money to the agent. This is done to bypass P2P charges and is probably the largest revenue leakage issue facing mobile operators at present. Deposits are normally free, so if a customer deposits into a recipient’s account then in effect they get a free P2P transfer. It’s doubly costly for the operator because they get no revenue and they have to pay commission to the agent for the transaction.",null,"Dépôt direct",17,"Un dépôt direct est un dépôt effectué sur un compte distant, autrement dit, sur un compte autre que celui détenu par la personne transférant l’argent à l’agent. Cette technique est employée afin d’éviter les frais de transfert entre deux individus. Il s’agit probablement du plus gros problème de perte de recettes auquel sont confrontés les opérateurs actuellement. Les dépôts sont habituellement gratuits. Si un client dépose une somme d’argent sur le compte d’un destinataire, le transfert entre les deux individus est gratuit. Les pertes sont doubles pour l’opérateur : non seulement il n’en tire aucun revenu mais il doit en plus payer à l’agent la commission pour la transaction.",null,"Depósito Directo",17,"Un Depósito Directo es un depósito realizado a un cuenta remota, es decir, no a la cuenta que pertenece a la persona que entrega el dinero al agente. Esto se realiza para evadir los cargos P2P y, probablemente, sea el mayor problema de pérdida de ingresos que enfrentan los operadores móviles en la actualidad. Normalmente, los depósitos son gratuitos, por lo tanto, si un cliente deposita en la cuenta del receptor, en efecto, obtiene una transferencia P2P gratis. Es doblemente costoso para el operador porque no obtiene ninguna ganancia y debe abonar al agente la comisión por la transacción.",null,null,17]
[null,"DMZ (De-Militarized Zone)","In computer security terminology, a DMZ (also referred to as a perimiter network) is a physical or logical subnetwork that contains and exposes an organization's external-facing services to an external network such as the internet.",null,null,"DMZ (De-Militarized Zone)",18,"In computer security terminology, a DMZ (also referred to as a perimiter network) is a physical or logical subnetwork that contains and exposes an organization's external-facing services to an external network such as the internet.",null,"DMZ (Zone démilitarisée)",18,"Dans la terminologie de la sécurité informatique, une DMZ (aussi appelée réseau de périmètre) est un sous-réseau physique ou logique qui contient et expose les services d’une organisation devant être accessibles depuis l’extérieur vers un réseau externe, comme internet.",null,"DMZ (Zona Desmilitarizada)",18,"En términos de seguridad informática, una DMZ (también conocida como red perimetral) es una subred física o lógica que contiene y expone los servicios externos de una organización a una red externa, tal como el Internet.",null,null,18]
[null,"Entities providing outsourced services","External parties that are contracted to provide a material part of the mobile money service.\n\nGenerally speaking, \"material\" outsourced services are those that could have a significant impact on the provider's operations, reputation, profitability, and/or regulatory compliance in the event of a failure or other unsatisfactory performance. Typically, this means entities that are performing operational activities (e.g. customer service staff, mobile money system) and which have access to customer data.\n\nAlso refer to the definition of \"outsourcing\".",null,null,"Entities providing outsourced services",19,"External parties that are contracted to provide a material part of the mobile money service.\n\nGenerally speaking, \"material\" outsourced services are those that could have a significant impact on the provider's operations, reputation, profitability, and/or regulatory compliance in the event of a failure or other unsatisfactory performance. Typically, this means entities that are performing operational activities (e.g. customer service staff, mobile money system) and which have access to customer data.\n\nAlso refer to the definition of \"outsourcing\".",null,"Entités assurant des services de sous-traitance",19,"Parties externes ayant signé un contrat aux fins de la fourniture d’une partie significative du service d’argent mobile.\n\nDe manière générale, les services de sous-traitance \"significatifs\" sont ceux pouvant avoir un impact significatif sur les opérations, la réputation, les profits du prestataire et/ou le respect par ce dernier des réglementations applicables en cas de défaut ou de performance insuffisante. Ce terme désigne typiquement les entités réalisant des activités opérationnelles (par exemple, personnel du service client, le système d’argent mobile) et ayant accès aux données concernant les clients.\n\nVoir également la définition du terme \"sous-traitance\".",null,"Entidades que prestan servicios tercerizados",19,"Partes externas contratadas para prestar una parte importante del servicio del dinero móvil.\n\nEn términos generales, los servicios \"importantes\" tercerizados son aquellos que podrían tener un impacto significativo en las operaciones, la reputación, la rentabilidad y/o el cumplimiento regulatorio del proveedor en caso de falla o desempeño insatisfactorio. Generalmente, significa las entidades que realizan actividades operativas (por ej., personal de atención al cliente, sistema del dinero móvil) y que tienen acceso a los datos de los clientes.\n\nTambién ver la definición de \"tercerización\".",null,null,19]
[null,"External recourse","Alternative external dispute resolution options that customers may utilize if they are not satisfied with the results of the provider's internal complaints process. Examples will vary by country and may include legal action and/or external mediation.",null,null,"External recourse",20,"Alternative external dispute resolution options that customers may utilize if they are not satisfied with the results of the provider's internal complaints process. Examples will vary by country and may include legal action and/or external mediation.",null,"Recours externe",20,"Processus alternatif externe de résolution des litiges qui permet aux clients de donner suite à une réclamation si le processus interne de résolution des réclamations du prestataire ne leur donne pas satisfaction. Les exemples varient en fonction du pays concerné et peuvent inclure des poursuites judiciaires ou une médiation externe.",null,"Recurso externo",20,"Opciones alternativas externas de resolución de controversias que los clientes podrían utilizar si no están satisfechos con los resultados del proceso interno de reclamos del proveedor. Los ejemplos variarán dependiendo del país y pueden incluir acciones legales y/o mediación externa.",null,null,20]
[null,"External system interfaces","The external system interfaces of the mobile money provider's system. Interfaces can include those for reconciliation with the trust bank, interoperability and international payments, merchant point of sale payments, online payments, and data exchange with business customers.",null,null,"External system interfaces",21,"The external system interfaces of the mobile money provider's system. Interfaces can include those for reconciliation with the trust bank, interoperability and international payments, merchant point of sale payments, online payments, and data exchange with business customers.",null,"Interface avec les systèmes externes",21,"Interface du système du prestataire avec des systèmes externes. Peut désigner des interfaces de rapprochement avec la banque fiduciaire, d’interopérabilité avec des partenaires de l’écosystème financier, de paiements internationaux, marchands (au point de vente ou en ligne) ou d’échange de données avec des entreprises clientes. ",null,"Interfaces de sistemas externos",21,"Las interfaces de sistemas externos del sistema del proveedor del dinero móvil. Pueden incluir interfaces para conciliación con el banco fiduciario, interoperabilidad y pagos internacionales, pagos en el punto de venta del comercio, pagos en línea e intercambio de datos con los clientes comerciales.",null,null,21]
[null,"FATF","Financial Action Task Force: An intergovernmental organization sponsored by  the G7 to develop policies to combat money laundering and terrorism financing.",null,null,"FATF",22,"Financial Action Task Force: An intergovernmental organization sponsored by  the G7 to develop policies to combat money laundering and terrorism financing.",null,"GAFI (FATF)",22,"Groupe d’action financière : organisation intergouvernementale soutenue par le G7 pour développer des politiques de lutte contre le blanchiment de capitaux et le financement du terrorisme.",null,"GAFI",22,"Grupo de Acción Financiera Internacional: Una organización intergubernamental patrocinada por el G7 para desarrollar políticas a fin de combatir el lavado de activos y el financiamiento del terrorismo.",null,null,22]
[null,"Fiduciary","Alternative term for Custodial Bank. An individual or legal entity that manages funds or other property (property held under a fiduciary contract or similar legal mechanism) for the benefit of one of more third parties (beneficiaries). Fiduciaries have a duty to act in the best interest of the beneficiaries of the fiduciary contract. Fiduciaries and fiduciary contracts are legal constructs that are typically found in countries with a civil-law legal tradition (i.e., derived from the Continental European legal tradition). NOTE: Trustees and trusts are similar legal constructs that are specific to countries with a common-law legal tradition (i.e., derived from the English or American legal tradition). ",null,null,"Fiduciary",23,"Alternative term for Custodial Bank. An individual or legal entity that manages funds or other property (property held under a fiduciary contract or similar legal mechanism) for the benefit of one of more third parties (beneficiaries). Fiduciaries have a duty to act in the best interest of the beneficiaries of the fiduciary contract. Fiduciaries and fiduciary contracts are legal constructs that are typically found in countries with a civil-law legal tradition (i.e., derived from the Continental European legal tradition). NOTE: Trustees and trusts are similar legal constructs that are specific to countries with a common-law legal tradition (i.e., derived from the English or American legal tradition). ",null,"Mandataire",23,"Appellation alternative des banques dépositaires. Personne physique ou morale qui gère des fonds ou d’autres biens (biens détenus en vertu d’un contrat fiduciaire ou d’un mécanisme juridique comparable) pour le bénéfice d’une ou plusieurs tierces parties (les bénéficiaires). Lesmandataires ont le devoir d’agir au mieux des intérêts des bénéficiaires du contrat fiduciaire. Les mandataires et contrats fiduciaires sont des concepts juridiques généralement rencontrés dans les pays ayant une tradition juridique de droit civil (inspirée du droit de l’Europe continentale). REMARQUE : les « trustees » (fiduciaires) et « trusts » (fiducies) sont des concepts similaires propres aux pays de tradition juridique de la common-law (inspirée du droit anglo-américain). Pour éviter toute confusion dans le présent document, les termes \"mandataire/contrat fiduciaire\" sont utilisés en référence aux dispositions relevant de la tradition juridique de droit civil, tandis que les termes \"fiduciaires/fiducies\" sont utilisés en référence aux dispositions relevant de la tradition juridique de common-law.",null,"Fiduciario",23,"Término alternativo para Banco Custodio. Una persona o entidad legal que administra los fondos u otros bienes (bienes en posesión conforme a un contrato fiduciario o mecanismo jurídico similar) en beneficio de una o más partes (beneficiarios). Los fiduciarios tienen el deber de actuar en favor de los intereses de los beneficiarios del contrato fiduciario. Los fiduciarios y los contratos fiduciarios son construcciones legales que generalmente se encuentran en países con una tradición jurídica de derecho civil (es decir, derivada de la tradición del derecho continental europeo). NOTA: Los fiduciarios y los fideicomisos son construcciones legales similares específicas de países con una tradición jurídica del common-law (es decir, derivada de la tradición jurídica inglesa o americana). ",null,null,23]
[null,"FIU","Financial Intelligence Unit: A national centre for the receipt and analysis of: (a) suspicious transaction reports; and (b) other information relevant to money laundering and financing of terrorism, and for the dissemination of the results of that analysis.",null,null,"FIU",24,"Financial Intelligence Unit: A national centre for the receipt and analysis of: (a) suspicious transaction reports; and (b) other information relevant to money laundering and financing of terrorism, and for the dissemination of the results of that analysis.",null,"CRF (FIU)",24,"Cellule du renseignement financier : un centre national pour la réception et l’analyse : (a) des déclarations d'opération suspecte, et (b) des autres informations relatives au blanchiment de capitaux et au financement du terrorisme, et de diffusion des résultats de cette analyse.",null,"UIF",24,"Unidad de Inteligencia Financiera: Un centro nacional para la recepción y el análisis de: (a) reportes de operaciones sospechosas; y (b) demás información relacionada con el lavado de activos y el financiamiento del terrorismo. La UIF también se encarga de divulgar los resultados del análisis.",null,null,24]
[null,"Finance Operations (FinOps)","Mobile Money Provider's function to manage financial operations. In particular, reconciliation and settlement with the trust bank and other financial partners. Ensures that e-money is balanced by real money in trust fund.",null,null,"Finance Operations (FinOps)",25,"Mobile Money Provider's function to manage financial operations. In particular, reconciliation and settlement with the trust bank and other financial partners. Ensures that e-money is balanced by real money in trust fund.",null,"Opérations financières (FinOps)",25,"Fonction du prestataire de service d’argent mobile chargée des activités financières, et notamment du rapprochement et des règlements avec la banque fiduciaire et les autres partenaires financiers. Veille à ce que l’encours d’argent électronique ait son équivalent en argent réel dans le fonds en fiducie.",null,"Operaciones Financieras (FinOps)",25,"Función del Proveedor del Dinero Móvil para gestionar las operaciones financieras. En particular, la conciliación y liquidación con el banco fiduciario y otros socios financieros. Garantiza que el dinero electrónico esté compensado con dinero real en los fondos fiduciarios.",null,null,25]
[null,"Financial ecosystem partners","For the purposes of the Code, “financial ecosystem partners” are entities that are connected to the mobile money service to provide a financial service. Examples include, but are not limited to, banks (custodial banks and account-holding banks), entities that send or receive bulk payments, International money transfer providers, ATM providers, payment switches, and other payment service providers (national and international). Entities would typically connect to the mobile money service via technical interfaces or data exchange.",null,null,"Financial ecosystem partners",26,"For the purposes of the Code, “financial ecosystem partners” are entities that are connected to the mobile money service to provide a financial service. Examples include, but are not limited to, banks (custodial banks and account-holding banks), entities that send or receive bulk payments, International money transfer providers, ATM providers, payment switches, and other payment service providers (national and international). Entities would typically connect to the mobile money service via technical interfaces or data exchange.",null,"Partenaires de l'écosystème financier",26,"Dans le cadre du Code de conduite, les « partenaires de l’écosystème financier » désignent les entités connectées au service d’argent mobile dans le but de fournir un service financier. Cela comprend par exemple, sans s’y limiter, les banques (banques dépositaires et autres établissements financiers détenteurs de comptes), les entités émettant ou recevant des paiements groupés, les prestataires de services de transfert d'argent à l'international, les prestataires de GAB, les prestataires de services de gestion de paiement et autres prestataires de services de paiement (nationaux ou internationaux). Ces entités sont généralement connectées au service d’argent mobile par le biais d’interfaces techniques ou de systèmes d’échange de données.",null,"Socios del ecosistema financiero",26,"Para los fines del Código, “socios del ecosistema financiero” son entidades que están conectadas con el servicio del dinero móvil para prestar un servicio financiero. Los ejemplos incluyen, sin carácter limitativo, bancos (bancos custodio y bancos tenedores de cuentas), entidades que envían o reciben pagos globales, proveedores internacionales de transferencias de dinero,  proveedores de cajeros automáticos, cambios y otros proveedores de servicios de pagos (nacionales e internacionales). Generalmente, las entidades se conectan al servicio del dinero móvil a través de interfaces técnicas o intercambio de datos.",null,null,26]
[null,"Fraud, Risk and AML Management \n(FraudRisk)","Mobile Money Provider's function which manages risk, fraud and AML. Sets policies and ensures the relevant departments fulfil the requirements for managing and mitigating risks. Operationally responsible for investigating frauds and watchlist screening. Should be implemented as a separate function from business operations to avoid conflict of interest.",null,null,"Fraud, Risk and AML Management \n(FraudRisk)",27,"Mobile Money Provider's function which manages risk, fraud and AML. Sets policies and ensures the relevant departments fulfil the requirements for managing and mitigating risks. Operationally responsible for investigating frauds and watchlist screening. Should be implemented as a separate function from business operations to avoid conflict of interest.",null,"Gestion des risques, de la fraude et de la lutte contre le blanchiment de capitaux (FraudRisk)",27,"Fonction du prestataire de service d’argent mobile chargée de la gestion des risques, de la fraude et de la lutte contre le blanchiment de capitaux. Définit les politiques et s’assure que les départements concernés respectent leurs obligations de gestion et de prévention des risques. A la responsabilité opérationnelle  des enquêtes relatives aux situations de fraude et de la vérification des listes de surveillance. Doit être séparée des activités d’exploitation pour éviter les conflits d’intérêts. ",null,"Gestión de Fraude, Riesgo y ALA\n(FraudRisk)",27,"Función del Proveedor del Dinero Móvil que realiza la gestión de riesgos, fraude y anti lavado de activos. Establece políticas y garantiza que los departamentos correspondientes cumplan con los requisitos para gestionar y mitigar los riesgos. Es operativamente responsable de investigar el fraude y analizar las listas de control. Se debe implementar como una función independiente de las operaciones del negocio para evitar conflictos de interés.",null,null,27]
[null,"Functional architecture","A Functional Architecture is a document describing the system architecture according to system function and interactions between functional components. It defines how the functions will operate together as the mobile money system. It is focused on function and logical interactions rather than hardware (which is covered in the infrastructure architecture).",null,null,"Functional architecture",28,"A Functional Architecture is a document describing the system architecture according to system function and interactions between functional components. It defines how the functions will operate together as the mobile money system. It is focused on function and logical interactions rather than hardware (which is covered in the infrastructure architecture).",null,"Architecture fonctionnelle",28,"L’architecture fonctionnelle est un document qui décrit l’architecture des systèmes en termes de fonctionnalités et d’interactions entre ses composants fonctionnels. Il définit le mode de fonctionnement commun des différents composants pour former le système de l’argent mobile et ne couvre que les fonctions et interactions logiques (les équipements informatiques proprement dits étant décrits dans l’architecture d’infrastructure).",null,"Arquitectura funcional",28,"Una Arquitectura Funcional es un documento que describe la arquitectura del sistema conforme a la función del sistema y a las interacciones entre los componentes funcionales. Define cómo las funciones operarán en conjunto como el sistema del dinero móvil. El foco está puesto en las interacciones funcionales y lógicas y no en el hardware (que está contemplado en la arquitectura de la infraestructura).",null,null,28]
[null,"Head of Mobile Money","The Head of Mobile money is responsible for running the mobile money service for the provider. This individual reports to senior management on the performance of the mobile money business against its strategic objectives.\nAlso known as Mobile Money CEO or similar title.",null,null,"Head of Mobile Money",29,"The Head of Mobile money is responsible for running the mobile money service for the provider. This individual reports to senior management on the performance of the mobile money business against its strategic objectives.\nAlso known as Mobile Money CEO or similar title.",null,"Responsable de l’exploitation de l’argent mobile",29,"Le Responsable de l’exploitation de l’argent mobile est chargé de la gestion du service d’argent mobile pour le compte du prestataire. Cette personne fournit à la direction générale des rapports concernant la performance de l’activité d’argent mobile comparée à ses objectifs stratégiques.\nÉgalement désigné par le titre de PDG Argent Mobile ou tout autre titre similaire.",null,"Jefe del Dinero Móvil",29,"El Jefe del Dinero Móvil es responsable de ejecutar el servicio del dinero móvil para el proveedor. Esta persona reporta a la alta gerencia el desempeño del negocio del dinero móvil en relación con sus objetivos estratégicos.\nTambién conocido como CEO del Dinero Móvil o cargo similar.",null,null,29]
[null,"Horizontal scaling / scalability","Horizontal scaling means expanding the system capacity by adding additional system components (rather than increasing the capacity of individual components, which is vertical scaling). It requires the system to be architected so that it can perform functions in parallel to use the additional components. The horizontal scalability of a system is its capability to scale horizontally.",null,null,"Horizontal scaling / scalability",30,"Horizontal scaling means expanding the system capacity by adding additional system components (rather than increasing the capacity of individual components, which is vertical scaling). It requires the system to be architected so that it can perform functions in parallel to use the additional components. The horizontal scalability of a system is its capability to scale horizontally.",null,"Expansion horizontale",30,"L'expansion horizontale désigne l'augmentation des capacités d'un système par l'ajout de composants supplémentaires (plutôt que par l'augmentation de la capacité de chaque composant, appelée expansion verticale). Elle nécessite que l'architecture du système l'autorise à exécuter des fonctions en parallèle de l'utilisation des composants supplémentaires.",null,"Escalamiento / escalabilidad horizontal",30,"Escalamiento horizontal significa expandir la capacidad del sistema agregando componentes adicionales del sistema (en lugar de aumentar la capacidad de los componentes individuales, que es escalamiento vertical). Requiere que la arquitectura del sistema permita realizar funciones en paralelo para utilizar los componentes adicionales. La escalabilidad horizontal de un sistema es su capacidad de escalar horizontalmente.",null,null,30]
[null,"Human Resources Management (HR)","Mobile Money Provider's function which manages employees within the mobile money functions. Responsible for recruitment, training and termination.",null,null,"Human Resources Management (HR)",31,"Mobile Money Provider's function which manages employees within the mobile money functions. Responsible for recruitment, training and termination.",null,"Gestion des ressources humaines (GRH)",31,"Fonction du prestataire de service d’argent mobile chargée de la gestion du personnel des différentes fonctions de l’argent mobile. Est responsable du recrutement, de la formation et du licenciement.",null,"Gestión de Recursos Humanos (RR.HH.)",31,"Función del Proveedor del Dinero Móvil que gestiona los empleados dentro de las funciones del dinero móvil. Responsable del reclutamiento, capacitación y finalización.",null,null,31]
[null,"Incident","An incident is an unplanned interruption to a service, a reduction in the quality of a service or an event that has not yet impacted the service to the customer.\nITIL 3 defines an incident as any event that is (1) unplanned; and (2) causes an interruption in service or a deterioration in service quality. ITIL lays out the foundations of Incident Management principles in order to address incidents quickly and restore services to full capacity as soon as possible. What is important to note regarding incidents is that any planned service disruption or reduction in quality is not an incident. For example, if you take systems offline for updating, backing up, or maintenance, it isn’t an incident, because it is planned. Additionally, a problem can be a problem without being an incident, because unless the problem causes an interruption in service or deterioration in quality, it isn’t an incident. In other words, if you discover an issue before it causes disruptions, by definition it isn’t an incident.",null,null,"Incident",32,"An incident is an unplanned interruption to a service, a reduction in the quality of a service or an event that has not yet impacted the service to the customer.\nITIL 3 defines an incident as any event that is (1) unplanned; and (2) causes an interruption in service or a deterioration in service quality. ITIL lays out the foundations of Incident Management principles in order to address incidents quickly and restore services to full capacity as soon as possible. What is important to note regarding incidents is that any planned service disruption or reduction in quality is not an incident. For example, if you take systems offline for updating, backing up, or maintenance, it isn’t an incident, because it is planned. Additionally, a problem can be a problem without being an incident, because unless the problem causes an interruption in service or deterioration in quality, it isn’t an incident. In other words, if you discover an issue before it causes disruptions, by definition it isn’t an incident.",null,"Incident",32,"Un incident est une interruption imprévue du fonctionnement d'un service, une baisse de la qualité d'un service ou un événement n'ayant pas encore eu d'impact sur le service aux clients.\nITIL 3 définit un accident comme tout événement qui est (1) inattendu, et (2) entraîne l'interruption d'un service ou la détérioration de la qualité d'un service. ITIL définiti les bases des principes de la gestion des incidents afin de résoudre ceux-ci rapidement et rétablir la pleine capacité des services aussi rapidement que possible. Il est important de noter que toute perturbation de service ou de détérioration de la qualité qui est prévue n'est pas considérée comme un accident. Par exemple, si vous arrêtez des systèmes pour mise à jour, sauvegarde ou maintenance, il ne s'agit pas d'un incident, car cette opération est planifiée, En outre, un problème n'est pas forcément un incident car il n'entraîne pas forcément une interruption d'un service ou la détérioration de la qualité, En d'autres termes, si vous découvrez un problème avant qu'il n'entraîne des perturbations, il ne s'agit pas d'un incident par définition.",null,"Incidente",32,"Un incidente es una interrupción no planificada del servicio, una reducción en la calidad de un servicio o un evento que todavía no afectó el servicio del cliente.\nITIL 3 define un incidente como un evento (1) no planificado; y (2) que causa una interrupción del servicio o un deterioro en la calidad del servicio. ITIL establece las bases de los principios de Gestión de Incidentes para responder rápidamente ante los incidentes y restablecer la plena capacidad de los servicios lo antes posible. En lo que respecta a incidentes, cabe destacar que cualquier interrupción del servicio o reducción de calidad no planificada no es un incidente. Por ejemplo, si los servicios están fuera de línea para su actualización, realización de copias de respaldo o mantenimiento, no se trata de un incidente porque es planificado. Además, un problema puede ser un problema sin ser un incidente, porque salvo el problema cause una interrupción del servicio o un deterioro de la calidad, no es un incidente. En otras palabras, si se descubre un problema antes de que cause interrupciones, por definición no se trata de un incidente.",null,null,32]
[null,"Information security","Information security includes three main dimensions: confidentiality, availability and integrity. Information security involves the application and management of appropriate security measures that involves consideration of a wide range of threats, with the aim of ensuring sustained business success and continuity, and minimising impacts of information security incidents. Information security is achieved through the implementation of an applicable set of controls, selected through the chosen risk management process and managed using an ISMS, including policies, processes, procedures, organizational structures, software and hardware to protect the identified information assets.",null,null,"Information security",33,"Information security includes three main dimensions: confidentiality, availability and integrity. Information security involves the application and management of appropriate security measures that involves consideration of a wide range of threats, with the aim of ensuring sustained business success and continuity, and minimising impacts of information security incidents. Information security is achieved through the implementation of an applicable set of controls, selected through the chosen risk management process and managed using an ISMS, including policies, processes, procedures, organizational structures, software and hardware to protect the identified information assets.",null,"Sécurité de l'information",33,"La sécurité de l'information revêt trois grandes dimensions : confidentialité, disponibilité et intégrité. Elle implique de mettre en place et de gérer des mesures de sécurité appropriées tenant compte d’un large éventail de risques, dans le but de garantir le bon fonctionnement durable de l’entreprise et de minimiser l’impact des incidents de sécurité. Elle passe par la mise en œuvre d’un ensemble adapté de mesures de prévention, sélectionnées dans le cadre du processus choisi de gestion des risques et gérées au moyen d’un SGSI, et se compose de politiques, processus, procédures, structures organisationnelles, logiciels et équipements ayant pour but de protéger les informations jugées sensibles.",null,"Seguridad de la información",33,"La seguridad de la información incluye tres dimensiones principales: confidencialidad, disponibilidad e integridad. La seguridad de la información involucra la aplicación y gestión de las medidas de seguridad adecuadas que incluye considerar una amplia gama de amenazas, con el objetivo de garantizar el éxito y la continuidad sostenida del negocio, y minimizar los impactos de los incidentes de seguridad de la información. La seguridad de la información se logra a través de la implementación de un conjunto de controles aplicables, seleccionados mediante el proceso de gestión de riesgos correspondiente y gestionados mediante un ISMS, que incluya políticas, procesos, procedimientos, estructuras organizacionales, software y hardware para proteger los dinero de información identificados.",null,null,33]
[null,"Information Security Management System (ISMS)","An Information Security Management System (ISMS) consists of the policies, procedures, guidelines, and associated resources and activities, collectively managed by an organization, in the pursuit of protecting its information assets. An ISMS is a systematic approach for establishing, implementing, operating, monitoring, reviewing, maintaining and improving an organization’s information security to achieve business objectives. It is based upon a risk assessment and the organization's risk acceptance levels designed to effectively treat and manage risks. ",null,null,"Information Security Management System (ISMS)",34,"An Information Security Management System (ISMS) consists of the policies, procedures, guidelines, and associated resources and activities, collectively managed by an organization, in the pursuit of protecting its information assets. An ISMS is a systematic approach for establishing, implementing, operating, monitoring, reviewing, maintaining and improving an organization’s information security to achieve business objectives. It is based upon a risk assessment and the organization's risk acceptance levels designed to effectively treat and manage risks. ",null,"Système de gestion de la sécurité des informations (SGSI)",34,"Un système de gestion de la sécurité des informations (SGSI) se compose des politiques, procédures, directives, ressources et activités s'y rattachant et gérées collectivement par une organisation dans le but de protéger les informations jugées sensibles. Un SGSI correspond à une approche systématique de la mise en place, de la mise en œuvre, du fonctionnement, du suivi, de l'examen, de la maintenance et de l'amélioration de la sécurité des informations détenues par une organisation en vue de la réalisation de ses objectifs d'entreprise. Il repose sur une évaluation des risques et le niveau de tolérance à ces risques accepté par l'organisation en vue de les prévenir et de les gérer efficacement. ",null,"Sistema de Gestión de Seguridad de la Información (ISMS)",34,"Un Sistema de Gestión de Seguridad de la Información (ISMS) consiste en políticas, procedimientos, lineamientos y recursos y actividades asociadas, gestionadas conjuntamente por una organización a fin de proteger sus activos de información. Un ISMS es un enfoque sistemático para establecer, implementar, operar, monitorear, revisar, mantener y mejorar la seguridad de la información de una organización para cumplir con los objetivos del negocio. Se basa en una evaluación de riesgos y en los niveles de aceptación de riesgos de una organización diseñados para tratar y gestionar los riesgos con eficacia. ",null,null,34]
[null,"Infrastructure architecture","The Infrastructure Architecture document describes the system architecture according to system hardware and interactions between hardware components. It defines how the hardware components will operate together as the mobile money system. It is includes details of physical components, such as servers, databases, network components and external physical connections. it is a literal representation of the system; a functional view is documented in the functional architecture.",null,null,"Infrastructure architecture",35,"The Infrastructure Architecture document describes the system architecture according to system hardware and interactions between hardware components. It defines how the hardware components will operate together as the mobile money system. It is includes details of physical components, such as servers, databases, network components and external physical connections. it is a literal representation of the system; a functional view is documented in the functional architecture.",null,"Architecture d’infrastructure",35,"L’architecture d’infrastructure est un document qui décrit l’architecture des systèmes en termes d’équipements physiques et d’interactions entre ces équipements. Il définit le mode de fonctionnement commun de ces équipements pour former le système de l’argent mobile et en détaille les composantes matérielles telles que serveurs, bases de données, équipements de réseau et connexions physiques externes. Il s’agit d’une représentation littérale du système,  la perspective fonctionnelle étant décrite par l’architecture fonctionnelle.",null,"Arquitectura de la infraestructura",35,"El documento de la Arquitectura de la Infraestructura describe la arquitectura del sistema conforme al hardware y a las interacciones entre los componentes del hardware. Define cómo los componentes del hardware operarán en conjunto como el sistema del dinero móvil. Incluye detalles de los componentes físicos, como los servidores, bases de datos, componentes de red y conexiones físicas externas. Es una representación literal del sistema; la visión funcional está documentada en la arquitectura funcional.",null,null,35]
[null,"Initiated transactions","Refer to \"completed transactions\"",null,null,"Initiated transactions",36,"Refer to \"completed transactions\"",null,"Transaction initiée",36,"Voir \"transaction conclue\"",null,"Transacciones iniciadas",36,"Ver \"transacciones completadas\"",null,null,36]
[null,"IPA - Initial Privacy Assessment","Initial Privacy Assessment to identify personal data. IPAs are simple questionnaires that are completed by the system owner in collaboration with the data owner.",null,null,"IPA - Initial Privacy Assessment",37,"Initial Privacy Assessment to identify personal data. IPAs are simple questionnaires that are completed by the system owner in collaboration with the data owner.",null,"EPC (IPA)",37,"Évaluation préalable de confidentialité. Permet d’identifier les données à caractère personnel. L’EPC est un simple questionnaire complété par le propriétaire du système en collaboration avec le propriétaire des données.",null,"IPA - Evaluación de Privacidad Inicial",37,"Evaluación de Privacidad Inicial para identificar datos personales. Las IPA son cuestionarios sencillos que completa el titular del sistema en colaboración con el titular de los datos.",null,null,37]
[null,"KYC tier","Under a risk-based approach, customers should be grouped into \"tiers\" according to the quantity and quality of KYC data provided. Different transaction/balance limits should be assigned to each tier accordingly. Higher transaction/balance limits should require more KYC and more verification. KYC tiers are referred to in 2.5.1 as \"minimum KYC\", \"regular KYC\", \"business customer KYC\".",null,null,"KYC tier",38,"Under a risk-based approach, customers should be grouped into \"tiers\" according to the quantity and quality of KYC data provided. Different transaction/balance limits should be assigned to each tier accordingly. Higher transaction/balance limits should require more KYC and more verification. KYC tiers are referred to in 2.5.1 as \"minimum KYC\", \"regular KYC\", \"business customer KYC\".",null,"Niveau de vérification d'identité (KYC Tier)",38,"Dans le cadre d'une approche fondée sur le niveau de risque, les clients doivent être regroupés en différentes catégories en fonction de la quantité et de la qualité des renseignements d'identité fournis. Différents plafonds d'opération/solde seront assignés à chaque catégorie en fonction du niveau de risque, les plafonds plus élevés requérant plus de renseignements d'identité et de vérifications. Les différents niveaux de vérification d'identité des clients sont mentionnés dans le sous-sous-principe 2.5.1 sous les termes \"vérification minimale\", \"vérification normale\" et \"vérification des clients professionnels\".",null,"Capa de CSC (Registro de Conocimiento del Cliente)",38,"Conforme a un enfoque basado en riesgos, se debe agrupar a los cliente en \"capas\" según la cantidad y la calidad de los datos de CSC suministrados. En consecuencia, se deben asignar diferentes límites de transacciones/saldos a cada capa. Los límites de transacciones/saldos más altos deben requerir un mayor CSC y más verificación. En 2.5.1 se hace referencia a las capas de CSC como \"CSC mínimo\", \"CSC regular\", \"CSC del cliente comercial\".",null,null,38]
[null,"Liquidity","Agents require both e-money and cash to service customers. Sufficient levels of both are required: if e-money levels are too low then agents cannot perform cash-ins and if cash is too low then agents cannot perform cash-outs. Agents can increase their e-money level by depositing cash with the provider. Alternatively, if super agents are offered, agents can use a super agent to manage their liquidity by exchanging quantities of e-money for cash or vice-versa.",null,null,"Liquidity",39,"Agents require both e-money and cash to service customers. Sufficient levels of both are required: if e-money levels are too low then agents cannot perform cash-ins and if cash is too low then agents cannot perform cash-outs. Agents can increase their e-money level by depositing cash with the provider. Alternatively, if super agents are offered, agents can use a super agent to manage their liquidity by exchanging quantities of e-money for cash or vice-versa.",null,"Liquidité",39,"Les agents ont besoin à la fois d’argent électronique et d’argent liquide pour servir les clients, avec des encours suffisant de chaque : avec un niveau insuffisant d’argent électronique, les agents ne peuvent pas effectuer des opérations de dépôts d’espèces, et avec un niveau insuffisant d’argent liquide, les agents ne peuvent pas effectuer des opérations de retrait d’espèces. Les agents peuvent augmenter leur encaisse d’argent électronique en déposant de l’argent liquide auprès du prestataire. Par ailleurs, lorsqu’il existe des super-agents, les agents peuvent s’en servir pour gérer leur liquidité en échangeant des sommes d’argent électronique contre de l’argent liquide ou inversement.",null,"Liquidez",39,"Para atender a los clientes, los agentes requieren no solo dinero electrónico sino también efectivo. Se requieren niveles suficientes de ambos: si los niveles de dinero electrónico son demasiado bajos entonces los agentes no pueden realizar ingresos de efectivo y si los niveles de efectivo son demasiado bajos entonces los agentes no pueden realizar retiros de efectivo. Los agentes pueden aumentar su nivel de dinero electrónico depositando efectivo al proveedor. Como alternativa, si se ofrecen súper agentes, los agentes pueden utilizar un súper agente para gestionar su liquidez mediante el intercambio de dinero móvil por efectivo y viceversa.",null,null,39]
[null,"Limits (transaction and balance limits)","Transaction and balance limits are imposed to manage the risk of abuse of the service (for fraud, money laundering or terrorist financing). Limits are typically low relative to bank accounts and this limits the impact of any abuse.",null,null,"Limits (transaction and balance limits)",40,"Transaction and balance limits are imposed to manage the risk of abuse of the service (for fraud, money laundering or terrorist financing). Limits are typically low relative to bank accounts and this limits the impact of any abuse.",null,"Plafonds (d'opération ou de solde) ",40,"Les plafonds d’opération et de solde sont mis en place pour empêcher l’usage malhonnête du service (à des fins de fraude, de blanchiment de capitaux ou de financement du terrorisme). Ces plafonds sont généralement faibles par rapport aux comptes bancaires, ce qui limite l’impact de toute utilisation malhonnête.",null,"Límites (límites de transacciones y saldos)",40,"Se imponen límites de transacciones y saldos para gestionar el riesgo de abuso del servicio (por fraude, lavado de activos o financiamiento del terrorismo). Generalmente, los límites relativos a las cuentas bancarias son bajos y esto limita el impacto de cualquier abuso.",null,null,40]
[null,"Management review","A management review is a detailed review of business operations and reports to the head of mobile money.",null,null,"Management review",41,"A management review is a detailed review of business operations and reports to the head of mobile money.",null,"Évaluation de la gestion",41,"Une évaluation de la gestion est un examen détaillé des activités, fourni sous forme de rapport à la direction de l’argent mobile.",null,"Revisión de gestión",41,"Una revisión de gestión es una revisión detallada de las operaciones y los informes al jefe del dinero móvil.",null,null,41]
[null,"Master agent","A master agent is a company with a number of outlets belonging to it. The master agent signs an agent agreement with the provider and manages its outlets as individual agents.",null,null,"Master agent",42,"A master agent is a company with a number of outlets belonging to it. The master agent signs an agent agreement with the provider and manages its outlets as individual agents.",null,"Agent principal (ou master agent)",42,"Un agent principal (ou « master agent ») est une société possédant un certain nombre de points de vente. L’agent principal signe un contrat d’agent avec le prestataire et gère ses points de vente comme autant d’agents individuels. ",null,"Agente maestro",42,"Un agente maestro es una compañía titular de una cantidad de comercios. El agente maestro firma un acuerdo de agente con el proveedor y gestiona sus comercios como agentes individuales.",null,null,42]
[null,"MLRO","Money Laundering Reporting Officer: an individual who is the focal point for a firm’s adherence to anti-money laundering and terrorist financing regulations.",null,null,"MLRO",43,"Money Laundering Reporting Officer: an individual who is the focal point for a firm’s adherence to anti-money laundering and terrorist financing regulations.",null,"Responsable anti-blanchiment (MLRO)",43,"Le responsable anti-blanchiment (ou Money Laundering Reporting Officer - MLRO en anglais) est le point de contact principal au sein d'une société en matière de respect des réglementations relatives à la lutte contre le blanchiment de capitaux et le financement du terrorisme (également appelé correspondant anti-blanchiment).",null,"MLRO",43,"Funcionario de Reporte del lavado de activos: una persona que es el punto focal para el cumplimiento por parte de una firma de las regulaciones contra el lavado de activos y el financiamiento del terrorismo.",null,null,43]
[null,"Mobile money data","The customer data held by the mobile money system. Providers should consider legislation regarding processing of data (production data and use of production data for testing), securing data, use of data for marketing / credit scoring and government access to data.",null,null,"Mobile money data",44,"The customer data held by the mobile money system. Providers should consider legislation regarding processing of data (production data and use of production data for testing), securing data, use of data for marketing / credit scoring and government access to data.",null,"Données de l'argent mobile",44,"Données des clients conservées par le système de l’argent mobile. Les prestataires doivent tenir compte  de la législation relative au traitement des données (données de production et utilisation de celles-ci pour des tests), à la sécurité des données, à l’utilisation des données à des fins de marketing / notation de crédit et à l’accès des pouvoirs publics aux données.",null,"Datos del dinero móvil",44,"Los datos de los clientes incluidos en el sistema del dinero móvil. Los proveedores deben considerar la legislación relativa al procesamiento de datos (datos de producción y uso de los datos de producción para la realización de pruebas), seguridad de los datos, uso de los datos para marketing / puntajes de crédito y acceso del gobierno a los datos.",null,null,44]
[null,"Mobile money services in scope of MMC","Mobile Money encompasses a number of services which are in scope of MM Certification. Mobile Money also enables payments for other services, which themselves are outside the scope of MMC (e.g. provision of utility services). Services are considered to be in scope of MMC if the customer's perception is that the service is being offered as part of mobile money (instead of being simply a payment channel: for example bill payment, where the customer does not perceive the utility company to be part of mobile money).\nThis can be determined from three factors:\n    1. Operation – is the service primarily set up and used via the mobile money handset interface or agents?\n    2. Branding – is the service named or co-branded with the MM service name, logo or brand?\n    3. Marketing – is the service marketed as a mobile money product, or is it exclusive to mobile money customers?\nIf the answer to at least two of these factors is \"yes\" then the service is likely to be perceived by customers as being part of the mobile money service and is therefore in scope of MMC.\n\nIn-scope services may include the following, depending on the provider:\n   • Transfers on-net (to registered and unregistered users) and off-net (e.g. to interoperability partners & banks)\n   • Transfers internationally (IMT)\n   • Deposits/withdrawals at agent or ATM\n   • Bill payments (as payment channel only)\n   • Merchant payments (as payment channel only)\n   • Loans, savings & insurance offered as part of mobile money",null,null,"Mobile money services in scope of MMC",45,"Mobile Money encompasses a number of services which are in scope of MM Certification. Mobile Money also enables payments for other services, which themselves are outside the scope of MMC (e.g. provision of utility services). Services are considered to be in scope of MMC if the customer's perception is that the service is being offered as part of mobile money (instead of being simply a payment channel: for example bill payment, where the customer does not perceive the utility company to be part of mobile money).\nThis can be determined from three factors:\n    1. Operation – is the service primarily set up and used via the mobile money handset interface or agents?\n    2. Branding – is the service named or co-branded with the MM service name, logo or brand?\n    3. Marketing – is the service marketed as a mobile money product, or is it exclusive to mobile money customers?\nIf the answer to at least two of these factors is \"yes\" then the service is likely to be perceived by customers as being part of the mobile money service and is therefore in scope of MMC.\n\nIn-scope services may include the following, depending on the provider:\n   • Transfers on-net (to registered and unregistered users) and off-net (e.g. to interoperability partners & banks)\n   • Transfers internationally (IMT)\n   • Deposits/withdrawals at agent or ATM\n   • Bill payments (as payment channel only)\n   • Merchant payments (as payment channel only)\n   • Loans, savings & insurance offered as part of mobile money",null,"Services de l'argent mobile entrant dans le champ d'application de la MMC",45,"L'argent mobile comprend un certain nombre de services inclus dans le champ d'application de la Certification de l'argent mobile (MMC). L'argent mobile permet également de payer d'autres services en dehors de ce champ d'application (par ex. la fourniture de services publics). Les services sont considérés comme inclus dans le champ d'application de la MMC si le client estime que le service est offert dans le cadre du service de l'argent mobile (et non comme un simple canal de paiement : par exemple, pour le paiement de factures, lorsque le client estime que la société fournissant le service public n'est pas un acteur de l'argent mobile).\nTrois facteurs doivent être pris en compte à cet effet :\n  1. Opération - le service est-il configuré et utilisé principalement par le biais de l'interface d'argent mobile sur le téléphone mobile ou d'agents ?\n  2. Marque - le service est-il identifié par le nom, le logo ou la marque du service d'argent mobile ou d'un partenariat incluant le service d'argent mobile ?\n  3. Marketing - le service est-il commercialisé en tant que produit de l'argent mobile ou est-il destiné exclusivement aux clients de l'argent mobile ?\nAu moins deux réponses affirmatives à ces trois questions signifient que le service a de grandes chances d'être perçu par les clients comme faisant partie du service d'argent mobile, et entre donc dans le champ d'application de la MMC.\n\nLes services entrant dans le champ d'application de la MMC incluent notamment les services suivants, en fonction du prestataire :\n   •Transferts sur réseau (aux utilisateurs enregistrés ou non enregistrés) et hors réseau (par ex. aux partenaires d'interopérabilité et aux banques)\n   • Transferts internationaux (IMT)\n   • Dépôts/retraits auprès d'un agent ou par le biais d'un GAB\n   • Paiement de factures (comme canal de paiement uniquement)\n   • Paiements de commerçants (comme canal de paiement uniquement)\n   • Services de prêts, d'épargne et d'assurance offerts dans le cadre du service d'argent mobile",null,"Servicios del dinero móvil dentro del alcance de MMC",45,"Dinero Móvil abarca una serie de servicios que se encuentran dentro del alcance de la Certificación del Dinero Móvil. Dinero Móvil también permite pagos por otros servicios fuera del alcance de of MMC (por ej., prestación de servicios públicos). Se considera que los servicios están dentro de MMC si el cliente percibe que el servicio se ofrece como parte de dinero móvil (en lugar de ser solo un canal de pago: por ejemplo, pago de facturas, cuando el cliente no percibe que la compañía de servicios públicos es parte de dinero móvil).\nEsto se puede determinar en base a tres factores:\n    1. Operación – ¿el servicio está configurado y es utilizado principalmente a través de la interfaz de dinero móvil en el dispositivo o de los agentes?\n    2. Marca – ¿el servicio lleva el nombre o la marca conjunta del nombre, logo o marca del servicio del dinero móvil?\n    3. Marketing – ¿el servicio se comercializa como un producto del dinero móvil o es exclusivo para clientes del dinero móvil?\nSi la respuesta a, por lo menos, dos de estos tres factores es \"sí\", entonces probablemente el servicio sea percibido por los clientes como parte del servicio del dinero móvil y, en consecuencia, se encuentre dentro del alcance de MMC.\n\nLos servicios dentro del alcance pueden incluir lo sigiuente, dependiendo del proveedor:\n   • Transferencias en la red (a usuarios registrados y no registrados) y fuera de la red (por ej., a socios de interoperabilidad y bancos)\n   • Transferencias internacionales (IMT)\n   • Depósitos/retiros en el agente o en cajeros automáticos\n   • Pagos de facturas (como canal de pagos solamente)\n   • Pagos a comerciantes (como canal de pagos solamente)\n   • Préstamo / ahorro / seguro ofrecido como parte del dinero móvil"]
[null,"Mobile money system","The system or systems that provide the mobile money service. In addition to the core accounting and transaction system it could also include systems such as reporting system, AML system, smartphone system, gateway system etc.",null,null,"Mobile money system",46,"The system or systems that provide the mobile money service. In addition to the core accounting and transaction system it could also include systems such as reporting system, AML system, smartphone system, gateway system etc.",null,"Système de l'argent mobile",{"$f":"$G49","v":46},"Le ou les systèmes qui permettent d’offrir le service d’argent mobile. Ils peuvent comprendre notamment, en plus du système de comptabilité et de transaction de base, des systèmes de production de rapports, de lutte contre le blanchiment de capitaux, de téléphonie intelligente, de passerelle etc. ",null,"Sistema del dinero móvil",46,"El sistema o los sistemas que prestan el servicio del dinero móvil. Además del sistema central contable y de transacciones, también podría incluir sistemas adicionales, como por ejemplo el sistema de generación de informes, sistema ALA, sistema para smartphones, sistema de gateway, etc.",null,null,46]
[null,"Mobile money system component","The individual server components that constitute the mobile money system. For example, the overall MM system could comprise a number of system components for presentation layer, interface layer, application layer and database layer. Several components could be duplicated for redundancy or capacity.",null,null,"Mobile money system component",47,"The individual server components that constitute the mobile money system. For example, the overall MM system could comprise a number of system components for presentation layer, interface layer, application layer and database layer. Several components could be duplicated for redundancy or capacity.",null,"Composante du système de l'argent mobile",47,"Désigne les composantes individuelles du serveur constituant le système de l'argent mobile. Par exemple, le système global de l'argent mobile peut intégrer un certain nombre de composantes système pour la couche présentation, la couche interface, la couche application et la couche de base de données. Plusieurs composantes peuvent être dupliquées pour assurer la redondance ou les capacités du système.",null,"Componente del sistema del dinero móvil",47,"Los componentes individuales del servidor que conforman el sistema del dinero móvil. Por ejemplo, todo el sistema del dinero móvil podría incluir una serie de componentes de sistema para la capa de presentación, la capa de interfaces, la capa de aplicaciones y la capa de bases de datos. Se pueden duplicar varios componentes para ofrecer redundancia o mayor capacidad."]
[null,"Net financial position","The net amount of funds that have been exchanged between the mobile money provider and each financial ecosystem partner - i.e. the volume of funds moving from provider to partner minus the volume of funds moving from partner to provider. This is identified by reconciliation.",null,null,"Net financial position",48,"The net amount of funds that have been exchanged between the mobile money provider and each financial ecosystem partner - i.e. the volume of funds moving from provider to partner minus the volume of funds moving from partner to provider. This is identified by reconciliation.",null,"Position financière nette",48,"Montant net des fonds échangés entre le prestataire d’argent mobile et chaque partenaire de l’écosystème financier, à savoir le montant des fonds circulant du prestataire vers le partenaire moins celui circulant du partenaire vers le prestataire. Ce montant est déterminé par le processus de rapprochement.",null,"Posición financiera neta",48,"El monto neto de los fondos intercambiados entre el proveedor del dinero móvil y cada socio del ecosistema financiero, es decir, el volumen de los fondos transferidos del proveedor al socio menos el volumen de los fondos transferidos del socio al proveedor. Esto se identifica con la conciliación.",null,null,48]
[null,"Off-net transaction","A transaction made to/from a financial ecosystem partner.",null,null,"Off-net transaction",49,"A transaction made to/from a financial ecosystem partner.",null,"Transactions hors réseau",49,"Transaction réalisée vers/depuis un partenaire de l’écosystème financier.",null,"Transacción fuera de la red",49,"Una transacción realizada hacia/desde un socio del ecosistema financiero.",null,null,49]
[null,"On-net transaction","A transaction made to/from an account belonging to the mobile money operator.",null,null,"On-net transaction",50,"A transaction made to/from an account belonging to the mobile money operator.",null,"Transaction sur réseau",50,"Transaction réalisée vers/depuis un compte appartenant à l’opérateur d’argent mobile.",null,"Transacción en la red",50,"Una transacción realizada hacia/desde una cuenta perteneciente al operador del dinero móvil.",null,null,50]
[null,"One-time code","See definition of \"voucher / one-time code\"",null,null,"One-time code",51,"See definition of \"voucher / one-time code\"",null,"Code à usage unique",51,"Voir la définition de \"code à usage temporaire/code à usage unique\"",null,"Código único",51,"Ver la definición de \"voucher/ código único\"",null,null,51]
[null,"Operational support period","Operational support is provided for the mobile money system by the technical operations team, which responds to incidents and service requests. The Operational Support Period defines which times and days that operational support will be provided. If applicable, it defines times when a reduced level of support (i.e. a reduced SLA) will be provided. The operational support period is defined by the SLA.",null,null,"Operational support period",52,"Operational support is provided for the mobile money system by the technical operations team, which responds to incidents and service requests. The Operational Support Period defines which times and days that operational support will be provided. If applicable, it defines times when a reduced level of support (i.e. a reduced SLA) will be provided. The operational support period is defined by the SLA.",null,"Horaires de support opérationnel",52,"Le support opérationnel au système de l’argent mobile est fourni par l’équipe technique, qui répond aux incidents et aux demandes d’assistance. Les horaires du support opérationnel sont les jours et les heures auxquels ce support est fourni. Le cas échéant, ils définissent également les périodes de support réduit (SLA réduite). Les horaires du support opérationnel sont définis par la convention de niveau de service (SLA).  ",null,"Período de soporte operativo",52,"El soporte operativo para el sistema del dinero móvil es brindado por el equipo de operaciones técnicas, que responde ante incidentes y solicitudes de servicio. El Período de Soporte Operativo define los horarios y los días en que se brindará el soporte operativo. Si corresponde, definirá las horas en las que se brindará un nivel reducido de soporte (es decir, un SLA reducido). El período de soporte operativo es definido por el SLA.\n",null,null,52]
[null,"Outsourcing / outsourced services","Outsourcing is the use of a third party (whether an affiliated or unaffiliated entity) to perform activities that would normally be performed directly by the provider (see Basel Committee on Banking Supervision (2005), \"Outsourcing in Financial Services\"). For example, customer service team or mobile money system could be outsourced.\n\nGenerally speaking, \"material outsourced services\" are those that could have a significant impact on the provider's operations, reputation, profitability, and/or regulatory compliance in the event of a failure or other unsatisfactory performance.\n\nAlso refer to the definition of \"entities providing outsourced services\".",null,null,"Outsourcing / outsourced services",53,"Outsourcing is the use of a third party (whether an affiliated or unaffiliated entity) to perform activities that would normally be performed directly by the provider (see Basel Committee on Banking Supervision (2005), \"Outsourcing in Financial Services\"). For example, customer service team or mobile money system could be outsourced.\n\nGenerally speaking, \"material outsourced services\" are those that could have a significant impact on the provider's operations, reputation, profitability, and/or regulatory compliance in the event of a failure or other unsatisfactory performance.\n\nAlso refer to the definition of \"entities providing outsourced services\".",null,"Sous-traitance / services de sous-traitance",53,"La sous-traitance désigne le fait de faire appel à un tiers (qu’il soit ou non une entité affiliée) pour des activités qui seraient normalement réalisées directement par le prestataire (voir Comité de Bâle sur le contrôle bancaire (2005), \"La sous-traitance de services financiers\"). Par exemple, le personnel du service client ou le système d’argent mobile peuvent être sous-traités. \n\nDe manière générale, les services de sous-traitance \"significatifs\" sont ceux pouvant avoir un impact significatif sur les opérations, la réputation, les profits du prestataire et/ou le respect par ce dernier des réglementations applicables en cas de défaut ou de performance insuffisante.\n\nVoir également la définition du terme \"entités assurant des services de sous-traitance\".",null,"Tercerización / servicios tercerizados",53,"Tercerización es el uso de un tercero (ya sea una entidad afiliada o no) para realizar actividades que normalmente serían realizadas en forma directa por el proveedor (ver Comité de Supervisión Bancaria de Basilea (2005), \"Outsourcing in Financial Services - Tercerización de Servicios Financieros\"). Por ejemplo, se podría tercerizar el equipo de atención al cliente del sistema del dinero móvil.\n\nEn términos generales, los \"servicios importantes tercerizados\" son aquellos que podrían tener un impacto significativo en las operaciones, la reputación, la rentabilidad y/o el cumplimiento regulatorio del proveedor en caso de falla o desempeño insatisfactorio.\n\nConsultar también la definición de \"entidades que prestan servicios tercerizados\".",null,null,53]
[null,"Pending transactions","Refer to \"completed transactions\"",null,null,"Pending transactions",54,"Refer to \"completed transactions\"",null,"Transactions en cours",54,"Voir \"transaction conclue\"",null,"Transacciones pendientes",54,"Ver \"transacciones completadas\"",null,null,54]
[null,"Personal Data","Personal Data is private information of a customer that is held by the provider. Examples include KYC data, identity data, transaction data, location data and credit history. The MSISDN is personal data if the MSISDN can be linked to a named individual.\n\nGeneral Data Protection Regulation (GDPR) (EU) defines personal data:\n\"Personal data\" means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; \n\nData Protection Act (UK) defines personal data:\n   • Can a living individual be identified from the data?\n   • Does the data relate to the individual, whether in personal or family life, business or profession?\n   • Is the data obviously about a particular individual?\n   • Is the data linked to an individual so that it provides particular information about that individual?",null,null,"Personal Data",55,"Personal Data is private information of a customer that is held by the provider. Examples include KYC data, identity data, transaction data, location data and credit history. The MSISDN is personal data if the MSISDN can be linked to a named individual.\n\nGeneral Data Protection Regulation (GDPR) (EU) defines personal data:\n\"Personal data\" means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; \n\nData Protection Act (UK) defines personal data:\n   • Can a living individual be identified from the data?\n   • Does the data relate to the individual, whether in personal or family life, business or profession?\n   • Is the data obviously about a particular individual?\n   • Is the data linked to an individual so that it provides particular information about that individual?",null,"Données à caractère personnel",55,"Les données à caractère personnel sont les informations de nature privée que le prestataire détient concernant les clients. Elles comprennent par exemple les renseignements et justificatifs d’identité, les données relatives aux transactions, à la localisation et à l’historique de crédit. Elles comprennent également le MSISDN si ce dernier peut être relié à un individu nommé.\n\nLe Règlement général sur la protection des données (RGPD) (UE) inclut la définition suivante : \n«données à caractère personnel» désigne toute information se rapportant à une personne physique identifiée ou identifiable («personne concernée») ; est réputée être une «personne physique identifiable» une personne physique qui peut être identifiée, directement ou indirectement, notamment par référence à un identifiant, tel qu'un nom, un numéro d'identification, des données de localisation, un identifiant en ligne, ou à un ou plusieurs éléments spécifiques propres à son identité physique, physiologique, génétique, psychique, économique, culturelle ou sociale ; \n\nLa loi britannique relative à la protection des données (Data Protection Act) (RU) inclut la définition suivante :\n   • Une personne physique vivante peut-elle être identifiée à partir de ces données ?\n   • Les données sont-elles liées à une personne physique, à sa vie personnelle ou familiale, son activité ou sa profession ?\n   • Les données concernent-elles, sans équivoque, une personne physique particulière ?\n   • Les données sont-elles liées à une personne physique de manière à fournir des renseignements particuliers à propos de cette personne ?",null,"Datos Personales",55,"Los datos personales son información privada de un cliente que está en posesión del proveedor. Los ejemplos incluyen los datos de registros de conocimiento del cliente (CSC), los datos de identidad, los datos de transacciones, los datos de localización y el historial de crédito. El MSISDN es un dato personal si se puede vincular a una persona nombrada.\n\nLa Reglamento General de Protección de Datos (RGPD) (Unión Europea) define los datos personales:\n\"Datos personales\" se refiere a toda información sobre una persona física identificada o identificable (‘sujeto de los datos’); una persona física identificable es toda persona física que se puede identificar, directa o indirectamente, en particular mediante referencia a un identificador, tal como nombre, número de identificación, datos de localización, identificador en línea o uno o más factores propios de la identidad física, fisiológica, genética, mental, económica, cultural o social de esa persona física; \n\nLa Ley de Protección de Datos (Reino Unido) define los datos personales:\n¿Puede una persona viva ser identificada a partir de los datos?\n¿Los datos se relacionan con la persona, ya sea en su vida personal o familiar, su actividad comercial o profesión?\n¿Los datos se refieren obviamente a una persona en particular?\n¿Los datos se relacionan con una persona de forma tal que brinden información particular sobre esa persona?",null,null,55]
[null,"PIA - Privacy Impact Assessment ","Privacy Impact Assessment to determine and mitigate privacy risks during collection and processing of personal data.",null,null,"PIA - Privacy Impact Assessment ",56,"Privacy Impact Assessment to determine and mitigate privacy risks during collection and processing of personal data.",null,"EIVP",56,"Évaluation de l'impact sur la vie privée (Privacy Impact Assessment - PIA en anglais) pour identifier et prévenir les risques d'atteinte à la vie privée lors de la collecte et du traitement de données à caractère personnel.",null,"PIA - Evaluación de Impactos a la Privacidad ",56,"La Evaluación de Impactos a la Privacidad determina y mitiga los riesgos a la privacidad durante la recolección y el procesamiento de los datos personales.",null,null,56]
[null,"Point of Sale (PoS) transaction","A customer transaction at a merchant or an agent that is conducted using a Point of Sale (PoS) device instead of a phone. The transaction is normally initiated on the PoS device, although there is often an action required on the customer's device (e.g. to generate a code before the transaction or to provide confirmation after the transaction is initiated).\nPoS transactions include merchant payments and cash in/out transactions at agents.",null,null,"Point of Sale (PoS) transaction",57,"A customer transaction at a merchant or an agent that is conducted using a Point of Sale (PoS) device instead of a phone. The transaction is normally initiated on the PoS device, although there is often an action required on the customer's device (e.g. to generate a code before the transaction or to provide confirmation after the transaction is initiated).\nPoS transactions include merchant payments and cash in/out transactions at agents.",null,"Transaction en Point de Vente (PdV)",57,"Transaction client réalisée chez un commerçant ou un agent par le biais d’un terminal de Point de Vente (PdV) au lieu d’un téléphone. La transaction est généralement initiée à partir du terminal de Point de Vente, mais le processus inclut souvent la nécessité pour le client d’effectuer une action sur son appareil (par exemple, générer un code avant la transaction ou confirmer la transaction une fois celle-ci initiée).\rLes transactions en PdV incluent les paiements de commerçants et les dépôts/retraits d’espèces chez les agents.",null,"Transacción en el Punto de Venta (PoS)",57,"La transacción de un cliente en un comercio o agente realizada utilizando un dispositivo de Punto de Venta (PoS) en lugar de un teléfono. Si bien normalmente la transacción se inicia en el dispositivo PoS, por lo general se requiere una acción en el dispositivo del cliente (por ej., generar un código antes de la transacción o para confirmar después del inicio de la transacción).\nLas transacciones PoS incluyen pagos en el comercio y transacciones de ingreso/retiro de efectivo en los agentes.",null,null,57]
[null,"Problem","A problem is the root cause of one or more incidents. The root cause is not usually known at the time a problem record is created and the problem management process is responsible for further investigation.\nProblem management differs from incident management in that it deals with underlying issues that may or may not affect users. Unlike incident management, which aims to restore the service to the user as quickly as possible (often using a workaround), problem management aims to find a permanent solution to the issue.",null,null,"Problem",58,"A problem is the root cause of one or more incidents. The root cause is not usually known at the time a problem record is created and the problem management process is responsible for further investigation.\nProblem management differs from incident management in that it deals with underlying issues that may or may not affect users. Unlike incident management, which aims to restore the service to the user as quickly as possible (often using a workaround), problem management aims to find a permanent solution to the issue.",null,"Problème",58,"Un problème est la cause profonde d’un ou plusieurs incidents. La cause profonde n’est généralement pas connue au moment de la création d’un dossier de problème et le processus de gestion des problèmes a pour mission de procéder à un examen plus approfondi.\nLa gestion des problèmes diffère de la gestion des incidents en ce qu’elle concerne des problématiques sous-jacentes qui peuvent affecter ou non les utilisateurs. Contrairement à la gestion des incidents, qui vise à rétablir le service le plus rapidement possible auprès de l’utilisateur (en utilisant la plupart du temps une solution de contournement), la gestion des problèmes permet de trouver une solution permanente à un problème donné.",null,"Problema",58,"Un problema es la causa raíz de uno o más incidentes. Por lo general, cuando se crea el registro de un problema no se conoce la causa raíz, y el proceso de gestión de problemas es responsable de una mayor investigación.\nLa gestión de problemas difiere de la gestión de incidentes en que trata los problemas subyacentes que podrían, o no, afectar a los usuarios. A diferencia de la gestión de incidentes, que tiene por objeto restablecer el servicio al usuario lo más rápido posible (generalmente empleando una solución temporal), la gestión de problemas tiene por objeto encontrar una solución definitiva al problema.",null,null,58]
[null,"Project Management Office (PMO)","Mobile Money Provider's function which manages the gated process for implementing changes to the Mobile Money service.",null,null,"Project Management Office (PMO)",59,"Mobile Money Provider's function which manages the gated process for implementing changes to the Mobile Money service.",null,"Département de gestion de projet (PMO)",59,"Fonction du Prestataire de l'argent mobile chargée de gérer le processus formel visant à mettre en œuvre les changements apportés au service d'argent mobile.",null,"Oficina de Gestión de Proyectos [Project Management Office (PMO)]",59,"Función del Proveedor del Dinero Móvil que gestiona el proceso por etapas para implementar cambios en el servicio del Dinero Móvil.",null,null,59]
[null,"Real time","Real time transactions are those that are completed by moving funds between the relevant accounts synchronously with the transaction request. For example, a customer’s account is immediately credited when funds are cashed in. Similarly, the recipient’s account is credited at the same time that a sender’s account is debited.",null,null,"Real time",60,"Real time transactions are those that are completed by moving funds between the relevant accounts synchronously with the transaction request. For example, a customer’s account is immediately credited when funds are cashed in. Similarly, the recipient’s account is credited at the same time that a sender’s account is debited.",null,"Temps réel",60,"Les transactions en temps réel sont les transactions pour lesquelles le transfert des fonds entre les comptes concernés est effectué simultanément à la demande. Par exemple, le compte du client est crédité immédiatement de tout dépôt en espèces, ou de la même manière, le compte du bénéficiaire d'un virement est crédité en même temps que le compte de l'émetteur est débité. ",null,"Tiempo real",60,"Las transacciones en tiempo real son aquellas que se completan transfiriendo fondos entre las cuentas correspondientes de forma síncrona con la solicitud de la transacción. Por ejemplo, cuando los fondos ingresan son inmediatamente acreditados en la cuenta del cliente. De igual modo, los fondos son acreditados en la cuenta del receptor al mismo tiempo que son debitados de la cuenta del remitente.",null,null,60]
[null,"Reconciliation","Reconciliation is the process of ensuring that two sets of records (usually the balances of two accounts) are in agreement. For example, reconciliation is used to ensure that the e-money in the system is balanced by the money held in the custodial account. It is also used to agree the funds that have been exchanged with financial ecosystem partners. Reconciliation is done periodically (e.g. daily) and the start and end point of the period must be agreed by the parties, as well as which transactions to include (usually completed transactions and not initiated transactions).",null,null,"Reconciliation",61,"Reconciliation is the process of ensuring that two sets of records (usually the balances of two accounts) are in agreement. For example, reconciliation is used to ensure that the e-money in the system is balanced by the money held in the custodial account. It is also used to agree the funds that have been exchanged with financial ecosystem partners. Reconciliation is done periodically (e.g. daily) and the start and end point of the period must be agreed by the parties, as well as which transactions to include (usually completed transactions and not initiated transactions).",null,"Rapprochement",61,"Le rapprochement est le processus de vérification de la concordance de deux registres différents (généralement des registres d'opérations et de soldes). Le rapprochement permet notamment de vérifier que l'encours d'argent électronique dans le système correspond aux sommes conservées sur le(s) compte(s) séquestre(s). Il sert également à convenir des montants échangés entre les partenaires de l'écosystème financier. Ce rapprochement est effectué périodiquement (par ex. quotidiennement), et son point de départ et de fin doit être convenu entre les parties, ainsi que les transactions devant être incluses (généralement, uniquement les transactions conclues, et non les transactions initiées).  ",null,"Conciliación",61,"Conciliación es el proceso para garantizar la concordancia de dos conjuntos de registros (generalmente los saldos de dos cuentas). Por ejemplo, se emplea la conciliación para garantizar que el dinero electrónico en el sistema esté compensado por el dinero en la cuenta de custodia. También se utiliza para que haya coincidencia en los fondos intercambiados entre los socios del ecosistema financiero. La conciliación se realiza de forma periódica (por ej., diariamente) y las partes deben acordar el punto de inicio y fin del período, así como también qué transacciones se incluirán (en general las transacciones completadas y no las transacciones iniciadas).",null,null,61]
[null,"Recovery Point Objective (RPO)","In business continuity, the RPO is an acceptable loss of business information following a continuity incident. It is specified as a unit of time (e.g. seconds, minutes, or hours), meaning the point in time in the past beyond which data may be lost.",null,null,"Recovery Point Objective (RPO)",62,"In business continuity, the RPO is an acceptable loss of business information following a continuity incident. It is specified as a unit of time (e.g. seconds, minutes, or hours), meaning the point in time in the past beyond which data may be lost.",null,"RPO (Recovery Point Objective)",62,"En matière de continuité de l'activité, le RPO (Recovery Point Objective) est la perte de données maximale admissible (PDMA) qu'un système d'information peut être amené à perdre par suite d’un incident. Elle est généralement exprimée comme la durée entre l’incident provoquant la perte de données et la date la plus récente des données qui seront utilisées en remplacement des données perdues, sous forme d'une unité de temps (par ex. secondes, minutes ou heures).  ",null,"Objetivo de Punto de Recuperación (RPO)",62,"En la continuidad del negocio, el RPO es la pérdida aceptable de información comercial después de un incidente de continuidad. Se especifica como una unidad de tiempo (por ej., segundos, minutos u horas), y significa el punto de tiempo en el pasado a partir del cual se podrían perder datos.",null,null,62]
[null,"Recovery Time Objective (RTO)","In business continuity, the RTO is a timeframe for resuming a business activity at a specified minimum acceptable level.",null,null,"Recovery Time Objective (RTO)",63,"In business continuity, the RTO is a timeframe for resuming a business activity at a specified minimum acceptable level.",null,"RTO (Recovery Time Objective)",63,"En matière de continuité de l'activité, le RTO (Recovery Time Objective) est le délai souhaité de reprise de l’activité de l’entreprise à la suite d’un incident sur la base de la durée maximale d'interruption admissible (DMIA) définie par l’entreprise.\n",null,"Objetivo de Tiempo de Recuperación (RTO)",63,"En la continuidad del negocio, el RTO es un marco de tiempo para restablecer una actividad comercial a un nivel mínimo aceptable especificado.",null,null,63]
[null,"Reserved funds","Funds belonging to a customer that are held separate and may not be transacted pending completion of a transaction. Commonly used to hold funds for a suspended transaction or a transaction which requires another approval step.",null,null,"Reserved funds",64,"Funds belonging to a customer that are held separate and may not be transacted pending completion of a transaction. Commonly used to hold funds for a suspended transaction or a transaction which requires another approval step.",null,"Fonds réservés",64,"Fonds appartenant à un client qui sont conservés à part et ne peuvent être utilisés pour d'autres transactions dans l'attente de la réalisation d'une transaction donnée, généralement dans le cas d’une transaction en suspens ou qui nécessite un accord supplémentaire.",null,"Fondos de reserva",64,"Fondos pertenecientes a un cliente que se mantienen separados y no pueden ser utilizados hasta que no se complete la transacción. Comúnmente son utilizados para mantener los fondos para una transacción suspendida o una transacción que requiere otro paso de aprobación.",null,null,64]
[null,"Risk-based KYC","A risk-based KYC approach determines that higher-risk accounts or transactions (such as accounts with higher limits and/or greater functionality, transactions to/from high-risk markets, or accounts/transactions by politically exposed persons) require enhanced KYC, while simplified KYC is sufficient for lower-risk accounts (such as accounts with lower transaction and balance limits aimed at promoting financial inclusion).\nThis is the recommended approach to KKYC requirements for mobile money services.",null,null,"Risk-based KYC",65,"A risk-based KYC approach determines that higher-risk accounts or transactions (such as accounts with higher limits and/or greater functionality, transactions to/from high-risk markets, or accounts/transactions by politically exposed persons) require enhanced KYC, while simplified KYC is sufficient for lower-risk accounts (such as accounts with lower transaction and balance limits aimed at promoting financial inclusion).\nThis is the recommended approach to KKYC requirements for mobile money services.",null,"Vérification de l’identité du client basée sur les risques",65,"Une approche de vérification de l’identité des clients basée sur les risques permet de déterminer que les comptes et transactions présentant un risque plus élevé (tels que les comptes dont les plafonds sont plus élevés et/ou offrant plus de fonctionnalités, les transactions depuis/vers des marchés à haut risque, ou des comptes détenus/transactions réalisées par des personnes politiquement exposées) nécessitent une vérification de l’identité des clients plus stricte, tandis qu’une vérification simplifiée est suffisante pour les comptes à plus faible risque (tels que les comptes dont les plafonds d’opération/solde sont moins élevés afin de promouvoir l’inclusion financière).\nIl s’agit là de l’approche recommandée en ce qui concerne les exigences de vérification de l’identité des clients pour les services d’argent mobile.",null,"CSC basado en riesgos",65,"Un enfoque de CSC basado en riesgos determina que las cuentas o transacciones de alto riesgo (como las cuentas con límites más altos y/o mayores funcionalidades, transacciones hacia/desde mercados de alto riesgo, o cuentas/transacciones por parte de personas expuestas políticamente) requieren CSC intensificado, mientras que CSC simplificado es suficiente para cuentas de menor riesgo (como cuentas con límites de transacciones y saldos más bajos destinadas a promover la inclusión financiera).\nEste es el enfoque recomendado para los requisitos de KCSC para los servicios del dinero móvil.",null,null,65]
[null,{"$f":"CHOOSE(LanguageNumber,F69,J69,N69,R69)","v":"SAR / STR"},{"$f":"CHOOSE(LanguageNumber,H69,L69,P69,T69)","v":"Suspicious Activity Report / Suspicious Transaction Report: a formal mechanism for reporting suspected fraud / AML / CFT criminal activity to the relevant authorities."},null,null,"SAR / STR",66,"Suspicious Activity Report / Suspicious Transaction Report: a formal mechanism for reporting suspected fraud / AML / CFT criminal activity to the relevant authorities.",null,"DOS",66,"Déclaration d’opération(s) suspecte(s) : mécanisme officiel de déclaration auprès des autorités compétentes des activités jugées suspectes en termes de fraude, blanchiment de capitaux ou financement du terrorisme.",null,"RAS / ROS",66,"Reporte de Actividades Sospechosas / Reporte de Operaciones Sospechosas: un mecanismo formal para informar una supuesta actividad delictiva de fraude / ALA / CFT a las autoridades correspondientes.",null,null,66]
[null,"Secure channel","A \"secure channel\" is one that provides confidence for both customer and provider. The channel should:\n - prevent phishing by securely identifying the provider;\n - prevent fraud by securely identifying the customer;\n - be secure from cyber attacks that could listen in or sniff the information exchange.\nPhone calls would be the normal secure channel. Calls from the provider to the customer should be from a published number so that the customer can verify that the provider is calling.\nProviders should avoid using email as a communication channel for resolving issues with customers.",null,null,"Secure channel",67,"A \"secure channel\" is one that provides confidence for both customer and provider. The channel should:\n - prevent phishing by securely identifying the provider;\n - prevent fraud by securely identifying the customer;\n - be secure from cyber attacks that could listen in or sniff the information exchange.\nPhone calls would be the normal secure channel. Calls from the provider to the customer should be from a published number so that the customer can verify that the provider is calling.\nProviders should avoid using email as a communication channel for resolving issues with customers.",null,"Canal sécurisé",67,"Un \"canal sécurisé\" est un canal de confiance pour le client et le prestataire. Le canal doit :\n- prévenir tout risque d’hameçonnage en identifiant le prestataire de manière sécurisée ;\n- prévenir tout risque de fraude en identifiant le client de manière sécurisée;\n- être protégé contre les cyber attaques qui peuvent écouter ou capturer le trafic d’informations.\nLes appels téléphoniques représentent le canal sécurisé habituel. Le numéro utilisé par le prestataire pour joindre le client doit s’afficher pour permettre au client de vérifier qu’il s’agit d’un appel du prestataire.\nLes prestataires doivent éviter d’utiliser les e-mails comme canal de communication pour résoudre les problèmes rencontrés avec les clients.",null,"Canal seguro",67,"Un \"canal seguro\" es aquel que ofrece confianza al cliente y al proveedor. El canal debe:\n - prevenir la suplantación de identidad mediante la identificación segura del proveedor;\n - prevenir el fraude mediante la identificación segura del cliente;\n - ser seguro contra ataques cibernéticos que podrían escuchar o espiar el intercambio de información.\nLas llamadas telefónicas serían el canal seguro normal. Las llamadas del proveedor al cliente deben realizarse desde un número público para que el cliente pueda verificar que lo está llamando el proveedor.\nLos proveedores deben evitar utilizar el correo electrónico como un canal de comunicación para resolver problemas con los clientes.",null,null,67]
[null,"Security credentials","Secret information used by customer for authentication. e.g. PIN or password.",null,null,"Security credentials",68,"Secret information used by customer for authentication. e.g. PIN or password.",null,"Identifiants de sécurité",{"$f":"$G71","v":68},"Informations confidentielles utilisées par le client pour son authentification, mot de passe ou code confidentiel par exemple.",null,"Credenciales de seguridad",{"$f":"$G71","v":68},"La información secreta utilizada por el cliente para autenticación, por ej., PIN o contraseña.",null,null,{"$f":"$G71","v":68}]
[null,"Security testing","There are three aspects to security testing: \ni) Testing that is done at the time of development to ensure that the developed system is secure. \nii) Penetration testing, which is security testing that is done in the operational environment by an external party to look for security weaknesses and verify that the operational system is secure.\niii) Vulnerability scans, which are general \"housekeeping\" automated system and network checks. They should be run frequently to identify any new security vulnerabilities. \n\nWhite-box testing is a security testing method that can be used to validate whether code implementation follows intended design, to validate implemented security functionality, and to uncover exploitable vulnerabilities.",null,null,"Security testing",69,"There are three aspects to security testing: \ni) Testing that is done at the time of development to ensure that the developed system is secure. \nii) Penetration testing, which is security testing that is done in the operational environment by an external party to look for security weaknesses and verify that the operational system is secure.\niii) Vulnerability scans, which are general \"housekeeping\" automated system and network checks. They should be run frequently to identify any new security vulnerabilities. \n\nWhite-box testing is a security testing method that can be used to validate whether code implementation follows intended design, to validate implemented security functionality, and to uncover exploitable vulnerabilities.",null,"Tests de sécurité",69,"Il existe trois aspects aux tests de sécurité : \ni) Tester ce qui a été fait au moment du développement afin de s’assurer que le système développé est sûr. \nii) Les tests d’intrusion, des tests de sécurité effectués dans l’environnement opérationnel par une partie externe afin d’identifier les éventuelles faiblesses dans la sécurité et vérifier que le système d’exploitation est sécurisé.\niii) Les analyses de vulnérabilités, des vérifications globales et automatiques du réseau et du système pour en assurer l’entretien. Ces tests doivent être effectués fréquemment afin d’identifier les nouvelles vulnérabilités en matière de sécurité. \n\nLes tests en boîte blanche (white-box testing) est une méthode de test de sécurité qui peut être utilisée pour confirmer que le code implémenté est conforme aux exigences définies lors de son développement, pour valider la fonctionnalité de sécurité et pour identifier les vulnérabilités exploitables.",null,"Pruebas de seguridad",69,"Existen tres aspectos de las pruebas de seguridad: \ni) Las pruebas realizadas al momento del desarrollo para garantizar que el sistema desarrollado sea seguro. \nii) Pruebas de penetración, que son las pruebas de seguridad que se realizan en el entorno operativo por un tercero externo para buscar debilidades de la seguridad y verificar que el sistema operativo sea seguro.\niii) Análisis de vulnerabilidades, que es un sistema automatizado de \"limpieza\" general y verificaciones de la red. Se deben ejecutar con frecuencia para identificar nuevas vulnerabilidades a la seguridad. \n\nLas pruebas de caja blanca son un método de pruebas de seguridad que se puede utilizar para validar si la implementación de códigos sigue el diseño objetivo, a fin de validar las funcionalidades de seguridad implementadas y develar las vulnerabilidades que podrían explotarse.",null,null,69]
[null,"Senior Management","In the toolkits, \"senior management\" refers to the senior governance overseeing the mobile money business for the provider. This function is accountable for the overall mobile money business operation. Depending on the organization, this could the mobile operator's CEO or board of directors, or the group-level management, or other sufficiently senior body in the organization with appropriate oversight.",null,null,"Senior Management",70,"In the toolkits, \"senior management\" refers to the senior governance overseeing the mobile money business for the provider. This function is accountable for the overall mobile money business operation. Depending on the organization, this could the mobile operator's CEO or board of directors, or the group-level management, or other sufficiently senior body in the organization with appropriate oversight.",null,"Direction générale (Senior Management)",70,"Dans le cadre des outils d’auto-évaluation, le terme « direction générale » (senior management en anglais) désigne généralement la direction de l’argent mobile. Il fait référence aux dirigeants de l’activité d’argent mobile pour le prestataire. Cette fonction a la responsabilité globale de l’activité d’argent mobile. Selon l’organisation, il peut s’agir du PDG ou du conseil d’administration de l’opérateur mobile, de la direction du groupe ou de tout autre organe d’un niveau hiérarchique suffisant au sein de l’organisation, doté du pouvoir de supervision approprié.",null,"Alta Gerencia",70,"En los kits de herramientas, \"alta gerencia\" se refiere a la alta gobernanza que supervisa el negocio del dinero móvil para el proveedor. Esta función es responsable de toda la operación del negocio del dinero móvil. Dependiendo de la organización, podría ser el CEO o el directorio del operador móvil, o la gerencia a nivel del grupo, u otro órgano lo suficientemente jerárquico en la organización con supervisión adecuada.",null,null,70]
[null,"Service level","A service level is the expected performance level of a function. Service levels should apply to both business and technical functions. Examples of technical service levels are \"system availability\" and \"response time\". Examples of business service levels are \"call waiting time\" for calls to customer services and \"time to perform cash-in\" for agents.",null,null,"Service level",71,"A service level is the expected performance level of a function. Service levels should apply to both business and technical functions. Examples of technical service levels are \"system availability\" and \"response time\". Examples of business service levels are \"call waiting time\" for calls to customer services and \"time to perform cash-in\" for agents.",null,"Niveau de service",71,"Les niveaux de service représentent les attentes en matière de performance au niveau d’une fonction donnée. Les niveaux de service s’appliquent à la fois aux fonctions techniques et aux fonctions commerciales. Parmi les exemples de niveau de service technique figurent la « disponibilité du système » ou le « temps de réponse. Parmi les exemples de niveaux de service commercial figurent le « temps d’attente des appels » pour les appels de clients ou le \"délai de réalisation d’une remise d’espèces » pour les agents.",null,"Nivel de servicio",71,"Un nivel de servicio es el nivel de desempeño esperado de una función. Los niveles de servicio deben ser aplicables a las funciones comerciales y técnicas. Ejemplos de niveles de servicio técnico son \"disponibilidad del sistema\" y \"tiempo de respuesta\". Ejemplos de niveles de servicio comercial son \"tiempo de espera de la llamada\" para las llamadas a atención al cliente y \"tiempo para realizar el ingreso de efectivo\" para agentes.",null,null,71]
[null,"Service","Refer to \"Mobile money service\"",null,null,"Service",72,"Refer to \"Mobile money service\"",null,"Service",72,"Désigne le \"service d'argent mobile\"",null,"Servicio ",72,"Consultar \"Servicio del dinero móvil\""]
[null,"Service management Plan","The Service Management Plan contains a statement of the objectives that the service provider wishes to achieve, and contains, or refers to, numerous other aspects of the service and its management, including the service requirements, any recognised limitations,  statutory and regulatory obligations, contractual obligations, authorities and responsibilities, the approach to risk, the approach to working with third parties, the technology used to support the service management systems, and how the services will be measured, audited, reported and improved. The service management plan should guide the Provider to adhere to the policy for service managements, achieve the objectives of the service provider in the management of the service, and fulfil the requirements of the service.",null,null,"Service management Plan",73,"The Service Management Plan contains a statement of the objectives that the service provider wishes to achieve, and contains, or refers to, numerous other aspects of the service and its management, including the service requirements, any recognised limitations,  statutory and regulatory obligations, contractual obligations, authorities and responsibilities, the approach to risk, the approach to working with third parties, the technology used to support the service management systems, and how the services will be measured, audited, reported and improved. The service management plan should guide the Provider to adhere to the policy for service managements, achieve the objectives of the service provider in the management of the service, and fulfil the requirements of the service.",null,"Plan de gestion de service",73,"Le plan de gestion de service (PGS) énonce les objectifs que le prestataire du service souhaite réaliser, et contient ou fait référence à plusieurs autres aspects du service et de sa gestion, dont notamment le cahier des charges du service, les éventuelles limitations identifiées, les obligations statutaires et réglementaires, les obligations contractuelles, les pouvoirs et responsabilités, l’approche du risque, l’approche du travail avec des tiers, les technologies utilisées à l’appui des systèmes de gestion du service,  et la manière dont les services seront mesurés, audités, suivis et améliorés. Le PGS doit aider le prestataire à respecter la politique de gestion du service, à réaliser ses objectifs dans la gestion du service et à répondre aux exigences du service.",null,"Plan de gestión del servicio",73,"El Plan de Gestión del Servicio contiene una declaración de los objetivos que desea alcanzar el proveedor de servicios, y contiene, o hace referencia, a numerosos aspectos del servicio y su gestión, incluyendo los requisitos del servicio y las limitaciones reconocidas, las obligaciones estatutarias y regulatorias, las obligaciones contractuales, las autoridades y responsabilidades, el enfoque de riesgos, el enfoque de trabajar con terceros, la tecnología utilizada para respaldar los sistemas de gestión del servicio, y cómo se medirán, auditarán, informarán y mejorarán los servicios. El plan de gestión del servicio debe guiar al Proveedor para que cumpla con la política de gestión del servicio, alcance los objetivos del proveedor de servicios en la gestión del servicio, y cumpla con los requisitos del servicio.",null,null,73]
[null,"Service management system","The service management activities of the provider ensure that the mobile money service achieves its objectives. The service management system directs and controls these service management activities. The service management system includes policies, objectives, plans, processes, documentation and resources required for the design, delivery and improvement of the service. Adapted from ISO/IEC 20000 part 1 2011 Section 3.31 ",null,null,"Service management system",74,"The service management activities of the provider ensure that the mobile money service achieves its objectives. The service management system directs and controls these service management activities. The service management system includes policies, objectives, plans, processes, documentation and resources required for the design, delivery and improvement of the service. Adapted from ISO/IEC 20000 part 1 2011 Section 3.31 ",null,"Système de gestion de service",74,"Les activités de gestion du service permettent au prestataire de s’assurer que le service d’argent mobile atteint ses objectifs. Le système de gestion du service guide et contrôle les activités de gestion du service. Il comprend les politiques, objectifs, plans, processus, documentation et ressources nécessaires à la conception, à la mise à disposition et à l’amélioration du service. Adapté de la norme ISO/IEC 20000, chapitre 1 2011 section 3.31 ",null,"Sistema de gestión del servicio",74,"Las actividades de gestión del servicio del proveedor garantizan que el servicio del dinero móvil alcance sus objetivos. El sistema de gestión del servicio dirige y controla estas actividades de gestión del servicio. El sistema de gestión del servicio incluye las políticas, objetivos, planes, procesos, documentación y recursos requeridos para el diseño, prestación y mejora del servicio. Adaptado de ISO/IEC 20000 parte 1 2011 Sección 3.31 ",null,null,74]
[null,"Service request","A service request is a request for information, advice, access to a service or a pre-approved change (e.g. configuration change).",null,null,"Service request",75,"A service request is a request for information, advice, access to a service or a pre-approved change (e.g. configuration change).",null,"Demande d'assistance",75,"Une demande d’assistance est une demande de renseignement, de conseil, d’accès à un service ou de modification pré-autorisée (par ex. un changement de configuration).",null,"Solicitud de servicio",75,"Una solicitud de servicio es una solicitud de información, recomendación, acceso a un servicio o un cambio pre-aprobado (por ej., cambio en la configuración).",null,null,75]
[null,"Settlement","Settlement is the exchange of funds between the provider and a financial ecosystem partner to balance a net financial position that has been identified by reconciliation.",null,null,"Settlement",76,"Settlement is the exchange of funds between the provider and a financial ecosystem partner to balance a net financial position that has been identified by reconciliation.",null,"Règlement ",76,"Le règlement est l'échange de fonds entre le prestataire et un partenaire de l'écosystème financier en vue de solder une position financière nette déterminée dans le cadre du processus de rapprochement.",null,"Liquidación",76,"La liquidación es el intercambio de fondos entre el proveedor y un socio del ecosistema financiero para compensar una posición financiera neta identificada mediante conciliación.",null,null,76]
[null,"SLA","Service Level Agreement. Refer to the definition of \"Service Level\"",null,null,"SLA",77,"Service Level Agreement. Refer to the definition of \"Service Level\"",null,"SLA",77,"Convention de niveau de service (Service Level Agreement). Voir la définition de \"Niveau de service\"",null,"SLA",77,"Acuerdo de Nivel de Servicio. Ver la definición de \"Nivel de Servicio\"",null,null,77]
[null,"Smurfing","\"Smurfing\" means \"frequent transactions just under regulatory reporting thresholds\", which is an indicator of possible fraudulent activity being done to avoid scrutiny.",null,null,"Smurfing",78,"\"Smurfing\" means \"frequent transactions just under regulatory reporting thresholds\", which is an indicator of possible fraudulent activity being done to avoid scrutiny.",null,"Smurfing",78,"Le \"smurfing\" désigne des opérations répétées juste en-dessous des seuils de déclaration réglementaire, qui peuvent être le signe d'activités frauduleuses (fractionnement des opérations pour contourner des obligations de déclaration).",null,"Pitufeo",78,"\"Pitufeo\" significa \"transacciones frecuentes justo por debajo de los umbrales de reporte regulatorios\", que es un indicador de la realización de una posible actividad fraudulenta para evitar el escrutinio.",null,null,78]
[null,"Super agent","A super agent is an entity (often a bank) that provides liquidity and cash handling facilities to agents. Agents can use the super agent to manage their liquidity by exchanging quantities of e-money for cash or vice-versa.",null,null,"Super agent",79,"A super agent is an entity (often a bank) that provides liquidity and cash handling facilities to agents. Agents can use the super agent to manage their liquidity by exchanging quantities of e-money for cash or vice-versa.",null,"Super-agent",79,"Un super-agent est une entité (souvent une banque) qui fournit de la liquidité et des services de traitement des espèces aux agents. Le super-agent facilite la gestion de la liquidité des agents en permettant l’échange de sommes d’argent électronique contre des espèces ou inversement.",null,"Súper agente",79,"Un súper agente es una entidad (generalmente un banco) que ofrece a los agentes liquidez e instalaciones para el manejo de efectivo. Los agentes pueden utilizar un súper agente para gestionar su liquidez mediante el intercambio de dinero móvil por efectivo y viceversa.",null,null,79]
[null,"Suspended transaction (“in suspense”)","A transaction which is held in an incomplete state, where the funds are reserved pending investigation by the provider. Commonly used for disputed transactions, transaction reversals and following technical issues where the state of a transaction is unknown.",null,null,"Suspended transaction (“in suspense”)",80,"A transaction which is held in an incomplete state, where the funds are reserved pending investigation by the provider. Commonly used for disputed transactions, transaction reversals and following technical issues where the state of a transaction is unknown.",null,"Transaction suspendue (\"en suspens”)",80,"Transaction conservée dans un état inachevé avec retenue des fonds correspondants dans l'attente de recherches par le prestataire. Cela est couramment utilisé pour les transactions contestées, les annulations d'opération et à la suite de problèmes techniques lorsque le statut de la transaction n'est pas connu.",null,"Transacción suspendida (“en suspenso”)",80,"Una transacción que permanece en un estado incompleto, cuando los fondos son reservados estando pendientes de investigación por parte del proveedor. Comúnmente utilizado para transacciones objetadas, reversiones de transacciones y después de problemas técnicos cuando el estado de una transacción es desconocido.",null,null,80]
[null,"Suspicious Activity Reports ","Confirmed cases of ML/TF must be reported to the appropriate authorities via a formal Suspicious Activity Report (SAR). Providers should engage with relevant law enforcement agencies to facilitate reporting and/or investigation of mobile money-related criminal offences.",null,null,"Suspicious Activity Reports ",81,"Confirmed cases of ML/TF must be reported to the appropriate authorities via a formal Suspicious Activity Report (SAR). Providers should engage with relevant law enforcement agencies to facilitate reporting and/or investigation of mobile money-related criminal offences.",null,"Rapports d'opérations suspectes ",81,"Les cas avérés de blanchiment de capitaux / financement du terrorisme doivent être déclarés aux autorités concernées par le biais d'une déclaration formelle d'opération suspecte (DOS). Les prestataires doivent coopérer avec les services compétents chargés de faire appliquer la loi pour faciliter les déclarations et/ou les enquêtes relatives aux infractions pénales liées à l’argent mobile.",null,"Reportes de Actividades Sospechosas ",81,"Los casos confirmados de LA/FT deben ser reportados a las autoridades correspondientes mediante un Reporte de Actividades Sospechosas (RAS) formal. Los proveedores se deben contactar con los organismos de aplicación de la ley correspondientes para facilitar el reporte y/o la investigación de los delitos relacionados con el dinero móvil.",null,null,81]
[null,"System / System Component","Refer to \"Mobile Money System\" / \"Mobile Money System Component\"",null,null,"System / System Component",82,"Refer to \"Mobile Money System\" / \"Mobile Money System Component\"",null,"Système/Composante du système ",82,"Désigne le \"système de l'argent mobile\"/une \"composante du système de l'argent mobile\"",null,"Sistema / Componente del sistema",82,"Consultar \"Sistema del Dinero Mövil\" / \"Componente del Sistema del Dinero Móvil\""]
[null,"System connectivity","The network systems enabling connectivity of the provider's mobile money system with external systems.",null,null,"System connectivity",83,"The network systems enabling connectivity of the provider's mobile money system with external systems.",null,"Connectivité du système",83,"Les systèmes de réseau qui permettent de connecter le système d’argent mobile du prestataire à des systèmes externes. ",null,"Conectividad del sistema",83,"Los sistemas de red que permiten la conectividad del sistema del dinero móvil del proveedor con los sistemas externos.",null,null,83]
[null,"Technical Development","Function to develop the technical system that provides the mobile money service. Includes development of the technical integration to external systems. Some or all of the function may be outsourced.",null,null,"Technical Development",84,"Function to develop the technical system that provides the mobile money service. Includes development of the technical integration to external systems. Some or all of the function may be outsourced.",null,"Développement technique",84,"Fonction de développement du système technique permettant d’offrir le service d'argent mobile. Comprend le développement de l’intégration technique aux systèmes externes. Cette fonction peut être externalisée en partie ou totalement.",null,"Desarrollo técnico",84,"Función para desarrollar el sistema técnico que presta el servicio del dinero móvil. Incluye el desarrollo de la integración técnica con los sistemas externos. Se pueden tercerizar algunas o todas las funciones.",null,null,84]
[null,"Technical Operations (TechOps)","Mobile Money Provider's function to operationally manage the technical system that provides the mobile money service. May be outsourced and should be separated from the system development function. Responsible for day-to-day function of all components of the mobile money system and its interfaces to the mobile operator's network, banking partner(s), financial service providers, other mobile money providers, agents and customers.",null,null,"Technical Operations (TechOps)",85,"Mobile Money Provider's function to operationally manage the technical system that provides the mobile money service. May be outsourced and should be separated from the system development function. Responsible for day-to-day function of all components of the mobile money system and its interfaces to the mobile operator's network, banking partner(s), financial service providers, other mobile money providers, agents and customers.",null,"Opérations techniques (TechOps)",85,"Fonction du prestataire de service d’argent mobile chargée de la gestion opérationnelle du système technique qui permet d’offrir le service d’argent mobile. Peut être externalisée et doit être séparée de la fonction de développement du système. Responsable du fonctionnement courant de l’ensemble des composantes du système d’argent mobile et de ses interfaces avec le réseau de l’opérateur mobile, ses partenaires bancaires, les prestataires de services financiers, les autres prestataires de services d’argent mobile, les agents et les clients.",null,"Operaciones Técnicas (TechOps)",85,"Función del Proveedor del Dinero Móvil para gestionar operativamente el sistema técnico que presta el servicio del dinero móvil. Se puede tercerizar y debe ser independiente de la función de desarrollo del sistema. Es responsable de la función diaria de todos los componentes del sistema del dinero móvil y sus interfaces con la red del operador móvil, socio(s) bancario(s), proveedores de servicios financieros, otros proveedores del dinero móvil, agentes y clientes.",null,null,85]
[null,"Tipping off","Disclosing that an investigation into money laundering, terrorist financing or fraud is being contemplated or carried out, where the disclosure is likely to prejudice that investigation.",null,null,"Tipping off",86,"Disclosing that an investigation into money laundering, terrorist financing or fraud is being contemplated or carried out, where the disclosure is likely to prejudice that investigation.",null,"Divulgation (\"tipping off\")",86,"Le fait de divulguer qu’une enquête sur un cas de fraude, de blanchiment de capitaux ou de financement du terrorisme est envisagée ou en cours de réalisation, lorsque cette divulgation risque de nuire à l’enquête.",null,"Alertar",86,"Divulgar que se está contemplando o llevando a cabo una investigación de lavado de activos, financiamiento del terrorismo o fraude, cuando es probable que esta divulgación perjudique la investigación.",null,null,86]
[null,"Three Lines of Defence (3LoD)","The 3LoD model provides three levels of risk management and can be illustrated as follows:\n1. The organisation’s operational management assesses, controls and mitigates risks.\n2. The risk management function facilitates effective risk management practices by operational management .\n3. The internal auditing function assesses how effectively the organisation assesses and manages its risks, including the first and second lines of defence.\nSource: ECB RSMP",null,null,"Three Lines of Defence (3LoD)",87,"The 3LoD model provides three levels of risk management and can be illustrated as follows:\n1. The organisation’s operational management assesses, controls and mitigates risks.\n2. The risk management function facilitates effective risk management practices by operational management .\n3. The internal auditing function assesses how effectively the organisation assesses and manages its risks, including the first and second lines of defence.\nSource: ECB RSMP",null,"Trois lignes de défense (3LD)",87,"Le modèle 3LD définit trois niveaux de gestion du risque et peut être décrit comme suit :\n1. La direction opérationnelle de l’organisation évalue, contrôle et atténue les risques.  \n2. La fonction de gestion du risque veille à l’application de pratiques efficaces de gestion du risque par la direction opérationnelle.\n3. La fonction d’audit interne évalue l’efficacité de l’évaluation et de la gestion des risques effectuée par l’organisation, et notamment par la première et la deuxième ligne de défense. \nSource : ECB RSMP",null,"Tres Líneas de Defensa (3LoD)",87,"El modelo de 3LoD proporciona tres niveles de gestión de riesgo y se puede ilustrar de la siguiente manera:\n1. La gestión operativa de la organización evalúa, controla y mitiga los riesgos.\n2. La función de gestión de riesgos facilita las prácticas de gestión de riesgos efectivas por parte de la gestión operativa.\n3. La función de auditoría interna evalúa la eficacia de la organización al evaluar y gestionar sus riesgos, incluidas las primera y segunda línea de defensa.\nFuente: ECB RSMP",null,null,87]
[null,"Trust bank system","The system or systems of the trust bank that interface to the provider's mobile money system. Includes components for reconciliation of e-money against real money held by the trust bank.",null,null,"Trust bank system",88,"The system or systems of the trust bank that interface to the provider's mobile money system. Includes components for reconciliation of e-money against real money held by the trust bank.",null,"Système de la banque fiduciaire",88,"Le ou les systèmes de la banque fiduciaire qui sont connectés au système d’argent mobile du prestataire. Comprend les modules de rapprochement de l’encours de monnaie électronique avec les encaisses réelles détenues par la banque. ",null,"Sistema del banco fiduciario",88,"El sistema o los sistemas del banco fiduciario que interactúan con el sistema del dinero móvil del proveedor. Incluye componentes para la conciliación del dinero móvil contra el dinero real en posesión del banco fiduciario.",null,null,88]
[null,"Trustee","An individual or legal entity that manages funds or other property (property held in trust) for the benefit of one of more third parties (beneficiaries). Trustees have a fiduciary duty to act in the best interest of the beneficiaries of the trust. Trustees and trusts are legal constructs that are typically found in countries with a common-law legal tradition (i.e., derived from the English or American legal tradition). NOTE:  Fiduciaries and fiduciary contracts are similar legal constructs that are typically found in countries with a civil-law legal tradition (i.e., derived from the Continental European legal tradition).",null,null,"Trustee",89,"An individual or legal entity that manages funds or other property (property held in trust) for the benefit of one of more third parties (beneficiaries). Trustees have a fiduciary duty to act in the best interest of the beneficiaries of the trust. Trustees and trusts are legal constructs that are typically found in countries with a common-law legal tradition (i.e., derived from the English or American legal tradition). NOTE:  Fiduciaries and fiduciary contracts are similar legal constructs that are typically found in countries with a civil-law legal tradition (i.e., derived from the Continental European legal tradition).",null,"Fiduciaire (\"trustee\")",89,"Personne physique ou morale qui gère des fonds ou d’autres biens (biens détenus en fiducie – « trust » en anglais) pour le bénéfice d’une ou plusieurs tierces parties (les bénéficiaires). Les fiduciaires ont le devoir d’agir au mieux des intérêts des bénéficiaires de la fiducie. Les fiduciaires et fiducies sont des concepts juridiques généralement rencontrés dans les pays ayant une tradition juridique de common-law (inspirée du droit anglo-américain). REMARQUE : les mandataires et contrats fiduciaires sont des concepts similaires dans les pays de tradition juridique de droit civil (inspirée du droit de l’Europe continentale). Pour éviter toute confusion dans le présent document, les termes \"mandataire/contrat fiduciaire\" sont utilisés en référence aux dispositions relevant de la tradition juridique de droit civil, tandis que les termes \"fiduciaires/fiducies\" sont utilisés en référence aux dispositions relevant de la tradition juridique de common-law.",null,"Fiduciario",89,"Una persona o entidad legal que administra los fondos u otros bienes (bienes en fideicomiso) en beneficio de una o más partes (beneficiarios). Los fiduciarios tienen el deber fiduciario de actuar en favor de los intereses de los beneficiarios del fideicomiso. Los fiduciarios y los fideicomisos (en la forma trustees y trusts, en inglés) son construcciones legales que generalmente se encuentran en países con una tradición jurídica del common-law (es decir, derivada de la tradición jurídica inglesa o americana). NOTA:  Los fiduciarios y los contratos fiduciarios (en la forma fiduciaries y fiduciary contracts, en inglés) son construcciones legales que generalmente se encuentran en países con una tradición jurídica de derecho civil (es decir, derivada de la tradición del derecho continental europeo).",null,null,89]
[null,"Two-factor authentication","Two factor authentication is a common term in security. It means that the user authenticates themself with two pieces of identity, usually “something they have” (handset) and “something they know” (PIN). MSISDN itself is not sufficient as a factor because it is not secret. However, the handset (identified by MSISDN) is a suitable factor, as long as the transaction ensures that the customer actually has the handset. This is automatically done for customer-initiated transactions from the handset. For transactions initiated by another party, such as merchant payments where the merchant initiates the transaction, the handset can be verified by USSD push or pull mechanisms or by the customer generating a one-time code using the handset.",null,null,"Two-factor authentication",90,"Two factor authentication is a common term in security. It means that the user authenticates themself with two pieces of identity, usually “something they have” (handset) and “something they know” (PIN). MSISDN itself is not sufficient as a factor because it is not secret. However, the handset (identified by MSISDN) is a suitable factor, as long as the transaction ensures that the customer actually has the handset. This is automatically done for customer-initiated transactions from the handset. For transactions initiated by another party, such as merchant payments where the merchant initiates the transaction, the handset can be verified by USSD push or pull mechanisms or by the customer generating a one-time code using the handset.",null,"Authentification à deux facteurs",90,"L’authentification à deux facteurs est un terme commun dans le domaine de la sécurité. Il signifie que l’utilisateur s’authentifie en utilisant deux éléments justifiant de son identité, en général \"un élément qu’il possède\" (appareil) et \"un élément qu’il connaît\" (code confidentiel). Le MSISDN en lui-même n’est pas un facteur suffisant car ce numéro n’est pas confidentiel. L’appareil (identifié par le MSISDN) est quant à lui un facteur approprié, à condition que la transaction permette de garantir que le client est effectivement en possession de son appareil. Cette exigence est automatiquement vérifiée pour les transactions initiées par le client depuis son appareil. Pour les transactions initiées par une autre partie, tels que les paiements des commerçants lorsque la transaction est initiée par le commerçant, l’appareil peut être vérifié par des mécanismes push ou pull USSD ou par la génération d’un code à usage unique par le client depuis son appareil.",null,"Autenticación de dos factores",90,"La autenticación de dos factores es un término común en materia de seguridad. Significa que el usuario se autentica con dos identidades, generalmente “algo que tiene” (dispositivo) y “algo que sabe” (PIN). El MSISDN en sí no es un factor suficiente porque no es secreto. No obstante, el dispositivo (identificado por el MSISDN) es un factor adecuado, siempre que la transacción garantice que el cliente realmente tiene el dispositivo. Esto se realiza automáticamente para las transacciones iniciadas por el cliente desde el dispositivo. Para las transacciones iniciadas por otra parte, como pagos en el comercio donde el comercio inicia la transacción, el dispositivo puede ser verificado mediante los mecanismos push o pull de USSD o mediante la generación por parte del cliente de un código único utilizando el dispositivo.",null,null,90]
[null,"Validation and Verification","In this document, the terms Verification and Validation are used as follows in relations to ID checks:\nVerification: Confirmation of a person's ID (e.g. name, date of birth) by viewing corroborating documenation (e.g an identify card) that confirms the information.\nValidation: Confirming that the identity documentation is valid by checks with the document-issuing authority.",null,null,"Validation and Verification",91,"In this document, the terms Verification and Validation are used as follows in relations to ID checks:\nVerification: Confirmation of a person's ID (e.g. name, date of birth) by viewing corroborating documenation (e.g an identify card) that confirms the information.\nValidation: Confirming that the identity documentation is valid by checks with the document-issuing authority.",null,"Validation et vérification",91,"Dans le cadre du présent document, les termes \"vérification\" et \"validation\" ont le sens donné ci-dessous en ce qui concerne le contrôle de l'identité des clients :\nVérification : confirmation de l'identité d'une personne (par ex. nom, date de naissance) par le contrôle des pièces justificatives appropriées (par ex. une carte d'identité) attestant de la véracité des informations données.\nValidation : procédure visant à confirmer la validité de la pièce d'identité en interrogeant l'autorité émettrice du document en question.",null,"Validación y Verificación",91,"En este documento, los términos Verificación y Validación se utilizan como se indica a continuación respecto de las verificaciones de identidad:\nVerificación: Confirmación de la identidad de una persona (por ej., nombre, fecha de nacimiento) al visualizar la documentación respaldatoria (por ej., documento de identidad) que confirma la información.\nValidación: Confirmar que la documentación de identidad es válida mediante verificaciones con la autoridad emisora del documento."]
[null,"Vertical scaling / scalability","Vertical scaling means expanding the system capacity by increasing the size of system components (rather than adding additional components, which is horizontal scaling). There is a limit to how far a system can be scaled vertically.",null,null,"Vertical scaling / scalability",92,"Vertical scaling means expanding the system capacity by increasing the size of system components (rather than adding additional components, which is horizontal scaling). There is a limit to how far a system can be scaled vertically.",null,"Expansion verticale",92,"L'expansion verticale désigne l'augmentation des capacités d'un système par l'augmentation de la capacité de ses composants (plutôt que par l’ajout de composants supplémentaires, appelée expansion horizontale). Le potentiel d’expansion verticale d’un système est limité.",null,"Escalamiento / escalabilidad vertical",92,"El escalamiento vertical significa expandir la capacidad del sistema aumentando el tamaño de los componentes del sistema (en lugar de agregando componentes adicionales, que es escalamiento horizontal). Existe un límite para escalar verticalmente un sistema.",null,null,92]
[null,"Voucher / one-time code","A voucher or one-time code is generated by the customer and may be used to authorize transactions initiated by another entity. For example, merchant transactions (e.g. via point of sale device) or ATM transactions.",null,null,"Voucher / one-time code",93,"A voucher or one-time code is generated by the customer and may be used to authorize transactions initiated by another entity. For example, merchant transactions (e.g. via point of sale device) or ATM transactions.",null,"Code à usage temporaire/code à usage unique",93,"Un code à usage temporaire ou un code à usage unique est généré par le client et peut être utilisé pour autoriser les transactions initiées par une autre entité. Par exemple, les transactions de commerçants (via un appareil en point de vente) ou les transactions depuis les distributeurs de billets.",null,"Voucher / código único",93,"Un voucher o código único es generado por el cliente y puede ser utilizado para autorizar transacciones iniciadas por otra entidad. Por ejemplo, transacciones en el comercio (por ej., mediante un dispositivo de punto de venta) o transacciones en cajeros automáticos.",null,null,93]
[null,{"$f":"CHOOSE(LanguageNumber,F97,J97,N97,R97)","v":"Data sources"},{"$f":"CHOOSE(LanguageNumber,H97,L97,P97,T97)","v":"Definitions"},null,null,"Data sources",null,"Definitions",null,"Source d'information",null,"Description",null,"Fuentes de datos",null,"Definiciones"]
[null,"BCBS AML","Basel Committee’s Sound Management of Risks related to Money Laundering and Financing of Terrorism",null,null,"BCBS AML",null,"Basel Committee’s Sound Management of Risks related to Money Laundering and Financing of Terrorism",null,"BCBS AML",null,"Recommandations du Comité de Bâle sur la gestion des risques liés au blanchiment de fonds et au financement du terrorisme",null,"BCBS AML",null,"Basel Committee’s Sound Management of Risks related to Money Laundering and Financing of Terrorism (En inglés)\n(Comité de Supervisión Bancaria de Basilea:  Adecuada gestión de los riesgos relacionados con el blanqueo de capitales y la financiación del terrorismo)\nhttps://www.bis.org/publ/bcbs275_es.pdf (en español) "]
[null,"BCBS OFS ",{"$f":"CHOOSE(LanguageNumber,H99,L99,P99,T99)","v":"Basel Committee’s Outsourcing in Financial Services"},null,null,"BCBS OFS ",null,"Basel Committee’s Outsourcing in Financial Services",null,"BCBS OFS ",null,"Comité de Bâle - L'externalisation dans le secteur financier",null,"BCBS OFS ",null,"Basel Committee’s Outsourcing in Financial Services (En inglés)\n(Comité de Supervisión Bancaria de Basilea: Tercerización de servicios financieros)"]
[null,"BCBS RMPEB","Basel Committee’s Risk Management Principles for Electronic Banking",null,null,"BCBS RMPEB",null,"Basel Committee’s Risk Management Principles for Electronic Banking",null,"BCBS RMPEB",null,"Comité de Bâle - Principes de gestion du risque pour les services bancaires électroniques",null,"BCBS RMPEB",null,"Basel Committee’s Risk Management Principles for Electronic Banking (En inglés)\n(Comité de Supervisión Bancaria de Basilea:  Principios de gestión de riesgos para banca electrónica)"]
[null,"ECB RSMP","ECB’s draft Recommendations for the Security of Mobile Payments",null,null,"ECB RSMP",null,"ECB’s draft Recommendations for the Security of Mobile Payments",null,"ECB RSMP",null,"Projet de recommandations de la BCE pour la sécurité des paiements mobiles",null,"ECB RSMP",null,"ECB’s draft Recommendations for the Security of Mobile Payments (En inglés)\n(Proyecto de recomendacionessobre seguridad de pagos móviles del BCE)"]
[null,"HK AML","Hong Kong’s AML/CFT Self-Assessment Checklist",null,null,"HK AML",null,"Hong Kong’s AML/CFT Self-Assessment Checklist",null,"HK AML",null,"Check-list d'auto-évaluation AML/CFT de Hong Kong",null,"HK AML",null,"Hong Kong’s AML/CFT Self-Assessment Checklist (En inglés)\n(Lista de control para autoevaluación de cumplimiento con requisitos de ALA/LFT de Hong Kong)"]
[null,"GSMA AML","GSMA’s Proportional Risk-Based AML/CFT Regimes for Mobile Money ",null,null,"GSMA AML",null,"GSMA’s Proportional Risk-Based AML/CFT Regimes for Mobile Money ",null,"GSMA AML",null,"GSMA - Régimes AML / CFT adaptés au niveau de risque pour l'argent mobile",null,"GSMA AML",null,"GSMA’s Proportional Risk-Based AML/CFT Regimes for Mobile Money (En inglés)\n(Regímenes de dinero móvil de ALA/LFT basados en riesgos proporcionales de la GSMA)"]
[null,"GSMA RMT","GSMA’s Risk Management Toolkit",null,null,"GSMA RMT",null,"GSMA’s Risk Management Toolkit",null,"GSMA RMT",null,"GSMA - Outil d'auto-évaluation pour la gestion des risques",null,"GSMA RMT",null,"GSMA’s Risk Management Toolkit (En inglés)\n(Herramientas para la gestión de riesgo de la GSMA)"]
[null,"ISO 20000-1:2011","ISO/IEC Information technology -- Service management -- Part 1: Service management system requirements",null,null,"ISO 20000-1:2011",null,"ISO/IEC Information technology -- Service management -- Part 1: Service management system requirements",null,"ISO 20000-1:2011",null,"ISO/IEC Technologies de l'information - Gestion des services - Partie 1: Exigences du système de management des services",null,"ISO 20000-1:2011",null,"ISO/IEC Information technology -- Service management -- Part 1: Service management system requirements (En inglés)\n(ISO/IEC Tecnología de la información -- Gestión del servicio -- Parte 1: Requisitos del sistema de gestión del servicio)"]
[null,"ISO 20000-2:2012","ISO/IEC Information technology -- Service management -- Part 2: Guidance on the application of service management systems",null,null,"ISO 20000-2:2012",null,"ISO/IEC Information technology -- Service management -- Part 2: Guidance on the application of service management systems",null,"ISO 20000-2:2012",null,"ISO/IEC Technologies de l'information - Gestion des services - Partie 2: Guide pour l'application des systèmes de management des services",null,"ISO 20000-2:2012",null,"ISO/IEC Information technology -- Service management -- Part 2: Guidance on the application of service management systems (En inglés)\n(ISO/IEC Tecnología de la información -- Gestión del servicio – Parte 2: Directrices para la aplicación de sistemas de gestión de servicio)"]
[null,"ISO 20000-4:2010","ISO/IEC TR Information technology -- Service management -- Part 4: Process reference model",null,null,"ISO 20000-4:2010",null,"ISO/IEC TR Information technology -- Service management -- Part 4: Process reference model",null,"ISO 20000-4:2010",null,"ISO/IEC Technologies de l'information - Gestion des services - Partie 4: Modèle de référence de processus (disponible en anglais seulement)",null,"ISO 20000-4:2010",null,"ISO/IEC TR Information technology -- Service management -- Part 4: Process reference model (En inglés)\n(ISO/IEC TR Tecnología de la información -- Gestión del servicio – Parte 4: Modelo de referencia de procesos)"]
[null,"ISO 22313:2012","ISO/IEC Societal security -- Business continuity management systems -- Guidance",null,null,"ISO 22313:2012",null,"ISO/IEC Societal security -- Business continuity management systems -- Guidance",null,"ISO 22313:2012",null,"ISO/IEC Sécurité sociétale - Systèmes de management de la continuité d'activité - Lignes directrices",null,"ISO 22313:2012",null,"ISO/IEC Societal security -- Business continuity management systems -- Guidance ISO/IEC Societal security -- Business continuity management systems -- Guidance (En inglés)\n(ISO/IEC Protección y seguridad de los ciudadanos – Sistema de gestión de la continuidad del negocio – Directrices)"]
[null,"ISO 27002:2013","ISO/IEC Information technology -- Security techniques -- Code of practice for information security controls",null,null,"ISO 27002:2013",null,"ISO/IEC Information technology -- Security techniques -- Code of practice for information security controls",null,"ISO 27002:2013",null,"ISO/IEC Technologies de l'information - Techniques de sécurité - Code de bonne pratique pour le management de la sécurité de l'information",null,"ISO 27002:2013",null,"ISO/IEC Information technology -- Security techniques -- Code of practice for information security controls (En inglés)\n(ISO/IEC – Técnicas de seguridad -- Código de prácticas para los controles de seguridad de la información)"]
[null,"ISO 27005:2011","ISO/IEC Information technology -- Security techniques -- Information security risk management",null,null,"ISO 27005:2011",null,"ISO/IEC Information technology -- Security techniques -- Information security risk management",null,"ISO 27005:2011",null,"ISO/IEC Technologies de l'information - Techniques de sécurité - Gestion des risques liés à la sécurité de l'information",null,"ISO 27005:2011",null,"ISO/IEC Information technology -- Security techniques -- Information security risk management (En inglés)\n(ISO/IEC – Técnicas de seguridad – Gestión del riesgo en la seguridad de la información)"]
[null,"ISO 27015:2012","ISO/IEC TR Information technology -- Security techniques -- Information security management guidelines for financial services",null,null,"ISO 27015:2012",null,"ISO/IEC TR Information technology -- Security techniques -- Information security management guidelines for financial services",null,"ISO 27015:2012",null,"ISO/IEC Technologies de l'information - Techniques de sécurité - Lignes directrices pour le management de la sécurité de l'information pour les services financiers (disponible en anglais seulement)",null,"ISO 27015:2012",null,"ISO/IEC TR Information technology -- Security techniques -- Information security management guidelines for financial services (En inglés)\n(ISO/IEC – Técnicas de seguridad – Directrices de gestión de seguridad de la información de los servicios financieros)"]
[null,"IS0 29100:2011","ISO/IEC Information technology -- Security techniques -- Privacy framework",null,null,"IS0 29100:2011",null,"ISO/IEC Information technology -- Security techniques -- Privacy framework",null,"IS0 29100:2011",null,"ISO/IEC Technologies de l'information - Techniques de sécurité - Cadre privé (disponible en anglais seulement)",null,"IS0 29100:2011",null,"ISO/IEC Information technology -- Security techniques -- Privacy framework (En inglés)\n(ISO/IEC – Técnicas de seguridad – Marco de referencia sobre privacidad)"]
[null,"ITIL","AXELOS ITIL Global Best Practice Approach to IT Service Management ",null,null,"ITIL",null,"AXELOS ITIL Global Best Practice Approach to IT Service Management ",null,"ITIL",null,"Approche internationale de bonne pratique d’AXELOS ITIL pour la gestion des services informatiques ",null,"ITIL",null,"AXELOS ITIL Global Best Practice Approach to IT Service Management  (En inglés)\nMarco ITIL de mejores prácticas globales para la gestión de servicios de TI  de AXELOS)"]
[null,"NIST","U.S. Department of Commerce National Institute of Standards and Technology",null,null,"NIST",null,"U.S. Department of Commerce National Institute of Standards and Technology",null,"NIST",null,"Département du commerce des États-Unis – Institut national des normes et de la technologie",null,"NIST",null,"U.S. Department of Commerce National Institute of Standards and Technology (En inglés)\n(Departamento de comercio de los EE. UU.: Instituto Nacional de Estandarización y Tecnología)"]
[null,"PCI DSS","Payment Card Industry’s (PCI) Data Security Standard – Requirements and Security Assessment Procedures",null,null,"PCI DSS",null,"Payment Card Industry’s (PCI) Data Security Standard – Requirements and Security Assessment Procedures",null,"PCI DSS",null,"Norme de sécurité des données de l’industrie des cartes de paiement (PCI) – Exigences et procédures d’évaluation de la sécurité ",null,"PCI DSS",null,"Payment Card Industry’s (PCI) Data Security Standard – Requirements and Security Assessment Procedures (En inglés)\n(Normas de Seguridad de la PCI [Payment Card Industry o Industria de tarjetas de pago] – Requerimientos y procedimientos para la evaluación de la seguridad)"]
[null,"Functions","Definitions",null,null,"Functions",null,"Definitions",null,"Fonction",null,"Définition",null,"Funciones",null,"Definiciones"]
[null,"Agent Management (Agent)","Mobile Money Provider's function which manages the agent network. Responsible for recruiting, training and monitoring performance of agents, and ensuring an effective distribution network.",null,null,{"$f":"F7","v":"Agent Management (Agent)"},null,{"$f":"H7","v":"Mobile Money Provider's function which manages the agent network. Responsible for recruiting, training and monitoring performance of agents, and ensuring an effective distribution network."},null,{"$f":"J7","v":"Gestion des agents (Agent)"},null,{"$f":"L7","v":"Fonction du prestataire de service d’argent mobile chargée de la gestion du réseau d’agents. Elle est responsable du recrutement, de la formation et de la surveillance des agents et veille à l’efficacité du réseau de distribution. "},null,{"$f":"N7","v":"Gestión de Agentes (Agente)"},null,{"$f":"P7","v":"Función del Proveedor del Dinero Móvil que gestiona la red de agentes. Responsable de contratar, capacitar y monitorear el desempeño de los agentes, así como de garantizar una red de distribución efectiva."},null,{"$f":"R7","v":0},null,{"$f":"T7","v":0}]
[null,"Business Operations (BizOps)","Mobile Money Provider's function to manage the mobile money business and encompasses a number of business operations:\n - Mobile money product management;\n - Management of the day-to-day mobile money business;\n - Reporting to senior management.\nThe \"Business Operations Manager\" is in charge of the Business Operations function.",null,null,{"$f":"F12","v":"Business Operations (BizOps)"},null,{"$f":"H12","v":"Mobile Money Provider's function to manage the mobile money business and encompasses a number of business operations:\n - Mobile money product management;\n - Management of the day-to-day mobile money business;\n - Reporting to senior management.\nThe \"Business Operations Manager\" is in charge of the Business Operations function."},null,{"$f":"J12","v":"Exploitation (BizOps)"},null,{"$f":"L12","v":"Fonction du prestataire de service d’argent mobile chargée de la gestion de l’activité d’argent mobile. Elle englobe un certain nombre d’activités de l’entreprise :  \n - gestion des produits d’argent mobile ;\n - gestion courante de l’activité d’argent mobile ; \n - remontée d'informations vers la direction de l’entreprise.\nLe \"responsable de l’exploitation de l’activité d’argent mobile\" est en charge de cette fonction."},null,{"$f":"N12","v":"Operaciones Comerciales (BizOps)"},null,{"$f":"P12","v":"Función del Proveedor del Dinero Móvil para gestionar el negocio del dinero móvil que abarca diversas operaciones comerciales:\n - Gestión de productos del dinero móvil;\n - Gestión diaria del negocio del dinero móvil;\n - Presentación de informes a la alta gerencia.\nEl \"Gerente de Operaciones Comerciales\" está a cargo de la función de Operaciones Comerciales."},null,{"$f":"R12","v":0},null,{"$f":"T12","v":0}]
[null,"Customer Service (CustServ)","Mobile Money Provider's function to provide an interface to customers, to resolve issues and answer questions. Typically includes a call centre, but may also employ walk-in service centres or other ways of reaching customers directly. Includes back-office functional expertise (second-line support to customer operations).",null,null,{"$f":"F19","v":"Customer Service (CustServ)"},null,{"$f":"H19","v":"Mobile Money Provider's function to provide an interface to customers, to resolve issues and answer questions. Typically includes a call centre, but may also employ walk-in service centres or other ways of reaching customers directly. Includes back-office functional expertise (second-line support to customer operations)."},null,{"$f":"J19","v":"Service client (CustServ)"},null,{"$f":"L19","v":"Fonction du prestataire de service d’argent mobile chargée des contacts avec la clientèle pour résoudre les problèmes et répondre aux questions. Cette fonction comprend généralement un centre d’appels, mais peut également s'appuyer sur des centres de service sans rendez-vous ou d’autres canaux de contact direct avec les clients. Comprend l’expertise administrative opérationnelle (appui de deuxième ligne aux activités commerciales)."},null,{"$f":"N19","v":"Atención al Cliente (CustServ)"},null,{"$f":"P19","v":"Función del Proveedor del Dinero Móvil que brinda una interfaz con los clientes para resolver problemas y responder preguntas. Generalmente incluye un centro de atención telefónica, pero también puede emplear centros de atención en persona u otras formas de llegar a los clientes de manera directa. Incluye conocimientos técnicos de las funciones del back-office (soporte de segundo nivel a  operaciones del cliente)."},null,{"$f":"R19","v":0},null,{"$f":"T19","v":0}]
[null,"Finance Operations (FinOps)","Mobile Money Provider's function to manage financial operations. In particular, reconciliation and settlement with the trust bank and other financial partners. Ensures that e-money is balanced by real money in trust fund.",null,null,{"$f":"F28","v":"Finance Operations (FinOps)"},null,{"$f":"H28","v":"Mobile Money Provider's function to manage financial operations. In particular, reconciliation and settlement with the trust bank and other financial partners. Ensures that e-money is balanced by real money in trust fund."},null,{"$f":"J28","v":"Opérations financières (FinOps)"},null,{"$f":"L28","v":"Fonction du prestataire de service d’argent mobile chargée des activités financières, et notamment du rapprochement et des règlements avec la banque fiduciaire et les autres partenaires financiers. Veille à ce que l’encours d’argent électronique ait son équivalent en argent réel dans le fonds en fiducie."},null,{"$f":"N28","v":"Operaciones Financieras (FinOps)"},null,{"$f":"P28","v":"Función del Proveedor del Dinero Móvil para gestionar las operaciones financieras. En particular, la conciliación y liquidación con el banco fiduciario y otros socios financieros. Garantiza que el dinero electrónico esté compensado con dinero real en los fondos fiduciarios."},null,{"$f":"R28","v":0},null,{"$f":"T28","v":0}]
[null,"Fraud, Risk and AML Management \n(FraudRisk)","Mobile Money Provider's function which manages risk, fraud and AML. Sets policies and ensures the relevant departments fulfil the requirements for managing and mitigating risks. Operationally responsible for investigating frauds and watchlist screening. Should be implemented as a separate function from business operations to avoid conflict of interest.",null,null,{"$f":"F30","v":"Fraud, Risk and AML Management \n(FraudRisk)"},null,{"$f":"H30","v":"Mobile Money Provider's function which manages risk, fraud and AML. Sets policies and ensures the relevant departments fulfil the requirements for managing and mitigating risks. Operationally responsible for investigating frauds and watchlist screening. Should be implemented as a separate function from business operations to avoid conflict of interest."},null,{"$f":"J30","v":"Gestion des risques, de la fraude et de la lutte contre le blanchiment de capitaux (FraudRisk)"},null,{"$f":"L30","v":"Fonction du prestataire de service d’argent mobile chargée de la gestion des risques, de la fraude et de la lutte contre le blanchiment de capitaux. Définit les politiques et s’assure que les départements concernés respectent leurs obligations de gestion et de prévention des risques. A la responsabilité opérationnelle  des enquêtes relatives aux situations de fraude et de la vérification des listes de surveillance. Doit être séparée des activités d’exploitation pour éviter les conflits d’intérêts. "},null,{"$f":"N30","v":"Gestión de Fraude, Riesgo y ALA\n(FraudRisk)"},null,{"$f":"P30","v":"Función del Proveedor del Dinero Móvil que realiza la gestión de riesgos, fraude y anti lavado de activos. Establece políticas y garantiza que los departamentos correspondientes cumplan con los requisitos para gestionar y mitigar los riesgos. Es operativamente responsable de investigar el fraude y analizar las listas de control. Se debe implementar como una función independiente de las operaciones del negocio para evitar conflictos de interés."},null,{"$f":"R30","v":0},null,{"$f":"T30","v":0}]
[null,"Human Resources Management (HR)","Mobile Money Provider's function which manages employees within the mobile money functions. Responsible for recruitment, training and termination.",null,null,{"$f":"F34","v":"Human Resources Management (HR)"},null,{"$f":"H34","v":"Mobile Money Provider's function which manages employees within the mobile money functions. Responsible for recruitment, training and termination."},null,{"$f":"J34","v":"Gestion des ressources humaines (GRH)"},null,{"$f":"L34","v":"Fonction du prestataire de service d’argent mobile chargée de la gestion du personnel des différentes fonctions de l’argent mobile. Est responsable du recrutement, de la formation et du licenciement."},null,{"$f":"N34","v":"Gestión de Recursos Humanos (RR.HH.)"},null,{"$f":"P34","v":"Función del Proveedor del Dinero Móvil que gestiona los empleados dentro de las funciones del dinero móvil. Responsable del reclutamiento, capacitación y finalización."},null,{"$f":"R34","v":0},null,{"$f":"T34","v":0}]
[null,"Project Management Office (PMO)","Mobile Money Provider's function which manages the gated process for implementing changes to the Mobile Money service.",null,null,{"$f":"F62","v":"Project Management Office (PMO)"},null,{"$f":"H62","v":"Mobile Money Provider's function which manages the gated process for implementing changes to the Mobile Money service."},null,{"$f":"J62","v":"Département de gestion de projet (PMO)"},null,{"$f":"L62","v":"Fonction du Prestataire de l'argent mobile chargée de gérer le processus formel visant à mettre en œuvre les changements apportés au service d'argent mobile."},null,{"$f":"N62","v":"Oficina de Gestión de Proyectos [Project Management Office (PMO)]"},null,{"$f":"P62","v":"Función del Proveedor del Dinero Móvil que gestiona el proceso por etapas para implementar cambios en el servicio del Dinero Móvil."},null,{"$f":"R62","v":0},null,{"$f":"T62","v":0}]
[null,"Technical Operations (TechOps)","Mobile Money Provider's function to operationally manage the technical system that provides the mobile money service. May be outsourced and should be separated from the system development function. Responsible for day-to-day function of all components of the mobile money system and its interfaces to the mobile operator's network, banking partner(s), financial service providers, other mobile money providers, agents and customers.",null,null,{"$f":"F88","v":"Technical Operations (TechOps)"},null,{"$f":"H88","v":"Mobile Money Provider's function to operationally manage the technical system that provides the mobile money service. May be outsourced and should be separated from the system development function. Responsible for day-to-day function of all components of the mobile money system and its interfaces to the mobile operator's network, banking partner(s), financial service providers, other mobile money providers, agents and customers."},null,{"$f":"J88","v":"Opérations techniques (TechOps)"},null,{"$f":"L88","v":"Fonction du prestataire de service d’argent mobile chargée de la gestion opérationnelle du système technique qui permet d’offrir le service d’argent mobile. Peut être externalisée et doit être séparée de la fonction de développement du système. Responsable du fonctionnement courant de l’ensemble des composantes du système d’argent mobile et de ses interfaces avec le réseau de l’opérateur mobile, ses partenaires bancaires, les prestataires de services financiers, les autres prestataires de services d’argent mobile, les agents et les clients."},null,{"$f":"N88","v":"Operaciones Técnicas (TechOps)"},null,{"$f":"P88","v":"Función del Proveedor del Dinero Móvil para gestionar operativamente el sistema técnico que presta el servicio del dinero móvil. Se puede tercerizar y debe ser independiente de la función de desarrollo del sistema. Es responsable de la función diaria de todos los componentes del sistema del dinero móvil y sus interfaces con la red del operador móvil, socio(s) bancario(s), proveedores de servicios financieros, otros proveedores del dinero móvil, agentes y clientes."},null,{"$f":"R88","v":0},null,{"$f":"T88","v":0}]

{"sheet":"Drivers","index":17,"n_rows":94,"n_cols":14,"rows_kept":94,"cut":false,"hidden":false,"merged":[[74,5,74,6],[75,5,75,6],[76,5,76,6],[77,5,77,6],[78,5,78,6],[69,5,69,6],[70,5,70,6],[71,5,71,6],[72,5,72,6],[73,5,73,6],[63,5,63,6],[64,5,64,6],[65,5,65,6],[68,5,68,6],[67,5,67,6],[60,5,60,6],[61,5,61,6],[62,5,62,6],[47,5,47,6],[48,5,48,6],[42,5,42,6],[43,5,43,6],[44,5,44,6],[45,5,45,6],[46,5,46,6],[37,5,37,6],[38,5,38,6],[39,5,39,6],[40,5,40,6],[41,5,41,6],[87,6,87,7],[2,1,2,7],[15,5,15,6],[16,5,16,6],[17,1,19,4],[17,5,17,6],[18,5,18,6],[19,5,19,6],[20,5,20,6],[21,5,21,6],[22,5,22,6],[23,5,23,6],[24,5,24,6],[25,5,25,6],[30,5,30,6],[31,5,31,6],[12,10,13,11],[26,5,26,6],[27,5,27,6],[28,5,28,6],[29,5,29,6],[32,5,32,6],[33,5,33,6],[34,5,34,6],[35,5,35,6],[36,5,36,6]]}
[null,"Values used in Toolkits"]
[]
[null,"Number of indicators",null,null,null,null,null,null,null,null,"Function list - editable"]
[null,"Principle 1","Required",{"$f":"COUNTIF('1'!BI:BI,\"Required\")","v":15},"Urgent",{"$f":"COUNTIF('1'!BH:BH,\"Urgent Required\")","v":8},"Recommended",{"$f":"COUNTIF('1'!BI:BI,\"Recommended\")","v":8},null,null,"Name","Description"]
[null,"Principle 2","Required",{"$f":"COUNTIF('2'!BI:BI,\"Required\")","v":56},"Urgent",{"$f":"COUNTIF('2'!BH:BH,\"Urgent Required\")","v":30},"Recommended",{"$f":"COUNTIF('2'!BI:BI,\"Recommended\")","v":55},null,null,"BizOps","Business operations"]
[null,"Principle 3","Required",{"$f":"COUNTIF('3'!BI:BI,\"Required\")","v":30},"Urgent",{"$f":"COUNTIF('3'!BH:BH,\"Urgent Required\")","v":15},"Recommended",{"$f":"COUNTIF('3'!BI:BI,\"Recommended\")","v":51},null,null,"FinOps","Finance ops"]
[null,"Principle 4","Required",{"$f":"COUNTIF('4'!BI:BI,\"Required\")","v":63},"Urgent",{"$f":"COUNTIF('4'!BH:BH,\"Urgent Required\")","v":28},"Recommended",{"$f":"COUNTIF('4'!BI:BI,\"Recommended\")","v":69},null,null,"CustServ","Customer service"]
[null,"Principle 5","Required",{"$f":"COUNTIF('5'!BI:BI,\"Required\")","v":68},"Urgent",{"$f":"COUNTIF('5'!BH:BH,\"Urgent Required\")","v":31},"Recommended",{"$f":"COUNTIF('5'!BI:BI,\"Recommended\")","v":72},null,null,"TechOps","Technical operations and development"]
[null,"Principle 6","Required",{"$f":"COUNTIF('6'!BI:BI,\"Required\")","v":16},"Urgent",{"$f":"COUNTIF('6'!BH:BH,\"Urgent Required\")","v":6},"Recommended",{"$f":"COUNTIF('6'!BI:BI,\"Recommended\")","v":20},null,null,"PMO","Project Management Office"]
[null,"Principle 7","Required",{"$f":"COUNTIF('7'!BI:BI,\"Required\")","v":23},"Urgent",{"$f":"COUNTIF('7'!BH:BH,\"Urgent Required\")","v":9},"Recommended",{"$f":"COUNTIF('7'!BI:BI,\"Recommended\")","v":38},null,null,"FraudRisk","Fraud, Risk, AML/CFT, Compliance"]
[null,"Principle 8","Required",{"$f":"COUNTIF('8'!BI:BI,\"Required\")","v":10},"Urgent",{"$f":"COUNTIF('8'!BH:BH,\"Urgent Required\")","v":0},"Recommended",{"$f":"COUNTIF('8'!BI:BI,\"Recommended\")","v":22},null,null,"Agent","Agent management"]
[null,"Totals","Required",{"$f":"D4+D5+D6+D7+D8+D9+D10+D11","v":281},"Urgent",{"$f":"SUM(F4:F11)","v":127},"Recommended",{"$f":"SUM(H4:H11)","v":335},null,null,"HR","Human resources"]
[null,null,"Total",{"$f":"D12+H12","v":616},null,null,null,null,null,null,"Edit this function list to change names and descriptions and to add more names. \nThese will appear in the drop-down in column O in the Principles worksheets. \nFunction names are not translated."]
[]
[]
[null,null,null,null,null,"Assessment column name translation",null,null,null,null,"Assessment column names translation"]
[null,null,null,null,null,"Used for translations only",null,null,null,null,{"$f":"$F$83","v":"EN"},{"$f":"$F$84","v":"FR"},{"$f":"$F$85","v":"ES"},{"$f":"$F$86","v":"YY"}]
[null,"SHIFT+CTRL+L to lock all the sheets\nSHIFT+CTRL+U to unlock.  \nWhen in locked mode the user can hide and unhide columns, select cells, and use the autofilter.",null,null,null,{"$f":"CHOOSE(LanguageNumber,K18,L18,M18,N18)","v":"SELF-ASSESSMENT"},null,null,null,null,"SELF-ASSESSMENT","AUTO-ÉVALUATION","AUTOEVALUACIÓN","SELF-ASSESSMENT"]
[null,null,null,null,null,"Compliance",null,null,null,null,"Compliance","Conformité","Cumplimiento","Compliance"]
[null,null,null,null,null,"Evidence document (specify document name, section number and page number)",null,null,null,null,"Evidence document (specify document name, section number and page number)","Document requis (indiquer le nom du document et le numéro de section / page)","Documentación proporcionada (nombre del documento, número de sección / página)","Evidence document"]
[null,null,null,null,null,"Comments \n(include notes on how the practice is implemented)",null,null,null,null,"Comments \n(include notes on how the practice is implemented)","Commentaires (expliquer comment la pratique est mise en œuvre)","Comentarios (incluir notas sobre cómo se implementó la práctica)","Comments"]
[null,null,null,null,null,"Action",null,null,null,null,"Action","Action","Acción","Action"]
[null,"Evidence provided:",null,null,null,"Reviewer name",null,null,null,null,"Reviewer name","Nom de l'examinateur","Nombre del examinador","Reviewer name"]
[null,1,{"$f":"COUNTIF('1'!V:V,$K$58)+COUNTIF('1'!V:V,$L$58)+COUNTIF('1'!V:V,$M$58)+COUNTIF('1'!V:V,$N$58)","v":0},{"$f":"C24/D4","v":0},null,"Evidence sent to Assessor?",null,null,null,null,"Evidence sent to Assessor?","Documents envoyés à l'évaluateur?","Documentos enviados al asesor?","Evidence sent to Assessor?"]
[null,2,{"$f":"COUNTIF('2'!V:V,$K$58)+COUNTIF('2'!V:V,$L$58)+COUNTIF('2'!V:V,$M$58)+COUNTIF('2'!V:V,$N$58)","v":0},0,null,"Spare 2",null,null,null,null,"Spare 2","SpareFR 2","SpareES 2","SpareYY 2"]
[null,3,{"$f":"COUNTIF('3'!V:V,$K$58)+COUNTIF('3'!V:V,$L$58)+COUNTIF('3'!V:V,$M$58)+COUNTIF('3'!V:V,$N$58)","v":0},0,null,"Spare 3",null,null,null,null,"Spare 3","SpareFR 3","SpareES 3","SpareYY 3"]
[null,4,{"$f":"COUNTIF('4'!V:V,$K$58)+COUNTIF('4'!V:V,$L$58)+COUNTIF('4'!V:V,$M$58)+COUNTIF('4'!V:V,$N$58)","v":0},0,null,"Spare 4",null,null,null,null,"Spare 4","SpareFR 4","SpareES 4","SpareYY 4"]
[null,5,{"$f":"COUNTIF('5'!V:V,$K$58)+COUNTIF('5'!V:V,$L$58)+COUNTIF('5'!V:V,$M$58)+COUNTIF('5'!V:V,$N$58)","v":0},0,null,"Spare 5",null,null,null,null,"Spare 5","SpareFR 5","SpareES 5","SpareYY 5"]
[null,6,{"$f":"COUNTIF('6'!V:V,$K$58)+COUNTIF('6'!V:V,$L$58)+COUNTIF('6'!V:V,$M$58)+COUNTIF('6'!V:V,$N$58)","v":0},0,null,"Spare 6",null,null,null,null,"Spare 6","SpareFR 6","SpareES 6","SpareYY 6"]
[null,7,{"$f":"COUNTIF('7'!V:V,$K$58)+COUNTIF('7'!V:V,$L$58)+COUNTIF('7'!V:V,$M$58)+COUNTIF('7'!V:V,$N$58)","v":0},0,null,"Spare 7",null,null,null,null,"Spare 7","SpareFR 7","SpareES 7","SpareYY 7"]
[null,8,{"$f":"COUNTIF('8'!V:V,$K$58)+COUNTIF('8'!V:V,$L$58)+COUNTIF('8'!V:V,$M$58)+COUNTIF('8'!V:V,$N$58)","v":0},0,null,"Spare 8",null,null,null,null,"Spare 8","SpareFR 8","SpareES 8","SpareYY 8"]
[null,"Total",{"$f":"SUM(C24:C31)","v":0},0,null,"Spare 9",null,null,null,null,"Spare 9","SpareFR 9","SpareES 9","SpareYY 9"]
[null,null,null,null,null,"Spare 10",null,null,null,null,"Spare 10","SpareFR 10","SpareES 10","SpareYY 10"]
[null,null,null,null,null,"EXTERNAL ASSESSMENT",null,null,null,null,"EXTERNAL ASSESSMENT","ÉVALUATION EXTERNE","EVALUACIÓN EXTERNA","EXTERNAL ASSESSMENT"]
[null,null,null,null,null,"Compliance",null,null,null,null,{"$f":"K19","v":"Compliance"},{"$f":"L19","v":"Conformité"},"Cumplimiento","Compliance"]
[null,null,null,null,null,"Evidence document (specify document name, section number and page number)",null,null,null,null,{"$f":"K20","v":"Evidence document (specify document name, section number and page number)"},{"$f":"L20","v":"Document requis (indiquer le nom du document et le numéro de section / page)"},"Documentación proporcionada (nombre del documento, número de sección / página)","Evidence document"]
[null,null,null,null,null,"Comments \n(include notes on how the practice is implemented)",null,null,null,null,{"$f":"K21","v":"Comments \n(include notes on how the practice is implemented)"},{"$f":"L21","v":"Commentaires (expliquer comment la pratique est mise en œuvre)"},{"$f":"M21","v":"Comentarios (incluir notas sobre cómo se implementó la práctica)"},"Comments"]
[null,null,null,null,null,"Recommendation to Provider",null,null,null,null,"Recommendation to Provider","Recommandation destinée au prestataire","Recomendación al Proveedor"]
[null,null,null,null,null,"Reviewer name",null,null,null,null,"Reviewer name","Nom de l'examinateur","Nombre del examinador","Reviewer name"]
[null,null,null,null,null,"Guidance notes for Assessor",null,null,null,null,"Guidance notes for Assessor","Notes pour l'examinateur","Notas para el examinador","Guidance notes for Assessor"]
[null,null,null,null,null,"Scheme Operator comments",null,null,null,null,"Scheme Operator comments","Commentaires de l'opérateur du schéma de certification","Comentarios del operador del esquema","Scheme Operator comments"]
[null,null,null,null,null,"Assessor's response to Scheme Operator",null,null,null,null,"Assessor's response to Scheme Operator","Réponse des examinateurs à l'opérateur du système de certification","Respuesta del examinador al operador del esquema de certificación","Assessor's response to Scheme Operator"]
[null,null,null,null,null,"Scheme Operator conclusion",null,null,null,null,"Scheme Operator conclusion","Conclusions de l'opérateur du schéma de certification","Conclusiones del operador del esquema de certificación","Scheme Operator conclusion"]
[null,null,null,null,null,"Spare 15",null,null,null,null,"Spare 15","SpareFR 15","SpareES 15","SpareYY 15"]
[null,null,null,null,null,"Spare 16",null,null,null,null,"Spare 16","SpareFR 16","SpareES 16","SpareYY 16"]
[null,null,null,null,null,"Spare 17",null,null,null,null,"Spare 17","SpareFR 17","SpareES 17","SpareYY 17"]
[null,null,null,null,null,"Spare 18",null,null,null,null,"Spare 18","SpareFR 18","SpareES 18","SpareYY 18"]
[null,null,null,null,null,"Spare 19",null,null,null,null,"Spare 19","SpareFR 19","SpareES 19","SpareYY 19"]
[null,null,null,null,null,"Spare 20",null,null,null,null,"Spare 20","SpareFR 20","SpareES 20","SpareYY 20"]
[]
[null,null,null,null,null,"Validations",null,null,null,null,"Validations translation"]
[null,null,null,null,null,"Used for cell validations.",null,null,null,null,{"$f":"$F$83","v":"EN"},{"$f":"$F$84","v":"FR"},{"$f":"$F$85","v":"ES"},{"$f":"$F$86","v":"YY"}]
[null,null,null,null,null,1,{"$f":"CHOOSE(LanguageNumber,K53,L53,M53,N53)","v":"Yes"},null,null,null,"Yes","Oui","Si","Y4"]
[null,null,null,null,null,2,"Partial",null,null,null,"Partial","En partie","Parcial","P4"]
[null,null,null,null,null,3,"No",null,null,null,"No","Non","No","N4"]
[null,null,null,null,null,4,"N/A",null,null,null,"N/A","n/a","N/A","NA4"]
[null,null,null,null,null,null,"Other",null,null,null,"Other","Autre","Otro","O4"]
[null,null,null,null,null,null,"Yes",null,null,null,{"$f":"K53","v":"Yes"},{"$f":"L53","v":"Oui"},"Si","Y4"]
[null,null,null,null,null,null,"No",null,null,null,{"$f":"K55","v":"No"},{"$f":"L55","v":"Non"},"No","N4"]
[null,null,null,null,null,null,null,null,null,null,"This table is used for cell validations."]
[null,null,null,null,null,"Compliance",null,null,null,null,"Compliance translation"]
[null,null,null,null,null,"Used for translations and cell validations",null,null,null,null,{"$f":"$F$83","v":"EN"},{"$f":"$F$84","v":"FR"},{"$f":"$F$85","v":"ES"},{"$f":"$F$86","v":"YY"}]
[null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,K63,L63,M63,N63)","v":"Required"},null,null,null,null,"Required","Requis","Obligatorio","Req4"]
[null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,K64,L64,M64,N64)","v":"Recommended"},null,null,null,null,"Recommended","Recommandé","Recomendado","Rec4"]
[null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,K65,L65,M65,N65)","v":"Standard required"},null,null,null,null,"Standard required","Requis Normal","Obligatorio estándar","ReqS4"]
[null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,K66,L66,M66,N66)","v":"Urgent required"},null,null,null,null,"Urgent required","Requis Prioritaire","Obligatorio urgente","ReqU4"]
[]
[null,null,null,null,null,"Other translations",null,null,null,null,"Other translations"]
[null,null,null,null,null,"Used for translations only",null,null,null,null,{"$f":"$F$83","v":"EN"},{"$f":"$F$84","v":"FR"},{"$f":"$F$85","v":"ES"},{"$f":"$F$86","v":"YY"}]
[null,null,null,null,null,{"$f":"CHOOSE(LanguageNumber,K70,L70,M70,N70)","v":"Principle"},null,null,null,null,"Principle","Principe","Principio","Principle"]
[null,null,null,null,null,"Total",null,null,null,null,"Total","Total","Total","Total"]
[null,null,null,null,null,"All",null,null,null,null,"All","Tous","Todos","All"]
[null,null,null,null,null,"All Categories",null,null,null,null,"All Categories","Toutes Catégories","Todas las categorías","All Categories"]
[null,null,null,null,null,"All Principles",null,null,null,null,"All Principles","Tous les Principes","Todos los Principios","All Principles"]
[null,null,null,null,null,"Compliance",null,null,null,null,{"$f":"K19","v":"Compliance"},{"$f":"L19","v":"Conformité"},{"$f":"M19","v":"Cumplimiento"},{"$f":"N19","v":"Compliance"}]
[null,null,null,null,null,"Overall compliance",null,null,null,null,"Overall compliance","Conformité globale","Cumplimiento total","Overall compliance"]
[null,null,null,null,null,"Compliance by Sub-Principle",null,null,null,null,"Compliance by Sub-Principle","Conformité par sous-principe","Cumplimiento por sub-principio","Compliance by Sub-Principle"]
[null,null,null,null,null,"(N/A indicators excluded)",null,null,null,null,"(N/A indicators excluded)","(hors indicateurs n/d)","(no incluye indicadores N/A)","(N/A indicators excluded)"]
[null,null,null,null,null,"Filter",null,null,null,null,"Filter","Filtre","Filtrar","Filter"]
[]
[null,null,null,null,null,"Languages"]
[null,null,null,null,null,"Language of Toolkit:",null,{"$f":"VLOOKUP(Language,LanguageTable,3,FALSE)","v":1}]
[null,null,null,null,null,"EN","English",1]
[null,null,null,null,null,"FR","Français",2]
[null,null,null,null,null,"ES","Español",3]
[null,null,null,null,null,"YY","<for future use>",4]
[]
[null,null,null,null,null,null,"Static"]
[null,null,null,null,null,null,"All Indicators",{"$f":"'Self-assessment Summary'!D27","v":616}]
[null,null,null,null,null,null,"Report Indicators to print",{"$f":"SUBTOTAL(3,Report!J7:J622)","v":616}]
[null,null,null,null,null,null,"Spacer 1",": "]
[null,null,null,null,null,null,"Spacer 2"," - "]
[null,null,null,null,null,null,"Carriage Return Character",{"$f":"CHAR(10)","v":"\n"}]
[null,null,null,null,null,null,null,{"$f":"IF(IsMac(),CHAR(13),CHAR(10))","v":"\n"}]

{"sheet":"All","index":18,"n_rows":682,"n_cols":72,"rows_kept":682,"cut":false,"hidden":true,"merged":[[1,3,1,11]]}
[]
[null,"All sub-principles",null,"This worksheet should be hidden. Its purpose is to drive other worksheets",null,null,null,null,null,null,null,null,null,null,null,null,"self",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"external",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"self","self","self","self","self","self","self","self","self","self","self","self","external","external","external","external","external","external","external","external","external","external","external","external"]
[null,{"$f":"'1'!B3","v":"Principle"},{"$f":"'1'!C3","v":"Sub-principle"},{"$f":"'1'!D3","v":"Sub-sub-principle"},{"$f":"'1'!E3","v":"Sub-sub-principle"},{"$f":"'1'!F3","v":"Practice ID"},{"$f":"'1'!G3","v":"Practice"},{"$f":"'1'!H3","v":"Practice data source"},{"$f":"'1'!I3","v":"Indicator ID"},{"$f":"'1'!J3","v":"Indicator"},{"$f":"'1'!K3","v":"Evidence required"},{"$f":"'1'!L3","v":"[SPARE]"},{"$f":"'1'!M3","v":"Detailed indicator category"},{"$f":"'1'!N3","v":"Indicator category"},{"$f":"'1'!O3","v":"Function"},{"$f":"'1'!P3","v":"[SPARE]"},{"$f":"'1'!Q3","v":"Compliance"},{"$f":"'1'!R3","v":"Evidence document (specify document name, section number and page number)"},{"$f":"'1'!S3","v":"Comments \n(include notes on how the practice is implemented)"},{"$f":"'1'!T3","v":"Action"},{"$f":"'1'!U3","v":"Reviewer name"},{"$f":"'1'!V3","v":"Evidence sent to Assessor?"},{"$f":"'1'!W3","v":"Spare 2"},{"$f":"'1'!X3","v":"Spare 3"},{"$f":"'1'!Y3","v":"Spare 4"},{"$f":"'1'!Z3","v":"Spare 5"},{"$f":"'1'!AA3","v":"Spare 6"},{"$f":"'1'!AB3","v":"Spare 7"},{"$f":"'1'!AC3","v":"Spare 8"},{"$f":"'1'!AD3","v":"Spare 9"},{"$f":"'1'!AE3","v":"Spare 10"},{"$f":"'1'!AF3","v":"Compliance"},{"$f":"'1'!AG3","v":"Evidence document (specify document name, section number and page number)"},{"$f":"'1'!AH3","v":"Comments \n(include notes on how the practice is implemented)"},{"$f":"'1'!AI3","v":"Recommendation to Provider"},{"$f":"'1'!AJ3","v":"Reviewer name"},{"$f":"'1'!AK3","v":"Guidance notes for Assessor"},{"$f":"'1'!AL3","v":"Scheme Operator comments"},{"$f":"'1'!AM3","v":"Assessor's response to Scheme Operator"},{"$f":"'1'!AN3","v":"Scheme Operator conclusion"},{"$f":"'1'!AO3","v":"Spare 15"},{"$f":"'1'!AP3","v":"Spare 16"},{"$f":"'1'!AQ3","v":"Spare 17"},{"$f":"'1'!AR3","v":"Spare 18"},{"$f":"'1'!AS3","v":"Spare 19"},{"$f":"'1'!AT3","v":"Spare 20"},"Required","Recommended","Yes","Partial","No","N/A",{"$f":"$AU3&\": \"&AW3","v":"Required: Yes"},{"$f":"$AU3&\": \"&AX3","v":"Required: Partial"},{"$f":"$AU3&\": \"&AY3","v":"Required: No"},{"$f":"$AU3&\": \"&AZ3","v":"Required: N/A"},{"$f":"$AV3&\": \"&AW3","v":"Recommended: Yes"},{"$f":"$AV3&\": \"&AX3","v":"Recommended: Partial"},{"$f":"$AV3&\": \"&AY3","v":"Recommended: No"},{"$f":"$AV3&\": \"&AZ3","v":"Recommended: N/A"},"Yes","Partial","No","N/A",{"$f":"$AU3&\": \"&BI3","v":"Required: Yes"},{"$f":"$AU3&\": \"&BJ3","v":"Required: Partial"},{"$f":"$AU3&\": \"&BK3","v":"Required: No"},{"$f":"$AU3&\": \"&BL3","v":"Required: N/A"},{"$f":"$AV3&\": \"&BI3","v":"Recommended: Yes"},{"$f":"$AV3&\": \"&BJ3","v":"Recommended: Partial"},{"$f":"$AV3&\": \"&BK3","v":"Recommended: No"},{"$f":"$AV3&\": \"&BL3","v":"Recommended: N/A"}]
[null,{"$f":"'1'!B5","v":"1"},{"$f":"'1'!C5","v":"1.1"},{"$f":"'1'!D5","v":"1.1.1"},{"$f":"'1'!E5","v":"1.1.1: Providers shall ensure that funds equal to the total value of outstanding mobile money liabilities are held in one or more custodial accounts on behalf of the mobile money users."},{"$f":"'1'!F5","v":"1.1.1.1"},{"$f":"'1'!G5","v":"1.1.1.1: VALUE OF E-MONEY MUST BALANCE VALUE IN CUSTODIAL ACCOUNTS\nThe value of funds held across all custodial accounts must be equal to or greater than the total value of outstanding mobile money liabilities. Depending upon the regulatory requirements in the country in question, either (1) 100% of the funds held in custodial accounts must be stored in a bank; or (2) some or all of the funds may be invested in other safe, liquid investments such as government bonds.\n\nIn case of discrepancy, the following must be implemented:\n• All discrepancies must be identified. \n• There should be an action plan for resolution which is being followed and tracked by management.\n• Discrepancies should be resolved promptly where possible. Long-term issues should have a clear plan and monitoring / management\n• The root cause of all discrepancies should be understood.\n• Any discrepancy must not be greater than 5% of the sum value of the custodial bank accounts at any time.\n\nProviders should keep records of the current and historical balances of the custodial account(s) and aggregate outstanding mobile money liabilities. "},{"$f":"'1'!H5","v":"GSMA RMT (FIN-06)"},{"$f":"'1'!I5","v":"1.1.1.1.1"},{"$f":"'1'!J5","v":"1.1.1.1.1: Are funds equal to or greater in value than the total value of outstanding mobile money liabilities held in custodial accounts on behalf of mobile money users?\n"},{"$f":"'1'!K5","v":"1) Custodial bank reconciliation record (most recent)\n- Check the total value of mobile money users funds held in custodian accounts is greater than, or equal to, the  total value of outstanding mobile money liabilities.\n- If there is a discrepancy, check that:\n• The discrepancy is not greater than 5% of the total value of the custodial bank accounts.\n• There is an action plan for resolution which is being followed and tracked by management.\n• The root cause of the discrepancy is understood or is under investigation, with supporting documentation. "},{"$f":"'1'!L5","v":0},{"$f":"'1'!M5","v":"Urgent Required"},{"$f":"'1'!N5","v":"Required"},{"$f":"'1'!O5","v":"FinOps"},{"$f":"'1'!P5","v":0},{"$f":"'1'!Q5","v":0},{"$f":"'1'!R5","v":0},{"$f":"'1'!S5","v":0},{"$f":"'1'!T5","v":0},{"$f":"'1'!U5","v":0},{"$f":"'1'!V5","v":0},{"$f":"'1'!W5","v":0},{"$f":"'1'!X5","v":0},{"$f":"'1'!Y5","v":0},{"$f":"'1'!Z5","v":0},{"$f":"'1'!AA5","v":0},{"$f":"'1'!AB5","v":0},{"$f":"'1'!AC5","v":0},{"$f":"'1'!AD5","v":0},{"$f":"'1'!AE5","v":0},{"$f":"'1'!AF5","v":0},{"$f":"'1'!AG5","v":0},{"$f":"'1'!AH5","v":0},{"$f":"'1'!AI5","v":0},{"$f":"'1'!AJ5","v":0},{"$f":"'1'!AK5","v":0},{"$f":"'1'!AL5","v":0},{"$f":"'1'!AM5","v":0},{"$f":"'1'!AN5","v":0},{"$f":"'1'!AO5","v":0},{"$f":"'1'!AP5","v":0},{"$f":"'1'!AQ5","v":0},{"$f":"'1'!AR5","v":0},{"$f":"'1'!AS5","v":0},{"$f":"'1'!AT5","v":0},{"$f":"SUMPRODUCT(IF($N4=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N4=CategoryRecommended,1,0))","v":0},{"$f":"_xlfn.IFNA(MATCH($Q4,ComplianceYes,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q4,CompliancePartial,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q4,ComplianceNo,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q4,ComplianceNA,0),0)","v":0},{"$f":"$AU4*AW4","v":0},{"$f":"$AU4*AX4","v":0},{"$f":"$AU4*AY4","v":0},{"$f":"$AU4*AZ4","v":0},{"$f":"$AV4*AW4","v":0},{"$f":"$AV4*AX4","v":0},{"$f":"$AV4*AY4","v":0},{"$f":"$AV4*AZ4","v":0},{"$f":"_xlfn.IFNA(MATCH($AF4,ComplianceYes,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF4,CompliancePartial,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF4,ComplianceNo,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF4,ComplianceNA,0),0)","v":0},{"$f":"$AU4*BI4","v":0},{"$f":"$AU4*BJ4","v":0},{"$f":"$AU4*BK4","v":0},{"$f":"$AU4*BL4","v":0},{"$f":"$AV4*BI4","v":0},{"$f":"$AV4*BJ4","v":0},{"$f":"$AV4*BK4","v":0},{"$f":"$AV4*BL4","v":0}]
[null,{"$f":"'1'!B6","v":"1"},{"$f":"'1'!C6","v":"1.1"},{"$f":"'1'!D6","v":"1.1.1"},{"$f":"'1'!E6","v":0},{"$f":"'1'!F6","v":"1.1.1.1"},{"$f":"'1'!G6","v":0},{"$f":"'1'!H6","v":0},{"$f":"'1'!I6","v":"1.1.1.1.2"},{"$f":"'1'!J6","v":"1.1.1.1.2: Are records of the current and historical balances of the custodial account(s) and aggregate outstanding mobile money liabilities readily available?\n"},{"$f":"'1'!K6","v":"1) Custodial bank reconciliation records (six months)\n- Check that the completed reconciliations for all custodial accounts are easily retrievable for 3-4 chosen dates within the last six months.\n- Check the historical balances are available for those dates.\n- If historical reconciliation balances are not available, review process documentation to ensure that records will be kept available."},{"$f":"'1'!L6","v":0},{"$f":"'1'!M6","v":"Standard Required"},{"$f":"'1'!N6","v":"Required"},{"$f":"'1'!O6","v":"FinOps"},{"$f":"'1'!P6","v":0},{"$f":"'1'!Q6","v":0},{"$f":"'1'!R6","v":0},{"$f":"'1'!S6","v":0},{"$f":"'1'!T6","v":0},{"$f":"'1'!U6","v":0},{"$f":"'1'!V6","v":0},{"$f":"'1'!W6","v":0},{"$f":"'1'!X6","v":0},{"$f":"'1'!Y6","v":0},{"$f":"'1'!Z6","v":0},{"$f":"'1'!AA6","v":0},{"$f":"'1'!AB6","v":0},{"$f":"'1'!AC6","v":0},{"$f":"'1'!AD6","v":0},{"$f":"'1'!AE6","v":0},{"$f":"'1'!AF6","v":0},{"$f":"'1'!AG6","v":0},{"$f":"'1'!AH6","v":0},{"$f":"'1'!AI6","v":0},{"$f":"'1'!AJ6","v":0},{"$f":"'1'!AK6","v":0},{"$f":"'1'!AL6","v":0},{"$f":"'1'!AM6","v":0},{"$f":"'1'!AN6","v":0},{"$f":"'1'!AO6","v":0},{"$f":"'1'!AP6","v":0},{"$f":"'1'!AQ6","v":0},{"$f":"'1'!AR6","v":0},{"$f":"'1'!AS6","v":0},{"$f":"'1'!AT6","v":0},{"$f":"SUMPRODUCT(IF($N5=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N5=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,{"$f":"$AU5*BI5","v":0},{"$f":"$AU5*BJ5","v":0},{"$f":"$AU5*BK5","v":0},{"$f":"$AU5*BL5","v":0},{"$f":"$AV5*BI5","v":0},{"$f":"$AV5*BJ5","v":0},{"$f":"$AV5*BK5","v":0},{"$f":"$AV5*BL5","v":0}]
[null,{"$f":"'1'!B7","v":"1"},{"$f":"'1'!C7","v":"1.1"},{"$f":"'1'!D7","v":"1.1.1"},{"$f":"'1'!E7","v":0},{"$f":"'1'!F7","v":"1.1.1.2"},{"$f":"'1'!G7","v":"1.1.1.2: CUSTODIAL BANK RECONCILIATION \nResponsibility for fund safeguarding should be assigned to a Mobile Money finance operations function that is separated from the business operations function. \n\nA process should be documented for reconciling the custodial account with the e-money system to ensure that the value of e-money matches the value of funds in the custodial account. This process should include the following actions:\n• e-money creation (e-money is created when funds are added to the custodial account)\n• e-money allocation (new e-money is allocated to the appropriate account)\n• e-money deletion (e-money is deleted when funds are withdrawn from the custodial account)\n\nReconciliation with the custodial bank should be performed at least daily on weekdays. The custodial bank reconciliation process should clearly specify the start and end point of each reconciliation period, clearly defining which transactions should be included to reach the final settlement position. A procedure should be specified for resolving reconciliation discrepancies.\n\nReconciliation data should be transferred via direct data exchange between the systems of the provider and the custodial bank in order to reduce the risk of errors and fraud. The reconciliation process itself may be manual or automated.\n\n"},{"$f":"'1'!H7","v":"GSMA RMT (FIN-05,\nFIN-11,\nFIN-13,\nFIN-14,\nFIN-15,\nFIN-16,\nFIN-17)\nISO 27002:2013 Sec. 12.1"},{"$f":"'1'!I7","v":"1.1.1.2.1"},{"$f":"'1'!J7","v":"1.1.1.2.1: Is responsibility for fund safeguarding assigned to a mobile money finance team that is separated from the business operations function?\n"},{"$f":"'1'!K7","v":"1) Documented custodial bank reconciliation process\n- Check responsibility for managing e-money is assigned to a mobile money finance team. \n\n2) Finance team organization chart and mobile money operations organisation chart. \n- Check there is separation of the mobile money finance and operations teams\n\n3) Custodial account mandates. \n- Check that only mobile money finance function personnel and mobile money senior management are permitted to operate the custodial accounts."},{"$f":"'1'!L7","v":0},{"$f":"'1'!M7","v":"Standard required"},{"$f":"'1'!N7","v":"Required"},{"$f":"'1'!O7","v":"FinOps"},{"$f":"'1'!P7","v":0},{"$f":"'1'!Q7","v":0},{"$f":"'1'!R7","v":0},{"$f":"'1'!S7","v":0},{"$f":"'1'!T7","v":0},{"$f":"'1'!U7","v":0},{"$f":"'1'!V7","v":0},{"$f":"'1'!W7","v":0},{"$f":"'1'!X7","v":0},{"$f":"'1'!Y7","v":0},{"$f":"'1'!Z7","v":0},{"$f":"'1'!AA7","v":0},{"$f":"'1'!AB7","v":0},{"$f":"'1'!AC7","v":0},{"$f":"'1'!AD7","v":0},{"$f":"'1'!AE7","v":0},{"$f":"'1'!AF7","v":0},{"$f":"'1'!AG7","v":0},{"$f":"'1'!AH7","v":0},{"$f":"'1'!AI7","v":0},{"$f":"'1'!AJ7","v":0},{"$f":"'1'!AK7","v":0},{"$f":"'1'!AL7","v":0},{"$f":"'1'!AM7","v":0},{"$f":"'1'!AN7","v":0},{"$f":"'1'!AO7","v":0},{"$f":"'1'!AP7","v":0},{"$f":"'1'!AQ7","v":0},{"$f":"'1'!AR7","v":0},{"$f":"'1'!AS7","v":0},{"$f":"'1'!AT7","v":0},{"$f":"SUMPRODUCT(IF($N6=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N6=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'1'!B8","v":"1"},{"$f":"'1'!C8","v":"1.1"},{"$f":"'1'!D8","v":"1.1.1"},{"$f":"'1'!E8","v":0},{"$f":"'1'!F8","v":"1.1.1.2"},{"$f":"'1'!G8","v":0},{"$f":"'1'!H8","v":0},{"$f":"'1'!I8","v":"1.1.1.2.2"},{"$f":"'1'!J8","v":"1.1.1.2.2: Is the custodial bank reconciliation process documented in detail, including the actions of e-money creation, allocation and deletion, and a procedure for resolving reconciliation discrepancies promptly?\n"},{"$f":"'1'!K8","v":"1) Documented custodial bank reconciliation process. \n- Check that the custodial bank reconciliation process is documented in detail, including the actions of:\n    • e-money creation (e-money is created when funds are added to the custodial account)\n    • e-money allocation (new e-money is allocated to the appropriate account)\n    • e-money deletion (e-money is deleted when funds are withdrawn from the custodial account)\n- Check that the process includes a procedure for resolving reconciliation discrepancies promptly, including escalation steps."},{"$f":"'1'!L8","v":0},{"$f":"'1'!M8","v":"Urgent Required"},{"$f":"'1'!N8","v":"Required"},{"$f":"'1'!O8","v":"FinOps"},{"$f":"'1'!P8","v":0},{"$f":"'1'!Q8","v":0},{"$f":"'1'!R8","v":0},{"$f":"'1'!S8","v":0},{"$f":"'1'!T8","v":0},{"$f":"'1'!U8","v":0},{"$f":"'1'!V8","v":0},{"$f":"'1'!W8","v":0},{"$f":"'1'!X8","v":0},{"$f":"'1'!Y8","v":0},{"$f":"'1'!Z8","v":0},{"$f":"'1'!AA8","v":0},{"$f":"'1'!AB8","v":0},{"$f":"'1'!AC8","v":0},{"$f":"'1'!AD8","v":0},{"$f":"'1'!AE8","v":0},{"$f":"'1'!AF8","v":0},{"$f":"'1'!AG8","v":0},{"$f":"'1'!AH8","v":0},{"$f":"'1'!AI8","v":0},{"$f":"'1'!AJ8","v":0},{"$f":"'1'!AK8","v":0},{"$f":"'1'!AL8","v":0},{"$f":"'1'!AM8","v":0},{"$f":"'1'!AN8","v":0},{"$f":"'1'!AO8","v":0},{"$f":"'1'!AP8","v":0},{"$f":"'1'!AQ8","v":0},{"$f":"'1'!AR8","v":0},{"$f":"'1'!AS8","v":0},{"$f":"'1'!AT8","v":0},{"$f":"SUMPRODUCT(IF($N7=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N7=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'1'!B9","v":"1"},{"$f":"'1'!C9","v":"1.1"},{"$f":"'1'!D9","v":"1.1.1"},{"$f":"'1'!E9","v":0},{"$f":"'1'!F9","v":"1.1.1.2"},{"$f":"'1'!G9","v":0},{"$f":"'1'!H9","v":0},{"$f":"'1'!I9","v":"1.1.1.2.3"},{"$f":"'1'!J9","v":"1.1.1.2.3: Is reconciliation with the custodial bank performed at least daily on weekdays?\n"},{"$f":"'1'!K9","v":"1) Documented custodial bank reconciliation process / custodial bank reconciliation records \n-  Check that the reconciliation with the custodial bank is performed at least daily on weekdays.\n"},{"$f":"'1'!L9","v":0},{"$f":"'1'!M9","v":"Standard required"},{"$f":"'1'!N9","v":"Required"},{"$f":"'1'!O9","v":"FinOps"},{"$f":"'1'!P9","v":0},{"$f":"'1'!Q9","v":0},{"$f":"'1'!R9","v":0},{"$f":"'1'!S9","v":0},{"$f":"'1'!T9","v":0},{"$f":"'1'!U9","v":0},{"$f":"'1'!V9","v":0},{"$f":"'1'!W9","v":0},{"$f":"'1'!X9","v":0},{"$f":"'1'!Y9","v":0},{"$f":"'1'!Z9","v":0},{"$f":"'1'!AA9","v":0},{"$f":"'1'!AB9","v":0},{"$f":"'1'!AC9","v":0},{"$f":"'1'!AD9","v":0},{"$f":"'1'!AE9","v":0},{"$f":"'1'!AF9","v":0},{"$f":"'1'!AG9","v":0},{"$f":"'1'!AH9","v":0},{"$f":"'1'!AI9","v":0},{"$f":"'1'!AJ9","v":0},{"$f":"'1'!AK9","v":0},{"$f":"'1'!AL9","v":0},{"$f":"'1'!AM9","v":0},{"$f":"'1'!AN9","v":0},{"$f":"'1'!AO9","v":0},{"$f":"'1'!AP9","v":0},{"$f":"'1'!AQ9","v":0},{"$f":"'1'!AR9","v":0},{"$f":"'1'!AS9","v":0},{"$f":"'1'!AT9","v":0},{"$f":"SUMPRODUCT(IF($N8=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N8=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'1'!B10","v":"1"},{"$f":"'1'!C10","v":"1.1"},{"$f":"'1'!D10","v":"1.1.1"},{"$f":"'1'!E10","v":0},{"$f":"'1'!F10","v":"1.1.1.2"},{"$f":"'1'!G10","v":0},{"$f":"'1'!H10","v":0},{"$f":"'1'!I10","v":"1.1.1.2.4"},{"$f":"'1'!J10","v":"1.1.1.2.4: Is the reconciliation process overseen by a reviewing function with separation of duty, to ensure reconciliation is accurately completed?\n"},{"$f":"'1'!K10","v":"1) Documented custodial bank reconciliation process / Custodial bank reconciliation records \n-  Check that custodial bank reconciliation is independently reviewed for accuracy and signed off by a separate team (i.e. segregation of duties).\n"},{"$f":"'1'!L10","v":0},{"$f":"'1'!M10","v":"Standard required"},{"$f":"'1'!N10","v":"Required"},{"$f":"'1'!O10","v":"FinOps"},{"$f":"'1'!P10","v":0},{"$f":"'1'!Q10","v":0},{"$f":"'1'!R10","v":0},{"$f":"'1'!S10","v":0},{"$f":"'1'!T10","v":0},{"$f":"'1'!U10","v":0},{"$f":"'1'!V10","v":0},{"$f":"'1'!W10","v":0},{"$f":"'1'!X10","v":0},{"$f":"'1'!Y10","v":0},{"$f":"'1'!Z10","v":0},{"$f":"'1'!AA10","v":0},{"$f":"'1'!AB10","v":0},{"$f":"'1'!AC10","v":0},{"$f":"'1'!AD10","v":0},{"$f":"'1'!AE10","v":0},{"$f":"'1'!AF10","v":0},{"$f":"'1'!AG10","v":0},{"$f":"'1'!AH10","v":0},{"$f":"'1'!AI10","v":0},{"$f":"'1'!AJ10","v":0},{"$f":"'1'!AK10","v":0},{"$f":"'1'!AL10","v":0},{"$f":"'1'!AM10","v":0},{"$f":"'1'!AN10","v":0},{"$f":"'1'!AO10","v":0},{"$f":"'1'!AP10","v":0},{"$f":"'1'!AQ10","v":0},{"$f":"'1'!AR10","v":0},{"$f":"'1'!AS10","v":0},{"$f":"'1'!AT10","v":0},{"$f":"SUMPRODUCT(IF($N9=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N9=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'1'!B11","v":"1"},{"$f":"'1'!C11","v":"1.1"},{"$f":"'1'!D11","v":"1.1.1"},{"$f":"'1'!E11","v":0},{"$f":"'1'!F11","v":"1.1.1.2"},{"$f":"'1'!G11","v":0},{"$f":"'1'!H11","v":0},{"$f":"'1'!I11","v":"1.1.1.2.5"},{"$f":"'1'!J11","v":"1.1.1.2.5: Does the custodial bank reconciliation process specify the start and end point of each reconciliation period, clearly defining which transactions should be included to reach the final settlement position?\n"},{"$f":"'1'!K11","v":0},{"$f":"'1'!L11","v":0},{"$f":"'1'!M11","v":"Recommended"},{"$f":"'1'!N11","v":"Recommended"},{"$f":"'1'!O11","v":"FinOps"},{"$f":"'1'!P11","v":0},{"$f":"'1'!Q11","v":0},{"$f":"'1'!R11","v":0},{"$f":"'1'!S11","v":0},{"$f":"'1'!T11","v":0},{"$f":"'1'!U11","v":0},{"$f":"'1'!V11","v":0},{"$f":"'1'!W11","v":0},{"$f":"'1'!X11","v":0},{"$f":"'1'!Y11","v":0},{"$f":"'1'!Z11","v":0},{"$f":"'1'!AA11","v":0},{"$f":"'1'!AB11","v":0},{"$f":"'1'!AC11","v":0},{"$f":"'1'!AD11","v":0},{"$f":"'1'!AE11","v":0},{"$f":"'1'!AF11","v":0},{"$f":"'1'!AG11","v":0},{"$f":"'1'!AH11","v":0},{"$f":"'1'!AI11","v":0},{"$f":"'1'!AJ11","v":0},{"$f":"'1'!AK11","v":0},{"$f":"'1'!AL11","v":0},{"$f":"'1'!AM11","v":0},{"$f":"'1'!AN11","v":0},{"$f":"'1'!AO11","v":0},{"$f":"'1'!AP11","v":0},{"$f":"'1'!AQ11","v":0},{"$f":"'1'!AR11","v":0},{"$f":"'1'!AS11","v":0},{"$f":"'1'!AT11","v":0},{"$f":"SUMPRODUCT(IF($N10=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N10=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'1'!B12","v":"1"},{"$f":"'1'!C12","v":"1.1"},{"$f":"'1'!D12","v":"1.1.2"},{"$f":"'1'!E12","v":"1.1.2: Providers shall ensure that user funds are ring-fenced to prevent attachment from the creditors of the provider in the event of a provider’s insolvency."},{"$f":"'1'!F12","v":"1.1.2.1"},{"$f":"'1'!G12","v":"1.1.2.1: PROTECTION OF FUNDS AGAINST LOSS DUE TO INSOLVENCY OF MOBILE MONEY PROVIDER\nUser funds must be legally segregated from the mobile money provider's assets to ensure that these funds may not be claimed by creditors of the provider in the event of a provider's insolvency. \n\nIn most countries with a common-law legal tradition (see definition), some form of a “trust” can be set up to ensure that funds are protected from a provider’s creditors. Funds held by the trust may not be claimed by the provider's creditors or the trustee's creditors.\n\nIn countries with a civil-law legal tradition, an arrangement similar to a common-law trust (such as a fiduciary contract) may be available, although in some countries user funds are not guaranteed full protection from the creditors of the fiduciary in the event of the fiduciary's insolvency. This risk can be mitigated if the fiduciary ensures that contractual agreements with creditors acknowledge that these assets are ring-fenced and unavailable in the event of the fiduciary’s insolvency.\n"},{"$f":"'1'!H12","v":"GSMA RMT (FIN-08)"},{"$f":"'1'!I12","v":"1.1.2.1.1"},{"$f":"'1'!J12","v":"1.1.2.1.1: Are user funds legally segregated - either through a trust or an arrangement that offers a similar level of protection - from the mobile money provider's assets (and the trustee's assets) to ensure that the funds may not be claimed by creditors in the event of the provider's or trustee's insolvency?\n"},{"$f":"'1'!K12","v":"1) Documented custodial bank reconciliation process. \n- Check the operator has formally identified measures to ensure customer funds are protected in the event of the operator, of any other key party, becoming insolvent. \n- Check the identified measures have been implemented effectively. \n\nNote 1: measures could include trust account, agreement with the regulator, separated commercial and trust accounts, etc.\nNote 2: This can be marked as N/A if trust accounts are not legally recognised the country of operation."},{"$f":"'1'!L12","v":0},{"$f":"'1'!M12","v":"Urgent Required"},{"$f":"'1'!N12","v":"Required"},{"$f":"'1'!O12","v":"FinOps"},{"$f":"'1'!P12","v":0},{"$f":"'1'!Q12","v":0},{"$f":"'1'!R12","v":0},{"$f":"'1'!S12","v":0},{"$f":"'1'!T12","v":0},{"$f":"'1'!U12","v":0},{"$f":"'1'!V12","v":0},{"$f":"'1'!W12","v":0},{"$f":"'1'!X12","v":0},{"$f":"'1'!Y12","v":0},{"$f":"'1'!Z12","v":0},{"$f":"'1'!AA12","v":0},{"$f":"'1'!AB12","v":0},{"$f":"'1'!AC12","v":0},{"$f":"'1'!AD12","v":0},{"$f":"'1'!AE12","v":0},{"$f":"'1'!AF12","v":0},{"$f":"'1'!AG12","v":0},{"$f":"'1'!AH12","v":0},{"$f":"'1'!AI12","v":0},{"$f":"'1'!AJ12","v":0},{"$f":"'1'!AK12","v":0},{"$f":"'1'!AL12","v":0},{"$f":"'1'!AM12","v":0},{"$f":"'1'!AN12","v":0},{"$f":"'1'!AO12","v":0},{"$f":"'1'!AP12","v":0},{"$f":"'1'!AQ12","v":0},{"$f":"'1'!AR12","v":0},{"$f":"'1'!AS12","v":0},{"$f":"'1'!AT12","v":0},{"$f":"SUMPRODUCT(IF($N11=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N11=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'1'!B13","v":"1"},{"$f":"'1'!C13","v":"1.1"},{"$f":"'1'!D13","v":"1.1.3"},{"$f":"'1'!E13","v":"1.1.3: Providers shall take measures to mitigate the risk of loss of funds due to insolvency of the bank, bond issuer, or other entity in which funds are invested."},{"$f":"'1'!F13","v":"1.1.3.1"},{"$f":"'1'!G13","v":"1.1.3.1: PROTECTION OF FUNDS AGAINST LOSS DUE TO INSOLVENCY OF CUSTODIAL BANK\nA risk assessment must be carried on the custodial bank to determine the bank's solvency. A risk mitigation strategy should be actioned appropriately. Recommended mitigation options include:\n• Custodial bank's deposit insurance, if it enables pass-through protection of individual mobile money wallets (this is not always the case);\n• Private deposit Insurance by the mobile money provider;\n• Spread risk across multiple banks;\n• Select custodial bank with a high reputation / rating;\n• Guarantee from the custodial bank’s parent group;\n• Guarantee from mobile money provider’s parent group.\n"},{"$f":"'1'!H13","v":0},{"$f":"'1'!I13","v":"1.1.3.1.1"},{"$f":"'1'!J13","v":"1.1.3.1.1: Has a risk assessment been carried on the custodial bank to determine the bank's solvency and a risk mitigation strategy actioned appropriately?\n"},{"$f":"'1'!K13","v":"1) Documented custodial bank reconciliation process. \n- Check the operator has assessed the custodial bank to determine their solvency and their risk of insolvency.\n- Check the operator has identified and actioned an appropriate migitation stratagy for custodial bank insolvency risk (Note: refer to Practice for examples)."},{"$f":"'1'!L13","v":0},{"$f":"'1'!M13","v":"Urgent Required"},{"$f":"'1'!N13","v":"Required"},{"$f":"'1'!O13","v":"FinOps"},{"$f":"'1'!P13","v":0},{"$f":"'1'!Q13","v":0},{"$f":"'1'!R13","v":0},{"$f":"'1'!S13","v":0},{"$f":"'1'!T13","v":0},{"$f":"'1'!U13","v":0},{"$f":"'1'!V13","v":0},{"$f":"'1'!W13","v":0},{"$f":"'1'!X13","v":0},{"$f":"'1'!Y13","v":0},{"$f":"'1'!Z13","v":0},{"$f":"'1'!AA13","v":0},{"$f":"'1'!AB13","v":0},{"$f":"'1'!AC13","v":0},{"$f":"'1'!AD13","v":0},{"$f":"'1'!AE13","v":0},{"$f":"'1'!AF13","v":0},{"$f":"'1'!AG13","v":0},{"$f":"'1'!AH13","v":0},{"$f":"'1'!AI13","v":0},{"$f":"'1'!AJ13","v":0},{"$f":"'1'!AK13","v":0},{"$f":"'1'!AL13","v":0},{"$f":"'1'!AM13","v":0},{"$f":"'1'!AN13","v":0},{"$f":"'1'!AO13","v":0},{"$f":"'1'!AP13","v":0},{"$f":"'1'!AQ13","v":0},{"$f":"'1'!AR13","v":0},{"$f":"'1'!AS13","v":0},{"$f":"'1'!AT13","v":0},{"$f":"SUMPRODUCT(IF($N12=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N12=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'1'!B14","v":"1"},{"$f":"'1'!C14","v":"1.1"},{"$f":"'1'!D14","v":"1.1.3"},{"$f":"'1'!E14","v":0},{"$f":"'1'!F14","v":"1.1.3.2"},{"$f":"'1'!G14","v":"1.1.3.2: MONITORING HEALTH OF CUSTODIAL BANK OR SIMILAR ENTITY\nMobile money providers should monitor the health of each bank, bond issuer, and/or other entity in which user funds are invested. This is particularly important in the absence of an effective public or private mechanism for insuring/guaranteeing user funds."},{"$f":"'1'!H14","v":"GSMA RMT (FIN-02)"},{"$f":"'1'!I14","v":"1.1.3.2.1"},{"$f":"'1'!J14","v":"1.1.3.2.1: Has a process been established for regularly monitoring the health of each bank, bond issuer, and/or other entity in which user funds are invested?\n"},{"$f":"'1'!K14","v":0},{"$f":"'1'!L14","v":0},{"$f":"'1'!M14","v":"Recommended"},{"$f":"'1'!N14","v":"Recommended"},{"$f":"'1'!O14","v":"FinOps"},{"$f":"'1'!P14","v":0},{"$f":"'1'!Q14","v":0},{"$f":"'1'!R14","v":0},{"$f":"'1'!S14","v":0},{"$f":"'1'!T14","v":0},{"$f":"'1'!U14","v":0},{"$f":"'1'!V14","v":0},{"$f":"'1'!W14","v":0},{"$f":"'1'!X14","v":0},{"$f":"'1'!Y14","v":0},{"$f":"'1'!Z14","v":0},{"$f":"'1'!AA14","v":0},{"$f":"'1'!AB14","v":0},{"$f":"'1'!AC14","v":0},{"$f":"'1'!AD14","v":0},{"$f":"'1'!AE14","v":0},{"$f":"'1'!AF14","v":0},{"$f":"'1'!AG14","v":0},{"$f":"'1'!AH14","v":0},{"$f":"'1'!AI14","v":0},{"$f":"'1'!AJ14","v":0},{"$f":"'1'!AK14","v":0},{"$f":"'1'!AL14","v":0},{"$f":"'1'!AM14","v":0},{"$f":"'1'!AN14","v":0},{"$f":"'1'!AO14","v":0},{"$f":"'1'!AP14","v":0},{"$f":"'1'!AQ14","v":0},{"$f":"'1'!AR14","v":0},{"$f":"'1'!AS14","v":0},{"$f":"'1'!AT14","v":0},{"$f":"SUMPRODUCT(IF($N13=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N13=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'1'!B15","v":"1"},{"$f":"'1'!C15","v":"1.1"},{"$f":"'1'!D15","v":"1.1.3"},{"$f":"'1'!E15","v":0},{"$f":"'1'!F15","v":"1.1.3.3"},{"$f":"'1'!G15","v":"1.1.3.3: DIVERSIFICATION OF FUNDS\nMobile money providers should consider diversification of funds among multiple banks (and/or other entities in which user funds are invested) to mitigate insolvency risk. At minimum, providers should begin diversification of funds once the value of user funds exceeds the value of the provider's net equity.\n\nIf an effective public or private mechanism for insuring user funds is in place, providers should still consider whether diversification of funds makes sense as a risk mitigation measure (e.g., to reduce risk of reliance on a single bank) or for commercial reasons (e.g., to facilitate cash-in and cash-out by financial ecosystem partners). \n"},{"$f":"'1'!H15","v":"GSMA RMT (FIN-09)"},{"$f":"'1'!I15","v":"1.1.3.3.1"},{"$f":"'1'!J15","v":"1.1.3.3.1: If the value of user funds exceeds the value of the provider's net equity, has the provider diversified funds among multiple banks (and/or other entities in which user funds are invested)?\n"},{"$f":"'1'!K15","v":0},{"$f":"'1'!L15","v":0},{"$f":"'1'!M15","v":"Recommended"},{"$f":"'1'!N15","v":"Recommended"},{"$f":"'1'!O15","v":"FinOps"},{"$f":"'1'!P15","v":0},{"$f":"'1'!Q15","v":0},{"$f":"'1'!R15","v":0},{"$f":"'1'!S15","v":0},{"$f":"'1'!T15","v":0},{"$f":"'1'!U15","v":0},{"$f":"'1'!V15","v":0},{"$f":"'1'!W15","v":0},{"$f":"'1'!X15","v":0},{"$f":"'1'!Y15","v":0},{"$f":"'1'!Z15","v":0},{"$f":"'1'!AA15","v":0},{"$f":"'1'!AB15","v":0},{"$f":"'1'!AC15","v":0},{"$f":"'1'!AD15","v":0},{"$f":"'1'!AE15","v":0},{"$f":"'1'!AF15","v":0},{"$f":"'1'!AG15","v":0},{"$f":"'1'!AH15","v":0},{"$f":"'1'!AI15","v":0},{"$f":"'1'!AJ15","v":0},{"$f":"'1'!AK15","v":0},{"$f":"'1'!AL15","v":0},{"$f":"'1'!AM15","v":0},{"$f":"'1'!AN15","v":0},{"$f":"'1'!AO15","v":0},{"$f":"'1'!AP15","v":0},{"$f":"'1'!AQ15","v":0},{"$f":"'1'!AR15","v":0},{"$f":"'1'!AS15","v":0},{"$f":"'1'!AT15","v":0},{"$f":"SUMPRODUCT(IF($N14=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N14=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'1'!B17","v":"1"},{"$f":"'1'!C17","v":"1.2"},{"$f":"'1'!D17","v":"1.2.1"},{"$f":"'1'!E17","v":"1.2.1: Where feasible, providers shall only authorize customer transactions in which the debiting and crediting of mobile money accounts is processed in real time."},{"$f":"'1'!F17","v":"1.2.1.1"},{"$f":"'1'!G17","v":"1.2.1.1: REAL-TIME TRANSACTION PROCESSING\nWhenever possible, all transactions must be completed in real time. The debit party's account should be debited at the same time as the credit party's account is credited.\n\n"},{"$f":"'1'!H17","v":0},{"$f":"'1'!I17","v":"1.2.1.1.1"},{"$f":"'1'!J17","v":"1.2.1.1.1: Are all transactions completed in real time (the debit party's account is debited at the same time as the credit party's account is credited), barring documented exceptions (i.e. multi-stage transactions - see 1.2.1.2)?\n"},{"$f":"'1'!K17","v":"1) Mobile Money system functional specification \n- Check that all transactions are processed in real time (debits and credits happen on the mobile money platform at the same time)  barring documented exceptions (i.e. multi-stage transactions noted in 1.2.1.2)"},{"$f":"'1'!L17","v":0},{"$f":"'1'!M17","v":"Standard Required"},{"$f":"'1'!N17","v":"Required"},{"$f":"'1'!O17","v":"TechOps"},{"$f":"'1'!P17","v":0},{"$f":"'1'!Q17","v":0},{"$f":"'1'!R17","v":0},{"$f":"'1'!S17","v":0},{"$f":"'1'!T17","v":0},{"$f":"'1'!U17","v":0},{"$f":"'1'!V17","v":0},{"$f":"'1'!W17","v":0},{"$f":"'1'!X17","v":0},{"$f":"'1'!Y17","v":0},{"$f":"'1'!Z17","v":0},{"$f":"'1'!AA17","v":0},{"$f":"'1'!AB17","v":0},{"$f":"'1'!AC17","v":0},{"$f":"'1'!AD17","v":0},{"$f":"'1'!AE17","v":0},{"$f":"'1'!AF17","v":0},{"$f":"'1'!AG17","v":0},{"$f":"'1'!AH17","v":0},{"$f":"'1'!AI17","v":0},{"$f":"'1'!AJ17","v":0},{"$f":"'1'!AK17","v":0},{"$f":"'1'!AL17","v":0},{"$f":"'1'!AM17","v":0},{"$f":"'1'!AN17","v":0},{"$f":"'1'!AO17","v":0},{"$f":"'1'!AP17","v":0},{"$f":"'1'!AQ17","v":0},{"$f":"'1'!AR17","v":0},{"$f":"'1'!AS17","v":0},{"$f":"'1'!AT17","v":0},{"$f":"SUMPRODUCT(IF($N15=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N15=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'1'!B18","v":"1"},{"$f":"'1'!C18","v":"1.2"},{"$f":"'1'!D18","v":"1.2.1"},{"$f":"'1'!E18","v":0},{"$f":"'1'!F18","v":"1.2.1.2"},{"$f":"'1'!G18","v":"1.2.1.2: FUNDS RESERVATION FOR MULTI-STAGE TRANSACTIONS\nSome transactions cannot be completed in real time, and require a confirmation step to be completed. Examples of multi-stage transactions include:\n   - transfer to an account of a financial partner, which requires time to confirm the transaction completion;\n   - P2P transfer to unregistered user (funds reserved until voucher is used)\n   - bill payment requiring biller's authorisation before completion;\n   - international money transfer requiring confirmation from the receiver's bank/hub, or requiring the recipient to provide additional KYC information. \n\nFunds should be debited or reserved from the sending party's account as soon as the transaction has been authorised by the mobile money sender. The funds will then be available for completing the transaction when it is confirmed (or released if the transaction is cancelled).\n\nThis is to mitigate the risk that the sender removes their funds before the transaction is completed, leading to a negative balance.\n"},{"$f":"'1'!H18","v":0},{"$f":"'1'!I18","v":"1.2.1.2.1"},{"$f":"'1'!J18","v":"1.2.1.2.1: For multi-stage transactions (requiring 3rd party action before completion), are funds debited or reserved from the sending party's account as soon as the transaction has been authorised by the mobile money sender?\n"},{"$f":"'1'!K18","v":"1) Mobile Money system functional specification or practical demonstration\n- Check transaction processing model for each multi-stage transaction type, including reversals and failure cases. Check that funds are debited or reserved as soon as each transaction is authorised by the sender. \nConsider the following examples:\n   - transfer to an account of a financial partner, which requires time to confirm the transaction completion;\n   - P2P transfer to unregistered user (funds reserved until voucher is used)\n   - bill payment requiring biller's authorisation before completion;\n   - international money transfer requiring confirmation from the receiver's bank/hub, or requiring the recipient to provide additional KYC information. \n"},{"$f":"'1'!L18","v":0},{"$f":"'1'!M18","v":"Urgent Required"},{"$f":"'1'!N18","v":"Required"},{"$f":"'1'!O18","v":"TechOps"},{"$f":"'1'!P18","v":0},{"$f":"'1'!Q18","v":0},{"$f":"'1'!R18","v":0},{"$f":"'1'!S18","v":0},{"$f":"'1'!U18","v":0},{"$f":"'1'!#REF!","v":{"$error":"#REF!"}},{"$f":"'1'!V18","v":0},{"$f":"'1'!W18","v":0},{"$f":"'1'!X18","v":0},{"$f":"'1'!Y18","v":0},{"$f":"'1'!Z18","v":0},{"$f":"'1'!AA18","v":0},{"$f":"'1'!AB18","v":0},{"$f":"'1'!AC18","v":0},{"$f":"'1'!AD18","v":0},{"$f":"'1'!AE18","v":0},{"$f":"'1'!AF18","v":0},{"$f":"'1'!AG18","v":0},{"$f":"'1'!AH18","v":0},{"$f":"'1'!AI18","v":0},{"$f":"'1'!AJ18","v":0},{"$f":"'1'!AK18","v":0},{"$f":"'1'!AL18","v":0},{"$f":"'1'!AM18","v":0},{"$f":"'1'!AN18","v":0},{"$f":"'1'!AO18","v":0},{"$f":"'1'!AP18","v":0},{"$f":"'1'!AQ18","v":0},{"$f":"'1'!AR18","v":0},{"$f":"'1'!AS18","v":0},{"$f":"'1'!AT18","v":0},{"$f":"SUMPRODUCT(IF($N16=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N16=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'1'!B19","v":"1"},{"$f":"'1'!C19","v":"1.2"},{"$f":"'1'!D19","v":"1.2.1"},{"$f":"'1'!E19","v":0},{"$f":"'1'!F19","v":"1.2.1.3"},{"$f":"'1'!G19","v":"1.2.1.3: SUSPENDED AND FAILED TRANSACTIONS\nThe system should automatically detect suspended transactions and alert staff to take appropriate action promptly (see definition).\n\nWhen transactions fail, the funds should be returned to the originator immediately, who should be notified promptly.\n"},{"$f":"'1'!H19","v":"GSMA RMT (FIN-12)"},{"$f":"'1'!I19","v":"1.2.1.3.1"},{"$f":"'1'!J19","v":"1.2.1.3.1: Does the system automatically detect suspended transactions and alert staff to take appropriate action promptly (see definition)?\n"},{"$f":"'1'!K19","v":0},{"$f":"'1'!L19","v":0},{"$f":"'1'!M19","v":"Recommended"},{"$f":"'1'!N19","v":"Recommended"},{"$f":"'1'!O19","v":"FinOps"},{"$f":"'1'!P19","v":0},{"$f":"'1'!Q19","v":0},{"$f":"'1'!R19","v":0},{"$f":"'1'!S19","v":0},{"$f":"'1'!T19","v":0},{"$f":"'1'!U19","v":0},{"$f":"'1'!V19","v":0},{"$f":"'1'!W19","v":0},{"$f":"'1'!X19","v":0},{"$f":"'1'!Y19","v":0},{"$f":"'1'!Z19","v":0},{"$f":"'1'!AA19","v":0},{"$f":"'1'!AB19","v":0},{"$f":"'1'!AC19","v":0},{"$f":"'1'!AD19","v":0},{"$f":"'1'!AE19","v":0},{"$f":"'1'!AF19","v":0},{"$f":"'1'!AG19","v":0},{"$f":"'1'!AH19","v":0},{"$f":"'1'!AI19","v":0},{"$f":"'1'!AJ19","v":0},{"$f":"'1'!AK19","v":0},{"$f":"'1'!AL19","v":0},{"$f":"'1'!AM19","v":0},{"$f":"'1'!AN19","v":0},{"$f":"'1'!AO19","v":0},{"$f":"'1'!AP19","v":0},{"$f":"'1'!AQ19","v":0},{"$f":"'1'!AR19","v":0},{"$f":"'1'!AS19","v":0},{"$f":"'1'!AT19","v":0},{"$f":"SUMPRODUCT(IF($N17=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N17=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'1'!B20","v":"1"},{"$f":"'1'!C20","v":"1.2"},{"$f":"'1'!D20","v":"1.2.1"},{"$f":"'1'!E20","v":0},{"$f":"'1'!F20","v":"1.2.1.3"},{"$f":"'1'!G20","v":0},{"$f":"'1'!H20","v":0},{"$f":"'1'!I20","v":"1.2.1.3.2"},{"$f":"'1'!J20","v":"1.2.1.3.2: When transactions fail, are funds returned to the originator immediately, with a prompt notification?\n"},{"$f":"'1'!K20","v":0},{"$f":"'1'!L20","v":0},{"$f":"'1'!M20","v":"Recommended"},{"$f":"'1'!N20","v":"Recommended"},{"$f":"'1'!O20","v":"FinOps"},{"$f":"'1'!P20","v":0},{"$f":"'1'!Q20","v":0},{"$f":"'1'!R20","v":0},{"$f":"'1'!S20","v":0},{"$f":"'1'!T20","v":0},{"$f":"'1'!U20","v":0},{"$f":"'1'!V20","v":0},{"$f":"'1'!W20","v":0},{"$f":"'1'!X20","v":0},{"$f":"'1'!Y20","v":0},{"$f":"'1'!Z20","v":0},{"$f":"'1'!AA20","v":0},{"$f":"'1'!AB20","v":0},{"$f":"'1'!AC20","v":0},{"$f":"'1'!AD20","v":0},{"$f":"'1'!AE20","v":0},{"$f":"'1'!AF20","v":0},{"$f":"'1'!AG20","v":0},{"$f":"'1'!AH20","v":0},{"$f":"'1'!AI20","v":0},{"$f":"'1'!AJ20","v":0},{"$f":"'1'!AK20","v":0},{"$f":"'1'!AL20","v":0},{"$f":"'1'!AM20","v":0},{"$f":"'1'!AN20","v":0},{"$f":"'1'!AO20","v":0},{"$f":"'1'!AP20","v":0},{"$f":"'1'!AQ20","v":0},{"$f":"'1'!AR20","v":0},{"$f":"'1'!AS20","v":0},{"$f":"'1'!AT20","v":0},{"$f":"SUMPRODUCT(IF($N18=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N18=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'1'!B21","v":"1"},{"$f":"'1'!C21","v":"1.2"},{"$f":"'1'!D21","v":"1.2.2"},{"$f":"'1'!E21","v":"1.2.2: Providers shall regularly reconcile transactions and settle balances with financial ecosystem partners."},{"$f":"'1'!F21","v":"1.2.2.1"},{"$f":"'1'!G21","v":"1.2.2.1: RECONCILIATION WITH FINANCIAL ECOSYSTEM PARTNERS\nA process should be defined for reconciling transactions with each financial ecosystem partner. Reconciliation is used to agree the transactions that have been exchanged with each financial partner, ensuring that both party's records are in agreement. The process should indicate how the net financial position is established for settling the balance.\n\nThe process should define:\n  - the data exchange mechanism (see below);\n  - the steps that should be taken by each party;\n  - the frequency of reconciliation determined by a risk assessment for each financial partner (e.g. daily);\n  - actions to be taken in case of discrepancy in reconciliation.\n\nData exchange: information on completed, pending, failed and suspended transactions should be included in the data exchanged. This is important for resolving the scenario where a transaction succeeds in one party's system but has not completed in the other party's system, leading to reconciliation discrepancy. \n\nSome financial ecosystem partners simply operate a prefunded e-money account (many ATM providers follow this model) and reconciliation is the responsibility of the partner. In this case, there must be a documented process for the financial ecosystem partner to dispute the transaction records.\n\n\n"},{"$f":"'1'!H21","v":"GSMA RMT (FIN-13)\nISO 27002:2013 Sec. 12.1"},{"$f":"'1'!I21","v":"1.2.2.1.1"},{"$f":"'1'!J21","v":"1.2.2.1.1: Has a process been documented for reconciliation of the net financial position with each applicable financial ecosystem partner?\n[Exclude financial ecosystem partners where the partner simply operates a prefunded e-monay account - see 1.2.2.1.2]\n"},{"$f":"'1'!K21","v":"1) Reconciliation and Settlement process or policy for financial partners\nCheck that the process specifies for each applicable financial partner (e.g. bank, IMT provider, interoperability MM provider):\n     a) the steps that should be taken by each party to establish the net financial position for settling the balance;\n     b) actions to be taken in case of discrepancy in reconciliation;\n     c) the frequency of reconciliation.\n"},{"$f":"'1'!L21","v":0},{"$f":"'1'!M21","v":"Urgent Required"},{"$f":"'1'!N21","v":"Required"},{"$f":"'1'!O21","v":"FinOps"},{"$f":"'1'!P21","v":0},{"$f":"'1'!Q21","v":0},{"$f":"'1'!R21","v":0},{"$f":"'1'!S21","v":0},{"$f":"'1'!T21","v":0},{"$f":"'1'!U21","v":0},{"$f":"'1'!V21","v":0},{"$f":"'1'!W21","v":0},{"$f":"'1'!X21","v":0},{"$f":"'1'!Y21","v":0},{"$f":"'1'!Z21","v":0},{"$f":"'1'!AA21","v":0},{"$f":"'1'!AB21","v":0},{"$f":"'1'!AC21","v":0},{"$f":"'1'!AD21","v":0},{"$f":"'1'!AE21","v":0},{"$f":"'1'!AF21","v":0},{"$f":"'1'!AG21","v":0},{"$f":"'1'!AH21","v":0},{"$f":"'1'!AI21","v":0},{"$f":"'1'!AJ21","v":0},{"$f":"'1'!AK21","v":0},{"$f":"'1'!AL21","v":0},{"$f":"'1'!AM21","v":0},{"$f":"'1'!AN21","v":0},{"$f":"'1'!AO21","v":0},{"$f":"'1'!AP21","v":0},{"$f":"'1'!AQ21","v":0},{"$f":"'1'!AR21","v":0},{"$f":"'1'!AS21","v":0},{"$f":"'1'!AT21","v":0},{"$f":"SUMPRODUCT(IF($N19=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N19=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'1'!B22","v":"1"},{"$f":"'1'!C22","v":"1.2"},{"$f":"'1'!D22","v":"1.2.2"},{"$f":"'1'!E22","v":0},{"$f":"'1'!F22","v":"1.2.2.1"},{"$f":"'1'!G22","v":0},{"$f":"'1'!H22","v":0},{"$f":"'1'!I22","v":"1.2.2.1.2"},{"$f":"'1'!J22","v":"1.2.2.1.2: For financial ecosystem partners that simply operate a prefunded e-monay account and reconciliation is the responsibility of the partner, is there a documented process for financial ecosystem partners to dispute transaction records?\n"},{"$f":"'1'!K22","v":"1) Reconciliation and Settlement process or policy for financial partners\n-  Check that the process specifies how financial ecosystem partners may dispute transaction records.\n"},{"$f":"'1'!L22","v":0},{"$f":"'1'!M22","v":"Urgent Required"},{"$f":"'1'!N22","v":"Required"},{"$f":"'1'!O22","v":"FinOps"},{"$f":"'1'!P22","v":0},{"$f":"'1'!Q22","v":0},{"$f":"'1'!R22","v":0},{"$f":"'1'!S22","v":0},{"$f":"'1'!T22","v":0},{"$f":"'1'!U22","v":0},{"$f":"'1'!V22","v":0},{"$f":"'1'!W22","v":0},{"$f":"'1'!X22","v":0},{"$f":"'1'!Y22","v":0},{"$f":"'1'!Z22","v":0},{"$f":"'1'!AA22","v":0},{"$f":"'1'!AB22","v":0},{"$f":"'1'!AC22","v":0},{"$f":"'1'!AD22","v":0},{"$f":"'1'!AE22","v":0},{"$f":"'1'!AF22","v":0},{"$f":"'1'!AG22","v":0},{"$f":"'1'!AH22","v":0},{"$f":"'1'!AI22","v":0},{"$f":"'1'!AJ22","v":0},{"$f":"'1'!AK22","v":0},{"$f":"'1'!AL22","v":0},{"$f":"'1'!AM22","v":0},{"$f":"'1'!AN22","v":0},{"$f":"'1'!AO22","v":0},{"$f":"'1'!AP22","v":0},{"$f":"'1'!AQ22","v":0},{"$f":"'1'!AR22","v":0},{"$f":"'1'!AS22","v":0},{"$f":"'1'!AT22","v":0},{"$f":"SUMPRODUCT(IF($N20=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N20=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'1'!B23","v":"1"},{"$f":"'1'!C23","v":"1.2"},{"$f":"'1'!D23","v":"1.2.2"},{"$f":"'1'!E23","v":0},{"$f":"'1'!F23","v":"1.2.2.1"},{"$f":"'1'!G23","v":0},{"$f":"'1'!H23","v":0},{"$f":"'1'!I23","v":"1.2.2.1.3"},{"$f":"'1'!J23","v":"1.2.2.1.3: Is information on failed and suspended transactions included in the data exchanged to help resolve reconciliation discrepancies?\n"},{"$f":"'1'!K23","v":0},{"$f":"'1'!L23","v":0},{"$f":"'1'!M23","v":"Recommended"},{"$f":"'1'!N23","v":"Recommended"},{"$f":"'1'!O23","v":"FinOps"},{"$f":"'1'!P23","v":0},{"$f":"'1'!Q23","v":0},{"$f":"'1'!R23","v":0},{"$f":"'1'!S23","v":0},{"$f":"'1'!T23","v":0},{"$f":"'1'!U23","v":0},{"$f":"'1'!V23","v":0},{"$f":"'1'!W23","v":0},{"$f":"'1'!X23","v":0},{"$f":"'1'!Y23","v":0},{"$f":"'1'!Z23","v":0},{"$f":"'1'!AA23","v":0},{"$f":"'1'!AB23","v":0},{"$f":"'1'!AC23","v":0},{"$f":"'1'!AD23","v":0},{"$f":"'1'!AE23","v":0},{"$f":"'1'!AF23","v":0},{"$f":"'1'!AG23","v":0},{"$f":"'1'!AH23","v":0},{"$f":"'1'!AI23","v":0},{"$f":"'1'!AJ23","v":0},{"$f":"'1'!AK23","v":0},{"$f":"'1'!AL23","v":0},{"$f":"'1'!AM23","v":0},{"$f":"'1'!AN23","v":0},{"$f":"'1'!AO23","v":0},{"$f":"'1'!AP23","v":0},{"$f":"'1'!AQ23","v":0},{"$f":"'1'!AR23","v":0},{"$f":"'1'!AS23","v":0},{"$f":"'1'!AT23","v":0},{"$f":"SUMPRODUCT(IF($N21=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N21=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'1'!B24","v":"1"},{"$f":"'1'!C24","v":"1.2"},{"$f":"'1'!D24","v":"1.2.2"},{"$f":"'1'!E24","v":0},{"$f":"'1'!F24","v":"1.2.2.2"},{"$f":"'1'!G24","v":"1.2.2.2: SETTLEMENT PROCESS FOR FINANCIAL ECOSYSTEM PARTNERS\nThe settlement process should specify the mechanism for exchange of funds between the provider and each financial ecosystem partner, in order to settle the balance indicated by reconciliation. \n\nSettlement accounts may be pre-funded or floating (i.e. which may go negative). A risk assessment should be done to determine whether a floating settlement account is suitable. For example, pre-funded settlement accounts may be required for some financial partners (e.g. international money transfer providers), but floating settlement accounts could be used for others (e.g. banks).\n\nFor settlement accounts that are not pre-funded and which might go negative (i.e. Provider could be a net payer):\n- the settlement process should specify for each financial partner how frequently settlement should be carried out.\n- acceptable settlement limits should be defined, together with a mechanism for enforcing the limits. There should be an escalation process to alert the head of mobile money to take action if settlement limits are exceeded.\n"},{"$f":"'1'!H24","v":"GSMA RMT\n\nISO 27002:2013 Sec. 12.1"},{"$f":"'1'!I24","v":"1.2.2.2.1"},{"$f":"'1'!J24","v":"1.2.2.2.1: Is a suitable settlement mechanism implemented and documented for every ecosystem partner (either pre-funded or risk-based)?\n"},{"$f":"'1'!K24","v":"1) Reconciliation and Settlement process or policy for financial partners\n- Check the process specifies a suitable settlement mechanism for each class of ecosystem partner\n- Check that pre-funded mechanisms are used for high-risk partners or where regulation prescribes it must be used.  \n\n[Note: settlement of prefunded accounts could simply mean deposit / withdrawal following the same model as master agents]"},{"$f":"'1'!L24","v":0},{"$f":"'1'!M24","v":"Urgent Required"},{"$f":"'1'!N24","v":"Required"},{"$f":"'1'!O24","v":"FinOps"},{"$f":"'1'!P24","v":0},{"$f":"'1'!Q24","v":0},{"$f":"'1'!R24","v":0},{"$f":"'1'!S24","v":0},{"$f":"'1'!T24","v":0},{"$f":"'1'!U24","v":0},{"$f":"'1'!V24","v":0},{"$f":"'1'!W24","v":0},{"$f":"'1'!X24","v":0},{"$f":"'1'!Y24","v":0},{"$f":"'1'!Z24","v":0},{"$f":"'1'!AA24","v":0},{"$f":"'1'!AB24","v":0},{"$f":"'1'!AC24","v":0},{"$f":"'1'!AD24","v":0},{"$f":"'1'!AE24","v":0},{"$f":"'1'!AF24","v":0},{"$f":"'1'!AG24","v":0},{"$f":"'1'!AH24","v":0},{"$f":"'1'!AI24","v":0},{"$f":"'1'!AJ24","v":0},{"$f":"'1'!AK24","v":0},{"$f":"'1'!AL24","v":0},{"$f":"'1'!AM24","v":0},{"$f":"'1'!AN24","v":0},{"$f":"'1'!AO24","v":0},{"$f":"'1'!AP24","v":0},{"$f":"'1'!AQ24","v":0},{"$f":"'1'!AR24","v":0},{"$f":"'1'!AS24","v":0},{"$f":"'1'!AT24","v":0},{"$f":"SUMPRODUCT(IF($N22=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N22=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'1'!B25","v":"1"},{"$f":"'1'!C25","v":"1.2"},{"$f":"'1'!D25","v":"1.2.2"},{"$f":"'1'!E25","v":0},{"$f":"'1'!F25","v":"1.2.2.2"},{"$f":"'1'!G25","v":0},{"$f":"'1'!H25","v":0},{"$f":"'1'!I25","v":"1.2.2.2.2"},{"$f":"'1'!J25","v":"1.2.2.2.2: If any settlement accounts are not pre-funded and which might go negative (i.e. Provider could be a net payer), does the reconciliation & settlement process define and enforce settlement account value limits?\n"},{"$f":"'1'!K25","v":"1) Reconciliation and Settlement process or policy for financial partners\n- If all settlement accounts are pre-funded (where the Provider is a net payer), mark this indicator as N/A.\n- Check that limits are set for all floating (non-pre-funded) settlement accounts with financial partners.\n- Check that there is a process for enforcing settlement limits for all floating settlement accounts (e.g. escalation to head of mobile money)."},{"$f":"'1'!L25","v":0},{"$f":"'1'!M25","v":"Standard Required"},{"$f":"'1'!N25","v":"Required"},{"$f":"'1'!O25","v":"FinOps"},{"$f":"'1'!P25","v":0},{"$f":"'1'!Q25","v":0},{"$f":"'1'!R25","v":0},{"$f":"'1'!S25","v":0},{"$f":"'1'!T25","v":0},{"$f":"'1'!U25","v":0},{"$f":"'1'!V25","v":0},{"$f":"'1'!W25","v":0},{"$f":"'1'!X25","v":0},{"$f":"'1'!Y25","v":0},{"$f":"'1'!Z25","v":0},{"$f":"'1'!AA25","v":0},{"$f":"'1'!AB25","v":0},{"$f":"'1'!AC25","v":0},{"$f":"'1'!AD25","v":0},{"$f":"'1'!AE25","v":0},{"$f":"'1'!AF25","v":0},{"$f":"'1'!AG25","v":0},{"$f":"'1'!AH25","v":0},{"$f":"'1'!AI25","v":0},{"$f":"'1'!AJ25","v":0},{"$f":"'1'!AK25","v":0},{"$f":"'1'!AL25","v":0},{"$f":"'1'!AM25","v":0},{"$f":"'1'!AN25","v":0},{"$f":"'1'!AO25","v":0},{"$f":"'1'!AP25","v":0},{"$f":"'1'!AQ25","v":0},{"$f":"'1'!AR25","v":0},{"$f":"'1'!AS25","v":0},{"$f":"'1'!AT25","v":0},{"$f":"SUMPRODUCT(IF($N23=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N23=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'1'!B26","v":"1"},{"$f":"'1'!C26","v":"1.2"},{"$f":"'1'!D26","v":"1.2.2"},{"$f":"'1'!E26","v":0},{"$f":"'1'!F26","v":"1.2.2.3"},{"$f":"'1'!G26","v":"1.2.2.3: RECONCILIATION & SETTLEMENT PROCESS: SERVICE LEVEL AGREEMENTS\nService levels for completion of reconciliation & settlement and for resolution of discrepancies and disputes should be agreed with each financial ecosystem partner. A process should be agreed for resolving breaches of the agreed service levels.\n\nService levels should include:\n- Time to complete reconciliation; \n- Time for transfers of settlement funds; and\n- Time for resolving disputes and escalations."},{"$f":"'1'!H26","v":"GSMA RMT\n\nISO 20000-1:2011 Sec. 6.1"},{"$f":"'1'!I26","v":"1.2.2.3.1"},{"$f":"'1'!J26","v":"1.2.2.3.1: Is there a Service Level Agreement (SLA) with each financial partner, specifying the expected performance for completing the reconciliation process?\n"},{"$f":"'1'!K26","v":0},{"$f":"'1'!L26","v":0},{"$f":"'1'!M26","v":"Recommended"},{"$f":"'1'!N26","v":"Recommended"},{"$f":"'1'!O26","v":"FinOps"},{"$f":"'1'!P26","v":0},{"$f":"'1'!Q26","v":0},{"$f":"'1'!R26","v":0},{"$f":"'1'!S26","v":0},{"$f":"'1'!T26","v":0},{"$f":"'1'!U26","v":0},{"$f":"'1'!V26","v":0},{"$f":"'1'!W26","v":0},{"$f":"'1'!X26","v":0},{"$f":"'1'!Y26","v":0},{"$f":"'1'!Z26","v":0},{"$f":"'1'!AA26","v":0},{"$f":"'1'!AB26","v":0},{"$f":"'1'!AC26","v":0},{"$f":"'1'!AD26","v":0},{"$f":"'1'!AE26","v":0},{"$f":"'1'!AF26","v":0},{"$f":"'1'!AG26","v":0},{"$f":"'1'!AH26","v":0},{"$f":"'1'!AI26","v":0},{"$f":"'1'!AJ26","v":0},{"$f":"'1'!AK26","v":0},{"$f":"'1'!AL26","v":0},{"$f":"'1'!AM26","v":0},{"$f":"'1'!AN26","v":0},{"$f":"'1'!AO26","v":0},{"$f":"'1'!AP26","v":0},{"$f":"'1'!AQ26","v":0},{"$f":"'1'!AR26","v":0},{"$f":"'1'!AS26","v":0},{"$f":"'1'!AT26","v":0},{"$f":"SUMPRODUCT(IF($N24=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N24=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'1'!B27","v":"1"},{"$f":"'1'!C27","v":"1.2"},{"$f":"'1'!D27","v":"1.2.2"},{"$f":"'1'!E27","v":0},{"$f":"'1'!F27","v":"1.2.2.3"},{"$f":"'1'!G27","v":0},{"$f":"'1'!H27","v":0},{"$f":"'1'!I27","v":"1.2.2.3.2"},{"$f":"'1'!J27","v":"1.2.2.3.2: Is there a Service Level Agreement (SLA) with each financial partner, specifying the expected performance for resolving reconciliation/settlement disputes and escalations?\n"},{"$f":"'1'!K27","v":0},{"$f":"'1'!L27","v":0},{"$f":"'1'!M27","v":"Recommended"},{"$f":"'1'!N27","v":"Recommended"},{"$f":"'1'!O27","v":"FinOps"},{"$f":"'1'!P27","v":0},{"$f":"'1'!Q27","v":0},{"$f":"'1'!R27","v":0},{"$f":"'1'!S27","v":0},{"$f":"'1'!T27","v":0},{"$f":"'1'!U27","v":0},{"$f":"'1'!V27","v":0},{"$f":"'1'!W27","v":0},{"$f":"'1'!X27","v":0},{"$f":"'1'!Y27","v":0},{"$f":"'1'!Z27","v":0},{"$f":"'1'!AA27","v":0},{"$f":"'1'!AB27","v":0},{"$f":"'1'!AC27","v":0},{"$f":"'1'!AD27","v":0},{"$f":"'1'!AE27","v":0},{"$f":"'1'!AF27","v":0},{"$f":"'1'!AG27","v":0},{"$f":"'1'!AH27","v":0},{"$f":"'1'!AI27","v":0},{"$f":"'1'!AJ27","v":0},{"$f":"'1'!AK27","v":0},{"$f":"'1'!AL27","v":0},{"$f":"'1'!AM27","v":0},{"$f":"'1'!AN27","v":0},{"$f":"'1'!AO27","v":0},{"$f":"'1'!AP27","v":0},{"$f":"'1'!AQ27","v":0},{"$f":"'1'!AR27","v":0},{"$f":"'1'!AS27","v":0},{"$f":"'1'!AT27","v":0},{"$f":"SUMPRODUCT(IF($N25=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N25=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'1'!B28","v":"1"},{"$f":"'1'!C28","v":"1.2"},{"$f":"'1'!D28","v":"1.2.2"},{"$f":"'1'!E28","v":0},{"$f":"'1'!F28","v":"1.2.2.4"},{"$f":"'1'!G28","v":"1.2.2.4: RECORD-KEEPING\nRecords of reconciliation with the custodial bank and financial ecosystem partners should be kept for a period determined by regulation or risk assessment, whichever is longer. FATF recommends that records be kept for a minimum of five years, either physically or electronically (or both)."},{"$f":"'1'!H28","v":"GSMA RMT\n(FR.P-07)"},{"$f":"'1'!I28","v":"1.2.2.4.1"},{"$f":"'1'!J28","v":"1.2.2.4.1: Are records of reconciliation with the custodial bank and financial ecosystem partners kept for at least five years?\n"},{"$f":"'1'!K28","v":"1) Reconciliation and Settlement process or policy for financial partners\n - Check that records will be kept for at least five years."},{"$f":"'1'!L28","v":0},{"$f":"'1'!M28","v":"Standard Required"},{"$f":"'1'!N28","v":"Required"},{"$f":"'1'!O28","v":"FinOps"},{"$f":"'1'!P28","v":0},{"$f":"'1'!Q28","v":0},{"$f":"'1'!R28","v":0},{"$f":"'1'!S28","v":0},{"$f":"'1'!T28","v":0},{"$f":"'1'!U28","v":0},{"$f":"'1'!V28","v":0},{"$f":"'1'!W28","v":0},{"$f":"'1'!X28","v":0},{"$f":"'1'!Y28","v":0},{"$f":"'1'!Z28","v":0},{"$f":"'1'!AA28","v":0},{"$f":"'1'!AB28","v":0},{"$f":"'1'!AC28","v":0},{"$f":"'1'!AD28","v":0},{"$f":"'1'!AE28","v":0},{"$f":"'1'!AF28","v":0},{"$f":"'1'!AG28","v":0},{"$f":"'1'!AH28","v":0},{"$f":"'1'!AI28","v":0},{"$f":"'1'!AJ28","v":0},{"$f":"'1'!AK28","v":0},{"$f":"'1'!AL28","v":0},{"$f":"'1'!AM28","v":0},{"$f":"'1'!AN28","v":0},{"$f":"'1'!AO28","v":0},{"$f":"'1'!AP28","v":0},{"$f":"'1'!AQ28","v":0},{"$f":"'1'!AR28","v":0},{"$f":"'1'!AS28","v":0},{"$f":"'1'!AT28","v":0},{"$f":"SUMPRODUCT(IF($N26=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N26=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B5","v":"2"},{"$f":"'2'!C5","v":"2.1"},{"$f":"'2'!D5","v":"2.1.1"},{"$f":"'2'!E5","v":"2.1.1: Providers shall develop effective policies and procedures for Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) compliance"},{"$f":"'2'!F5","v":"2.1.1.1"},{"$f":"'2'!G5","v":"2.1.1.1: AML/CFT POLICY\nProviders should develop a strong AML/CFT policy. The AML/CFT policy should be  reviewed and updated as needed, such as following material changes to the service or regulation. The AML/CFT policy should include:\n\n- Raising Suspicious Activity Reports (SARs) and Suspicious Transaction Reports (STRs) with the relevant authorities in the case of suspected ML/TF (refer to 2.1.1.2).\n- Regular independent audit to evaluate compliance with and efficacy of AML/CFT procedures (refer to 2.1.1.4).\n- Ensuring that changes in business processes and systems are matched by appropriate changes to the AML/CFT controls (refer to 2.2.1).\n- Updating the sub-policies and procedures as needed - such as following changes to the service or regulation (refer to 2.2.1).\n- Logging and monitoring transactions and actions (refer to 2.4.1).\n- Identifying customers by collecting and verifying KYC information (refer to 2.5.1).\n- Implementing transaction and balance limits based on KYC tiers (refer to 2.5.2).\n- Blocking accounts when necessary (refer to 2.5.3).\n- Screening customers, agents, staff and partners (refer to Principle 3).\n- Training staff and agents in AML/CFT (refer to 2.6.1)\n- Monitoring staff and agent compliance with AML/CFT procedures (refer to 2.6.2).\n- Addressing staff and agent AML/CFT violations (refer to 2.6.3)"},{"$f":"'2'!H5","v":"GSMA RMT"},{"$f":"'2'!I5","v":"2.1.1.1.1"},{"$f":"'2'!J5","v":"2.1.1.1.1: Is there documentation that describes the objectives and function of the AML function (i.e. policy or equivalent document) that is reviewed and approved by senior management?\n"},{"$f":"'2'!K5","v":"1) Documentation that describes the objective and function of the AML programme (i.e. policy or equivalent document)\n\n- Check that the document has been approved within the last two years by the current senior manager (Director) who is responsible for the policy."},{"$f":"'2'!L5","v":0},{"$f":"'2'!M5","v":"Urgent Required"},{"$f":"'2'!N5","v":"Required"},{"$f":"'2'!O5","v":"FraudRisk"},{"$f":"'2'!P5","v":0},{"$f":"'2'!Q5","v":0},{"$f":"'2'!R5","v":0},{"$f":"'2'!S5","v":0},{"$f":"'2'!T5","v":0},{"$f":"'2'!U5","v":0},{"$f":"'2'!V5","v":0},{"$f":"'2'!W5","v":0},{"$f":"'2'!X5","v":0},{"$f":"'2'!Y5","v":0},{"$f":"'2'!Z5","v":0},{"$f":"'2'!AA5","v":0},{"$f":"'2'!AB5","v":0},{"$f":"'2'!AC5","v":0},{"$f":"'2'!AD5","v":0},{"$f":"'2'!AE5","v":0},{"$f":"'2'!AF5","v":0},{"$f":"'2'!AG5","v":0},{"$f":"'2'!AH5","v":0},{"$f":"'2'!AI5","v":0},{"$f":"'2'!AJ5","v":0},{"$f":"'2'!AK5","v":0},{"$f":"'2'!AL5","v":0},{"$f":"'2'!AM5","v":0},{"$f":"'2'!AN5","v":0},{"$f":"'2'!AO5","v":0},{"$f":"'2'!AP5","v":0},{"$f":"'2'!AQ5","v":0},{"$f":"'2'!AR5","v":0},{"$f":"'2'!AS5","v":0},{"$f":"'2'!AT5","v":0},{"$f":"SUMPRODUCT(IF($N27=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N27=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B6","v":"2"},{"$f":"'2'!C6","v":"2.1"},{"$f":"'2'!D6","v":"2.1.1"},{"$f":"'2'!E6","v":0},{"$f":"'2'!F6","v":"2.1.1.1"},{"$f":"'2'!G6","v":0},{"$f":"'2'!H6","v":0},{"$f":"'2'!I6","v":"2.1.1.1.2"},{"$f":"'2'!J6","v":"2.1.1.1.2: Is the AML/CFT policy (or equivalent document) reviewed at least every 24 months and updated if needed?\n"},{"$f":"'2'!K6","v":"1) Documentation that describes the objective and function of the AML programme (i.e. policy or equivalent document)\n - Check that the document contains a revision history log and the last revision date is in the last 24 months.\n\n"},{"$f":"'2'!L6","v":0},{"$f":"'2'!M6","v":"Standard Required"},{"$f":"'2'!N6","v":"Required"},{"$f":"'2'!O6","v":"FraudRisk"},{"$f":"'2'!P6","v":0},{"$f":"'2'!Q6","v":0},{"$f":"'2'!R6","v":0},{"$f":"'2'!S6","v":0},{"$f":"'2'!T6","v":0},{"$f":"'2'!U6","v":0},{"$f":"'2'!V6","v":0},{"$f":"'2'!W6","v":0},{"$f":"'2'!X6","v":0},{"$f":"'2'!Y6","v":0},{"$f":"'2'!Z6","v":0},{"$f":"'2'!AA6","v":0},{"$f":"'2'!AB6","v":0},{"$f":"'2'!AC6","v":0},{"$f":"'2'!AD6","v":0},{"$f":"'2'!AE6","v":0},{"$f":"'2'!AF6","v":0},{"$f":"'2'!AG6","v":0},{"$f":"'2'!AH6","v":0},{"$f":"'2'!AI6","v":0},{"$f":"'2'!AJ6","v":0},{"$f":"'2'!AK6","v":0},{"$f":"'2'!AL6","v":0},{"$f":"'2'!AM6","v":0},{"$f":"'2'!AN6","v":0},{"$f":"'2'!AO6","v":0},{"$f":"'2'!AP6","v":0},{"$f":"'2'!AQ6","v":0},{"$f":"'2'!AR6","v":0},{"$f":"'2'!AS6","v":0},{"$f":"'2'!AT6","v":0},{"$f":"SUMPRODUCT(IF($N28=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N28=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B7","v":"2"},{"$f":"'2'!C7","v":"2.1"},{"$f":"'2'!D7","v":"2.1.1"},{"$f":"'2'!E7","v":0},{"$f":"'2'!F7","v":"2.1.1.2"},{"$f":"'2'!G7","v":"2.1.1.2: AML/CFT PROCESS\nProviders should implement a suspicious activity management process for addressing suspected ML/TF activity. This process should provide clear guidelines about appropriate internal actions to be taken when suspicious patterns are detected, such as:\n- further investigation and monitoring;\n- account blocking.\n\nThe risk of each suspicious activity should be evaluated, and investigating higher-risk suspicious activities should be prioritised.\n\nAgents and employees should be provided with a mechanism to report suspicious activity, the details of which should be communicated to them. [This could be the same channel as used for reporting fraud, security incidents and data privacy breaches] \n\nConfirmed cases of ML/TF must be reported to the appropriate authorities via a formal Suspicious Activity Report (SAR) and/or Suspicious Transaction Report (STR). Providers should engage with relevant law enforcement agencies to facilitate reporting and/or investigation of mobile money-related criminal offences.\n"},{"$f":"'2'!H7","v":"GSMA RMT"},{"$f":"'2'!I7","v":"2.1.1.2.1"},{"$f":"'2'!J7","v":"2.1.1.2.1: Has a suspicious activity management process been defined for dealing with suspected ML/TF activities?\n"},{"$f":"'2'!K7","v":"1) Suspicious activity management process for identifying, investigating, actioning and reporting suspected ML/TF activity.\n- Check that the process has been documented."},{"$f":"'2'!L7","v":0},{"$f":"'2'!M7","v":"Urgent Required"},{"$f":"'2'!N7","v":"Required"},{"$f":"'2'!O7","v":"FraudRisk"},{"$f":"'2'!P7","v":0},{"$f":"'2'!Q7","v":0},{"$f":"'2'!R7","v":0},{"$f":"'2'!S7","v":0},{"$f":"'2'!T7","v":0},{"$f":"'2'!U7","v":0},{"$f":"'2'!V7","v":0},{"$f":"'2'!W7","v":0},{"$f":"'2'!X7","v":0},{"$f":"'2'!Y7","v":0},{"$f":"'2'!Z7","v":0},{"$f":"'2'!AA7","v":0},{"$f":"'2'!AB7","v":0},{"$f":"'2'!AC7","v":0},{"$f":"'2'!AD7","v":0},{"$f":"'2'!AE7","v":0},{"$f":"'2'!AF7","v":0},{"$f":"'2'!AG7","v":0},{"$f":"'2'!AH7","v":0},{"$f":"'2'!AI7","v":0},{"$f":"'2'!AJ7","v":0},{"$f":"'2'!AK7","v":0},{"$f":"'2'!AL7","v":0},{"$f":"'2'!AM7","v":0},{"$f":"'2'!AN7","v":0},{"$f":"'2'!AO7","v":0},{"$f":"'2'!AP7","v":0},{"$f":"'2'!AQ7","v":0},{"$f":"'2'!AR7","v":0},{"$f":"'2'!AS7","v":0},{"$f":"'2'!AT7","v":0},{"$f":"SUMPRODUCT(IF($N29=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N29=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B8","v":"2"},{"$f":"'2'!C8","v":"2.1"},{"$f":"'2'!D8","v":"2.1.1"},{"$f":"'2'!E8","v":""},{"$f":"'2'!F8","v":"2.1.1.2"},{"$f":"'2'!G8","v":0},{"$f":"'2'!H8","v":0},{"$f":"'2'!I8","v":"2.1.1.2.2"},{"$f":"'2'!J8","v":"2.1.1.2.2: Does the suspicious activity management process provide clear guidelines about appropriate actions to be taken (e.g. further investigation and monitoring, account blocking)?\n"},{"$f":"'2'!K8","v":"1) Suspicious activity management process for identifying, investigating, actioning and reporting suspected ML/TF activity.\n\n- Check that this process includes:\n     1) How the report is received by the AML Unit\n     2) What additional information is obtained on the case\n     3) Who is responsible for the investigation\n     4) What actions must been taken for confirmed, not confirmed and inconclusive cases\n     5) Who approves the closure of the case\n"},{"$f":"'2'!L8","v":0},{"$f":"'2'!M8","v":"Urgent Required"},{"$f":"'2'!N8","v":"Required"},{"$f":"'2'!O8","v":"FraudRisk"},{"$f":"'2'!P8","v":0},{"$f":"'2'!Q8","v":0},{"$f":"'2'!R8","v":0},{"$f":"'2'!S8","v":0},{"$f":"'2'!T8","v":0},{"$f":"'2'!U8","v":0},{"$f":"'2'!V8","v":0},{"$f":"'2'!W8","v":0},{"$f":"'2'!X8","v":0},{"$f":"'2'!Y8","v":0},{"$f":"'2'!Z8","v":0},{"$f":"'2'!AA8","v":0},{"$f":"'2'!AB8","v":0},{"$f":"'2'!AC8","v":0},{"$f":"'2'!AD8","v":0},{"$f":"'2'!AE8","v":0},{"$f":"'2'!AF8","v":0},{"$f":"'2'!AG8","v":0},{"$f":"'2'!AH8","v":0},{"$f":"'2'!AI8","v":0},{"$f":"'2'!AJ8","v":0},{"$f":"'2'!AK8","v":0},{"$f":"'2'!AL8","v":0},{"$f":"'2'!AM8","v":0},{"$f":"'2'!AN8","v":0},{"$f":"'2'!AO8","v":0},{"$f":"'2'!AP8","v":0},{"$f":"'2'!AQ8","v":0},{"$f":"'2'!AR8","v":0},{"$f":"'2'!AS8","v":0},{"$f":"'2'!AT8","v":0},{"$f":"SUMPRODUCT(IF($N30=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N30=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B9","v":"2"},{"$f":"'2'!C9","v":"2.1"},{"$f":"'2'!D9","v":"2.1.1"},{"$f":"'2'!E9","v":0},{"$f":"'2'!F9","v":"2.1.1.2"},{"$f":"'2'!G9","v":0},{"$f":"'2'!H9","v":0},{"$f":"'2'!I9","v":"2.1.1.2.3"},{"$f":"'2'!J9","v":"2.1.1.2.3: Does the suspicious activity management process clearly define how Suspicious Activity Reports (SARs) and/or Suspicious Transaction Reports (STR) should be raised with the relevant authorities in the case of suspected ML/TF?\n"},{"$f":"'2'!K9","v":"1) Documented suspicious activity management process for identifying, investigating, actioning and reporting suspected ML/TF activity.\n\n- Check that this process includes:\n     1) Who reports the SAR\n     2) Which organisation the SAR is sent to (local FIU)\n     3) How the report is submitted\n     4) Time lines for issuing report (if required)\n"},{"$f":"'2'!L9","v":0},{"$f":"'2'!M9","v":"Urgent Required"},{"$f":"'2'!N9","v":"Required"},{"$f":"'2'!O9","v":"FraudRisk"},{"$f":"'2'!P9","v":0},{"$f":"'2'!Q9","v":0},{"$f":"'2'!R9","v":0},{"$f":"'2'!S9","v":0},{"$f":"'2'!T9","v":0},{"$f":"'2'!U9","v":0},{"$f":"'2'!V9","v":0},{"$f":"'2'!W9","v":0},{"$f":"'2'!X9","v":0},{"$f":"'2'!Y9","v":0},{"$f":"'2'!Z9","v":0},{"$f":"'2'!AA9","v":0},{"$f":"'2'!AB9","v":0},{"$f":"'2'!AC9","v":0},{"$f":"'2'!AD9","v":0},{"$f":"'2'!AE9","v":0},{"$f":"'2'!AF9","v":0},{"$f":"'2'!AG9","v":0},{"$f":"'2'!AH9","v":0},{"$f":"'2'!AI9","v":0},{"$f":"'2'!AJ9","v":0},{"$f":"'2'!AK9","v":0},{"$f":"'2'!AL9","v":0},{"$f":"'2'!AM9","v":0},{"$f":"'2'!AN9","v":0},{"$f":"'2'!AO9","v":0},{"$f":"'2'!AP9","v":0},{"$f":"'2'!AQ9","v":0},{"$f":"'2'!AR9","v":0},{"$f":"'2'!AS9","v":0},{"$f":"'2'!AT9","v":0},{"$f":"SUMPRODUCT(IF($N31=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N31=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B10","v":"2"},{"$f":"'2'!C10","v":"2.1"},{"$f":"'2'!D10","v":"2.1.1"},{"$f":"'2'!E10","v":""},{"$f":"'2'!F10","v":"2.1.1.2"},{"$f":"'2'!G10","v":0},{"$f":"'2'!H10","v":0},{"$f":"'2'!I10","v":"2.1.1.2.4"},{"$f":"'2'!J10","v":"2.1.1.2.4: Is there a mechanism for agents and employees to report suspicious activity (ML,TF), and are they made aware of this reporting channel? \n[This could be the same channel as used for reporting fraud, security incidents and data privacy breaches]\n"},{"$f":"'2'!K10","v":"1) Documented mechanism for agents and employees to report suspicious activities (e.g. phone line).\n- Check the reporting channel is available to all agents and employees by reviewing the processes.\n- Check that the suspicious activity reporting channel is practical and availed to all.\n\n2) Documentation showing how agents and staff are made aware of the suspicious activity reporting channel (e.g. training material, emails. SMS broadcasts, posters, agent handbook, awareness campaign).\n- Check the staff and agents have been made aware of the suspicious activity reporting channel and their responsibility to report suspicions.\n"},{"$f":"'2'!L10","v":0},{"$f":"'2'!M10","v":"Urgent Required"},{"$f":"'2'!N10","v":"Required"},{"$f":"'2'!O10","v":"FraudRisk"},{"$f":"'2'!P10","v":0},{"$f":"'2'!Q10","v":0},{"$f":"'2'!R10","v":0},{"$f":"'2'!S10","v":0},{"$f":"'2'!T10","v":0},{"$f":"'2'!U10","v":0},{"$f":"'2'!V10","v":0},{"$f":"'2'!W10","v":0},{"$f":"'2'!X10","v":0},{"$f":"'2'!Y10","v":0},{"$f":"'2'!Z10","v":0},{"$f":"'2'!AA10","v":0},{"$f":"'2'!AB10","v":0},{"$f":"'2'!AC10","v":0},{"$f":"'2'!AD10","v":0},{"$f":"'2'!AE10","v":0},{"$f":"'2'!AF10","v":0},{"$f":"'2'!AG10","v":0},{"$f":"'2'!AH10","v":0},{"$f":"'2'!AI10","v":0},{"$f":"'2'!AJ10","v":0},{"$f":"'2'!AK10","v":0},{"$f":"'2'!AL10","v":0},{"$f":"'2'!AM10","v":0},{"$f":"'2'!AN10","v":0},{"$f":"'2'!AO10","v":0},{"$f":"'2'!AP10","v":0},{"$f":"'2'!AQ10","v":0},{"$f":"'2'!AR10","v":0},{"$f":"'2'!AS10","v":0},{"$f":"'2'!AT10","v":0},{"$f":"SUMPRODUCT(IF($N32=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N32=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B11","v":"2"},{"$f":"'2'!C11","v":"2.1"},{"$f":"'2'!D11","v":"2.1.1"},{"$f":"'2'!E11","v":""},{"$f":"'2'!F11","v":"2.1.1.3"},{"$f":"'2'!G11","v":"2.1.1.3: AUDIT OF AML/CFT FUNCTION\nProviders should carry out an independent audit every two years to evaluate efficacy of AML/CFT procedures. Auditors could be internal and/or external, provided that they are independent.\n\nThe findings of the audit should be prioritized appropriately. The AML/CFT manager should ensure that the recommendations are implemented promptly."},{"$f":"'2'!H11","v":"GSMA RMT"},{"$f":"'2'!I11","v":"2.1.1.3.1"},{"$f":"'2'!J11","v":"2.1.1.3.1: Is a regular independent audit carried out (at least every two years) to evaluate efficacy of AML/CFT procedures?\n"},{"$f":"'2'!K11","v":"1) Most recent AML/CFT audit report (header page)\n- Check the date of the audit is within the last two years.\n- Check that the audit was carried out by either the providers own internal audit function, or a suitable external body.\n\n2) AML/CFT audit plan or process - this is suitable evidence if the provider has been operating for less than two years.\n- Check that the plan shows an AML/CFT audit planned within two years of the launch of the mobile money service.\n- Check that the audit will be carried out by either the providers own internal audit function, or a suitable external body."},{"$f":"'2'!L11","v":0},{"$f":"'2'!M11","v":"Urgent Required"},{"$f":"'2'!N11","v":"Required"},{"$f":"'2'!O11","v":"FraudRisk"},{"$f":"'2'!P11","v":0},{"$f":"'2'!Q11","v":0},{"$f":"'2'!R11","v":0},{"$f":"'2'!S11","v":0},{"$f":"'2'!T11","v":0},{"$f":"'2'!U11","v":0},{"$f":"'2'!V11","v":0},{"$f":"'2'!W11","v":0},{"$f":"'2'!X11","v":0},{"$f":"'2'!Y11","v":0},{"$f":"'2'!Z11","v":0},{"$f":"'2'!AA11","v":0},{"$f":"'2'!AB11","v":0},{"$f":"'2'!AC11","v":0},{"$f":"'2'!AD11","v":0},{"$f":"'2'!AE11","v":0},{"$f":"'2'!AF11","v":0},{"$f":"'2'!AG11","v":0},{"$f":"'2'!AH11","v":0},{"$f":"'2'!AI11","v":0},{"$f":"'2'!AJ11","v":0},{"$f":"'2'!AK11","v":0},{"$f":"'2'!AL11","v":0},{"$f":"'2'!AM11","v":0},{"$f":"'2'!AN11","v":0},{"$f":"'2'!AO11","v":0},{"$f":"'2'!AP11","v":0},{"$f":"'2'!AQ11","v":0},{"$f":"'2'!AR11","v":0},{"$f":"'2'!AS11","v":0},{"$f":"'2'!AT11","v":0},{"$f":"SUMPRODUCT(IF($N33=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N33=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B12","v":"2"},{"$f":"'2'!C12","v":"2.1"},{"$f":"'2'!D12","v":"2.1.1"},{"$f":"'2'!E12","v":""},{"$f":"'2'!F12","v":"2.1.1.3"},{"$f":"'2'!G12","v":0},{"$f":"'2'!H12","v":0},{"$f":"'2'!I12","v":"2.1.1.3.2"},{"$f":"'2'!J12","v":"2.1.1.3.2: Are audit findings prioritized, implemented and reviewed, with supervision from AML/CFT manager?\n"},{"$f":"'2'!K12","v":"1) Most recent  AML/CFT audit report\n- Check that agreed actions for audit findings have been prioritised and implemented.\n\n2) AML/CFT audit plan or process - this is suitable evidence if the provider is unwilling to share contents of audit report.\n- Check that the MLRO has access to all the reports and actions updates.\n- Check that there is a process to prioritise and implement all audit actions and findings."},{"$f":"'2'!L12","v":0},{"$f":"'2'!M12","v":"Urgent Required"},{"$f":"'2'!N12","v":"Required"},{"$f":"'2'!O12","v":"FraudRisk"},{"$f":"'2'!P12","v":0},{"$f":"'2'!Q12","v":0},{"$f":"'2'!R12","v":0},{"$f":"'2'!S12","v":0},{"$f":"'2'!T12","v":0},{"$f":"'2'!U12","v":0},{"$f":"'2'!V12","v":0},{"$f":"'2'!W12","v":0},{"$f":"'2'!X12","v":0},{"$f":"'2'!Y12","v":0},{"$f":"'2'!Z12","v":0},{"$f":"'2'!AA12","v":0},{"$f":"'2'!AB12","v":0},{"$f":"'2'!AC12","v":0},{"$f":"'2'!AD12","v":0},{"$f":"'2'!AE12","v":0},{"$f":"'2'!AF12","v":0},{"$f":"'2'!AG12","v":0},{"$f":"'2'!AH12","v":0},{"$f":"'2'!AI12","v":0},{"$f":"'2'!AJ12","v":0},{"$f":"'2'!AK12","v":0},{"$f":"'2'!AL12","v":0},{"$f":"'2'!AM12","v":0},{"$f":"'2'!AN12","v":0},{"$f":"'2'!AO12","v":0},{"$f":"'2'!AP12","v":0},{"$f":"'2'!AQ12","v":0},{"$f":"'2'!AR12","v":0},{"$f":"'2'!AS12","v":0},{"$f":"'2'!AT12","v":0},{"$f":"SUMPRODUCT(IF($N34=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N34=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B13","v":"2"},{"$f":"'2'!C13","v":"2.1"},{"$f":"'2'!D13","v":"2.1.1"},{"$f":"'2'!E13","v":""},{"$f":"'2'!F13","v":"2.1.1.4"},{"$f":"'2'!G13","v":"2.1.1.4: AML/CFT RECORDS\nRecords relevant to AML/CFT should be kept for a period determined by regulation or risk assessment, whichever is longer. FATF recommends that records be kept for a minimum of five years, either physically or electronically (or both). The following records should be kept as a minimum:\n- Customer/agent identification records;\n- Transaction records of all successful and failed transactions (refer to 5.3.6.2 - audit trails);\n- Suspicious activity reports (internal reports and external SARs/ STRs);\n- Policies and procedures, including previous versions of documentation with dates."},{"$f":"'2'!H13","v":"GSMA RMT (FR.P-07)"},{"$f":"'2'!I13","v":"2.1.1.4.1"},{"$f":"'2'!J13","v":"2.1.1.4.1: Have AML/CFT record-keeping processes and system functions been implemented?\n"},{"$f":"'2'!K13","v":"1) Record management process/documentation for AML/CFT records\n- Check that the processes have been implemented.\n"},{"$f":"'2'!L13","v":0},{"$f":"'2'!M13","v":"Standard Required"},{"$f":"'2'!N13","v":"Required"},{"$f":"'2'!O13","v":"FraudRisk"},{"$f":"'2'!P13","v":0},{"$f":"'2'!Q13","v":0},{"$f":"'2'!R13","v":0},{"$f":"'2'!S13","v":0},{"$f":"'2'!T13","v":0},{"$f":"'2'!U13","v":0},{"$f":"'2'!V13","v":0},{"$f":"'2'!W13","v":0},{"$f":"'2'!X13","v":0},{"$f":"'2'!Y13","v":0},{"$f":"'2'!Z13","v":0},{"$f":"'2'!AA13","v":0},{"$f":"'2'!AB13","v":0},{"$f":"'2'!AC13","v":0},{"$f":"'2'!AD13","v":0},{"$f":"'2'!AE13","v":0},{"$f":"'2'!AF13","v":0},{"$f":"'2'!AG13","v":0},{"$f":"'2'!AH13","v":0},{"$f":"'2'!AI13","v":0},{"$f":"'2'!AJ13","v":0},{"$f":"'2'!AK13","v":0},{"$f":"'2'!AL13","v":0},{"$f":"'2'!AM13","v":0},{"$f":"'2'!AN13","v":0},{"$f":"'2'!AO13","v":0},{"$f":"'2'!AP13","v":0},{"$f":"'2'!AQ13","v":0},{"$f":"'2'!AR13","v":0},{"$f":"'2'!AS13","v":0},{"$f":"'2'!AT13","v":0},{"$f":"SUMPRODUCT(IF($N35=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N35=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B14","v":"2"},{"$f":"'2'!C14","v":"2.1"},{"$f":"'2'!D14","v":"2.1.1"},{"$f":"'2'!E14","v":""},{"$f":"'2'!F14","v":"2.1.1.4"},{"$f":"'2'!G14","v":0},{"$f":"'2'!H14","v":0},{"$f":"'2'!I14","v":"2.1.1.4.2"},{"$f":"'2'!J14","v":"2.1.1.4.2: Are all suspicious activity reports being kept for both internal and externally-reported SARs/ STRs?\n"},{"$f":"'2'!K14","v":"1) Suspicious activity management record log\n- Check that internal and externally reported SARs/STRs are stored securely and accessible to the MLRO.\n(Note: there may be providers that have legitimately not received any SARs/STRs - in which case the proposed process should be checked)."},{"$f":"'2'!L14","v":0},{"$f":"'2'!M14","v":"Urgent Required"},{"$f":"'2'!N14","v":"Required"},{"$f":"'2'!O14","v":"FraudRisk"},{"$f":"'2'!P14","v":0},{"$f":"'2'!Q14","v":0},{"$f":"'2'!R14","v":0},{"$f":"'2'!S14","v":0},{"$f":"'2'!T14","v":0},{"$f":"'2'!U14","v":0},{"$f":"'2'!V14","v":0},{"$f":"'2'!W14","v":0},{"$f":"'2'!X14","v":0},{"$f":"'2'!Y14","v":0},{"$f":"'2'!Z14","v":0},{"$f":"'2'!AA14","v":0},{"$f":"'2'!AB14","v":0},{"$f":"'2'!AC14","v":0},{"$f":"'2'!AD14","v":0},{"$f":"'2'!AE14","v":0},{"$f":"'2'!AF14","v":0},{"$f":"'2'!AG14","v":0},{"$f":"'2'!AH14","v":0},{"$f":"'2'!AI14","v":0},{"$f":"'2'!AJ14","v":0},{"$f":"'2'!AK14","v":0},{"$f":"'2'!AL14","v":0},{"$f":"'2'!AM14","v":0},{"$f":"'2'!AN14","v":0},{"$f":"'2'!AO14","v":0},{"$f":"'2'!AP14","v":0},{"$f":"'2'!AQ14","v":0},{"$f":"'2'!AR14","v":0},{"$f":"'2'!AS14","v":0},{"$f":"'2'!AT14","v":0},{"$f":"SUMPRODUCT(IF($N36=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N36=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B15","v":"2"},{"$f":"'2'!C15","v":"2.1"},{"$f":"'2'!D15","v":"2.1.1"},{"$f":"'2'!E15","v":""},{"$f":"'2'!F15","v":"2.1.1.4"},{"$f":"'2'!G15","v":0},{"$f":"'2'!H15","v":0},{"$f":"'2'!I15","v":"2.1.1.4.3"},{"$f":"'2'!J15","v":"2.1.1.4.3: Are copies of all current and prior AML/CFT-related policies and processes being kept, including dates where they were in operation?\n"},{"$f":"'2'!K15","v":0},{"$f":"'2'!L15","v":0},{"$f":"'2'!M15","v":"Recommended"},{"$f":"'2'!N15","v":"Recommended"},{"$f":"'2'!O15","v":"FraudRisk"},{"$f":"'2'!P15","v":0},{"$f":"'2'!Q15","v":0},{"$f":"'2'!R15","v":0},{"$f":"'2'!S15","v":0},{"$f":"'2'!T15","v":0},{"$f":"'2'!U15","v":0},{"$f":"'2'!V15","v":0},{"$f":"'2'!W15","v":0},{"$f":"'2'!X15","v":0},{"$f":"'2'!Y15","v":0},{"$f":"'2'!Z15","v":0},{"$f":"'2'!AA15","v":0},{"$f":"'2'!AB15","v":0},{"$f":"'2'!AC15","v":0},{"$f":"'2'!AD15","v":0},{"$f":"'2'!AE15","v":0},{"$f":"'2'!AF15","v":0},{"$f":"'2'!AG15","v":0},{"$f":"'2'!AH15","v":0},{"$f":"'2'!AI15","v":0},{"$f":"'2'!AJ15","v":0},{"$f":"'2'!AK15","v":0},{"$f":"'2'!AL15","v":0},{"$f":"'2'!AM15","v":0},{"$f":"'2'!AN15","v":0},{"$f":"'2'!AO15","v":0},{"$f":"'2'!AP15","v":0},{"$f":"'2'!AQ15","v":0},{"$f":"'2'!AR15","v":0},{"$f":"'2'!AS15","v":0},{"$f":"'2'!AT15","v":0},{"$f":"SUMPRODUCT(IF($N37=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N37=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B17","v":"2"},{"$f":"'2'!C17","v":"2.2"},{"$f":"'2'!D17","v":"2.2.1"},{"$f":"'2'!E17","v":"2.2.1: Senior management shall demonstrate their commitment to AML/CFT compliance through proper oversight"},{"$f":"'2'!F17","v":"2.2.1.1"},{"$f":"'2'!G17","v":"2.2.1.1: AML/CFT COMPLIANCE DEPARTMENT\nSenior management should establish a compliance function that should fulfil the following criteria:\n- be independent of all operational and business functions; \n- report directly to senior management; \n- have sufficient management seniority and authority to enforce AML/CFT policies (able to influence functional managers to make necessary changes);\n- be sufficiently funded to implement effective AML/CFT procedures."},{"$f":"'2'!H17","v":"GSMA RMT (FR.O-02\nFR.O-03)"},{"$f":"'2'!I17","v":"2.2.1.1.1"},{"$f":"'2'!J17","v":"2.2.1.1.1: Has an AML/CFT compliance function been established?\n"},{"$f":"'2'!K17","v":"1) AML/CFT Organisation chart \n- Check the organisation chart contains the MLRO and support staff.\n\n2) Documentation that describes the objective and function of the AML programme (i.e. policy or equivalent document)\n- Check that provison has been made for an MLRO and support staff  \n(note: this might be contained in the roles and responsibilites section)."},{"$f":"'2'!L17","v":0},{"$f":"'2'!M17","v":"Urgent Required"},{"$f":"'2'!N17","v":"Required"},{"$f":"'2'!O17","v":"FraudRisk"},{"$f":"'2'!P17","v":0},{"$f":"'2'!Q17","v":0},{"$f":"'2'!R17","v":0},{"$f":"'2'!S17","v":0},{"$f":"'2'!T17","v":0},{"$f":"'2'!U17","v":0},{"$f":"'2'!V17","v":0},{"$f":"'2'!W17","v":0},{"$f":"'2'!X17","v":0},{"$f":"'2'!Y17","v":0},{"$f":"'2'!Z17","v":0},{"$f":"'2'!AA17","v":0},{"$f":"'2'!AB17","v":0},{"$f":"'2'!AC17","v":0},{"$f":"'2'!AD17","v":0},{"$f":"'2'!AE17","v":0},{"$f":"'2'!AF17","v":0},{"$f":"'2'!AG17","v":0},{"$f":"'2'!AH17","v":0},{"$f":"'2'!AI17","v":0},{"$f":"'2'!AJ17","v":0},{"$f":"'2'!AK17","v":0},{"$f":"'2'!AL17","v":0},{"$f":"'2'!AM17","v":0},{"$f":"'2'!AN17","v":0},{"$f":"'2'!AO17","v":0},{"$f":"'2'!AP17","v":0},{"$f":"'2'!AQ17","v":0},{"$f":"'2'!AR17","v":0},{"$f":"'2'!AS17","v":0},{"$f":"'2'!AT17","v":0},{"$f":"SUMPRODUCT(IF($N38=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N38=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B18","v":"2"},{"$f":"'2'!C18","v":"2.2"},{"$f":"'2'!D18","v":"2.2.1"},{"$f":"'2'!E18","v":0},{"$f":"'2'!F18","v":"2.2.1.1"},{"$f":"'2'!G18","v":0},{"$f":"'2'!H18","v":0},{"$f":"'2'!I18","v":"2.2.1.1.2"},{"$f":"'2'!J18","v":"2.2.1.1.2: Is the AML/CFT compliance function independent of all operational and business functions and does it report directly to senior management?\n"},{"$f":"'2'!K18","v":"1)  AML/CFT Organisation chart \n- Check the organisation chart to see that the reporting line is to a suitably 'independent' directorate.\n- Check the reporting line of the MLRO/AML Officer is to a senior manager (e.g. Director level)"},{"$f":"'2'!L18","v":0},{"$f":"'2'!M18","v":"Standard Required"},{"$f":"'2'!N18","v":"Required"},{"$f":"'2'!O18","v":"FraudRisk"},{"$f":"'2'!P18","v":0},{"$f":"'2'!Q18","v":0},{"$f":"'2'!R18","v":0},{"$f":"'2'!S18","v":0},{"$f":"'2'!T18","v":0},{"$f":"'2'!U18","v":0},{"$f":"'2'!V18","v":0},{"$f":"'2'!W18","v":0},{"$f":"'2'!X18","v":0},{"$f":"'2'!Y18","v":0},{"$f":"'2'!Z18","v":0},{"$f":"'2'!AA18","v":0},{"$f":"'2'!AB18","v":0},{"$f":"'2'!AC18","v":0},{"$f":"'2'!AD18","v":0},{"$f":"'2'!AE18","v":0},{"$f":"'2'!AF18","v":0},{"$f":"'2'!AG18","v":0},{"$f":"'2'!AH18","v":0},{"$f":"'2'!AI18","v":0},{"$f":"'2'!AJ18","v":0},{"$f":"'2'!AK18","v":0},{"$f":"'2'!AL18","v":0},{"$f":"'2'!AM18","v":0},{"$f":"'2'!AN18","v":0},{"$f":"'2'!AO18","v":0},{"$f":"'2'!AP18","v":0},{"$f":"'2'!AQ18","v":0},{"$f":"'2'!AR18","v":0},{"$f":"'2'!AS18","v":0},{"$f":"'2'!AT18","v":0},{"$f":"SUMPRODUCT(IF($N39=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N39=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B19","v":"2"},{"$f":"'2'!C19","v":"2.2"},{"$f":"'2'!D19","v":"2.2.1"},{"$f":"'2'!E19","v":0},{"$f":"'2'!F19","v":"2.2.1.1"},{"$f":"'2'!G19","v":0},{"$f":"'2'!H19","v":0},{"$f":"'2'!I19","v":"2.2.1.1.3"},{"$f":"'2'!J19","v":"2.2.1.1.3: Does the Head of AML/CFT compliance have sufficient management seniority and authority to enforce AML/CFT policies (able to influence functional managers to make necessary changes)?\n"},{"$f":"'2'!K19","v":"1)  Role description for Money Laundering Reporting Officer (MLRO) or equivalent\n- Check the banding/grade/rank is sufficiently senior to able to influence functional managers.\n\n2) Documentation that describes the objective and function of the AML programme (i.e. policy or equivalent document)\n- Check that the documents give the MLRO/AML officer the authority to implement effective AML/CFT policies, procedures and systems."},{"$f":"'2'!L19","v":0},{"$f":"'2'!M19","v":"Urgent Required"},{"$f":"'2'!N19","v":"Required"},{"$f":"'2'!O19","v":"FraudRisk"},{"$f":"'2'!P19","v":0},{"$f":"'2'!Q19","v":0},{"$f":"'2'!R19","v":0},{"$f":"'2'!S19","v":0},{"$f":"'2'!T19","v":0},{"$f":"'2'!U19","v":0},{"$f":"'2'!V19","v":0},{"$f":"'2'!W19","v":0},{"$f":"'2'!X19","v":0},{"$f":"'2'!Y19","v":0},{"$f":"'2'!Z19","v":0},{"$f":"'2'!AA19","v":0},{"$f":"'2'!AB19","v":0},{"$f":"'2'!AC19","v":0},{"$f":"'2'!AD19","v":0},{"$f":"'2'!AE19","v":0},{"$f":"'2'!AF19","v":0},{"$f":"'2'!AG19","v":0},{"$f":"'2'!AH19","v":0},{"$f":"'2'!AI19","v":0},{"$f":"'2'!AJ19","v":0},{"$f":"'2'!AK19","v":0},{"$f":"'2'!AL19","v":0},{"$f":"'2'!AM19","v":0},{"$f":"'2'!AN19","v":0},{"$f":"'2'!AO19","v":0},{"$f":"'2'!AP19","v":0},{"$f":"'2'!AQ19","v":0},{"$f":"'2'!AR19","v":0},{"$f":"'2'!AS19","v":0},{"$f":"'2'!AT19","v":0},{"$f":"SUMPRODUCT(IF($N40=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N40=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B20","v":"2"},{"$f":"'2'!C20","v":"2.2"},{"$f":"'2'!D20","v":"2.2.1"},{"$f":"'2'!E20","v":0},{"$f":"'2'!F20","v":"2.2.1.1"},{"$f":"'2'!G20","v":0},{"$f":"'2'!H20","v":0},{"$f":"'2'!I20","v":"2.2.1.1.4"},{"$f":"'2'!J20","v":"2.2.1.1.4: Is the AML/CFT compliance department sufficiently funded to implement effective AML/CFT policies, procedures and systems (as described in this toolkit)?\n"},{"$f":"'2'!K20","v":"1)  AML/CFT Organisation chart \n- Check AML team head count is sufficient to carry out the operational requirements\n(Note 1: The size of the AML team should be proportionate to the size, complexity and risk profile of the business.)\n(Note 2: Head count might sit in different teams, or shared services centres - these staff should be included when assessing head count)\n(Note 3: assessment of sufficient head count might also be made by reviewing the MLRO's (or equivalent) assessment of resourcing)"},{"$f":"'2'!L20","v":0},{"$f":"'2'!M20","v":"Urgent Required"},{"$f":"'2'!N20","v":"Required"},{"$f":"'2'!O20","v":"FraudRisk"},{"$f":"'2'!P20","v":0},{"$f":"'2'!Q20","v":0},{"$f":"'2'!R20","v":0},{"$f":"'2'!S20","v":0},{"$f":"'2'!T20","v":0},{"$f":"'2'!U20","v":0},{"$f":"'2'!V20","v":0},{"$f":"'2'!W20","v":0},{"$f":"'2'!X20","v":0},{"$f":"'2'!Y20","v":0},{"$f":"'2'!Z20","v":0},{"$f":"'2'!AA20","v":0},{"$f":"'2'!AB20","v":0},{"$f":"'2'!AC20","v":0},{"$f":"'2'!AD20","v":0},{"$f":"'2'!AE20","v":0},{"$f":"'2'!AF20","v":0},{"$f":"'2'!AG20","v":0},{"$f":"'2'!AH20","v":0},{"$f":"'2'!AI20","v":0},{"$f":"'2'!AJ20","v":0},{"$f":"'2'!AK20","v":0},{"$f":"'2'!AL20","v":0},{"$f":"'2'!AM20","v":0},{"$f":"'2'!AN20","v":0},{"$f":"'2'!AO20","v":0},{"$f":"'2'!AP20","v":0},{"$f":"'2'!AQ20","v":0},{"$f":"'2'!AR20","v":0},{"$f":"'2'!AS20","v":0},{"$f":"'2'!AT20","v":0},{"$f":"SUMPRODUCT(IF($N41=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N41=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B21","v":"2"},{"$f":"'2'!C21","v":"2.2"},{"$f":"'2'!D21","v":"2.2.1"},{"$f":"'2'!E21","v":""},{"$f":"'2'!F21","v":"2.2.1.2"},{"$f":"'2'!G21","v":"2.2.1.2: AML/CFT COMPLIANCE DEPARTMENT REVIEWS\nSenior management should regularly review the AML/CFT compliance function to ensure its effectiveness."},{"$f":"'2'!H21","v":"HK AML"},{"$f":"'2'!I21","v":"2.2.1.2.1"},{"$f":"'2'!J21","v":"2.2.1.2.1: Does senior management regularly review the AML/CFT compliance function to ensure its effectiveness?\n"},{"$f":"'2'!K21","v":"1) Most recent AML/CFT internal control report, annual MLRO report, or AML/CFT review process.\n- Check senior management regularly review the AML/CFT compliance function.\n\n"},{"$f":"'2'!L21","v":0},{"$f":"'2'!M21","v":"Urgent Required"},{"$f":"'2'!N21","v":"Required"},{"$f":"'2'!O21","v":"FraudRisk"},{"$f":"'2'!P21","v":0},{"$f":"'2'!Q21","v":0},{"$f":"'2'!R21","v":0},{"$f":"'2'!S21","v":0},{"$f":"'2'!T21","v":0},{"$f":"'2'!U21","v":0},{"$f":"'2'!V21","v":0},{"$f":"'2'!W21","v":0},{"$f":"'2'!X21","v":0},{"$f":"'2'!Y21","v":0},{"$f":"'2'!Z21","v":0},{"$f":"'2'!AA21","v":0},{"$f":"'2'!AB21","v":0},{"$f":"'2'!AC21","v":0},{"$f":"'2'!AD21","v":0},{"$f":"'2'!AE21","v":0},{"$f":"'2'!AF21","v":0},{"$f":"'2'!AG21","v":0},{"$f":"'2'!AH21","v":0},{"$f":"'2'!AI21","v":0},{"$f":"'2'!AJ21","v":0},{"$f":"'2'!AK21","v":0},{"$f":"'2'!AL21","v":0},{"$f":"'2'!AM21","v":0},{"$f":"'2'!AN21","v":0},{"$f":"'2'!AO21","v":0},{"$f":"'2'!AP21","v":0},{"$f":"'2'!AQ21","v":0},{"$f":"'2'!AR21","v":0},{"$f":"'2'!AS21","v":0},{"$f":"'2'!AT21","v":0},{"$f":"SUMPRODUCT(IF($N42=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N42=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B22","v":"2"},{"$f":"'2'!C22","v":"2.2"},{"$f":"'2'!D22","v":"2.2.1"},{"$f":"'2'!E22","v":""},{"$f":"'2'!F22","v":"2.2.1.2"},{"$f":"'2'!G22","v":0},{"$f":"'2'!H22","v":0},{"$f":"'2'!I22","v":"2.2.1.2.2"},{"$f":"'2'!J22","v":"2.2.1.2.2: In its most recent review, did senior management indicate satisfaction with the effectiveness of the AML/CFT function?\n"},{"$f":"'2'!K22","v":"1) Most recent AML/CFT internal control report, annual MLRO report, or AML/CFT review process.\n- Check senior management have confirmed receipt of there report, approved the contents and /or given instructions to reduce the residual risks."},{"$f":"'2'!L22","v":0},{"$f":"'2'!M22","v":"Standard Required"},{"$f":"'2'!N22","v":"Required"},{"$f":"'2'!O22","v":"FraudRisk"},{"$f":"'2'!P22","v":0},{"$f":"'2'!Q22","v":0},{"$f":"'2'!R22","v":0},{"$f":"'2'!S22","v":0},{"$f":"'2'!T22","v":0},{"$f":"'2'!U22","v":0},{"$f":"'2'!V22","v":0},{"$f":"'2'!W22","v":0},{"$f":"'2'!X22","v":0},{"$f":"'2'!Y22","v":0},{"$f":"'2'!Z22","v":0},{"$f":"'2'!AA22","v":0},{"$f":"'2'!AB22","v":0},{"$f":"'2'!AC22","v":0},{"$f":"'2'!AD22","v":0},{"$f":"'2'!AE22","v":0},{"$f":"'2'!AF22","v":0},{"$f":"'2'!AG22","v":0},{"$f":"'2'!AH22","v":0},{"$f":"'2'!AI22","v":0},{"$f":"'2'!AJ22","v":0},{"$f":"'2'!AK22","v":0},{"$f":"'2'!AL22","v":0},{"$f":"'2'!AM22","v":0},{"$f":"'2'!AN22","v":0},{"$f":"'2'!AO22","v":0},{"$f":"'2'!AP22","v":0},{"$f":"'2'!AQ22","v":0},{"$f":"'2'!AR22","v":0},{"$f":"'2'!AS22","v":0},{"$f":"'2'!AT22","v":0},{"$f":"SUMPRODUCT(IF($N43=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N43=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B24","v":"2"},{"$f":"'2'!C24","v":"2.3"},{"$f":"'2'!D24","v":"2.3.1"},{"$f":"'2'!E24","v":"2.3.1: Providers shall appoint a qualified money-laundering reporting officer (MLRO) to promote and monitor compliance with AML/CFT-related obligations"},{"$f":"'2'!F24","v":"2.3.1.1"},{"$f":"'2'!G24","v":"2.3.1.1: AML/CFT MANAGER: MONEY LAUNDERING REPORTING  OFFICER\nA qualified, independent and autonomous Money-Laundering Reporting Officer (MLRO) (or employee with equivalent responsibilities) should be appointed with responsibility for AML/CFT. The MLRO should report to a senior director or equivalent. A single identified person should be responsible and accountable for all MLRO functions. They may have other responsibilities, depending on the size of the mobile money operation.\n\nThe responsibilities of the MLRO should include the following:\n- Implementing procedures to comply with AML/CFT regulations;\n- Screening procedures for staff, agents, and entities providing outsourced services;\n- Monitoring compliance with AML/CFT procedures; \n- Receiving internal reports of suspicious activity and carrying out investigations and necessary actions; \n- Ensuring that changes in business processes and systems are matched by appropriate changes to AML/CFT controls; \n- Encouraging an AML/CFT culture within the Provider (with the assistance of the Directors, officers, and senior management); \n- Raising Suspicious Activity Reports (SARs) and/or Suspicious Transaction Reports (STRs) with the relevant authorities in the case of suspected ML/TF.\n- Serving as the contact person for law enforcement agencies  \n- Serving as the contact person for the Financial Intelligence Unit (or comparable government body) with respect to money laundering and terrorist financing; \n- Identifying national and international AML/CFT regulations that must be followed, and keeping up-to-date with regulations and guidance in AML/CFT practices (e.g. from FATF (Financial Action Task Force))."},{"$f":"'2'!H24","v":"GSMA RMT (FR.O-01)"},{"$f":"'2'!I24","v":"2.3.1.1.1"},{"$f":"'2'!J24","v":"2.3.1.1.1: Has a qualified, independent and autonomous Money-Laundering Reporting Officer (MLRO) (or employee with equivalent responsibilities) been appointed with responsibility for AML/CFT?\n"},{"$f":"'2'!K24","v":"1) MLRO's qualification  (or employee with equivalent responsibilities)\n- Check qualification is appropriate to AML/CFT \n- Check that the qualification/formal training is from a suitable professional body (i.e. ICA, ACAMS etc)\n(Note: 5 years of suitable relevant experience can be considered instead of a qualification)\n\n2) Role description for Money Laundering Reporting Officer (MLRO) or equivalent\n- Check the documents gives the MLRO authority to act autonomously.\n\n3) AML/CFT Organisation chart \n- Check the organisation chart to see that the reporting line is to a suitably independent directorate (same as 2.2.1.1.2.)."},{"$f":"'2'!L24","v":0},{"$f":"'2'!M24","v":"Urgent Required"},{"$f":"'2'!N24","v":"Required"},{"$f":"'2'!O24","v":"FraudRisk"},{"$f":"'2'!P24","v":0},{"$f":"'2'!Q24","v":0},{"$f":"'2'!R24","v":0},{"$f":"'2'!S24","v":0},{"$f":"'2'!T24","v":0},{"$f":"'2'!U24","v":0},{"$f":"'2'!V24","v":0},{"$f":"'2'!W24","v":0},{"$f":"'2'!X24","v":0},{"$f":"'2'!Y24","v":0},{"$f":"'2'!Z24","v":0},{"$f":"'2'!AA24","v":0},{"$f":"'2'!AB24","v":0},{"$f":"'2'!AC24","v":0},{"$f":"'2'!AD24","v":0},{"$f":"'2'!AE24","v":0},{"$f":"'2'!AF24","v":0},{"$f":"'2'!AG24","v":0},{"$f":"'2'!AH24","v":0},{"$f":"'2'!AI24","v":0},{"$f":"'2'!AJ24","v":0},{"$f":"'2'!AK24","v":0},{"$f":"'2'!AL24","v":0},{"$f":"'2'!AM24","v":0},{"$f":"'2'!AN24","v":0},{"$f":"'2'!AO24","v":0},{"$f":"'2'!AP24","v":0},{"$f":"'2'!AQ24","v":0},{"$f":"'2'!AR24","v":0},{"$f":"'2'!AS24","v":0},{"$f":"'2'!AT24","v":0},{"$f":"SUMPRODUCT(IF($N44=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N44=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B25","v":"2"},{"$f":"'2'!C25","v":"2.3"},{"$f":"'2'!D25","v":"2.3.1"},{"$f":"'2'!E25","v":0},{"$f":"'2'!F25","v":"2.3.1.1"},{"$f":"'2'!G25","v":0},{"$f":"'2'!H25","v":0},{"$f":"'2'!I25","v":"2.3.1.1.2"},{"$f":"'2'!J25","v":"2.3.1.1.2: Does the MLRO identify national and international AML/CFT regulations that must be followed and keep up-to-date with regulations and developments in AML/CFT?\n"},{"$f":"'2'!K25","v":"1) Risk Assessment on local legislation and regulations and providers controls\n- Check the risk assessment includes a review of local and international AML/CFT regualtions and how the organisation is meeting those requirements\n- Check the risk asessement has been refreshed within the last 18 months."},{"$f":"'2'!L25","v":0},{"$f":"'2'!M25","v":"Standard Required"},{"$f":"'2'!N25","v":"Required"},{"$f":"'2'!O25","v":"FraudRisk"},{"$f":"'2'!P25","v":0},{"$f":"'2'!Q25","v":0},{"$f":"'2'!R25","v":0},{"$f":"'2'!S25","v":0},{"$f":"'2'!T25","v":0},{"$f":"'2'!U25","v":0},{"$f":"'2'!V25","v":0},{"$f":"'2'!W25","v":0},{"$f":"'2'!X25","v":0},{"$f":"'2'!Y25","v":0},{"$f":"'2'!Z25","v":0},{"$f":"'2'!AA25","v":0},{"$f":"'2'!AB25","v":0},{"$f":"'2'!AC25","v":0},{"$f":"'2'!AD25","v":0},{"$f":"'2'!AE25","v":0},{"$f":"'2'!AF25","v":0},{"$f":"'2'!AG25","v":0},{"$f":"'2'!AH25","v":0},{"$f":"'2'!AI25","v":0},{"$f":"'2'!AJ25","v":0},{"$f":"'2'!AK25","v":0},{"$f":"'2'!AL25","v":0},{"$f":"'2'!AM25","v":0},{"$f":"'2'!AN25","v":0},{"$f":"'2'!AO25","v":0},{"$f":"'2'!AP25","v":0},{"$f":"'2'!AQ25","v":0},{"$f":"'2'!AR25","v":0},{"$f":"'2'!AS25","v":0},{"$f":"'2'!AT25","v":0},{"$f":"SUMPRODUCT(IF($N45=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N45=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B26","v":"2"},{"$f":"'2'!C26","v":"2.3"},{"$f":"'2'!D26","v":"2.3.1"},{"$f":"'2'!E26","v":0},{"$f":"'2'!F26","v":"2.3.1.1"},{"$f":"'2'!G26","v":0},{"$f":"'2'!H26","v":0},{"$f":"'2'!I26","v":"2.3.1.1.3"},{"$f":"'2'!J26","v":"2.3.1.1.3: Has the MLRO been given responsibility for ensuring procedures are implemented to comply with the AML/CFT laws and regulations?\n"},{"$f":"'2'!K26","v":"1) Documentation that describes the objective and function of the AML programme (i.e. policy or equivalent document)\n- Check that this includes an outline of the MLRO responsibilities, including overseeing implementation of procedures that comply with AML/CFT laws.\n"},{"$f":"'2'!L26","v":0},{"$f":"'2'!M26","v":"Urgent Required"},{"$f":"'2'!N26","v":"Required"},{"$f":"'2'!O26","v":"FraudRisk"},{"$f":"'2'!P26","v":0},{"$f":"'2'!Q26","v":0},{"$f":"'2'!R26","v":0},{"$f":"'2'!S26","v":0},{"$f":"'2'!T26","v":0},{"$f":"'2'!U26","v":0},{"$f":"'2'!V26","v":0},{"$f":"'2'!W26","v":0},{"$f":"'2'!X26","v":0},{"$f":"'2'!Y26","v":0},{"$f":"'2'!Z26","v":0},{"$f":"'2'!AA26","v":0},{"$f":"'2'!AB26","v":0},{"$f":"'2'!AC26","v":0},{"$f":"'2'!AD26","v":0},{"$f":"'2'!AE26","v":0},{"$f":"'2'!AF26","v":0},{"$f":"'2'!AG26","v":0},{"$f":"'2'!AH26","v":0},{"$f":"'2'!AI26","v":0},{"$f":"'2'!AJ26","v":0},{"$f":"'2'!AK26","v":0},{"$f":"'2'!AL26","v":0},{"$f":"'2'!AM26","v":0},{"$f":"'2'!AN26","v":0},{"$f":"'2'!AO26","v":0},{"$f":"'2'!AP26","v":0},{"$f":"'2'!AQ26","v":0},{"$f":"'2'!AR26","v":0},{"$f":"'2'!AS26","v":0},{"$f":"'2'!AT26","v":0},{"$f":"SUMPRODUCT(IF($N46=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N46=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B27","v":"2"},{"$f":"'2'!C27","v":"2.3"},{"$f":"'2'!D27","v":"2.3.1"},{"$f":"'2'!E27","v":""},{"$f":"'2'!F27","v":"2.3.1.1"},{"$f":"'2'!G27","v":0},{"$f":"'2'!H27","v":0},{"$f":"'2'!I27","v":"2.3.1.1.4"},{"$f":"'2'!J27","v":"2.3.1.1.4: Does the MLRO receive internal reports of suspicious activity and investigate suspect accounts / individuals and take appropriate action?\n"},{"$f":"'2'!K27","v":"1) Suspicious activity management process for identifying, investigating, actioning and reporting suspected ML/TF activity.\n-Check internal reports of suspicious activity are received by the MLRO.\n-Check there is a process for the MLRO to investigate the suspicion."},{"$f":"'2'!L27","v":0},{"$f":"'2'!M27","v":"Urgent Required"},{"$f":"'2'!N27","v":"Required"},{"$f":"'2'!O27","v":"FraudRisk"},{"$f":"'2'!P27","v":0},{"$f":"'2'!Q27","v":0},{"$f":"'2'!R27","v":0},{"$f":"'2'!S27","v":0},{"$f":"'2'!T27","v":0},{"$f":"'2'!U27","v":0},{"$f":"'2'!V27","v":0},{"$f":"'2'!W27","v":0},{"$f":"'2'!X27","v":0},{"$f":"'2'!Y27","v":0},{"$f":"'2'!Z27","v":0},{"$f":"'2'!AA27","v":0},{"$f":"'2'!AB27","v":0},{"$f":"'2'!AC27","v":0},{"$f":"'2'!AD27","v":0},{"$f":"'2'!AE27","v":0},{"$f":"'2'!AF27","v":0},{"$f":"'2'!AG27","v":0},{"$f":"'2'!AH27","v":0},{"$f":"'2'!AI27","v":0},{"$f":"'2'!AJ27","v":0},{"$f":"'2'!AK27","v":0},{"$f":"'2'!AL27","v":0},{"$f":"'2'!AM27","v":0},{"$f":"'2'!AN27","v":0},{"$f":"'2'!AO27","v":0},{"$f":"'2'!AP27","v":0},{"$f":"'2'!AQ27","v":0},{"$f":"'2'!AR27","v":0},{"$f":"'2'!AS27","v":0},{"$f":"'2'!AT27","v":0},{"$f":"SUMPRODUCT(IF($N47=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N47=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B28","v":"2"},{"$f":"'2'!C28","v":"2.3"},{"$f":"'2'!D28","v":"2.3.1"},{"$f":"'2'!E28","v":""},{"$f":"'2'!F28","v":"2.3.1.1"},{"$f":"'2'!G28","v":0},{"$f":"'2'!H28","v":0},{"$f":"'2'!I28","v":"2.3.1.1.5"},{"$f":"'2'!J28","v":"2.3.1.1.5: Does the MLRO ensure that when changes are made to business services and processes, appropriate changes to AML/CFT controls are also made?\n"},{"$f":"'2'!K28","v":"1) Mobile Money service change management process / product development process\n- Check the process includes the requirement for changes to be notified and approved by the MLRO where required \n- Check that AML controls are changed where required"},{"$f":"'2'!L28","v":0},{"$f":"'2'!M28","v":"Standard Required"},{"$f":"'2'!N28","v":"Required"},{"$f":"'2'!O28","v":"FraudRisk"},{"$f":"'2'!P28","v":0},{"$f":"'2'!Q28","v":0},{"$f":"'2'!R28","v":0},{"$f":"'2'!S28","v":0},{"$f":"'2'!T28","v":0},{"$f":"'2'!U28","v":0},{"$f":"'2'!V28","v":0},{"$f":"'2'!W28","v":0},{"$f":"'2'!X28","v":0},{"$f":"'2'!Y28","v":0},{"$f":"'2'!Z28","v":0},{"$f":"'2'!AA28","v":0},{"$f":"'2'!AB28","v":0},{"$f":"'2'!AC28","v":0},{"$f":"'2'!AD28","v":0},{"$f":"'2'!AE28","v":0},{"$f":"'2'!AF28","v":0},{"$f":"'2'!AG28","v":0},{"$f":"'2'!AH28","v":0},{"$f":"'2'!AI28","v":0},{"$f":"'2'!AJ28","v":0},{"$f":"'2'!AK28","v":0},{"$f":"'2'!AL28","v":0},{"$f":"'2'!AM28","v":0},{"$f":"'2'!AN28","v":0},{"$f":"'2'!AO28","v":0},{"$f":"'2'!AP28","v":0},{"$f":"'2'!AQ28","v":0},{"$f":"'2'!AR28","v":0},{"$f":"'2'!AS28","v":0},{"$f":"'2'!AT28","v":0},{"$f":"SUMPRODUCT(IF($N48=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N48=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B29","v":"2"},{"$f":"'2'!C29","v":"2.3"},{"$f":"'2'!D29","v":"2.3.1"},{"$f":"'2'!E29","v":""},{"$f":"'2'!F29","v":"2.3.1.1"},{"$f":"'2'!G29","v":0},{"$f":"'2'!H29","v":0},{"$f":"'2'!I29","v":"2.3.1.1.6"},{"$f":"'2'!J29","v":"2.3.1.1.6: Does the MLRO encourage an AML/CFT culture within the Provider (with the assistance of the Directors, Officers, and senior management)?\n"},{"$f":"'2'!K29","v":0},{"$f":"'2'!L29","v":0},{"$f":"'2'!M29","v":"Recommended"},{"$f":"'2'!N29","v":"Recommended"},{"$f":"'2'!O29","v":"FraudRisk"},{"$f":"'2'!P29","v":0},{"$f":"'2'!Q29","v":0},{"$f":"'2'!R29","v":0},{"$f":"'2'!S29","v":0},{"$f":"'2'!T29","v":0},{"$f":"'2'!U29","v":0},{"$f":"'2'!V29","v":0},{"$f":"'2'!W29","v":0},{"$f":"'2'!X29","v":0},{"$f":"'2'!Y29","v":0},{"$f":"'2'!Z29","v":0},{"$f":"'2'!AA29","v":0},{"$f":"'2'!AB29","v":0},{"$f":"'2'!AC29","v":0},{"$f":"'2'!AD29","v":0},{"$f":"'2'!AE29","v":0},{"$f":"'2'!AF29","v":0},{"$f":"'2'!AG29","v":0},{"$f":"'2'!AH29","v":0},{"$f":"'2'!AI29","v":0},{"$f":"'2'!AJ29","v":0},{"$f":"'2'!AK29","v":0},{"$f":"'2'!AL29","v":0},{"$f":"'2'!AM29","v":0},{"$f":"'2'!AN29","v":0},{"$f":"'2'!AO29","v":0},{"$f":"'2'!AP29","v":0},{"$f":"'2'!AQ29","v":0},{"$f":"'2'!AR29","v":0},{"$f":"'2'!AS29","v":0},{"$f":"'2'!AT29","v":0},{"$f":"SUMPRODUCT(IF($N49=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N49=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B30","v":"2"},{"$f":"'2'!C30","v":"2.3"},{"$f":"'2'!D30","v":"2.3.1"},{"$f":"'2'!E30","v":""},{"$f":"'2'!F30","v":"2.3.1.1"},{"$f":"'2'!G30","v":0},{"$f":"'2'!H30","v":0},{"$f":"'2'!I30","v":"2.3.1.1.7"},{"$f":"'2'!J30","v":"2.3.1.1.7: Does the MLRO maintain contacts with law enforcement agencies and the Financial Intelligence Unit (or comparable government body)?\n"},{"$f":"'2'!K30","v":0},{"$f":"'2'!L30","v":0},{"$f":"'2'!M30","v":"Recommended"},{"$f":"'2'!N30","v":"Recommended"},{"$f":"'2'!O30","v":"FraudRisk"},{"$f":"'2'!P30","v":0},{"$f":"'2'!Q30","v":0},{"$f":"'2'!R30","v":0},{"$f":"'2'!S30","v":0},{"$f":"'2'!T30","v":0},{"$f":"'2'!U30","v":0},{"$f":"'2'!V30","v":0},{"$f":"'2'!W30","v":0},{"$f":"'2'!X30","v":0},{"$f":"'2'!Y30","v":0},{"$f":"'2'!Z30","v":0},{"$f":"'2'!AA30","v":0},{"$f":"'2'!AB30","v":0},{"$f":"'2'!AC30","v":0},{"$f":"'2'!AD30","v":0},{"$f":"'2'!AE30","v":0},{"$f":"'2'!AF30","v":0},{"$f":"'2'!AG30","v":0},{"$f":"'2'!AH30","v":0},{"$f":"'2'!AI30","v":0},{"$f":"'2'!AJ30","v":0},{"$f":"'2'!AK30","v":0},{"$f":"'2'!AL30","v":0},{"$f":"'2'!AM30","v":0},{"$f":"'2'!AN30","v":0},{"$f":"'2'!AO30","v":0},{"$f":"'2'!AP30","v":0},{"$f":"'2'!AQ30","v":0},{"$f":"'2'!AR30","v":0},{"$f":"'2'!AS30","v":0},{"$f":"'2'!AT30","v":0},{"$f":"SUMPRODUCT(IF($N50=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N50=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B32","v":"2"},{"$f":"'2'!C32","v":"2.4"},{"$f":"'2'!D32","v":"2.4.1"},{"$f":"'2'!E32","v":"2.4.1: Providers shall create a system to monitor transactions for AML/CFT and anti-fraud purposes"},{"$f":"'2'!F32","v":"2.4.1.1"},{"$f":"'2'!G32","v":"2.4.1.1: TRANSACTION MONITORING\nA transaction monitoring system should be deployed to automatically identify suspicious transactions and patterns based on a configured set of rules. All transactions to/from mobile money accounts should be monitored to identify suspicious patterns. Alerts should be generated for manual follow-up and intervention. \n\nIt is recommended that actions on accounts (such as opening, closure, PIN change, SIM change) also be monitored for suspicious patterns.\n\nTransaction monitoring reports should be formally submitted to the MLRO and actions taken as defined in 2.1.1.2 and stored according to the record-keeping policy (2.1.1.5).\n\nDetails of the transaction monitoring system and its rules should be documented."},{"$f":"'2'!H32","v":"GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML"},{"$f":"'2'!I32","v":"2.4.1.1.1"},{"$f":"'2'!J32","v":"2.4.1.1.1: Has a transaction monitoring system been deployed to automatically identify suspicious transactions and patterns and create alerts for follow-up?\n"},{"$f":"'2'!K32","v":"1) Transaction monitoring system functional specification (or demonstration of system)\n- Check that the specification has been implemented and is operational."},{"$f":"'2'!L32","v":0},{"$f":"'2'!M32","v":"Urgent Required"},{"$f":"'2'!N32","v":"Required"},{"$f":"'2'!O32","v":"FraudRisk"},{"$f":"'2'!P32","v":0},{"$f":"'2'!Q32","v":0},{"$f":"'2'!R32","v":0},{"$f":"'2'!S32","v":0},{"$f":"'2'!T32","v":0},{"$f":"'2'!U32","v":0},{"$f":"'2'!V32","v":0},{"$f":"'2'!W32","v":0},{"$f":"'2'!X32","v":0},{"$f":"'2'!Y32","v":0},{"$f":"'2'!Z32","v":0},{"$f":"'2'!AA32","v":0},{"$f":"'2'!AB32","v":0},{"$f":"'2'!AC32","v":0},{"$f":"'2'!AD32","v":0},{"$f":"'2'!AE32","v":0},{"$f":"'2'!AF32","v":0},{"$f":"'2'!AG32","v":0},{"$f":"'2'!AH32","v":0},{"$f":"'2'!AI32","v":0},{"$f":"'2'!AJ32","v":0},{"$f":"'2'!AK32","v":0},{"$f":"'2'!AL32","v":0},{"$f":"'2'!AM32","v":0},{"$f":"'2'!AN32","v":0},{"$f":"'2'!AO32","v":0},{"$f":"'2'!AP32","v":0},{"$f":"'2'!AQ32","v":0},{"$f":"'2'!AR32","v":0},{"$f":"'2'!AS32","v":0},{"$f":"'2'!AT32","v":0},{"$f":"SUMPRODUCT(IF($N51=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N51=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B33","v":"2"},{"$f":"'2'!C33","v":"2.4"},{"$f":"'2'!D33","v":"2.4.1"},{"$f":"'2'!E33","v":0},{"$f":"'2'!F33","v":"2.4.1.1"},{"$f":"'2'!G33","v":0},{"$f":"'2'!H33","v":0},{"$f":"'2'!I33","v":"2.4.1.1.2"},{"$f":"'2'!J33","v":"2.4.1.1.2: Are details of the transaction monitoring system and its configuration documented?\n"},{"$f":"'2'!K33","v":"1) Transaction monitoring system functional specification\n- Check that transaction monitoring system and the configuration is documented.\n\n"},{"$f":"'2'!L33","v":0},{"$f":"'2'!M33","v":"Standard Required"},{"$f":"'2'!N33","v":"Required"},{"$f":"'2'!O33","v":"FraudRisk"},{"$f":"'2'!P33","v":0},{"$f":"'2'!Q33","v":0},{"$f":"'2'!R33","v":0},{"$f":"'2'!S33","v":0},{"$f":"'2'!T33","v":0},{"$f":"'2'!U33","v":0},{"$f":"'2'!V33","v":0},{"$f":"'2'!W33","v":0},{"$f":"'2'!X33","v":0},{"$f":"'2'!Y33","v":0},{"$f":"'2'!Z33","v":0},{"$f":"'2'!AA33","v":0},{"$f":"'2'!AB33","v":0},{"$f":"'2'!AC33","v":0},{"$f":"'2'!AD33","v":0},{"$f":"'2'!AE33","v":0},{"$f":"'2'!AF33","v":0},{"$f":"'2'!AG33","v":0},{"$f":"'2'!AH33","v":0},{"$f":"'2'!AI33","v":0},{"$f":"'2'!AJ33","v":0},{"$f":"'2'!AK33","v":0},{"$f":"'2'!AL33","v":0},{"$f":"'2'!AM33","v":0},{"$f":"'2'!AN33","v":0},{"$f":"'2'!AO33","v":0},{"$f":"'2'!AP33","v":0},{"$f":"'2'!AQ33","v":0},{"$f":"'2'!AR33","v":0},{"$f":"'2'!AS33","v":0},{"$f":"'2'!AT33","v":0},{"$f":"SUMPRODUCT(IF($N52=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N52=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B34","v":"2"},{"$f":"'2'!C34","v":"2.4"},{"$f":"'2'!D34","v":"2.4.1"},{"$f":"'2'!E34","v":0},{"$f":"'2'!F34","v":"2.4.1.1"},{"$f":"'2'!G34","v":0},{"$f":"'2'!H34","v":0},{"$f":"'2'!I34","v":"2.4.1.1.3"},{"$f":"'2'!J34","v":"2.4.1.1.3: Has an automated monitoring system been deployed to identify suspicious actions on accounts (such as opening, closure, PIN change, SIM change)?\n"},{"$f":"'2'!K34","v":0},{"$f":"'2'!L34","v":0},{"$f":"'2'!M34","v":"Recommended"},{"$f":"'2'!N34","v":"Recommended"},{"$f":"'2'!O34","v":"FraudRisk"},{"$f":"'2'!P34","v":0},{"$f":"'2'!Q34","v":0},{"$f":"'2'!R34","v":0},{"$f":"'2'!S34","v":0},{"$f":"'2'!T34","v":0},{"$f":"'2'!U34","v":0},{"$f":"'2'!V34","v":0},{"$f":"'2'!W34","v":0},{"$f":"'2'!X34","v":0},{"$f":"'2'!Y34","v":0},{"$f":"'2'!Z34","v":0},{"$f":"'2'!AA34","v":0},{"$f":"'2'!AB34","v":0},{"$f":"'2'!AC34","v":0},{"$f":"'2'!AD34","v":0},{"$f":"'2'!AE34","v":0},{"$f":"'2'!AF34","v":0},{"$f":"'2'!AG34","v":0},{"$f":"'2'!AH34","v":0},{"$f":"'2'!AI34","v":0},{"$f":"'2'!AJ34","v":0},{"$f":"'2'!AK34","v":0},{"$f":"'2'!AL34","v":0},{"$f":"'2'!AM34","v":0},{"$f":"'2'!AN34","v":0},{"$f":"'2'!AO34","v":0},{"$f":"'2'!AP34","v":0},{"$f":"'2'!AQ34","v":0},{"$f":"'2'!AR34","v":0},{"$f":"'2'!AS34","v":0},{"$f":"'2'!AT34","v":0},{"$f":"SUMPRODUCT(IF($N53=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N53=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B35","v":"2"},{"$f":"'2'!C35","v":"2.4"},{"$f":"'2'!D35","v":"2.4.1"},{"$f":"'2'!E35","v":0},{"$f":"'2'!F35","v":"2.4.1.2"},{"$f":"'2'!G35","v":"2.4.1.2: IDENTIFICATION OF SUSPICIOUS TRANSACTIONS\nThe transaction monitoring system should identify unusual or suspicious patterns of transactions. The system should be configurable so that it can be configured to respond to new types of suspicious patterns quickly and effectively.\n\nExamples of suspicious transactions that the system should be able to detect include:\n- Structuring of transactions (e.g., smurfing - multiple transactions just under the transaction limit);\n- Multiple attempted transactions exceeding allowable transaction limits; \n- Changes in velocity of transactions or transaction patterns inconsistent with customer’s prior behaviour (based on behaviour profiling);\n- Transaction requests from lost or stolen devices (e.g. using handset IMEI)."},{"$f":"'2'!H35","v":"GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML"},{"$f":"'2'!I35","v":"2.4.1.2.1"},{"$f":"'2'!J35","v":"2.4.1.2.1: Can the transaction monitoring system be configured to respond to new types of suspicious patterns quickly and effectively?\n"},{"$f":"'2'!K35","v":"1) Transaction monitoring system functional specification\n- Check that system can be reconfigured to respond to new patterns of suspicious behaviour without requiring significant changes such as a new software release."},{"$f":"'2'!L35","v":0},{"$f":"'2'!M35","v":"Standard Required"},{"$f":"'2'!N35","v":"Required"},{"$f":"'2'!O35","v":"FraudRisk"},{"$f":"'2'!P35","v":0},{"$f":"'2'!Q35","v":0},{"$f":"'2'!R35","v":0},{"$f":"'2'!S35","v":0},{"$f":"'2'!T35","v":0},{"$f":"'2'!U35","v":0},{"$f":"'2'!V35","v":0},{"$f":"'2'!W35","v":0},{"$f":"'2'!X35","v":0},{"$f":"'2'!Y35","v":0},{"$f":"'2'!Z35","v":0},{"$f":"'2'!AA35","v":0},{"$f":"'2'!AB35","v":0},{"$f":"'2'!AC35","v":0},{"$f":"'2'!AD35","v":0},{"$f":"'2'!AE35","v":0},{"$f":"'2'!AF35","v":0},{"$f":"'2'!AG35","v":0},{"$f":"'2'!AH35","v":0},{"$f":"'2'!AI35","v":0},{"$f":"'2'!AJ35","v":0},{"$f":"'2'!AK35","v":0},{"$f":"'2'!AL35","v":0},{"$f":"'2'!AM35","v":0},{"$f":"'2'!AN35","v":0},{"$f":"'2'!AO35","v":0},{"$f":"'2'!AP35","v":0},{"$f":"'2'!AQ35","v":0},{"$f":"'2'!AR35","v":0},{"$f":"'2'!AS35","v":0},{"$f":"'2'!AT35","v":0},{"$f":"SUMPRODUCT(IF($N54=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N54=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B36","v":"2"},{"$f":"'2'!C36","v":"2.4"},{"$f":"'2'!D36","v":"2.4.1"},{"$f":"'2'!E36","v":0},{"$f":"'2'!F36","v":"2.4.1.2"},{"$f":"'2'!G36","v":0},{"$f":"'2'!H36","v":0},{"$f":"'2'!I36","v":"2.4.1.2.2"},{"$f":"'2'!J36","v":"2.4.1.2.2: Can the transaction monitoring system detect structuring of transactions (e.g., smurfing) or multiple attempted transactions that exceed the transaction limit?\n"},{"$f":"'2'!K36","v":0},{"$f":"'2'!L36","v":0},{"$f":"'2'!M36","v":"Recommended"},{"$f":"'2'!N36","v":"Recommended"},{"$f":"'2'!O36","v":"FraudRisk"},{"$f":"'2'!P36","v":0},{"$f":"'2'!Q36","v":0},{"$f":"'2'!R36","v":0},{"$f":"'2'!S36","v":0},{"$f":"'2'!T36","v":0},{"$f":"'2'!U36","v":0},{"$f":"'2'!V36","v":0},{"$f":"'2'!W36","v":0},{"$f":"'2'!X36","v":0},{"$f":"'2'!Y36","v":0},{"$f":"'2'!Z36","v":0},{"$f":"'2'!AA36","v":0},{"$f":"'2'!AB36","v":0},{"$f":"'2'!AC36","v":0},{"$f":"'2'!AD36","v":0},{"$f":"'2'!AE36","v":0},{"$f":"'2'!AF36","v":0},{"$f":"'2'!AG36","v":0},{"$f":"'2'!AH36","v":0},{"$f":"'2'!AI36","v":0},{"$f":"'2'!AJ36","v":0},{"$f":"'2'!AK36","v":0},{"$f":"'2'!AL36","v":0},{"$f":"'2'!AM36","v":0},{"$f":"'2'!AN36","v":0},{"$f":"'2'!AO36","v":0},{"$f":"'2'!AP36","v":0},{"$f":"'2'!AQ36","v":0},{"$f":"'2'!AR36","v":0},{"$f":"'2'!AS36","v":0},{"$f":"'2'!AT36","v":0},{"$f":"SUMPRODUCT(IF($N55=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N55=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B37","v":"2"},{"$f":"'2'!C37","v":"2.4"},{"$f":"'2'!D37","v":"2.4.1"},{"$f":"'2'!E37","v":0},{"$f":"'2'!F37","v":"2.4.1.2"},{"$f":"'2'!G37","v":0},{"$f":"'2'!H37","v":0},{"$f":"'2'!I37","v":"2.4.1.2.3"},{"$f":"'2'!J37","v":"2.4.1.2.3: Can the transaction monitoring system promptly detect changes in velocity of transactions or transactions inconsistent with client’s prior behaviour?\n"},{"$f":"'2'!K37","v":0},{"$f":"'2'!L37","v":0},{"$f":"'2'!M37","v":"Recommended"},{"$f":"'2'!N37","v":"Recommended"},{"$f":"'2'!O37","v":"FraudRisk"},{"$f":"'2'!P37","v":0},{"$f":"'2'!Q37","v":0},{"$f":"'2'!R37","v":0},{"$f":"'2'!S37","v":0},{"$f":"'2'!T37","v":0},{"$f":"'2'!U37","v":0},{"$f":"'2'!V37","v":0},{"$f":"'2'!W37","v":0},{"$f":"'2'!X37","v":0},{"$f":"'2'!Y37","v":0},{"$f":"'2'!Z37","v":0},{"$f":"'2'!AA37","v":0},{"$f":"'2'!AB37","v":0},{"$f":"'2'!AC37","v":0},{"$f":"'2'!AD37","v":0},{"$f":"'2'!AE37","v":0},{"$f":"'2'!AF37","v":0},{"$f":"'2'!AG37","v":0},{"$f":"'2'!AH37","v":0},{"$f":"'2'!AI37","v":0},{"$f":"'2'!AJ37","v":0},{"$f":"'2'!AK37","v":0},{"$f":"'2'!AL37","v":0},{"$f":"'2'!AM37","v":0},{"$f":"'2'!AN37","v":0},{"$f":"'2'!AO37","v":0},{"$f":"'2'!AP37","v":0},{"$f":"'2'!AQ37","v":0},{"$f":"'2'!AR37","v":0},{"$f":"'2'!AS37","v":0},{"$f":"'2'!AT37","v":0},{"$f":"SUMPRODUCT(IF($N56=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N56=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B38","v":"2"},{"$f":"'2'!C38","v":"2.4"},{"$f":"'2'!D38","v":"2.4.1"},{"$f":"'2'!E38","v":0},{"$f":"'2'!F38","v":"2.4.1.2"},{"$f":"'2'!G38","v":0},{"$f":"'2'!H38","v":0},{"$f":"'2'!I38","v":"2.4.1.2.4"},{"$f":"'2'!J38","v":"2.4.1.2.4: Can the transaction monitoring system promptly detect transaction requests from lost or stolen devices (e.g. using handset IMEI)?\n"},{"$f":"'2'!K38","v":0},{"$f":"'2'!L38","v":0},{"$f":"'2'!M38","v":"Recommended"},{"$f":"'2'!N38","v":"Recommended"},{"$f":"'2'!O38","v":"FraudRisk"},{"$f":"'2'!P38","v":0},{"$f":"'2'!Q38","v":0},{"$f":"'2'!R38","v":0},{"$f":"'2'!S38","v":0},{"$f":"'2'!T38","v":0},{"$f":"'2'!U38","v":0},{"$f":"'2'!V38","v":0},{"$f":"'2'!W38","v":0},{"$f":"'2'!X38","v":0},{"$f":"'2'!Y38","v":0},{"$f":"'2'!Z38","v":0},{"$f":"'2'!AA38","v":0},{"$f":"'2'!AB38","v":0},{"$f":"'2'!AC38","v":0},{"$f":"'2'!AD38","v":0},{"$f":"'2'!AE38","v":0},{"$f":"'2'!AF38","v":0},{"$f":"'2'!AG38","v":0},{"$f":"'2'!AH38","v":0},{"$f":"'2'!AI38","v":0},{"$f":"'2'!AJ38","v":0},{"$f":"'2'!AK38","v":0},{"$f":"'2'!AL38","v":0},{"$f":"'2'!AM38","v":0},{"$f":"'2'!AN38","v":0},{"$f":"'2'!AO38","v":0},{"$f":"'2'!AP38","v":0},{"$f":"'2'!AQ38","v":0},{"$f":"'2'!AR38","v":0},{"$f":"'2'!AS38","v":0},{"$f":"'2'!AT38","v":0},{"$f":"SUMPRODUCT(IF($N57=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N57=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B39","v":"2"},{"$f":"'2'!C39","v":"2.4"},{"$f":"'2'!D39","v":"2.4.1"},{"$f":"'2'!E39","v":0},{"$f":"'2'!F39","v":"2.4.1.3"},{"$f":"'2'!G39","v":"2.4.1.3: GEOGRAPHIC VALIDATION\nIf technically feasible, location details of transaction parties should be monitored. Location details may be obtained through geo-location, cell site or other system-generated address data.\n\nLocation information can be used to identify suspicious behaviour such as:\n  - transactions to/from suspicious locations (e.g. prisons);\n  - transactions by an agent when the customer is not at the agent location;\n  - multiple transactions in different locations within a short time period (this is an indicator of SIM cloning).\n  - agents operating outside their expected area (agent SIMs that have moved location may be used for unauthorized cross-border transfers and are also more likely to be performing false registrations).\n"},{"$f":"'2'!H39","v":"GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML"},{"$f":"'2'!I39","v":"2.4.1.3.1"},{"$f":"'2'!J39","v":"2.4.1.3.1: Does the transaction monitoring system incorporate location information of transaction parties (obtained through geo-location, cell site or other system-generated address data)?\n"},{"$f":"'2'!K39","v":0},{"$f":"'2'!L39","v":0},{"$f":"'2'!M39","v":"Recommended"},{"$f":"'2'!N39","v":"Recommended"},{"$f":"'2'!O39","v":"FraudRisk"},{"$f":"'2'!P39","v":0},{"$f":"'2'!Q39","v":0},{"$f":"'2'!R39","v":0},{"$f":"'2'!S39","v":0},{"$f":"'2'!T39","v":0},{"$f":"'2'!U39","v":0},{"$f":"'2'!V39","v":0},{"$f":"'2'!W39","v":0},{"$f":"'2'!X39","v":0},{"$f":"'2'!Y39","v":0},{"$f":"'2'!Z39","v":0},{"$f":"'2'!AA39","v":0},{"$f":"'2'!AB39","v":0},{"$f":"'2'!AC39","v":0},{"$f":"'2'!AD39","v":0},{"$f":"'2'!AE39","v":0},{"$f":"'2'!AF39","v":0},{"$f":"'2'!AG39","v":0},{"$f":"'2'!AH39","v":0},{"$f":"'2'!AI39","v":0},{"$f":"'2'!AJ39","v":0},{"$f":"'2'!AK39","v":0},{"$f":"'2'!AL39","v":0},{"$f":"'2'!AM39","v":0},{"$f":"'2'!AN39","v":0},{"$f":"'2'!AO39","v":0},{"$f":"'2'!AP39","v":0},{"$f":"'2'!AQ39","v":0},{"$f":"'2'!AR39","v":0},{"$f":"'2'!AS39","v":0},{"$f":"'2'!AT39","v":0},{"$f":"SUMPRODUCT(IF($N58=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N58=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B40","v":"2"},{"$f":"'2'!C40","v":"2.4"},{"$f":"'2'!D40","v":"2.4.1"},{"$f":"'2'!E40","v":0},{"$f":"'2'!F40","v":"2.4.1.3"},{"$f":"'2'!G40","v":0},{"$f":"'2'!H40","v":0},{"$f":"'2'!I40","v":"2.4.1.3.2"},{"$f":"'2'!J40","v":"2.4.1.3.2: Can the transaction monitoring system detect transactions to/from suspicious locations?\n"},{"$f":"'2'!K40","v":0},{"$f":"'2'!L40","v":0},{"$f":"'2'!M40","v":"Recommended"},{"$f":"'2'!N40","v":"Recommended"},{"$f":"'2'!O40","v":"FraudRisk"},{"$f":"'2'!P40","v":0},{"$f":"'2'!Q40","v":0},{"$f":"'2'!R40","v":0},{"$f":"'2'!S40","v":0},{"$f":"'2'!T40","v":0},{"$f":"'2'!U40","v":0},{"$f":"'2'!V40","v":0},{"$f":"'2'!W40","v":0},{"$f":"'2'!X40","v":0},{"$f":"'2'!Y40","v":0},{"$f":"'2'!Z40","v":0},{"$f":"'2'!AA40","v":0},{"$f":"'2'!AB40","v":0},{"$f":"'2'!AC40","v":0},{"$f":"'2'!AD40","v":0},{"$f":"'2'!AE40","v":0},{"$f":"'2'!AF40","v":0},{"$f":"'2'!AG40","v":0},{"$f":"'2'!AH40","v":0},{"$f":"'2'!AI40","v":0},{"$f":"'2'!AJ40","v":0},{"$f":"'2'!AK40","v":0},{"$f":"'2'!AL40","v":0},{"$f":"'2'!AM40","v":0},{"$f":"'2'!AN40","v":0},{"$f":"'2'!AO40","v":0},{"$f":"'2'!AP40","v":0},{"$f":"'2'!AQ40","v":0},{"$f":"'2'!AR40","v":0},{"$f":"'2'!AS40","v":0},{"$f":"'2'!AT40","v":0},{"$f":"SUMPRODUCT(IF($N59=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N59=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B41","v":"2"},{"$f":"'2'!C41","v":"2.4"},{"$f":"'2'!D41","v":"2.4.1"},{"$f":"'2'!E41","v":0},{"$f":"'2'!F41","v":"2.4.1.3"},{"$f":"'2'!G41","v":0},{"$f":"'2'!H41","v":0},{"$f":"'2'!I41","v":"2.4.1.3.3"},{"$f":"'2'!J41","v":"2.4.1.3.3: Can the transaction monitoring system detect transactions by an agent when customer is not at agent location?\n"},{"$f":"'2'!K41","v":0},{"$f":"'2'!L41","v":0},{"$f":"'2'!M41","v":"Recommended"},{"$f":"'2'!N41","v":"Recommended"},{"$f":"'2'!O41","v":"FraudRisk"},{"$f":"'2'!P41","v":0},{"$f":"'2'!Q41","v":0},{"$f":"'2'!R41","v":0},{"$f":"'2'!S41","v":0},{"$f":"'2'!T41","v":0},{"$f":"'2'!U41","v":0},{"$f":"'2'!V41","v":0},{"$f":"'2'!W41","v":0},{"$f":"'2'!X41","v":0},{"$f":"'2'!Y41","v":0},{"$f":"'2'!Z41","v":0},{"$f":"'2'!AA41","v":0},{"$f":"'2'!AB41","v":0},{"$f":"'2'!AC41","v":0},{"$f":"'2'!AD41","v":0},{"$f":"'2'!AE41","v":0},{"$f":"'2'!AF41","v":0},{"$f":"'2'!AG41","v":0},{"$f":"'2'!AH41","v":0},{"$f":"'2'!AI41","v":0},{"$f":"'2'!AJ41","v":0},{"$f":"'2'!AK41","v":0},{"$f":"'2'!AL41","v":0},{"$f":"'2'!AM41","v":0},{"$f":"'2'!AN41","v":0},{"$f":"'2'!AO41","v":0},{"$f":"'2'!AP41","v":0},{"$f":"'2'!AQ41","v":0},{"$f":"'2'!AR41","v":0},{"$f":"'2'!AS41","v":0},{"$f":"'2'!AT41","v":0},{"$f":"SUMPRODUCT(IF($N60=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N60=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B42","v":"2"},{"$f":"'2'!C42","v":"2.4"},{"$f":"'2'!D42","v":"2.4.1"},{"$f":"'2'!E42","v":0},{"$f":"'2'!F42","v":"2.4.1.3"},{"$f":"'2'!G42","v":0},{"$f":"'2'!H42","v":0},{"$f":"'2'!I42","v":"2.4.1.3.4"},{"$f":"'2'!J42","v":"2.4.1.3.4: Can the transaction monitoring system detect multiple transactions in different locations within a short time period (this is an indicator of SIM cloning)?\n"},{"$f":"'2'!K42","v":0},{"$f":"'2'!L42","v":0},{"$f":"'2'!M42","v":"Recommended"},{"$f":"'2'!N42","v":"Recommended"},{"$f":"'2'!O42","v":"FraudRisk"},{"$f":"'2'!P42","v":0},{"$f":"'2'!Q42","v":0},{"$f":"'2'!R42","v":0},{"$f":"'2'!S42","v":0},{"$f":"'2'!T42","v":0},{"$f":"'2'!U42","v":0},{"$f":"'2'!V42","v":0},{"$f":"'2'!W42","v":0},{"$f":"'2'!X42","v":0},{"$f":"'2'!Y42","v":0},{"$f":"'2'!Z42","v":0},{"$f":"'2'!AA42","v":0},{"$f":"'2'!AB42","v":0},{"$f":"'2'!AC42","v":0},{"$f":"'2'!AD42","v":0},{"$f":"'2'!AE42","v":0},{"$f":"'2'!AF42","v":0},{"$f":"'2'!AG42","v":0},{"$f":"'2'!AH42","v":0},{"$f":"'2'!AI42","v":0},{"$f":"'2'!AJ42","v":0},{"$f":"'2'!AK42","v":0},{"$f":"'2'!AL42","v":0},{"$f":"'2'!AM42","v":0},{"$f":"'2'!AN42","v":0},{"$f":"'2'!AO42","v":0},{"$f":"'2'!AP42","v":0},{"$f":"'2'!AQ42","v":0},{"$f":"'2'!AR42","v":0},{"$f":"'2'!AS42","v":0},{"$f":"'2'!AT42","v":0},{"$f":"SUMPRODUCT(IF($N61=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N61=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B43","v":"2"},{"$f":"'2'!C43","v":"2.4"},{"$f":"'2'!D43","v":"2.4.1"},{"$f":"'2'!E43","v":0},{"$f":"'2'!F43","v":"2.4.1.3"},{"$f":"'2'!G43","v":0},{"$f":"'2'!H43","v":0},{"$f":"'2'!I43","v":"2.4.1.3.5"},{"$f":"'2'!J43","v":"2.4.1.3.5: Can the transaction monitoring system detect agents operating outside their expected area?\n"},{"$f":"'2'!K43","v":0},{"$f":"'2'!L43","v":0},{"$f":"'2'!M43","v":"Recommended"},{"$f":"'2'!N43","v":"Recommended"},{"$f":"'2'!O43","v":"FraudRisk"},{"$f":"'2'!P43","v":0},{"$f":"'2'!Q43","v":0},{"$f":"'2'!R43","v":0},{"$f":"'2'!S43","v":0},{"$f":"'2'!T43","v":0},{"$f":"'2'!U43","v":0},{"$f":"'2'!V43","v":0},{"$f":"'2'!W43","v":0},{"$f":"'2'!X43","v":0},{"$f":"'2'!Y43","v":0},{"$f":"'2'!Z43","v":0},{"$f":"'2'!AA43","v":0},{"$f":"'2'!AB43","v":0},{"$f":"'2'!AC43","v":0},{"$f":"'2'!AD43","v":0},{"$f":"'2'!AE43","v":0},{"$f":"'2'!AF43","v":0},{"$f":"'2'!AG43","v":0},{"$f":"'2'!AH43","v":0},{"$f":"'2'!AI43","v":0},{"$f":"'2'!AJ43","v":0},{"$f":"'2'!AK43","v":0},{"$f":"'2'!AL43","v":0},{"$f":"'2'!AM43","v":0},{"$f":"'2'!AN43","v":0},{"$f":"'2'!AO43","v":0},{"$f":"'2'!AP43","v":0},{"$f":"'2'!AQ43","v":0},{"$f":"'2'!AR43","v":0},{"$f":"'2'!AS43","v":0},{"$f":"'2'!AT43","v":0},{"$f":"SUMPRODUCT(IF($N62=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N62=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B44","v":"2"},{"$f":"'2'!C44","v":"2.4"},{"$f":"'2'!D44","v":"2.4.1"},{"$f":"'2'!E44","v":0},{"$f":"'2'!F44","v":"2.4.1.4"},{"$f":"'2'!G44","v":"2.4.1.4: ENHANCED TRANSACTION MONITORING\nEnhanced monitoring should be carried out for business transactions and transactions to/from financial ecosystem partners (e.g. banks, cross-border, interoperability), as these transactions may have higher limits and may present a higher ML / TF risk."},{"$f":"'2'!H44","v":"GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML"},{"$f":"'2'!I44","v":"2.4.1.4.1"},{"$f":"'2'!J44","v":"2.4.1.4.1: Is enhanced transaction monitoring implemented for business transactions and transactions to / from financial ecosystem partners (e.g. banks, cross-border, interoperability)?\n"},{"$f":"'2'!K44","v":0},{"$f":"'2'!L44","v":0},{"$f":"'2'!M44","v":"Recommended"},{"$f":"'2'!N44","v":"Recommended"},{"$f":"'2'!O44","v":"FraudRisk"},{"$f":"'2'!P44","v":0},{"$f":"'2'!Q44","v":0},{"$f":"'2'!R44","v":0},{"$f":"'2'!S44","v":0},{"$f":"'2'!T44","v":0},{"$f":"'2'!U44","v":0},{"$f":"'2'!V44","v":0},{"$f":"'2'!W44","v":0},{"$f":"'2'!X44","v":0},{"$f":"'2'!Y44","v":0},{"$f":"'2'!Z44","v":0},{"$f":"'2'!AA44","v":0},{"$f":"'2'!AB44","v":0},{"$f":"'2'!AC44","v":0},{"$f":"'2'!AD44","v":0},{"$f":"'2'!AE44","v":0},{"$f":"'2'!AF44","v":0},{"$f":"'2'!AG44","v":0},{"$f":"'2'!AH44","v":0},{"$f":"'2'!AI44","v":0},{"$f":"'2'!AJ44","v":0},{"$f":"'2'!AK44","v":0},{"$f":"'2'!AL44","v":0},{"$f":"'2'!AM44","v":0},{"$f":"'2'!AN44","v":0},{"$f":"'2'!AO44","v":0},{"$f":"'2'!AP44","v":0},{"$f":"'2'!AQ44","v":0},{"$f":"'2'!AR44","v":0},{"$f":"'2'!AS44","v":0},{"$f":"'2'!AT44","v":0},{"$f":"SUMPRODUCT(IF($N63=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N63=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B45","v":"2"},{"$f":"'2'!C45","v":"2.4"},{"$f":"'2'!D45","v":"2.4.1"},{"$f":"'2'!E45","v":0},{"$f":"'2'!F45","v":"2.4.1.5"},{"$f":"'2'!G45","v":"2.4.1.5: MONITORING CHANGES TO ACCOUNTS\nActions on accounts should be monitored to identify unusual and suspicious activity. This should include:\n  - Unusual account opening or closing;\n  - Suspicious changes to accounts;\n  - Suspicious patterns of security credential (e.g., PIN) change;\n  - Suspicious patterns of SIM change;\n  - Duplication of accounts."},{"$f":"'2'!H45","v":"GSMA RMT (FR.T-05\nFR.T-16\nFR.P-10) \n\nGSMA AML"},{"$f":"'2'!I45","v":"2.4.1.5.1"},{"$f":"'2'!J45","v":"2.4.1.5.1: Are actions on accounts monitored to identify unusual and suspicious activity, including account opening/closing/changes, suspicious PIN/SIM changes, and duplication of accounts?\n"},{"$f":"'2'!K45","v":0},{"$f":"'2'!L45","v":0},{"$f":"'2'!M45","v":"Recommended"},{"$f":"'2'!N45","v":"Recommended"},{"$f":"'2'!O45","v":"FraudRisk"},{"$f":"'2'!P45","v":0},{"$f":"'2'!Q45","v":0},{"$f":"'2'!R45","v":0},{"$f":"'2'!S45","v":0},{"$f":"'2'!T45","v":0},{"$f":"'2'!U45","v":0},{"$f":"'2'!V45","v":0},{"$f":"'2'!W45","v":0},{"$f":"'2'!X45","v":0},{"$f":"'2'!Y45","v":0},{"$f":"'2'!Z45","v":0},{"$f":"'2'!AA45","v":0},{"$f":"'2'!AB45","v":0},{"$f":"'2'!AC45","v":0},{"$f":"'2'!AD45","v":0},{"$f":"'2'!AE45","v":0},{"$f":"'2'!AF45","v":0},{"$f":"'2'!AG45","v":0},{"$f":"'2'!AH45","v":0},{"$f":"'2'!AI45","v":0},{"$f":"'2'!AJ45","v":0},{"$f":"'2'!AK45","v":0},{"$f":"'2'!AL45","v":0},{"$f":"'2'!AM45","v":0},{"$f":"'2'!AN45","v":0},{"$f":"'2'!AO45","v":0},{"$f":"'2'!AP45","v":0},{"$f":"'2'!AQ45","v":0},{"$f":"'2'!AR45","v":0},{"$f":"'2'!AS45","v":0},{"$f":"'2'!AT45","v":0},{"$f":"SUMPRODUCT(IF($N64=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N64=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B47","v":"2"},{"$f":"'2'!C47","v":"2.5"},{"$f":"'2'!D47","v":"2.5.1"},{"$f":"'2'!E47","v":"2.5.1: Providers shall adequately identify clients"},{"$f":"'2'!F47","v":"2.5.1.1"},{"$f":"'2'!G47","v":"2.5.1.1: KYC POLICY / REQUIREMENTS\nProviders should have a documented KYC policy (or doocumented KYC requirements) specifying the appropriate KYC to be collected for each type of account and the acceptable documentation.\n\nA risk-based KYC approach is recommended, which determines that higher-risk accounts or transactions (such as accounts with higher limits and/or greater functionality, transactions to/from high-risk markets, or accounts/transactions by politically exposed persons) require enhanced KYC, while simplified KYC is sufficient for lower-risk accounts (such as accounts with lower transaction and balance limits aimed at promoting financial inclusion)."},{"$f":"'2'!H47","v":"GSMA RMT (AG-09 )"},{"$f":"'2'!I47","v":"2.5.1.1.1"},{"$f":"'2'!J47","v":"2.5.1.1.1: Are the KYC requirements for customers documented, specifying the appropriate KYC to be collected for each type of account and the acceptable documentation?\n(Also see definition of risk-based KYC).\n"},{"$f":"'2'!K47","v":"1) KYC policy / KYC requirements / account registration process\n- Check that this specifies the KYC information required for each account type offered by the provider.\n- Check that the provider has assessed that the KYC information captured meets local regulatory requirements."},{"$f":"'2'!L47","v":0},{"$f":"'2'!M47","v":"Urgent Required"},{"$f":"'2'!N47","v":"Required"},{"$f":"'2'!O47","v":"FraudRisk"},{"$f":"'2'!P47","v":0},{"$f":"'2'!Q47","v":0},{"$f":"'2'!R47","v":0},{"$f":"'2'!S47","v":0},{"$f":"'2'!T47","v":0},{"$f":"'2'!U47","v":0},{"$f":"'2'!V47","v":0},{"$f":"'2'!W47","v":0},{"$f":"'2'!X47","v":0},{"$f":"'2'!Y47","v":0},{"$f":"'2'!Z47","v":0},{"$f":"'2'!AA47","v":0},{"$f":"'2'!AB47","v":0},{"$f":"'2'!AC47","v":0},{"$f":"'2'!AD47","v":0},{"$f":"'2'!AE47","v":0},{"$f":"'2'!AF47","v":0},{"$f":"'2'!AG47","v":0},{"$f":"'2'!AH47","v":0},{"$f":"'2'!AI47","v":0},{"$f":"'2'!AJ47","v":0},{"$f":"'2'!AK47","v":0},{"$f":"'2'!AL47","v":0},{"$f":"'2'!AM47","v":0},{"$f":"'2'!AN47","v":0},{"$f":"'2'!AO47","v":0},{"$f":"'2'!AP47","v":0},{"$f":"'2'!AQ47","v":0},{"$f":"'2'!AR47","v":0},{"$f":"'2'!AS47","v":0},{"$f":"'2'!AT47","v":0},{"$f":"SUMPRODUCT(IF($N65=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N65=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B48","v":"2"},{"$f":"'2'!C48","v":"2.5"},{"$f":"'2'!D48","v":"2.5.1"},{"$f":"'2'!E48","v":0},{"$f":"'2'!F48","v":"2.5.1.2"},{"$f":"'2'!G48","v":"2.5.1.2: MINIMUM KYC FOR BASIC ACCOUNTS AND LOW-VALUE OCCASIONAL TRANSACTIONS\nAt minimum, and subject to local law and regulation, providers should collect the following information at account opening or when conducting a low-value occasional transaction (e.g. OTC), either directly (for example, when a customer self-registers on their phone) or using agents: \n- Full name of Applicant; \n- Date of birth of Applicant; \n- Mobile telephone number of Applicant (if applicable);\n\nDepending upon domestic AML/CFT requirements, verification of information may be delayed or may not be required for low-value accounts or occasional transactions. Higher transaction/balance limits should require more KYC and stronger verification.\n\nIf permitted by local law, a basic account with limited functionality may be opened remotely using customer information already collected by the provider, government, or other party (e.g. from SIM registration or centralized electronic database). "},{"$f":"'2'!H48","v":"GSMA RMT (AG-09 )"},{"$f":"'2'!I48","v":"2.5.1.2.1"},{"$f":"'2'!J48","v":"2.5.1.2.1: Is all the following minimum KYC collected from customers opening basic accounts or conducting low-value occasional transactions (e.g. OTC)?\n"},{"$f":"'2'!K48","v":"1) KYC policy / KYC requirements / account registration process\n- Check that basic/low risk accounts (that only permit low value transactions) require the collection of at least the following KYC information:\n     a) Full name \n     b) Date of birth of Applicant\n     c) Mobile number or unique reference number\n\n[This indicator should be marked N/A if this type of basic account is not offered by the provider]"},{"$f":"'2'!L48","v":0},{"$f":"'2'!M48","v":"Urgent Required"},{"$f":"'2'!N48","v":"Required"},{"$f":"'2'!O48","v":"FraudRisk"},{"$f":"'2'!P48","v":0},{"$f":"'2'!Q48","v":0},{"$f":"'2'!R48","v":0},{"$f":"'2'!S48","v":0},{"$f":"'2'!T48","v":0},{"$f":"'2'!U48","v":0},{"$f":"'2'!V48","v":0},{"$f":"'2'!W48","v":0},{"$f":"'2'!X48","v":0},{"$f":"'2'!Y48","v":0},{"$f":"'2'!Z48","v":0},{"$f":"'2'!AA48","v":0},{"$f":"'2'!AB48","v":0},{"$f":"'2'!AC48","v":0},{"$f":"'2'!AD48","v":0},{"$f":"'2'!AE48","v":0},{"$f":"'2'!AF48","v":0},{"$f":"'2'!AG48","v":0},{"$f":"'2'!AH48","v":0},{"$f":"'2'!AI48","v":0},{"$f":"'2'!AJ48","v":0},{"$f":"'2'!AK48","v":0},{"$f":"'2'!AL48","v":0},{"$f":"'2'!AM48","v":0},{"$f":"'2'!AN48","v":0},{"$f":"'2'!AO48","v":0},{"$f":"'2'!AP48","v":0},{"$f":"'2'!AQ48","v":0},{"$f":"'2'!AR48","v":0},{"$f":"'2'!AS48","v":0},{"$f":"'2'!AT48","v":0},{"$f":"SUMPRODUCT(IF($N66=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N66=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B49","v":"2"},{"$f":"'2'!C49","v":"2.5"},{"$f":"'2'!D49","v":"2.5.1"},{"$f":"'2'!E49","v":""},{"$f":"'2'!F49","v":"2.5.1.3"},{"$f":"'2'!G49","v":"2.5.1.3: KYC FOR REGULAR ACCOUNTS\nAdditional KYC Information can be collected to enable higher-limit accounts or additional functionality and this may include: \n- All information required for Basic KYC; \n- Place of birth of Applicant; \n- Photograph of Applicant; \n- Current residential address of Applicant; \n- National ID number of Applicant (if such exists in the relevant jurisdiction) or other identifying number;\n- Any other information required to comply with local AML/CFT regulations.\n\nIf widely available, a national ID document should be used to verify customer identity. If a national ID is not widely available, one or more of the following IDs may be considered, if permitted by local laws and regulations. As part of the risk-based KYC approach, providers should evaluate the reliability of different identification documents when determining requirements for different account tiers: \n- Passport  \n- Voting card \n- Driver's licence \n- Social security card\n- Employee ID \n- Student ID \n- Salary slip \n- Tax report \n- Other government-issued ID\n- Attestation letter from local government official or person of appropriate standing in the community, such as a village chief.\n"},{"$f":"'2'!H49","v":"GSMA RMT (AG-09 )"},{"$f":"'2'!I49","v":"2.5.1.3.1"},{"$f":"'2'!J49","v":"2.5.1.3.1: In addition to the minimum KYC, is the National ID or other identifying number collected from customers opening regular accounts (if applicable)?\n"},{"$f":"'2'!K49","v":"1) KYC policy / KYC requirements / account registration process\n- Check that regular accounts require the collection of at least the following KYC information:\n     1) Full name\n     2) Date of birth of the applicant\n     3) Mobile number or unique reference number\n     4) National ID number or other identifying number "},{"$f":"'2'!L49","v":0},{"$f":"'2'!M49","v":"Urgent Required"},{"$f":"'2'!N49","v":"Required"},{"$f":"'2'!O49","v":"FraudRisk"},{"$f":"'2'!P49","v":0},{"$f":"'2'!Q49","v":0},{"$f":"'2'!R49","v":0},{"$f":"'2'!S49","v":0},{"$f":"'2'!T49","v":0},{"$f":"'2'!U49","v":0},{"$f":"'2'!V49","v":0},{"$f":"'2'!W49","v":0},{"$f":"'2'!X49","v":0},{"$f":"'2'!Y49","v":0},{"$f":"'2'!Z49","v":0},{"$f":"'2'!AA49","v":0},{"$f":"'2'!AB49","v":0},{"$f":"'2'!AC49","v":0},{"$f":"'2'!AD49","v":0},{"$f":"'2'!AE49","v":0},{"$f":"'2'!AF49","v":0},{"$f":"'2'!AG49","v":0},{"$f":"'2'!AH49","v":0},{"$f":"'2'!AI49","v":0},{"$f":"'2'!AJ49","v":0},{"$f":"'2'!AK49","v":0},{"$f":"'2'!AL49","v":0},{"$f":"'2'!AM49","v":0},{"$f":"'2'!AN49","v":0},{"$f":"'2'!AO49","v":0},{"$f":"'2'!AP49","v":0},{"$f":"'2'!AQ49","v":0},{"$f":"'2'!AR49","v":0},{"$f":"'2'!AS49","v":0},{"$f":"'2'!AT49","v":0},{"$f":"SUMPRODUCT(IF($N67=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N67=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B50","v":"2"},{"$f":"'2'!C50","v":"2.5"},{"$f":"'2'!D50","v":"2.5.1"},{"$f":"'2'!E50","v":""},{"$f":"'2'!F50","v":"2.5.1.3"},{"$f":"'2'!G50","v":0},{"$f":"'2'!H50","v":0},{"$f":"'2'!I50","v":"2.5.1.3.2"},{"$f":"'2'!J50","v":"2.5.1.3.2: In addition to the minimum KYC, is a photograph of the applicant taken for customers opening regular accounts?\n"},{"$f":"'2'!K50","v":0},{"$f":"'2'!L50","v":0},{"$f":"'2'!M50","v":"Recommended"},{"$f":"'2'!N50","v":"Recommended"},{"$f":"'2'!O50","v":"FraudRisk"},{"$f":"'2'!P50","v":0},{"$f":"'2'!Q50","v":0},{"$f":"'2'!R50","v":0},{"$f":"'2'!S50","v":0},{"$f":"'2'!T50","v":0},{"$f":"'2'!U50","v":0},{"$f":"'2'!V50","v":0},{"$f":"'2'!W50","v":0},{"$f":"'2'!X50","v":0},{"$f":"'2'!Y50","v":0},{"$f":"'2'!Z50","v":0},{"$f":"'2'!AA50","v":0},{"$f":"'2'!AB50","v":0},{"$f":"'2'!AC50","v":0},{"$f":"'2'!AD50","v":0},{"$f":"'2'!AE50","v":0},{"$f":"'2'!AF50","v":0},{"$f":"'2'!AG50","v":0},{"$f":"'2'!AH50","v":0},{"$f":"'2'!AI50","v":0},{"$f":"'2'!AJ50","v":0},{"$f":"'2'!AK50","v":0},{"$f":"'2'!AL50","v":0},{"$f":"'2'!AM50","v":0},{"$f":"'2'!AN50","v":0},{"$f":"'2'!AO50","v":0},{"$f":"'2'!AP50","v":0},{"$f":"'2'!AQ50","v":0},{"$f":"'2'!AR50","v":0},{"$f":"'2'!AS50","v":0},{"$f":"'2'!AT50","v":0},{"$f":"SUMPRODUCT(IF($N68=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N68=CategoryRecommended,1,0))","v":1},{"$f":"_xlfn.IFNA(MATCH($Q68,ComplianceYes,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q68,CompliancePartial,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q68,ComplianceNo,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q68,ComplianceNA,0),0)","v":0},{"$f":"$AU68*AW68","v":0},{"$f":"$AU68*AX68","v":0},{"$f":"$AU68*AY68","v":0},{"$f":"$AU68*AZ68","v":0},{"$f":"$AV68*AW68","v":0},{"$f":"$AV68*AX68","v":0},{"$f":"$AV68*AY68","v":0},{"$f":"$AV68*AZ68","v":0},{"$f":"_xlfn.IFNA(MATCH($AF68,ComplianceYes,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF68,CompliancePartial,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF68,ComplianceNo,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF68,ComplianceNA,0),0)","v":0},0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B51","v":"2"},{"$f":"'2'!C51","v":"2.5"},{"$f":"'2'!D51","v":"2.5.1"},{"$f":"'2'!E51","v":""},{"$f":"'2'!F51","v":"2.5.1.3"},{"$f":"'2'!G51","v":0},{"$f":"'2'!H51","v":0},{"$f":"'2'!I51","v":"2.5.1.3.3"},{"$f":"'2'!J51","v":"2.5.1.3.3: In addition to the minimum KYC, is the current residential address collected from customers opening regular accounts?\n"},{"$f":"'2'!K51","v":0},{"$f":"'2'!L51","v":0},{"$f":"'2'!M51","v":"Recommended"},{"$f":"'2'!N51","v":"Recommended"},{"$f":"'2'!O51","v":"FraudRisk"},{"$f":"'2'!P51","v":0},{"$f":"'2'!Q51","v":0},{"$f":"'2'!R51","v":0},{"$f":"'2'!S51","v":0},{"$f":"'2'!T51","v":0},{"$f":"'2'!U51","v":0},{"$f":"'2'!V51","v":0},{"$f":"'2'!W51","v":0},{"$f":"'2'!X51","v":0},{"$f":"'2'!Y51","v":0},{"$f":"'2'!Z51","v":0},{"$f":"'2'!AA51","v":0},{"$f":"'2'!AB51","v":0},{"$f":"'2'!AC51","v":0},{"$f":"'2'!AD51","v":0},{"$f":"'2'!AE51","v":0},{"$f":"'2'!AF51","v":0},{"$f":"'2'!AG51","v":0},{"$f":"'2'!AH51","v":0},{"$f":"'2'!AI51","v":0},{"$f":"'2'!AJ51","v":0},{"$f":"'2'!AK51","v":0},{"$f":"'2'!AL51","v":0},{"$f":"'2'!AM51","v":0},{"$f":"'2'!AN51","v":0},{"$f":"'2'!AO51","v":0},{"$f":"'2'!AP51","v":0},{"$f":"'2'!AQ51","v":0},{"$f":"'2'!AR51","v":0},{"$f":"'2'!AS51","v":0},{"$f":"'2'!AT51","v":0},{"$f":"SUMPRODUCT(IF($N69=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N69=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,{"$f":"$AU69*BI69","v":0},{"$f":"$AU69*BJ69","v":0},{"$f":"$AU69*BK69","v":0},{"$f":"$AU69*BL69","v":0},{"$f":"$AV69*BI69","v":0},{"$f":"$AV69*BJ69","v":0},{"$f":"$AV69*BK69","v":0},{"$f":"$AV69*BL69","v":0}]
[null,{"$f":"'2'!B52","v":"2"},{"$f":"'2'!C52","v":"2.5"},{"$f":"'2'!D52","v":"2.5.1"},{"$f":"'2'!E52","v":""},{"$f":"'2'!F52","v":"2.5.1.3"},{"$f":"'2'!G52","v":0},{"$f":"'2'!H52","v":0},{"$f":"'2'!I52","v":"2.5.1.3.4"},{"$f":"'2'!J52","v":"2.5.1.3.4: In addition to the minimum KYC, is the place of birth collected from customers opening regular accounts?\n"},{"$f":"'2'!K52","v":0},{"$f":"'2'!L52","v":0},{"$f":"'2'!M52","v":"Recommended"},{"$f":"'2'!N52","v":"Recommended"},{"$f":"'2'!O52","v":"FraudRisk"},{"$f":"'2'!P52","v":0},{"$f":"'2'!Q52","v":0},{"$f":"'2'!R52","v":0},{"$f":"'2'!S52","v":0},{"$f":"'2'!T52","v":0},{"$f":"'2'!U52","v":0},{"$f":"'2'!V52","v":0},{"$f":"'2'!W52","v":0},{"$f":"'2'!X52","v":0},{"$f":"'2'!Y52","v":0},{"$f":"'2'!Z52","v":0},{"$f":"'2'!AA52","v":0},{"$f":"'2'!AB52","v":0},{"$f":"'2'!AC52","v":0},{"$f":"'2'!AD52","v":0},{"$f":"'2'!AE52","v":0},{"$f":"'2'!AF52","v":0},{"$f":"'2'!AG52","v":0},{"$f":"'2'!AH52","v":0},{"$f":"'2'!AI52","v":0},{"$f":"'2'!AJ52","v":0},{"$f":"'2'!AK52","v":0},{"$f":"'2'!AL52","v":0},{"$f":"'2'!AM52","v":0},{"$f":"'2'!AN52","v":0},{"$f":"'2'!AO52","v":0},{"$f":"'2'!AP52","v":0},{"$f":"'2'!AQ52","v":0},{"$f":"'2'!AR52","v":0},{"$f":"'2'!AS52","v":0},{"$f":"'2'!AT52","v":0},{"$f":"SUMPRODUCT(IF($N70=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N70=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B53","v":"2"},{"$f":"'2'!C53","v":"2.5"},{"$f":"'2'!D53","v":"2.5.1"},{"$f":"'2'!E53","v":""},{"$f":"'2'!F53","v":"2.5.1.3"},{"$f":"'2'!G53","v":0},{"$f":"'2'!H53","v":0},{"$f":"'2'!I53","v":"2.5.1.3.5"},{"$f":"'2'!J53","v":"2.5.1.3.5: Do contracts with business customers oblige them to provide updated details to the provider whenever there is a material change in the business ownership or management?\n"},{"$f":"'2'!K53","v":0},{"$f":"'2'!L53","v":0},{"$f":"'2'!M53","v":"Recommended"},{"$f":"'2'!N53","v":"Recommended"},{"$f":"'2'!O53","v":"FraudRisk"},{"$f":"'2'!P53","v":0},{"$f":"'2'!Q53","v":0},{"$f":"'2'!R53","v":0},{"$f":"'2'!S53","v":0},{"$f":"'2'!T53","v":0},{"$f":"'2'!U53","v":0},{"$f":"'2'!V53","v":0},{"$f":"'2'!W53","v":0},{"$f":"'2'!X53","v":0},{"$f":"'2'!Y53","v":0},{"$f":"'2'!Z53","v":0},{"$f":"'2'!AA53","v":0},{"$f":"'2'!AB53","v":0},{"$f":"'2'!AC53","v":0},{"$f":"'2'!AD53","v":0},{"$f":"'2'!AE53","v":0},{"$f":"'2'!AF53","v":0},{"$f":"'2'!AG53","v":0},{"$f":"'2'!AH53","v":0},{"$f":"'2'!AI53","v":0},{"$f":"'2'!AJ53","v":0},{"$f":"'2'!AK53","v":0},{"$f":"'2'!AL53","v":0},{"$f":"'2'!AM53","v":0},{"$f":"'2'!AN53","v":0},{"$f":"'2'!AO53","v":0},{"$f":"'2'!AP53","v":0},{"$f":"'2'!AQ53","v":0},{"$f":"'2'!AR53","v":0},{"$f":"'2'!AS53","v":0},{"$f":"'2'!AT53","v":0},{"$f":"SUMPRODUCT(IF($N71=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N71=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B54","v":"2"},{"$f":"'2'!C54","v":"2.5"},{"$f":"'2'!D54","v":"2.5.1"},{"$f":"'2'!E54","v":""},{"$f":"'2'!F54","v":"2.5.1.4"},{"$f":"'2'!G54","v":"2.5.1.4: KYC FOR BUSINESS ACCOUNTS\nEnhanced customer information should be collected for business customers and merchants and their directors. Business accounts typically have higher transaction limits so the ML/TF risks are higher. \n\nThe minimum additional Business KYC information to be collected is:\n- Identification of owners of the business;\n- Identification of members of senior management of the business;\n\nBackground checks on the owners and senior management of the business, including a police check and bankruptcy check, should be made where possible, and the financial viability and reputation of the business should be established, taking references where necessary. Using a risk-based approach, providers should consider checking the source of a business customer's funds and, where appropriate, their income statements.\n\nData should be reviewed and updated annually and whenever there is a material change in the business ownership or management. Contracts with business customers should oblige them to provide updated details to the provider whenever there is a material change in the business ownership or management.\n\nReports should be run regularly to ensure that all business customers have complete KYC for their owners and senior managers."},{"$f":"'2'!H54","v":"GSMA RMT (FR.P-28)"},{"$f":"'2'!I54","v":"2.5.1.4.1"},{"$f":"'2'!J54","v":"2.5.1.4.1: Are the KYC requirements for business accounts documented; in particular, the requirement for identification of the owners and senior management of each business?\n"},{"$f":"'2'!K54","v":"1) KYC policy / KYC requirements / account registration process\n- Check that KYC requirements are specified for business accounts (e.g. certificate of incorporation or registration, Tax registration, Business licence or permit, Bank details, ID documents for owners and directors)\n- Check that business accounts require risk-based identity checks of owners and/or directors"},{"$f":"'2'!L54","v":0},{"$f":"'2'!M54","v":"Standard Required"},{"$f":"'2'!N54","v":"Required"},{"$f":"'2'!O54","v":"FraudRisk"},{"$f":"'2'!P54","v":0},{"$f":"'2'!Q54","v":0},{"$f":"'2'!R54","v":0},{"$f":"'2'!S54","v":0},{"$f":"'2'!T54","v":0},{"$f":"'2'!U54","v":0},{"$f":"'2'!V54","v":0},{"$f":"'2'!W54","v":0},{"$f":"'2'!X54","v":0},{"$f":"'2'!Y54","v":0},{"$f":"'2'!Z54","v":0},{"$f":"'2'!AA54","v":0},{"$f":"'2'!AB54","v":0},{"$f":"'2'!AC54","v":0},{"$f":"'2'!AD54","v":0},{"$f":"'2'!AE54","v":0},{"$f":"'2'!AF54","v":0},{"$f":"'2'!AG54","v":0},{"$f":"'2'!AH54","v":0},{"$f":"'2'!AI54","v":0},{"$f":"'2'!AJ54","v":0},{"$f":"'2'!AK54","v":0},{"$f":"'2'!AL54","v":0},{"$f":"'2'!AM54","v":0},{"$f":"'2'!AN54","v":0},{"$f":"'2'!AO54","v":0},{"$f":"'2'!AP54","v":0},{"$f":"'2'!AQ54","v":0},{"$f":"'2'!AR54","v":0},{"$f":"'2'!AS54","v":0},{"$f":"'2'!AT54","v":0},{"$f":"SUMPRODUCT(IF($N72=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N72=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B55","v":"2"},{"$f":"'2'!C55","v":"2.5"},{"$f":"'2'!D55","v":"2.5.1"},{"$f":"'2'!E55","v":""},{"$f":"'2'!F55","v":"2.5.1.4"},{"$f":"'2'!G55","v":0},{"$f":"'2'!H55","v":0},{"$f":"'2'!I55","v":"2.5.1.4.2"},{"$f":"'2'!J55","v":"2.5.1.4.2: Are suitable checks (e.g. police check, bankruptcy check, financial viability and reputation) are made on business customers, and references taken if necessary?\n"},{"$f":"'2'!K55","v":0},{"$f":"'2'!L55","v":0},{"$f":"'2'!M55","v":"Recommended"},{"$f":"'2'!N55","v":"Recommended"},{"$f":"'2'!O55","v":"FraudRisk"},{"$f":"'2'!P55","v":0},{"$f":"'2'!Q55","v":0},{"$f":"'2'!R55","v":0},{"$f":"'2'!S55","v":0},{"$f":"'2'!T55","v":0},{"$f":"'2'!U55","v":0},{"$f":"'2'!V55","v":0},{"$f":"'2'!W55","v":0},{"$f":"'2'!X55","v":0},{"$f":"'2'!Y55","v":0},{"$f":"'2'!Z55","v":0},{"$f":"'2'!AA55","v":0},{"$f":"'2'!AB55","v":0},{"$f":"'2'!AC55","v":0},{"$f":"'2'!AD55","v":0},{"$f":"'2'!AE55","v":0},{"$f":"'2'!AF55","v":0},{"$f":"'2'!AG55","v":0},{"$f":"'2'!AH55","v":0},{"$f":"'2'!AI55","v":0},{"$f":"'2'!AJ55","v":0},{"$f":"'2'!AK55","v":0},{"$f":"'2'!AL55","v":0},{"$f":"'2'!AM55","v":0},{"$f":"'2'!AN55","v":0},{"$f":"'2'!AO55","v":0},{"$f":"'2'!AP55","v":0},{"$f":"'2'!AQ55","v":0},{"$f":"'2'!AR55","v":0},{"$f":"'2'!AS55","v":0},{"$f":"'2'!AT55","v":0},{"$f":"SUMPRODUCT(IF($N73=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N73=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B56","v":"2"},{"$f":"'2'!C56","v":"2.5"},{"$f":"'2'!D56","v":"2.5.1"},{"$f":"'2'!E56","v":0},{"$f":"'2'!F56","v":"2.5.1.4"},{"$f":"'2'!G56","v":0},{"$f":"'2'!H56","v":0},{"$f":"'2'!I56","v":"2.5.1.4.3"},{"$f":"'2'!J56","v":"2.5.1.4.3: Is KYC data reviewed and updated as needed?\n"},{"$f":"'2'!K56","v":0},{"$f":"'2'!L56","v":0},{"$f":"'2'!M56","v":"Recommended"},{"$f":"'2'!N56","v":"Recommended"},{"$f":"'2'!O56","v":"FraudRisk"},{"$f":"'2'!P56","v":0},{"$f":"'2'!Q56","v":0},{"$f":"'2'!R56","v":0},{"$f":"'2'!S56","v":0},{"$f":"'2'!T56","v":0},{"$f":"'2'!U56","v":0},{"$f":"'2'!V56","v":0},{"$f":"'2'!W56","v":0},{"$f":"'2'!X56","v":0},{"$f":"'2'!Y56","v":0},{"$f":"'2'!Z56","v":0},{"$f":"'2'!AA56","v":0},{"$f":"'2'!AB56","v":0},{"$f":"'2'!AC56","v":0},{"$f":"'2'!AD56","v":0},{"$f":"'2'!AE56","v":0},{"$f":"'2'!AF56","v":0},{"$f":"'2'!AG56","v":0},{"$f":"'2'!AH56","v":0},{"$f":"'2'!AI56","v":0},{"$f":"'2'!AJ56","v":0},{"$f":"'2'!AK56","v":0},{"$f":"'2'!AL56","v":0},{"$f":"'2'!AM56","v":0},{"$f":"'2'!AN56","v":0},{"$f":"'2'!AO56","v":0},{"$f":"'2'!AP56","v":0},{"$f":"'2'!AQ56","v":0},{"$f":"'2'!AR56","v":0},{"$f":"'2'!AS56","v":0},{"$f":"'2'!AT56","v":0},{"$f":"SUMPRODUCT(IF($N74=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N74=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B57","v":"2"},{"$f":"'2'!C57","v":"2.5"},{"$f":"'2'!D57","v":"2.5.1"},{"$f":"'2'!E57","v":""},{"$f":"'2'!F57","v":"2.5.1.4"},{"$f":"'2'!G57","v":0},{"$f":"'2'!H57","v":0},{"$f":"'2'!I57","v":"2.5.1.4.4"},{"$f":"'2'!J57","v":"2.5.1.4.4: Do contracts with business customers oblige them to provide updated details to the provider whenever there is a material change in the business ownership or management?\n"},{"$f":"'2'!K57","v":0},{"$f":"'2'!L57","v":0},{"$f":"'2'!M57","v":"Recommended"},{"$f":"'2'!N57","v":"Recommended"},{"$f":"'2'!O57","v":"FraudRisk"},{"$f":"'2'!P57","v":0},{"$f":"'2'!Q57","v":0},{"$f":"'2'!R57","v":0},{"$f":"'2'!S57","v":0},{"$f":"'2'!T57","v":0},{"$f":"'2'!U57","v":0},{"$f":"'2'!V57","v":0},{"$f":"'2'!W57","v":0},{"$f":"'2'!X57","v":0},{"$f":"'2'!Y57","v":0},{"$f":"'2'!Z57","v":0},{"$f":"'2'!AA57","v":0},{"$f":"'2'!AB57","v":0},{"$f":"'2'!AC57","v":0},{"$f":"'2'!AD57","v":0},{"$f":"'2'!AE57","v":0},{"$f":"'2'!AF57","v":0},{"$f":"'2'!AG57","v":0},{"$f":"'2'!AH57","v":0},{"$f":"'2'!AI57","v":0},{"$f":"'2'!AJ57","v":0},{"$f":"'2'!AK57","v":0},{"$f":"'2'!AL57","v":0},{"$f":"'2'!AM57","v":0},{"$f":"'2'!AN57","v":0},{"$f":"'2'!AO57","v":0},{"$f":"'2'!AP57","v":0},{"$f":"'2'!AQ57","v":0},{"$f":"'2'!AR57","v":0},{"$f":"'2'!AS57","v":0},{"$f":"'2'!AT57","v":0},{"$f":"SUMPRODUCT(IF($N75=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N75=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B58","v":"2"},{"$f":"'2'!C58","v":"2.5"},{"$f":"'2'!D58","v":"2.5.1"},{"$f":"'2'!E58","v":""},{"$f":"'2'!F58","v":"2.5.1.5"},{"$f":"'2'!G58","v":"2.5.1.5: VERIFYING KYC  \nUnder a risk-based approach (which must meet regulatory requirements), various levels of verification can be considered, depending upon transaction/balance limits and other risk controls. More rigorous verification procedures should be employed for higher-value and higher-risk accounts (see definition of risk-based KYC). \n\nAs a minimum, the following should be done:\n- Verification of KYC at the time of registration by viewing the appropriate ID document. Verification should confirm that document exists, that it is not an obvious forgery, that the photo (if there is one) is visible and matches the customer, and that the document confirms the supplied KYC details. \n- Basic system-enforced verification to ensure completeness and spot obvious issues (e.g. Date of Birth is a valid date, all fields completed, ID not duplicated).\n- Risk-based review of the KYC data, to confirm completeness and to look for errors such as obviously-false names. This could be automated or semi-automated in the system.\nIn some countries, providers are required to make a copy of the provided ID document.\n\nIf required, verification can be enforced by blocking accounts of customers whose ID has not been verified within a short period of registration (e.g. a week). Additional limits (e.g. cash-in only or very low transaction limit) may be placed on the accounts until the KYC ID has been verified. \n\nIf suspicious activity occurs on the account, then it may be necessary to carry out additional due diligence."},{"$f":"'2'!H58","v":"GSMA RMT (FR.T-11\nAG-09 )"},{"$f":"'2'!I58","v":"2.5.1.5.1"},{"$f":"'2'!J58","v":"2.5.1.5.1: Is the KYC data verified at the time of registration, by the registering agent or by the provider, by viewing or copying suitable ID documentation?\n"},{"$f":"'2'!K58","v":"1) KYC policy / KYC requirements / account registration process\n- Check that the KYC information provided by the applicant during registration is verified by viewing the customer's identification documentation."},{"$f":"'2'!L58","v":0},{"$f":"'2'!M58","v":"Urgent Required"},{"$f":"'2'!N58","v":"Required"},{"$f":"'2'!O58","v":"FraudRisk"},{"$f":"'2'!P58","v":0},{"$f":"'2'!Q58","v":0},{"$f":"'2'!R58","v":0},{"$f":"'2'!S58","v":0},{"$f":"'2'!T58","v":0},{"$f":"'2'!U58","v":0},{"$f":"'2'!V58","v":0},{"$f":"'2'!W58","v":0},{"$f":"'2'!X58","v":0},{"$f":"'2'!Y58","v":0},{"$f":"'2'!Z58","v":0},{"$f":"'2'!AA58","v":0},{"$f":"'2'!AB58","v":0},{"$f":"'2'!AC58","v":0},{"$f":"'2'!AD58","v":0},{"$f":"'2'!AE58","v":0},{"$f":"'2'!AF58","v":0},{"$f":"'2'!AG58","v":0},{"$f":"'2'!AH58","v":0},{"$f":"'2'!AI58","v":0},{"$f":"'2'!AJ58","v":0},{"$f":"'2'!AK58","v":0},{"$f":"'2'!AL58","v":0},{"$f":"'2'!AM58","v":0},{"$f":"'2'!AN58","v":0},{"$f":"'2'!AO58","v":0},{"$f":"'2'!AP58","v":0},{"$f":"'2'!AQ58","v":0},{"$f":"'2'!AR58","v":0},{"$f":"'2'!AS58","v":0},{"$f":"'2'!AT58","v":0},{"$f":"SUMPRODUCT(IF($N76=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N76=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B59","v":"2"},{"$f":"'2'!C59","v":"2.5"},{"$f":"'2'!D59","v":"2.5.1"},{"$f":"'2'!E59","v":""},{"$f":"'2'!F59","v":"2.5.1.5"},{"$f":"'2'!G59","v":0},{"$f":"'2'!H59","v":0},{"$f":"'2'!I59","v":"2.5.1.5.2"},{"$f":"'2'!J59","v":"2.5.1.5.2: Is basic system-enforced verification performed to ensure completeness and to spot obvious issues (e.g. Date of Birth is a valid date, all fields completed)?\n"},{"$f":"'2'!K59","v":"1) Configuration of the customer registration platform.\n- Check that the system rejects applications that have obvious issues (e.g. Date of Birth is a valid date, all fields completed)"},{"$f":"'2'!L59","v":0},{"$f":"'2'!M59","v":"Standard Required"},{"$f":"'2'!N59","v":"Required"},{"$f":"'2'!O59","v":"FraudRisk"},{"$f":"'2'!P59","v":0},{"$f":"'2'!Q59","v":0},{"$f":"'2'!R59","v":0},{"$f":"'2'!S59","v":0},{"$f":"'2'!T59","v":0},{"$f":"'2'!U59","v":0},{"$f":"'2'!V59","v":0},{"$f":"'2'!W59","v":0},{"$f":"'2'!X59","v":0},{"$f":"'2'!Y59","v":0},{"$f":"'2'!Z59","v":0},{"$f":"'2'!AA59","v":0},{"$f":"'2'!AB59","v":0},{"$f":"'2'!AC59","v":0},{"$f":"'2'!AD59","v":0},{"$f":"'2'!AE59","v":0},{"$f":"'2'!AF59","v":0},{"$f":"'2'!AG59","v":0},{"$f":"'2'!AH59","v":0},{"$f":"'2'!AI59","v":0},{"$f":"'2'!AJ59","v":0},{"$f":"'2'!AK59","v":0},{"$f":"'2'!AL59","v":0},{"$f":"'2'!AM59","v":0},{"$f":"'2'!AN59","v":0},{"$f":"'2'!AO59","v":0},{"$f":"'2'!AP59","v":0},{"$f":"'2'!AQ59","v":0},{"$f":"'2'!AR59","v":0},{"$f":"'2'!AS59","v":0},{"$f":"'2'!AT59","v":0},{"$f":"SUMPRODUCT(IF($N77=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N77=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B60","v":"2"},{"$f":"'2'!C60","v":"2.5"},{"$f":"'2'!D60","v":"2.5.1"},{"$f":"'2'!E60","v":""},{"$f":"'2'!F60","v":"2.5.1.5"},{"$f":"'2'!G60","v":0},{"$f":"'2'!H60","v":0},{"$f":"'2'!I60","v":"2.5.1.5.3"},{"$f":"'2'!J60","v":"2.5.1.5.3: If regulation permits accounts to be opened without immediate verification of KYC data, is account functionality limited (through measures such as lower transaction and/or balance limits, limits on permitted services, etc.) to mitigate risk?\n"},{"$f":"'2'!K60","v":"1)  KYC policy / KYC requirements / account registration process\n- For accounts that are opened without immediate verification, check that account functionality is limited for the period before verification is complete\n\n2) Assessment of local AML/CFT regulatory requirements\n- Check that the provider has reviewed the limited functionality (for accounts with unverified KYC) in relation to local regulatory requirements.\n\n[This indicator should be marked N/A if not offered by the provider]"},{"$f":"'2'!L60","v":0},{"$f":"'2'!M60","v":"Standard Required"},{"$f":"'2'!N60","v":"Required"},{"$f":"'2'!O60","v":"FraudRisk"},{"$f":"'2'!P60","v":0},{"$f":"'2'!Q60","v":0},{"$f":"'2'!R60","v":0},{"$f":"'2'!S60","v":0},{"$f":"'2'!T60","v":0},{"$f":"'2'!U60","v":0},{"$f":"'2'!V60","v":0},{"$f":"'2'!W60","v":0},{"$f":"'2'!X60","v":0},{"$f":"'2'!Y60","v":0},{"$f":"'2'!Z60","v":0},{"$f":"'2'!AA60","v":0},{"$f":"'2'!AB60","v":0},{"$f":"'2'!AC60","v":0},{"$f":"'2'!AD60","v":0},{"$f":"'2'!AE60","v":0},{"$f":"'2'!AF60","v":0},{"$f":"'2'!AG60","v":0},{"$f":"'2'!AH60","v":0},{"$f":"'2'!AI60","v":0},{"$f":"'2'!AJ60","v":0},{"$f":"'2'!AK60","v":0},{"$f":"'2'!AL60","v":0},{"$f":"'2'!AM60","v":0},{"$f":"'2'!AN60","v":0},{"$f":"'2'!AO60","v":0},{"$f":"'2'!AP60","v":0},{"$f":"'2'!AQ60","v":0},{"$f":"'2'!AR60","v":0},{"$f":"'2'!AS60","v":0},{"$f":"'2'!AT60","v":0},{"$f":"SUMPRODUCT(IF($N78=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N78=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B61","v":"2"},{"$f":"'2'!C61","v":"2.5"},{"$f":"'2'!D61","v":"2.5.1"},{"$f":"'2'!E61","v":""},{"$f":"'2'!F61","v":"2.5.1.5"},{"$f":"'2'!G61","v":0},{"$f":"'2'!H61","v":0},{"$f":"'2'!I61","v":"2.5.1.5.4"},{"$f":"'2'!J61","v":"2.5.1.5.4: Are risk-based reviews (either automated or semi-automated) of customers' and businesses' KYC data performed to confirm completeness and to identify errors?\n"},{"$f":"'2'!K61","v":0},{"$f":"'2'!L61","v":0},{"$f":"'2'!M61","v":"Recommended"},{"$f":"'2'!N61","v":"Recommended"},{"$f":"'2'!O61","v":"FraudRisk"},{"$f":"'2'!P61","v":0},{"$f":"'2'!Q61","v":0},{"$f":"'2'!R61","v":0},{"$f":"'2'!S61","v":0},{"$f":"'2'!T61","v":0},{"$f":"'2'!U61","v":0},{"$f":"'2'!V61","v":0},{"$f":"'2'!W61","v":0},{"$f":"'2'!X61","v":0},{"$f":"'2'!Y61","v":0},{"$f":"'2'!Z61","v":0},{"$f":"'2'!AA61","v":0},{"$f":"'2'!AB61","v":0},{"$f":"'2'!AC61","v":0},{"$f":"'2'!AD61","v":0},{"$f":"'2'!AE61","v":0},{"$f":"'2'!AF61","v":0},{"$f":"'2'!AG61","v":0},{"$f":"'2'!AH61","v":0},{"$f":"'2'!AI61","v":0},{"$f":"'2'!AJ61","v":0},{"$f":"'2'!AK61","v":0},{"$f":"'2'!AL61","v":0},{"$f":"'2'!AM61","v":0},{"$f":"'2'!AN61","v":0},{"$f":"'2'!AO61","v":0},{"$f":"'2'!AP61","v":0},{"$f":"'2'!AQ61","v":0},{"$f":"'2'!AR61","v":0},{"$f":"'2'!AS61","v":0},{"$f":"'2'!AT61","v":0},{"$f":"SUMPRODUCT(IF($N79=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N79=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B62","v":"2"},{"$f":"'2'!C62","v":"2.5"},{"$f":"'2'!D62","v":"2.5.1"},{"$f":"'2'!E62","v":""},{"$f":"'2'!F62","v":"2.5.1.5"},{"$f":"'2'!G62","v":0},{"$f":"'2'!H62","v":0},{"$f":"'2'!I62","v":"2.5.1.5.5"},{"$f":"'2'!J62","v":"2.5.1.5.5: For customers whose ID has not been verified within a period of time (e.g. a week), does the system automatically block their accounts to enforce verification of ID (unless an exemption to the verification requirement exists for low-value accounts)?\n"},{"$f":"'2'!K62","v":0},{"$f":"'2'!L62","v":0},{"$f":"'2'!M62","v":"Recommended"},{"$f":"'2'!N62","v":"Recommended"},{"$f":"'2'!O62","v":"FraudRisk"},{"$f":"'2'!P62","v":0},{"$f":"'2'!Q62","v":0},{"$f":"'2'!R62","v":0},{"$f":"'2'!S62","v":0},{"$f":"'2'!T62","v":0},{"$f":"'2'!U62","v":0},{"$f":"'2'!V62","v":0},{"$f":"'2'!W62","v":0},{"$f":"'2'!X62","v":0},{"$f":"'2'!Y62","v":0},{"$f":"'2'!Z62","v":0},{"$f":"'2'!AA62","v":0},{"$f":"'2'!AB62","v":0},{"$f":"'2'!AC62","v":0},{"$f":"'2'!AD62","v":0},{"$f":"'2'!AE62","v":0},{"$f":"'2'!AF62","v":0},{"$f":"'2'!AG62","v":0},{"$f":"'2'!AH62","v":0},{"$f":"'2'!AI62","v":0},{"$f":"'2'!AJ62","v":0},{"$f":"'2'!AK62","v":0},{"$f":"'2'!AL62","v":0},{"$f":"'2'!AM62","v":0},{"$f":"'2'!AN62","v":0},{"$f":"'2'!AO62","v":0},{"$f":"'2'!AP62","v":0},{"$f":"'2'!AQ62","v":0},{"$f":"'2'!AR62","v":0},{"$f":"'2'!AS62","v":0},{"$f":"'2'!AT62","v":0},{"$f":"SUMPRODUCT(IF($N80=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N80=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B63","v":"2"},{"$f":"'2'!C63","v":"2.5"},{"$f":"'2'!D63","v":"2.5.1"},{"$f":"'2'!E63","v":""},{"$f":"'2'!F63","v":"2.5.1.5"},{"$f":"'2'!G63","v":0},{"$f":"'2'!H63","v":0},{"$f":"'2'!I63","v":"2.5.1.5.6"},{"$f":"'2'!J63","v":"2.5.1.5.6: In case of suspicious activity, is additional KYC due diligence carried out?\n"},{"$f":"'2'!K63","v":0},{"$f":"'2'!L63","v":0},{"$f":"'2'!M63","v":"Recommended"},{"$f":"'2'!N63","v":"Recommended"},{"$f":"'2'!O63","v":"FraudRisk"},{"$f":"'2'!P63","v":0},{"$f":"'2'!Q63","v":0},{"$f":"'2'!R63","v":0},{"$f":"'2'!S63","v":0},{"$f":"'2'!T63","v":0},{"$f":"'2'!U63","v":0},{"$f":"'2'!V63","v":0},{"$f":"'2'!W63","v":0},{"$f":"'2'!X63","v":0},{"$f":"'2'!Y63","v":0},{"$f":"'2'!Z63","v":0},{"$f":"'2'!AA63","v":0},{"$f":"'2'!AB63","v":0},{"$f":"'2'!AC63","v":0},{"$f":"'2'!AD63","v":0},{"$f":"'2'!AE63","v":0},{"$f":"'2'!AF63","v":0},{"$f":"'2'!AG63","v":0},{"$f":"'2'!AH63","v":0},{"$f":"'2'!AI63","v":0},{"$f":"'2'!AJ63","v":0},{"$f":"'2'!AK63","v":0},{"$f":"'2'!AL63","v":0},{"$f":"'2'!AM63","v":0},{"$f":"'2'!AN63","v":0},{"$f":"'2'!AO63","v":0},{"$f":"'2'!AP63","v":0},{"$f":"'2'!AQ63","v":0},{"$f":"'2'!AR63","v":0},{"$f":"'2'!AS63","v":0},{"$f":"'2'!AT63","v":0},{"$f":"SUMPRODUCT(IF($N81=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N81=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B64","v":"2"},{"$f":"'2'!C64","v":"2.5"},{"$f":"'2'!D64","v":"2.5.1"},{"$f":"'2'!E64","v":""},{"$f":"'2'!F64","v":"2.5.1.6"},{"$f":"'2'!G64","v":"2.5.1.6: VERIFYING KYC AGAINST MOBILE PHONE RECORDS\nProviders should regularly reconcile their mobile money system with their mobile phone CRM system to identify accounts where the customer information does not match.\n\nWhere information does not match, providers should identify whether this is expected and acceptable (e.g. because an employer or family member is paying for postpaid service). If not, the discrepancy should be investigated."},{"$f":"'2'!H64","v":"GSMA RMT (FR.T-11)"},{"$f":"'2'!I64","v":"2.5.1.6.1"},{"$f":"'2'!J64","v":"2.5.1.6.1: Are customers' KYC details cross-checked against ID records held with the mobile phone CRM accounts to identify accounts where the customer information does not match?\n"},{"$f":"'2'!K64","v":0},{"$f":"'2'!L64","v":0},{"$f":"'2'!M64","v":"Recommended"},{"$f":"'2'!N64","v":"Recommended"},{"$f":"'2'!O64","v":"FraudRisk"},{"$f":"'2'!P64","v":0},{"$f":"'2'!Q64","v":0},{"$f":"'2'!R64","v":0},{"$f":"'2'!S64","v":0},{"$f":"'2'!T64","v":0},{"$f":"'2'!U64","v":0},{"$f":"'2'!V64","v":0},{"$f":"'2'!W64","v":0},{"$f":"'2'!X64","v":0},{"$f":"'2'!Y64","v":0},{"$f":"'2'!Z64","v":0},{"$f":"'2'!AA64","v":0},{"$f":"'2'!AB64","v":0},{"$f":"'2'!AC64","v":0},{"$f":"'2'!AD64","v":0},{"$f":"'2'!AE64","v":0},{"$f":"'2'!AF64","v":0},{"$f":"'2'!AG64","v":0},{"$f":"'2'!AH64","v":0},{"$f":"'2'!AI64","v":0},{"$f":"'2'!AJ64","v":0},{"$f":"'2'!AK64","v":0},{"$f":"'2'!AL64","v":0},{"$f":"'2'!AM64","v":0},{"$f":"'2'!AN64","v":0},{"$f":"'2'!AO64","v":0},{"$f":"'2'!AP64","v":0},{"$f":"'2'!AQ64","v":0},{"$f":"'2'!AR64","v":0},{"$f":"'2'!AS64","v":0},{"$f":"'2'!AT64","v":0},{"$f":"SUMPRODUCT(IF($N82=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N82=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B65","v":"2"},{"$f":"'2'!C65","v":"2.5"},{"$f":"'2'!D65","v":"2.5.1"},{"$f":"'2'!E65","v":""},{"$f":"'2'!F65","v":"2.5.1.6"},{"$f":"'2'!G65","v":0},{"$f":"'2'!H65","v":0},{"$f":"'2'!I65","v":"2.5.1.6.2"},{"$f":"'2'!J65","v":"2.5.1.6.2: In case a customer's KYC does not match their mobile phone CRM record, does the verification policy and process specify the appropriate action to identify whether this is expected and acceptable (e.g. because an employer or family member is paying for postpaid service) and to investigate the discrepancy if necessary?\n"},{"$f":"'2'!K65","v":0},{"$f":"'2'!L65","v":0},{"$f":"'2'!M65","v":"Recommended"},{"$f":"'2'!N65","v":"Recommended"},{"$f":"'2'!O65","v":"FraudRisk"},{"$f":"'2'!P65","v":0},{"$f":"'2'!Q65","v":0},{"$f":"'2'!R65","v":0},{"$f":"'2'!S65","v":0},{"$f":"'2'!T65","v":0},{"$f":"'2'!U65","v":0},{"$f":"'2'!V65","v":0},{"$f":"'2'!W65","v":0},{"$f":"'2'!X65","v":0},{"$f":"'2'!Y65","v":0},{"$f":"'2'!Z65","v":0},{"$f":"'2'!AA65","v":0},{"$f":"'2'!AB65","v":0},{"$f":"'2'!AC65","v":0},{"$f":"'2'!AD65","v":0},{"$f":"'2'!AE65","v":0},{"$f":"'2'!AF65","v":0},{"$f":"'2'!AG65","v":0},{"$f":"'2'!AH65","v":0},{"$f":"'2'!AI65","v":0},{"$f":"'2'!AJ65","v":0},{"$f":"'2'!AK65","v":0},{"$f":"'2'!AL65","v":0},{"$f":"'2'!AM65","v":0},{"$f":"'2'!AN65","v":0},{"$f":"'2'!AO65","v":0},{"$f":"'2'!AP65","v":0},{"$f":"'2'!AQ65","v":0},{"$f":"'2'!AR65","v":0},{"$f":"'2'!AS65","v":0},{"$f":"'2'!AT65","v":0},{"$f":"SUMPRODUCT(IF($N83=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N83=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B66","v":"2"},{"$f":"'2'!C66","v":"2.5"},{"$f":"'2'!D66","v":"2.5.1"},{"$f":"'2'!E66","v":""},{"$f":"'2'!F66","v":"2.5.1.7"},{"$f":"'2'!G66","v":"2.5.1.7: CHECKING IDENTITY DURING CASH-IN/CASH-OUT TRANSACTIONS\nProviders should ensure that agents consistently perform identity checks on the customer at cash-out, as a final check point to stop fraudsters and money launderers from liquidating e-money. It is recommended also to perform identity checks at cash-in too, to reduce the risk of direct deposits (see 2.7.1).\n\nA report should be created for all cash-in/out transactions that are rejected due to authentication failure (e.g. wrong PIN or lack of ID), with a process implemented for the AML/CFT team to review the report regularly."},{"$f":"'2'!H66","v":"GSMA RMT (FR.P-16\nFR.T-08)"},{"$f":"'2'!I66","v":"2.5.1.7.1"},{"$f":"'2'!J66","v":"2.5.1.7.1: Is the identity of the customer systematically checked by the agent at cash-out?\n"},{"$f":"'2'!K66","v":0},{"$f":"'2'!L66","v":0},{"$f":"'2'!M66","v":"Recommended"},{"$f":"'2'!N66","v":"Recommended"},{"$f":"'2'!O66","v":"FraudRisk"},{"$f":"'2'!P66","v":0},{"$f":"'2'!Q66","v":0},{"$f":"'2'!R66","v":0},{"$f":"'2'!S66","v":0},{"$f":"'2'!T66","v":0},{"$f":"'2'!U66","v":0},{"$f":"'2'!V66","v":0},{"$f":"'2'!W66","v":0},{"$f":"'2'!X66","v":0},{"$f":"'2'!Y66","v":0},{"$f":"'2'!Z66","v":0},{"$f":"'2'!AA66","v":0},{"$f":"'2'!AB66","v":0},{"$f":"'2'!AC66","v":0},{"$f":"'2'!AD66","v":0},{"$f":"'2'!AE66","v":0},{"$f":"'2'!AF66","v":0},{"$f":"'2'!AG66","v":0},{"$f":"'2'!AH66","v":0},{"$f":"'2'!AI66","v":0},{"$f":"'2'!AJ66","v":0},{"$f":"'2'!AK66","v":0},{"$f":"'2'!AL66","v":0},{"$f":"'2'!AM66","v":0},{"$f":"'2'!AN66","v":0},{"$f":"'2'!AO66","v":0},{"$f":"'2'!AP66","v":0},{"$f":"'2'!AQ66","v":0},{"$f":"'2'!AR66","v":0},{"$f":"'2'!AS66","v":0},{"$f":"'2'!AT66","v":0},{"$f":"SUMPRODUCT(IF($N84=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N84=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B67","v":"2"},{"$f":"'2'!C67","v":"2.5"},{"$f":"'2'!D67","v":"2.5.1"},{"$f":"'2'!E67","v":""},{"$f":"'2'!F67","v":"2.5.1.7"},{"$f":"'2'!G67","v":0},{"$f":"'2'!H67","v":0},{"$f":"'2'!I67","v":"2.5.1.7.2"},{"$f":"'2'!J67","v":"2.5.1.7.2: Does the AML/CFT team regularly review a report of all cash-in/out transactions that are rejected due to identity check failure?\n"},{"$f":"'2'!K67","v":0},{"$f":"'2'!L67","v":0},{"$f":"'2'!M67","v":"Recommended"},{"$f":"'2'!N67","v":"Recommended"},{"$f":"'2'!O67","v":"FraudRisk"},{"$f":"'2'!P67","v":0},{"$f":"'2'!Q67","v":0},{"$f":"'2'!R67","v":0},{"$f":"'2'!S67","v":0},{"$f":"'2'!T67","v":0},{"$f":"'2'!U67","v":0},{"$f":"'2'!V67","v":0},{"$f":"'2'!W67","v":0},{"$f":"'2'!X67","v":0},{"$f":"'2'!Y67","v":0},{"$f":"'2'!Z67","v":0},{"$f":"'2'!AA67","v":0},{"$f":"'2'!AB67","v":0},{"$f":"'2'!AC67","v":0},{"$f":"'2'!AD67","v":0},{"$f":"'2'!AE67","v":0},{"$f":"'2'!AF67","v":0},{"$f":"'2'!AG67","v":0},{"$f":"'2'!AH67","v":0},{"$f":"'2'!AI67","v":0},{"$f":"'2'!AJ67","v":0},{"$f":"'2'!AK67","v":0},{"$f":"'2'!AL67","v":0},{"$f":"'2'!AM67","v":0},{"$f":"'2'!AN67","v":0},{"$f":"'2'!AO67","v":0},{"$f":"'2'!AP67","v":0},{"$f":"'2'!AQ67","v":0},{"$f":"'2'!AR67","v":0},{"$f":"'2'!AS67","v":0},{"$f":"'2'!AT67","v":0},{"$f":"SUMPRODUCT(IF($N85=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N85=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B68","v":"2"},{"$f":"'2'!C68","v":"2.5"},{"$f":"'2'!D68","v":"2.5.2"},{"$f":"'2'!E68","v":"2.5.2: Providers shall place appropriate risk-based transaction and balance limits on accounts, depending upon the strength of customer identification and verification"},{"$f":"'2'!F68","v":"2.5.2.1"},{"$f":"'2'!G68","v":"2.5.2.1: TRANSACTION AND BALANCE LIMITS BASED ON KYC TIER\nTransaction and balance limits should be assigned to each tier and enforced by the system to limit the risk of abuse of the service (for fraud, money laundering or terrorist financing). Transactions that would breach a transaction or balance limit should be prevented.\n\nProviders should establish some or all of the following limits:\n- Maximum value of a single transaction;\n- Total value of transactions per day, week, month, 3 months, and/or year. Limits for inbound and outbound transactions could be different;\n- Total number of transactions per day, week, month, 3 months, and/or year; \n- Limit on the maximum balance that may be stored at any time.\n\nIf warranted due to risk assessments and/or required by regulation, providers may limit lower-tier customers to domestic transfers only and/or prevent them from accessing other financial ecosystem products, such as savings accounts."},{"$f":"'2'!H68","v":"GSMA RMT (FR.T-12\nFR.P-27\nFR.P-32)"},{"$f":"'2'!I68","v":"2.5.2.1.1"},{"$f":"'2'!J68","v":"2.5.2.1.1: Are transaction and balance limits assigned to each KYC tier of customer accounts and enforced by the system?\n"},{"$f":"'2'!K68","v":"1) MM system functional specification\n - Transaction limits: check that the system is confgured to block transactions once a threshold is met, and that this is customised to each KYC tier."},{"$f":"'2'!L68","v":0},{"$f":"'2'!M68","v":"Urgent Required"},{"$f":"'2'!N68","v":"Required"},{"$f":"'2'!O68","v":"FraudRisk"},{"$f":"'2'!P68","v":0},{"$f":"'2'!Q68","v":0},{"$f":"'2'!R68","v":0},{"$f":"'2'!S68","v":0},{"$f":"'2'!T68","v":0},{"$f":"'2'!U68","v":0},{"$f":"'2'!V68","v":0},{"$f":"'2'!W68","v":0},{"$f":"'2'!X68","v":0},{"$f":"'2'!Y68","v":0},{"$f":"'2'!Z68","v":0},{"$f":"'2'!AA68","v":0},{"$f":"'2'!AB68","v":0},{"$f":"'2'!AC68","v":0},{"$f":"'2'!AD68","v":0},{"$f":"'2'!AE68","v":0},{"$f":"'2'!AF68","v":0},{"$f":"'2'!AG68","v":0},{"$f":"'2'!AH68","v":0},{"$f":"'2'!AI68","v":0},{"$f":"'2'!AJ68","v":0},{"$f":"'2'!AK68","v":0},{"$f":"'2'!AL68","v":0},{"$f":"'2'!AM68","v":0},{"$f":"'2'!AN68","v":0},{"$f":"'2'!AO68","v":0},{"$f":"'2'!AP68","v":0},{"$f":"'2'!AQ68","v":0},{"$f":"'2'!AR68","v":0},{"$f":"'2'!AS68","v":0},{"$f":"'2'!AT68","v":0},{"$f":"SUMPRODUCT(IF($N86=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N86=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B69","v":"2"},{"$f":"'2'!C69","v":"2.5"},{"$f":"'2'!D69","v":"2.5.2"},{"$f":"'2'!E69","v":0},{"$f":"'2'!F69","v":"2.5.2.1"},{"$f":"'2'!G69","v":0},{"$f":"'2'!H69","v":0},{"$f":"'2'!I69","v":"2.5.2.1.2"},{"$f":"'2'!J69","v":"2.5.2.1.2: Do higher transaction/balance limits (if applicable) require more KYC and stronger verification?\n"},{"$f":"'2'!K69","v":"1) KYC policy / KYC requirements / account registration process\n- Check that more KYC and verification is required for higher transaction/balance limits."},{"$f":"'2'!L69","v":0},{"$f":"'2'!M69","v":"Standard Required"},{"$f":"'2'!N69","v":"Required"},{"$f":"'2'!O69","v":"FraudRisk"},{"$f":"'2'!P69","v":0},{"$f":"'2'!Q69","v":0},{"$f":"'2'!R69","v":0},{"$f":"'2'!S69","v":0},{"$f":"'2'!T69","v":0},{"$f":"'2'!U69","v":0},{"$f":"'2'!V69","v":0},{"$f":"'2'!W69","v":0},{"$f":"'2'!X69","v":0},{"$f":"'2'!Y69","v":0},{"$f":"'2'!Z69","v":0},{"$f":"'2'!AA69","v":0},{"$f":"'2'!AB69","v":0},{"$f":"'2'!AC69","v":0},{"$f":"'2'!AD69","v":0},{"$f":"'2'!AE69","v":0},{"$f":"'2'!AF69","v":0},{"$f":"'2'!AG69","v":0},{"$f":"'2'!AH69","v":0},{"$f":"'2'!AI69","v":0},{"$f":"'2'!AJ69","v":0},{"$f":"'2'!AK69","v":0},{"$f":"'2'!AL69","v":0},{"$f":"'2'!AM69","v":0},{"$f":"'2'!AN69","v":0},{"$f":"'2'!AO69","v":0},{"$f":"'2'!AP69","v":0},{"$f":"'2'!AQ69","v":0},{"$f":"'2'!AR69","v":0},{"$f":"'2'!AS69","v":0},{"$f":"'2'!AT69","v":0},{"$f":"SUMPRODUCT(IF($N87=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N87=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B70","v":"2"},{"$f":"'2'!C70","v":"2.5"},{"$f":"'2'!D70","v":"2.5.2"},{"$f":"'2'!E70","v":0},{"$f":"'2'!F70","v":"2.5.2.1"},{"$f":"'2'!G70","v":0},{"$f":"'2'!H70","v":0},{"$f":"'2'!I70","v":"2.5.2.1.3"},{"$f":"'2'!J70","v":"2.5.2.1.3: If warranted due to risk assessments and/or required by regulation, are lower-tier customers restricted to lower-risk products only?\n"},{"$f":"'2'!K70","v":0},{"$f":"'2'!L70","v":0},{"$f":"'2'!M70","v":"Recommended"},{"$f":"'2'!N70","v":"Recommended"},{"$f":"'2'!O70","v":"FraudRisk"},{"$f":"'2'!P70","v":0},{"$f":"'2'!Q70","v":0},{"$f":"'2'!R70","v":0},{"$f":"'2'!S70","v":0},{"$f":"'2'!T70","v":0},{"$f":"'2'!U70","v":0},{"$f":"'2'!V70","v":0},{"$f":"'2'!W70","v":0},{"$f":"'2'!X70","v":0},{"$f":"'2'!Y70","v":0},{"$f":"'2'!Z70","v":0},{"$f":"'2'!AA70","v":0},{"$f":"'2'!AB70","v":0},{"$f":"'2'!AC70","v":0},{"$f":"'2'!AD70","v":0},{"$f":"'2'!AE70","v":0},{"$f":"'2'!AF70","v":0},{"$f":"'2'!AG70","v":0},{"$f":"'2'!AH70","v":0},{"$f":"'2'!AI70","v":0},{"$f":"'2'!AJ70","v":0},{"$f":"'2'!AK70","v":0},{"$f":"'2'!AL70","v":0},{"$f":"'2'!AM70","v":0},{"$f":"'2'!AN70","v":0},{"$f":"'2'!AO70","v":0},{"$f":"'2'!AP70","v":0},{"$f":"'2'!AQ70","v":0},{"$f":"'2'!AR70","v":0},{"$f":"'2'!AS70","v":0},{"$f":"'2'!AT70","v":0},{"$f":"SUMPRODUCT(IF($N88=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N88=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B71","v":"2"},{"$f":"'2'!C71","v":"2.5"},{"$f":"'2'!D71","v":"2.5.2"},{"$f":"'2'!E71","v":0},{"$f":"'2'!F71","v":"2.5.2.2"},{"$f":"'2'!G71","v":"2.5.2.2: TRANSACTION AND BALANCE LIMITS: MULTIPLE ACCOUNTS\nThe provider should set limits on the number of accounts a customer / business can hold. If more than  one account is permitted, the transaction and balance limits should be applied to the aggregate total of transactions/balances across the accounts."},{"$f":"'2'!H71","v":"GSMA RMT (FR.P-03)"},{"$f":"'2'!I71","v":"2.5.2.2.1"},{"$f":"'2'!J71","v":"2.5.2.2.1: Does the AML/CFT policy specify a limit on the number of accounts that a customer / business can hold?\n"},{"$f":"'2'!K71","v":0},{"$f":"'2'!L71","v":0},{"$f":"'2'!M71","v":"Recommended"},{"$f":"'2'!N71","v":"Recommended"},{"$f":"'2'!O71","v":"FraudRisk"},{"$f":"'2'!P71","v":0},{"$f":"'2'!Q71","v":0},{"$f":"'2'!R71","v":0},{"$f":"'2'!S71","v":0},{"$f":"'2'!T71","v":0},{"$f":"'2'!U71","v":0},{"$f":"'2'!V71","v":0},{"$f":"'2'!W71","v":0},{"$f":"'2'!X71","v":0},{"$f":"'2'!Y71","v":0},{"$f":"'2'!Z71","v":0},{"$f":"'2'!AA71","v":0},{"$f":"'2'!AB71","v":0},{"$f":"'2'!AC71","v":0},{"$f":"'2'!AD71","v":0},{"$f":"'2'!AE71","v":0},{"$f":"'2'!AF71","v":0},{"$f":"'2'!AG71","v":0},{"$f":"'2'!AH71","v":0},{"$f":"'2'!AI71","v":0},{"$f":"'2'!AJ71","v":0},{"$f":"'2'!AK71","v":0},{"$f":"'2'!AL71","v":0},{"$f":"'2'!AM71","v":0},{"$f":"'2'!AN71","v":0},{"$f":"'2'!AO71","v":0},{"$f":"'2'!AP71","v":0},{"$f":"'2'!AQ71","v":0},{"$f":"'2'!AR71","v":0},{"$f":"'2'!AS71","v":0},{"$f":"'2'!AT71","v":0},{"$f":"SUMPRODUCT(IF($N89=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N89=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B72","v":"2"},{"$f":"'2'!C72","v":"2.5"},{"$f":"'2'!D72","v":"2.5.2"},{"$f":"'2'!E72","v":0},{"$f":"'2'!F72","v":"2.5.2.2"},{"$f":"'2'!G72","v":0},{"$f":"'2'!H72","v":0},{"$f":"'2'!I72","v":"2.5.2.2.2"},{"$f":"'2'!J72","v":"2.5.2.2.2: Are system and process controls in place to enforce the limit on the number of accounts that a customer / business can hold?\n"},{"$f":"'2'!K72","v":0},{"$f":"'2'!L72","v":0},{"$f":"'2'!M72","v":"Recommended"},{"$f":"'2'!N72","v":"Recommended"},{"$f":"'2'!O72","v":"FraudRisk"},{"$f":"'2'!P72","v":0},{"$f":"'2'!Q72","v":0},{"$f":"'2'!R72","v":0},{"$f":"'2'!S72","v":0},{"$f":"'2'!T72","v":0},{"$f":"'2'!U72","v":0},{"$f":"'2'!V72","v":0},{"$f":"'2'!W72","v":0},{"$f":"'2'!X72","v":0},{"$f":"'2'!Y72","v":0},{"$f":"'2'!Z72","v":0},{"$f":"'2'!AA72","v":0},{"$f":"'2'!AB72","v":0},{"$f":"'2'!AC72","v":0},{"$f":"'2'!AD72","v":0},{"$f":"'2'!AE72","v":0},{"$f":"'2'!AF72","v":0},{"$f":"'2'!AG72","v":0},{"$f":"'2'!AH72","v":0},{"$f":"'2'!AI72","v":0},{"$f":"'2'!AJ72","v":0},{"$f":"'2'!AK72","v":0},{"$f":"'2'!AL72","v":0},{"$f":"'2'!AM72","v":0},{"$f":"'2'!AN72","v":0},{"$f":"'2'!AO72","v":0},{"$f":"'2'!AP72","v":0},{"$f":"'2'!AQ72","v":0},{"$f":"'2'!AR72","v":0},{"$f":"'2'!AS72","v":0},{"$f":"'2'!AT72","v":0},{"$f":"SUMPRODUCT(IF($N90=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N90=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B73","v":"2"},{"$f":"'2'!C73","v":"2.5"},{"$f":"'2'!D73","v":"2.5.2"},{"$f":"'2'!E73","v":0},{"$f":"'2'!F73","v":"2.5.2.2"},{"$f":"'2'!G73","v":0},{"$f":"'2'!H73","v":0},{"$f":"'2'!I73","v":"2.5.2.2.3"},{"$f":"'2'!J73","v":"2.5.2.2.3: If more than one account is permitted, are transaction and balance limits correctly applied to the aggregate total of transactions/balances across the accounts, or are other controls implemented, based on risk assessment?\n"},{"$f":"'2'!K73","v":0},{"$f":"'2'!L73","v":0},{"$f":"'2'!M73","v":"Recommended"},{"$f":"'2'!N73","v":"Recommended"},{"$f":"'2'!O73","v":"FraudRisk"},{"$f":"'2'!P73","v":0},{"$f":"'2'!Q73","v":0},{"$f":"'2'!R73","v":0},{"$f":"'2'!S73","v":0},{"$f":"'2'!T73","v":0},{"$f":"'2'!U73","v":0},{"$f":"'2'!V73","v":0},{"$f":"'2'!W73","v":0},{"$f":"'2'!X73","v":0},{"$f":"'2'!Y73","v":0},{"$f":"'2'!Z73","v":0},{"$f":"'2'!AA73","v":0},{"$f":"'2'!AB73","v":0},{"$f":"'2'!AC73","v":0},{"$f":"'2'!AD73","v":0},{"$f":"'2'!AE73","v":0},{"$f":"'2'!AF73","v":0},{"$f":"'2'!AG73","v":0},{"$f":"'2'!AH73","v":0},{"$f":"'2'!AI73","v":0},{"$f":"'2'!AJ73","v":0},{"$f":"'2'!AK73","v":0},{"$f":"'2'!AL73","v":0},{"$f":"'2'!AM73","v":0},{"$f":"'2'!AN73","v":0},{"$f":"'2'!AO73","v":0},{"$f":"'2'!AP73","v":0},{"$f":"'2'!AQ73","v":0},{"$f":"'2'!AR73","v":0},{"$f":"'2'!AS73","v":0},{"$f":"'2'!AT73","v":0},{"$f":"SUMPRODUCT(IF($N91=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N91=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B74","v":"2"},{"$f":"'2'!C74","v":"2.5"},{"$f":"'2'!D74","v":"2.5.3"},{"$f":"'2'!E74","v":"2.5.3: Providers shall have the ability to block account transactions under certain circumstances"},{"$f":"'2'!F74","v":"2.5.3.1"},{"$f":"'2'!G74","v":"2.5.3.1: ACCOUNT-BLOCKING\nThe account-blocking mechanism should prevent accounts from being used under carefully-defined circumstances. Some of the circumstances under which providers could decide to block accounts include:\n- Prior to completion of identification and verification (subject to any exceptions for verification of low-value accounts, as noted in 2.5.1.2); \n- If required to do so by a competent authority;\n- If an account has become compromised or when a trigger event occurs on the account which indicates ML/TF may have occurred;\n- If an account has been fraudulently created;\n- If there is doubt that the KYC information is correct or if a customer has refused to provide additional KYC information requested;\n- When it is discovered that the customer has more than the maximum number of permitted accounts;\n- When a handset known to have been used for fraudulent activities is used with the account (e.g. identified by IMEI);\n"},{"$f":"'2'!H74","v":"GSMA RMT (FR.P-12)"},{"$f":"'2'!I74","v":"2.5.3.1.1"},{"$f":"'2'!J74","v":"2.5.3.1.1: Is there documentation that specifies the situations when accounts should be blocked?\n"},{"$f":"'2'!K74","v":"1) AML/CFT policy or process documentation\n- Check that there is documentation that specifies when an account should be blocked."},{"$f":"'2'!L74","v":0},{"$f":"'2'!M74","v":"Urgent Required"},{"$f":"'2'!N74","v":"Required"},{"$f":"'2'!O74","v":"FraudRisk"},{"$f":"'2'!P74","v":0},{"$f":"'2'!Q74","v":0},{"$f":"'2'!R74","v":0},{"$f":"'2'!S74","v":0},{"$f":"'2'!T74","v":0},{"$f":"'2'!U74","v":0},{"$f":"'2'!V74","v":0},{"$f":"'2'!W74","v":0},{"$f":"'2'!X74","v":0},{"$f":"'2'!Y74","v":0},{"$f":"'2'!Z74","v":0},{"$f":"'2'!AA74","v":0},{"$f":"'2'!AB74","v":0},{"$f":"'2'!AC74","v":0},{"$f":"'2'!AD74","v":0},{"$f":"'2'!AE74","v":0},{"$f":"'2'!AF74","v":0},{"$f":"'2'!AG74","v":0},{"$f":"'2'!AH74","v":0},{"$f":"'2'!AI74","v":0},{"$f":"'2'!AJ74","v":0},{"$f":"'2'!AK74","v":0},{"$f":"'2'!AL74","v":0},{"$f":"'2'!AM74","v":0},{"$f":"'2'!AN74","v":0},{"$f":"'2'!AO74","v":0},{"$f":"'2'!AP74","v":0},{"$f":"'2'!AQ74","v":0},{"$f":"'2'!AR74","v":0},{"$f":"'2'!AS74","v":0},{"$f":"'2'!AT74","v":0},{"$f":"SUMPRODUCT(IF($N92=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N92=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B75","v":"2"},{"$f":"'2'!C75","v":"2.5"},{"$f":"'2'!D75","v":"2.5.3"},{"$f":"'2'!E75","v":0},{"$f":"'2'!F75","v":"2.5.3.1"},{"$f":"'2'!G75","v":0},{"$f":"'2'!H75","v":0},{"$f":"'2'!I75","v":"2.5.3.1.2"},{"$f":"'2'!J75","v":"2.5.3.1.2: Is account-blocking enforced if required to do so by a competent authority?\n"},{"$f":"'2'!K75","v":"1) AML/CFT policy or process documentation\n- Check that there is a process by which a competent authority can block an account."},{"$f":"'2'!L75","v":0},{"$f":"'2'!M75","v":"Standard Required"},{"$f":"'2'!N75","v":"Required"},{"$f":"'2'!O75","v":"FraudRisk"},{"$f":"'2'!P75","v":0},{"$f":"'2'!Q75","v":0},{"$f":"'2'!R75","v":0},{"$f":"'2'!S75","v":0},{"$f":"'2'!T75","v":0},{"$f":"'2'!U75","v":0},{"$f":"'2'!V75","v":0},{"$f":"'2'!W75","v":0},{"$f":"'2'!X75","v":0},{"$f":"'2'!Y75","v":0},{"$f":"'2'!Z75","v":0},{"$f":"'2'!AA75","v":0},{"$f":"'2'!AB75","v":0},{"$f":"'2'!AC75","v":0},{"$f":"'2'!AD75","v":0},{"$f":"'2'!AE75","v":0},{"$f":"'2'!AF75","v":0},{"$f":"'2'!AG75","v":0},{"$f":"'2'!AH75","v":0},{"$f":"'2'!AI75","v":0},{"$f":"'2'!AJ75","v":0},{"$f":"'2'!AK75","v":0},{"$f":"'2'!AL75","v":0},{"$f":"'2'!AM75","v":0},{"$f":"'2'!AN75","v":0},{"$f":"'2'!AO75","v":0},{"$f":"'2'!AP75","v":0},{"$f":"'2'!AQ75","v":0},{"$f":"'2'!AR75","v":0},{"$f":"'2'!AS75","v":0},{"$f":"'2'!AT75","v":0},{"$f":"SUMPRODUCT(IF($N93=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N93=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B76","v":"2"},{"$f":"'2'!C76","v":"2.5"},{"$f":"'2'!D76","v":"2.5.3"},{"$f":"'2'!E76","v":0},{"$f":"'2'!F76","v":"2.5.3.1"},{"$f":"'2'!G76","v":0},{"$f":"'2'!H76","v":0},{"$f":"'2'!I76","v":"2.5.3.1.3"},{"$f":"'2'!J76","v":"2.5.3.1.3: Is account-blocking enforced if an account has become compromised or when a trigger event has occurred on the account which indicates ML/TF or fraud may have occurred?\n"},{"$f":"'2'!K76","v":"1) AML/CFT policy or process documentation\n- Check that there is a process by which the system can block an account due to a trigger event that indicates fraud or ML/TF may have occurred."},{"$f":"'2'!L76","v":0},{"$f":"'2'!M76","v":"Standard Required"},{"$f":"'2'!N76","v":"Required"},{"$f":"'2'!O76","v":"FraudRisk"},{"$f":"'2'!P76","v":0},{"$f":"'2'!Q76","v":0},{"$f":"'2'!R76","v":0},{"$f":"'2'!S76","v":0},{"$f":"'2'!T76","v":0},{"$f":"'2'!U76","v":0},{"$f":"'2'!V76","v":0},{"$f":"'2'!W76","v":0},{"$f":"'2'!X76","v":0},{"$f":"'2'!Y76","v":0},{"$f":"'2'!Z76","v":0},{"$f":"'2'!AA76","v":0},{"$f":"'2'!AB76","v":0},{"$f":"'2'!AC76","v":0},{"$f":"'2'!AD76","v":0},{"$f":"'2'!AE76","v":0},{"$f":"'2'!AF76","v":0},{"$f":"'2'!AG76","v":0},{"$f":"'2'!AH76","v":0},{"$f":"'2'!AI76","v":0},{"$f":"'2'!AJ76","v":0},{"$f":"'2'!AK76","v":0},{"$f":"'2'!AL76","v":0},{"$f":"'2'!AM76","v":0},{"$f":"'2'!AN76","v":0},{"$f":"'2'!AO76","v":0},{"$f":"'2'!AP76","v":0},{"$f":"'2'!AQ76","v":0},{"$f":"'2'!AR76","v":0},{"$f":"'2'!AS76","v":0},{"$f":"'2'!AT76","v":0},{"$f":"SUMPRODUCT(IF($N94=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N94=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B77","v":"2"},{"$f":"'2'!C77","v":"2.5"},{"$f":"'2'!D77","v":"2.5.3"},{"$f":"'2'!E77","v":0},{"$f":"'2'!F77","v":"2.5.3.1"},{"$f":"'2'!G77","v":0},{"$f":"'2'!H77","v":0},{"$f":"'2'!I77","v":"2.5.3.1.4"},{"$f":"'2'!J77","v":"2.5.3.1.4: Is account-blocking enforced prior to completion of identification and verification (subject to any exceptions for verification of low-value accounts, as noted in 2.5.1.2)?\n"},{"$f":"'2'!K77","v":0},{"$f":"'2'!L77","v":0},{"$f":"'2'!M77","v":"Recommended"},{"$f":"'2'!N77","v":"Recommended"},{"$f":"'2'!O77","v":"FraudRisk"},{"$f":"'2'!P77","v":0},{"$f":"'2'!Q77","v":0},{"$f":"'2'!R77","v":0},{"$f":"'2'!S77","v":0},{"$f":"'2'!T77","v":0},{"$f":"'2'!U77","v":0},{"$f":"'2'!V77","v":0},{"$f":"'2'!W77","v":0},{"$f":"'2'!X77","v":0},{"$f":"'2'!Y77","v":0},{"$f":"'2'!Z77","v":0},{"$f":"'2'!AA77","v":0},{"$f":"'2'!AB77","v":0},{"$f":"'2'!AC77","v":0},{"$f":"'2'!AD77","v":0},{"$f":"'2'!AE77","v":0},{"$f":"'2'!AF77","v":0},{"$f":"'2'!AG77","v":0},{"$f":"'2'!AH77","v":0},{"$f":"'2'!AI77","v":0},{"$f":"'2'!AJ77","v":0},{"$f":"'2'!AK77","v":0},{"$f":"'2'!AL77","v":0},{"$f":"'2'!AM77","v":0},{"$f":"'2'!AN77","v":0},{"$f":"'2'!AO77","v":0},{"$f":"'2'!AP77","v":0},{"$f":"'2'!AQ77","v":0},{"$f":"'2'!AR77","v":0},{"$f":"'2'!AS77","v":0},{"$f":"'2'!AT77","v":0},{"$f":"SUMPRODUCT(IF($N95=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N95=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B78","v":"2"},{"$f":"'2'!C78","v":"2.5"},{"$f":"'2'!D78","v":"2.5.3"},{"$f":"'2'!E78","v":""},{"$f":"'2'!F78","v":"2.5.3.2"},{"$f":"'2'!G78","v":"2.5.3.2: CUSTOMER BLACKLISTS\nProviders should record blacklists of customers that have been found to be involved in fraud, and should prevent these customers from holding mobile money accounts.\n\nIt is recommended that providers block transactions to/from blacklisted accounts managed by financial ecosystem partners if financial ecosystem partners provide such information and if legally permitted. \n\nIf possible, blacklists should be exchanged with other domestic mobile money providers and financial ecosystem partners. Ideally, Mobile Money providers and financial ecosystem partners in each country should come to an agreement about sharing details of money laundering, terrorist financing, and perpetration of fraud. This will help to prevent fraudsters from moving from one operator to another in order to continue their activities.\n\nThe agreement should include which identities to include in the information exchange. For example, it should include agents, businesses, and merchants (and their directors). Whether to include customers will depend on local agreements. How to identify the individuals should also be agreed - for example, by national ID."},{"$f":"'2'!H78","v":"GSMA RMT (FR.P-31)"},{"$f":"'2'!I78","v":"2.5.3.2.1"},{"$f":"'2'!J78","v":"2.5.3.2.1: Is there a process for maintaining a blacklist of customers that have been found to be involved in fraud and preventing them from holding accounts?\n"},{"$f":"'2'!K78","v":0},{"$f":"'2'!L78","v":0},{"$f":"'2'!M78","v":"Standard Required"},{"$f":"'2'!N78","v":"Recommended"},{"$f":"'2'!O78","v":"FraudRisk"},{"$f":"'2'!P78","v":0},{"$f":"'2'!Q78","v":0},{"$f":"'2'!R78","v":0},{"$f":"'2'!S78","v":0},{"$f":"'2'!T78","v":0},{"$f":"'2'!U78","v":0},{"$f":"'2'!V78","v":0},{"$f":"'2'!W78","v":0},{"$f":"'2'!X78","v":0},{"$f":"'2'!Y78","v":0},{"$f":"'2'!Z78","v":0},{"$f":"'2'!AA78","v":0},{"$f":"'2'!AB78","v":0},{"$f":"'2'!AC78","v":0},{"$f":"'2'!AD78","v":0},{"$f":"'2'!AE78","v":0},{"$f":"'2'!AF78","v":0},{"$f":"'2'!AG78","v":0},{"$f":"'2'!AH78","v":0},{"$f":"'2'!AI78","v":0},{"$f":"'2'!AJ78","v":0},{"$f":"'2'!AK78","v":0},{"$f":"'2'!AL78","v":0},{"$f":"'2'!AM78","v":0},{"$f":"'2'!AN78","v":0},{"$f":"'2'!AO78","v":0},{"$f":"'2'!AP78","v":0},{"$f":"'2'!AQ78","v":0},{"$f":"'2'!AR78","v":0},{"$f":"'2'!AS78","v":0},{"$f":"'2'!AT78","v":0},{"$f":"SUMPRODUCT(IF($N96=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N96=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B79","v":"2"},{"$f":"'2'!C79","v":"2.5"},{"$f":"'2'!D79","v":"2.5.3"},{"$f":"'2'!E79","v":""},{"$f":"'2'!F79","v":"2.5.3.2"},{"$f":"'2'!G79","v":0},{"$f":"'2'!H79","v":0},{"$f":"'2'!I79","v":"2.5.3.2.2"},{"$f":"'2'!J79","v":"2.5.3.2.2: If supported by financial ecosystem partners, are operator-maintained blacklists exchanged under a joint blacklisting agreement?\n"},{"$f":"'2'!K79","v":0},{"$f":"'2'!L79","v":0},{"$f":"'2'!M79","v":"Recommended"},{"$f":"'2'!N79","v":"Recommended"},{"$f":"'2'!O79","v":"FraudRisk"},{"$f":"'2'!P79","v":0},{"$f":"'2'!Q79","v":0},{"$f":"'2'!R79","v":0},{"$f":"'2'!S79","v":0},{"$f":"'2'!T79","v":0},{"$f":"'2'!U79","v":0},{"$f":"'2'!V79","v":0},{"$f":"'2'!W79","v":0},{"$f":"'2'!X79","v":0},{"$f":"'2'!Y79","v":0},{"$f":"'2'!Z79","v":0},{"$f":"'2'!AA79","v":0},{"$f":"'2'!AB79","v":0},{"$f":"'2'!AC79","v":0},{"$f":"'2'!AD79","v":0},{"$f":"'2'!AE79","v":0},{"$f":"'2'!AF79","v":0},{"$f":"'2'!AG79","v":0},{"$f":"'2'!AH79","v":0},{"$f":"'2'!AI79","v":0},{"$f":"'2'!AJ79","v":0},{"$f":"'2'!AK79","v":0},{"$f":"'2'!AL79","v":0},{"$f":"'2'!AM79","v":0},{"$f":"'2'!AN79","v":0},{"$f":"'2'!AO79","v":0},{"$f":"'2'!AP79","v":0},{"$f":"'2'!AQ79","v":0},{"$f":"'2'!AR79","v":0},{"$f":"'2'!AS79","v":0},{"$f":"'2'!AT79","v":0},{"$f":"SUMPRODUCT(IF($N97=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N97=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B80","v":"2"},{"$f":"'2'!C80","v":"2.5"},{"$f":"'2'!D80","v":"2.5.4"},{"$f":"'2'!E80","v":"2.5.4: Providers shall screen accounts using domestic and international money laundering, terrorist financing, and sanctions watch lists"},{"$f":"'2'!F80","v":"2.5.4.1"},{"$f":"'2'!G80","v":"2.5.4.1: WATCHLIST SCREENING OF ACCOUNTS\nAll accounts (including customer, agent and business accounts) should be screened against watchhlists.  Watchlists should include domestic and international money laundering, terrorist financing, Politically Exposed Persons (PEP) and sanctions watch lists. \nExamples of international watch lists that may be used include:\n- The Consolidated United Nations Security Council Sanctions List\n- OFAC (US Office of Foreign Assets Control) Specially Designated Nationals List \n- The Consolidated List of Persons, Groups and Entities subject to EU Financial Sanctions.\n\nScreening should be performed within a short period of time following account opening and it is recommended that screening is repeated regularly thereafter (frequency may vary depending upon customer risk level). \nIn case a match is found against a mandatory watchlist, the account should be immediately blocked and appropriate action taken on such accounts and their owners. \n\nA number of \"possible matches\" may be found during screening. A risk-based process should be implemented to deal with such accounts (e.g. obtaining further KYC ID and temporarily blocking of account, depending upon risk level.\n\nA regular report should be generated (and reviewed by the AML/CFT management) on the number of screening matches and possible matches and the action taken on each."},{"$f":"'2'!H80","v":"GSMA RMT (FR.P-09)"},{"$f":"'2'!I80","v":"2.5.4.1.1"},{"$f":"'2'!J80","v":"2.5.4.1.1: Has a documented account-screening process been implemented to ensure that all accounts (including customer, agent and business accounts) are screened against appropriate watch lists?\n"},{"$f":"'2'!K80","v":"1) Watchlist screening process or AML/CFT policy / process\n- Check that the provider has a documented account screening process.\n- Check that the provider has conducted and documented an assessment of which sanction lists they are required to screen against.\n\n\n\n\n"},{"$f":"'2'!L80","v":0},{"$f":"'2'!M80","v":"Standard Required"},{"$f":"'2'!N80","v":"Required"},{"$f":"'2'!O80","v":"FraudRisk"},{"$f":"'2'!P80","v":0},{"$f":"'2'!Q80","v":0},{"$f":"'2'!R80","v":0},{"$f":"'2'!S80","v":0},{"$f":"'2'!T80","v":0},{"$f":"'2'!U80","v":0},{"$f":"'2'!V80","v":0},{"$f":"'2'!W80","v":0},{"$f":"'2'!X80","v":0},{"$f":"'2'!Y80","v":0},{"$f":"'2'!Z80","v":0},{"$f":"'2'!AA80","v":0},{"$f":"'2'!AB80","v":0},{"$f":"'2'!AC80","v":0},{"$f":"'2'!AD80","v":0},{"$f":"'2'!AE80","v":0},{"$f":"'2'!AF80","v":0},{"$f":"'2'!AG80","v":0},{"$f":"'2'!AH80","v":0},{"$f":"'2'!AI80","v":0},{"$f":"'2'!AJ80","v":0},{"$f":"'2'!AK80","v":0},{"$f":"'2'!AL80","v":0},{"$f":"'2'!AM80","v":0},{"$f":"'2'!AN80","v":0},{"$f":"'2'!AO80","v":0},{"$f":"'2'!AP80","v":0},{"$f":"'2'!AQ80","v":0},{"$f":"'2'!AR80","v":0},{"$f":"'2'!AS80","v":0},{"$f":"'2'!AT80","v":0},{"$f":"SUMPRODUCT(IF($N98=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N98=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B81","v":"2"},{"$f":"'2'!C81","v":"2.5"},{"$f":"'2'!D81","v":"2.5.4"},{"$f":"'2'!E81","v":0},{"$f":"'2'!F81","v":"2.5.4.1"},{"$f":"'2'!G81","v":0},{"$f":"'2'!H81","v":0},{"$f":"'2'!I81","v":"2.5.4.1.2"},{"$f":"'2'!J81","v":"2.5.4.1.2: Does the account-screening process ensure that screening is performed within a short period of time following account opening?\n"},{"$f":"'2'!K81","v":"1) Watchlist screening process or AML/CFT policy / process\n- Check the timing of the screening. It should before the business relationship is established or soon thereafter.\n- Check that the provider is screening newly sanctioned entities against the customer base\n- Check that the provider is receiving regular updates of both sanctions and PEP lists"},{"$f":"'2'!L81","v":0},{"$f":"'2'!M81","v":"Standard Required"},{"$f":"'2'!N81","v":"Required"},{"$f":"'2'!O81","v":"FraudRisk"},{"$f":"'2'!P81","v":0},{"$f":"'2'!Q81","v":0},{"$f":"'2'!R81","v":0},{"$f":"'2'!S81","v":0},{"$f":"'2'!T81","v":0},{"$f":"'2'!U81","v":0},{"$f":"'2'!V81","v":0},{"$f":"'2'!W81","v":0},{"$f":"'2'!X81","v":0},{"$f":"'2'!Y81","v":0},{"$f":"'2'!Z81","v":0},{"$f":"'2'!AA81","v":0},{"$f":"'2'!AB81","v":0},{"$f":"'2'!AC81","v":0},{"$f":"'2'!AD81","v":0},{"$f":"'2'!AE81","v":0},{"$f":"'2'!AF81","v":0},{"$f":"'2'!AG81","v":0},{"$f":"'2'!AH81","v":0},{"$f":"'2'!AI81","v":0},{"$f":"'2'!AJ81","v":0},{"$f":"'2'!AK81","v":0},{"$f":"'2'!AL81","v":0},{"$f":"'2'!AM81","v":0},{"$f":"'2'!AN81","v":0},{"$f":"'2'!AO81","v":0},{"$f":"'2'!AP81","v":0},{"$f":"'2'!AQ81","v":0},{"$f":"'2'!AR81","v":0},{"$f":"'2'!AS81","v":0},{"$f":"'2'!AT81","v":0},{"$f":"SUMPRODUCT(IF($N99=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N99=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B82","v":"2"},{"$f":"'2'!C82","v":"2.5"},{"$f":"'2'!D82","v":"2.5.4"},{"$f":"'2'!E82","v":0},{"$f":"'2'!F82","v":"2.5.4.1"},{"$f":"'2'!G82","v":0},{"$f":"'2'!H82","v":0},{"$f":"'2'!I82","v":"2.5.4.1.3"},{"$f":"'2'!J82","v":"2.5.4.1.3: Does the account-screening process ensure that in case a confirmed match is found against a mandatory watchlist, the account is blocked within one day and appropriate action taken on such accounts and their owners?\n"},{"$f":"'2'!K82","v":"1) Watchlist screening process or AML/CFT policy / process\n- Check that the process requires any accounts that are identified as being on a mandatory lists to be blocked within one day and further appropriate actions taken.\n- Check that the process includes full documentation and rationale for decisions to block accounts.\n"},{"$f":"'2'!L82","v":0},{"$f":"'2'!M82","v":"Standard Required"},{"$f":"'2'!N82","v":"Required"},{"$f":"'2'!O82","v":"FraudRisk"},{"$f":"'2'!P82","v":0},{"$f":"'2'!Q82","v":0},{"$f":"'2'!R82","v":0},{"$f":"'2'!S82","v":0},{"$f":"'2'!T82","v":0},{"$f":"'2'!U82","v":0},{"$f":"'2'!V82","v":0},{"$f":"'2'!W82","v":0},{"$f":"'2'!X82","v":0},{"$f":"'2'!Y82","v":0},{"$f":"'2'!Z82","v":0},{"$f":"'2'!AA82","v":0},{"$f":"'2'!AB82","v":0},{"$f":"'2'!AC82","v":0},{"$f":"'2'!AD82","v":0},{"$f":"'2'!AE82","v":0},{"$f":"'2'!AF82","v":0},{"$f":"'2'!AG82","v":0},{"$f":"'2'!AH82","v":0},{"$f":"'2'!AI82","v":0},{"$f":"'2'!AJ82","v":0},{"$f":"'2'!AK82","v":0},{"$f":"'2'!AL82","v":0},{"$f":"'2'!AM82","v":0},{"$f":"'2'!AN82","v":0},{"$f":"'2'!AO82","v":0},{"$f":"'2'!AP82","v":0},{"$f":"'2'!AQ82","v":0},{"$f":"'2'!AR82","v":0},{"$f":"'2'!AS82","v":0},{"$f":"'2'!AT82","v":0},{"$f":"SUMPRODUCT(IF($N100=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N100=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B83","v":"2"},{"$f":"'2'!C83","v":"2.5"},{"$f":"'2'!D83","v":"2.5.4"},{"$f":"'2'!E83","v":0},{"$f":"'2'!F83","v":"2.5.4.1"},{"$f":"'2'!G83","v":0},{"$f":"'2'!H83","v":0},{"$f":"'2'!I83","v":"2.5.4.1.4"},{"$f":"'2'!J83","v":"2.5.4.1.4: Does the account-screening process ensure that screening is performed regularly on all customer, agent and business accounts, and following certain triggers, such as discovery of suspicious account activity or KYC issues?\n"},{"$f":"'2'!K83","v":0},{"$f":"'2'!L83","v":0},{"$f":"'2'!M83","v":"Recommended"},{"$f":"'2'!N83","v":"Recommended"},{"$f":"'2'!O83","v":"FraudRisk"},{"$f":"'2'!P83","v":0},{"$f":"'2'!Q83","v":0},{"$f":"'2'!R83","v":0},{"$f":"'2'!S83","v":0},{"$f":"'2'!T83","v":0},{"$f":"'2'!U83","v":0},{"$f":"'2'!V83","v":0},{"$f":"'2'!W83","v":0},{"$f":"'2'!X83","v":0},{"$f":"'2'!Y83","v":0},{"$f":"'2'!Z83","v":0},{"$f":"'2'!AA83","v":0},{"$f":"'2'!AB83","v":0},{"$f":"'2'!AC83","v":0},{"$f":"'2'!AD83","v":0},{"$f":"'2'!AE83","v":0},{"$f":"'2'!AF83","v":0},{"$f":"'2'!AG83","v":0},{"$f":"'2'!AH83","v":0},{"$f":"'2'!AI83","v":0},{"$f":"'2'!AJ83","v":0},{"$f":"'2'!AK83","v":0},{"$f":"'2'!AL83","v":0},{"$f":"'2'!AM83","v":0},{"$f":"'2'!AN83","v":0},{"$f":"'2'!AO83","v":0},{"$f":"'2'!AP83","v":0},{"$f":"'2'!AQ83","v":0},{"$f":"'2'!AR83","v":0},{"$f":"'2'!AS83","v":0},{"$f":"'2'!AT83","v":0},{"$f":"SUMPRODUCT(IF($N101=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N101=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B84","v":"2"},{"$f":"'2'!C84","v":"2.5"},{"$f":"'2'!D84","v":"2.5.4"},{"$f":"'2'!E84","v":0},{"$f":"'2'!F84","v":"2.5.4.1"},{"$f":"'2'!G84","v":0},{"$f":"'2'!H84","v":0},{"$f":"'2'!I84","v":"2.5.4.1.5"},{"$f":"'2'!J84","v":"2.5.4.1.5: Does the account-screening process specify how to deal with \"possible matches\", defining a risk-based process to deal with such accounts, including collection of further KYC ID and temporarily blocking of the account, depending upon risk level?\n"},{"$f":"'2'!K84","v":0},{"$f":"'2'!L84","v":0},{"$f":"'2'!M84","v":"Recommended"},{"$f":"'2'!N84","v":"Recommended"},{"$f":"'2'!O84","v":"FraudRisk"},{"$f":"'2'!P84","v":0},{"$f":"'2'!Q84","v":0},{"$f":"'2'!R84","v":0},{"$f":"'2'!S84","v":0},{"$f":"'2'!T84","v":0},{"$f":"'2'!U84","v":0},{"$f":"'2'!V84","v":0},{"$f":"'2'!W84","v":0},{"$f":"'2'!X84","v":0},{"$f":"'2'!Y84","v":0},{"$f":"'2'!Z84","v":0},{"$f":"'2'!AA84","v":0},{"$f":"'2'!AB84","v":0},{"$f":"'2'!AC84","v":0},{"$f":"'2'!AD84","v":0},{"$f":"'2'!AE84","v":0},{"$f":"'2'!AF84","v":0},{"$f":"'2'!AG84","v":0},{"$f":"'2'!AH84","v":0},{"$f":"'2'!AI84","v":0},{"$f":"'2'!AJ84","v":0},{"$f":"'2'!AK84","v":0},{"$f":"'2'!AL84","v":0},{"$f":"'2'!AM84","v":0},{"$f":"'2'!AN84","v":0},{"$f":"'2'!AO84","v":0},{"$f":"'2'!AP84","v":0},{"$f":"'2'!AQ84","v":0},{"$f":"'2'!AR84","v":0},{"$f":"'2'!AS84","v":0},{"$f":"'2'!AT84","v":0},{"$f":"SUMPRODUCT(IF($N102=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N102=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B85","v":"2"},{"$f":"'2'!C85","v":"2.5"},{"$f":"'2'!D85","v":"2.5.4"},{"$f":"'2'!E85","v":""},{"$f":"'2'!F85","v":"2.5.4.1"},{"$f":"'2'!G85","v":0},{"$f":"'2'!H85","v":0},{"$f":"'2'!I85","v":"2.5.4.1.6"},{"$f":"'2'!J85","v":"2.5.4.1.6: Is a regular report generated (and reviewed by the AML/CFT management) on the number of screening matches and possible matches and the action taken on each?\n"},{"$f":"'2'!K85","v":0},{"$f":"'2'!L85","v":0},{"$f":"'2'!M85","v":"Recommended"},{"$f":"'2'!N85","v":"Recommended"},{"$f":"'2'!O85","v":"FraudRisk"},{"$f":"'2'!P85","v":0},{"$f":"'2'!Q85","v":0},{"$f":"'2'!R85","v":0},{"$f":"'2'!S85","v":0},{"$f":"'2'!T85","v":0},{"$f":"'2'!U85","v":0},{"$f":"'2'!V85","v":0},{"$f":"'2'!W85","v":0},{"$f":"'2'!X85","v":0},{"$f":"'2'!Y85","v":0},{"$f":"'2'!Z85","v":0},{"$f":"'2'!AA85","v":0},{"$f":"'2'!AB85","v":0},{"$f":"'2'!AC85","v":0},{"$f":"'2'!AD85","v":0},{"$f":"'2'!AE85","v":0},{"$f":"'2'!AF85","v":0},{"$f":"'2'!AG85","v":0},{"$f":"'2'!AH85","v":0},{"$f":"'2'!AI85","v":0},{"$f":"'2'!AJ85","v":0},{"$f":"'2'!AK85","v":0},{"$f":"'2'!AL85","v":0},{"$f":"'2'!AM85","v":0},{"$f":"'2'!AN85","v":0},{"$f":"'2'!AO85","v":0},{"$f":"'2'!AP85","v":0},{"$f":"'2'!AQ85","v":0},{"$f":"'2'!AR85","v":0},{"$f":"'2'!AS85","v":0},{"$f":"'2'!AT85","v":0},{"$f":"SUMPRODUCT(IF($N103=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N103=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B87","v":"2"},{"$f":"'2'!C87","v":"2.6"},{"$f":"'2'!D87","v":"2.6.1"},{"$f":"'2'!E87","v":"2.6.1: Providers shall ensure that staff and agents are properly trained in AML/CFT procedures"},{"$f":"'2'!F87","v":"2.6.1.1"},{"$f":"'2'!G87","v":"2.6.1.1: AGENT TRAINING IN AML/CFT\nThe AML/CFT policy should include a requirement to train agents in AML/CFT procedures before they start operating. Provider-agent contracts should require agents to implement proper processes and to train their own staff members accordingly.\n\nAgent training should include the following (as applicable):\n- How to conduct proper KYC verification when registering new customers; and\n- Responsibility of provider and individual staff for AML/CFT compliance and suspicious transaction reporting."},{"$f":"'2'!H87","v":"GSMA RMT\n(AG-09)\n\nHK AML"},{"$f":"'2'!I87","v":"2.6.1.1.1"},{"$f":"'2'!J87","v":"2.6.1.1.1: Is there a policy stating that all agents must be trained in AML/CFT procedures before they start operating?\n"},{"$f":"'2'!K87","v":"1) Agent training plan/materials or AML/CFT training plan\n- Check that all agents receive AML training prior to their starting operating.\n"},{"$f":"'2'!L87","v":0},{"$f":"'2'!M87","v":"Urgent Required"},{"$f":"'2'!N87","v":"Required"},{"$f":"'2'!O87","v":"FraudRisk"},{"$f":"'2'!P87","v":0},{"$f":"'2'!Q87","v":0},{"$f":"'2'!R87","v":0},{"$f":"'2'!S87","v":0},{"$f":"'2'!T87","v":0},{"$f":"'2'!U87","v":0},{"$f":"'2'!V87","v":0},{"$f":"'2'!W87","v":0},{"$f":"'2'!X87","v":0},{"$f":"'2'!Y87","v":0},{"$f":"'2'!Z87","v":0},{"$f":"'2'!AA87","v":0},{"$f":"'2'!AB87","v":0},{"$f":"'2'!AC87","v":0},{"$f":"'2'!AD87","v":0},{"$f":"'2'!AE87","v":0},{"$f":"'2'!AF87","v":0},{"$f":"'2'!AG87","v":0},{"$f":"'2'!AH87","v":0},{"$f":"'2'!AI87","v":0},{"$f":"'2'!AJ87","v":0},{"$f":"'2'!AK87","v":0},{"$f":"'2'!AL87","v":0},{"$f":"'2'!AM87","v":0},{"$f":"'2'!AN87","v":0},{"$f":"'2'!AO87","v":0},{"$f":"'2'!AP87","v":0},{"$f":"'2'!AQ87","v":0},{"$f":"'2'!AR87","v":0},{"$f":"'2'!AS87","v":0},{"$f":"'2'!AT87","v":0},{"$f":"SUMPRODUCT(IF($N104=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N104=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B88","v":"2"},{"$f":"'2'!C88","v":"2.6"},{"$f":"'2'!D88","v":"2.6.1"},{"$f":"'2'!E88","v":0},{"$f":"'2'!F88","v":"2.6.1.1"},{"$f":"'2'!G88","v":0},{"$f":"'2'!H88","v":0},{"$f":"'2'!I88","v":"2.6.1.1.2"},{"$f":"'2'!J88","v":"2.6.1.1.2: Does agent training for registering agents include how to conduct proper KYC verification when registering new customers?\n"},{"$f":"'2'!K88","v":"1) Agent training plan/materials or AML/CFT training plan\n- Check that it contains details on what information is to be collected from the customer at registration, and how it is processed.\n- Check that it contains details on what documentation should be presented by the customer, and how it is verified by the agent."},{"$f":"'2'!L88","v":0},{"$f":"'2'!M88","v":"Urgent Required"},{"$f":"'2'!N88","v":"Required"},{"$f":"'2'!O88","v":"FraudRisk"},{"$f":"'2'!P88","v":0},{"$f":"'2'!Q88","v":0},{"$f":"'2'!R88","v":0},{"$f":"'2'!S88","v":0},{"$f":"'2'!T88","v":0},{"$f":"'2'!U88","v":0},{"$f":"'2'!V88","v":0},{"$f":"'2'!W88","v":0},{"$f":"'2'!X88","v":0},{"$f":"'2'!Y88","v":0},{"$f":"'2'!Z88","v":0},{"$f":"'2'!AA88","v":0},{"$f":"'2'!AB88","v":0},{"$f":"'2'!AC88","v":0},{"$f":"'2'!AD88","v":0},{"$f":"'2'!AE88","v":0},{"$f":"'2'!AF88","v":0},{"$f":"'2'!AG88","v":0},{"$f":"'2'!AH88","v":0},{"$f":"'2'!AI88","v":0},{"$f":"'2'!AJ88","v":0},{"$f":"'2'!AK88","v":0},{"$f":"'2'!AL88","v":0},{"$f":"'2'!AM88","v":0},{"$f":"'2'!AN88","v":0},{"$f":"'2'!AO88","v":0},{"$f":"'2'!AP88","v":0},{"$f":"'2'!AQ88","v":0},{"$f":"'2'!AR88","v":0},{"$f":"'2'!AS88","v":0},{"$f":"'2'!AT88","v":0},{"$f":"SUMPRODUCT(IF($N105=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N105=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B89","v":"2"},{"$f":"'2'!C89","v":"2.6"},{"$f":"'2'!D89","v":"2.6.1"},{"$f":"'2'!E89","v":0},{"$f":"'2'!F89","v":"2.6.1.1"},{"$f":"'2'!G89","v":0},{"$f":"'2'!H89","v":0},{"$f":"'2'!I89","v":"2.6.1.1.3"},{"$f":"'2'!J89","v":"2.6.1.1.3: Do contractual arrangements require agents to implement appropriate AML/CFT processes and to train their staff members accordingly?\n"},{"$f":"'2'!K89","v":"1) Standard / sample agent contract\n- Check that the agent contract requires agents to implement appropriate AML/CTF processes and to train their staff accordingly"},{"$f":"'2'!L89","v":0},{"$f":"'2'!M89","v":"Standard Required"},{"$f":"'2'!N89","v":"Required"},{"$f":"'2'!O89","v":"FraudRisk"},{"$f":"'2'!P89","v":0},{"$f":"'2'!Q89","v":0},{"$f":"'2'!R89","v":0},{"$f":"'2'!S89","v":0},{"$f":"'2'!T89","v":0},{"$f":"'2'!U89","v":0},{"$f":"'2'!V89","v":0},{"$f":"'2'!W89","v":0},{"$f":"'2'!X89","v":0},{"$f":"'2'!Y89","v":0},{"$f":"'2'!Z89","v":0},{"$f":"'2'!AA89","v":0},{"$f":"'2'!AB89","v":0},{"$f":"'2'!AC89","v":0},{"$f":"'2'!AD89","v":0},{"$f":"'2'!AE89","v":0},{"$f":"'2'!AF89","v":0},{"$f":"'2'!AG89","v":0},{"$f":"'2'!AH89","v":0},{"$f":"'2'!AI89","v":0},{"$f":"'2'!AJ89","v":0},{"$f":"'2'!AK89","v":0},{"$f":"'2'!AL89","v":0},{"$f":"'2'!AM89","v":0},{"$f":"'2'!AN89","v":0},{"$f":"'2'!AO89","v":0},{"$f":"'2'!AP89","v":0},{"$f":"'2'!AQ89","v":0},{"$f":"'2'!AR89","v":0},{"$f":"'2'!AS89","v":0},{"$f":"'2'!AT89","v":0},{"$f":"SUMPRODUCT(IF($N106=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N106=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B90","v":"2"},{"$f":"'2'!C90","v":"2.6"},{"$f":"'2'!D90","v":"2.6.1"},{"$f":"'2'!E90","v":0},{"$f":"'2'!F90","v":"2.6.1.2"},{"$f":"'2'!G90","v":"2.6.1.2: STAFF TRAINING IN AML/CFT\nThe AML/CFT policy should include a requirement to train relevant staff in AML/CFT procedures, and they should be provided with regular refresher training, and that training records must be kept.\n\nStaff training should include the following (as applicable):\n- Responsibility of provider and individual staff for AML/CFT compliance and suspicious transaction reporting; \n- Provider’s policies and procedures and the role of staff with respect with to these policies and procedures; \n- Relevant emerging risks and trends in ML/TF; \n- How to conduct proper KYC verification when registering new clients; \n- Proper record-keeping procedures; \n- How to identify and report suspicious activity without “tipping off”; \n- How to communicate with agents;\n- How to monitor agent compliance with AML/CFT requirements."},{"$f":"'2'!H90","v":"GSMA RMT (FR.O-06)\n\nHK AML"},{"$f":"'2'!I90","v":"2.6.1.2.1"},{"$f":"'2'!J90","v":"2.6.1.2.1: Is there a policy stating that relevant staff must be trained in AML/CFT procedures?\n"},{"$f":"'2'!K90","v":"1) Employee training plan/materials or AML/CFT training plan/materials or AML/CFT policy (or equivalent)\n- Check that there is a requirement for staff to receive AML training during the induction process. [or this could be specified in AML/CFT policy]\n"},{"$f":"'2'!L90","v":0},{"$f":"'2'!M90","v":"Urgent Required"},{"$f":"'2'!N90","v":"Required"},{"$f":"'2'!O90","v":"FraudRisk"},{"$f":"'2'!P90","v":0},{"$f":"'2'!Q90","v":0},{"$f":"'2'!R90","v":0},{"$f":"'2'!S90","v":0},{"$f":"'2'!T90","v":0},{"$f":"'2'!U90","v":0},{"$f":"'2'!V90","v":0},{"$f":"'2'!W90","v":0},{"$f":"'2'!X90","v":0},{"$f":"'2'!Y90","v":0},{"$f":"'2'!Z90","v":0},{"$f":"'2'!AA90","v":0},{"$f":"'2'!AB90","v":0},{"$f":"'2'!AC90","v":0},{"$f":"'2'!AD90","v":0},{"$f":"'2'!AE90","v":0},{"$f":"'2'!AF90","v":0},{"$f":"'2'!AG90","v":0},{"$f":"'2'!AH90","v":0},{"$f":"'2'!AI90","v":0},{"$f":"'2'!AJ90","v":0},{"$f":"'2'!AK90","v":0},{"$f":"'2'!AL90","v":0},{"$f":"'2'!AM90","v":0},{"$f":"'2'!AN90","v":0},{"$f":"'2'!AO90","v":0},{"$f":"'2'!AP90","v":0},{"$f":"'2'!AQ90","v":0},{"$f":"'2'!AR90","v":0},{"$f":"'2'!AS90","v":0},{"$f":"'2'!AT90","v":0},{"$f":"SUMPRODUCT(IF($N107=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N107=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B91","v":"2"},{"$f":"'2'!C91","v":"2.6"},{"$f":"'2'!D91","v":"2.6.1"},{"$f":"'2'!E91","v":0},{"$f":"'2'!F91","v":"2.6.1.2"},{"$f":"'2'!G91","v":0},{"$f":"'2'!H91","v":0},{"$f":"'2'!I91","v":"2.6.1.2.2"},{"$f":"'2'!J91","v":"2.6.1.2.2: Are staff tested regularly on their understanding of internal policies and procedures and legal obligations with respect to AML/CFT?\n"},{"$f":"'2'!K91","v":0},{"$f":"'2'!L91","v":0},{"$f":"'2'!M91","v":"Recommended"},{"$f":"'2'!N91","v":"Recommended"},{"$f":"'2'!O91","v":"FraudRisk"},{"$f":"'2'!P91","v":0},{"$f":"'2'!Q91","v":0},{"$f":"'2'!R91","v":0},{"$f":"'2'!S91","v":0},{"$f":"'2'!T91","v":0},{"$f":"'2'!U91","v":0},{"$f":"'2'!V91","v":0},{"$f":"'2'!W91","v":0},{"$f":"'2'!X91","v":0},{"$f":"'2'!Y91","v":0},{"$f":"'2'!Z91","v":0},{"$f":"'2'!AA91","v":0},{"$f":"'2'!AB91","v":0},{"$f":"'2'!AC91","v":0},{"$f":"'2'!AD91","v":0},{"$f":"'2'!AE91","v":0},{"$f":"'2'!AF91","v":0},{"$f":"'2'!AG91","v":0},{"$f":"'2'!AH91","v":0},{"$f":"'2'!AI91","v":0},{"$f":"'2'!AJ91","v":0},{"$f":"'2'!AK91","v":0},{"$f":"'2'!AL91","v":0},{"$f":"'2'!AM91","v":0},{"$f":"'2'!AN91","v":0},{"$f":"'2'!AO91","v":0},{"$f":"'2'!AP91","v":0},{"$f":"'2'!AQ91","v":0},{"$f":"'2'!AR91","v":0},{"$f":"'2'!AS91","v":0},{"$f":"'2'!AT91","v":0},{"$f":"SUMPRODUCT(IF($N108=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N108=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B92","v":"2"},{"$f":"'2'!C92","v":"2.6"},{"$f":"'2'!D92","v":"2.6.2"},{"$f":"'2'!E92","v":"2.6.2: Providers shall monitor staff and agent compliance with AML/CFT procedures"},{"$f":"'2'!F92","v":"2.6.2.1"},{"$f":"'2'!G92","v":"2.6.2.1: MONITORING OF AGENT AML/CFT COMPLIANCE\nMonitoring (both on-site and off-site) should be aimed at ensuring that agents (including any sub-agents) comply with all internal policies and procedures and legal obligations with respect to AML/CFT. Providers should:\n- Develop systems that allow providers to monitor agent compliance with AML/CFT requirements; \n- Ensure agents understand the AML/CFT procedures;\n- Ensure all correct KYC details and IDs are captured when registering customers;\n- Ensure identity checks are properly performed for cash-in and cash-out transactions;\n- Ensure that all required records are kept;\n- Regularly review agent compliance with AML/CFT processes; and\n- Conduct on-site reviews of agents and their AML/CFT processes."},{"$f":"'2'!H92","v":"HK AML\nBCBS AML\nGSMA RMT"},{"$f":"'2'!I92","v":"2.6.2.1.1"},{"$f":"'2'!J92","v":"2.6.2.1.1: Does agent monitoring ensure that all correct KYC details and IDs are captured when registering customers (if applicable)?\n"},{"$f":"'2'!K92","v":"1) AML/CFT policy or process documentation\n- Check that there is a process to monitor agents to ensure all that KYC details are captured correctly. \n"},{"$f":"'2'!L92","v":0},{"$f":"'2'!M92","v":"Standard Required"},{"$f":"'2'!N92","v":"Required"},{"$f":"'2'!O92","v":"FraudRisk"},{"$f":"'2'!P92","v":0},{"$f":"'2'!Q92","v":0},{"$f":"'2'!R92","v":0},{"$f":"'2'!S92","v":0},{"$f":"'2'!T92","v":0},{"$f":"'2'!U92","v":0},{"$f":"'2'!V92","v":0},{"$f":"'2'!W92","v":0},{"$f":"'2'!X92","v":0},{"$f":"'2'!Y92","v":0},{"$f":"'2'!Z92","v":0},{"$f":"'2'!AA92","v":0},{"$f":"'2'!AB92","v":0},{"$f":"'2'!AC92","v":0},{"$f":"'2'!AD92","v":0},{"$f":"'2'!AE92","v":0},{"$f":"'2'!AF92","v":0},{"$f":"'2'!AG92","v":0},{"$f":"'2'!AH92","v":0},{"$f":"'2'!AI92","v":0},{"$f":"'2'!AJ92","v":0},{"$f":"'2'!AK92","v":0},{"$f":"'2'!AL92","v":0},{"$f":"'2'!AM92","v":0},{"$f":"'2'!AN92","v":0},{"$f":"'2'!AO92","v":0},{"$f":"'2'!AP92","v":0},{"$f":"'2'!AQ92","v":0},{"$f":"'2'!AR92","v":0},{"$f":"'2'!AS92","v":0},{"$f":"'2'!AT92","v":0},{"$f":"SUMPRODUCT(IF($N109=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N109=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B93","v":"2"},{"$f":"'2'!C93","v":"2.6"},{"$f":"'2'!D93","v":"2.6.2"},{"$f":"'2'!E93","v":0},{"$f":"'2'!F93","v":"2.6.2.1"},{"$f":"'2'!G93","v":0},{"$f":"'2'!H93","v":0},{"$f":"'2'!I93","v":"2.6.2.1.2"},{"$f":"'2'!J93","v":"2.6.2.1.2: Does agent monitoring ensure that identity checks are properly performed for cash-in and cash-out transactions?\n"},{"$f":"'2'!K93","v":0},{"$f":"'2'!L93","v":0},{"$f":"'2'!M93","v":"Recommended"},{"$f":"'2'!N93","v":"Recommended"},{"$f":"'2'!O93","v":"FraudRisk"},{"$f":"'2'!P93","v":0},{"$f":"'2'!Q93","v":0},{"$f":"'2'!R93","v":0},{"$f":"'2'!S93","v":0},{"$f":"'2'!T93","v":0},{"$f":"'2'!U93","v":0},{"$f":"'2'!V93","v":0},{"$f":"'2'!W93","v":0},{"$f":"'2'!X93","v":0},{"$f":"'2'!Y93","v":0},{"$f":"'2'!Z93","v":0},{"$f":"'2'!AA93","v":0},{"$f":"'2'!AB93","v":0},{"$f":"'2'!AC93","v":0},{"$f":"'2'!AD93","v":0},{"$f":"'2'!AE93","v":0},{"$f":"'2'!AF93","v":0},{"$f":"'2'!AG93","v":0},{"$f":"'2'!AH93","v":0},{"$f":"'2'!AI93","v":0},{"$f":"'2'!AJ93","v":0},{"$f":"'2'!AK93","v":0},{"$f":"'2'!AL93","v":0},{"$f":"'2'!AM93","v":0},{"$f":"'2'!AN93","v":0},{"$f":"'2'!AO93","v":0},{"$f":"'2'!AP93","v":0},{"$f":"'2'!AQ93","v":0},{"$f":"'2'!AR93","v":0},{"$f":"'2'!AS93","v":0},{"$f":"'2'!AT93","v":0},{"$f":"SUMPRODUCT(IF($N110=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N110=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B94","v":"2"},{"$f":"'2'!C94","v":"2.6"},{"$f":"'2'!D94","v":"2.6.2"},{"$f":"'2'!E94","v":0},{"$f":"'2'!F94","v":"2.6.2.1"},{"$f":"'2'!G94","v":0},{"$f":"'2'!H94","v":0},{"$f":"'2'!I94","v":"2.6.2.1.3"},{"$f":"'2'!J94","v":"2.6.2.1.3: Are records kept of agent monitoring activities?\n"},{"$f":"'2'!K94","v":0},{"$f":"'2'!L94","v":0},{"$f":"'2'!M94","v":"Standard Required"},{"$f":"'2'!N94","v":"Recommended"},{"$f":"'2'!O94","v":"FraudRisk"},{"$f":"'2'!P94","v":0},{"$f":"'2'!Q94","v":0},{"$f":"'2'!R94","v":0},{"$f":"'2'!S94","v":0},{"$f":"'2'!T94","v":0},{"$f":"'2'!U94","v":0},{"$f":"'2'!V94","v":0},{"$f":"'2'!W94","v":0},{"$f":"'2'!X94","v":0},{"$f":"'2'!Y94","v":0},{"$f":"'2'!Z94","v":0},{"$f":"'2'!AA94","v":0},{"$f":"'2'!AB94","v":0},{"$f":"'2'!AC94","v":0},{"$f":"'2'!AD94","v":0},{"$f":"'2'!AE94","v":0},{"$f":"'2'!AF94","v":0},{"$f":"'2'!AG94","v":0},{"$f":"'2'!AH94","v":0},{"$f":"'2'!AI94","v":0},{"$f":"'2'!AJ94","v":0},{"$f":"'2'!AK94","v":0},{"$f":"'2'!AL94","v":0},{"$f":"'2'!AM94","v":0},{"$f":"'2'!AN94","v":0},{"$f":"'2'!AO94","v":0},{"$f":"'2'!AP94","v":0},{"$f":"'2'!AQ94","v":0},{"$f":"'2'!AR94","v":0},{"$f":"'2'!AS94","v":0},{"$f":"'2'!AT94","v":0},{"$f":"SUMPRODUCT(IF($N111=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N111=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B95","v":"2"},{"$f":"'2'!C95","v":"2.6"},{"$f":"'2'!D95","v":"2.6.2"},{"$f":"'2'!E95","v":""},{"$f":"'2'!F95","v":"2.6.2.2"},{"$f":"'2'!G95","v":"2.6.2.2: MONITORING OF STAFF AML/CFT COMPLIANCE\nRelevant staff should be monitored to ensure that they comply with AML/CFT processes. This should include:\n - KYC quality assurance (to identify erroneous  or fraudulent data that is inputted by customer service staff). \n - AML analysts (e.g. transaction monitoring / watchlist screening) should also have their work dip-tested to ensure that they are following procedures correctly.  \n - Staff who carry out agent due diligence should have samples of their work subjected to review. \n\n"},{"$f":"'2'!H95","v":"HK AML\nGSMA RMT"},{"$f":"'2'!I95","v":"2.6.2.2.1"},{"$f":"'2'!J95","v":"2.6.2.2.1: Are there processes to review the work of those staff who carry out KYC QA, Agent Due Diligence assurance, transaction monitoring and watchlist screening or other AML analysis?\n"},{"$f":"'2'!K95","v":0},{"$f":"'2'!L95","v":0},{"$f":"'2'!M95","v":"Recommended"},{"$f":"'2'!N95","v":"Recommended"},{"$f":"'2'!O95","v":"FraudRisk"},{"$f":"'2'!P95","v":0},{"$f":"'2'!Q95","v":0},{"$f":"'2'!R95","v":0},{"$f":"'2'!S95","v":0},{"$f":"'2'!T95","v":0},{"$f":"'2'!U95","v":0},{"$f":"'2'!V95","v":0},{"$f":"'2'!W95","v":0},{"$f":"'2'!X95","v":0},{"$f":"'2'!Y95","v":0},{"$f":"'2'!Z95","v":0},{"$f":"'2'!AA95","v":0},{"$f":"'2'!AB95","v":0},{"$f":"'2'!AC95","v":0},{"$f":"'2'!AD95","v":0},{"$f":"'2'!AE95","v":0},{"$f":"'2'!AF95","v":0},{"$f":"'2'!AG95","v":0},{"$f":"'2'!AH95","v":0},{"$f":"'2'!AI95","v":0},{"$f":"'2'!AJ95","v":0},{"$f":"'2'!AK95","v":0},{"$f":"'2'!AL95","v":0},{"$f":"'2'!AM95","v":0},{"$f":"'2'!AN95","v":0},{"$f":"'2'!AO95","v":0},{"$f":"'2'!AP95","v":0},{"$f":"'2'!AQ95","v":0},{"$f":"'2'!AR95","v":0},{"$f":"'2'!AS95","v":0},{"$f":"'2'!AT95","v":0},{"$f":"SUMPRODUCT(IF($N112=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N112=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B97","v":2},{"$f":"'2'!C97","v":2.7},{"$f":"'2'!D97","v":"2.7.1"},{"$f":"'2'!E97","v":"2.7.1: Providers shall develop risk-based policies and measures for fraud detection and prevention"},{"$f":"'2'!F97","v":"2.7.1.1"},{"$f":"'2'!G97","v":"2.7.1.1: FRAUD MANAGEMENT POLICY\nProviders should establish a mobile money fraud management policy that defines the approach to anticipating, monitoring, assessing, managing and controlling fraud. It should address the following:\n- design and implementation of the transaction monitoring system;\n- policies governing employees, agents, customers and third parties to reduce opportunities for fraud; and\n- communication with law enforcement agencies, statutory and regulatory bodies, and other key decision-makers concerning mobile money fraud."},{"$f":"'2'!H97","v":"ECB RSMP"},{"$f":"'2'!I97","v":"2.7.1.1.1"},{"$f":"'2'!J97","v":"2.7.1.1.1: Is there a fraud management policy that defines the approach to anticipating, monitoring, assessing, managing and controlling mobile money fraud?\n"},{"$f":"'2'!K97","v":"1) Fraud management policy (or equivalent documents)\n- Check the policy includes the entire fraud management lifecycle including anticipating, monitoring, assessing, managing and controlling fraud.\n- Check the policy contains specific actions relating to mobile money fraud (important if the policy is not mobile money-specific)."},{"$f":"'2'!L97","v":0},{"$f":"'2'!M97","v":"Standard Required"},{"$f":"'2'!N97","v":"Required"},{"$f":"'2'!O97","v":"FraudRisk"},{"$f":"'2'!P97","v":0},{"$f":"'2'!Q97","v":0},{"$f":"'2'!R97","v":0},{"$f":"'2'!S97","v":0},{"$f":"'2'!T97","v":0},{"$f":"'2'!U97","v":0},{"$f":"'2'!V97","v":0},{"$f":"'2'!W97","v":0},{"$f":"'2'!X97","v":0},{"$f":"'2'!Y97","v":0},{"$f":"'2'!Z97","v":0},{"$f":"'2'!AA97","v":0},{"$f":"'2'!AB97","v":0},{"$f":"'2'!AC97","v":0},{"$f":"'2'!AD97","v":0},{"$f":"'2'!AE97","v":0},{"$f":"'2'!AF97","v":0},{"$f":"'2'!AG97","v":0},{"$f":"'2'!AH97","v":0},{"$f":"'2'!AI97","v":0},{"$f":"'2'!AJ97","v":0},{"$f":"'2'!AK97","v":0},{"$f":"'2'!AL97","v":0},{"$f":"'2'!AM97","v":0},{"$f":"'2'!AN97","v":0},{"$f":"'2'!AO97","v":0},{"$f":"'2'!AP97","v":0},{"$f":"'2'!AQ97","v":0},{"$f":"'2'!AR97","v":0},{"$f":"'2'!AS97","v":0},{"$f":"'2'!AT97","v":0},{"$f":"SUMPRODUCT(IF($N113=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N113=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B98","v":2},{"$f":"'2'!C98","v":2.7},{"$f":"'2'!D98","v":"2.7.1"},{"$f":"'2'!E98","v":""},{"$f":"'2'!F98","v":"2.7.1.2"},{"$f":"'2'!G98","v":"2.7.1.2: ANTI-FRAUD TRAINING\nMuch anti-fraud training is covered by AML/CFT and KYC training (see 2.6). Additional anti-fraud training should be implemented for staff and agents, which should include:\n- awareness of common frauds, including provider risks, agent risks and customer risks (e.g. social engineering);\n- specific processes that are designed to counter fraud; and\n- how to report suspicious activity (employees and agents should be mandated to report fraud or suspected fraud);\n- how to report fraud.\n\nThe channel for reporting fraud reporting could be the same as used for reporting suspected ML/TF, security incidents and data privacy breaches."},{"$f":"'2'!H98","v":"GSMA RMT"},{"$f":"'2'!I98","v":"2.7.1.2.1"},{"$f":"'2'!J98","v":"2.7.1.2.1: Is there a staff training programme that addresses fraud management and fraud awareness, including provider risks, agent risks and customer risks (e.g. social engineering) and anti-fraud processes?\n"},{"$f":"'2'!K98","v":"1) Employee training plan / materials\n- Check that the training plan / materials includes training staff in fraud management and fraud awareness.\n- Check that the training plan / materials includes details on provider, agent and customer risk.\n- Check that the training plan / materials includes details on anti-fraud processes."},{"$f":"'2'!L98","v":0},{"$f":"'2'!M98","v":"Standard Required"},{"$f":"'2'!N98","v":"Required"},{"$f":"'2'!O98","v":"FraudRisk"},{"$f":"'2'!P98","v":0},{"$f":"'2'!Q98","v":0},{"$f":"'2'!R98","v":0},{"$f":"'2'!S98","v":0},{"$f":"'2'!T98","v":0},{"$f":"'2'!U98","v":0},{"$f":"'2'!V98","v":0},{"$f":"'2'!W98","v":0},{"$f":"'2'!X98","v":0},{"$f":"'2'!Y98","v":0},{"$f":"'2'!Z98","v":0},{"$f":"'2'!AA98","v":0},{"$f":"'2'!AB98","v":0},{"$f":"'2'!AC98","v":0},{"$f":"'2'!AD98","v":0},{"$f":"'2'!AE98","v":0},{"$f":"'2'!AF98","v":0},{"$f":"'2'!AG98","v":0},{"$f":"'2'!AH98","v":0},{"$f":"'2'!AI98","v":0},{"$f":"'2'!AJ98","v":0},{"$f":"'2'!AK98","v":0},{"$f":"'2'!AL98","v":0},{"$f":"'2'!AM98","v":0},{"$f":"'2'!AN98","v":0},{"$f":"'2'!AO98","v":0},{"$f":"'2'!AP98","v":0},{"$f":"'2'!AQ98","v":0},{"$f":"'2'!AR98","v":0},{"$f":"'2'!AS98","v":0},{"$f":"'2'!AT98","v":0},{"$f":"SUMPRODUCT(IF($N114=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N114=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B99","v":2},{"$f":"'2'!C99","v":2.7},{"$f":"'2'!D99","v":"2.7.1"},{"$f":"'2'!E99","v":0},{"$f":"'2'!F99","v":"2.7.1.2"},{"$f":"'2'!G99","v":0},{"$f":"'2'!H99","v":0},{"$f":"'2'!I99","v":"2.7.1.2.2"},{"$f":"'2'!J99","v":"2.7.1.2.2: Are agents trained in anti-fraud measures, such as being aware of common frauds, identity checking, and social engineering, and how to report fraud?\n[The channel for reporting fraud reporting could be the same as used for reporting suspected ML/TF, security incidents and data privacy breaches]\n"},{"$f":"'2'!K99","v":"1) Agent training plan / materials\n- Check content of agent training includes fraud education. For example, details of common frauds, identity checking and social engineering, and how to report fraud."},{"$f":"'2'!L99","v":0},{"$f":"'2'!M99","v":"Standard Required"},{"$f":"'2'!N99","v":"Required"},{"$f":"'2'!O99","v":"FraudRisk"},{"$f":"'2'!P99","v":0},{"$f":"'2'!Q99","v":0},{"$f":"'2'!R99","v":0},{"$f":"'2'!S99","v":0},{"$f":"'2'!T99","v":0},{"$f":"'2'!U99","v":0},{"$f":"'2'!V99","v":0},{"$f":"'2'!W99","v":0},{"$f":"'2'!X99","v":0},{"$f":"'2'!Y99","v":0},{"$f":"'2'!Z99","v":0},{"$f":"'2'!AA99","v":0},{"$f":"'2'!AB99","v":0},{"$f":"'2'!AC99","v":0},{"$f":"'2'!AD99","v":0},{"$f":"'2'!AE99","v":0},{"$f":"'2'!AF99","v":0},{"$f":"'2'!AG99","v":0},{"$f":"'2'!AH99","v":0},{"$f":"'2'!AI99","v":0},{"$f":"'2'!AJ99","v":0},{"$f":"'2'!AK99","v":0},{"$f":"'2'!AL99","v":0},{"$f":"'2'!AM99","v":0},{"$f":"'2'!AN99","v":0},{"$f":"'2'!AO99","v":0},{"$f":"'2'!AP99","v":0},{"$f":"'2'!AQ99","v":0},{"$f":"'2'!AR99","v":0},{"$f":"'2'!AS99","v":0},{"$f":"'2'!AT99","v":0},{"$f":"SUMPRODUCT(IF($N115=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N115=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B100","v":2},{"$f":"'2'!C100","v":2.7},{"$f":"'2'!D100","v":"2.7.1"},{"$f":"'2'!E100","v":""},{"$f":"'2'!F100","v":"2.7.1.2"},{"$f":"'2'!G100","v":0},{"$f":"'2'!H100","v":0},{"$f":"'2'!I100","v":"2.7.1.2.3"},{"$f":"'2'!J100","v":"2.7.1.2.3: Are employees and agents mandated to report fraud or suspected fraud, and trained in how to report suspicious activity?\n"},{"$f":"'2'!K100","v":0},{"$f":"'2'!L100","v":0},{"$f":"'2'!M100","v":"Recommended"},{"$f":"'2'!N100","v":"Recommended"},{"$f":"'2'!O100","v":"FraudRisk"},{"$f":"'2'!P100","v":0},{"$f":"'2'!Q100","v":0},{"$f":"'2'!R100","v":0},{"$f":"'2'!S100","v":0},{"$f":"'2'!T100","v":0},{"$f":"'2'!U100","v":0},{"$f":"'2'!V100","v":0},{"$f":"'2'!W100","v":0},{"$f":"'2'!X100","v":0},{"$f":"'2'!Y100","v":0},{"$f":"'2'!Z100","v":0},{"$f":"'2'!AA100","v":0},{"$f":"'2'!AB100","v":0},{"$f":"'2'!AC100","v":0},{"$f":"'2'!AD100","v":0},{"$f":"'2'!AE100","v":0},{"$f":"'2'!AF100","v":0},{"$f":"'2'!AG100","v":0},{"$f":"'2'!AH100","v":0},{"$f":"'2'!AI100","v":0},{"$f":"'2'!AJ100","v":0},{"$f":"'2'!AK100","v":0},{"$f":"'2'!AL100","v":0},{"$f":"'2'!AM100","v":0},{"$f":"'2'!AN100","v":0},{"$f":"'2'!AO100","v":0},{"$f":"'2'!AP100","v":0},{"$f":"'2'!AQ100","v":0},{"$f":"'2'!AR100","v":0},{"$f":"'2'!AS100","v":0},{"$f":"'2'!AT100","v":0},{"$f":"SUMPRODUCT(IF($N116=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N116=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B101","v":2},{"$f":"'2'!C101","v":2.7},{"$f":"'2'!D101","v":"2.7.1"},{"$f":"'2'!E101","v":""},{"$f":"'2'!F101","v":"2.7.1.3"},{"$f":"'2'!G101","v":"2.7.1.3: NOTIFICATIONS TO CUSTOMERS AND AGENTS\nProviders should send notifications to customers and agents whenever activity occurs on their account so that the user can verify it. This should include:\n- success or failure of all transactions;\n- change of security credentials (e.g., PIN replacement); and\n- change of personal information.\n\nTransaction confirmation messages should be sent to both the customer and the agent for cash-in and cash-out transactions.\n"},{"$f":"'2'!H101","v":"GSMA RMT"},{"$f":"'2'!I101","v":"2.7.1.3.1"},{"$f":"'2'!J101","v":"2.7.1.3.1: Are all mobile money users notified of the success or failure of all transactions?\n"},{"$f":"'2'!K101","v":"1) MM system functional specification \n- Check that notifications are sent to the customer of all transactions on their account, including transactions that have failed. [Could be evidenced by a demonstration of system]"},{"$f":"'2'!L101","v":0},{"$f":"'2'!M101","v":"Urgent Required"},{"$f":"'2'!N101","v":"Required"},{"$f":"'2'!O101","v":"FraudRisk"},{"$f":"'2'!P101","v":0},{"$f":"'2'!Q101","v":0},{"$f":"'2'!R101","v":0},{"$f":"'2'!S101","v":0},{"$f":"'2'!T101","v":0},{"$f":"'2'!U101","v":0},{"$f":"'2'!V101","v":0},{"$f":"'2'!W101","v":0},{"$f":"'2'!X101","v":0},{"$f":"'2'!Y101","v":0},{"$f":"'2'!Z101","v":0},{"$f":"'2'!AA101","v":0},{"$f":"'2'!AB101","v":0},{"$f":"'2'!AC101","v":0},{"$f":"'2'!AD101","v":0},{"$f":"'2'!AE101","v":0},{"$f":"'2'!AF101","v":0},{"$f":"'2'!AG101","v":0},{"$f":"'2'!AH101","v":0},{"$f":"'2'!AI101","v":0},{"$f":"'2'!AJ101","v":0},{"$f":"'2'!AK101","v":0},{"$f":"'2'!AL101","v":0},{"$f":"'2'!AM101","v":0},{"$f":"'2'!AN101","v":0},{"$f":"'2'!AO101","v":0},{"$f":"'2'!AP101","v":0},{"$f":"'2'!AQ101","v":0},{"$f":"'2'!AR101","v":0},{"$f":"'2'!AS101","v":0},{"$f":"'2'!AT101","v":0},{"$f":"SUMPRODUCT(IF($N117=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N117=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B102","v":2},{"$f":"'2'!C102","v":2.7},{"$f":"'2'!D102","v":"2.7.1"},{"$f":"'2'!E102","v":""},{"$f":"'2'!F102","v":"2.7.1.3"},{"$f":"'2'!G102","v":0},{"$f":"'2'!H102","v":0},{"$f":"'2'!I102","v":"2.7.1.3.2"},{"$f":"'2'!J102","v":"2.7.1.3.2: Are transaction confirmation messages sent to both the customer and the agent for cash-in and cash-out transactions?\n"},{"$f":"'2'!K102","v":"1) The MM system functional specification that relates to transactions, product description or customer journey description\n- Check that confirmation messages are sent to both customer and agent for cash-in/out transactions. [Could be evidenced by a demonstration of system]"},{"$f":"'2'!L102","v":0},{"$f":"'2'!M102","v":"Standard Required"},{"$f":"'2'!N102","v":"Required"},{"$f":"'2'!O102","v":"FraudRisk"},{"$f":"'2'!P102","v":0},{"$f":"'2'!Q102","v":0},{"$f":"'2'!R102","v":0},{"$f":"'2'!S102","v":0},{"$f":"'2'!T102","v":0},{"$f":"'2'!U102","v":0},{"$f":"'2'!V102","v":0},{"$f":"'2'!W102","v":0},{"$f":"'2'!X102","v":0},{"$f":"'2'!Y102","v":0},{"$f":"'2'!Z102","v":0},{"$f":"'2'!AA102","v":0},{"$f":"'2'!AB102","v":0},{"$f":"'2'!AC102","v":0},{"$f":"'2'!AD102","v":0},{"$f":"'2'!AE102","v":0},{"$f":"'2'!AF102","v":0},{"$f":"'2'!AG102","v":0},{"$f":"'2'!AH102","v":0},{"$f":"'2'!AI102","v":0},{"$f":"'2'!AJ102","v":0},{"$f":"'2'!AK102","v":0},{"$f":"'2'!AL102","v":0},{"$f":"'2'!AM102","v":0},{"$f":"'2'!AN102","v":0},{"$f":"'2'!AO102","v":0},{"$f":"'2'!AP102","v":0},{"$f":"'2'!AQ102","v":0},{"$f":"'2'!AR102","v":0},{"$f":"'2'!AS102","v":0},{"$f":"'2'!AT102","v":0},{"$f":"SUMPRODUCT(IF($N118=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N118=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B103","v":2},{"$f":"'2'!C103","v":2.7},{"$f":"'2'!D103","v":"2.7.1"},{"$f":"'2'!E103","v":""},{"$f":"'2'!F103","v":"2.7.1.3"},{"$f":"'2'!G103","v":0},{"$f":"'2'!H103","v":0},{"$f":"'2'!I103","v":"2.7.1.3.3"},{"$f":"'2'!J103","v":"2.7.1.3.3: Are mobile money account holders notified of key events such as change of security credentials (e.g. PIN replacement) and change of personal information?\n"},{"$f":"'2'!K103","v":"1) MM system functional specification \n- Check that notifications are sent to the customer of all changes on their account, including changes to security credentials and personal information. [Could be evidenced by a demonstration of system]"},{"$f":"'2'!L103","v":0},{"$f":"'2'!M103","v":"Urgent Required"},{"$f":"'2'!N103","v":"Required"},{"$f":"'2'!O103","v":"FraudRisk"},{"$f":"'2'!P103","v":0},{"$f":"'2'!Q103","v":0},{"$f":"'2'!R103","v":0},{"$f":"'2'!S103","v":0},{"$f":"'2'!T103","v":0},{"$f":"'2'!U103","v":0},{"$f":"'2'!V103","v":0},{"$f":"'2'!W103","v":0},{"$f":"'2'!X103","v":0},{"$f":"'2'!Y103","v":0},{"$f":"'2'!Z103","v":0},{"$f":"'2'!AA103","v":0},{"$f":"'2'!AB103","v":0},{"$f":"'2'!AC103","v":0},{"$f":"'2'!AD103","v":0},{"$f":"'2'!AE103","v":0},{"$f":"'2'!AF103","v":0},{"$f":"'2'!AG103","v":0},{"$f":"'2'!AH103","v":0},{"$f":"'2'!AI103","v":0},{"$f":"'2'!AJ103","v":0},{"$f":"'2'!AK103","v":0},{"$f":"'2'!AL103","v":0},{"$f":"'2'!AM103","v":0},{"$f":"'2'!AN103","v":0},{"$f":"'2'!AO103","v":0},{"$f":"'2'!AP103","v":0},{"$f":"'2'!AQ103","v":0},{"$f":"'2'!AR103","v":0},{"$f":"'2'!AS103","v":0},{"$f":"'2'!AT103","v":0},{"$f":"SUMPRODUCT(IF($N119=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N119=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B104","v":2},{"$f":"'2'!C104","v":2.7},{"$f":"'2'!D104","v":"2.7.1"},{"$f":"'2'!E104","v":""},{"$f":"'2'!F104","v":"2.7.1.4"},{"$f":"'2'!G104","v":"2.7.1.4: SECURE CHANGING OF SECURITY CREDENTIALS AND SIMS\nSIM swaps and PIN changes are particularly susceptible to fraud. Impersonation fraud and employee frauds are common.\n\nControls should be implemented to protect SIM swaps against impersonation fraud. Examples of protections include:\n - Requiring customer to present ID documentation to do SIM swap;\n - Preventing customer from using mobile money or USSD for 48 hours.\n\nAgent SIM swaps should be prohibited or strictly controlled. \n\nStrict controls shouold be enforced on staff that perform PIN changes, such as maker-checker, or restriction by roles, or monitoring of the PIN-change staff.\n\nRisk-based monitoring should be done on SIM swaps and change of PINs. High-risk accounts should be particularly monitored (e.g. airtime collection account, e-money disbursement/collection accounts, and high-value accounts)."},{"$f":"'2'!H104","v":"GSMA RMT"},{"$f":"'2'!I104","v":"2.7.1.4.1"},{"$f":"'2'!J104","v":"2.7.1.4.1: Have controls been implemented to protect SIM swaps against impersonation fraud?\n"},{"$f":"'2'!K104","v":"1) SIM swap process / fraud management policy (or equivalent documents)\n- Check that controls have been implemented to protect SIM swaps against impersonation fraud. Examples of protections include requiring customer to present ID documentation to or preventing customer from using mobile money or USSD for 48 hours. Other approaches may be acceptable.\n"},{"$f":"'2'!L104","v":0},{"$f":"'2'!M104","v":"Urgent Required"},{"$f":"'2'!N104","v":"Required"},{"$f":"'2'!O104","v":"FraudRisk"},{"$f":"'2'!P104","v":0},{"$f":"'2'!Q104","v":0},{"$f":"'2'!R104","v":0},{"$f":"'2'!S104","v":0},{"$f":"'2'!T104","v":0},{"$f":"'2'!U104","v":0},{"$f":"'2'!V104","v":0},{"$f":"'2'!W104","v":0},{"$f":"'2'!X104","v":0},{"$f":"'2'!Y104","v":0},{"$f":"'2'!Z104","v":0},{"$f":"'2'!AA104","v":0},{"$f":"'2'!AB104","v":0},{"$f":"'2'!AC104","v":0},{"$f":"'2'!AD104","v":0},{"$f":"'2'!AE104","v":0},{"$f":"'2'!AF104","v":0},{"$f":"'2'!AG104","v":0},{"$f":"'2'!AH104","v":0},{"$f":"'2'!AI104","v":0},{"$f":"'2'!AJ104","v":0},{"$f":"'2'!AK104","v":0},{"$f":"'2'!AL104","v":0},{"$f":"'2'!AM104","v":0},{"$f":"'2'!AN104","v":0},{"$f":"'2'!AO104","v":0},{"$f":"'2'!AP104","v":0},{"$f":"'2'!AQ104","v":0},{"$f":"'2'!AR104","v":0},{"$f":"'2'!AS104","v":0},{"$f":"'2'!AT104","v":0},{"$f":"SUMPRODUCT(IF($N120=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N120=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B105","v":2},{"$f":"'2'!C105","v":2.7},{"$f":"'2'!D105","v":"2.7.1"},{"$f":"'2'!E105","v":""},{"$f":"'2'!F105","v":"2.7.1.4"},{"$f":"'2'!G105","v":0},{"$f":"'2'!H105","v":0},{"$f":"'2'!I105","v":"2.7.1.4.2"},{"$f":"'2'!J105","v":"2.7.1.4.2: Are Agent SIM swaps prohibited or strictly controlled?\n"},{"$f":"'2'!K105","v":"1) SIM swap process / fraud management policy (or equivalent documents)\n- Check that there are controls in place to strictly control or prohibit Agent SIM swaps.\n\n"},{"$f":"'2'!L105","v":0},{"$f":"'2'!M105","v":"Standard Required"},{"$f":"'2'!N105","v":"Required"},{"$f":"'2'!O105","v":"FraudRisk"},{"$f":"'2'!P105","v":0},{"$f":"'2'!Q105","v":0},{"$f":"'2'!R105","v":0},{"$f":"'2'!S105","v":0},{"$f":"'2'!T105","v":0},{"$f":"'2'!U105","v":0},{"$f":"'2'!V105","v":0},{"$f":"'2'!W105","v":0},{"$f":"'2'!X105","v":0},{"$f":"'2'!Y105","v":0},{"$f":"'2'!Z105","v":0},{"$f":"'2'!AA105","v":0},{"$f":"'2'!AB105","v":0},{"$f":"'2'!AC105","v":0},{"$f":"'2'!AD105","v":0},{"$f":"'2'!AE105","v":0},{"$f":"'2'!AF105","v":0},{"$f":"'2'!AG105","v":0},{"$f":"'2'!AH105","v":0},{"$f":"'2'!AI105","v":0},{"$f":"'2'!AJ105","v":0},{"$f":"'2'!AK105","v":0},{"$f":"'2'!AL105","v":0},{"$f":"'2'!AM105","v":0},{"$f":"'2'!AN105","v":0},{"$f":"'2'!AO105","v":0},{"$f":"'2'!AP105","v":0},{"$f":"'2'!AQ105","v":0},{"$f":"'2'!AR105","v":0},{"$f":"'2'!AS105","v":0},{"$f":"'2'!AT105","v":0},{"$f":"SUMPRODUCT(IF($N121=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N121=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B106","v":2},{"$f":"'2'!C106","v":2.7},{"$f":"'2'!D106","v":"2.7.1"},{"$f":"'2'!E106","v":""},{"$f":"'2'!F106","v":"2.7.1.4"},{"$f":"'2'!G106","v":0},{"$f":"'2'!H106","v":0},{"$f":"'2'!I106","v":"2.7.1.4.3"},{"$f":"'2'!J106","v":"2.7.1.4.3: Are strict controls enforced on staff that perform PIN changes \ne.g. maker-checker, or restriction by roles, or monitoring of the PIN-change staff.\n"},{"$f":"'2'!K106","v":"1) PIN change process / fraud management policy (or equivalent documents)\n- Check that strict controls are enforced on staff that perform PIN changes e.g. maker-checker, or restriction by roles, or monitoring of the PIN-change staff.\n"},{"$f":"'2'!L106","v":0},{"$f":"'2'!M106","v":"Urgent Required"},{"$f":"'2'!N106","v":"Required"},{"$f":"'2'!O106","v":"FraudRisk"},{"$f":"'2'!P106","v":0},{"$f":"'2'!Q106","v":0},{"$f":"'2'!R106","v":0},{"$f":"'2'!S106","v":0},{"$f":"'2'!T106","v":0},{"$f":"'2'!U106","v":0},{"$f":"'2'!V106","v":0},{"$f":"'2'!W106","v":0},{"$f":"'2'!X106","v":0},{"$f":"'2'!Y106","v":0},{"$f":"'2'!Z106","v":0},{"$f":"'2'!AA106","v":0},{"$f":"'2'!AB106","v":0},{"$f":"'2'!AC106","v":0},{"$f":"'2'!AD106","v":0},{"$f":"'2'!AE106","v":0},{"$f":"'2'!AF106","v":0},{"$f":"'2'!AG106","v":0},{"$f":"'2'!AH106","v":0},{"$f":"'2'!AI106","v":0},{"$f":"'2'!AJ106","v":0},{"$f":"'2'!AK106","v":0},{"$f":"'2'!AL106","v":0},{"$f":"'2'!AM106","v":0},{"$f":"'2'!AN106","v":0},{"$f":"'2'!AO106","v":0},{"$f":"'2'!AP106","v":0},{"$f":"'2'!AQ106","v":0},{"$f":"'2'!AR106","v":0},{"$f":"'2'!AS106","v":0},{"$f":"'2'!AT106","v":0},{"$f":"SUMPRODUCT(IF($N122=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N122=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B107","v":2},{"$f":"'2'!C107","v":2.7},{"$f":"'2'!D107","v":"2.7.1"},{"$f":"'2'!E107","v":""},{"$f":"'2'!F107","v":"2.7.1.4"},{"$f":"'2'!G107","v":0},{"$f":"'2'!H107","v":0},{"$f":"'2'!I107","v":"2.7.1.4.4"},{"$f":"'2'!J107","v":"2.7.1.4.4: Is risk-based monitoring done on SIM swaps and change of PINs, particularly on higher-risk accounts?\n"},{"$f":"'2'!K107","v":"1) Monitoring / logging / audit trail specification and/or SIM swap and PIN change report \n- Check that monitoring is done on SIM swaps and change of PINs."},{"$f":"'2'!L107","v":0},{"$f":"'2'!M107","v":"Standard Required"},{"$f":"'2'!N107","v":"Required"},{"$f":"'2'!O107","v":"FraudRisk"},{"$f":"'2'!P107","v":0},{"$f":"'2'!Q107","v":0},{"$f":"'2'!R107","v":0},{"$f":"'2'!S107","v":0},{"$f":"'2'!T107","v":0},{"$f":"'2'!U107","v":0},{"$f":"'2'!V107","v":0},{"$f":"'2'!W107","v":0},{"$f":"'2'!X107","v":0},{"$f":"'2'!Y107","v":0},{"$f":"'2'!Z107","v":0},{"$f":"'2'!AA107","v":0},{"$f":"'2'!AB107","v":0},{"$f":"'2'!AC107","v":0},{"$f":"'2'!AD107","v":0},{"$f":"'2'!AE107","v":0},{"$f":"'2'!AF107","v":0},{"$f":"'2'!AG107","v":0},{"$f":"'2'!AH107","v":0},{"$f":"'2'!AI107","v":0},{"$f":"'2'!AJ107","v":0},{"$f":"'2'!AK107","v":0},{"$f":"'2'!AL107","v":0},{"$f":"'2'!AM107","v":0},{"$f":"'2'!AN107","v":0},{"$f":"'2'!AO107","v":0},{"$f":"'2'!AP107","v":0},{"$f":"'2'!AQ107","v":0},{"$f":"'2'!AR107","v":0},{"$f":"'2'!AS107","v":0},{"$f":"'2'!AT107","v":0},{"$f":"SUMPRODUCT(IF($N123=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N123=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B108","v":2},{"$f":"'2'!C108","v":2.7},{"$f":"'2'!D108","v":"2.7.1"},{"$f":"'2'!E108","v":""},{"$f":"'2'!F108","v":"2.7.1.5"},{"$f":"'2'!G108","v":"2.7.1.5: TRANSACTION AUTHORIZATION - BUYING GOODS AT MERCHANTS\nCustomer security credentials (e.g., PINs) should not be entered on any system that is not controlled by the provider or its trusted partners, including Point of Sale (PoS) devices and websites. Instead, the mobile money system should use another mechanism to authenticate customer transactions initiated on PoS devices or websites. If a customer-generated voucher (one-time code) is used, it should:\n- have a short validity period;\n- be specific to a merchant (or merchant chain);\n- be valid only up to a defined amount.\n\nThese controls limit the risk of the voucher being obtained by an unauthorized party and misused."},{"$f":"'2'!H108","v":"GSMA RMT"},{"$f":"'2'!I108","v":"2.7.1.5.1"},{"$f":"'2'!J108","v":"2.7.1.5.1: Are merchant transactions designed such that customers do not have to enter their PIN or other security credentials on Point of Sale (PoS) devices or websites that are not controlled by the provider or its trusted partners?\n"},{"$f":"'2'!K108","v":"1) MM system functional specification and / or demonstration of system\n- Check the system specification to verify customers do not enter security details on any merchant point of sale device, website or any other device not controlled by the provider or its trusted partner."},{"$f":"'2'!L108","v":0},{"$f":"'2'!M108","v":"Standard Required"},{"$f":"'2'!N108","v":"Required"},{"$f":"'2'!O108","v":"FraudRisk"},{"$f":"'2'!P108","v":0},{"$f":"'2'!Q108","v":0},{"$f":"'2'!R108","v":0},{"$f":"'2'!S108","v":0},{"$f":"'2'!T108","v":0},{"$f":"'2'!U108","v":0},{"$f":"'2'!V108","v":0},{"$f":"'2'!W108","v":0},{"$f":"'2'!X108","v":0},{"$f":"'2'!Y108","v":0},{"$f":"'2'!Z108","v":0},{"$f":"'2'!AA108","v":0},{"$f":"'2'!AB108","v":0},{"$f":"'2'!AC108","v":0},{"$f":"'2'!AD108","v":0},{"$f":"'2'!AE108","v":0},{"$f":"'2'!AF108","v":0},{"$f":"'2'!AG108","v":0},{"$f":"'2'!AH108","v":0},{"$f":"'2'!AI108","v":0},{"$f":"'2'!AJ108","v":0},{"$f":"'2'!AK108","v":0},{"$f":"'2'!AL108","v":0},{"$f":"'2'!AM108","v":0},{"$f":"'2'!AN108","v":0},{"$f":"'2'!AO108","v":0},{"$f":"'2'!AP108","v":0},{"$f":"'2'!AQ108","v":0},{"$f":"'2'!AR108","v":0},{"$f":"'2'!AS108","v":0},{"$f":"'2'!AT108","v":0},{"$f":"SUMPRODUCT(IF($N124=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N124=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B109","v":2},{"$f":"'2'!C109","v":2.7},{"$f":"'2'!D109","v":"2.7.1"},{"$f":"'2'!E109","v":""},{"$f":"'2'!F109","v":"2.7.1.5"},{"$f":"'2'!G109","v":0},{"$f":"'2'!H109","v":0},{"$f":"'2'!I109","v":"2.7.1.5.2"},{"$f":"'2'!J109","v":"2.7.1.5.2: If customer-generated vouchers (one-time codes) are used for merchant payments on PoS devices or websites, are they:\n - restricted with a short validity period?\n - specific to the merchant (or merchant chain)?\n - valid only up to a defined amount?\n"},{"$f":"'2'!K109","v":0},{"$f":"'2'!L109","v":0},{"$f":"'2'!M109","v":"Recommended"},{"$f":"'2'!N109","v":"Recommended"},{"$f":"'2'!O109","v":"FraudRisk"},{"$f":"'2'!P109","v":0},{"$f":"'2'!Q109","v":0},{"$f":"'2'!R109","v":0},{"$f":"'2'!S109","v":0},{"$f":"'2'!T109","v":0},{"$f":"'2'!U109","v":0},{"$f":"'2'!V109","v":0},{"$f":"'2'!W109","v":0},{"$f":"'2'!X109","v":0},{"$f":"'2'!Y109","v":0},{"$f":"'2'!Z109","v":0},{"$f":"'2'!AA109","v":0},{"$f":"'2'!AB109","v":0},{"$f":"'2'!AC109","v":0},{"$f":"'2'!AD109","v":0},{"$f":"'2'!AE109","v":0},{"$f":"'2'!AF109","v":0},{"$f":"'2'!AG109","v":0},{"$f":"'2'!AH109","v":0},{"$f":"'2'!AI109","v":0},{"$f":"'2'!AJ109","v":0},{"$f":"'2'!AK109","v":0},{"$f":"'2'!AL109","v":0},{"$f":"'2'!AM109","v":0},{"$f":"'2'!AN109","v":0},{"$f":"'2'!AO109","v":0},{"$f":"'2'!AP109","v":0},{"$f":"'2'!AQ109","v":0},{"$f":"'2'!AR109","v":0},{"$f":"'2'!AS109","v":0},{"$f":"'2'!AT109","v":0},{"$f":"SUMPRODUCT(IF($N125=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N125=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B110","v":2},{"$f":"'2'!C110","v":2.7},{"$f":"'2'!D110","v":"2.7.1"},{"$f":"'2'!E110","v":""},{"$f":"'2'!F110","v":"2.7.1.6"},{"$f":"'2'!G110","v":"2.7.1.6: DIRECT DEPOSITS\nA direct deposit is a cash-in into a remote account to fraudulently bypass the P2P charge. This is a major source of revenue leakage for many providers. \nProviders should implement controls to prevent or reduce direct deposits, including:\n- \"soft\" controls i.e. education of agents to conduct identity checks of the customer to prevent direct deposits, and penalties for agents that fail to do so; and\n- \"hard\" controls i.e. technical changes to ensure that the sender handset is present at cash-in."},{"$f":"'2'!H110","v":"GSMA RMT"},{"$f":"'2'!I110","v":"2.7.1.6.1"},{"$f":"'2'!J110","v":"2.7.1.6.1: Are controls implemented to prevent or reduce direct deposit fraud, where controls could include soft controls (agent processes) or hard controls (technical changes)?\n"},{"$f":"'2'!K110","v":0},{"$f":"'2'!L110","v":0},{"$f":"'2'!M110","v":"Recommended"},{"$f":"'2'!N110","v":"Recommended"},{"$f":"'2'!O110","v":"FraudRisk"},{"$f":"'2'!P110","v":0},{"$f":"'2'!Q110","v":0},{"$f":"'2'!R110","v":0},{"$f":"'2'!S110","v":0},{"$f":"'2'!T110","v":0},{"$f":"'2'!U110","v":0},{"$f":"'2'!V110","v":0},{"$f":"'2'!W110","v":0},{"$f":"'2'!X110","v":0},{"$f":"'2'!Y110","v":0},{"$f":"'2'!Z110","v":0},{"$f":"'2'!AA110","v":0},{"$f":"'2'!AB110","v":0},{"$f":"'2'!AC110","v":0},{"$f":"'2'!AD110","v":0},{"$f":"'2'!AE110","v":0},{"$f":"'2'!AF110","v":0},{"$f":"'2'!AG110","v":0},{"$f":"'2'!AH110","v":0},{"$f":"'2'!AI110","v":0},{"$f":"'2'!AJ110","v":0},{"$f":"'2'!AK110","v":0},{"$f":"'2'!AL110","v":0},{"$f":"'2'!AM110","v":0},{"$f":"'2'!AN110","v":0},{"$f":"'2'!AO110","v":0},{"$f":"'2'!AP110","v":0},{"$f":"'2'!AQ110","v":0},{"$f":"'2'!AR110","v":0},{"$f":"'2'!AS110","v":0},{"$f":"'2'!AT110","v":0},{"$f":"SUMPRODUCT(IF($N126=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N126=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B111","v":2},{"$f":"'2'!C111","v":2.7},{"$f":"'2'!D111","v":"2.7.1"},{"$f":"'2'!E111","v":""},{"$f":"'2'!F111","v":"2.7.1.7"},{"$f":"'2'!G111","v":"2.7.1.7: AGENT ANTI-FRAUD MEASURES\nProviders should ensure that agents cannot provide services outside the expected geographical area of their activities, as this may indicate fraudulent activity - for example, agent SIMs have been found operating illegal international money transfer from another country or used in prisons. The following controls should be implemented:\n- Providers should use location tracking of agent SIMs to identify agents that are operating outside their normal area;\n- Providers should disable roaming on agent handsets.\n\nProviders should introduce SMS restrictions so that agent SIMs can only receive SMSs from the mobile money system. This can prevent spoof SMSs from being sent to agents for false cash-outs.\n\nProviders should reconcile transaction and commissions data to detect commissions fraud, such as agents parcelling large transactions into smaller ones to earn larger commissions."},{"$f":"'2'!H111","v":"GSMA RMT"},{"$f":"'2'!I111","v":"2.7.1.7.1"},{"$f":"'2'!J111","v":"2.7.1.7.1: Is the location of agents being tracked to prevent agents from operating outside their normal area?\n"},{"$f":"'2'!K111","v":0},{"$f":"'2'!L111","v":0},{"$f":"'2'!M111","v":"Recommended"},{"$f":"'2'!N111","v":"Recommended"},{"$f":"'2'!O111","v":"FraudRisk"},{"$f":"'2'!P111","v":0},{"$f":"'2'!Q111","v":0},{"$f":"'2'!R111","v":0},{"$f":"'2'!S111","v":0},{"$f":"'2'!T111","v":0},{"$f":"'2'!U111","v":0},{"$f":"'2'!V111","v":0},{"$f":"'2'!W111","v":0},{"$f":"'2'!X111","v":0},{"$f":"'2'!Y111","v":0},{"$f":"'2'!Z111","v":0},{"$f":"'2'!AA111","v":0},{"$f":"'2'!AB111","v":0},{"$f":"'2'!AC111","v":0},{"$f":"'2'!AD111","v":0},{"$f":"'2'!AE111","v":0},{"$f":"'2'!AF111","v":0},{"$f":"'2'!AG111","v":0},{"$f":"'2'!AH111","v":0},{"$f":"'2'!AI111","v":0},{"$f":"'2'!AJ111","v":0},{"$f":"'2'!AK111","v":0},{"$f":"'2'!AL111","v":0},{"$f":"'2'!AM111","v":0},{"$f":"'2'!AN111","v":0},{"$f":"'2'!AO111","v":0},{"$f":"'2'!AP111","v":0},{"$f":"'2'!AQ111","v":0},{"$f":"'2'!AR111","v":0},{"$f":"'2'!AS111","v":0},{"$f":"'2'!AT111","v":0},{"$f":"SUMPRODUCT(IF($N127=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N127=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B112","v":2},{"$f":"'2'!C112","v":2.7},{"$f":"'2'!D112","v":"2.7.1"},{"$f":"'2'!E112","v":""},{"$f":"'2'!F112","v":"2.7.1.7"},{"$f":"'2'!G112","v":0},{"$f":"'2'!H112","v":0},{"$f":"'2'!I112","v":"2.7.1.7.2"},{"$f":"'2'!J112","v":"2.7.1.7.2: Is roaming disabled on agent handsets?\n"},{"$f":"'2'!K112","v":0},{"$f":"'2'!L112","v":0},{"$f":"'2'!M112","v":"Recommended"},{"$f":"'2'!N112","v":"Recommended"},{"$f":"'2'!O112","v":"FraudRisk"},{"$f":"'2'!P112","v":0},{"$f":"'2'!Q112","v":0},{"$f":"'2'!R112","v":0},{"$f":"'2'!S112","v":0},{"$f":"'2'!T112","v":0},{"$f":"'2'!U112","v":0},{"$f":"'2'!V112","v":0},{"$f":"'2'!W112","v":0},{"$f":"'2'!X112","v":0},{"$f":"'2'!Y112","v":0},{"$f":"'2'!Z112","v":0},{"$f":"'2'!AA112","v":0},{"$f":"'2'!AB112","v":0},{"$f":"'2'!AC112","v":0},{"$f":"'2'!AD112","v":0},{"$f":"'2'!AE112","v":0},{"$f":"'2'!AF112","v":0},{"$f":"'2'!AG112","v":0},{"$f":"'2'!AH112","v":0},{"$f":"'2'!AI112","v":0},{"$f":"'2'!AJ112","v":0},{"$f":"'2'!AK112","v":0},{"$f":"'2'!AL112","v":0},{"$f":"'2'!AM112","v":0},{"$f":"'2'!AN112","v":0},{"$f":"'2'!AO112","v":0},{"$f":"'2'!AP112","v":0},{"$f":"'2'!AQ112","v":0},{"$f":"'2'!AR112","v":0},{"$f":"'2'!AS112","v":0},{"$f":"'2'!AT112","v":0},{"$f":"SUMPRODUCT(IF($N128=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N128=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B113","v":2},{"$f":"'2'!C113","v":2.7},{"$f":"'2'!D113","v":"2.7.1"},{"$f":"'2'!E113","v":""},{"$f":"'2'!F113","v":"2.7.1.7"},{"$f":"'2'!G113","v":0},{"$f":"'2'!H113","v":0},{"$f":"'2'!I113","v":"2.7.1.7.3"},{"$f":"'2'!J113","v":"2.7.1.7.3: Have SMS restrictions been applied so that agent SIMs can only receive SMSs from the mobile money system in order to prevent spoof SMSs being sent to agents for false cash-outs?\n"},{"$f":"'2'!K113","v":0},{"$f":"'2'!L113","v":0},{"$f":"'2'!M113","v":"Recommended"},{"$f":"'2'!N113","v":"Recommended"},{"$f":"'2'!O113","v":"FraudRisk"},{"$f":"'2'!P113","v":0},{"$f":"'2'!Q113","v":0},{"$f":"'2'!R113","v":0},{"$f":"'2'!S113","v":0},{"$f":"'2'!T113","v":0},{"$f":"'2'!U113","v":0},{"$f":"'2'!V113","v":0},{"$f":"'2'!W113","v":0},{"$f":"'2'!X113","v":0},{"$f":"'2'!Y113","v":0},{"$f":"'2'!Z113","v":0},{"$f":"'2'!AA113","v":0},{"$f":"'2'!AB113","v":0},{"$f":"'2'!AC113","v":0},{"$f":"'2'!AD113","v":0},{"$f":"'2'!AE113","v":0},{"$f":"'2'!AF113","v":0},{"$f":"'2'!AG113","v":0},{"$f":"'2'!AH113","v":0},{"$f":"'2'!AI113","v":0},{"$f":"'2'!AJ113","v":0},{"$f":"'2'!AK113","v":0},{"$f":"'2'!AL113","v":0},{"$f":"'2'!AM113","v":0},{"$f":"'2'!AN113","v":0},{"$f":"'2'!AO113","v":0},{"$f":"'2'!AP113","v":0},{"$f":"'2'!AQ113","v":0},{"$f":"'2'!AR113","v":0},{"$f":"'2'!AS113","v":0},{"$f":"'2'!AT113","v":0},{"$f":"SUMPRODUCT(IF($N129=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N129=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B114","v":2},{"$f":"'2'!C114","v":2.7},{"$f":"'2'!D114","v":"2.7.1"},{"$f":"'2'!E114","v":""},{"$f":"'2'!F114","v":"2.7.1.7"},{"$f":"'2'!G114","v":0},{"$f":"'2'!H114","v":0},{"$f":"'2'!I114","v":"2.7.1.7.4"},{"$f":"'2'!J114","v":"2.7.1.7.4: Is transaction and commissions data reconciled to detect commissions fraud, such as agents parcelling large transactions into smaller ones to earn larger commissions?\n"},{"$f":"'2'!K114","v":0},{"$f":"'2'!L114","v":0},{"$f":"'2'!M114","v":"Recommended"},{"$f":"'2'!N114","v":"Recommended"},{"$f":"'2'!O114","v":"FraudRisk"},{"$f":"'2'!P114","v":0},{"$f":"'2'!Q114","v":0},{"$f":"'2'!R114","v":0},{"$f":"'2'!S114","v":0},{"$f":"'2'!T114","v":0},{"$f":"'2'!U114","v":0},{"$f":"'2'!V114","v":0},{"$f":"'2'!W114","v":0},{"$f":"'2'!X114","v":0},{"$f":"'2'!Y114","v":0},{"$f":"'2'!Z114","v":0},{"$f":"'2'!AA114","v":0},{"$f":"'2'!AB114","v":0},{"$f":"'2'!AC114","v":0},{"$f":"'2'!AD114","v":0},{"$f":"'2'!AE114","v":0},{"$f":"'2'!AF114","v":0},{"$f":"'2'!AG114","v":0},{"$f":"'2'!AH114","v":0},{"$f":"'2'!AI114","v":0},{"$f":"'2'!AJ114","v":0},{"$f":"'2'!AK114","v":0},{"$f":"'2'!AL114","v":0},{"$f":"'2'!AM114","v":0},{"$f":"'2'!AN114","v":0},{"$f":"'2'!AO114","v":0},{"$f":"'2'!AP114","v":0},{"$f":"'2'!AQ114","v":0},{"$f":"'2'!AR114","v":0},{"$f":"'2'!AS114","v":0},{"$f":"'2'!AT114","v":0},{"$f":"SUMPRODUCT(IF($N130=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N130=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B115","v":2},{"$f":"'2'!C115","v":2.7},{"$f":"'2'!D115","v":"2.7.1"},{"$f":"'2'!E115","v":""},{"$f":"'2'!F115","v":"2.7.1.8"},{"$f":"'2'!G115","v":"2.7.1.8: SANCTIONS FOR AGENTS, BUSINESSES AND MERCHANTS\nSanctions should be applied to agents, businesses or merchants found to be in breach of process or involved in fraud. Examples of sanctions include:\n- Tiered sanctions, increasing in severity upon repetition of offence e.g., suspend account for 1 day/ 1 month/ permanently, or three-strikes-and-out;\n- Termination of agent or reseller status; or\n- Reporting to police for criminal activity."},{"$f":"'2'!H115","v":"GSMA RMT"},{"$f":"'2'!I115","v":"2.7.1.8.1"},{"$f":"'2'!J115","v":"2.7.1.8.1: Are sanctions applied to agents, businesses, or merchants found to be involved in fraud?\n"},{"$f":"'2'!K115","v":"1) Fraud management policy (or equivalent documents)\n- Check there is a process to sanction agents, businesses or merchants that are found to be involved in fraud or wrongdoing.\n\n"},{"$f":"'2'!L115","v":0},{"$f":"'2'!M115","v":"Urgent Required"},{"$f":"'2'!N115","v":"Required"},{"$f":"'2'!O115","v":"FraudRisk"},{"$f":"'2'!P115","v":0},{"$f":"'2'!Q115","v":0},{"$f":"'2'!R115","v":0},{"$f":"'2'!S115","v":0},{"$f":"'2'!T115","v":0},{"$f":"'2'!U115","v":0},{"$f":"'2'!V115","v":0},{"$f":"'2'!W115","v":0},{"$f":"'2'!X115","v":0},{"$f":"'2'!Y115","v":0},{"$f":"'2'!Z115","v":0},{"$f":"'2'!AA115","v":0},{"$f":"'2'!AB115","v":0},{"$f":"'2'!AC115","v":0},{"$f":"'2'!AD115","v":0},{"$f":"'2'!AE115","v":0},{"$f":"'2'!AF115","v":0},{"$f":"'2'!AG115","v":0},{"$f":"'2'!AH115","v":0},{"$f":"'2'!AI115","v":0},{"$f":"'2'!AJ115","v":0},{"$f":"'2'!AK115","v":0},{"$f":"'2'!AL115","v":0},{"$f":"'2'!AM115","v":0},{"$f":"'2'!AN115","v":0},{"$f":"'2'!AO115","v":0},{"$f":"'2'!AP115","v":0},{"$f":"'2'!AQ115","v":0},{"$f":"'2'!AR115","v":0},{"$f":"'2'!AS115","v":0},{"$f":"'2'!AT115","v":0},{"$f":"SUMPRODUCT(IF($N131=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N131=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B116","v":2},{"$f":"'2'!C116","v":2.7},{"$f":"'2'!D116","v":"2.7.1"},{"$f":"'2'!E116","v":""},{"$f":"'2'!F116","v":"2.7.1.9"},{"$f":"'2'!G116","v":"2.7.1.9: ACCOUNT-CHECKING BY AGENTS, BUSINESSES AND MERCHANTS\nProviders should communicate to agents, businesses and merchants the importance of regular checks to ensure the integrity and accuracy of their accounts. This will help detect fraud and reduce the opportunity for fraud. \n\nAgents, businesses and merchants should:\n- reconcile their mobile money account balance with a separate log of transactions to detect any variance between the actual and expected amount;\n- monitor account balances to check for unusual activity."},{"$f":"'2'!H116","v":"GSMA RMT"},{"$f":"'2'!I116","v":"2.7.1.9.1"},{"$f":"'2'!J116","v":"2.7.1.9.1: Do providers communicate to agents, businesses and merchants the importance of comparing the actual and expected balance of funds in their mobile money account to detect possible fraud?\n"},{"$f":"'2'!K116","v":0},{"$f":"'2'!L116","v":0},{"$f":"'2'!M116","v":"Recommended"},{"$f":"'2'!N116","v":"Recommended"},{"$f":"'2'!O116","v":"FraudRisk"},{"$f":"'2'!P116","v":0},{"$f":"'2'!Q116","v":0},{"$f":"'2'!R116","v":0},{"$f":"'2'!S116","v":0},{"$f":"'2'!T116","v":0},{"$f":"'2'!U116","v":0},{"$f":"'2'!V116","v":0},{"$f":"'2'!W116","v":0},{"$f":"'2'!X116","v":0},{"$f":"'2'!Y116","v":0},{"$f":"'2'!Z116","v":0},{"$f":"'2'!AA116","v":0},{"$f":"'2'!AB116","v":0},{"$f":"'2'!AC116","v":0},{"$f":"'2'!AD116","v":0},{"$f":"'2'!AE116","v":0},{"$f":"'2'!AF116","v":0},{"$f":"'2'!AG116","v":0},{"$f":"'2'!AH116","v":0},{"$f":"'2'!AI116","v":0},{"$f":"'2'!AJ116","v":0},{"$f":"'2'!AK116","v":0},{"$f":"'2'!AL116","v":0},{"$f":"'2'!AM116","v":0},{"$f":"'2'!AN116","v":0},{"$f":"'2'!AO116","v":0},{"$f":"'2'!AP116","v":0},{"$f":"'2'!AQ116","v":0},{"$f":"'2'!AR116","v":0},{"$f":"'2'!AS116","v":0},{"$f":"'2'!AT116","v":0},{"$f":"SUMPRODUCT(IF($N132=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N132=CategoryRecommended,1,0))","v":1},{"$f":"_xlfn.IFNA(MATCH($Q132,ComplianceYes,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q132,CompliancePartial,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q132,ComplianceNo,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q132,ComplianceNA,0),0)","v":0},{"$f":"$AU132*AW132","v":0},{"$f":"$AU132*AX132","v":0},{"$f":"$AU132*AY132","v":0},{"$f":"$AU132*AZ132","v":0},{"$f":"$AV132*AW132","v":0},{"$f":"$AV132*AX132","v":0},{"$f":"$AV132*AY132","v":0},{"$f":"$AV132*AZ132","v":0},{"$f":"_xlfn.IFNA(MATCH($AF132,ComplianceYes,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF132,CompliancePartial,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF132,ComplianceNo,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF132,ComplianceNA,0),0)","v":0},0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B117","v":2},{"$f":"'2'!C117","v":2.7},{"$f":"'2'!D117","v":"2.7.1"},{"$f":"'2'!E117","v":""},{"$f":"'2'!F117","v":"2.7.1.10"},{"$f":"'2'!G117","v":"2.7.1.10: INFORMATION-SHARING WITH OTHER PROVIDERS\nAn information-sharing process or forum should be set up to enable a country's mobile money providers to share information about known frauds and counter-measures.\n\nWhere possible, providers should share details of agents, businesses and merchants (and their directors) that have been found to have engaged in fraud.\n\nNote: GSMA also hosts a Fraud and Risk working group, where best practice is shared and discussed."},{"$f":"'2'!H117","v":"GSMA RMT"},{"$f":"'2'!I117","v":"2.7.1.10.1"},{"$f":"'2'!J117","v":"2.7.1.10.1: Is there an information-sharing process or forum to enable a country's mobile money providers to share information about known frauds and counter-measures?\n"},{"$f":"'2'!K117","v":0},{"$f":"'2'!L117","v":0},{"$f":"'2'!M117","v":"Recommended"},{"$f":"'2'!N117","v":"Recommended"},{"$f":"'2'!O117","v":"FraudRisk"},{"$f":"'2'!P117","v":0},{"$f":"'2'!Q117","v":0},{"$f":"'2'!R117","v":0},{"$f":"'2'!S117","v":0},{"$f":"'2'!T117","v":0},{"$f":"'2'!U117","v":0},{"$f":"'2'!V117","v":0},{"$f":"'2'!W117","v":0},{"$f":"'2'!X117","v":0},{"$f":"'2'!Y117","v":0},{"$f":"'2'!Z117","v":0},{"$f":"'2'!AA117","v":0},{"$f":"'2'!AB117","v":0},{"$f":"'2'!AC117","v":0},{"$f":"'2'!AD117","v":0},{"$f":"'2'!AE117","v":0},{"$f":"'2'!AF117","v":0},{"$f":"'2'!AG117","v":0},{"$f":"'2'!AH117","v":0},{"$f":"'2'!AI117","v":0},{"$f":"'2'!AJ117","v":0},{"$f":"'2'!AK117","v":0},{"$f":"'2'!AL117","v":0},{"$f":"'2'!AM117","v":0},{"$f":"'2'!AN117","v":0},{"$f":"'2'!AO117","v":0},{"$f":"'2'!AP117","v":0},{"$f":"'2'!AQ117","v":0},{"$f":"'2'!AR117","v":0},{"$f":"'2'!AS117","v":0},{"$f":"'2'!AT117","v":0},{"$f":"SUMPRODUCT(IF($N133=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N133=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,{"$f":"$AU133*BI133","v":0},{"$f":"$AU133*BJ133","v":0},{"$f":"$AU133*BK133","v":0},{"$f":"$AU133*BL133","v":0},{"$f":"$AV133*BI133","v":0},{"$f":"$AV133*BJ133","v":0},{"$f":"$AV133*BK133","v":0},{"$f":"$AV133*BL133","v":0}]
[null,{"$f":"'2'!B118","v":2},{"$f":"'2'!C118","v":2.7},{"$f":"'2'!D118","v":"2.7.1"},{"$f":"'2'!E118","v":""},{"$f":"'2'!F118","v":"2.7.1.11"},{"$f":"'2'!G118","v":"2.7.1.11: PROTECT AT-RISK ACCOUNTS AND TRANSACTIONS\nCertain types of accounts have been targeted by fraudsters (often internal fraud), and measures should be implemented to protect these accounts. Types of at-risk accounts include:\n- Provider's airtime collection account;\n- High-value accounts such as business accounts;\n- E-money collection/disbursement accounts;\n- Abandoned accounts e.g. the customer closes the mobile phone account but not the mobile money account; the customer forgets about the account; or the customer dies.\n\nIt is recommended that more secure handsets are used for higher-risk accounts, such as agent, business and merchant accounts. For example, STK-based or smartphone terminals instead of USSD-based handsets.\n\nBulk payment transactions are another source of fraud and measures should be taken to secure these transactions. For example the use of maker-checker.\n"},{"$f":"'2'!H118","v":"GSMA RMT"},{"$f":"'2'!I118","v":"2.7.1.11.1"},{"$f":"'2'!J118","v":"2.7.1.11.1: Have measures been implemented to protect at-risk accounts from internal fraud, such as the airtime collection account, e-money disbursement/collection accounts, high-value accounts and abandoned accounts?\n"},{"$f":"'2'!K118","v":0},{"$f":"'2'!L118","v":0},{"$f":"'2'!M118","v":"Recommended"},{"$f":"'2'!N118","v":"Recommended"},{"$f":"'2'!O118","v":"FraudRisk"},{"$f":"'2'!P118","v":0},{"$f":"'2'!Q118","v":0},{"$f":"'2'!R118","v":0},{"$f":"'2'!S118","v":0},{"$f":"'2'!T118","v":0},{"$f":"'2'!U118","v":0},{"$f":"'2'!V118","v":0},{"$f":"'2'!W118","v":0},{"$f":"'2'!X118","v":0},{"$f":"'2'!Y118","v":0},{"$f":"'2'!Z118","v":0},{"$f":"'2'!AA118","v":0},{"$f":"'2'!AB118","v":0},{"$f":"'2'!AC118","v":0},{"$f":"'2'!AD118","v":0},{"$f":"'2'!AE118","v":0},{"$f":"'2'!AF118","v":0},{"$f":"'2'!AG118","v":0},{"$f":"'2'!AH118","v":0},{"$f":"'2'!AI118","v":0},{"$f":"'2'!AJ118","v":0},{"$f":"'2'!AK118","v":0},{"$f":"'2'!AL118","v":0},{"$f":"'2'!AM118","v":0},{"$f":"'2'!AN118","v":0},{"$f":"'2'!AO118","v":0},{"$f":"'2'!AP118","v":0},{"$f":"'2'!AQ118","v":0},{"$f":"'2'!AR118","v":0},{"$f":"'2'!AS118","v":0},{"$f":"'2'!AT118","v":0},{"$f":"SUMPRODUCT(IF($N134=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N134=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B119","v":2},{"$f":"'2'!C119","v":2.7},{"$f":"'2'!D119","v":"2.7.1"},{"$f":"'2'!E119","v":0},{"$f":"'2'!F119","v":"2.7.1.11"},{"$f":"'2'!G119","v":0},{"$f":"'2'!H119","v":0},{"$f":"'2'!I119","v":0},{"$f":"'2'!J119","v":"2.7.1.11.2: Are more secure handsets are used for higher-risk accounts, such as agent, business and merchant accounts? \n(For example, STK-based or smartphone terminals instead of USSD-based handsets.)\n"},{"$f":"'2'!K119","v":0},{"$f":"'2'!L119","v":0},{"$f":"'2'!M119","v":"Recommended"},{"$f":"'2'!N119","v":"Recommended"},{"$f":"'2'!O119","v":"FraudRisk"},{"$f":"'2'!P119","v":0},{"$f":"'2'!Q119","v":0},{"$f":"'2'!R119","v":0},{"$f":"'2'!S119","v":0},{"$f":"'2'!T119","v":0},{"$f":"'2'!U119","v":0},{"$f":"'2'!V119","v":0},{"$f":"'2'!W119","v":0},{"$f":"'2'!X119","v":0},{"$f":"'2'!Y119","v":0},{"$f":"'2'!Z119","v":0},{"$f":"'2'!AA119","v":0},{"$f":"'2'!AB119","v":0},{"$f":"'2'!AC119","v":0},{"$f":"'2'!AD119","v":0},{"$f":"'2'!AE119","v":0},{"$f":"'2'!AF119","v":0},{"$f":"'2'!AG119","v":0},{"$f":"'2'!AH119","v":0},{"$f":"'2'!AI119","v":0},{"$f":"'2'!AJ119","v":0},{"$f":"'2'!AK119","v":0},{"$f":"'2'!AL119","v":0},{"$f":"'2'!AM119","v":0},{"$f":"'2'!AN119","v":0},{"$f":"'2'!AO119","v":0},{"$f":"'2'!AP119","v":0},{"$f":"'2'!AQ119","v":0},{"$f":"'2'!AR119","v":0},{"$f":"'2'!AS119","v":0},{"$f":"'2'!AT119","v":0},{"$f":"SUMPRODUCT(IF($N135=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N135=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B120","v":2},{"$f":"'2'!C120","v":2.7},{"$f":"'2'!D120","v":"2.7.1"},{"$f":"'2'!E120","v":0},{"$f":"'2'!F120","v":"2.7.1.11"},{"$f":"'2'!G120","v":0},{"$f":"'2'!H120","v":0},{"$f":"'2'!I120","v":"2.7.1.11.3"},{"$f":"'2'!J120","v":"2.7.1.11.3: Have measures been implemented to secure bulk payment transactions, for example with the use of maker-checker?\n"},{"$f":"'2'!K120","v":0},{"$f":"'2'!L120","v":0},{"$f":"'2'!M120","v":"Recommended"},{"$f":"'2'!N120","v":"Recommended"},{"$f":"'2'!O120","v":"FraudRisk"},{"$f":"'2'!P120","v":0},{"$f":"'2'!Q120","v":0},{"$f":"'2'!R120","v":0},{"$f":"'2'!S120","v":0},{"$f":"'2'!T120","v":0},{"$f":"'2'!U120","v":0},{"$f":"'2'!V120","v":0},{"$f":"'2'!W120","v":0},{"$f":"'2'!X120","v":0},{"$f":"'2'!Y120","v":0},{"$f":"'2'!Z120","v":0},{"$f":"'2'!AA120","v":0},{"$f":"'2'!AB120","v":0},{"$f":"'2'!AC120","v":0},{"$f":"'2'!AD120","v":0},{"$f":"'2'!AE120","v":0},{"$f":"'2'!AF120","v":0},{"$f":"'2'!AG120","v":0},{"$f":"'2'!AH120","v":0},{"$f":"'2'!AI120","v":0},{"$f":"'2'!AJ120","v":0},{"$f":"'2'!AK120","v":0},{"$f":"'2'!AL120","v":0},{"$f":"'2'!AM120","v":0},{"$f":"'2'!AN120","v":0},{"$f":"'2'!AO120","v":0},{"$f":"'2'!AP120","v":0},{"$f":"'2'!AQ120","v":0},{"$f":"'2'!AR120","v":0},{"$f":"'2'!AS120","v":0},{"$f":"'2'!AT120","v":0},{"$f":"SUMPRODUCT(IF($N136=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N136=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'2'!B121","v":2},{"$f":"'2'!C121","v":2.7},{"$f":"'2'!D121","v":"2.7.1"},{"$f":"'2'!E121","v":""},{"$f":"'2'!F121","v":"2.7.1.12"},{"$f":"'2'!G121","v":"2.7.1.12: IDENTITY THEFT PROTECTION\nCustomer name validation is implemented by some operators to reduce reversals by presenting the recipient's name to the sender. However, this could be abused by fraudsters to steal customers' identities.\n\nProviders should implement measures to reduce the risk of identity theft using the customer name validation functionality. For example, providers could:\n- restrict the number of times that customer name validation can be initiated and cancelled per day; or \n- restrict customer name validation only to names from the customer's list of contacts."},{"$f":"'2'!H121","v":"GSMA RMT"},{"$f":"'2'!I121","v":"2.7.1.12.1"},{"$f":"'2'!J121","v":"2.7.1.12.1: Have providers implemented controls to limit the risk of customer name validation functionality being used for identity theft?\n"},{"$f":"'2'!K121","v":0},{"$f":"'2'!L121","v":0},{"$f":"'2'!M121","v":"Recommended"},{"$f":"'2'!N121","v":"Recommended"},{"$f":"'2'!O121","v":"FraudRisk"},{"$f":"'2'!P121","v":0},{"$f":"'2'!Q121","v":0},{"$f":"'2'!R121","v":0},{"$f":"'2'!S121","v":0},{"$f":"'2'!T121","v":0},{"$f":"'2'!U121","v":0},{"$f":"'2'!V121","v":0},{"$f":"'2'!W121","v":0},{"$f":"'2'!X121","v":0},{"$f":"'2'!Y121","v":0},{"$f":"'2'!Z121","v":0},{"$f":"'2'!AA121","v":0},{"$f":"'2'!AB121","v":0},{"$f":"'2'!AC121","v":0},{"$f":"'2'!AD121","v":0},{"$f":"'2'!AE121","v":0},{"$f":"'2'!AF121","v":0},{"$f":"'2'!AG121","v":0},{"$f":"'2'!AH121","v":0},{"$f":"'2'!AI121","v":0},{"$f":"'2'!AJ121","v":0},{"$f":"'2'!AK121","v":0},{"$f":"'2'!AL121","v":0},{"$f":"'2'!AM121","v":0},{"$f":"'2'!AN121","v":0},{"$f":"'2'!AO121","v":0},{"$f":"'2'!AP121","v":0},{"$f":"'2'!AQ121","v":0},{"$f":"'2'!AR121","v":0},{"$f":"'2'!AS121","v":0},{"$f":"'2'!AT121","v":0},{"$f":"SUMPRODUCT(IF($N137=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N137=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B5","v":"3"},{"$f":"'3'!C5","v":"3.1"},{"$f":"'3'!D5","v":"3.1.1"},{"$f":"'3'!E5","v":"3.1.1: Providers shall conduct proper due diligence on potential staff, agents and entities providing outsourced services"},{"$f":"'3'!F5","v":"3.1.1.1"},{"$f":"'3'!G5","v":"3.1.1.1: STAFF DUE DILIGENCE PROCESS\nDue diligence should be carried out on all mobile money staff before their employment and regularly thereafter, as determined by risk assessment.\n\nIdentification data should be obtained for all staff (full name, address, date of birth). A risk assessment should determine whether further due diligence is reuqired, which could include the following, for example:\n- employment history;\n- reference checks;\n- criminal record check;\n- watchlist screening (using domestic and international money laundering, terrorist financing, and sanctions watchlists). \n\nThe risk assessment may determine that additional due diligence should be carried out on higher-risk roles; for example the following:\n- Finance team\n- AML/Fraud team\n- Privileged account holders (super users or account creation roles)\n- The head of mobile money and managers of key functions\n\nThe staff due diligence process should be regularly reviewed and updated as needed, such as when changes are made to the service or regulation. "},{"$f":"'3'!H5","v":"GSMA RMT"},{"$f":"'3'!I5","v":"3.1.1.1.1"},{"$f":"'3'!J5","v":"3.1.1.1.1: Is there a documented staff due diligence process, and is it regularly reviewed and updated as needed?\n"},{"$f":"'3'!K5","v":"1) Staff due diligence process\n-Check that that process is documented\n-Check that the document includes a revision history\n-Check that that document has been reviewed within the last 24 months"},{"$f":"'3'!L5","v":0},{"$f":"'3'!M5","v":"Urgent Required"},{"$f":"'3'!N5","v":"Required"},{"$f":"'3'!O5","v":"HR"},{"$f":"'3'!P5","v":0},{"$f":"'3'!Q5","v":0},{"$f":"'3'!R5","v":0},{"$f":"'3'!S5","v":0},{"$f":"'3'!T5","v":0},{"$f":"'3'!U5","v":0},{"$f":"'3'!V5","v":0},{"$f":"'3'!W5","v":0},{"$f":"'3'!X5","v":0},{"$f":"'3'!Y5","v":0},{"$f":"'3'!Z5","v":0},{"$f":"'3'!AA5","v":0},{"$f":"'3'!AB5","v":0},{"$f":"'3'!AC5","v":0},{"$f":"'3'!AD5","v":0},{"$f":"'3'!AE5","v":0},{"$f":"'3'!AF5","v":0},{"$f":"'3'!AG5","v":0},{"$f":"'3'!AH5","v":0},{"$f":"'3'!AI5","v":0},{"$f":"'3'!AJ5","v":0},{"$f":"'3'!AK5","v":0},{"$f":"'3'!AL5","v":0},{"$f":"'3'!AM5","v":0},{"$f":"'3'!AN5","v":0},{"$f":"'3'!AO5","v":0},{"$f":"'3'!AP5","v":0},{"$f":"'3'!AQ5","v":0},{"$f":"'3'!AR5","v":0},{"$f":"'3'!AS5","v":0},{"$f":"'3'!AT5","v":0},{"$f":"SUMPRODUCT(IF($N138=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N138=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B6","v":"3"},{"$f":"'3'!C6","v":"3.1"},{"$f":"'3'!D6","v":"3.1.1"},{"$f":"'3'!E6","v":0},{"$f":"'3'!F6","v":"3.1.1.1"},{"$f":"'3'!G6","v":0},{"$f":"'3'!H6","v":0},{"$f":"'3'!I6","v":"3.1.1.1.2"},{"$f":"'3'!J6","v":"3.1.1.1.2: Are identification data collected for staff - full name, address, date of birth?\n"},{"$f":"'3'!K6","v":"1) Staff due diligence process\n- Check that there is a process for identification data to be collected from staff.\n- Check that this includes:\na) Full Names\nb) Address\nc) Date of birth"},{"$f":"'3'!L6","v":0},{"$f":"'3'!M6","v":"Urgent Required"},{"$f":"'3'!N6","v":"Required"},{"$f":"'3'!O6","v":"HR"},{"$f":"'3'!P6","v":0},{"$f":"'3'!Q6","v":0},{"$f":"'3'!R6","v":0},{"$f":"'3'!S6","v":0},{"$f":"'3'!T6","v":0},{"$f":"'3'!U6","v":0},{"$f":"'3'!V6","v":0},{"$f":"'3'!W6","v":0},{"$f":"'3'!X6","v":0},{"$f":"'3'!Y6","v":0},{"$f":"'3'!Z6","v":0},{"$f":"'3'!AA6","v":0},{"$f":"'3'!AB6","v":0},{"$f":"'3'!AC6","v":0},{"$f":"'3'!AD6","v":0},{"$f":"'3'!AE6","v":0},{"$f":"'3'!AF6","v":0},{"$f":"'3'!AG6","v":0},{"$f":"'3'!AH6","v":0},{"$f":"'3'!AI6","v":0},{"$f":"'3'!AJ6","v":0},{"$f":"'3'!AK6","v":0},{"$f":"'3'!AL6","v":0},{"$f":"'3'!AM6","v":0},{"$f":"'3'!AN6","v":0},{"$f":"'3'!AO6","v":0},{"$f":"'3'!AP6","v":0},{"$f":"'3'!AQ6","v":0},{"$f":"'3'!AR6","v":0},{"$f":"'3'!AS6","v":0},{"$f":"'3'!AT6","v":0},{"$f":"SUMPRODUCT(IF($N139=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N139=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B7","v":"3"},{"$f":"'3'!C7","v":"3.1"},{"$f":"'3'!D7","v":"3.1.1"},{"$f":"'3'!E7","v":0},{"$f":"'3'!F7","v":"3.1.1.1"},{"$f":"'3'!G7","v":0},{"$f":"'3'!H7","v":0},{"$f":"'3'!I7","v":"3.1.1.1.3"},{"$f":"'3'!J7","v":"3.1.1.1.3: Is a risk-based assessment carried out to determine whether additional due diligence is required (e.g. watchlist screening or additional KYC) for staff in sensitive roles (such as head of mobile money, Finance team, AML staff, Fraud team, and privileged staff account holders (super users or account creation roles)?\n"},{"$f":"'3'!K7","v":"1) Staff due diligence process\n- Check that a risk-based assessment has been carried out to determine whether additional due diligence is required (e.g. watchlist screening or additional KYC) for staff in sensitive roles  (based on reasonable assessment of risk)."},{"$f":"'3'!L7","v":0},{"$f":"'3'!M7","v":"Standard Required"},{"$f":"'3'!N7","v":"Required"},{"$f":"'3'!O7","v":"HR"},{"$f":"'3'!P7","v":0},{"$f":"'3'!Q7","v":0},{"$f":"'3'!R7","v":0},{"$f":"'3'!S7","v":0},{"$f":"'3'!T7","v":0},{"$f":"'3'!U7","v":0},{"$f":"'3'!V7","v":0},{"$f":"'3'!W7","v":0},{"$f":"'3'!X7","v":0},{"$f":"'3'!Y7","v":0},{"$f":"'3'!Z7","v":0},{"$f":"'3'!AA7","v":0},{"$f":"'3'!AB7","v":0},{"$f":"'3'!AC7","v":0},{"$f":"'3'!AD7","v":0},{"$f":"'3'!AE7","v":0},{"$f":"'3'!AF7","v":0},{"$f":"'3'!AG7","v":0},{"$f":"'3'!AH7","v":0},{"$f":"'3'!AI7","v":0},{"$f":"'3'!AJ7","v":0},{"$f":"'3'!AK7","v":0},{"$f":"'3'!AL7","v":0},{"$f":"'3'!AM7","v":0},{"$f":"'3'!AN7","v":0},{"$f":"'3'!AO7","v":0},{"$f":"'3'!AP7","v":0},{"$f":"'3'!AQ7","v":0},{"$f":"'3'!AR7","v":0},{"$f":"'3'!AS7","v":0},{"$f":"'3'!AT7","v":0},{"$f":"SUMPRODUCT(IF($N140=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N140=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B8","v":"3"},{"$f":"'3'!C8","v":"3.1"},{"$f":"'3'!D8","v":"3.1.1"},{"$f":"'3'!E8","v":0},{"$f":"'3'!F8","v":"3.1.1.1"},{"$f":"'3'!G8","v":0},{"$f":"'3'!H8","v":0},{"$f":"'3'!I8","v":"3.1.1.1.4"},{"$f":"'3'!J8","v":"3.1.1.1.4: Is employment history checked and are references taken for all operational staff?\n"},{"$f":"'3'!K8","v":0},{"$f":"'3'!L8","v":0},{"$f":"'3'!M8","v":"Recommended"},{"$f":"'3'!N8","v":"Recommended"},{"$f":"'3'!O8","v":"HR"},{"$f":"'3'!P8","v":0},{"$f":"'3'!Q8","v":0},{"$f":"'3'!R8","v":0},{"$f":"'3'!S8","v":0},{"$f":"'3'!T8","v":0},{"$f":"'3'!U8","v":0},{"$f":"'3'!V8","v":0},{"$f":"'3'!W8","v":0},{"$f":"'3'!X8","v":0},{"$f":"'3'!Y8","v":0},{"$f":"'3'!Z8","v":0},{"$f":"'3'!AA8","v":0},{"$f":"'3'!AB8","v":0},{"$f":"'3'!AC8","v":0},{"$f":"'3'!AD8","v":0},{"$f":"'3'!AE8","v":0},{"$f":"'3'!AF8","v":0},{"$f":"'3'!AG8","v":0},{"$f":"'3'!AH8","v":0},{"$f":"'3'!AI8","v":0},{"$f":"'3'!AJ8","v":0},{"$f":"'3'!AK8","v":0},{"$f":"'3'!AL8","v":0},{"$f":"'3'!AM8","v":0},{"$f":"'3'!AN8","v":0},{"$f":"'3'!AO8","v":0},{"$f":"'3'!AP8","v":0},{"$f":"'3'!AQ8","v":0},{"$f":"'3'!AR8","v":0},{"$f":"'3'!AS8","v":0},{"$f":"'3'!AT8","v":0},{"$f":"SUMPRODUCT(IF($N141=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N141=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B9","v":"3"},{"$f":"'3'!C9","v":"3.1"},{"$f":"'3'!D9","v":"3.1.1"},{"$f":"'3'!E9","v":0},{"$f":"'3'!F9","v":"3.1.1.1"},{"$f":"'3'!G9","v":0},{"$f":"'3'!H9","v":0},{"$f":"'3'!I9","v":"3.1.1.1.5"},{"$f":"'3'!J9","v":"3.1.1.1.5: Are criminal record checks carried out for all operational staff?\n"},{"$f":"'3'!K9","v":0},{"$f":"'3'!L9","v":0},{"$f":"'3'!M9","v":"Recommended"},{"$f":"'3'!N9","v":"Recommended"},{"$f":"'3'!O9","v":"HR"},{"$f":"'3'!P9","v":0},{"$f":"'3'!Q9","v":0},{"$f":"'3'!R9","v":0},{"$f":"'3'!S9","v":0},{"$f":"'3'!T9","v":0},{"$f":"'3'!U9","v":0},{"$f":"'3'!V9","v":0},{"$f":"'3'!W9","v":0},{"$f":"'3'!X9","v":0},{"$f":"'3'!Y9","v":0},{"$f":"'3'!Z9","v":0},{"$f":"'3'!AA9","v":0},{"$f":"'3'!AB9","v":0},{"$f":"'3'!AC9","v":0},{"$f":"'3'!AD9","v":0},{"$f":"'3'!AE9","v":0},{"$f":"'3'!AF9","v":0},{"$f":"'3'!AG9","v":0},{"$f":"'3'!AH9","v":0},{"$f":"'3'!AI9","v":0},{"$f":"'3'!AJ9","v":0},{"$f":"'3'!AK9","v":0},{"$f":"'3'!AL9","v":0},{"$f":"'3'!AM9","v":0},{"$f":"'3'!AN9","v":0},{"$f":"'3'!AO9","v":0},{"$f":"'3'!AP9","v":0},{"$f":"'3'!AQ9","v":0},{"$f":"'3'!AR9","v":0},{"$f":"'3'!AS9","v":0},{"$f":"'3'!AT9","v":0},{"$f":"SUMPRODUCT(IF($N142=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N142=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B10","v":"3"},{"$f":"'3'!C10","v":"3.1"},{"$f":"'3'!D10","v":"3.1.1"},{"$f":"'3'!E10","v":""},{"$f":"'3'!F10","v":"3.1.1.2"},{"$f":"'3'!G10","v":"3.1.1.2: STAFF DUE DILIGENCE - FREQUENCY AND RECORDS\nDue diligence checks should be performed on all staff at intervals specified in the staff due diligence policy. This should ideally be every three years at minimum, and every two years at minimum for staff that are in the sensitive roles identified by risk assessment (3.1.1.2).\n\nThe provider should maintain the following staff due diligence records:\n- Records of staff due diligence conducted\n- Copies of all documentation collected during due diligence\nRecords should be kept for a period determined by regulation or risk assessment, whichever is longer. FATF recommends that records be kept for a minimum of five years after termination, either physically or electronically (or both). "},{"$f":"'3'!H10","v":"GSMA RMT"},{"$f":"'3'!I10","v":"3.1.1.2.1"},{"$f":"'3'!J10","v":"3.1.1.2.1: Are due diligence checks performed on all staff every three years at minimum, and every two years at minimum for staff that are in sensitive roles?\n"},{"$f":"'3'!K10","v":0},{"$f":"'3'!L10","v":0},{"$f":"'3'!M10","v":"Recommended"},{"$f":"'3'!N10","v":"Recommended"},{"$f":"'3'!O10","v":"HR"},{"$f":"'3'!P10","v":0},{"$f":"'3'!Q10","v":0},{"$f":"'3'!R10","v":0},{"$f":"'3'!S10","v":0},{"$f":"'3'!T10","v":0},{"$f":"'3'!U10","v":0},{"$f":"'3'!V10","v":0},{"$f":"'3'!W10","v":0},{"$f":"'3'!X10","v":0},{"$f":"'3'!Y10","v":0},{"$f":"'3'!Z10","v":0},{"$f":"'3'!AA10","v":0},{"$f":"'3'!AB10","v":0},{"$f":"'3'!AC10","v":0},{"$f":"'3'!AD10","v":0},{"$f":"'3'!AE10","v":0},{"$f":"'3'!AF10","v":0},{"$f":"'3'!AG10","v":0},{"$f":"'3'!AH10","v":0},{"$f":"'3'!AI10","v":0},{"$f":"'3'!AJ10","v":0},{"$f":"'3'!AK10","v":0},{"$f":"'3'!AL10","v":0},{"$f":"'3'!AM10","v":0},{"$f":"'3'!AN10","v":0},{"$f":"'3'!AO10","v":0},{"$f":"'3'!AP10","v":0},{"$f":"'3'!AQ10","v":0},{"$f":"'3'!AR10","v":0},{"$f":"'3'!AS10","v":0},{"$f":"'3'!AT10","v":0},{"$f":"SUMPRODUCT(IF($N143=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N143=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B11","v":"3"},{"$f":"'3'!C11","v":"3.1"},{"$f":"'3'!D11","v":"3.1.1"},{"$f":"'3'!E11","v":""},{"$f":"'3'!F11","v":"3.1.1.2"},{"$f":"'3'!G11","v":0},{"$f":"'3'!H11","v":0},{"$f":"'3'!I11","v":"3.1.1.2.2"},{"$f":"'3'!J11","v":"3.1.1.2.2: Are staff due diligence records kept for at least five years after termination, including identification records and records of due diligence conducted?\n"},{"$f":"'3'!K11","v":0},{"$f":"'3'!L11","v":0},{"$f":"'3'!M11","v":"Recommended"},{"$f":"'3'!N11","v":"Recommended"},{"$f":"'3'!O11","v":"HR"},{"$f":"'3'!P11","v":0},{"$f":"'3'!Q11","v":0},{"$f":"'3'!R11","v":0},{"$f":"'3'!S11","v":0},{"$f":"'3'!T11","v":0},{"$f":"'3'!U11","v":0},{"$f":"'3'!V11","v":0},{"$f":"'3'!W11","v":0},{"$f":"'3'!X11","v":0},{"$f":"'3'!Y11","v":0},{"$f":"'3'!Z11","v":0},{"$f":"'3'!AA11","v":0},{"$f":"'3'!AB11","v":0},{"$f":"'3'!AC11","v":0},{"$f":"'3'!AD11","v":0},{"$f":"'3'!AE11","v":0},{"$f":"'3'!AF11","v":0},{"$f":"'3'!AG11","v":0},{"$f":"'3'!AH11","v":0},{"$f":"'3'!AI11","v":0},{"$f":"'3'!AJ11","v":0},{"$f":"'3'!AK11","v":0},{"$f":"'3'!AL11","v":0},{"$f":"'3'!AM11","v":0},{"$f":"'3'!AN11","v":0},{"$f":"'3'!AO11","v":0},{"$f":"'3'!AP11","v":0},{"$f":"'3'!AQ11","v":0},{"$f":"'3'!AR11","v":0},{"$f":"'3'!AS11","v":0},{"$f":"'3'!AT11","v":0},{"$f":"SUMPRODUCT(IF($N144=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N144=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B12","v":"3"},{"$f":"'3'!C12","v":"3.1"},{"$f":"'3'!D12","v":"3.1.1"},{"$f":"'3'!E12","v":""},{"$f":"'3'!F12","v":"3.1.1.3"},{"$f":"'3'!G12","v":"3.1.1.3: AGENT DUE DILIGENCE POLICY\nThe provider should have a policy to carry out due diligence on mobile money agents before they start operation and regularly thereafter. The agent due diligence policy should define checks to be made when contracting new master agents and individual agents, and ongoing reviews. \n\nThe agent due diligence policy should be regularly reviewed and updated as needed, such as when changes are made to the service or regulation."},{"$f":"'3'!H12","v":"GSMA RMT"},{"$f":"'3'!I12","v":"3.1.1.3.1"},{"$f":"'3'!J12","v":"3.1.1.3.1: Is there a policy to perform due diligence on mobile money agents before their engagement and regularly thereafter, and is the policy regularly reviewed and updated as needed, such as when changes are made to the service or regulation?\n"},{"$f":"'3'!K12","v":0},{"$f":"'3'!L12","v":0},{"$f":"'3'!M12","v":"Recommended"},{"$f":"'3'!N12","v":"Recommended"},{"$f":"'3'!O12","v":"Agent"},{"$f":"'3'!P12","v":0},{"$f":"'3'!Q12","v":0},{"$f":"'3'!R12","v":0},{"$f":"'3'!S12","v":0},{"$f":"'3'!T12","v":0},{"$f":"'3'!U12","v":0},{"$f":"'3'!V12","v":0},{"$f":"'3'!W12","v":0},{"$f":"'3'!X12","v":0},{"$f":"'3'!Y12","v":0},{"$f":"'3'!Z12","v":0},{"$f":"'3'!AA12","v":0},{"$f":"'3'!AB12","v":0},{"$f":"'3'!AC12","v":0},{"$f":"'3'!AD12","v":0},{"$f":"'3'!AE12","v":0},{"$f":"'3'!AF12","v":0},{"$f":"'3'!AG12","v":0},{"$f":"'3'!AH12","v":0},{"$f":"'3'!AI12","v":0},{"$f":"'3'!AJ12","v":0},{"$f":"'3'!AK12","v":0},{"$f":"'3'!AL12","v":0},{"$f":"'3'!AM12","v":0},{"$f":"'3'!AN12","v":0},{"$f":"'3'!AO12","v":0},{"$f":"'3'!AP12","v":0},{"$f":"'3'!AQ12","v":0},{"$f":"'3'!AR12","v":0},{"$f":"'3'!AS12","v":0},{"$f":"'3'!AT12","v":0},{"$f":"SUMPRODUCT(IF($N145=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N145=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B13","v":"3"},{"$f":"'3'!C13","v":"3.1"},{"$f":"'3'!D13","v":"3.1.1"},{"$f":"'3'!E13","v":""},{"$f":"'3'!F13","v":"3.1.1.4"},{"$f":"'3'!G13","v":"3.1.1.4: AGENT DUE DILIGENCE: MASTER AGENTS\nProviders should conduct due diligence on all master agents and agent aggregators. Checks should include:\n- Identification of owners and senior management of master agents - full name, address, date of birth (validated by viewing ID);\n- Two business references;\n- Criminal record check on owners and senior management of master agents;\n- Bankruptcy check on owners and senior management of master agents;\n- A certified true copy of the business registration documents of the master agent (e.g. memorandum and articles of association);\n- An organisational chart of the agent network indicating the identity of the managers of each agent store;\n- Screening of owners and senior management of master agents using domestic and international money laundering, terrorist financing, and sanctions watchlists."},{"$f":"'3'!H13","v":"GSMA RMT (AG-02)"},{"$f":"'3'!I13","v":"3.1.1.4.1"},{"$f":"'3'!J13","v":"3.1.1.4.1: Has a process been implemented to carry out due diligence on all master agents and agent aggregators?\n"},{"$f":"'3'!K13","v":"1) Agent Due Diligence Process\n- Check that there is a process to carry out due diligence on all master agents and agent aggregators."},{"$f":"'3'!L13","v":0},{"$f":"'3'!M13","v":"Urgent Required"},{"$f":"'3'!N13","v":"Required"},{"$f":"'3'!O13","v":"Agent"},{"$f":"'3'!P13","v":0},{"$f":"'3'!Q13","v":0},{"$f":"'3'!R13","v":0},{"$f":"'3'!S13","v":0},{"$f":"'3'!T13","v":0},{"$f":"'3'!U13","v":0},{"$f":"'3'!V13","v":0},{"$f":"'3'!W13","v":0},{"$f":"'3'!X13","v":0},{"$f":"'3'!Y13","v":0},{"$f":"'3'!Z13","v":0},{"$f":"'3'!AA13","v":0},{"$f":"'3'!AB13","v":0},{"$f":"'3'!AC13","v":0},{"$f":"'3'!AD13","v":0},{"$f":"'3'!AE13","v":0},{"$f":"'3'!AF13","v":0},{"$f":"'3'!AG13","v":0},{"$f":"'3'!AH13","v":0},{"$f":"'3'!AI13","v":0},{"$f":"'3'!AJ13","v":0},{"$f":"'3'!AK13","v":0},{"$f":"'3'!AL13","v":0},{"$f":"'3'!AM13","v":0},{"$f":"'3'!AN13","v":0},{"$f":"'3'!AO13","v":0},{"$f":"'3'!AP13","v":0},{"$f":"'3'!AQ13","v":0},{"$f":"'3'!AR13","v":0},{"$f":"'3'!AS13","v":0},{"$f":"'3'!AT13","v":0},{"$f":"SUMPRODUCT(IF($N146=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N146=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B14","v":"3"},{"$f":"'3'!C14","v":"3.1"},{"$f":"'3'!D14","v":"3.1.1"},{"$f":"'3'!E14","v":""},{"$f":"'3'!F14","v":"3.1.1.4"},{"$f":"'3'!G14","v":0},{"$f":"'3'!H14","v":0},{"$f":"'3'!I14","v":"3.1.1.4.2"},{"$f":"'3'!J14","v":"3.1.1.4.2: Is identification of owners and senior management of master agents & and agent aggregators collected, including full name, address, and date of birth (with verification of name and DoB)?\n"},{"$f":"'3'!K14","v":"1) Agent Due Diligence Process\n- Check that identification of all owners (>25% ownership) and senior management of master agents/agent aggregators is collected, including:\na) Full Name      (verified by viewing ID documentation)\nb) Address\nc) Date of birth  (verified by viewing ID documentation, where available)"},{"$f":"'3'!L14","v":0},{"$f":"'3'!M14","v":"Urgent Required"},{"$f":"'3'!N14","v":"Required"},{"$f":"'3'!O14","v":"Agent"},{"$f":"'3'!P14","v":0},{"$f":"'3'!Q14","v":0},{"$f":"'3'!R14","v":0},{"$f":"'3'!S14","v":0},{"$f":"'3'!T14","v":0},{"$f":"'3'!U14","v":0},{"$f":"'3'!V14","v":0},{"$f":"'3'!W14","v":0},{"$f":"'3'!X14","v":0},{"$f":"'3'!Y14","v":0},{"$f":"'3'!Z14","v":0},{"$f":"'3'!AA14","v":0},{"$f":"'3'!AB14","v":0},{"$f":"'3'!AC14","v":0},{"$f":"'3'!AD14","v":0},{"$f":"'3'!AE14","v":0},{"$f":"'3'!AF14","v":0},{"$f":"'3'!AG14","v":0},{"$f":"'3'!AH14","v":0},{"$f":"'3'!AI14","v":0},{"$f":"'3'!AJ14","v":0},{"$f":"'3'!AK14","v":0},{"$f":"'3'!AL14","v":0},{"$f":"'3'!AM14","v":0},{"$f":"'3'!AN14","v":0},{"$f":"'3'!AO14","v":0},{"$f":"'3'!AP14","v":0},{"$f":"'3'!AQ14","v":0},{"$f":"'3'!AR14","v":0},{"$f":"'3'!AS14","v":0},{"$f":"'3'!AT14","v":0},{"$f":"SUMPRODUCT(IF($N147=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N147=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B15","v":"3"},{"$f":"'3'!C15","v":"3.1"},{"$f":"'3'!D15","v":"3.1.1"},{"$f":"'3'!E15","v":""},{"$f":"'3'!F15","v":"3.1.1.4"},{"$f":"'3'!G15","v":0},{"$f":"'3'!H15","v":0},{"$f":"'3'!I15","v":"3.1.1.4.3"},{"$f":"'3'!J15","v":"3.1.1.4.3: Are owners and senior management of all master agents and agent aggregators screened using watchlists?\n"},{"$f":"'3'!K15","v":"1) Agent Due Diligence Process\n- Check that the process includes the screening of owners and senior managers of master agents and agent aggregators against watch lists (which should be at a minimum the lists required for customer screening)."},{"$f":"'3'!L15","v":0},{"$f":"'3'!M15","v":"Standard Required"},{"$f":"'3'!N15","v":"Required"},{"$f":"'3'!O15","v":"Agent"},{"$f":"'3'!P15","v":0},{"$f":"'3'!Q15","v":0},{"$f":"'3'!R15","v":0},{"$f":"'3'!S15","v":0},{"$f":"'3'!T15","v":0},{"$f":"'3'!U15","v":0},{"$f":"'3'!V15","v":0},{"$f":"'3'!W15","v":0},{"$f":"'3'!X15","v":0},{"$f":"'3'!Y15","v":0},{"$f":"'3'!Z15","v":0},{"$f":"'3'!AA15","v":0},{"$f":"'3'!AB15","v":0},{"$f":"'3'!AC15","v":0},{"$f":"'3'!AD15","v":0},{"$f":"'3'!AE15","v":0},{"$f":"'3'!AF15","v":0},{"$f":"'3'!AG15","v":0},{"$f":"'3'!AH15","v":0},{"$f":"'3'!AI15","v":0},{"$f":"'3'!AJ15","v":0},{"$f":"'3'!AK15","v":0},{"$f":"'3'!AL15","v":0},{"$f":"'3'!AM15","v":0},{"$f":"'3'!AN15","v":0},{"$f":"'3'!AO15","v":0},{"$f":"'3'!AP15","v":0},{"$f":"'3'!AQ15","v":0},{"$f":"'3'!AR15","v":0},{"$f":"'3'!AS15","v":0},{"$f":"'3'!AT15","v":0},{"$f":"SUMPRODUCT(IF($N148=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N148=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B16","v":"3"},{"$f":"'3'!C16","v":"3.1"},{"$f":"'3'!D16","v":"3.1.1"},{"$f":"'3'!E16","v":""},{"$f":"'3'!F16","v":"3.1.1.4"},{"$f":"'3'!G16","v":0},{"$f":"'3'!H16","v":0},{"$f":"'3'!I16","v":"3.1.1.4.4"},{"$f":"'3'!J16","v":"3.1.1.4.4: Are at least two business references obtained for all master agents and agent aggregators?\n"},{"$f":"'3'!K16","v":0},{"$f":"'3'!L16","v":0},{"$f":"'3'!M16","v":"Recommended"},{"$f":"'3'!N16","v":"Recommended"},{"$f":"'3'!O16","v":"Agent"},{"$f":"'3'!P16","v":0},{"$f":"'3'!Q16","v":0},{"$f":"'3'!R16","v":0},{"$f":"'3'!S16","v":0},{"$f":"'3'!T16","v":0},{"$f":"'3'!U16","v":0},{"$f":"'3'!V16","v":0},{"$f":"'3'!W16","v":0},{"$f":"'3'!X16","v":0},{"$f":"'3'!Y16","v":0},{"$f":"'3'!Z16","v":0},{"$f":"'3'!AA16","v":0},{"$f":"'3'!AB16","v":0},{"$f":"'3'!AC16","v":0},{"$f":"'3'!AD16","v":0},{"$f":"'3'!AE16","v":0},{"$f":"'3'!AF16","v":0},{"$f":"'3'!AG16","v":0},{"$f":"'3'!AH16","v":0},{"$f":"'3'!AI16","v":0},{"$f":"'3'!AJ16","v":0},{"$f":"'3'!AK16","v":0},{"$f":"'3'!AL16","v":0},{"$f":"'3'!AM16","v":0},{"$f":"'3'!AN16","v":0},{"$f":"'3'!AO16","v":0},{"$f":"'3'!AP16","v":0},{"$f":"'3'!AQ16","v":0},{"$f":"'3'!AR16","v":0},{"$f":"'3'!AS16","v":0},{"$f":"'3'!AT16","v":0},{"$f":"SUMPRODUCT(IF($N149=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N149=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B17","v":"3"},{"$f":"'3'!C17","v":"3.1"},{"$f":"'3'!D17","v":"3.1.1"},{"$f":"'3'!E17","v":""},{"$f":"'3'!F17","v":"3.1.1.4"},{"$f":"'3'!G17","v":0},{"$f":"'3'!H17","v":0},{"$f":"'3'!I17","v":"3.1.1.4.5"},{"$f":"'3'!J17","v":"3.1.1.4.5: Are criminal record checks performed on owners and senior management of all master agents and agent aggregators ?\n"},{"$f":"'3'!K17","v":0},{"$f":"'3'!L17","v":0},{"$f":"'3'!M17","v":"Recommended"},{"$f":"'3'!N17","v":"Recommended"},{"$f":"'3'!O17","v":"Agent"},{"$f":"'3'!P17","v":0},{"$f":"'3'!Q17","v":0},{"$f":"'3'!R17","v":0},{"$f":"'3'!S17","v":0},{"$f":"'3'!T17","v":0},{"$f":"'3'!U17","v":0},{"$f":"'3'!V17","v":0},{"$f":"'3'!W17","v":0},{"$f":"'3'!X17","v":0},{"$f":"'3'!Y17","v":0},{"$f":"'3'!Z17","v":0},{"$f":"'3'!AA17","v":0},{"$f":"'3'!AB17","v":0},{"$f":"'3'!AC17","v":0},{"$f":"'3'!AD17","v":0},{"$f":"'3'!AE17","v":0},{"$f":"'3'!AF17","v":0},{"$f":"'3'!AG17","v":0},{"$f":"'3'!AH17","v":0},{"$f":"'3'!AI17","v":0},{"$f":"'3'!AJ17","v":0},{"$f":"'3'!AK17","v":0},{"$f":"'3'!AL17","v":0},{"$f":"'3'!AM17","v":0},{"$f":"'3'!AN17","v":0},{"$f":"'3'!AO17","v":0},{"$f":"'3'!AP17","v":0},{"$f":"'3'!AQ17","v":0},{"$f":"'3'!AR17","v":0},{"$f":"'3'!AS17","v":0},{"$f":"'3'!AT17","v":0},{"$f":"SUMPRODUCT(IF($N150=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N150=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B18","v":"3"},{"$f":"'3'!C18","v":"3.1"},{"$f":"'3'!D18","v":"3.1.1"},{"$f":"'3'!E18","v":""},{"$f":"'3'!F18","v":"3.1.1.4"},{"$f":"'3'!G18","v":0},{"$f":"'3'!H18","v":0},{"$f":"'3'!I18","v":"3.1.1.4.6"},{"$f":"'3'!J18","v":"3.1.1.4.6: Is a bankruptcy check performed on the owners and senior management of all master agents and agent aggregators ?\n"},{"$f":"'3'!K18","v":0},{"$f":"'3'!L18","v":0},{"$f":"'3'!M18","v":"Recommended"},{"$f":"'3'!N18","v":"Recommended"},{"$f":"'3'!O18","v":"Agent"},{"$f":"'3'!P18","v":0},{"$f":"'3'!Q18","v":0},{"$f":"'3'!R18","v":0},{"$f":"'3'!S18","v":0},{"$f":"'3'!T18","v":0},{"$f":"'3'!U18","v":0},{"$f":"'3'!V18","v":0},{"$f":"'3'!W18","v":0},{"$f":"'3'!X18","v":0},{"$f":"'3'!Y18","v":0},{"$f":"'3'!Z18","v":0},{"$f":"'3'!AA18","v":0},{"$f":"'3'!AB18","v":0},{"$f":"'3'!AC18","v":0},{"$f":"'3'!AD18","v":0},{"$f":"'3'!AE18","v":0},{"$f":"'3'!AF18","v":0},{"$f":"'3'!AG18","v":0},{"$f":"'3'!AH18","v":0},{"$f":"'3'!AI18","v":0},{"$f":"'3'!AJ18","v":0},{"$f":"'3'!AK18","v":0},{"$f":"'3'!AL18","v":0},{"$f":"'3'!AM18","v":0},{"$f":"'3'!AN18","v":0},{"$f":"'3'!AO18","v":0},{"$f":"'3'!AP18","v":0},{"$f":"'3'!AQ18","v":0},{"$f":"'3'!AR18","v":0},{"$f":"'3'!AS18","v":0},{"$f":"'3'!AT18","v":0},{"$f":"SUMPRODUCT(IF($N151=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N151=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B19","v":"3"},{"$f":"'3'!C19","v":"3.1"},{"$f":"'3'!D19","v":"3.1.1"},{"$f":"'3'!E19","v":""},{"$f":"'3'!F19","v":"3.1.1.4"},{"$f":"'3'!G19","v":0},{"$f":"'3'!H19","v":0},{"$f":"'3'!I19","v":"3.1.1.4.7"},{"$f":"'3'!J19","v":"3.1.1.4.7: Is a certified true copy of the business registration documents obtained (e.g. memorandum and articles of association) for all master agents and agent aggregators?\n"},{"$f":"'3'!K19","v":0},{"$f":"'3'!L19","v":0},{"$f":"'3'!M19","v":"Recommended"},{"$f":"'3'!N19","v":"Recommended"},{"$f":"'3'!O19","v":"Agent"},{"$f":"'3'!P19","v":0},{"$f":"'3'!Q19","v":0},{"$f":"'3'!R19","v":0},{"$f":"'3'!S19","v":0},{"$f":"'3'!T19","v":0},{"$f":"'3'!U19","v":0},{"$f":"'3'!V19","v":0},{"$f":"'3'!W19","v":0},{"$f":"'3'!X19","v":0},{"$f":"'3'!Y19","v":0},{"$f":"'3'!Z19","v":0},{"$f":"'3'!AA19","v":0},{"$f":"'3'!AB19","v":0},{"$f":"'3'!AC19","v":0},{"$f":"'3'!AD19","v":0},{"$f":"'3'!AE19","v":0},{"$f":"'3'!AF19","v":0},{"$f":"'3'!AG19","v":0},{"$f":"'3'!AH19","v":0},{"$f":"'3'!AI19","v":0},{"$f":"'3'!AJ19","v":0},{"$f":"'3'!AK19","v":0},{"$f":"'3'!AL19","v":0},{"$f":"'3'!AM19","v":0},{"$f":"'3'!AN19","v":0},{"$f":"'3'!AO19","v":0},{"$f":"'3'!AP19","v":0},{"$f":"'3'!AQ19","v":0},{"$f":"'3'!AR19","v":0},{"$f":"'3'!AS19","v":0},{"$f":"'3'!AT19","v":0},{"$f":"SUMPRODUCT(IF($N152=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N152=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B20","v":"3"},{"$f":"'3'!C20","v":"3.1"},{"$f":"'3'!D20","v":"3.1.1"},{"$f":"'3'!E20","v":""},{"$f":"'3'!F20","v":"3.1.1.5"},{"$f":"'3'!G20","v":"3.1.1.5: AGENT DUE DILIGENCE: AGENTS\nThe Agent Due Diligence policy should define procedures for vetting agents, whether they are engaged directly by the provider or via master agents. In the case that agents are engaged via master agents, the provider's contract should ensure that the master agents carry out the same level of vetting on the agents.\n\nThe following due diligence should be carried out on agents:\n- Identification of owners and managers of agents - full name, address, date of birth;\n- Certificate of trading or tax certificate or similar business entity document (if required by regulation or risk assessment).\n\nIf feasible, a good practice to consider is to take a photo of each agent location and map the GPS coordinates of the location.\n\nIf master agents are used, master agents should supply this due diligence information to the provider.\n\nAdditionally, the provider should carry out screening of the owners and managers of agents using domestic and international money laundering, terrorist financing, and sanctions watchlists. Screening should also be done against the provider's own blacklist of individuals known for fraud/ML/TF (refer to 2.5.3 and 5.3.10). Where \"possible matches\" are found, further ID should be obtained from the individual so that the match can be confirmed or discarded."},{"$f":"'3'!H20","v":"GSMA RMT (AG-02)"},{"$f":"'3'!I20","v":"3.1.1.5.1"},{"$f":"'3'!J20","v":"3.1.1.5.1: Is due diligence carried out on agents, including verifying the identity of their owners and managers (at minimum full name, address, and date of birth)?\n"},{"$f":"'3'!K20","v":"1) Agent Due Diligence Process\n- Check that there is a process to carry out due diligence on all  agents before they are activated.\n- Check that the process includes identification of all owners (>25% ownership) and managers of agents\n-Check that information captured on owners and senior management includes:\n     a) Full Name\n     b) Address\n     c) Date of birth "},{"$f":"'3'!L20","v":0},{"$f":"'3'!M20","v":"Urgent Required"},{"$f":"'3'!N20","v":"Required"},{"$f":"'3'!O20","v":"Agent"},{"$f":"'3'!P20","v":0},{"$f":"'3'!Q20","v":0},{"$f":"'3'!R20","v":0},{"$f":"'3'!S20","v":0},{"$f":"'3'!T20","v":0},{"$f":"'3'!U20","v":0},{"$f":"'3'!V20","v":0},{"$f":"'3'!W20","v":0},{"$f":"'3'!X20","v":0},{"$f":"'3'!Y20","v":0},{"$f":"'3'!Z20","v":0},{"$f":"'3'!AA20","v":0},{"$f":"'3'!AB20","v":0},{"$f":"'3'!AC20","v":0},{"$f":"'3'!AD20","v":0},{"$f":"'3'!AE20","v":0},{"$f":"'3'!AF20","v":0},{"$f":"'3'!AG20","v":0},{"$f":"'3'!AH20","v":0},{"$f":"'3'!AI20","v":0},{"$f":"'3'!AJ20","v":0},{"$f":"'3'!AK20","v":0},{"$f":"'3'!AL20","v":0},{"$f":"'3'!AM20","v":0},{"$f":"'3'!AN20","v":0},{"$f":"'3'!AO20","v":0},{"$f":"'3'!AP20","v":0},{"$f":"'3'!AQ20","v":0},{"$f":"'3'!AR20","v":0},{"$f":"'3'!AS20","v":0},{"$f":"'3'!AT20","v":0},{"$f":"SUMPRODUCT(IF($N153=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N153=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B21","v":"3"},{"$f":"'3'!C21","v":"3.1"},{"$f":"'3'!D21","v":"3.1.1"},{"$f":"'3'!E21","v":""},{"$f":"'3'!F21","v":"3.1.1.5"},{"$f":"'3'!G21","v":0},{"$f":"'3'!H21","v":0},{"$f":"'3'!I21","v":"3.1.1.5.2"},{"$f":"'3'!J21","v":"3.1.1.5.2: Are master agents contractually required to supply due diligence information on their agents to the provider?\n"},{"$f":"'3'!K21","v":"1) Agent due diligence process\n-Check that the process requires master agents to collect and supply due diligence information on their individual agents.\n\n2) Master agents contracts\n- Check master agents contract contains a clause requiring them to supply due diligence information on their individual agents."},{"$f":"'3'!L21","v":0},{"$f":"'3'!M21","v":"Standard Required"},{"$f":"'3'!N21","v":"Required"},{"$f":"'3'!O21","v":"Agent"},{"$f":"'3'!P21","v":0},{"$f":"'3'!Q21","v":0},{"$f":"'3'!R21","v":0},{"$f":"'3'!S21","v":0},{"$f":"'3'!T21","v":0},{"$f":"'3'!U21","v":0},{"$f":"'3'!V21","v":0},{"$f":"'3'!W21","v":0},{"$f":"'3'!X21","v":0},{"$f":"'3'!Y21","v":0},{"$f":"'3'!Z21","v":0},{"$f":"'3'!AA21","v":0},{"$f":"'3'!AB21","v":0},{"$f":"'3'!AC21","v":0},{"$f":"'3'!AD21","v":0},{"$f":"'3'!AE21","v":0},{"$f":"'3'!AF21","v":0},{"$f":"'3'!AG21","v":0},{"$f":"'3'!AH21","v":0},{"$f":"'3'!AI21","v":0},{"$f":"'3'!AJ21","v":0},{"$f":"'3'!AK21","v":0},{"$f":"'3'!AL21","v":0},{"$f":"'3'!AM21","v":0},{"$f":"'3'!AN21","v":0},{"$f":"'3'!AO21","v":0},{"$f":"'3'!AP21","v":0},{"$f":"'3'!AQ21","v":0},{"$f":"'3'!AR21","v":0},{"$f":"'3'!AS21","v":0},{"$f":"'3'!AT21","v":0},{"$f":"SUMPRODUCT(IF($N154=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N154=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B22","v":"3"},{"$f":"'3'!C22","v":"3.1"},{"$f":"'3'!D22","v":"3.1.1"},{"$f":"'3'!E22","v":""},{"$f":"'3'!F22","v":"3.1.1.5"},{"$f":"'3'!G22","v":0},{"$f":"'3'!H22","v":0},{"$f":"'3'!I22","v":"3.1.1.5.3"},{"$f":"'3'!J22","v":"3.1.1.5.3: Are owners of all agents screened using watchlists?\n"},{"$f":"'3'!K22","v":"1) Agent Due Diligence Process\n- Check that the process includes the screening of owners of individual agents against watch lists.\n- Check that the selected watch list include at a minimum the lists required for customer screening.\n- Check that the process include the identification and management of politically exposed persons."},{"$f":"'3'!L22","v":0},{"$f":"'3'!M22","v":"Standard Required"},{"$f":"'3'!N22","v":"Required"},{"$f":"'3'!O22","v":"Agent"},{"$f":"'3'!P22","v":0},{"$f":"'3'!Q22","v":0},{"$f":"'3'!R22","v":0},{"$f":"'3'!S22","v":0},{"$f":"'3'!T22","v":0},{"$f":"'3'!U22","v":0},{"$f":"'3'!V22","v":0},{"$f":"'3'!W22","v":0},{"$f":"'3'!X22","v":0},{"$f":"'3'!Y22","v":0},{"$f":"'3'!Z22","v":0},{"$f":"'3'!AA22","v":0},{"$f":"'3'!AB22","v":0},{"$f":"'3'!AC22","v":0},{"$f":"'3'!AD22","v":0},{"$f":"'3'!AE22","v":0},{"$f":"'3'!AF22","v":0},{"$f":"'3'!AG22","v":0},{"$f":"'3'!AH22","v":0},{"$f":"'3'!AI22","v":0},{"$f":"'3'!AJ22","v":0},{"$f":"'3'!AK22","v":0},{"$f":"'3'!AL22","v":0},{"$f":"'3'!AM22","v":0},{"$f":"'3'!AN22","v":0},{"$f":"'3'!AO22","v":0},{"$f":"'3'!AP22","v":0},{"$f":"'3'!AQ22","v":0},{"$f":"'3'!AR22","v":0},{"$f":"'3'!AS22","v":0},{"$f":"'3'!AT22","v":0},{"$f":"SUMPRODUCT(IF($N155=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N155=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B23","v":"3"},{"$f":"'3'!C23","v":"3.1"},{"$f":"'3'!D23","v":"3.1.1"},{"$f":"'3'!E23","v":""},{"$f":"'3'!F23","v":"3.1.1.5"},{"$f":"'3'!G23","v":0},{"$f":"'3'!H23","v":0},{"$f":"'3'!I23","v":"3.1.1.5.4"},{"$f":"'3'!J23","v":"3.1.1.5.4: Is a copy obtained of each agent's certificate of trading / tax certificate / similar business entity document (if required by regulation or risk assessment)?\n"},{"$f":"'3'!K23","v":0},{"$f":"'3'!L23","v":0},{"$f":"'3'!M23","v":"Recommended"},{"$f":"'3'!N23","v":"Recommended"},{"$f":"'3'!O23","v":"Agent"},{"$f":"'3'!P23","v":0},{"$f":"'3'!Q23","v":0},{"$f":"'3'!R23","v":0},{"$f":"'3'!S23","v":0},{"$f":"'3'!T23","v":0},{"$f":"'3'!U23","v":0},{"$f":"'3'!V23","v":0},{"$f":"'3'!W23","v":0},{"$f":"'3'!X23","v":0},{"$f":"'3'!Y23","v":0},{"$f":"'3'!Z23","v":0},{"$f":"'3'!AA23","v":0},{"$f":"'3'!AB23","v":0},{"$f":"'3'!AC23","v":0},{"$f":"'3'!AD23","v":0},{"$f":"'3'!AE23","v":0},{"$f":"'3'!AF23","v":0},{"$f":"'3'!AG23","v":0},{"$f":"'3'!AH23","v":0},{"$f":"'3'!AI23","v":0},{"$f":"'3'!AJ23","v":0},{"$f":"'3'!AK23","v":0},{"$f":"'3'!AL23","v":0},{"$f":"'3'!AM23","v":0},{"$f":"'3'!AN23","v":0},{"$f":"'3'!AO23","v":0},{"$f":"'3'!AP23","v":0},{"$f":"'3'!AQ23","v":0},{"$f":"'3'!AR23","v":0},{"$f":"'3'!AS23","v":0},{"$f":"'3'!AT23","v":0},{"$f":"SUMPRODUCT(IF($N156=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N156=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B24","v":"3"},{"$f":"'3'!C24","v":"3.1"},{"$f":"'3'!D24","v":"3.1.1"},{"$f":"'3'!E24","v":""},{"$f":"'3'!F24","v":"3.1.1.6"},{"$f":"'3'!G24","v":"3.1.1.6: AGENT DUE DILIGENCE FREQUENCY AND RECORDS\nDue diligence checks should be performed at intervals specified in the agent due diligence policy. This should be every two years at a minimum.\n\nThe provider should maintain the following agent due diligence records:\n- Records of agent due diligence conducted\n- Copies of all documentation collected during due diligence\nRecords should be kept for a period determined by regulation or risk assessment, whichever is longer. FATF recommends that records be kept for a minimum of five years, either physically or electronically (or both). "},{"$f":"'3'!H24","v":"GSMA RMT"},{"$f":"'3'!I24","v":"3.1.1.6.1"},{"$f":"'3'!J24","v":"3.1.1.6.1: Are due diligence checks performed on all agents every two years at a minimum?\n"},{"$f":"'3'!K24","v":0},{"$f":"'3'!L24","v":0},{"$f":"'3'!M24","v":"Recommended"},{"$f":"'3'!N24","v":"Recommended"},{"$f":"'3'!O24","v":"Agent"},{"$f":"'3'!P24","v":0},{"$f":"'3'!Q24","v":0},{"$f":"'3'!R24","v":0},{"$f":"'3'!S24","v":0},{"$f":"'3'!T24","v":0},{"$f":"'3'!U24","v":0},{"$f":"'3'!V24","v":0},{"$f":"'3'!W24","v":0},{"$f":"'3'!X24","v":0},{"$f":"'3'!Y24","v":0},{"$f":"'3'!Z24","v":0},{"$f":"'3'!AA24","v":0},{"$f":"'3'!AB24","v":0},{"$f":"'3'!AC24","v":0},{"$f":"'3'!AD24","v":0},{"$f":"'3'!AE24","v":0},{"$f":"'3'!AF24","v":0},{"$f":"'3'!AG24","v":0},{"$f":"'3'!AH24","v":0},{"$f":"'3'!AI24","v":0},{"$f":"'3'!AJ24","v":0},{"$f":"'3'!AK24","v":0},{"$f":"'3'!AL24","v":0},{"$f":"'3'!AM24","v":0},{"$f":"'3'!AN24","v":0},{"$f":"'3'!AO24","v":0},{"$f":"'3'!AP24","v":0},{"$f":"'3'!AQ24","v":0},{"$f":"'3'!AR24","v":0},{"$f":"'3'!AS24","v":0},{"$f":"'3'!AT24","v":0},{"$f":"SUMPRODUCT(IF($N157=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N157=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B25","v":"3"},{"$f":"'3'!C25","v":"3.1"},{"$f":"'3'!D25","v":"3.1.1"},{"$f":"'3'!E25","v":""},{"$f":"'3'!F25","v":"3.1.1.6"},{"$f":"'3'!G25","v":0},{"$f":"'3'!H25","v":0},{"$f":"'3'!I25","v":"3.1.1.6.2"},{"$f":"'3'!J25","v":"3.1.1.6.2: Are agent due diligence records kept for at least five years, including KYC records and records of due diligence conducted?\n"},{"$f":"'3'!K25","v":0},{"$f":"'3'!L25","v":0},{"$f":"'3'!M25","v":"Recommended"},{"$f":"'3'!N25","v":"Recommended"},{"$f":"'3'!O25","v":"Agent"},{"$f":"'3'!P25","v":0},{"$f":"'3'!Q25","v":0},{"$f":"'3'!R25","v":0},{"$f":"'3'!S25","v":0},{"$f":"'3'!T25","v":0},{"$f":"'3'!U25","v":0},{"$f":"'3'!V25","v":0},{"$f":"'3'!W25","v":0},{"$f":"'3'!X25","v":0},{"$f":"'3'!Y25","v":0},{"$f":"'3'!Z25","v":0},{"$f":"'3'!AA25","v":0},{"$f":"'3'!AB25","v":0},{"$f":"'3'!AC25","v":0},{"$f":"'3'!AD25","v":0},{"$f":"'3'!AE25","v":0},{"$f":"'3'!AF25","v":0},{"$f":"'3'!AG25","v":0},{"$f":"'3'!AH25","v":0},{"$f":"'3'!AI25","v":0},{"$f":"'3'!AJ25","v":0},{"$f":"'3'!AK25","v":0},{"$f":"'3'!AL25","v":0},{"$f":"'3'!AM25","v":0},{"$f":"'3'!AN25","v":0},{"$f":"'3'!AO25","v":0},{"$f":"'3'!AP25","v":0},{"$f":"'3'!AQ25","v":0},{"$f":"'3'!AR25","v":0},{"$f":"'3'!AS25","v":0},{"$f":"'3'!AT25","v":0},{"$f":"SUMPRODUCT(IF($N158=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N158=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B26","v":"3"},{"$f":"'3'!C26","v":"3.1"},{"$f":"'3'!D26","v":"3.1.1"},{"$f":"'3'!E26","v":""},{"$f":"'3'!F26","v":"3.1.1.7"},{"$f":"'3'!G26","v":"3.1.1.7: DUE DILIGENCE ON ENTITIES PROVIDING OUTSOURCED SERVICES\nProviders should carry out due diligence on entities providing outsourced services before they start operation and regularly thereafter (every two years at a minimum).\n\nThe due diligence requirements should be documented and regularly reviewed and updated as needed, such as when changes are made to the service or regulation. \n\nAt a minimum the following checks should be included:\n- The entity must be able to provide outsourced services effectively and reliably;\n- The entity should be qualified to provide the particular service: the provider should check appropriate documentation to confirm this;\n- The entity should have a good reputation: the provider could request client references to confirm this;\n- The entity should understand and be able to meet the provider’s objectives: this should be confirmed by written confirmation from the entity;\n- The entity should have proper risk management policies and controls in place: the provider should review the risk management documentation;\n- The entity should have the financial soundness to meet its obligations: Provider should check that the partner is financially solvent, with sufficient capital reserves to underwrite its level of operations.\n\nThe provider should maintain the following due diligence records:\n- Records of due diligence conducted on entities providing outsourced services;\n- Copies of all documentation collected during due diligence.\nRecords should be kept for a period determined by regulation or risk assessment, whichever is longer. FATF recommends that records be kept for a minimum of five years after termination, either physically or electronically (or both)."},{"$f":"'3'!H26","v":"GSMA RMT\nBCBS OFS"},{"$f":"'3'!I26","v":"3.1.1.7.1"},{"$f":"'3'!J26","v":"3.1.1.7.1: Is due diligence carried out on all entities providing outsourced services for core mobile money functions before they start operation?\n"},{"$f":"'3'!K26","v":"1) Outsourcing due diligence requirements, process or similar documentation \n- Check that due diligence requirements are documented for entities providing outsourced services for core mobile money functions.\n- Check that there is a process to perform due diligence on these outsourcing entities before their services become operational.\n"},{"$f":"'3'!L26","v":0},{"$f":"'3'!M26","v":"Urgent Required"},{"$f":"'3'!N26","v":"Required"},{"$f":"'3'!O26","v":"BizOps"},{"$f":"'3'!P26","v":0},{"$f":"'3'!Q26","v":0},{"$f":"'3'!R26","v":0},{"$f":"'3'!S26","v":0},{"$f":"'3'!T26","v":0},{"$f":"'3'!U26","v":0},{"$f":"'3'!V26","v":0},{"$f":"'3'!W26","v":0},{"$f":"'3'!X26","v":0},{"$f":"'3'!Y26","v":0},{"$f":"'3'!Z26","v":0},{"$f":"'3'!AA26","v":0},{"$f":"'3'!AB26","v":0},{"$f":"'3'!AC26","v":0},{"$f":"'3'!AD26","v":0},{"$f":"'3'!AE26","v":0},{"$f":"'3'!AF26","v":0},{"$f":"'3'!AG26","v":0},{"$f":"'3'!AH26","v":0},{"$f":"'3'!AI26","v":0},{"$f":"'3'!AJ26","v":0},{"$f":"'3'!AK26","v":0},{"$f":"'3'!AL26","v":0},{"$f":"'3'!AM26","v":0},{"$f":"'3'!AN26","v":0},{"$f":"'3'!AO26","v":0},{"$f":"'3'!AP26","v":0},{"$f":"'3'!AQ26","v":0},{"$f":"'3'!AR26","v":0},{"$f":"'3'!AS26","v":0},{"$f":"'3'!AT26","v":0},{"$f":"SUMPRODUCT(IF($N159=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N159=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B27","v":"3"},{"$f":"'3'!C27","v":"3.1"},{"$f":"'3'!D27","v":"3.1.1"},{"$f":"'3'!E27","v":""},{"$f":"'3'!F27","v":"3.1.1.7"},{"$f":"'3'!G27","v":0},{"$f":"'3'!H27","v":0},{"$f":"'3'!I27","v":"3.1.1.7.2"},{"$f":"'3'!J27","v":"3.1.1.7.2: Are checks done (e.g. review qualifications or documentation) to ensure that each entity providing outsourced services for core mobile money functions can provide its outsourced services effectively and reliably?\n"},{"$f":"'3'!K27","v":"1) Outsourcing due diligence requirements, process or similar documentation \n- Check that there is a process to ascertain that any outsourced entity carrying out core mobile money functions has appropriate skills to carry out the function effectively and reliably.\n"},{"$f":"'3'!L27","v":0},{"$f":"'3'!M27","v":"Standard Required"},{"$f":"'3'!N27","v":"Required"},{"$f":"'3'!O27","v":"BizOps"},{"$f":"'3'!P27","v":0},{"$f":"'3'!Q27","v":0},{"$f":"'3'!R27","v":0},{"$f":"'3'!S27","v":0},{"$f":"'3'!T27","v":0},{"$f":"'3'!U27","v":0},{"$f":"'3'!V27","v":0},{"$f":"'3'!W27","v":0},{"$f":"'3'!X27","v":0},{"$f":"'3'!Y27","v":0},{"$f":"'3'!Z27","v":0},{"$f":"'3'!AA27","v":0},{"$f":"'3'!AB27","v":0},{"$f":"'3'!AC27","v":0},{"$f":"'3'!AD27","v":0},{"$f":"'3'!AE27","v":0},{"$f":"'3'!AF27","v":0},{"$f":"'3'!AG27","v":0},{"$f":"'3'!AH27","v":0},{"$f":"'3'!AI27","v":0},{"$f":"'3'!AJ27","v":0},{"$f":"'3'!AK27","v":0},{"$f":"'3'!AL27","v":0},{"$f":"'3'!AM27","v":0},{"$f":"'3'!AN27","v":0},{"$f":"'3'!AO27","v":0},{"$f":"'3'!AP27","v":0},{"$f":"'3'!AQ27","v":0},{"$f":"'3'!AR27","v":0},{"$f":"'3'!AS27","v":0},{"$f":"'3'!AT27","v":0},{"$f":"SUMPRODUCT(IF($N160=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N160=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B28","v":"3"},{"$f":"'3'!C28","v":"3.1"},{"$f":"'3'!D28","v":"3.1.1"},{"$f":"'3'!E28","v":""},{"$f":"'3'!F28","v":"3.1.1.7"},{"$f":"'3'!G28","v":0},{"$f":"'3'!H28","v":0},{"$f":"'3'!I28","v":"3.1.1.7.3"},{"$f":"'3'!J28","v":"3.1.1.7.3: Are references checked to ensure that each entity providing outsourced services has a good reputation?\n"},{"$f":"'3'!K28","v":0},{"$f":"'3'!L28","v":0},{"$f":"'3'!M28","v":"Recommended"},{"$f":"'3'!N28","v":"Recommended"},{"$f":"'3'!O28","v":"BizOps"},{"$f":"'3'!P28","v":0},{"$f":"'3'!Q28","v":0},{"$f":"'3'!R28","v":0},{"$f":"'3'!S28","v":0},{"$f":"'3'!T28","v":0},{"$f":"'3'!U28","v":0},{"$f":"'3'!V28","v":0},{"$f":"'3'!W28","v":0},{"$f":"'3'!X28","v":0},{"$f":"'3'!Y28","v":0},{"$f":"'3'!Z28","v":0},{"$f":"'3'!AA28","v":0},{"$f":"'3'!AB28","v":0},{"$f":"'3'!AC28","v":0},{"$f":"'3'!AD28","v":0},{"$f":"'3'!AE28","v":0},{"$f":"'3'!AF28","v":0},{"$f":"'3'!AG28","v":0},{"$f":"'3'!AH28","v":0},{"$f":"'3'!AI28","v":0},{"$f":"'3'!AJ28","v":0},{"$f":"'3'!AK28","v":0},{"$f":"'3'!AL28","v":0},{"$f":"'3'!AM28","v":0},{"$f":"'3'!AN28","v":0},{"$f":"'3'!AO28","v":0},{"$f":"'3'!AP28","v":0},{"$f":"'3'!AQ28","v":0},{"$f":"'3'!AR28","v":0},{"$f":"'3'!AS28","v":0},{"$f":"'3'!AT28","v":0},{"$f":"SUMPRODUCT(IF($N161=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N161=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B29","v":"3"},{"$f":"'3'!C29","v":"3.1"},{"$f":"'3'!D29","v":"3.1.1"},{"$f":"'3'!E29","v":""},{"$f":"'3'!F29","v":"3.1.1.7"},{"$f":"'3'!G29","v":0},{"$f":"'3'!H29","v":0},{"$f":"'3'!I29","v":"3.1.1.7.4"},{"$f":"'3'!J29","v":"3.1.1.7.4: Are checks done to ensure that the entity providing outsourced services is financially solvent, with sufficient capital reserves to underwrite its level of operations?\n"},{"$f":"'3'!K29","v":0},{"$f":"'3'!L29","v":0},{"$f":"'3'!M29","v":"Recommended"},{"$f":"'3'!N29","v":"Recommended"},{"$f":"'3'!O29","v":"BizOps"},{"$f":"'3'!P29","v":0},{"$f":"'3'!Q29","v":0},{"$f":"'3'!R29","v":0},{"$f":"'3'!S29","v":0},{"$f":"'3'!T29","v":0},{"$f":"'3'!U29","v":0},{"$f":"'3'!V29","v":0},{"$f":"'3'!W29","v":0},{"$f":"'3'!X29","v":0},{"$f":"'3'!Y29","v":0},{"$f":"'3'!Z29","v":0},{"$f":"'3'!AA29","v":0},{"$f":"'3'!AB29","v":0},{"$f":"'3'!AC29","v":0},{"$f":"'3'!AD29","v":0},{"$f":"'3'!AE29","v":0},{"$f":"'3'!AF29","v":0},{"$f":"'3'!AG29","v":0},{"$f":"'3'!AH29","v":0},{"$f":"'3'!AI29","v":0},{"$f":"'3'!AJ29","v":0},{"$f":"'3'!AK29","v":0},{"$f":"'3'!AL29","v":0},{"$f":"'3'!AM29","v":0},{"$f":"'3'!AN29","v":0},{"$f":"'3'!AO29","v":0},{"$f":"'3'!AP29","v":0},{"$f":"'3'!AQ29","v":0},{"$f":"'3'!AR29","v":0},{"$f":"'3'!AS29","v":0},{"$f":"'3'!AT29","v":0},{"$f":"SUMPRODUCT(IF($N162=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N162=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B30","v":"3"},{"$f":"'3'!C30","v":"3.1"},{"$f":"'3'!D30","v":"3.1.1"},{"$f":"'3'!E30","v":""},{"$f":"'3'!F30","v":"3.1.1.7"},{"$f":"'3'!G30","v":0},{"$f":"'3'!H30","v":0},{"$f":"'3'!I30","v":"3.1.1.7.5"},{"$f":"'3'!J30","v":"3.1.1.7.5: Are due diligence checks performed on all entities providing outsourced services for core mobile money functions every two years at a minimum?\n"},{"$f":"'3'!K30","v":0},{"$f":"'3'!L30","v":0},{"$f":"'3'!M30","v":"Recommended"},{"$f":"'3'!N30","v":"Recommended"},{"$f":"'3'!O30","v":"BizOps"},{"$f":"'3'!P30","v":0},{"$f":"'3'!Q30","v":0},{"$f":"'3'!R30","v":0},{"$f":"'3'!S30","v":0},{"$f":"'3'!T30","v":0},{"$f":"'3'!U30","v":0},{"$f":"'3'!V30","v":0},{"$f":"'3'!W30","v":0},{"$f":"'3'!X30","v":0},{"$f":"'3'!Y30","v":0},{"$f":"'3'!Z30","v":0},{"$f":"'3'!AA30","v":0},{"$f":"'3'!AB30","v":0},{"$f":"'3'!AC30","v":0},{"$f":"'3'!AD30","v":0},{"$f":"'3'!AE30","v":0},{"$f":"'3'!AF30","v":0},{"$f":"'3'!AG30","v":0},{"$f":"'3'!AH30","v":0},{"$f":"'3'!AI30","v":0},{"$f":"'3'!AJ30","v":0},{"$f":"'3'!AK30","v":0},{"$f":"'3'!AL30","v":0},{"$f":"'3'!AM30","v":0},{"$f":"'3'!AN30","v":0},{"$f":"'3'!AO30","v":0},{"$f":"'3'!AP30","v":0},{"$f":"'3'!AQ30","v":0},{"$f":"'3'!AR30","v":0},{"$f":"'3'!AS30","v":0},{"$f":"'3'!AT30","v":0},{"$f":"SUMPRODUCT(IF($N163=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N163=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B31","v":"3"},{"$f":"'3'!C31","v":"3.1"},{"$f":"'3'!D31","v":"3.1.1"},{"$f":"'3'!E31","v":""},{"$f":"'3'!F31","v":"3.1.1.7"},{"$f":"'3'!G31","v":0},{"$f":"'3'!H31","v":0},{"$f":"'3'!I31","v":"3.1.1.7.6"},{"$f":"'3'!J31","v":"3.1.1.7.6: Are due diligence records for all entities providing outsourced services kept for at least five years after termination, including copies of all documentation collected and records of due diligence conducted?\n"},{"$f":"'3'!K31","v":0},{"$f":"'3'!L31","v":0},{"$f":"'3'!M31","v":"Recommended"},{"$f":"'3'!N31","v":"Recommended"},{"$f":"'3'!O31","v":"BizOps"},{"$f":"'3'!P31","v":0},{"$f":"'3'!Q31","v":0},{"$f":"'3'!R31","v":0},{"$f":"'3'!S31","v":0},{"$f":"'3'!T31","v":0},{"$f":"'3'!U31","v":0},{"$f":"'3'!V31","v":0},{"$f":"'3'!W31","v":0},{"$f":"'3'!X31","v":0},{"$f":"'3'!Y31","v":0},{"$f":"'3'!Z31","v":0},{"$f":"'3'!AA31","v":0},{"$f":"'3'!AB31","v":0},{"$f":"'3'!AC31","v":0},{"$f":"'3'!AD31","v":0},{"$f":"'3'!AE31","v":0},{"$f":"'3'!AF31","v":0},{"$f":"'3'!AG31","v":0},{"$f":"'3'!AH31","v":0},{"$f":"'3'!AI31","v":0},{"$f":"'3'!AJ31","v":0},{"$f":"'3'!AK31","v":0},{"$f":"'3'!AL31","v":0},{"$f":"'3'!AM31","v":0},{"$f":"'3'!AN31","v":0},{"$f":"'3'!AO31","v":0},{"$f":"'3'!AP31","v":0},{"$f":"'3'!AQ31","v":0},{"$f":"'3'!AR31","v":0},{"$f":"'3'!AS31","v":0},{"$f":"'3'!AT31","v":0},{"$f":"SUMPRODUCT(IF($N164=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N164=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B33","v":"3"},{"$f":"'3'!C33","v":"3.2"},{"$f":"'3'!D33","v":"3.2.1"},{"$f":"'3'!E33","v":"3.2.1: Providers shall develop and implement training programmes for staff"},{"$f":"'3'!F33","v":"3.2.1.1"},{"$f":"'3'!G33","v":"3.2.1.1: STAFF TRAINING: REQUIREMENTS / POLICY\nThe Provider should document training requirements for mobile money staff. Staff should receive relevant initial training and ongoing additional training as needed according to their role.\nThe training requirements should be regularly reviewed and updated as needed, such as when changes are made to the service or regulation.\n"},{"$f":"'3'!H33","v":"GSMA RMT"},{"$f":"'3'!I33","v":"3.2.1.1.1"},{"$f":"'3'!J33","v":"3.2.1.1.1: Is there documentation that describes the training requirements for mobile money staff (including initial and ongoing training), and is it regularly reviewed and updated as needed, such as when changes are made to the service or regulation?\n"},{"$f":"'3'!K33","v":"1) Staff training plan, training material or similar training documentation\n- Check the training requirements are documented for mobile money staff\n- Check the documents include:\n     a) Initial training \n     b) on-going training\n- Check there is a process to revise training requirements when required - for example when changes are made to the services, or to local regulations.\n"},{"$f":"'3'!L33","v":0},{"$f":"'3'!M33","v":"Standard Required"},{"$f":"'3'!N33","v":"Required"},{"$f":"'3'!O33","v":"BizOps"},{"$f":"'3'!P33","v":0},{"$f":"'3'!Q33","v":0},{"$f":"'3'!R33","v":0},{"$f":"'3'!S33","v":0},{"$f":"'3'!T33","v":0},{"$f":"'3'!U33","v":0},{"$f":"'3'!V33","v":0},{"$f":"'3'!W33","v":0},{"$f":"'3'!X33","v":0},{"$f":"'3'!Y33","v":0},{"$f":"'3'!Z33","v":0},{"$f":"'3'!AA33","v":0},{"$f":"'3'!AB33","v":0},{"$f":"'3'!AC33","v":0},{"$f":"'3'!AD33","v":0},{"$f":"'3'!AE33","v":0},{"$f":"'3'!AF33","v":0},{"$f":"'3'!AG33","v":0},{"$f":"'3'!AH33","v":0},{"$f":"'3'!AI33","v":0},{"$f":"'3'!AJ33","v":0},{"$f":"'3'!AK33","v":0},{"$f":"'3'!AL33","v":0},{"$f":"'3'!AM33","v":0},{"$f":"'3'!AN33","v":0},{"$f":"'3'!AO33","v":0},{"$f":"'3'!AP33","v":0},{"$f":"'3'!AQ33","v":0},{"$f":"'3'!AR33","v":0},{"$f":"'3'!AS33","v":0},{"$f":"'3'!AT33","v":0},{"$f":"SUMPRODUCT(IF($N165=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N165=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B34","v":"3"},{"$f":"'3'!C34","v":"3.2"},{"$f":"'3'!D34","v":"3.2.1"},{"$f":"'3'!E34","v":0},{"$f":"'3'!F34","v":"3.2.1.2"},{"$f":"'3'!G34","v":"3.2.1.2: STAFF TRAINING: PROCESS\nThe Provider should implement a process to train all new staff in mobile money and their role. The training should include, at a minimum:\n- the details of carrying out their role, the potential failure points and the implications for the business and its customers; and\n- the provider's mobile money business.\n\nRefresher training should be performed at intervals specified in the staff training policy. This should be every two years at a minimum. Training should also be conducted when staff change roles or when there are changes to the mobile money service that affect their role.\n\nWhen relevant to the role, staff should be trained in AML/CFT procedures and in anti-fraud measures (see 2.6.1)."},{"$f":"'3'!H34","v":"GSMA RMT"},{"$f":"'3'!I34","v":"3.2.1.2.1"},{"$f":"'3'!J34","v":"3.2.1.2.1: Are employees trained in (i) the details of carrying out their role, and (ii) the provider's mobile money business?\n"},{"$f":"'3'!K34","v":"1) Staff training plan, training material or similar training documentation\n- Check the staff training content includes:\na) details of carrying out their role\nb) the providers mobile money business\n\n\n"},{"$f":"'3'!L34","v":0},{"$f":"'3'!M34","v":"Urgent Required"},{"$f":"'3'!N34","v":"Required"},{"$f":"'3'!O34","v":"BizOps"},{"$f":"'3'!P34","v":0},{"$f":"'3'!Q34","v":0},{"$f":"'3'!R34","v":0},{"$f":"'3'!S34","v":0},{"$f":"'3'!T34","v":0},{"$f":"'3'!U34","v":0},{"$f":"'3'!V34","v":0},{"$f":"'3'!W34","v":0},{"$f":"'3'!X34","v":0},{"$f":"'3'!Y34","v":0},{"$f":"'3'!Z34","v":0},{"$f":"'3'!AA34","v":0},{"$f":"'3'!AB34","v":0},{"$f":"'3'!AC34","v":0},{"$f":"'3'!AD34","v":0},{"$f":"'3'!AE34","v":0},{"$f":"'3'!AF34","v":0},{"$f":"'3'!AG34","v":0},{"$f":"'3'!AH34","v":0},{"$f":"'3'!AI34","v":0},{"$f":"'3'!AJ34","v":0},{"$f":"'3'!AK34","v":0},{"$f":"'3'!AL34","v":0},{"$f":"'3'!AM34","v":0},{"$f":"'3'!AN34","v":0},{"$f":"'3'!AO34","v":0},{"$f":"'3'!AP34","v":0},{"$f":"'3'!AQ34","v":0},{"$f":"'3'!AR34","v":0},{"$f":"'3'!AS34","v":0},{"$f":"'3'!AT34","v":0},{"$f":"SUMPRODUCT(IF($N166=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N166=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B35","v":"3"},{"$f":"'3'!C35","v":"3.2"},{"$f":"'3'!D35","v":"3.2.1"},{"$f":"'3'!E35","v":""},{"$f":"'3'!F35","v":"3.2.1.2"},{"$f":"'3'!G35","v":0},{"$f":"'3'!H35","v":0},{"$f":"'3'!I35","v":"3.2.1.2.2"},{"$f":"'3'!J35","v":"3.2.1.2.2: Is refresher training (for mobile money and their specific role) performed for staff every two years at a minimum?\n"},{"$f":"'3'!K35","v":0},{"$f":"'3'!L35","v":0},{"$f":"'3'!M35","v":"Recommended"},{"$f":"'3'!N35","v":"Recommended"},{"$f":"'3'!O35","v":"BizOps"},{"$f":"'3'!P35","v":0},{"$f":"'3'!Q35","v":0},{"$f":"'3'!R35","v":0},{"$f":"'3'!S35","v":0},{"$f":"'3'!T35","v":0},{"$f":"'3'!U35","v":0},{"$f":"'3'!V35","v":0},{"$f":"'3'!W35","v":0},{"$f":"'3'!X35","v":0},{"$f":"'3'!Y35","v":0},{"$f":"'3'!Z35","v":0},{"$f":"'3'!AA35","v":0},{"$f":"'3'!AB35","v":0},{"$f":"'3'!AC35","v":0},{"$f":"'3'!AD35","v":0},{"$f":"'3'!AE35","v":0},{"$f":"'3'!AF35","v":0},{"$f":"'3'!AG35","v":0},{"$f":"'3'!AH35","v":0},{"$f":"'3'!AI35","v":0},{"$f":"'3'!AJ35","v":0},{"$f":"'3'!AK35","v":0},{"$f":"'3'!AL35","v":0},{"$f":"'3'!AM35","v":0},{"$f":"'3'!AN35","v":0},{"$f":"'3'!AO35","v":0},{"$f":"'3'!AP35","v":0},{"$f":"'3'!AQ35","v":0},{"$f":"'3'!AR35","v":0},{"$f":"'3'!AS35","v":0},{"$f":"'3'!AT35","v":0},{"$f":"SUMPRODUCT(IF($N167=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N167=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B36","v":"3"},{"$f":"'3'!C36","v":"3.2"},{"$f":"'3'!D36","v":"3.2.1"},{"$f":"'3'!E36","v":""},{"$f":"'3'!F36","v":"3.2.1.2"},{"$f":"'3'!G36","v":0},{"$f":"'3'!H36","v":0},{"$f":"'3'!I36","v":"3.2.1.2.3"},{"$f":"'3'!J36","v":"3.2.1.2.3: Is training conducted when staff change roles and when there are changes to the mobile money service that affect their role?\n"},{"$f":"'3'!K36","v":0},{"$f":"'3'!L36","v":0},{"$f":"'3'!M36","v":"Recommended"},{"$f":"'3'!N36","v":"Recommended"},{"$f":"'3'!O36","v":"BizOps"},{"$f":"'3'!P36","v":0},{"$f":"'3'!Q36","v":0},{"$f":"'3'!R36","v":0},{"$f":"'3'!S36","v":0},{"$f":"'3'!T36","v":0},{"$f":"'3'!U36","v":0},{"$f":"'3'!V36","v":0},{"$f":"'3'!W36","v":0},{"$f":"'3'!X36","v":0},{"$f":"'3'!Y36","v":0},{"$f":"'3'!Z36","v":0},{"$f":"'3'!AA36","v":0},{"$f":"'3'!AB36","v":0},{"$f":"'3'!AC36","v":0},{"$f":"'3'!AD36","v":0},{"$f":"'3'!AE36","v":0},{"$f":"'3'!AF36","v":0},{"$f":"'3'!AG36","v":0},{"$f":"'3'!AH36","v":0},{"$f":"'3'!AI36","v":0},{"$f":"'3'!AJ36","v":0},{"$f":"'3'!AK36","v":0},{"$f":"'3'!AL36","v":0},{"$f":"'3'!AM36","v":0},{"$f":"'3'!AN36","v":0},{"$f":"'3'!AO36","v":0},{"$f":"'3'!AP36","v":0},{"$f":"'3'!AQ36","v":0},{"$f":"'3'!AR36","v":0},{"$f":"'3'!AS36","v":0},{"$f":"'3'!AT36","v":0},{"$f":"SUMPRODUCT(IF($N168=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N168=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B37","v":"3"},{"$f":"'3'!C37","v":"3.2"},{"$f":"'3'!D37","v":"3.2.1"},{"$f":"'3'!E37","v":""},{"$f":"'3'!F37","v":"3.2.1.3"},{"$f":"'3'!G37","v":"3.2.1.3: STAFF TRAINING: RECORDS\nThe provider should maintain records of all staff training conducted. Records should be kept for a period determined by regulation or risk assessment, whichever is longer. Records should be kept physically or electronically (or both). "},{"$f":"'3'!H37","v":"GSMA RMT"},{"$f":"'3'!I37","v":"3.2.1.3.1"},{"$f":"'3'!J37","v":"3.2.1.3.1: Are all employees trained and are all training records kept for a suitable period?\n"},{"$f":"'3'!K37","v":"1) Training records\n- Check records kept include:\n      a) Name of employee/unique ID\n      b) Training received\n      c) Assessment score (if any test is administered)\n      d) Date training completed\n- Check there is a timeline for the storage of the records.\n- Check records are aligned with the training plan.\n"},{"$f":"'3'!L37","v":0},{"$f":"'3'!M37","v":"Standard Required"},{"$f":"'3'!N37","v":"Required"},{"$f":"'3'!O37","v":"BizOps"},{"$f":"'3'!P37","v":0},{"$f":"'3'!Q37","v":0},{"$f":"'3'!R37","v":0},{"$f":"'3'!S37","v":0},{"$f":"'3'!T37","v":0},{"$f":"'3'!U37","v":0},{"$f":"'3'!V37","v":0},{"$f":"'3'!W37","v":0},{"$f":"'3'!X37","v":0},{"$f":"'3'!Y37","v":0},{"$f":"'3'!Z37","v":0},{"$f":"'3'!AA37","v":0},{"$f":"'3'!AB37","v":0},{"$f":"'3'!AC37","v":0},{"$f":"'3'!AD37","v":0},{"$f":"'3'!AE37","v":0},{"$f":"'3'!AF37","v":0},{"$f":"'3'!AG37","v":0},{"$f":"'3'!AH37","v":0},{"$f":"'3'!AI37","v":0},{"$f":"'3'!AJ37","v":0},{"$f":"'3'!AK37","v":0},{"$f":"'3'!AL37","v":0},{"$f":"'3'!AM37","v":0},{"$f":"'3'!AN37","v":0},{"$f":"'3'!AO37","v":0},{"$f":"'3'!AP37","v":0},{"$f":"'3'!AQ37","v":0},{"$f":"'3'!AR37","v":0},{"$f":"'3'!AS37","v":0},{"$f":"'3'!AT37","v":0},{"$f":"SUMPRODUCT(IF($N169=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N169=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B38","v":"3"},{"$f":"'3'!C38","v":"3.2"},{"$f":"'3'!D38","v":"3.2.2"},{"$f":"'3'!E38","v":"3.2.2: Providers shall develop and implement training programmes for agents"},{"$f":"'3'!F38","v":"3.2.2.1"},{"$f":"'3'!G38","v":"3.2.2.1: TRAINING FOR AGENTS: REQUIREMENTS / POLICY\nThe provider should document a policy to carry out training of mobile money agents before their engagement and regularly thereafter. The agent training policy should be regularly reviewed and updated as needed, such as when changes are made to the service or regulation. "},{"$f":"'3'!H38","v":"GSMA RMT"},{"$f":"'3'!I38","v":"3.2.2.1.1"},{"$f":"'3'!J38","v":"3.2.2.1.1: Is there documentation that describes the training requirements for mobile money agents (including initial and ongoing training), and is it regularly reviewed and updated as needed, such as when changes are made to the service or regulation?\n"},{"$f":"'3'!K38","v":"1) Agent training plan, training material or similar training documentation\n- Check that training requirements are documented for agents\n- Check that the document includes:\n     a) Initial training \n     b) On-going training\n- Check that there is a process to revise training requirements when required - for example when changes are main to the services, or local regulations\n"},{"$f":"'3'!L38","v":0},{"$f":"'3'!M38","v":"Urgent Required"},{"$f":"'3'!N38","v":"Required"},{"$f":"'3'!O38","v":"Agent"},{"$f":"'3'!P38","v":0},{"$f":"'3'!Q38","v":0},{"$f":"'3'!R38","v":0},{"$f":"'3'!S38","v":0},{"$f":"'3'!T38","v":0},{"$f":"'3'!U38","v":0},{"$f":"'3'!V38","v":0},{"$f":"'3'!W38","v":0},{"$f":"'3'!X38","v":0},{"$f":"'3'!Y38","v":0},{"$f":"'3'!Z38","v":0},{"$f":"'3'!AA38","v":0},{"$f":"'3'!AB38","v":0},{"$f":"'3'!AC38","v":0},{"$f":"'3'!AD38","v":0},{"$f":"'3'!AE38","v":0},{"$f":"'3'!AF38","v":0},{"$f":"'3'!AG38","v":0},{"$f":"'3'!AH38","v":0},{"$f":"'3'!AI38","v":0},{"$f":"'3'!AJ38","v":0},{"$f":"'3'!AK38","v":0},{"$f":"'3'!AL38","v":0},{"$f":"'3'!AM38","v":0},{"$f":"'3'!AN38","v":0},{"$f":"'3'!AO38","v":0},{"$f":"'3'!AP38","v":0},{"$f":"'3'!AQ38","v":0},{"$f":"'3'!AR38","v":0},{"$f":"'3'!AS38","v":0},{"$f":"'3'!AT38","v":0},{"$f":"SUMPRODUCT(IF($N170=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N170=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B39","v":"3"},{"$f":"'3'!C39","v":"3.2"},{"$f":"'3'!D39","v":"3.2.2"},{"$f":"'3'!E39","v":0},{"$f":"'3'!F39","v":"3.2.2.2"},{"$f":"'3'!G39","v":"3.2.2.2: TRAINING FOR AGENTS: PROCESS\nThe Provider should implement a process to ensure all agents are trained. The training should include, at a minimum:\n- Liquidity management (see definition);\n- How to facilitate customer transactions;\n- AML/CFT procedures (see 2.6.1.1.2);\n- Anti-fraud measures (see 5.3.10.2);\n- Disclosure of fees; and\n- How to inform customers of their rights in the event of a complaint (see 7.1.2.1).\n\nProviders should monitor agents to ensure they are properly trained and to identify areas where further support is required (refer to 3.4). Refresher training should be performed at intervals specified in the agent training policy, and every two years at a minimum.\n\nTraining of all agents should also be conducted when there are changes to the mobile money service that affect agents."},{"$f":"'3'!H39","v":"ISO 27015:2012 Sec. 12.1\nGSMA RMT (AG-08,\nAG-10,\nAG-11,\nAG-14,\nAG-17)"},{"$f":"'3'!I39","v":"3.2.2.2.1"},{"$f":"'3'!J39","v":"3.2.2.2.1: Are agents trained in the important aspects of operating as a mobile money agent, such as liquidity management (see definition), carrying out customer transactions, and key security measures?\n"},{"$f":"'3'!K39","v":"1) Agent training plan, training material or similar training documentation\n- Check that the training content includes important aspects of operating as a mobile money agent such as liquidity management, customer registration (if applicable), cash in/out, etc.\n"},{"$f":"'3'!L39","v":0},{"$f":"'3'!M39","v":"Urgent Required"},{"$f":"'3'!N39","v":"Required"},{"$f":"'3'!O39","v":"Agent"},{"$f":"'3'!P39","v":0},{"$f":"'3'!Q39","v":0},{"$f":"'3'!R39","v":0},{"$f":"'3'!S39","v":0},{"$f":"'3'!T39","v":0},{"$f":"'3'!U39","v":0},{"$f":"'3'!V39","v":0},{"$f":"'3'!W39","v":0},{"$f":"'3'!X39","v":0},{"$f":"'3'!Y39","v":0},{"$f":"'3'!Z39","v":0},{"$f":"'3'!AA39","v":0},{"$f":"'3'!AB39","v":0},{"$f":"'3'!AC39","v":0},{"$f":"'3'!AD39","v":0},{"$f":"'3'!AE39","v":0},{"$f":"'3'!AF39","v":0},{"$f":"'3'!AG39","v":0},{"$f":"'3'!AH39","v":0},{"$f":"'3'!AI39","v":0},{"$f":"'3'!AJ39","v":0},{"$f":"'3'!AK39","v":0},{"$f":"'3'!AL39","v":0},{"$f":"'3'!AM39","v":0},{"$f":"'3'!AN39","v":0},{"$f":"'3'!AO39","v":0},{"$f":"'3'!AP39","v":0},{"$f":"'3'!AQ39","v":0},{"$f":"'3'!AR39","v":0},{"$f":"'3'!AS39","v":0},{"$f":"'3'!AT39","v":0},{"$f":"SUMPRODUCT(IF($N171=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N171=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B40","v":"3"},{"$f":"'3'!C40","v":"3.2"},{"$f":"'3'!D40","v":"3.2.2"},{"$f":"'3'!E40","v":""},{"$f":"'3'!F40","v":"3.2.2.2"},{"$f":"'3'!G40","v":0},{"$f":"'3'!H40","v":0},{"$f":"'3'!I40","v":"3.2.2.2.2"},{"$f":"'3'!J40","v":"3.2.2.2.2: Are agents trained in disclosure of fees?\n"},{"$f":"'3'!K40","v":0},{"$f":"'3'!L40","v":0},{"$f":"'3'!M40","v":"Recommended"},{"$f":"'3'!N40","v":"Recommended"},{"$f":"'3'!O40","v":"Agent"},{"$f":"'3'!P40","v":0},{"$f":"'3'!Q40","v":0},{"$f":"'3'!R40","v":0},{"$f":"'3'!S40","v":0},{"$f":"'3'!T40","v":0},{"$f":"'3'!U40","v":0},{"$f":"'3'!V40","v":0},{"$f":"'3'!W40","v":0},{"$f":"'3'!X40","v":0},{"$f":"'3'!Y40","v":0},{"$f":"'3'!Z40","v":0},{"$f":"'3'!AA40","v":0},{"$f":"'3'!AB40","v":0},{"$f":"'3'!AC40","v":0},{"$f":"'3'!AD40","v":0},{"$f":"'3'!AE40","v":0},{"$f":"'3'!AF40","v":0},{"$f":"'3'!AG40","v":0},{"$f":"'3'!AH40","v":0},{"$f":"'3'!AI40","v":0},{"$f":"'3'!AJ40","v":0},{"$f":"'3'!AK40","v":0},{"$f":"'3'!AL40","v":0},{"$f":"'3'!AM40","v":0},{"$f":"'3'!AN40","v":0},{"$f":"'3'!AO40","v":0},{"$f":"'3'!AP40","v":0},{"$f":"'3'!AQ40","v":0},{"$f":"'3'!AR40","v":0},{"$f":"'3'!AS40","v":0},{"$f":"'3'!AT40","v":0},{"$f":"SUMPRODUCT(IF($N172=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N172=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B41","v":"3"},{"$f":"'3'!C41","v":"3.2"},{"$f":"'3'!D41","v":"3.2.2"},{"$f":"'3'!E41","v":""},{"$f":"'3'!F41","v":"3.2.2.2"},{"$f":"'3'!G41","v":0},{"$f":"'3'!H41","v":0},{"$f":"'3'!I41","v":"3.2.2.2.3"},{"$f":"'3'!J41","v":"3.2.2.2.3: Is refresher training performed at least every two years and whenever there are changes to the mobile money service that affect agents?\n"},{"$f":"'3'!K41","v":0},{"$f":"'3'!L41","v":0},{"$f":"'3'!M41","v":"Recommended"},{"$f":"'3'!N41","v":"Recommended"},{"$f":"'3'!O41","v":"Agent"},{"$f":"'3'!P41","v":0},{"$f":"'3'!Q41","v":0},{"$f":"'3'!R41","v":0},{"$f":"'3'!S41","v":0},{"$f":"'3'!T41","v":0},{"$f":"'3'!U41","v":0},{"$f":"'3'!V41","v":0},{"$f":"'3'!W41","v":0},{"$f":"'3'!X41","v":0},{"$f":"'3'!Y41","v":0},{"$f":"'3'!Z41","v":0},{"$f":"'3'!AA41","v":0},{"$f":"'3'!AB41","v":0},{"$f":"'3'!AC41","v":0},{"$f":"'3'!AD41","v":0},{"$f":"'3'!AE41","v":0},{"$f":"'3'!AF41","v":0},{"$f":"'3'!AG41","v":0},{"$f":"'3'!AH41","v":0},{"$f":"'3'!AI41","v":0},{"$f":"'3'!AJ41","v":0},{"$f":"'3'!AK41","v":0},{"$f":"'3'!AL41","v":0},{"$f":"'3'!AM41","v":0},{"$f":"'3'!AN41","v":0},{"$f":"'3'!AO41","v":0},{"$f":"'3'!AP41","v":0},{"$f":"'3'!AQ41","v":0},{"$f":"'3'!AR41","v":0},{"$f":"'3'!AS41","v":0},{"$f":"'3'!AT41","v":0},{"$f":"SUMPRODUCT(IF($N173=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N173=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B42","v":"3"},{"$f":"'3'!C42","v":"3.2"},{"$f":"'3'!D42","v":"3.2.2"},{"$f":"'3'!E42","v":""},{"$f":"'3'!F42","v":"3.2.2.3"},{"$f":"'3'!G42","v":"3.2.2.3: TRAINING FOR AGENTS: RECORDS\nThe provider should maintain records of all agent training conducted. Records should be kept for a period determined by regulation or risk assessment, whichever is longer. Records should be kept physically or electronically (or both). \n"},{"$f":"'3'!H42","v":"GSMA RMT"},{"$f":"'3'!I42","v":"3.2.2.3.1"},{"$f":"'3'!J42","v":"3.2.2.3.1: Are all agents trained and are all training records kept for a suitable period?\n"},{"$f":"'3'!K42","v":"1) Training records\n- Check records kept include:\n      a) Name of agent/unique ID\n      b) Training received\n      c) Assessment score (if any test is administered)\n      d) Date training completed\n- Check there is a timeline for the storage of the records.\n- Check records are aligned with the training plan.\n"},{"$f":"'3'!L42","v":0},{"$f":"'3'!M42","v":"Standard Required"},{"$f":"'3'!N42","v":"Required"},{"$f":"'3'!O42","v":"Agent"},{"$f":"'3'!P42","v":0},{"$f":"'3'!Q42","v":0},{"$f":"'3'!R42","v":0},{"$f":"'3'!S42","v":0},{"$f":"'3'!T42","v":0},{"$f":"'3'!U42","v":0},{"$f":"'3'!V42","v":0},{"$f":"'3'!W42","v":0},{"$f":"'3'!X42","v":0},{"$f":"'3'!Y42","v":0},{"$f":"'3'!Z42","v":0},{"$f":"'3'!AA42","v":0},{"$f":"'3'!AB42","v":0},{"$f":"'3'!AC42","v":0},{"$f":"'3'!AD42","v":0},{"$f":"'3'!AE42","v":0},{"$f":"'3'!AF42","v":0},{"$f":"'3'!AG42","v":0},{"$f":"'3'!AH42","v":0},{"$f":"'3'!AI42","v":0},{"$f":"'3'!AJ42","v":0},{"$f":"'3'!AK42","v":0},{"$f":"'3'!AL42","v":0},{"$f":"'3'!AM42","v":0},{"$f":"'3'!AN42","v":0},{"$f":"'3'!AO42","v":0},{"$f":"'3'!AP42","v":0},{"$f":"'3'!AQ42","v":0},{"$f":"'3'!AR42","v":0},{"$f":"'3'!AS42","v":0},{"$f":"'3'!AT42","v":0},{"$f":"SUMPRODUCT(IF($N174=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N174=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B44","v":"3"},{"$f":"'3'!C44","v":"3.3"},{"$f":"'3'!D44","v":"3.3.1"},{"$f":"'3'!E44","v":"3.3.1: Providers shall establish written agreements governing their relationship with agents and entities providing outsourced services."},{"$f":"'3'!F44","v":"3.3.1.1"},{"$f":"'3'!G44","v":"3.3.1.1: AGENT AGREEMENTS\nContractual agreements should be established with all agents, either directly or through master agents or agent aggregators. Agreements should ensure that the responsibilities and expectations of providers and agents are clearly established. The following topics should be included:\n- A list of the functions to be provided by agent (e.g. registration, cash-in, cash-out).\n- Expected service levels from agent and the service level of provider's system (which may include scheduled downtime) (see definition).\n- Contractual liabilities of the respective parties with respect to fraud/forgery, cash and mobile money security, physical security, customer data security, and other relevant matters.\n- Stipulation that provider must have access to all data related to the activities conducted by the agent on behalf of the provider (such as written records of transactions, customer identification data etc.), and clarification of the ownership of such data.\n- Barring of discriminatory practices - all customers should be served equally."},{"$f":"'3'!H44","v":"ECB RSMP \nBCBS OFS\nGSMA RMT\n(CON-05, CON-06, CON-09, CON-10, CON-13, CON-14)"},{"$f":"'3'!I44","v":"3.3.1.1.1"},{"$f":"'3'!J44","v":"3.3.1.1.1: Are contractual agreements in place with all agents, either directly or through master agents or agent aggregators?\n"},{"$f":"'3'!K44","v":"1) Sample agent contract or standard contract template.\n2) Sample master agent contract / agent aggregator contract or template contract.\n\n- Check that a suitable contract exists for agents.\n- Check that a suitable contract exists for master agents and agent aggregators (if applicable).\n"},{"$f":"'3'!L44","v":0},{"$f":"'3'!M44","v":"Urgent Required"},{"$f":"'3'!N44","v":"Required"},{"$f":"'3'!O44","v":"Agent"},{"$f":"'3'!P44","v":0},{"$f":"'3'!Q44","v":0},{"$f":"'3'!R44","v":0},{"$f":"'3'!S44","v":0},{"$f":"'3'!T44","v":0},{"$f":"'3'!U44","v":0},{"$f":"'3'!V44","v":0},{"$f":"'3'!W44","v":0},{"$f":"'3'!X44","v":0},{"$f":"'3'!Y44","v":0},{"$f":"'3'!Z44","v":0},{"$f":"'3'!AA44","v":0},{"$f":"'3'!AB44","v":0},{"$f":"'3'!AC44","v":0},{"$f":"'3'!AD44","v":0},{"$f":"'3'!AE44","v":0},{"$f":"'3'!AF44","v":0},{"$f":"'3'!AG44","v":0},{"$f":"'3'!AH44","v":0},{"$f":"'3'!AI44","v":0},{"$f":"'3'!AJ44","v":0},{"$f":"'3'!AK44","v":0},{"$f":"'3'!AL44","v":0},{"$f":"'3'!AM44","v":0},{"$f":"'3'!AN44","v":0},{"$f":"'3'!AO44","v":0},{"$f":"'3'!AP44","v":0},{"$f":"'3'!AQ44","v":0},{"$f":"'3'!AR44","v":0},{"$f":"'3'!AS44","v":0},{"$f":"'3'!AT44","v":0},{"$f":"SUMPRODUCT(IF($N175=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N175=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B45","v":"3"},{"$f":"'3'!C45","v":"3.3"},{"$f":"'3'!D45","v":"3.3.1"},{"$f":"'3'!E45","v":0},{"$f":"'3'!F45","v":"3.3.1.1"},{"$f":"'3'!G45","v":0},{"$f":"'3'!H45","v":0},{"$f":"'3'!I45","v":"3.3.1.1.2"},{"$f":"'3'!J45","v":"3.3.1.1.2: Do agent agreements include (i) a list of the functions to be provided by the agent and (ii) the expected service levels from the agent and provider (see definition)?\n"},{"$f":"'3'!K45","v":0},{"$f":"'3'!L45","v":0},{"$f":"'3'!M45","v":"Recommended"},{"$f":"'3'!N45","v":"Recommended"},{"$f":"'3'!O45","v":"Agent"},{"$f":"'3'!P45","v":0},{"$f":"'3'!Q45","v":0},{"$f":"'3'!R45","v":0},{"$f":"'3'!S45","v":0},{"$f":"'3'!T45","v":0},{"$f":"'3'!U45","v":0},{"$f":"'3'!V45","v":0},{"$f":"'3'!W45","v":0},{"$f":"'3'!X45","v":0},{"$f":"'3'!Y45","v":0},{"$f":"'3'!Z45","v":0},{"$f":"'3'!AA45","v":0},{"$f":"'3'!AB45","v":0},{"$f":"'3'!AC45","v":0},{"$f":"'3'!AD45","v":0},{"$f":"'3'!AE45","v":0},{"$f":"'3'!AF45","v":0},{"$f":"'3'!AG45","v":0},{"$f":"'3'!AH45","v":0},{"$f":"'3'!AI45","v":0},{"$f":"'3'!AJ45","v":0},{"$f":"'3'!AK45","v":0},{"$f":"'3'!AL45","v":0},{"$f":"'3'!AM45","v":0},{"$f":"'3'!AN45","v":0},{"$f":"'3'!AO45","v":0},{"$f":"'3'!AP45","v":0},{"$f":"'3'!AQ45","v":0},{"$f":"'3'!AR45","v":0},{"$f":"'3'!AS45","v":0},{"$f":"'3'!AT45","v":0},{"$f":"SUMPRODUCT(IF($N176=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N176=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B46","v":"3"},{"$f":"'3'!C46","v":"3.3"},{"$f":"'3'!D46","v":"3.3.1"},{"$f":"'3'!E46","v":0},{"$f":"'3'!F46","v":"3.3.1.1"},{"$f":"'3'!G46","v":0},{"$f":"'3'!H46","v":0},{"$f":"'3'!I46","v":"3.3.1.1.3"},{"$f":"'3'!J46","v":"3.3.1.1.3: Do agent agreements specify contractual liabilities with respect to fraud/forgery, cash and mobile money security, physical security, and customer data security?\n"},{"$f":"'3'!K46","v":0},{"$f":"'3'!L46","v":0},{"$f":"'3'!M46","v":"Recommended"},{"$f":"'3'!N46","v":"Recommended"},{"$f":"'3'!O46","v":"Agent"},{"$f":"'3'!P46","v":0},{"$f":"'3'!Q46","v":0},{"$f":"'3'!R46","v":0},{"$f":"'3'!S46","v":0},{"$f":"'3'!T46","v":0},{"$f":"'3'!U46","v":0},{"$f":"'3'!V46","v":0},{"$f":"'3'!W46","v":0},{"$f":"'3'!X46","v":0},{"$f":"'3'!Y46","v":0},{"$f":"'3'!Z46","v":0},{"$f":"'3'!AA46","v":0},{"$f":"'3'!AB46","v":0},{"$f":"'3'!AC46","v":0},{"$f":"'3'!AD46","v":0},{"$f":"'3'!AE46","v":0},{"$f":"'3'!AF46","v":0},{"$f":"'3'!AG46","v":0},{"$f":"'3'!AH46","v":0},{"$f":"'3'!AI46","v":0},{"$f":"'3'!AJ46","v":0},{"$f":"'3'!AK46","v":0},{"$f":"'3'!AL46","v":0},{"$f":"'3'!AM46","v":0},{"$f":"'3'!AN46","v":0},{"$f":"'3'!AO46","v":0},{"$f":"'3'!AP46","v":0},{"$f":"'3'!AQ46","v":0},{"$f":"'3'!AR46","v":0},{"$f":"'3'!AS46","v":0},{"$f":"'3'!AT46","v":0},{"$f":"SUMPRODUCT(IF($N177=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N177=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B47","v":"3"},{"$f":"'3'!C47","v":"3.3"},{"$f":"'3'!D47","v":"3.3.1"},{"$f":"'3'!E47","v":0},{"$f":"'3'!F47","v":"3.3.1.1"},{"$f":"'3'!G47","v":0},{"$f":"'3'!H47","v":0},{"$f":"'3'!I47","v":"3.3.1.1.4"},{"$f":"'3'!J47","v":"3.3.1.1.4: Do agent agreements stipulate that provider must have access to all data related to the activities conducted by the agent on behalf of the provider (such as written records of transactions, customer identification data etc.) and clarify the ownership of such data?\n"},{"$f":"'3'!K47","v":0},{"$f":"'3'!L47","v":0},{"$f":"'3'!M47","v":"Recommended"},{"$f":"'3'!N47","v":"Recommended"},{"$f":"'3'!O47","v":"Agent"},{"$f":"'3'!P47","v":0},{"$f":"'3'!Q47","v":0},{"$f":"'3'!R47","v":0},{"$f":"'3'!S47","v":0},{"$f":"'3'!T47","v":0},{"$f":"'3'!U47","v":0},{"$f":"'3'!V47","v":0},{"$f":"'3'!W47","v":0},{"$f":"'3'!X47","v":0},{"$f":"'3'!Y47","v":0},{"$f":"'3'!Z47","v":0},{"$f":"'3'!AA47","v":0},{"$f":"'3'!AB47","v":0},{"$f":"'3'!AC47","v":0},{"$f":"'3'!AD47","v":0},{"$f":"'3'!AE47","v":0},{"$f":"'3'!AF47","v":0},{"$f":"'3'!AG47","v":0},{"$f":"'3'!AH47","v":0},{"$f":"'3'!AI47","v":0},{"$f":"'3'!AJ47","v":0},{"$f":"'3'!AK47","v":0},{"$f":"'3'!AL47","v":0},{"$f":"'3'!AM47","v":0},{"$f":"'3'!AN47","v":0},{"$f":"'3'!AO47","v":0},{"$f":"'3'!AP47","v":0},{"$f":"'3'!AQ47","v":0},{"$f":"'3'!AR47","v":0},{"$f":"'3'!AS47","v":0},{"$f":"'3'!AT47","v":0},{"$f":"SUMPRODUCT(IF($N178=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N178=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B48","v":"3"},{"$f":"'3'!C48","v":"3.3"},{"$f":"'3'!D48","v":"3.3.1"},{"$f":"'3'!E48","v":0},{"$f":"'3'!F48","v":"3.3.1.1"},{"$f":"'3'!G48","v":0},{"$f":"'3'!H48","v":0},{"$f":"'3'!I48","v":"3.3.1.1.5"},{"$f":"'3'!J48","v":"3.3.1.1.5: Do agent agreements bar discriminatory practices, meaning that all customers should be served equally?\n"},{"$f":"'3'!K48","v":0},{"$f":"'3'!L48","v":0},{"$f":"'3'!M48","v":"Recommended"},{"$f":"'3'!N48","v":"Recommended"},{"$f":"'3'!O48","v":"Agent"},{"$f":"'3'!P48","v":0},{"$f":"'3'!Q48","v":0},{"$f":"'3'!R48","v":0},{"$f":"'3'!S48","v":0},{"$f":"'3'!T48","v":0},{"$f":"'3'!U48","v":0},{"$f":"'3'!V48","v":0},{"$f":"'3'!W48","v":0},{"$f":"'3'!X48","v":0},{"$f":"'3'!Y48","v":0},{"$f":"'3'!Z48","v":0},{"$f":"'3'!AA48","v":0},{"$f":"'3'!AB48","v":0},{"$f":"'3'!AC48","v":0},{"$f":"'3'!AD48","v":0},{"$f":"'3'!AE48","v":0},{"$f":"'3'!AF48","v":0},{"$f":"'3'!AG48","v":0},{"$f":"'3'!AH48","v":0},{"$f":"'3'!AI48","v":0},{"$f":"'3'!AJ48","v":0},{"$f":"'3'!AK48","v":0},{"$f":"'3'!AL48","v":0},{"$f":"'3'!AM48","v":0},{"$f":"'3'!AN48","v":0},{"$f":"'3'!AO48","v":0},{"$f":"'3'!AP48","v":0},{"$f":"'3'!AQ48","v":0},{"$f":"'3'!AR48","v":0},{"$f":"'3'!AS48","v":0},{"$f":"'3'!AT48","v":0},{"$f":"SUMPRODUCT(IF($N179=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N179=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B49","v":"3"},{"$f":"'3'!C49","v":"3.3"},{"$f":"'3'!D49","v":"3.3.1"},{"$f":"'3'!E49","v":""},{"$f":"'3'!F49","v":"3.3.1.2"},{"$f":"'3'!G49","v":"3.3.1.2: AGREEMENTS WITH ENTITIES PROVIDING OUTSOURCED SERVICES\nContractual agreements should be established with all entities providing outsourced services. Agreements should ensure that the responsibilities and expectations of providers and entities providing outsourced services are clearly established. \n\nThe following topics should be included:\n- Expected service levels from the entity providing outsourced services. Note that the SLA published to customers should take account of the operational SLA agreed with entities providing outsourced services (see 4.2).\n- Where appropriate, a requirement for entities providing outsourced services to conduct appropriate due diligence on their own staff.\n- Business continuity requirements (when appropriate - for example, if the mobile money system is outsourced);\n- Stipulation that provider must have access to all data related to the activities conducted by the entity providing outsourced services on behalf of the provider and clarification of the ownership of such data.\n"},{"$f":"'3'!H49","v":0},{"$f":"'3'!I49","v":"3.3.1.2.1"},{"$f":"'3'!J49","v":"3.3.1.2.1: Are the expected service levels defined for each entity providing material outsourced services?\n"},{"$f":"'3'!K49","v":"1) Contract document for each material outsourced service suppliers (e.g. MM platform provider)\n- Check that expected service levels are defined for all entities providing material outsourced services.\n"},{"$f":"'3'!L49","v":0},{"$f":"'3'!M49","v":"Urgent Required"},{"$f":"'3'!N49","v":"Required"},{"$f":"'3'!O49","v":"BizOps"},{"$f":"'3'!P49","v":0},{"$f":"'3'!Q49","v":0},{"$f":"'3'!R49","v":0},{"$f":"'3'!S49","v":0},{"$f":"'3'!T49","v":0},{"$f":"'3'!U49","v":0},{"$f":"'3'!V49","v":0},{"$f":"'3'!W49","v":0},{"$f":"'3'!X49","v":0},{"$f":"'3'!Y49","v":0},{"$f":"'3'!Z49","v":0},{"$f":"'3'!AA49","v":0},{"$f":"'3'!AB49","v":0},{"$f":"'3'!AC49","v":0},{"$f":"'3'!AD49","v":0},{"$f":"'3'!AE49","v":0},{"$f":"'3'!AF49","v":0},{"$f":"'3'!AG49","v":0},{"$f":"'3'!AH49","v":0},{"$f":"'3'!AI49","v":0},{"$f":"'3'!AJ49","v":0},{"$f":"'3'!AK49","v":0},{"$f":"'3'!AL49","v":0},{"$f":"'3'!AM49","v":0},{"$f":"'3'!AN49","v":0},{"$f":"'3'!AO49","v":0},{"$f":"'3'!AP49","v":0},{"$f":"'3'!AQ49","v":0},{"$f":"'3'!AR49","v":0},{"$f":"'3'!AS49","v":0},{"$f":"'3'!AT49","v":0},{"$f":"SUMPRODUCT(IF($N180=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N180=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B50","v":"3"},{"$f":"'3'!C50","v":"3.3"},{"$f":"'3'!D50","v":"3.3.1"},{"$f":"'3'!E50","v":""},{"$f":"'3'!F50","v":"3.3.1.2"},{"$f":"'3'!G50","v":0},{"$f":"'3'!H50","v":0},{"$f":"'3'!I50","v":"3.3.1.2.2"},{"$f":"'3'!J50","v":"3.3.1.2.2: Where appropriate, do agreements with entities providing outsourced services require them to conduct appropriate due diligence on their staff?\n"},{"$f":"'3'!K50","v":0},{"$f":"'3'!L50","v":0},{"$f":"'3'!M50","v":"Recommended"},{"$f":"'3'!N50","v":"Recommended"},{"$f":"'3'!O50","v":"BizOps"},{"$f":"'3'!P50","v":0},{"$f":"'3'!Q50","v":0},{"$f":"'3'!R50","v":0},{"$f":"'3'!S50","v":0},{"$f":"'3'!T50","v":0},{"$f":"'3'!U50","v":0},{"$f":"'3'!V50","v":0},{"$f":"'3'!W50","v":0},{"$f":"'3'!X50","v":0},{"$f":"'3'!Y50","v":0},{"$f":"'3'!Z50","v":0},{"$f":"'3'!AA50","v":0},{"$f":"'3'!AB50","v":0},{"$f":"'3'!AC50","v":0},{"$f":"'3'!AD50","v":0},{"$f":"'3'!AE50","v":0},{"$f":"'3'!AF50","v":0},{"$f":"'3'!AG50","v":0},{"$f":"'3'!AH50","v":0},{"$f":"'3'!AI50","v":0},{"$f":"'3'!AJ50","v":0},{"$f":"'3'!AK50","v":0},{"$f":"'3'!AL50","v":0},{"$f":"'3'!AM50","v":0},{"$f":"'3'!AN50","v":0},{"$f":"'3'!AO50","v":0},{"$f":"'3'!AP50","v":0},{"$f":"'3'!AQ50","v":0},{"$f":"'3'!AR50","v":0},{"$f":"'3'!AS50","v":0},{"$f":"'3'!AT50","v":0},{"$f":"SUMPRODUCT(IF($N181=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N181=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B51","v":"3"},{"$f":"'3'!C51","v":"3.3"},{"$f":"'3'!D51","v":"3.3.1"},{"$f":"'3'!E51","v":""},{"$f":"'3'!F51","v":"3.3.1.2"},{"$f":"'3'!G51","v":0},{"$f":"'3'!H51","v":0},{"$f":"'3'!I51","v":"3.3.1.2.3"},{"$f":"'3'!J51","v":"3.3.1.2.3: Where appropriate, do agreements with entities providing outsourced services address business continuity requirements?\n"},{"$f":"'3'!K51","v":0},{"$f":"'3'!L51","v":0},{"$f":"'3'!M51","v":"Recommended"},{"$f":"'3'!N51","v":"Recommended"},{"$f":"'3'!O51","v":"BizOps"},{"$f":"'3'!P51","v":0},{"$f":"'3'!Q51","v":0},{"$f":"'3'!R51","v":0},{"$f":"'3'!S51","v":0},{"$f":"'3'!T51","v":0},{"$f":"'3'!U51","v":0},{"$f":"'3'!V51","v":0},{"$f":"'3'!W51","v":0},{"$f":"'3'!X51","v":0},{"$f":"'3'!Y51","v":0},{"$f":"'3'!Z51","v":0},{"$f":"'3'!AA51","v":0},{"$f":"'3'!AB51","v":0},{"$f":"'3'!AC51","v":0},{"$f":"'3'!AD51","v":0},{"$f":"'3'!AE51","v":0},{"$f":"'3'!AF51","v":0},{"$f":"'3'!AG51","v":0},{"$f":"'3'!AH51","v":0},{"$f":"'3'!AI51","v":0},{"$f":"'3'!AJ51","v":0},{"$f":"'3'!AK51","v":0},{"$f":"'3'!AL51","v":0},{"$f":"'3'!AM51","v":0},{"$f":"'3'!AN51","v":0},{"$f":"'3'!AO51","v":0},{"$f":"'3'!AP51","v":0},{"$f":"'3'!AQ51","v":0},{"$f":"'3'!AR51","v":0},{"$f":"'3'!AS51","v":0},{"$f":"'3'!AT51","v":0},{"$f":"SUMPRODUCT(IF($N182=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N182=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B52","v":"3"},{"$f":"'3'!C52","v":"3.3"},{"$f":"'3'!D52","v":"3.3.1"},{"$f":"'3'!E52","v":""},{"$f":"'3'!F52","v":"3.3.1.2"},{"$f":"'3'!G52","v":0},{"$f":"'3'!H52","v":0},{"$f":"'3'!I52","v":"3.3.1.2.4"},{"$f":"'3'!J52","v":"3.3.1.2.4: Do agreements with entities providing outsourced services (i) stipulate that the provider must have access to all data related to the activities conducted by the entity providing outsourced services on behalf of the provider and (ii) clarify the ownership of such data?\n"},{"$f":"'3'!K52","v":0},{"$f":"'3'!L52","v":0},{"$f":"'3'!M52","v":"Recommended"},{"$f":"'3'!N52","v":"Recommended"},{"$f":"'3'!O52","v":"BizOps"},{"$f":"'3'!P52","v":0},{"$f":"'3'!Q52","v":0},{"$f":"'3'!R52","v":0},{"$f":"'3'!S52","v":0},{"$f":"'3'!T52","v":0},{"$f":"'3'!U52","v":0},{"$f":"'3'!V52","v":0},{"$f":"'3'!W52","v":0},{"$f":"'3'!X52","v":0},{"$f":"'3'!Y52","v":0},{"$f":"'3'!Z52","v":0},{"$f":"'3'!AA52","v":0},{"$f":"'3'!AB52","v":0},{"$f":"'3'!AC52","v":0},{"$f":"'3'!AD52","v":0},{"$f":"'3'!AE52","v":0},{"$f":"'3'!AF52","v":0},{"$f":"'3'!AG52","v":0},{"$f":"'3'!AH52","v":0},{"$f":"'3'!AI52","v":0},{"$f":"'3'!AJ52","v":0},{"$f":"'3'!AK52","v":0},{"$f":"'3'!AL52","v":0},{"$f":"'3'!AM52","v":0},{"$f":"'3'!AN52","v":0},{"$f":"'3'!AO52","v":0},{"$f":"'3'!AP52","v":0},{"$f":"'3'!AQ52","v":0},{"$f":"'3'!AR52","v":0},{"$f":"'3'!AS52","v":0},{"$f":"'3'!AT52","v":0},{"$f":"SUMPRODUCT(IF($N183=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N183=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B53","v":"3"},{"$f":"'3'!C53","v":"3.3"},{"$f":"'3'!D53","v":"3.3.2"},{"$f":"'3'!E53","v":"3.3.2: Providers shall assume responsibility for actions taken on their behalf by their agents (and any sub-agents) under the provider-agent contract.\n"},{"$f":"'3'!F53","v":"3.3.2.1"},{"$f":"'3'!G53","v":"3.3.2.1: AGENT AGREEMENTS AND PROVIDER RESPONSIBILITY\nProviders shall assume responsibility for actions taken by their agents when acting on behalf of the provider. This includes all cases where the agents had actual (express or implied) or apparent authority to take the action in question on behalf of the provider.\n\nThis should be made clear in the provider's agreement with agents and customers.\n"},{"$f":"'3'!H53","v":0},{"$f":"'3'!I53","v":"3.3.2.1.1"},{"$f":"'3'!J53","v":"3.3.2.1.1: Does the provider's agreement with agents and customers make it clear that the provider assumes responsibility for actions taken by their agents when acting on behalf of the provider?\n"},{"$f":"'3'!K53","v":"1) Sample agent contract\n- Check that there is a clause that states the provider assumes responsibility for actions taken by the agent on behalf of the provider\n\n2) Sample of customer contract\n- Check that there is a clause that states the provider assumes responsibility for actions taken by an agent on behalf of the provider."},{"$f":"'3'!L53","v":0},{"$f":"'3'!M53","v":"Recommended"},{"$f":"'3'!N53","v":"Recommended"},{"$f":"'3'!O53","v":"Agent"},{"$f":"'3'!P53","v":0},{"$f":"'3'!Q53","v":0},{"$f":"'3'!R53","v":0},{"$f":"'3'!S53","v":0},{"$f":"'3'!T53","v":0},{"$f":"'3'!U53","v":0},{"$f":"'3'!V53","v":0},{"$f":"'3'!W53","v":0},{"$f":"'3'!X53","v":0},{"$f":"'3'!Y53","v":0},{"$f":"'3'!Z53","v":0},{"$f":"'3'!AA53","v":0},{"$f":"'3'!AB53","v":0},{"$f":"'3'!AC53","v":0},{"$f":"'3'!AD53","v":0},{"$f":"'3'!AE53","v":0},{"$f":"'3'!AF53","v":0},{"$f":"'3'!AG53","v":0},{"$f":"'3'!AH53","v":0},{"$f":"'3'!AI53","v":0},{"$f":"'3'!AJ53","v":0},{"$f":"'3'!AK53","v":0},{"$f":"'3'!AL53","v":0},{"$f":"'3'!AM53","v":0},{"$f":"'3'!AN53","v":0},{"$f":"'3'!AO53","v":0},{"$f":"'3'!AP53","v":0},{"$f":"'3'!AQ53","v":0},{"$f":"'3'!AR53","v":0},{"$f":"'3'!AS53","v":0},{"$f":"'3'!AT53","v":0},{"$f":"SUMPRODUCT(IF($N184=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N184=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B54","v":"3"},{"$f":"'3'!C54","v":"3.3"},{"$f":"'3'!D54","v":"3.3.2"},{"$f":"'3'!E54","v":0},{"$f":"'3'!F54","v":"3.3.2.2"},{"$f":"'3'!G54","v":"3.3.2.2: AGENT AGREEMENTS AND PROVIDER RESPONSIBILITY\nProvider-agent contracts (see 3.3.1) should include provisions granting providers the right to seek restitution for damages incurred by the provider due to agent (or sub-agent) conduct.\n"},{"$f":"'3'!H54","v":0},{"$f":"'3'!I54","v":"3.3.2.2.1"},{"$f":"'3'!J54","v":"3.3.2.2.1: Does the provider-agent contract include provisions granting providers the right to seek restitution for damages incurred by the provider due to agent (or sub-agent) conduct?\n"},{"$f":"'3'!K54","v":0},{"$f":"'3'!L54","v":0},{"$f":"'3'!M54","v":"Recommended"},{"$f":"'3'!N54","v":"Recommended"},{"$f":"'3'!O54","v":"Agent"},{"$f":"'3'!P54","v":0},{"$f":"'3'!Q54","v":0},{"$f":"'3'!R54","v":0},{"$f":"'3'!S54","v":0},{"$f":"'3'!T54","v":0},{"$f":"'3'!U54","v":0},{"$f":"'3'!V54","v":0},{"$f":"'3'!W54","v":0},{"$f":"'3'!X54","v":0},{"$f":"'3'!Y54","v":0},{"$f":"'3'!Z54","v":0},{"$f":"'3'!AA54","v":0},{"$f":"'3'!AB54","v":0},{"$f":"'3'!AC54","v":0},{"$f":"'3'!AD54","v":0},{"$f":"'3'!AE54","v":0},{"$f":"'3'!AF54","v":0},{"$f":"'3'!AG54","v":0},{"$f":"'3'!AH54","v":0},{"$f":"'3'!AI54","v":0},{"$f":"'3'!AJ54","v":0},{"$f":"'3'!AK54","v":0},{"$f":"'3'!AL54","v":0},{"$f":"'3'!AM54","v":0},{"$f":"'3'!AN54","v":0},{"$f":"'3'!AO54","v":0},{"$f":"'3'!AP54","v":0},{"$f":"'3'!AQ54","v":0},{"$f":"'3'!AR54","v":0},{"$f":"'3'!AS54","v":0},{"$f":"'3'!AT54","v":0},{"$f":"SUMPRODUCT(IF($N185=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N185=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B56","v":"3"},{"$f":"'3'!C56","v":"3.4"},{"$f":"'3'!D56","v":"3.4.1"},{"$f":"'3'!E56","v":"3.4.1: Providers shall develop policies and processes for ongoing management and oversight of staff, agents and entities providing outsourced services"},{"$f":"'3'!F56","v":"3.4.1.1"},{"$f":"'3'!G56","v":"3.4.1.1: STAFF MANAGEMENT POLICY\nProviders should implement a human resources policy for their mobile money staff. The policy should determine how the provider will ensure it has the human resources needed to implement and maintain the mobile money service.\n\nA human resources management process should be implemented to do the following:\n- Determine the necessary competence for staff for each role within the mobile money organization.\n- Provide training or take other actions (e.g. recruitment) to achieve the necessary competence in each role.\n- Provide training on other key processes, particularly those relating to AML/CFT, anti-fraud, regulatory compliance, data privacy, security, and business continuity.\n- Ensure that staff are aware of their roles and responsibilities, and how their role contributes to the mobile money service.\n- Ensure changes of responsibility, including initiation or termination of a responsibility, are managed appropriately, including through suitable training and monitoring.\n- Maintain appropriate records of staff training, skills and experience.\n"},{"$f":"'3'!H56","v":"ISO 20000-1:2018 Sec. 5.2,\nGSMA RMT"},{"$f":"'3'!I56","v":"3.4.1.1.1"},{"$f":"'3'!J56","v":"3.4.1.1.1: Has a human resources policy been implemented that determines how the provider will ensure it has appropriate human resources needed to implement and maintain the mobile money service, and is the policy kept up to date?\n"},{"$f":"'3'!K56","v":"1) Human resources policy (or equivalent documentation)\n- Check provider has appropriate human resources to operate the mobile money service.\n- Check the revision date on the policy/equivalent document is within the last 24 months."},{"$f":"'3'!L56","v":0},{"$f":"'3'!M56","v":"Standard Required"},{"$f":"'3'!N56","v":"Required"},{"$f":"'3'!O56","v":"HR"},{"$f":"'3'!P56","v":0},{"$f":"'3'!Q56","v":0},{"$f":"'3'!R56","v":0},{"$f":"'3'!S56","v":0},{"$f":"'3'!T56","v":0},{"$f":"'3'!U56","v":0},{"$f":"'3'!V56","v":0},{"$f":"'3'!W56","v":0},{"$f":"'3'!X56","v":0},{"$f":"'3'!Y56","v":0},{"$f":"'3'!Z56","v":0},{"$f":"'3'!AA56","v":0},{"$f":"'3'!AB56","v":0},{"$f":"'3'!AC56","v":0},{"$f":"'3'!AD56","v":0},{"$f":"'3'!AE56","v":0},{"$f":"'3'!AF56","v":0},{"$f":"'3'!AG56","v":0},{"$f":"'3'!AH56","v":0},{"$f":"'3'!AI56","v":0},{"$f":"'3'!AJ56","v":0},{"$f":"'3'!AK56","v":0},{"$f":"'3'!AL56","v":0},{"$f":"'3'!AM56","v":0},{"$f":"'3'!AN56","v":0},{"$f":"'3'!AO56","v":0},{"$f":"'3'!AP56","v":0},{"$f":"'3'!AQ56","v":0},{"$f":"'3'!AR56","v":0},{"$f":"'3'!AS56","v":0},{"$f":"'3'!AT56","v":0},{"$f":"SUMPRODUCT(IF($N186=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N186=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B57","v":"3"},{"$f":"'3'!C57","v":"3.4"},{"$f":"'3'!D57","v":"3.4.1"},{"$f":"'3'!E57","v":0},{"$f":"'3'!F57","v":"3.4.1.1"},{"$f":"'3'!G57","v":0},{"$f":"'3'!H57","v":0},{"$f":"'3'!I57","v":"3.4.1.1.2"},{"$f":"'3'!J57","v":"3.4.1.1.2: Are the competencies required for each role being identified, and are competency gaps being filled through training or recruitment?\n"},{"$f":"'3'!K57","v":0},{"$f":"'3'!L57","v":0},{"$f":"'3'!M57","v":"Recommended"},{"$f":"'3'!N57","v":"Recommended"},{"$f":"'3'!O57","v":"HR"},{"$f":"'3'!P57","v":0},{"$f":"'3'!Q57","v":0},{"$f":"'3'!R57","v":0},{"$f":"'3'!S57","v":0},{"$f":"'3'!T57","v":0},{"$f":"'3'!U57","v":0},{"$f":"'3'!V57","v":0},{"$f":"'3'!W57","v":0},{"$f":"'3'!X57","v":0},{"$f":"'3'!Y57","v":0},{"$f":"'3'!Z57","v":0},{"$f":"'3'!AA57","v":0},{"$f":"'3'!AB57","v":0},{"$f":"'3'!AC57","v":0},{"$f":"'3'!AD57","v":0},{"$f":"'3'!AE57","v":0},{"$f":"'3'!AF57","v":0},{"$f":"'3'!AG57","v":0},{"$f":"'3'!AH57","v":0},{"$f":"'3'!AI57","v":0},{"$f":"'3'!AJ57","v":0},{"$f":"'3'!AK57","v":0},{"$f":"'3'!AL57","v":0},{"$f":"'3'!AM57","v":0},{"$f":"'3'!AN57","v":0},{"$f":"'3'!AO57","v":0},{"$f":"'3'!AP57","v":0},{"$f":"'3'!AQ57","v":0},{"$f":"'3'!AR57","v":0},{"$f":"'3'!AS57","v":0},{"$f":"'3'!AT57","v":0},{"$f":"SUMPRODUCT(IF($N187=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N187=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B58","v":"3"},{"$f":"'3'!C58","v":"3.4"},{"$f":"'3'!D58","v":"3.4.1"},{"$f":"'3'!E58","v":""},{"$f":"'3'!F58","v":"3.4.1.2"},{"$f":"'3'!G58","v":"3.4.1.2: STAFF MANAGEMENT PROCESS\nA process should be defined for dealing with unsatisfactory performance from staff. The process should determine how to respond to unsatisfactory performance or breaches of process / policy. The process should include the following:\n- Assisting staff to improve through coaching, training or other mechanisms;\n- Disciplinary procedure to address continued poor performance or more substantial issues;\n- Termination for serious failings - including specification of the circumstances under which staff can be terminated and the procedures to be followed;\n- Procedure for managing disputes with staff."},{"$f":"'3'!H58","v":"ECB RSMP, ISO 27015:2012 Sec. 7.4"},{"$f":"'3'!I58","v":"3.4.1.2.1"},{"$f":"'3'!J58","v":"3.4.1.2.1: Has a process been defined for dealing with unsatisfactory performance from staff and breaches of process / policy?\n"},{"$f":"'3'!K58","v":0},{"$f":"'3'!L58","v":0},{"$f":"'3'!M58","v":"Recommended"},{"$f":"'3'!N58","v":"Recommended"},{"$f":"'3'!O58","v":"HR"},{"$f":"'3'!P58","v":0},{"$f":"'3'!Q58","v":0},{"$f":"'3'!R58","v":0},{"$f":"'3'!S58","v":0},{"$f":"'3'!T58","v":0},{"$f":"'3'!U58","v":0},{"$f":"'3'!V58","v":0},{"$f":"'3'!W58","v":0},{"$f":"'3'!X58","v":0},{"$f":"'3'!Y58","v":0},{"$f":"'3'!Z58","v":0},{"$f":"'3'!AA58","v":0},{"$f":"'3'!AB58","v":0},{"$f":"'3'!AC58","v":0},{"$f":"'3'!AD58","v":0},{"$f":"'3'!AE58","v":0},{"$f":"'3'!AF58","v":0},{"$f":"'3'!AG58","v":0},{"$f":"'3'!AH58","v":0},{"$f":"'3'!AI58","v":0},{"$f":"'3'!AJ58","v":0},{"$f":"'3'!AK58","v":0},{"$f":"'3'!AL58","v":0},{"$f":"'3'!AM58","v":0},{"$f":"'3'!AN58","v":0},{"$f":"'3'!AO58","v":0},{"$f":"'3'!AP58","v":0},{"$f":"'3'!AQ58","v":0},{"$f":"'3'!AR58","v":0},{"$f":"'3'!AS58","v":0},{"$f":"'3'!AT58","v":0},{"$f":"SUMPRODUCT(IF($N188=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N188=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B59","v":"3"},{"$f":"'3'!C59","v":"3.4"},{"$f":"'3'!D59","v":"3.4.1"},{"$f":"'3'!E59","v":""},{"$f":"'3'!F59","v":"3.4.1.3"},{"$f":"'3'!G59","v":"3.4.1.3: AGENT MANAGEMENT POLICY\nProviders should set a policy for managing their agent network, including:\n- Definition of an agent management function within the provider;\n- The level of direct contracting with individual agents that the provider can support and the proportion of agents that should be engaged via master agents or aggregators;\n- Selection criteria for appropriate agents / master agents / agent aggregators;\n- Acceptable level of agent management concentration risk associated with agents (i.e. number/percentage of agents managed by a single master agent / agent aggregator)."},{"$f":"'3'!H59","v":0},{"$f":"'3'!I59","v":"3.4.1.3.1"},{"$f":"'3'!J59","v":"3.4.1.3.1: Does the agent management policy define the level of direct contracting with individual agents that the provider can support and the proportion of agents that should be engaged via master agents or aggregators?\n"},{"$f":"'3'!K59","v":0},{"$f":"'3'!L59","v":0},{"$f":"'3'!M59","v":"Recommended"},{"$f":"'3'!N59","v":"Recommended"},{"$f":"'3'!O59","v":"Agent"},{"$f":"'3'!P59","v":0},{"$f":"'3'!Q59","v":0},{"$f":"'3'!R59","v":0},{"$f":"'3'!S59","v":0},{"$f":"'3'!T59","v":0},{"$f":"'3'!U59","v":0},{"$f":"'3'!V59","v":0},{"$f":"'3'!W59","v":0},{"$f":"'3'!X59","v":0},{"$f":"'3'!Y59","v":0},{"$f":"'3'!Z59","v":0},{"$f":"'3'!AA59","v":0},{"$f":"'3'!AB59","v":0},{"$f":"'3'!AC59","v":0},{"$f":"'3'!AD59","v":0},{"$f":"'3'!AE59","v":0},{"$f":"'3'!AF59","v":0},{"$f":"'3'!AG59","v":0},{"$f":"'3'!AH59","v":0},{"$f":"'3'!AI59","v":0},{"$f":"'3'!AJ59","v":0},{"$f":"'3'!AK59","v":0},{"$f":"'3'!AL59","v":0},{"$f":"'3'!AM59","v":0},{"$f":"'3'!AN59","v":0},{"$f":"'3'!AO59","v":0},{"$f":"'3'!AP59","v":0},{"$f":"'3'!AQ59","v":0},{"$f":"'3'!AR59","v":0},{"$f":"'3'!AS59","v":0},{"$f":"'3'!AT59","v":0},{"$f":"SUMPRODUCT(IF($N189=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N189=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B60","v":"3"},{"$f":"'3'!C60","v":"3.4"},{"$f":"'3'!D60","v":"3.4.1"},{"$f":"'3'!E60","v":""},{"$f":"'3'!F60","v":"3.4.1.3"},{"$f":"'3'!G60","v":0},{"$f":"'3'!H60","v":0},{"$f":"'3'!I60","v":"3.4.1.3.2"},{"$f":"'3'!J60","v":"3.4.1.3.2: Does the agent management policy define selection criteria for appropriate agents / master agents / agent aggregators?\n"},{"$f":"'3'!K60","v":0},{"$f":"'3'!L60","v":0},{"$f":"'3'!M60","v":"Recommended"},{"$f":"'3'!N60","v":"Recommended"},{"$f":"'3'!O60","v":"Agent"},{"$f":"'3'!P60","v":0},{"$f":"'3'!Q60","v":0},{"$f":"'3'!R60","v":0},{"$f":"'3'!S60","v":0},{"$f":"'3'!T60","v":0},{"$f":"'3'!U60","v":0},{"$f":"'3'!V60","v":0},{"$f":"'3'!W60","v":0},{"$f":"'3'!X60","v":0},{"$f":"'3'!Y60","v":0},{"$f":"'3'!Z60","v":0},{"$f":"'3'!AA60","v":0},{"$f":"'3'!AB60","v":0},{"$f":"'3'!AC60","v":0},{"$f":"'3'!AD60","v":0},{"$f":"'3'!AE60","v":0},{"$f":"'3'!AF60","v":0},{"$f":"'3'!AG60","v":0},{"$f":"'3'!AH60","v":0},{"$f":"'3'!AI60","v":0},{"$f":"'3'!AJ60","v":0},{"$f":"'3'!AK60","v":0},{"$f":"'3'!AL60","v":0},{"$f":"'3'!AM60","v":0},{"$f":"'3'!AN60","v":0},{"$f":"'3'!AO60","v":0},{"$f":"'3'!AP60","v":0},{"$f":"'3'!AQ60","v":0},{"$f":"'3'!AR60","v":0},{"$f":"'3'!AS60","v":0},{"$f":"'3'!AT60","v":0},{"$f":"SUMPRODUCT(IF($N190=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N190=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B61","v":"3"},{"$f":"'3'!C61","v":"3.4"},{"$f":"'3'!D61","v":"3.4.1"},{"$f":"'3'!E61","v":""},{"$f":"'3'!F61","v":"3.4.1.3"},{"$f":"'3'!G61","v":0},{"$f":"'3'!H61","v":0},{"$f":"'3'!I61","v":"3.4.1.3.3"},{"$f":"'3'!J61","v":"3.4.1.3.3: Does the agent management policy define an acceptable level of agent management concentration risk (i.e. number/percentage of agents managed by a single master agent / agent aggregator)?\n"},{"$f":"'3'!K61","v":0},{"$f":"'3'!L61","v":0},{"$f":"'3'!M61","v":"Recommended"},{"$f":"'3'!N61","v":"Recommended"},{"$f":"'3'!O61","v":"Agent"},{"$f":"'3'!P61","v":0},{"$f":"'3'!Q61","v":0},{"$f":"'3'!R61","v":0},{"$f":"'3'!S61","v":0},{"$f":"'3'!T61","v":0},{"$f":"'3'!U61","v":0},{"$f":"'3'!V61","v":0},{"$f":"'3'!W61","v":0},{"$f":"'3'!X61","v":0},{"$f":"'3'!Y61","v":0},{"$f":"'3'!Z61","v":0},{"$f":"'3'!AA61","v":0},{"$f":"'3'!AB61","v":0},{"$f":"'3'!AC61","v":0},{"$f":"'3'!AD61","v":0},{"$f":"'3'!AE61","v":0},{"$f":"'3'!AF61","v":0},{"$f":"'3'!AG61","v":0},{"$f":"'3'!AH61","v":0},{"$f":"'3'!AI61","v":0},{"$f":"'3'!AJ61","v":0},{"$f":"'3'!AK61","v":0},{"$f":"'3'!AL61","v":0},{"$f":"'3'!AM61","v":0},{"$f":"'3'!AN61","v":0},{"$f":"'3'!AO61","v":0},{"$f":"'3'!AP61","v":0},{"$f":"'3'!AQ61","v":0},{"$f":"'3'!AR61","v":0},{"$f":"'3'!AS61","v":0},{"$f":"'3'!AT61","v":0},{"$f":"SUMPRODUCT(IF($N191=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N191=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B62","v":"3"},{"$f":"'3'!C62","v":"3.4"},{"$f":"'3'!D62","v":"3.4.1"},{"$f":"'3'!E62","v":""},{"$f":"'3'!F62","v":"3.4.1.4"},{"$f":"'3'!G62","v":"3.4.1.4: AGENT MANAGEMENT PROCESS\nThe roles and responsibilities of the provider's agent management function should be clearly defined to carry out management of agents. Business processes for agent management should be specified, and monitored to ensure that they are working efficiently.\n\nProviders should ensure that there are clear lines of communication for information exchange with master agents and agent aggregators, so that relevant information is shared promptly by both parties.  Routes for escalation of issues should be made available to agents (e.g. through regular contact with the agent manager)."},{"$f":"'3'!H62","v":0},{"$f":"'3'!I62","v":"3.4.1.4.1"},{"$f":"'3'!J62","v":"3.4.1.4.1: Have roles and responsibilities been defined to carry out management of agents?\n"},{"$f":"'3'!K62","v":"1) Agent management process or RACI or sample agent contract or similar document\n- Check that roles and responsibilities for agent management have been defined."},{"$f":"'3'!L62","v":0},{"$f":"'3'!M62","v":"Standard Required"},{"$f":"'3'!N62","v":"Required"},{"$f":"'3'!O62","v":"Agent"},{"$f":"'3'!P62","v":0},{"$f":"'3'!Q62","v":0},{"$f":"'3'!R62","v":0},{"$f":"'3'!S62","v":0},{"$f":"'3'!T62","v":0},{"$f":"'3'!U62","v":0},{"$f":"'3'!V62","v":0},{"$f":"'3'!W62","v":0},{"$f":"'3'!X62","v":0},{"$f":"'3'!Y62","v":0},{"$f":"'3'!Z62","v":0},{"$f":"'3'!AA62","v":0},{"$f":"'3'!AB62","v":0},{"$f":"'3'!AC62","v":0},{"$f":"'3'!AD62","v":0},{"$f":"'3'!AE62","v":0},{"$f":"'3'!AF62","v":0},{"$f":"'3'!AG62","v":0},{"$f":"'3'!AH62","v":0},{"$f":"'3'!AI62","v":0},{"$f":"'3'!AJ62","v":0},{"$f":"'3'!AK62","v":0},{"$f":"'3'!AL62","v":0},{"$f":"'3'!AM62","v":0},{"$f":"'3'!AN62","v":0},{"$f":"'3'!AO62","v":0},{"$f":"'3'!AP62","v":0},{"$f":"'3'!AQ62","v":0},{"$f":"'3'!AR62","v":0},{"$f":"'3'!AS62","v":0},{"$f":"'3'!AT62","v":0},{"$f":"SUMPRODUCT(IF($N192=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N192=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B63","v":"3"},{"$f":"'3'!C63","v":"3.4"},{"$f":"'3'!D63","v":"3.4.1"},{"$f":"'3'!E63","v":""},{"$f":"'3'!F63","v":"3.4.1.4"},{"$f":"'3'!G63","v":0},{"$f":"'3'!H63","v":0},{"$f":"'3'!I63","v":"3.4.1.4.2"},{"$f":"'3'!J63","v":"3.4.1.4.2: Are agents provided with a route to escalate issues?\n"},{"$f":"'3'!K63","v":"1) Agent management process or RACI or sample agent contract or similar document\n- Check there is a process for agents to escalate issues (e.g. through regular contact with the agent manager).\n"},{"$f":"'3'!L63","v":0},{"$f":"'3'!M63","v":"Standard Required"},{"$f":"'3'!N63","v":"Required"},{"$f":"'3'!O63","v":"Agent"},{"$f":"'3'!P63","v":0},{"$f":"'3'!Q63","v":0},{"$f":"'3'!R63","v":0},{"$f":"'3'!S63","v":0},{"$f":"'3'!T63","v":0},{"$f":"'3'!U63","v":0},{"$f":"'3'!V63","v":0},{"$f":"'3'!W63","v":0},{"$f":"'3'!X63","v":0},{"$f":"'3'!Y63","v":0},{"$f":"'3'!Z63","v":0},{"$f":"'3'!AA63","v":0},{"$f":"'3'!AB63","v":0},{"$f":"'3'!AC63","v":0},{"$f":"'3'!AD63","v":0},{"$f":"'3'!AE63","v":0},{"$f":"'3'!AF63","v":0},{"$f":"'3'!AG63","v":0},{"$f":"'3'!AH63","v":0},{"$f":"'3'!AI63","v":0},{"$f":"'3'!AJ63","v":0},{"$f":"'3'!AK63","v":0},{"$f":"'3'!AL63","v":0},{"$f":"'3'!AM63","v":0},{"$f":"'3'!AN63","v":0},{"$f":"'3'!AO63","v":0},{"$f":"'3'!AP63","v":0},{"$f":"'3'!AQ63","v":0},{"$f":"'3'!AR63","v":0},{"$f":"'3'!AS63","v":0},{"$f":"'3'!AT63","v":0},{"$f":"SUMPRODUCT(IF($N193=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N193=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B64","v":"3"},{"$f":"'3'!C64","v":"3.4"},{"$f":"'3'!D64","v":"3.4.1"},{"$f":"'3'!E64","v":""},{"$f":"'3'!F64","v":"3.4.1.5"},{"$f":"'3'!G64","v":"3.4.1.5: AGENT MONITORING\nProcesses should be implemented to monitor agents and to notify agents (and their master agents / agent aggregators) of unsatisfactory performance. Relevant information should also be provided to internal management. \nProviders should use a combination of on-site visits (e.g. mystery shoppers) and off-site monitoring (e.g. transaction / location monitoring). Monitoring should address at least the following:\n- Ensuring personal details (KYC) are correctly obtained and verified when registering customers (see 2.6.2 - AML Compliance); \n- Ensuring identity checks are done correctly for cash-in/out;\n- Ensuring processes are followed;\n- Following-up customer complaints.\n\nNote: Contractual agreements should specify that providers may monitor and audit agent to ensure that the provider’s obligations to customers and regulators are being met. Contractual agreements should also specify that providers have access to all relevant records and other information held by agents (see 3.3.1 - Contractual agreements). "},{"$f":"'3'!H64","v":"GSMA RMT\n(AG-03, \nAG-04,\nAG-05)"},{"$f":"'3'!I64","v":"3.4.1.5.1"},{"$f":"'3'!J64","v":"3.4.1.5.1: Have processes been implemented to monitor agents and to notify agents (and their master agents / agent aggregators) of unsatisfactory performance?\n"},{"$f":"'3'!K64","v":"1) Agent management process or RACI or sample agent contract or similar document\n- Check there is a process to monitor agents\n- Check there is a process for agents, master agents and agent aggregators to be informed of unsatisfactory performance\n"},{"$f":"'3'!L64","v":0},{"$f":"'3'!M64","v":"Urgent Required"},{"$f":"'3'!N64","v":"Required"},{"$f":"'3'!O64","v":"Agent"},{"$f":"'3'!P64","v":0},{"$f":"'3'!Q64","v":0},{"$f":"'3'!R64","v":0},{"$f":"'3'!S64","v":0},{"$f":"'3'!T64","v":0},{"$f":"'3'!U64","v":0},{"$f":"'3'!V64","v":0},{"$f":"'3'!W64","v":0},{"$f":"'3'!X64","v":0},{"$f":"'3'!Y64","v":0},{"$f":"'3'!Z64","v":0},{"$f":"'3'!AA64","v":0},{"$f":"'3'!AB64","v":0},{"$f":"'3'!AC64","v":0},{"$f":"'3'!AD64","v":0},{"$f":"'3'!AE64","v":0},{"$f":"'3'!AF64","v":0},{"$f":"'3'!AG64","v":0},{"$f":"'3'!AH64","v":0},{"$f":"'3'!AI64","v":0},{"$f":"'3'!AJ64","v":0},{"$f":"'3'!AK64","v":0},{"$f":"'3'!AL64","v":0},{"$f":"'3'!AM64","v":0},{"$f":"'3'!AN64","v":0},{"$f":"'3'!AO64","v":0},{"$f":"'3'!AP64","v":0},{"$f":"'3'!AQ64","v":0},{"$f":"'3'!AR64","v":0},{"$f":"'3'!AS64","v":0},{"$f":"'3'!AT64","v":0},{"$f":"SUMPRODUCT(IF($N194=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N194=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B65","v":"3"},{"$f":"'3'!C65","v":"3.4"},{"$f":"'3'!D65","v":"3.4.1"},{"$f":"'3'!E65","v":""},{"$f":"'3'!F65","v":"3.4.1.5"},{"$f":"'3'!G65","v":0},{"$f":"'3'!H65","v":0},{"$f":"'3'!I65","v":"3.4.1.5.2"},{"$f":"'3'!J65","v":"3.4.1.5.2: Are both on-site visits (e.g. mystery shoppers) and off-site monitoring (e.g. transaction/ location monitoring) used to monitor/ audit agents?\n"},{"$f":"'3'!K65","v":"1) Agent management process or RACI or sample agent contract or similar document\n- Check the process for monitoring agents includes:\n        a) onsite visits (e.g. mystery shopping)\n        b) off-site monitoring (e.g. transaction / complaints monitoring)\n\n2) Agent monitoring records\n- Check that the process is active by reviewing records or schedules of site-visits\n"},{"$f":"'3'!L65","v":0},{"$f":"'3'!M65","v":"Urgent Required"},{"$f":"'3'!N65","v":"Required"},{"$f":"'3'!O65","v":"Agent"},{"$f":"'3'!P65","v":0},{"$f":"'3'!Q65","v":0},{"$f":"'3'!R65","v":0},{"$f":"'3'!S65","v":0},{"$f":"'3'!T65","v":0},{"$f":"'3'!U65","v":0},{"$f":"'3'!V65","v":0},{"$f":"'3'!W65","v":0},{"$f":"'3'!X65","v":0},{"$f":"'3'!Y65","v":0},{"$f":"'3'!Z65","v":0},{"$f":"'3'!AA65","v":0},{"$f":"'3'!AB65","v":0},{"$f":"'3'!AC65","v":0},{"$f":"'3'!AD65","v":0},{"$f":"'3'!AE65","v":0},{"$f":"'3'!AF65","v":0},{"$f":"'3'!AG65","v":0},{"$f":"'3'!AH65","v":0},{"$f":"'3'!AI65","v":0},{"$f":"'3'!AJ65","v":0},{"$f":"'3'!AK65","v":0},{"$f":"'3'!AL65","v":0},{"$f":"'3'!AM65","v":0},{"$f":"'3'!AN65","v":0},{"$f":"'3'!AO65","v":0},{"$f":"'3'!AP65","v":0},{"$f":"'3'!AQ65","v":0},{"$f":"'3'!AR65","v":0},{"$f":"'3'!AS65","v":0},{"$f":"'3'!AT65","v":0},{"$f":"SUMPRODUCT(IF($N195=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N195=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B66","v":"3"},{"$f":"'3'!C66","v":"3.4"},{"$f":"'3'!D66","v":"3.4.1"},{"$f":"'3'!E66","v":""},{"$f":"'3'!F66","v":"3.4.1.5"},{"$f":"'3'!G66","v":0},{"$f":"'3'!H66","v":0},{"$f":"'3'!I66","v":"3.4.1.5.3"},{"$f":"'3'!J66","v":"3.4.1.5.3: Are customer complaints about agents tracked and action taken on regularly-offending agents?\n"},{"$f":"'3'!K66","v":"1) Sample records of complaints about agents\n- Look at a sample of customer complaints about agents to ensure the process is being followed, complaints are being recored and actions taken.\n"},{"$f":"'3'!L66","v":0},{"$f":"'3'!M66","v":"Urgent Required"},{"$f":"'3'!N66","v":"Required"},{"$f":"'3'!O66","v":"Agent"},{"$f":"'3'!P66","v":0},{"$f":"'3'!Q66","v":0},{"$f":"'3'!R66","v":0},{"$f":"'3'!S66","v":0},{"$f":"'3'!T66","v":0},{"$f":"'3'!U66","v":0},{"$f":"'3'!V66","v":0},{"$f":"'3'!W66","v":0},{"$f":"'3'!X66","v":0},{"$f":"'3'!Y66","v":0},{"$f":"'3'!Z66","v":0},{"$f":"'3'!AA66","v":0},{"$f":"'3'!AB66","v":0},{"$f":"'3'!AC66","v":0},{"$f":"'3'!AD66","v":0},{"$f":"'3'!AE66","v":0},{"$f":"'3'!AF66","v":0},{"$f":"'3'!AG66","v":0},{"$f":"'3'!AH66","v":0},{"$f":"'3'!AI66","v":0},{"$f":"'3'!AJ66","v":0},{"$f":"'3'!AK66","v":0},{"$f":"'3'!AL66","v":0},{"$f":"'3'!AM66","v":0},{"$f":"'3'!AN66","v":0},{"$f":"'3'!AO66","v":0},{"$f":"'3'!AP66","v":0},{"$f":"'3'!AQ66","v":0},{"$f":"'3'!AR66","v":0},{"$f":"'3'!AS66","v":0},{"$f":"'3'!AT66","v":0},{"$f":"SUMPRODUCT(IF($N196=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N196=CategoryRecommended,1,0))","v":0},{"$f":"_xlfn.IFNA(MATCH($Q196,ComplianceYes,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q196,CompliancePartial,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q196,ComplianceNo,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q196,ComplianceNA,0),0)","v":0},{"$f":"$AU196*AW196","v":0},{"$f":"$AU196*AX196","v":0},{"$f":"$AU196*AY196","v":0},{"$f":"$AU196*AZ196","v":0},{"$f":"$AV196*AW196","v":0},{"$f":"$AV196*AX196","v":0},{"$f":"$AV196*AY196","v":0},{"$f":"$AV196*AZ196","v":0},{"$f":"_xlfn.IFNA(MATCH($AF196,ComplianceYes,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF196,CompliancePartial,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF196,ComplianceNo,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF196,ComplianceNA,0),0)","v":0},0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B67","v":"3"},{"$f":"'3'!C67","v":"3.4"},{"$f":"'3'!D67","v":"3.4.1"},{"$f":"'3'!E67","v":""},{"$f":"'3'!F67","v":"3.4.1.6"},{"$f":"'3'!G67","v":"3.4.1.6: AGENT SANCTIONS AND TERMINATION\nA sanctions and termination process should be defined and agreed with each agent / master agent / agent aggregator (as applicable) for escalation and resolution of unsatisfactory performance or breaches of process / policy. The process should clearly describe the circumstances under which agents can be terminated and the procedures to be followed.\n\nThe process should include escalating levels of sanctions up to termination of an individual agent / master agent / agent aggregator. Examples of sanctions that could be considered include:\n\n- 3 strikes and out for minor offences;\n- Financial sanctions;\n- Tiered penalties – increasing severity upon repetition of offence. e.g. suspend agent for 1 day / 1 week / 1 month;\n- Termination of mobile money status (which will cut off this part of their revenue stream);\n- Termination of mobile reseller status, if applicable (which will cut off further revenue stream).\n\nNote: Agents should be reported to the police if criminal activity is discovered."},{"$f":"'3'!H67","v":0},{"$f":"'3'!I67","v":"3.4.1.6.1"},{"$f":"'3'!J67","v":"3.4.1.6.1: Has a sanctions and termination process been agreed with each agent / master agent / agent aggregator (as applicable) for escalation and resolution of unsatisfactory performance or breaches of process / policy?\n"},{"$f":"'3'!K67","v":"1) Agent management process or RACI or sample agent contract or record of agent sanctions or similar document\n- Check that the there is a process to sanction and/or terminate agents / master agents / agent aggregators (as applicable) of unsatisfactory performance or breaches of process / policy. \n- Check that the process includes escalation and resolution measures."},{"$f":"'3'!L67","v":0},{"$f":"'3'!M67","v":"Standard Required"},{"$f":"'3'!N67","v":"Required"},{"$f":"'3'!O67","v":"Agent"},{"$f":"'3'!P67","v":0},{"$f":"'3'!Q67","v":0},{"$f":"'3'!R67","v":0},{"$f":"'3'!S67","v":0},{"$f":"'3'!T67","v":0},{"$f":"'3'!U67","v":0},{"$f":"'3'!V67","v":0},{"$f":"'3'!W67","v":0},{"$f":"'3'!X67","v":0},{"$f":"'3'!Y67","v":0},{"$f":"'3'!Z67","v":0},{"$f":"'3'!AA67","v":0},{"$f":"'3'!AB67","v":0},{"$f":"'3'!AC67","v":0},{"$f":"'3'!AD67","v":0},{"$f":"'3'!AE67","v":0},{"$f":"'3'!AF67","v":0},{"$f":"'3'!AG67","v":0},{"$f":"'3'!AH67","v":0},{"$f":"'3'!AI67","v":0},{"$f":"'3'!AJ67","v":0},{"$f":"'3'!AK67","v":0},{"$f":"'3'!AL67","v":0},{"$f":"'3'!AM67","v":0},{"$f":"'3'!AN67","v":0},{"$f":"'3'!AO67","v":0},{"$f":"'3'!AP67","v":0},{"$f":"'3'!AQ67","v":0},{"$f":"'3'!AR67","v":0},{"$f":"'3'!AS67","v":0},{"$f":"'3'!AT67","v":0},{"$f":"SUMPRODUCT(IF($N197=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N197=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,{"$f":"$AU197*BI197","v":0},{"$f":"$AU197*BJ197","v":0},{"$f":"$AU197*BK197","v":0},{"$f":"$AU197*BL197","v":0},{"$f":"$AV197*BI197","v":0},{"$f":"$AV197*BJ197","v":0},{"$f":"$AV197*BK197","v":0},{"$f":"$AV197*BL197","v":0}]
[null,{"$f":"'3'!B68","v":"3"},{"$f":"'3'!C68","v":"3.4"},{"$f":"'3'!D68","v":"3.4.1"},{"$f":"'3'!E68","v":""},{"$f":"'3'!F68","v":"3.4.1.6"},{"$f":"'3'!G68","v":0},{"$f":"'3'!H68","v":0},{"$f":"'3'!I68","v":"3.4.1.6.2"},{"$f":"'3'!J68","v":"3.4.1.6.2: Does the sanctions process include escalating levels of sanctions, such as 3 strikes and out / financial sanctions / tiered penalties / termination of mobile money status / termination of mobile reseller status?\n"},{"$f":"'3'!K68","v":0},{"$f":"'3'!L68","v":0},{"$f":"'3'!M68","v":"Recommended"},{"$f":"'3'!N68","v":"Recommended"},{"$f":"'3'!O68","v":"Agent"},{"$f":"'3'!P68","v":0},{"$f":"'3'!Q68","v":0},{"$f":"'3'!R68","v":0},{"$f":"'3'!S68","v":0},{"$f":"'3'!T68","v":0},{"$f":"'3'!U68","v":0},{"$f":"'3'!V68","v":0},{"$f":"'3'!W68","v":0},{"$f":"'3'!X68","v":0},{"$f":"'3'!Y68","v":0},{"$f":"'3'!Z68","v":0},{"$f":"'3'!AA68","v":0},{"$f":"'3'!AB68","v":0},{"$f":"'3'!AC68","v":0},{"$f":"'3'!AD68","v":0},{"$f":"'3'!AE68","v":0},{"$f":"'3'!AF68","v":0},{"$f":"'3'!AG68","v":0},{"$f":"'3'!AH68","v":0},{"$f":"'3'!AI68","v":0},{"$f":"'3'!AJ68","v":0},{"$f":"'3'!AK68","v":0},{"$f":"'3'!AL68","v":0},{"$f":"'3'!AM68","v":0},{"$f":"'3'!AN68","v":0},{"$f":"'3'!AO68","v":0},{"$f":"'3'!AP68","v":0},{"$f":"'3'!AQ68","v":0},{"$f":"'3'!AR68","v":0},{"$f":"'3'!AS68","v":0},{"$f":"'3'!AT68","v":0},{"$f":"SUMPRODUCT(IF($N198=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N198=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B69","v":"3"},{"$f":"'3'!C69","v":"3.4"},{"$f":"'3'!D69","v":"3.4.1"},{"$f":"'3'!E69","v":""},{"$f":"'3'!F69","v":"3.4.1.6"},{"$f":"'3'!G69","v":0},{"$f":"'3'!H69","v":0},{"$f":"'3'!I69","v":"3.4.1.6.3"},{"$f":"'3'!J69","v":"3.4.1.6.3: Does the sanctions process clearly describe the circumstances under which agents can be terminated and the procedures to be followed?\n"},{"$f":"'3'!K69","v":0},{"$f":"'3'!L69","v":0},{"$f":"'3'!M69","v":"Recommended"},{"$f":"'3'!N69","v":"Recommended"},{"$f":"'3'!O69","v":"Agent"},{"$f":"'3'!P69","v":0},{"$f":"'3'!Q69","v":0},{"$f":"'3'!R69","v":0},{"$f":"'3'!S69","v":0},{"$f":"'3'!T69","v":0},{"$f":"'3'!U69","v":0},{"$f":"'3'!V69","v":0},{"$f":"'3'!W69","v":0},{"$f":"'3'!X69","v":0},{"$f":"'3'!Y69","v":0},{"$f":"'3'!Z69","v":0},{"$f":"'3'!AA69","v":0},{"$f":"'3'!AB69","v":0},{"$f":"'3'!AC69","v":0},{"$f":"'3'!AD69","v":0},{"$f":"'3'!AE69","v":0},{"$f":"'3'!AF69","v":0},{"$f":"'3'!AG69","v":0},{"$f":"'3'!AH69","v":0},{"$f":"'3'!AI69","v":0},{"$f":"'3'!AJ69","v":0},{"$f":"'3'!AK69","v":0},{"$f":"'3'!AL69","v":0},{"$f":"'3'!AM69","v":0},{"$f":"'3'!AN69","v":0},{"$f":"'3'!AO69","v":0},{"$f":"'3'!AP69","v":0},{"$f":"'3'!AQ69","v":0},{"$f":"'3'!AR69","v":0},{"$f":"'3'!AS69","v":0},{"$f":"'3'!AT69","v":0},{"$f":"SUMPRODUCT(IF($N199=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N199=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B70","v":"3"},{"$f":"'3'!C70","v":"3.4"},{"$f":"'3'!D70","v":"3.4.1"},{"$f":"'3'!E70","v":""},{"$f":"'3'!F70","v":"3.4.1.7"},{"$f":"'3'!G70","v":"3.4.1.7: AGENT DISPUTE MANAGEMENT\nA dispute-management process should be implemented with each agent / master agent / agent aggregator (as applicable) to resolve major issues, disagreements and contractual disputes, with the final escalation being court resolution."},{"$f":"'3'!H70","v":0},{"$f":"'3'!I70","v":"3.4.1.7.1"},{"$f":"'3'!J70","v":"3.4.1.7.1: Has an agent dispute-management process been implemented to resolve major issues, disagreements and contractual disputes with agents?\n"},{"$f":"'3'!K70","v":"1) Agent dispute management process / agent contract\n- Check that there is a process documented for agent dispute management\n"},{"$f":"'3'!L70","v":0},{"$f":"'3'!M70","v":"Standard Required"},{"$f":"'3'!N70","v":"Required"},{"$f":"'3'!O70","v":"Agent"},{"$f":"'3'!P70","v":0},{"$f":"'3'!Q70","v":0},{"$f":"'3'!R70","v":0},{"$f":"'3'!S70","v":0},{"$f":"'3'!T70","v":0},{"$f":"'3'!U70","v":0},{"$f":"'3'!V70","v":0},{"$f":"'3'!W70","v":0},{"$f":"'3'!X70","v":0},{"$f":"'3'!Y70","v":0},{"$f":"'3'!Z70","v":0},{"$f":"'3'!AA70","v":0},{"$f":"'3'!AB70","v":0},{"$f":"'3'!AC70","v":0},{"$f":"'3'!AD70","v":0},{"$f":"'3'!AE70","v":0},{"$f":"'3'!AF70","v":0},{"$f":"'3'!AG70","v":0},{"$f":"'3'!AH70","v":0},{"$f":"'3'!AI70","v":0},{"$f":"'3'!AJ70","v":0},{"$f":"'3'!AK70","v":0},{"$f":"'3'!AL70","v":0},{"$f":"'3'!AM70","v":0},{"$f":"'3'!AN70","v":0},{"$f":"'3'!AO70","v":0},{"$f":"'3'!AP70","v":0},{"$f":"'3'!AQ70","v":0},{"$f":"'3'!AR70","v":0},{"$f":"'3'!AS70","v":0},{"$f":"'3'!AT70","v":0},{"$f":"SUMPRODUCT(IF($N200=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N200=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B71","v":"3"},{"$f":"'3'!C71","v":"3.4"},{"$f":"'3'!D71","v":"3.4.1"},{"$f":"'3'!E71","v":""},{"$f":"'3'!F71","v":"3.4.1.8"},{"$f":"'3'!G71","v":"3.4.1.8: AGENT AVAILABILITY AND LIQUIDITY\nProviders should monitor customers' usage patterns and their agent network to ensure sufficient coverage of agents, given current and anticipated usage patterns.\n\nAgent liquidity should be monitored. If necessary, providers should establish super-agents to assist agents in maintaining liquidity and should continue to optimize liquidity management. "},{"$f":"'3'!H71","v":"GSMA RMT\n(AG-18,\nAG-19)"},{"$f":"'3'!I71","v":"3.4.1.8.1"},{"$f":"'3'!J71","v":"3.4.1.8.1: Are customers' usage patterns and the agent network monitored to ensure sufficient coverage of agents, given current and anticipated usage patterns?\n"},{"$f":"'3'!K71","v":0},{"$f":"'3'!L71","v":0},{"$f":"'3'!M71","v":"Recommended"},{"$f":"'3'!N71","v":"Recommended"},{"$f":"'3'!O71","v":"Agent"},{"$f":"'3'!P71","v":0},{"$f":"'3'!Q71","v":0},{"$f":"'3'!R71","v":0},{"$f":"'3'!S71","v":0},{"$f":"'3'!T71","v":0},{"$f":"'3'!U71","v":0},{"$f":"'3'!V71","v":0},{"$f":"'3'!W71","v":0},{"$f":"'3'!X71","v":0},{"$f":"'3'!Y71","v":0},{"$f":"'3'!Z71","v":0},{"$f":"'3'!AA71","v":0},{"$f":"'3'!AB71","v":0},{"$f":"'3'!AC71","v":0},{"$f":"'3'!AD71","v":0},{"$f":"'3'!AE71","v":0},{"$f":"'3'!AF71","v":0},{"$f":"'3'!AG71","v":0},{"$f":"'3'!AH71","v":0},{"$f":"'3'!AI71","v":0},{"$f":"'3'!AJ71","v":0},{"$f":"'3'!AK71","v":0},{"$f":"'3'!AL71","v":0},{"$f":"'3'!AM71","v":0},{"$f":"'3'!AN71","v":0},{"$f":"'3'!AO71","v":0},{"$f":"'3'!AP71","v":0},{"$f":"'3'!AQ71","v":0},{"$f":"'3'!AR71","v":0},{"$f":"'3'!AS71","v":0},{"$f":"'3'!AT71","v":0},{"$f":"SUMPRODUCT(IF($N201=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N201=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B72","v":"3"},{"$f":"'3'!C72","v":"3.4"},{"$f":"'3'!D72","v":"3.4.1"},{"$f":"'3'!E72","v":""},{"$f":"'3'!F72","v":"3.4.1.8"},{"$f":"'3'!G72","v":0},{"$f":"'3'!H72","v":0},{"$f":"'3'!I72","v":"3.4.1.8.2"},{"$f":"'3'!J72","v":"3.4.1.8.2: Is the liquidity of agents monitored?\n"},{"$f":"'3'!K72","v":0},{"$f":"'3'!L72","v":0},{"$f":"'3'!M72","v":"Recommended"},{"$f":"'3'!N72","v":"Recommended"},{"$f":"'3'!O72","v":"Agent"},{"$f":"'3'!P72","v":0},{"$f":"'3'!Q72","v":0},{"$f":"'3'!R72","v":0},{"$f":"'3'!S72","v":0},{"$f":"'3'!T72","v":0},{"$f":"'3'!U72","v":0},{"$f":"'3'!V72","v":0},{"$f":"'3'!W72","v":0},{"$f":"'3'!X72","v":0},{"$f":"'3'!Y72","v":0},{"$f":"'3'!Z72","v":0},{"$f":"'3'!AA72","v":0},{"$f":"'3'!AB72","v":0},{"$f":"'3'!AC72","v":0},{"$f":"'3'!AD72","v":0},{"$f":"'3'!AE72","v":0},{"$f":"'3'!AF72","v":0},{"$f":"'3'!AG72","v":0},{"$f":"'3'!AH72","v":0},{"$f":"'3'!AI72","v":0},{"$f":"'3'!AJ72","v":0},{"$f":"'3'!AK72","v":0},{"$f":"'3'!AL72","v":0},{"$f":"'3'!AM72","v":0},{"$f":"'3'!AN72","v":0},{"$f":"'3'!AO72","v":0},{"$f":"'3'!AP72","v":0},{"$f":"'3'!AQ72","v":0},{"$f":"'3'!AR72","v":0},{"$f":"'3'!AS72","v":0},{"$f":"'3'!AT72","v":0},{"$f":"SUMPRODUCT(IF($N202=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N202=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B73","v":"3"},{"$f":"'3'!C73","v":"3.4"},{"$f":"'3'!D73","v":"3.4.1"},{"$f":"'3'!E73","v":""},{"$f":"'3'!F73","v":"3.4.1.8"},{"$f":"'3'!G73","v":0},{"$f":"'3'!H73","v":0},{"$f":"'3'!I73","v":"3.4.1.8.3"},{"$f":"'3'!J73","v":"3.4.1.8.3: If necessary, have super-agents been established to assist agents in maintaining liquidity, with ongoing optimization?\n"},{"$f":"'3'!K73","v":0},{"$f":"'3'!L73","v":0},{"$f":"'3'!M73","v":"Recommended"},{"$f":"'3'!N73","v":"Recommended"},{"$f":"'3'!O73","v":"Agent"},{"$f":"'3'!P73","v":0},{"$f":"'3'!Q73","v":0},{"$f":"'3'!R73","v":0},{"$f":"'3'!S73","v":0},{"$f":"'3'!T73","v":0},{"$f":"'3'!U73","v":0},{"$f":"'3'!V73","v":0},{"$f":"'3'!W73","v":0},{"$f":"'3'!X73","v":0},{"$f":"'3'!Y73","v":0},{"$f":"'3'!Z73","v":0},{"$f":"'3'!AA73","v":0},{"$f":"'3'!AB73","v":0},{"$f":"'3'!AC73","v":0},{"$f":"'3'!AD73","v":0},{"$f":"'3'!AE73","v":0},{"$f":"'3'!AF73","v":0},{"$f":"'3'!AG73","v":0},{"$f":"'3'!AH73","v":0},{"$f":"'3'!AI73","v":0},{"$f":"'3'!AJ73","v":0},{"$f":"'3'!AK73","v":0},{"$f":"'3'!AL73","v":0},{"$f":"'3'!AM73","v":0},{"$f":"'3'!AN73","v":0},{"$f":"'3'!AO73","v":0},{"$f":"'3'!AP73","v":0},{"$f":"'3'!AQ73","v":0},{"$f":"'3'!AR73","v":0},{"$f":"'3'!AS73","v":0},{"$f":"'3'!AT73","v":0},{"$f":"SUMPRODUCT(IF($N203=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N203=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B74","v":"3"},{"$f":"'3'!C74","v":"3.4"},{"$f":"'3'!D74","v":"3.4.1"},{"$f":"'3'!E74","v":""},{"$f":"'3'!F74","v":"3.4.1.9"},{"$f":"'3'!G74","v":"3.4.1.9: AGENT RISK MANAGEMENT\nProviders should conduct risk management for each of their master agents and agent aggregators. Risk management should be carried out when agents are appointed and thereafter when required. When assessing risk, all of the following factors should be considered:\n- Performance of each master agent / agent aggregator in managing its agents and implementing the provider's policies and processes;\n- Relationship between provider and each master agent/ agent aggregator;\n- Relationship between master agent/ agent aggregator and agents;\n- Regulatory status of each master agent / agent aggregator;\n- Financial, reputational, and operational impact on provider of performance failure by each master agent / agent aggregator;\n- Potential losses to provider’s customers due to performance failure by master agent / agent aggregator; and\n- Concentration risk (number/percentage of agents managed by a single master agent / agent aggregator)."},{"$f":"'3'!H74","v":"BCBS OFS"},{"$f":"'3'!I74","v":"3.4.1.9.1"},{"$f":"'3'!J74","v":"3.4.1.9.1: Is risk management carried out on agents when each master agent and agent aggregator is appointed and when required?\n"},{"$f":"'3'!K74","v":"1) Agent risk register\n- Check that there is a risk register that records risks of each master agent and agent aggregator.\n- Check that actions have been assigned a severity and an owner and followed up."},{"$f":"'3'!L74","v":0},{"$f":"'3'!M74","v":"Urgent Required"},{"$f":"'3'!N74","v":"Required"},{"$f":"'3'!O74","v":"Agent"},{"$f":"'3'!P74","v":0},{"$f":"'3'!Q74","v":0},{"$f":"'3'!R74","v":0},{"$f":"'3'!S74","v":0},{"$f":"'3'!T74","v":0},{"$f":"'3'!U74","v":0},{"$f":"'3'!V74","v":0},{"$f":"'3'!W74","v":0},{"$f":"'3'!X74","v":0},{"$f":"'3'!Y74","v":0},{"$f":"'3'!Z74","v":0},{"$f":"'3'!AA74","v":0},{"$f":"'3'!AB74","v":0},{"$f":"'3'!AC74","v":0},{"$f":"'3'!AD74","v":0},{"$f":"'3'!AE74","v":0},{"$f":"'3'!AF74","v":0},{"$f":"'3'!AG74","v":0},{"$f":"'3'!AH74","v":0},{"$f":"'3'!AI74","v":0},{"$f":"'3'!AJ74","v":0},{"$f":"'3'!AK74","v":0},{"$f":"'3'!AL74","v":0},{"$f":"'3'!AM74","v":0},{"$f":"'3'!AN74","v":0},{"$f":"'3'!AO74","v":0},{"$f":"'3'!AP74","v":0},{"$f":"'3'!AQ74","v":0},{"$f":"'3'!AR74","v":0},{"$f":"'3'!AS74","v":0},{"$f":"'3'!AT74","v":0},{"$f":"SUMPRODUCT(IF($N204=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N204=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B75","v":"3"},{"$f":"'3'!C75","v":"3.4"},{"$f":"'3'!D75","v":"3.4.1"},{"$f":"'3'!E75","v":""},{"$f":"'3'!F75","v":"3.4.1.9"},{"$f":"'3'!G75","v":0},{"$f":"'3'!H75","v":0},{"$f":"'3'!I75","v":"3.4.1.9.2"},{"$f":"'3'!J75","v":"3.4.1.9.2: Does agent risk management review the relationship between provider and each master agent/ agent aggregator, as well as that between the master agent and their individual agents?\n"},{"$f":"'3'!K75","v":0},{"$f":"'3'!L75","v":0},{"$f":"'3'!M75","v":"Recommended"},{"$f":"'3'!N75","v":"Recommended"},{"$f":"'3'!O75","v":"Agent"},{"$f":"'3'!P75","v":0},{"$f":"'3'!Q75","v":0},{"$f":"'3'!R75","v":0},{"$f":"'3'!S75","v":0},{"$f":"'3'!T75","v":0},{"$f":"'3'!U75","v":0},{"$f":"'3'!V75","v":0},{"$f":"'3'!W75","v":0},{"$f":"'3'!X75","v":0},{"$f":"'3'!Y75","v":0},{"$f":"'3'!Z75","v":0},{"$f":"'3'!AA75","v":0},{"$f":"'3'!AB75","v":0},{"$f":"'3'!AC75","v":0},{"$f":"'3'!AD75","v":0},{"$f":"'3'!AE75","v":0},{"$f":"'3'!AF75","v":0},{"$f":"'3'!AG75","v":0},{"$f":"'3'!AH75","v":0},{"$f":"'3'!AI75","v":0},{"$f":"'3'!AJ75","v":0},{"$f":"'3'!AK75","v":0},{"$f":"'3'!AL75","v":0},{"$f":"'3'!AM75","v":0},{"$f":"'3'!AN75","v":0},{"$f":"'3'!AO75","v":0},{"$f":"'3'!AP75","v":0},{"$f":"'3'!AQ75","v":0},{"$f":"'3'!AR75","v":0},{"$f":"'3'!AS75","v":0},{"$f":"'3'!AT75","v":0},{"$f":"SUMPRODUCT(IF($N205=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N205=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B76","v":"3"},{"$f":"'3'!C76","v":"3.4"},{"$f":"'3'!D76","v":"3.4.1"},{"$f":"'3'!E76","v":""},{"$f":"'3'!F76","v":"3.4.1.9"},{"$f":"'3'!G76","v":0},{"$f":"'3'!H76","v":0},{"$f":"'3'!I76","v":"3.4.1.9.3"},{"$f":"'3'!J76","v":"3.4.1.9.3: Is the risk and impact of failure of each master agent / agent aggregator assessed?\n"},{"$f":"'3'!K76","v":0},{"$f":"'3'!L76","v":0},{"$f":"'3'!M76","v":"Recommended"},{"$f":"'3'!N76","v":"Recommended"},{"$f":"'3'!O76","v":"Agent"},{"$f":"'3'!P76","v":0},{"$f":"'3'!Q76","v":0},{"$f":"'3'!R76","v":0},{"$f":"'3'!S76","v":0},{"$f":"'3'!T76","v":0},{"$f":"'3'!U76","v":0},{"$f":"'3'!V76","v":0},{"$f":"'3'!W76","v":0},{"$f":"'3'!X76","v":0},{"$f":"'3'!Y76","v":0},{"$f":"'3'!Z76","v":0},{"$f":"'3'!AA76","v":0},{"$f":"'3'!AB76","v":0},{"$f":"'3'!AC76","v":0},{"$f":"'3'!AD76","v":0},{"$f":"'3'!AE76","v":0},{"$f":"'3'!AF76","v":0},{"$f":"'3'!AG76","v":0},{"$f":"'3'!AH76","v":0},{"$f":"'3'!AI76","v":0},{"$f":"'3'!AJ76","v":0},{"$f":"'3'!AK76","v":0},{"$f":"'3'!AL76","v":0},{"$f":"'3'!AM76","v":0},{"$f":"'3'!AN76","v":0},{"$f":"'3'!AO76","v":0},{"$f":"'3'!AP76","v":0},{"$f":"'3'!AQ76","v":0},{"$f":"'3'!AR76","v":0},{"$f":"'3'!AS76","v":0},{"$f":"'3'!AT76","v":0},{"$f":"SUMPRODUCT(IF($N206=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N206=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B77","v":"3"},{"$f":"'3'!C77","v":"3.4"},{"$f":"'3'!D77","v":"3.4.1"},{"$f":"'3'!E77","v":""},{"$f":"'3'!F77","v":"3.4.1.9"},{"$f":"'3'!G77","v":0},{"$f":"'3'!H77","v":0},{"$f":"'3'!I77","v":"3.4.1.9.4"},{"$f":"'3'!J77","v":"3.4.1.9.4: Does agent risk management address the concentration risk associated with use of master agents / agent aggregators?\n"},{"$f":"'3'!K77","v":0},{"$f":"'3'!L77","v":0},{"$f":"'3'!M77","v":"Recommended"},{"$f":"'3'!N77","v":"Recommended"},{"$f":"'3'!O77","v":"Agent"},{"$f":"'3'!P77","v":0},{"$f":"'3'!Q77","v":0},{"$f":"'3'!R77","v":0},{"$f":"'3'!S77","v":0},{"$f":"'3'!T77","v":0},{"$f":"'3'!U77","v":0},{"$f":"'3'!V77","v":0},{"$f":"'3'!W77","v":0},{"$f":"'3'!X77","v":0},{"$f":"'3'!Y77","v":0},{"$f":"'3'!Z77","v":0},{"$f":"'3'!AA77","v":0},{"$f":"'3'!AB77","v":0},{"$f":"'3'!AC77","v":0},{"$f":"'3'!AD77","v":0},{"$f":"'3'!AE77","v":0},{"$f":"'3'!AF77","v":0},{"$f":"'3'!AG77","v":0},{"$f":"'3'!AH77","v":0},{"$f":"'3'!AI77","v":0},{"$f":"'3'!AJ77","v":0},{"$f":"'3'!AK77","v":0},{"$f":"'3'!AL77","v":0},{"$f":"'3'!AM77","v":0},{"$f":"'3'!AN77","v":0},{"$f":"'3'!AO77","v":0},{"$f":"'3'!AP77","v":0},{"$f":"'3'!AQ77","v":0},{"$f":"'3'!AR77","v":0},{"$f":"'3'!AS77","v":0},{"$f":"'3'!AT77","v":0},{"$f":"SUMPRODUCT(IF($N207=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N207=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B78","v":"3"},{"$f":"'3'!C78","v":"3.4"},{"$f":"'3'!D78","v":"3.4.1"},{"$f":"'3'!E78","v":""},{"$f":"'3'!F78","v":"3.4.1.10"},{"$f":"'3'!G78","v":"3.4.1.10: OUTSOURCING POLICY\nIf material elements of the mobile money service are outsourced, the provider should define an outsourcing policy or similar document to specify principles for governance of outsourcing. This should include:\n- How to determine whether (and the extent to which) a function is appropriate for outsourcing;\n- Ensuring that all entities providing material services are compliant with relevant regulations [relevant regulations could differ by country and role of supplier. e.g. MM platform supplier may have to comply with data processor regulations];\n- Concentration risk - i.e. risk of outsourcing multiple activities to a single entity providing outsourced services; and\n- Limits on acceptable overall levels of outsourcing.\n\nAlso refer to the definitions of \"outsourcing\" and \"entities providing outsourced services\"."},{"$f":"'3'!H78","v":0},{"$f":"'3'!I78","v":"3.4.1.10.1"},{"$f":"'3'!J78","v":"3.4.1.10.1: Does the provider request all entities providing material services to state that they are compliant with relevant regulations?\n"},{"$f":"'3'!K78","v":"1) Contract document for each material outsourced service suppliers (e.g. MM platform provider)\n- Check that relevant regulations have been identified for all material outsourced suppliers.\n- Check that all material outsourced suppliers have stated that they are compliant with relevant regulations.\n"},{"$f":"'3'!L78","v":0},{"$f":"'3'!M78","v":"Standard Required"},{"$f":"'3'!N78","v":"Required"},{"$f":"'3'!O78","v":"FraudRisk"},{"$f":"'3'!P78","v":0},{"$f":"'3'!Q78","v":0},{"$f":"'3'!R78","v":0},{"$f":"'3'!S78","v":0},{"$f":"'3'!T78","v":0},{"$f":"'3'!U78","v":0},{"$f":"'3'!V78","v":0},{"$f":"'3'!W78","v":0},{"$f":"'3'!X78","v":0},{"$f":"'3'!Y78","v":0},{"$f":"'3'!Z78","v":0},{"$f":"'3'!AA78","v":0},{"$f":"'3'!AB78","v":0},{"$f":"'3'!AC78","v":0},{"$f":"'3'!AD78","v":0},{"$f":"'3'!AE78","v":0},{"$f":"'3'!AF78","v":0},{"$f":"'3'!AG78","v":0},{"$f":"'3'!AH78","v":0},{"$f":"'3'!AI78","v":0},{"$f":"'3'!AJ78","v":0},{"$f":"'3'!AK78","v":0},{"$f":"'3'!AL78","v":0},{"$f":"'3'!AM78","v":0},{"$f":"'3'!AN78","v":0},{"$f":"'3'!AO78","v":0},{"$f":"'3'!AP78","v":0},{"$f":"'3'!AQ78","v":0},{"$f":"'3'!AR78","v":0},{"$f":"'3'!AS78","v":0},{"$f":"'3'!AT78","v":0},{"$f":"SUMPRODUCT(IF($N208=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N208=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B79","v":"3"},{"$f":"'3'!C79","v":"3.4"},{"$f":"'3'!D79","v":"3.4.1"},{"$f":"'3'!E79","v":""},{"$f":"'3'!F79","v":"3.4.1.10"},{"$f":"'3'!G79","v":0},{"$f":"'3'!H79","v":0},{"$f":"'3'!I79","v":"3.4.1.10.2"},{"$f":"'3'!J79","v":"3.4.1.10.2: Does the outsourcing policy indicate how to determine whether (and the extent to which) a mobile money function is appropriate for outsourcing?\n"},{"$f":"'3'!K79","v":0},{"$f":"'3'!L79","v":0},{"$f":"'3'!M79","v":"Recommended"},{"$f":"'3'!N79","v":"Recommended"},{"$f":"'3'!O79","v":"BizOps"},{"$f":"'3'!P79","v":0},{"$f":"'3'!Q79","v":0},{"$f":"'3'!R79","v":0},{"$f":"'3'!S79","v":0},{"$f":"'3'!T79","v":0},{"$f":"'3'!U79","v":0},{"$f":"'3'!V79","v":0},{"$f":"'3'!W79","v":0},{"$f":"'3'!X79","v":0},{"$f":"'3'!Y79","v":0},{"$f":"'3'!Z79","v":0},{"$f":"'3'!AA79","v":0},{"$f":"'3'!AB79","v":0},{"$f":"'3'!AC79","v":0},{"$f":"'3'!AD79","v":0},{"$f":"'3'!AE79","v":0},{"$f":"'3'!AF79","v":0},{"$f":"'3'!AG79","v":0},{"$f":"'3'!AH79","v":0},{"$f":"'3'!AI79","v":0},{"$f":"'3'!AJ79","v":0},{"$f":"'3'!AK79","v":0},{"$f":"'3'!AL79","v":0},{"$f":"'3'!AM79","v":0},{"$f":"'3'!AN79","v":0},{"$f":"'3'!AO79","v":0},{"$f":"'3'!AP79","v":0},{"$f":"'3'!AQ79","v":0},{"$f":"'3'!AR79","v":0},{"$f":"'3'!AS79","v":0},{"$f":"'3'!AT79","v":0},{"$f":"SUMPRODUCT(IF($N209=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N209=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B80","v":"3"},{"$f":"'3'!C80","v":"3.4"},{"$f":"'3'!D80","v":"3.4.1"},{"$f":"'3'!E80","v":""},{"$f":"'3'!F80","v":"3.4.1.10"},{"$f":"'3'!G80","v":0},{"$f":"'3'!H80","v":0},{"$f":"'3'!I80","v":"3.4.1.10.3"},{"$f":"'3'!J80","v":"3.4.1.10.3: Does the outsourcing policy address concentration risk associated with a single entity providing outsourced services and limits on acceptable overall levels of outsourcing?\n"},{"$f":"'3'!K80","v":0},{"$f":"'3'!L80","v":0},{"$f":"'3'!M80","v":"Recommended"},{"$f":"'3'!N80","v":"Recommended"},{"$f":"'3'!O80","v":"BizOps"},{"$f":"'3'!P80","v":0},{"$f":"'3'!Q80","v":0},{"$f":"'3'!R80","v":0},{"$f":"'3'!S80","v":0},{"$f":"'3'!T80","v":0},{"$f":"'3'!U80","v":0},{"$f":"'3'!V80","v":0},{"$f":"'3'!W80","v":0},{"$f":"'3'!X80","v":0},{"$f":"'3'!Y80","v":0},{"$f":"'3'!Z80","v":0},{"$f":"'3'!AA80","v":0},{"$f":"'3'!AB80","v":0},{"$f":"'3'!AC80","v":0},{"$f":"'3'!AD80","v":0},{"$f":"'3'!AE80","v":0},{"$f":"'3'!AF80","v":0},{"$f":"'3'!AG80","v":0},{"$f":"'3'!AH80","v":0},{"$f":"'3'!AI80","v":0},{"$f":"'3'!AJ80","v":0},{"$f":"'3'!AK80","v":0},{"$f":"'3'!AL80","v":0},{"$f":"'3'!AM80","v":0},{"$f":"'3'!AN80","v":0},{"$f":"'3'!AO80","v":0},{"$f":"'3'!AP80","v":0},{"$f":"'3'!AQ80","v":0},{"$f":"'3'!AR80","v":0},{"$f":"'3'!AS80","v":0},{"$f":"'3'!AT80","v":0},{"$f":"SUMPRODUCT(IF($N210=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N210=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B81","v":"3"},{"$f":"'3'!C81","v":"3.4"},{"$f":"'3'!D81","v":"3.4.1"},{"$f":"'3'!E81","v":""},{"$f":"'3'!F81","v":"3.4.1.11"},{"$f":"'3'!G81","v":"3.4.1.11: OUTSOURCING MANAGEMENT\nProviders should monitor entities providing material outsourced services (see definition) against agreed service levels (see 3.3) and notify entities of exceptions and unsatisfactory performance. Procedures for escalation of issues on both sides of the relationship should be implemented. \n\nThe provider should manage the relationship with each entity providing outsourced services to ensure that there are lines of communication for information exchange so that relevant information is shared promptly by both parties."},{"$f":"'3'!H81","v":0},{"$f":"'3'!I81","v":"3.4.1.11.1"},{"$f":"'3'!J81","v":"3.4.1.11.1: Are entities providing material outsourced services (see see definition) monitored against agreed service levels and notified of exceptions and unsatisfactory performance?\n"},{"$f":"'3'!K81","v":0},{"$f":"'3'!L81","v":0},{"$f":"'3'!M81","v":"Recommended"},{"$f":"'3'!N81","v":"Recommended"},{"$f":"'3'!O81","v":"BizOps"},{"$f":"'3'!P81","v":0},{"$f":"'3'!Q81","v":0},{"$f":"'3'!R81","v":0},{"$f":"'3'!S81","v":0},{"$f":"'3'!T81","v":0},{"$f":"'3'!U81","v":0},{"$f":"'3'!V81","v":0},{"$f":"'3'!W81","v":0},{"$f":"'3'!X81","v":0},{"$f":"'3'!Y81","v":0},{"$f":"'3'!Z81","v":0},{"$f":"'3'!AA81","v":0},{"$f":"'3'!AB81","v":0},{"$f":"'3'!AC81","v":0},{"$f":"'3'!AD81","v":0},{"$f":"'3'!AE81","v":0},{"$f":"'3'!AF81","v":0},{"$f":"'3'!AG81","v":0},{"$f":"'3'!AH81","v":0},{"$f":"'3'!AI81","v":0},{"$f":"'3'!AJ81","v":0},{"$f":"'3'!AK81","v":0},{"$f":"'3'!AL81","v":0},{"$f":"'3'!AM81","v":0},{"$f":"'3'!AN81","v":0},{"$f":"'3'!AO81","v":0},{"$f":"'3'!AP81","v":0},{"$f":"'3'!AQ81","v":0},{"$f":"'3'!AR81","v":0},{"$f":"'3'!AS81","v":0},{"$f":"'3'!AT81","v":0},{"$f":"SUMPRODUCT(IF($N211=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N211=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B82","v":"3"},{"$f":"'3'!C82","v":"3.4"},{"$f":"'3'!D82","v":"3.4.1"},{"$f":"'3'!E82","v":""},{"$f":"'3'!F82","v":"3.4.1.12"},{"$f":"'3'!G82","v":"3.4.1.12: OUTSOURCING MANAGEMENT - DISPUTE MANAGEMENT\nA dispute management process should be implemented with each entity providing outsourced services to resolve major issues and contractual disputes that cannot be resolved by the normal issue management and escalation process."},{"$f":"'3'!H82","v":0},{"$f":"'3'!I82","v":"3.4.1.12.1"},{"$f":"'3'!J82","v":"3.4.1.12.1: Has a dispute management process been implemented with each entity providing outsourced services to resolve major issues and contractual disputes?\n"},{"$f":"'3'!K82","v":0},{"$f":"'3'!L82","v":0},{"$f":"'3'!M82","v":"Recommended"},{"$f":"'3'!N82","v":"Recommended"},{"$f":"'3'!O82","v":"BizOps"},{"$f":"'3'!P82","v":0},{"$f":"'3'!Q82","v":0},{"$f":"'3'!R82","v":0},{"$f":"'3'!S82","v":0},{"$f":"'3'!T82","v":0},{"$f":"'3'!U82","v":0},{"$f":"'3'!V82","v":0},{"$f":"'3'!W82","v":0},{"$f":"'3'!X82","v":0},{"$f":"'3'!Y82","v":0},{"$f":"'3'!Z82","v":0},{"$f":"'3'!AA82","v":0},{"$f":"'3'!AB82","v":0},{"$f":"'3'!AC82","v":0},{"$f":"'3'!AD82","v":0},{"$f":"'3'!AE82","v":0},{"$f":"'3'!AF82","v":0},{"$f":"'3'!AG82","v":0},{"$f":"'3'!AH82","v":0},{"$f":"'3'!AI82","v":0},{"$f":"'3'!AJ82","v":0},{"$f":"'3'!AK82","v":0},{"$f":"'3'!AL82","v":0},{"$f":"'3'!AM82","v":0},{"$f":"'3'!AN82","v":0},{"$f":"'3'!AO82","v":0},{"$f":"'3'!AP82","v":0},{"$f":"'3'!AQ82","v":0},{"$f":"'3'!AR82","v":0},{"$f":"'3'!AS82","v":0},{"$f":"'3'!AT82","v":0},{"$f":"SUMPRODUCT(IF($N212=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N212=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B83","v":"3"},{"$f":"'3'!C83","v":"3.4"},{"$f":"'3'!D83","v":"3.4.1"},{"$f":"'3'!E83","v":""},{"$f":"'3'!F83","v":"3.4.1.13"},{"$f":"'3'!G83","v":"3.4.1.13: OUTSOURCING RISK MANAGEMENT\nThe provider should conduct risk management for outsourced services. When assessing outsourcing risk, all of the following factors should be considered:\n- Performance of entity providing outsourced services in managing and controlling their own risks;\n- Relationship between provider and entity providing outsourced services;\n- Financial, reputational, and operational impact on provider of performance failure by entity providing outsourced services;\n- Potential losses to provider’s customers due to performance failure by entity providing outsourced services;\n- Effects of outsourcing on the ability of provider to comply with legal/regulatory requirements (and adapt to changes in regulatory requirements);\n- Effort/time required to switch to alternate entity providing outsourced services or to bring activity in-house, if necessary;\n- Complexity of each outsourcing arrangement and the overall level of outsourcing complexity;\n- Impact of outsourcing on the provider's ability to supervise its business;\n- Ability of each entity providing outsourced services to adhere to the provider's security policy."},{"$f":"'3'!H83","v":"BCBS OFS"},{"$f":"'3'!I83","v":"3.4.1.13.1"},{"$f":"'3'!J83","v":"3.4.1.13.1: Is risk management conducted for each mobile money function that is outsourced?\n"},{"$f":"'3'!K83","v":"1) Outsourcing risk management process / policy\n- Check that there is a process/method to identify mobile money functions that are outsourced\n- Check that there is risk management process for identified functions\n- Check that there is a process for dealing with outsourced functions that fail the risk management process. "},{"$f":"'3'!L83","v":0},{"$f":"'3'!M83","v":"Standard Required"},{"$f":"'3'!N83","v":"Required"},{"$f":"'3'!O83","v":"FraudRisk"},{"$f":"'3'!P83","v":0},{"$f":"'3'!Q83","v":0},{"$f":"'3'!R83","v":0},{"$f":"'3'!S83","v":0},{"$f":"'3'!T83","v":0},{"$f":"'3'!U83","v":0},{"$f":"'3'!V83","v":0},{"$f":"'3'!W83","v":0},{"$f":"'3'!X83","v":0},{"$f":"'3'!Y83","v":0},{"$f":"'3'!Z83","v":0},{"$f":"'3'!AA83","v":0},{"$f":"'3'!AB83","v":0},{"$f":"'3'!AC83","v":0},{"$f":"'3'!AD83","v":0},{"$f":"'3'!AE83","v":0},{"$f":"'3'!AF83","v":0},{"$f":"'3'!AG83","v":0},{"$f":"'3'!AH83","v":0},{"$f":"'3'!AI83","v":0},{"$f":"'3'!AJ83","v":0},{"$f":"'3'!AK83","v":0},{"$f":"'3'!AL83","v":0},{"$f":"'3'!AM83","v":0},{"$f":"'3'!AN83","v":0},{"$f":"'3'!AO83","v":0},{"$f":"'3'!AP83","v":0},{"$f":"'3'!AQ83","v":0},{"$f":"'3'!AR83","v":0},{"$f":"'3'!AS83","v":0},{"$f":"'3'!AT83","v":0},{"$f":"SUMPRODUCT(IF($N213=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N213=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B84","v":"3"},{"$f":"'3'!C84","v":"3.4"},{"$f":"'3'!D84","v":"3.4.1"},{"$f":"'3'!E84","v":""},{"$f":"'3'!F84","v":"3.4.1.13"},{"$f":"'3'!G84","v":0},{"$f":"'3'!H84","v":0},{"$f":"'3'!I84","v":"3.4.1.13.2"},{"$f":"'3'!J84","v":"3.4.1.13.2: Does risk management for outsourcing analyse the relationship between the provider and each entity providing outsourced services?\n"},{"$f":"'3'!K84","v":0},{"$f":"'3'!L84","v":0},{"$f":"'3'!M84","v":"Recommended"},{"$f":"'3'!N84","v":"Recommended"},{"$f":"'3'!O84","v":"FraudRisk"},{"$f":"'3'!P84","v":0},{"$f":"'3'!Q84","v":0},{"$f":"'3'!R84","v":0},{"$f":"'3'!S84","v":0},{"$f":"'3'!T84","v":0},{"$f":"'3'!U84","v":0},{"$f":"'3'!V84","v":0},{"$f":"'3'!W84","v":0},{"$f":"'3'!X84","v":0},{"$f":"'3'!Y84","v":0},{"$f":"'3'!Z84","v":0},{"$f":"'3'!AA84","v":0},{"$f":"'3'!AB84","v":0},{"$f":"'3'!AC84","v":0},{"$f":"'3'!AD84","v":0},{"$f":"'3'!AE84","v":0},{"$f":"'3'!AF84","v":0},{"$f":"'3'!AG84","v":0},{"$f":"'3'!AH84","v":0},{"$f":"'3'!AI84","v":0},{"$f":"'3'!AJ84","v":0},{"$f":"'3'!AK84","v":0},{"$f":"'3'!AL84","v":0},{"$f":"'3'!AM84","v":0},{"$f":"'3'!AN84","v":0},{"$f":"'3'!AO84","v":0},{"$f":"'3'!AP84","v":0},{"$f":"'3'!AQ84","v":0},{"$f":"'3'!AR84","v":0},{"$f":"'3'!AS84","v":0},{"$f":"'3'!AT84","v":0},{"$f":"SUMPRODUCT(IF($N214=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N214=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B85","v":"3"},{"$f":"'3'!C85","v":"3.4"},{"$f":"'3'!D85","v":"3.4.1"},{"$f":"'3'!E85","v":""},{"$f":"'3'!F85","v":"3.4.1.13"},{"$f":"'3'!G85","v":0},{"$f":"'3'!H85","v":0},{"$f":"'3'!I85","v":"3.4.1.13.3"},{"$f":"'3'!J85","v":"3.4.1.13.3: Does risk management for outsourcing evaluate the financial, reputational, and operational impact on provider of performance failure by each entity providing outsourced services?\n"},{"$f":"'3'!K85","v":0},{"$f":"'3'!L85","v":0},{"$f":"'3'!M85","v":"Recommended"},{"$f":"'3'!N85","v":"Recommended"},{"$f":"'3'!O85","v":"FraudRisk"},{"$f":"'3'!P85","v":0},{"$f":"'3'!Q85","v":0},{"$f":"'3'!R85","v":0},{"$f":"'3'!S85","v":0},{"$f":"'3'!T85","v":0},{"$f":"'3'!U85","v":0},{"$f":"'3'!V85","v":0},{"$f":"'3'!W85","v":0},{"$f":"'3'!X85","v":0},{"$f":"'3'!Y85","v":0},{"$f":"'3'!Z85","v":0},{"$f":"'3'!AA85","v":0},{"$f":"'3'!AB85","v":0},{"$f":"'3'!AC85","v":0},{"$f":"'3'!AD85","v":0},{"$f":"'3'!AE85","v":0},{"$f":"'3'!AF85","v":0},{"$f":"'3'!AG85","v":0},{"$f":"'3'!AH85","v":0},{"$f":"'3'!AI85","v":0},{"$f":"'3'!AJ85","v":0},{"$f":"'3'!AK85","v":0},{"$f":"'3'!AL85","v":0},{"$f":"'3'!AM85","v":0},{"$f":"'3'!AN85","v":0},{"$f":"'3'!AO85","v":0},{"$f":"'3'!AP85","v":0},{"$f":"'3'!AQ85","v":0},{"$f":"'3'!AR85","v":0},{"$f":"'3'!AS85","v":0},{"$f":"'3'!AT85","v":0},{"$f":"SUMPRODUCT(IF($N215=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N215=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B86","v":"3"},{"$f":"'3'!C86","v":"3.4"},{"$f":"'3'!D86","v":"3.4.1"},{"$f":"'3'!E86","v":0},{"$f":"'3'!F86","v":"3.4.1.13"},{"$f":"'3'!G86","v":0},{"$f":"'3'!H86","v":0},{"$f":"'3'!I86","v":"3.4.1.13.4"},{"$f":"'3'!J86","v":"3.4.1.13.4: Does risk management for outsourcing consider the effects of outsourcing on the ability of the provider to comply with legal/regulatory requirements (and adapt to changes in regulatory requirements)?\n"},{"$f":"'3'!K86","v":0},{"$f":"'3'!L86","v":0},{"$f":"'3'!M86","v":"Recommended"},{"$f":"'3'!N86","v":"Recommended"},{"$f":"'3'!O86","v":"FraudRisk"},{"$f":"'3'!P86","v":0},{"$f":"'3'!Q86","v":0},{"$f":"'3'!R86","v":0},{"$f":"'3'!S86","v":0},{"$f":"'3'!T86","v":0},{"$f":"'3'!U86","v":0},{"$f":"'3'!V86","v":0},{"$f":"'3'!W86","v":0},{"$f":"'3'!X86","v":0},{"$f":"'3'!Y86","v":0},{"$f":"'3'!Z86","v":0},{"$f":"'3'!AA86","v":0},{"$f":"'3'!AB86","v":0},{"$f":"'3'!AC86","v":0},{"$f":"'3'!AD86","v":0},{"$f":"'3'!AE86","v":0},{"$f":"'3'!AF86","v":0},{"$f":"'3'!AG86","v":0},{"$f":"'3'!AH86","v":0},{"$f":"'3'!AI86","v":0},{"$f":"'3'!AJ86","v":0},{"$f":"'3'!AK86","v":0},{"$f":"'3'!AL86","v":0},{"$f":"'3'!AM86","v":0},{"$f":"'3'!AN86","v":0},{"$f":"'3'!AO86","v":0},{"$f":"'3'!AP86","v":0},{"$f":"'3'!AQ86","v":0},{"$f":"'3'!AR86","v":0},{"$f":"'3'!AS86","v":0},{"$f":"'3'!AT86","v":0},{"$f":"SUMPRODUCT(IF($N216=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N216=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B87","v":"3"},{"$f":"'3'!C87","v":"3.4"},{"$f":"'3'!D87","v":"3.4.1"},{"$f":"'3'!E87","v":""},{"$f":"'3'!F87","v":"3.4.1.13"},{"$f":"'3'!G87","v":0},{"$f":"'3'!H87","v":0},{"$f":"'3'!I87","v":"3.4.1.13.5"},{"$f":"'3'!J87","v":"3.4.1.13.5: Does risk management for outsourcing assess the effort/time required to switch to an alternate entity providing outsourced services or to bring activity in-house, if necessary?\n"},{"$f":"'3'!K87","v":0},{"$f":"'3'!L87","v":0},{"$f":"'3'!M87","v":"Recommended"},{"$f":"'3'!N87","v":"Recommended"},{"$f":"'3'!O87","v":"FraudRisk"},{"$f":"'3'!P87","v":0},{"$f":"'3'!Q87","v":0},{"$f":"'3'!R87","v":0},{"$f":"'3'!S87","v":0},{"$f":"'3'!T87","v":0},{"$f":"'3'!U87","v":0},{"$f":"'3'!V87","v":0},{"$f":"'3'!W87","v":0},{"$f":"'3'!X87","v":0},{"$f":"'3'!Y87","v":0},{"$f":"'3'!Z87","v":0},{"$f":"'3'!AA87","v":0},{"$f":"'3'!AB87","v":0},{"$f":"'3'!AC87","v":0},{"$f":"'3'!AD87","v":0},{"$f":"'3'!AE87","v":0},{"$f":"'3'!AF87","v":0},{"$f":"'3'!AG87","v":0},{"$f":"'3'!AH87","v":0},{"$f":"'3'!AI87","v":0},{"$f":"'3'!AJ87","v":0},{"$f":"'3'!AK87","v":0},{"$f":"'3'!AL87","v":0},{"$f":"'3'!AM87","v":0},{"$f":"'3'!AN87","v":0},{"$f":"'3'!AO87","v":0},{"$f":"'3'!AP87","v":0},{"$f":"'3'!AQ87","v":0},{"$f":"'3'!AR87","v":0},{"$f":"'3'!AS87","v":0},{"$f":"'3'!AT87","v":0},{"$f":"SUMPRODUCT(IF($N217=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N217=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'3'!B88","v":"3"},{"$f":"'3'!C88","v":"3.4"},{"$f":"'3'!D88","v":"3.4.1"},{"$f":"'3'!E88","v":""},{"$f":"'3'!F88","v":"3.4.1.14"},{"$f":"'3'!G88","v":"3.4.1.14: OUTSOURCING MANAGEMENT - REVIEW OF OUTSOURCED SYSTEMS\nIf the mobile money system (or components of it) are outsourced, providers should review the technical capability of the supplier(s) at regular intervals - at least every two years or following a significant change to the services outsourced - including the following aspects:\n- System high-availability design;\n- Capacity management;\n- Technical operations;\n- Change management;\n- Disaster recovery and contingency plans;\n- IT security."},{"$f":"'3'!H88","v":"BCBS OFS"},{"$f":"'3'!I88","v":"3.4.1.14.1"},{"$f":"'3'!J88","v":"3.4.1.14.1: If the mobile money system (or components of it) are outsourced, is the technical capability of the supplier(s) being reviewed at regular intervals and following any significant changes?\n"},{"$f":"'3'!K88","v":"1) Outsourced risk management process / policy\n- Check that there is a process to review the technical capability of an outsourced function\n- Check that the outsource review plan include regular reviews and details for triggers for review (e.g. following significant changes)\n\n2) Outsourced function contract\n- Check that the contract or agreement includes the right for provider to review the technical capabilities of the outsource supplier."},{"$f":"'3'!L88","v":0},{"$f":"'3'!M88","v":"Recommended"},{"$f":"'3'!N88","v":"Recommended"},{"$f":"'3'!O88","v":"TechOps"},{"$f":"'3'!P88","v":0},{"$f":"'3'!Q88","v":0},{"$f":"'3'!R88","v":0},{"$f":"'3'!S88","v":0},{"$f":"'3'!T88","v":0},{"$f":"'3'!U88","v":0},{"$f":"'3'!V88","v":0},{"$f":"'3'!W88","v":0},{"$f":"'3'!X88","v":0},{"$f":"'3'!Y88","v":0},{"$f":"'3'!Z88","v":0},{"$f":"'3'!AA88","v":0},{"$f":"'3'!AB88","v":0},{"$f":"'3'!AC88","v":0},{"$f":"'3'!AD88","v":0},{"$f":"'3'!AE88","v":0},{"$f":"'3'!AF88","v":0},{"$f":"'3'!AG88","v":0},{"$f":"'3'!AH88","v":0},{"$f":"'3'!AI88","v":0},{"$f":"'3'!AJ88","v":0},{"$f":"'3'!AK88","v":0},{"$f":"'3'!AL88","v":0},{"$f":"'3'!AM88","v":0},{"$f":"'3'!AN88","v":0},{"$f":"'3'!AO88","v":0},{"$f":"'3'!AP88","v":0},{"$f":"'3'!AQ88","v":0},{"$f":"'3'!AR88","v":0},{"$f":"'3'!AS88","v":0},{"$f":"'3'!AT88","v":0},{"$f":"SUMPRODUCT(IF($N218=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N218=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B5","v":"4"},{"$f":"'4'!C5","v":"4.1"},{"$f":"'4'!D5","v":"4.1.1"},{"$f":"'4'!E5","v":"4.1.1: Providers shall ensure that the Board of Directors and senior management establish effective management oversight"},{"$f":"'4'!F5","v":"4.1.1.1"},{"$f":"'4'!G5","v":"4.1.1.1: GOVERNANCE OF MOBILE MONEY BUSINESS\nSenior management should develop a strategy and governance model for the mobile money business. This should:\n\n- define the governance structure and senior roles to manage the mobile money business;\n- define the scope of business that is addressed by mobile money;\n- communicate the importance of fulfilling regulatory requirements;\n- set measurable goals for the operation of the mobile money service (see 4.2);\n- specify management reviews and audits at planned intervals (see 4.2 and 4.1.1.3); and\n- ensure that risks to services are assessed and managed (see 4.6).\n\nThe strategy should be communicated to mobile money staff and should be regularly updated and reviewed for continued suitability.\n\nSenior management should ensure the provision of sufficient resources to fulfil the objectives of the mobile money business."},{"$f":"'4'!H5","v":"ISO 20000-1:2018 Sec. 5.1"},{"$f":"'4'!I5","v":"4.1.1.1.1"},{"$f":"'4'!J5","v":"4.1.1.1.1: Has senior management defined the governance and organization to manage the mobile money business?\n"},{"$f":"'4'!K5","v":"1) Mobile Money organization chart and/or governance documentation\n- Check the the governance structure of the mobile money business is documented.\n- Check the organisation of the mobile money business is documented."},{"$f":"'4'!L5","v":0},{"$f":"'4'!M5","v":"Urgent Required"},{"$f":"'4'!N5","v":"Required"},{"$f":"'4'!O5","v":"BizOps"},{"$f":"'4'!P5","v":0},{"$f":"'4'!Q5","v":0},{"$f":"'4'!R5","v":0},{"$f":"'4'!S5","v":0},{"$f":"'4'!T5","v":0},{"$f":"'4'!U5","v":0},{"$f":"'4'!V5","v":0},{"$f":"'4'!W5","v":0},{"$f":"'4'!X5","v":0},{"$f":"'4'!Y5","v":0},{"$f":"'4'!Z5","v":0},{"$f":"'4'!AA5","v":0},{"$f":"'4'!AB5","v":0},{"$f":"'4'!AC5","v":0},{"$f":"'4'!AD5","v":0},{"$f":"'4'!AE5","v":0},{"$f":"'4'!AF5","v":0},{"$f":"'4'!AG5","v":0},{"$f":"'4'!AH5","v":0},{"$f":"'4'!AI5","v":0},{"$f":"'4'!AJ5","v":0},{"$f":"'4'!AK5","v":0},{"$f":"'4'!AL5","v":0},{"$f":"'4'!AM5","v":0},{"$f":"'4'!AN5","v":0},{"$f":"'4'!AO5","v":0},{"$f":"'4'!AP5","v":0},{"$f":"'4'!AQ5","v":0},{"$f":"'4'!AR5","v":0},{"$f":"'4'!AS5","v":0},{"$f":"'4'!AT5","v":0},{"$f":"SUMPRODUCT(IF($N219=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N219=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B6","v":"4"},{"$f":"'4'!C6","v":"4.1"},{"$f":"'4'!D6","v":"4.1.1"},{"$f":"'4'!E6","v":0},{"$f":"'4'!F6","v":"4.1.1.1"},{"$f":"'4'!G6","v":0},{"$f":"'4'!H6","v":0},{"$f":"'4'!I6","v":"4.1.1.1.2"},{"$f":"'4'!J6","v":"4.1.1.1.2: Is the governance and organization regularly updated and reviewed for continued suitability?\n"},{"$f":"'4'!K6","v":"1) Mobile Money organization chart and/or governance documentation\n- Check the governance and organization model has been reviewed and approved in the last 24 months.\n"},{"$f":"'4'!L6","v":0},{"$f":"'4'!M6","v":"Standard Required"},{"$f":"'4'!N6","v":"Required"},{"$f":"'4'!O6","v":"BizOps"},{"$f":"'4'!P6","v":0},{"$f":"'4'!Q6","v":0},{"$f":"'4'!R6","v":0},{"$f":"'4'!S6","v":0},{"$f":"'4'!T6","v":0},{"$f":"'4'!U6","v":0},{"$f":"'4'!V6","v":0},{"$f":"'4'!W6","v":0},{"$f":"'4'!X6","v":0},{"$f":"'4'!Y6","v":0},{"$f":"'4'!Z6","v":0},{"$f":"'4'!AA6","v":0},{"$f":"'4'!AB6","v":0},{"$f":"'4'!AC6","v":0},{"$f":"'4'!AD6","v":0},{"$f":"'4'!AE6","v":0},{"$f":"'4'!AF6","v":0},{"$f":"'4'!AG6","v":0},{"$f":"'4'!AH6","v":0},{"$f":"'4'!AI6","v":0},{"$f":"'4'!AJ6","v":0},{"$f":"'4'!AK6","v":0},{"$f":"'4'!AL6","v":0},{"$f":"'4'!AM6","v":0},{"$f":"'4'!AN6","v":0},{"$f":"'4'!AO6","v":0},{"$f":"'4'!AP6","v":0},{"$f":"'4'!AQ6","v":0},{"$f":"'4'!AR6","v":0},{"$f":"'4'!AS6","v":0},{"$f":"'4'!AT6","v":0},{"$f":"SUMPRODUCT(IF($N220=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N220=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B7","v":"4"},{"$f":"'4'!C7","v":"4.1"},{"$f":"'4'!D7","v":"4.1.1"},{"$f":"'4'!E7","v":0},{"$f":"'4'!F7","v":"4.1.1.1"},{"$f":"'4'!G7","v":0},{"$f":"'4'!H7","v":0},{"$f":"'4'!I7","v":"4.1.1.1.3"},{"$f":"'4'!J7","v":"4.1.1.1.3: Has the scope of the mobile money business been formally identified and documented?\n"},{"$f":"'4'!K7","v":0},{"$f":"'4'!L7","v":0},{"$f":"'4'!M7","v":"Recommended"},{"$f":"'4'!N7","v":"Recommended"},{"$f":"'4'!O7","v":"BizOps"},{"$f":"'4'!P7","v":0},{"$f":"'4'!Q7","v":0},{"$f":"'4'!R7","v":0},{"$f":"'4'!S7","v":0},{"$f":"'4'!T7","v":0},{"$f":"'4'!U7","v":0},{"$f":"'4'!V7","v":0},{"$f":"'4'!W7","v":0},{"$f":"'4'!X7","v":0},{"$f":"'4'!Y7","v":0},{"$f":"'4'!Z7","v":0},{"$f":"'4'!AA7","v":0},{"$f":"'4'!AB7","v":0},{"$f":"'4'!AC7","v":0},{"$f":"'4'!AD7","v":0},{"$f":"'4'!AE7","v":0},{"$f":"'4'!AF7","v":0},{"$f":"'4'!AG7","v":0},{"$f":"'4'!AH7","v":0},{"$f":"'4'!AI7","v":0},{"$f":"'4'!AJ7","v":0},{"$f":"'4'!AK7","v":0},{"$f":"'4'!AL7","v":0},{"$f":"'4'!AM7","v":0},{"$f":"'4'!AN7","v":0},{"$f":"'4'!AO7","v":0},{"$f":"'4'!AP7","v":0},{"$f":"'4'!AQ7","v":0},{"$f":"'4'!AR7","v":0},{"$f":"'4'!AS7","v":0},{"$f":"'4'!AT7","v":0},{"$f":"SUMPRODUCT(IF($N221=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N221=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B8","v":"4"},{"$f":"'4'!C8","v":"4.1"},{"$f":"'4'!D8","v":"4.1.1"},{"$f":"'4'!E8","v":""},{"$f":"'4'!F8","v":"4.1.1.1"},{"$f":"'4'!G8","v":0},{"$f":"'4'!H8","v":0},{"$f":"'4'!I8","v":"4.1.1.1.4"},{"$f":"'4'!J8","v":"4.1.1.1.4: Does senior management ensure the provision of sufficient resources to fulfil the objectives of the mobile money business?\n"},{"$f":"'4'!K8","v":0},{"$f":"'4'!L8","v":0},{"$f":"'4'!M8","v":"Recommended"},{"$f":"'4'!N8","v":"Recommended"},{"$f":"'4'!O8","v":"BizOps"},{"$f":"'4'!P8","v":0},{"$f":"'4'!Q8","v":0},{"$f":"'4'!R8","v":0},{"$f":"'4'!S8","v":0},{"$f":"'4'!T8","v":0},{"$f":"'4'!U8","v":0},{"$f":"'4'!V8","v":0},{"$f":"'4'!W8","v":0},{"$f":"'4'!X8","v":0},{"$f":"'4'!Y8","v":0},{"$f":"'4'!Z8","v":0},{"$f":"'4'!AA8","v":0},{"$f":"'4'!AB8","v":0},{"$f":"'4'!AC8","v":0},{"$f":"'4'!AD8","v":0},{"$f":"'4'!AE8","v":0},{"$f":"'4'!AF8","v":0},{"$f":"'4'!AG8","v":0},{"$f":"'4'!AH8","v":0},{"$f":"'4'!AI8","v":0},{"$f":"'4'!AJ8","v":0},{"$f":"'4'!AK8","v":0},{"$f":"'4'!AL8","v":0},{"$f":"'4'!AM8","v":0},{"$f":"'4'!AN8","v":0},{"$f":"'4'!AO8","v":0},{"$f":"'4'!AP8","v":0},{"$f":"'4'!AQ8","v":0},{"$f":"'4'!AR8","v":0},{"$f":"'4'!AS8","v":0},{"$f":"'4'!AT8","v":0},{"$f":"SUMPRODUCT(IF($N222=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N222=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B9","v":"4"},{"$f":"'4'!C9","v":"4.1"},{"$f":"'4'!D9","v":"4.1.1"},{"$f":"'4'!E9","v":""},{"$f":"'4'!F9","v":"4.1.1.2"},{"$f":"'4'!G9","v":"4.1.1.2: HEAD OF MOBILE MONEY\nThe mobile money provider should appoint a head of mobile money, who is responsible for operating the mobile money service. The manager should:\n\n- ensure that managers are assigned for each function of service operation;\n- ensure appropriate documentation is produced for each area of service operation;\n- ensure that all operations (internal and via third parties) are managed to meet the goals of the service;\n- regularly report to senior management in service management reviews."},{"$f":"'4'!H9","v":"ISO 20000-1:2018 Sec. 5.1"},{"$f":"'4'!I9","v":"4.1.1.2.1"},{"$f":"'4'!J9","v":"4.1.1.2.1: Has a head of mobile money been assigned, who is responsible for operating the mobile money service?\n"},{"$f":"'4'!K9","v":"1) Mobile Money organization chart and/or governance documentation\n- Check a position exists for the Head of mobile money, and \n- Check responsibility for managing the mobile money business has been assigned to that position.  \n- Check that the position is currently filled.\n"},{"$f":"'4'!L9","v":0},{"$f":"'4'!M9","v":"Urgent Required"},{"$f":"'4'!N9","v":"Required"},{"$f":"'4'!O9","v":"BizOps"},{"$f":"'4'!P9","v":0},{"$f":"'4'!Q9","v":0},{"$f":"'4'!R9","v":0},{"$f":"'4'!S9","v":0},{"$f":"'4'!T9","v":0},{"$f":"'4'!U9","v":0},{"$f":"'4'!V9","v":0},{"$f":"'4'!W9","v":0},{"$f":"'4'!X9","v":0},{"$f":"'4'!Y9","v":0},{"$f":"'4'!Z9","v":0},{"$f":"'4'!AA9","v":0},{"$f":"'4'!AB9","v":0},{"$f":"'4'!AC9","v":0},{"$f":"'4'!AD9","v":0},{"$f":"'4'!AE9","v":0},{"$f":"'4'!AF9","v":0},{"$f":"'4'!AG9","v":0},{"$f":"'4'!AH9","v":0},{"$f":"'4'!AI9","v":0},{"$f":"'4'!AJ9","v":0},{"$f":"'4'!AK9","v":0},{"$f":"'4'!AL9","v":0},{"$f":"'4'!AM9","v":0},{"$f":"'4'!AN9","v":0},{"$f":"'4'!AO9","v":0},{"$f":"'4'!AP9","v":0},{"$f":"'4'!AQ9","v":0},{"$f":"'4'!AR9","v":0},{"$f":"'4'!AS9","v":0},{"$f":"'4'!AT9","v":0},{"$f":"SUMPRODUCT(IF($N223=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N223=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B10","v":"4"},{"$f":"'4'!C10","v":"4.1"},{"$f":"'4'!D10","v":"4.1.1"},{"$f":"'4'!E10","v":""},{"$f":"'4'!F10","v":"4.1.1.2"},{"$f":"'4'!G10","v":0},{"$f":"'4'!H10","v":0},{"$f":"'4'!I10","v":"4.1.1.2.2"},{"$f":"'4'!J10","v":"4.1.1.2.2: Does the head of mobile money report regularly to senior management on the performance of the mobile money service?\n"},{"$f":"'4'!K10","v":"1) Mobile money performance reports / service review report\n- Check that a mobile money performance report or service review report has been produced in the last six months.\n- Check that the report was sent to senior management."},{"$f":"'4'!L10","v":0},{"$f":"'4'!M10","v":"Urgent Required"},{"$f":"'4'!N10","v":"Required"},{"$f":"'4'!O10","v":"BizOps"},{"$f":"'4'!P10","v":0},{"$f":"'4'!Q10","v":0},{"$f":"'4'!R10","v":0},{"$f":"'4'!S10","v":0},{"$f":"'4'!T10","v":0},{"$f":"'4'!U10","v":0},{"$f":"'4'!V10","v":0},{"$f":"'4'!W10","v":0},{"$f":"'4'!X10","v":0},{"$f":"'4'!Y10","v":0},{"$f":"'4'!Z10","v":0},{"$f":"'4'!AA10","v":0},{"$f":"'4'!AB10","v":0},{"$f":"'4'!AC10","v":0},{"$f":"'4'!AD10","v":0},{"$f":"'4'!AE10","v":0},{"$f":"'4'!AF10","v":0},{"$f":"'4'!AG10","v":0},{"$f":"'4'!AH10","v":0},{"$f":"'4'!AI10","v":0},{"$f":"'4'!AJ10","v":0},{"$f":"'4'!AK10","v":0},{"$f":"'4'!AL10","v":0},{"$f":"'4'!AM10","v":0},{"$f":"'4'!AN10","v":0},{"$f":"'4'!AO10","v":0},{"$f":"'4'!AP10","v":0},{"$f":"'4'!AQ10","v":0},{"$f":"'4'!AR10","v":0},{"$f":"'4'!AS10","v":0},{"$f":"'4'!AT10","v":0},{"$f":"SUMPRODUCT(IF($N224=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N224=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B11","v":"4"},{"$f":"'4'!C11","v":"4.1"},{"$f":"'4'!D11","v":"4.1.1"},{"$f":"'4'!E11","v":""},{"$f":"'4'!F11","v":"4.1.1.3"},{"$f":"'4'!G11","v":"4.1.1.3: MOBILE MONEY AUDIT\nRegular audits or compliance reviews of the mobile money service should be carried out on behalf of senior management. In setting up the review, the following should be adhered to:\n- The scope and purpose should be defined - typically to evaluate whether the MM governance, internal control and risk management processes are operating effectively;\n- Reviewers could be internal and/or external, provided that they are independent - for example, the compliance function could do the review;\n- Planning of the audit / review should take into account the importance of the services, processes and areas to be audited and the results of previous reviews.\n- An Internal Audit function is created that reports directly to the Head of Mobile Money and its report is distributed to relevant management.\n"},{"$f":"'4'!H11","v":"ISO 20000-2:2019 Sec. 9.2"},{"$f":"'4'!I11","v":"4.1.1.3.1"},{"$f":"'4'!J11","v":"4.1.1.3.1: is an audit or compliance review of the mobile money service (or high-risk activities of mobile money) done to evaluate the MM governance, internal control and risk management processes - at least every two years and reporting to senior management?\n"},{"$f":"'4'!K11","v":"1. Header page of last audit, or audit policy/process/plan, or compliance framework\n- Check that an audit or compliance review of mobile money is performed at least every 2 years by an independent function (e.g. internal audit or compliance team).\n"},{"$f":"'4'!L11","v":0},{"$f":"'4'!M11","v":"Urgent Required"},{"$f":"'4'!N11","v":"Required"},{"$f":"'4'!O11","v":"BizOps"},{"$f":"'4'!P11","v":0},{"$f":"'4'!Q11","v":0},{"$f":"'4'!R11","v":0},{"$f":"'4'!S11","v":0},{"$f":"'4'!T11","v":0},{"$f":"'4'!U11","v":0},{"$f":"'4'!V11","v":0},{"$f":"'4'!W11","v":0},{"$f":"'4'!X11","v":0},{"$f":"'4'!Y11","v":0},{"$f":"'4'!Z11","v":0},{"$f":"'4'!AA11","v":0},{"$f":"'4'!AB11","v":0},{"$f":"'4'!AC11","v":0},{"$f":"'4'!AD11","v":0},{"$f":"'4'!AE11","v":0},{"$f":"'4'!AF11","v":0},{"$f":"'4'!AG11","v":0},{"$f":"'4'!AH11","v":0},{"$f":"'4'!AI11","v":0},{"$f":"'4'!AJ11","v":0},{"$f":"'4'!AK11","v":0},{"$f":"'4'!AL11","v":0},{"$f":"'4'!AM11","v":0},{"$f":"'4'!AN11","v":0},{"$f":"'4'!AO11","v":0},{"$f":"'4'!AP11","v":0},{"$f":"'4'!AQ11","v":0},{"$f":"'4'!AR11","v":0},{"$f":"'4'!AS11","v":0},{"$f":"'4'!AT11","v":0},{"$f":"SUMPRODUCT(IF($N225=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N225=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B12","v":"4"},{"$f":"'4'!C12","v":"4.1"},{"$f":"'4'!D12","v":"4.1.1"},{"$f":"'4'!E12","v":""},{"$f":"'4'!F12","v":"4.1.1.3"},{"$f":"'4'!G12","v":0},{"$f":"'4'!H12","v":0},{"$f":"'4'!I12","v":"4.1.1.3.2"},{"$f":"'4'!J12","v":"4.1.1.3.2: Are issues raised by audits / compliance reviews being followed up by senior management to ensure they are addressed promptly?\n"},{"$f":"'4'!K12","v":"1) Records of last audit, or audit policy/process/plan, or compliance framework\n- Check that issues raised by audits/compliance reviews are being followed up by senior management to ensure they are addressed promptly\n(Note: Records of the last audit / review could be redacted to remove sensitive contents but to show that actions are being followed up. Alternatively, the process documentation could be used as evidence)"},{"$f":"'4'!L12","v":0},{"$f":"'4'!M12","v":"Standard Required"},{"$f":"'4'!N12","v":"Required"},{"$f":"'4'!O12","v":"BizOps"},{"$f":"'4'!P12","v":0},{"$f":"'4'!Q12","v":0},{"$f":"'4'!R12","v":0},{"$f":"'4'!S12","v":0},{"$f":"'4'!T12","v":0},{"$f":"'4'!U12","v":0},{"$f":"'4'!V12","v":0},{"$f":"'4'!W12","v":0},{"$f":"'4'!X12","v":0},{"$f":"'4'!Y12","v":0},{"$f":"'4'!Z12","v":0},{"$f":"'4'!AA12","v":0},{"$f":"'4'!AB12","v":0},{"$f":"'4'!AC12","v":0},{"$f":"'4'!AD12","v":0},{"$f":"'4'!AE12","v":0},{"$f":"'4'!AF12","v":0},{"$f":"'4'!AG12","v":0},{"$f":"'4'!AH12","v":0},{"$f":"'4'!AI12","v":0},{"$f":"'4'!AJ12","v":0},{"$f":"'4'!AK12","v":0},{"$f":"'4'!AL12","v":0},{"$f":"'4'!AM12","v":0},{"$f":"'4'!AN12","v":0},{"$f":"'4'!AO12","v":0},{"$f":"'4'!AP12","v":0},{"$f":"'4'!AQ12","v":0},{"$f":"'4'!AR12","v":0},{"$f":"'4'!AS12","v":0},{"$f":"'4'!AT12","v":0},{"$f":"SUMPRODUCT(IF($N226=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N226=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B13","v":"4"},{"$f":"'4'!C13","v":"4.1"},{"$f":"'4'!D13","v":"4.1.1"},{"$f":"'4'!E13","v":""},{"$f":"'4'!F13","v":"4.1.1.3"},{"$f":"'4'!G13","v":0},{"$f":"'4'!H13","v":0},{"$f":"'4'!I13","v":"4.1.1.3.3"},{"$f":"'4'!J13","v":"4.1.1.3.3: Does the planning of the review take into account the importance of the services, processes and areas to be reviewed and the results of previous reviews?\n"},{"$f":"'4'!K13","v":0},{"$f":"'4'!L13","v":0},{"$f":"'4'!M13","v":"Recommended"},{"$f":"'4'!N13","v":"Recommended"},{"$f":"'4'!O13","v":"BizOps"},{"$f":"'4'!P13","v":0},{"$f":"'4'!Q13","v":0},{"$f":"'4'!R13","v":0},{"$f":"'4'!S13","v":0},{"$f":"'4'!T13","v":0},{"$f":"'4'!U13","v":0},{"$f":"'4'!V13","v":0},{"$f":"'4'!W13","v":0},{"$f":"'4'!X13","v":0},{"$f":"'4'!Y13","v":0},{"$f":"'4'!Z13","v":0},{"$f":"'4'!AA13","v":0},{"$f":"'4'!AB13","v":0},{"$f":"'4'!AC13","v":0},{"$f":"'4'!AD13","v":0},{"$f":"'4'!AE13","v":0},{"$f":"'4'!AF13","v":0},{"$f":"'4'!AG13","v":0},{"$f":"'4'!AH13","v":0},{"$f":"'4'!AI13","v":0},{"$f":"'4'!AJ13","v":0},{"$f":"'4'!AK13","v":0},{"$f":"'4'!AL13","v":0},{"$f":"'4'!AM13","v":0},{"$f":"'4'!AN13","v":0},{"$f":"'4'!AO13","v":0},{"$f":"'4'!AP13","v":0},{"$f":"'4'!AQ13","v":0},{"$f":"'4'!AR13","v":0},{"$f":"'4'!AS13","v":0},{"$f":"'4'!AT13","v":0},{"$f":"SUMPRODUCT(IF($N227=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N227=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B14","v":"4"},{"$f":"'4'!C14","v":"4.1"},{"$f":"'4'!D14","v":"4.1.1"},{"$f":"'4'!E14","v":""},{"$f":"'4'!F14","v":"4.1.1.4"},{"$f":"'4'!G14","v":"4.1.1.4: DOCUMENT MANAGEMENT POLICY\nA policy for document management should be documented and implemented. The policy should ensure that all business activities are properly documented. The document management policy should specify the following:\n- Each business function should be governed by its own documented policy.\n- All business processes should be documented.\n- Agreements with customers and suppliers should be documented and include service levels.\n- All documents should be reviewed and updated regularly.\n- Change controls should be implemented to manage changes to documents, with new versions of documents recorded using a proper change log.\n- Document retention should be specified, including old versions of documents."},{"$f":"'4'!H14","v":"ISO 20000-1:2011 Sec. 4.3"},{"$f":"'4'!I14","v":"4.1.1.4.1"},{"$f":"'4'!J14","v":"4.1.1.4.1: Has a document management policy, that requires all business activities to be properly documented, been specified and implemented?\n"},{"$f":"'4'!K14","v":"1. A Document management policy is in place which requires that all business activities are documented. Check that the policy requires:\n - all business units have documented policies;\n - all business processes are documented;\n - all customer and supplier contracts are documented and contain an SLA.\nCheck that the document management policy specifies document review periods, change control processes, version control and storage and retrieval processes.\nCheck that the policy has been signed by the current senior management team in the last 2 years."},{"$f":"'4'!L14","v":0},{"$f":"'4'!M14","v":"Recommended"},{"$f":"'4'!N14","v":"Recommended"},{"$f":"'4'!O14","v":"BizOps"},{"$f":"'4'!P14","v":0},{"$f":"'4'!Q14","v":0},{"$f":"'4'!R14","v":0},{"$f":"'4'!S14","v":0},{"$f":"'4'!T14","v":0},{"$f":"'4'!U14","v":0},{"$f":"'4'!V14","v":0},{"$f":"'4'!W14","v":0},{"$f":"'4'!X14","v":0},{"$f":"'4'!Y14","v":0},{"$f":"'4'!Z14","v":0},{"$f":"'4'!AA14","v":0},{"$f":"'4'!AB14","v":0},{"$f":"'4'!AC14","v":0},{"$f":"'4'!AD14","v":0},{"$f":"'4'!AE14","v":0},{"$f":"'4'!AF14","v":0},{"$f":"'4'!AG14","v":0},{"$f":"'4'!AH14","v":0},{"$f":"'4'!AI14","v":0},{"$f":"'4'!AJ14","v":0},{"$f":"'4'!AK14","v":0},{"$f":"'4'!AL14","v":0},{"$f":"'4'!AM14","v":0},{"$f":"'4'!AN14","v":0},{"$f":"'4'!AO14","v":0},{"$f":"'4'!AP14","v":0},{"$f":"'4'!AQ14","v":0},{"$f":"'4'!AR14","v":0},{"$f":"'4'!AS14","v":0},{"$f":"'4'!AT14","v":0},{"$f":"SUMPRODUCT(IF($N228=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N228=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B16","v":"4"},{"$f":"'4'!C16","v":"4.2"},{"$f":"'4'!D16","v":"4.2.1"},{"$f":"'4'!E16","v":"4.2.1: Providers and partners should operate technical systems properly and manage service levels"},{"$f":"'4'!F16","v":"4.2.1.1"},{"$f":"'4'!G16","v":"4.2.1.1: TECHNICAL OPERATIONS\nThe provider should create, implement and maintain technical operations documentation, which should include:\n1. Functional architecture and infrastructure architecture;\n2. Scheduled operational activities and dependencies. Include:;\n     - manual processes for manipulating systems or files (e.g. log file maintenance, renewing certificates);\n     - scheduling of regular jobs;\n     - instructions for handling errors or other exceptional conditions that might arise;\n     - system or component restart and recovery procedures for use in the event of errors or failures;\n     - backup of data and storage of backup material (see 5.3.5.2);\n     - management of system logs and system monitoring (see 5.3.6).\n\nOther technical operations documentation should include:\n - Effort and resources definition, including an organizational chart;\n - Compliance (e.g. ISO, PCI DSS, ITIL);\n - Operational management tools;\n - Risks to technical operations;\n - Planned activities (e.g. upgrades);\n - Governance, communication and reporting plan;\n - Service levels (see elsewhere in 4.2.1);\n - Incident support and escalation (see 4.4).\n\nRegular reviews and improvements should be part of the process."},{"$f":"'4'!H16","v":"ISO 20000-1:2018 Sec 6.3"},{"$f":"'4'!I16","v":"4.2.1.1.1"},{"$f":"'4'!J16","v":"4.2.1.1.1: Is documentation in place to define all technical operations activities of the mobile money system, including regular and scheduled technical operations tasks?\n"},{"$f":"'4'!K16","v":"1) Operational process documentation\n- Check this appears complete\n- Check this includes a process for regular / scheduled operational activities\n- Check the plan has been implemented \n"},{"$f":"'4'!L16","v":0},{"$f":"'4'!M16","v":"Urgent Required"},{"$f":"'4'!N16","v":"Required"},{"$f":"'4'!O16","v":"TechOps"},{"$f":"'4'!P16","v":0},{"$f":"'4'!Q16","v":0},{"$f":"'4'!R16","v":0},{"$f":"'4'!S16","v":0},{"$f":"'4'!T16","v":0},{"$f":"'4'!U16","v":0},{"$f":"'4'!V16","v":0},{"$f":"'4'!W16","v":0},{"$f":"'4'!X16","v":0},{"$f":"'4'!Y16","v":0},{"$f":"'4'!Z16","v":0},{"$f":"'4'!AA16","v":0},{"$f":"'4'!AB16","v":0},{"$f":"'4'!AC16","v":0},{"$f":"'4'!AD16","v":0},{"$f":"'4'!AE16","v":0},{"$f":"'4'!AF16","v":0},{"$f":"'4'!AG16","v":0},{"$f":"'4'!AH16","v":0},{"$f":"'4'!AI16","v":0},{"$f":"'4'!AJ16","v":0},{"$f":"'4'!AK16","v":0},{"$f":"'4'!AL16","v":0},{"$f":"'4'!AM16","v":0},{"$f":"'4'!AN16","v":0},{"$f":"'4'!AO16","v":0},{"$f":"'4'!AP16","v":0},{"$f":"'4'!AQ16","v":0},{"$f":"'4'!AR16","v":0},{"$f":"'4'!AS16","v":0},{"$f":"'4'!AT16","v":0},{"$f":"SUMPRODUCT(IF($N229=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N229=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B17","v":"4"},{"$f":"'4'!C17","v":"4.2"},{"$f":"'4'!D17","v":"4.2.1"},{"$f":"'4'!E17","v":0},{"$f":"'4'!F17","v":"4.2.1.1"},{"$f":"'4'!G17","v":0},{"$f":"'4'!H17","v":0},{"$f":"'4'!I17","v":"4.2.1.1.2"},{"$f":"'4'!J17","v":"4.2.1.1.2: Are the functional architecture and infrastructure architecture of the mobile money system documented?\n"},{"$f":"'4'!K17","v":"1) System architecture specification\n- Check both the functional and technical architecture has been documented"},{"$f":"'4'!L17","v":0},{"$f":"'4'!M17","v":"Urgent Required"},{"$f":"'4'!N17","v":"Required"},{"$f":"'4'!O17","v":"TechOps"},{"$f":"'4'!P17","v":0},{"$f":"'4'!Q17","v":0},{"$f":"'4'!R17","v":0},{"$f":"'4'!S17","v":0},{"$f":"'4'!T17","v":0},{"$f":"'4'!U17","v":0},{"$f":"'4'!V17","v":0},{"$f":"'4'!W17","v":0},{"$f":"'4'!X17","v":0},{"$f":"'4'!Y17","v":0},{"$f":"'4'!Z17","v":0},{"$f":"'4'!AA17","v":0},{"$f":"'4'!AB17","v":0},{"$f":"'4'!AC17","v":0},{"$f":"'4'!AD17","v":0},{"$f":"'4'!AE17","v":0},{"$f":"'4'!AF17","v":0},{"$f":"'4'!AG17","v":0},{"$f":"'4'!AH17","v":0},{"$f":"'4'!AI17","v":0},{"$f":"'4'!AJ17","v":0},{"$f":"'4'!AK17","v":0},{"$f":"'4'!AL17","v":0},{"$f":"'4'!AM17","v":0},{"$f":"'4'!AN17","v":0},{"$f":"'4'!AO17","v":0},{"$f":"'4'!AP17","v":0},{"$f":"'4'!AQ17","v":0},{"$f":"'4'!AR17","v":0},{"$f":"'4'!AS17","v":0},{"$f":"'4'!AT17","v":0},{"$f":"SUMPRODUCT(IF($N230=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N230=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B18","v":"4"},{"$f":"'4'!C18","v":"4.2"},{"$f":"'4'!D18","v":"4.2.1"},{"$f":"'4'!E18","v":0},{"$f":"'4'!F18","v":"4.2.1.1"},{"$f":"'4'!G18","v":0},{"$f":"'4'!H18","v":0},{"$f":"'4'!I18","v":"4.2.1.1.3"},{"$f":"'4'!J18","v":"4.2.1.1.3: Are the required resources documented, including an organizational chart and/or responsibility assignment matrix (RACI)?\n"},{"$f":"'4'!K18","v":"1) Organizational chart and/or responsibility assignment matrix (RACI) for all organizations supporting the platform (both internal and external, if applicable).\n- Check that the plan includes identification of required resources either by Technical operations organization chart and/or responsibility matrix.\n\n"},{"$f":"'4'!L18","v":0},{"$f":"'4'!M18","v":"Standard Required"},{"$f":"'4'!N18","v":"Required"},{"$f":"'4'!O18","v":"TechOps"},{"$f":"'4'!P18","v":0},{"$f":"'4'!Q18","v":0},{"$f":"'4'!R18","v":0},{"$f":"'4'!S18","v":0},{"$f":"'4'!T18","v":0},{"$f":"'4'!U18","v":0},{"$f":"'4'!V18","v":0},{"$f":"'4'!W18","v":0},{"$f":"'4'!X18","v":0},{"$f":"'4'!Y18","v":0},{"$f":"'4'!Z18","v":0},{"$f":"'4'!AA18","v":0},{"$f":"'4'!AB18","v":0},{"$f":"'4'!AC18","v":0},{"$f":"'4'!AD18","v":0},{"$f":"'4'!AE18","v":0},{"$f":"'4'!AF18","v":0},{"$f":"'4'!AG18","v":0},{"$f":"'4'!AH18","v":0},{"$f":"'4'!AI18","v":0},{"$f":"'4'!AJ18","v":0},{"$f":"'4'!AK18","v":0},{"$f":"'4'!AL18","v":0},{"$f":"'4'!AM18","v":0},{"$f":"'4'!AN18","v":0},{"$f":"'4'!AO18","v":0},{"$f":"'4'!AP18","v":0},{"$f":"'4'!AQ18","v":0},{"$f":"'4'!AR18","v":0},{"$f":"'4'!AS18","v":0},{"$f":"'4'!AT18","v":0},{"$f":"SUMPRODUCT(IF($N231=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N231=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B19","v":"4"},{"$f":"'4'!C19","v":"4.2"},{"$f":"'4'!D19","v":"4.2.1"},{"$f":"'4'!E19","v":""},{"$f":"'4'!F19","v":"4.2.1.1"},{"$f":"'4'!G19","v":0},{"$f":"'4'!H19","v":0},{"$f":"'4'!I19","v":"4.2.1.1.4"},{"$f":"'4'!J19","v":"4.2.1.1.4: Is the process for planned activities (e.g. upgrades) specified in the technical operations documentation so that they can be managed appropriately?\n"},{"$f":"'4'!K19","v":0},{"$f":"'4'!L19","v":0},{"$f":"'4'!M19","v":"Recommended"},{"$f":"'4'!N19","v":"Recommended"},{"$f":"'4'!O19","v":"TechOps"},{"$f":"'4'!P19","v":0},{"$f":"'4'!Q19","v":0},{"$f":"'4'!R19","v":0},{"$f":"'4'!S19","v":0},{"$f":"'4'!T19","v":0},{"$f":"'4'!U19","v":0},{"$f":"'4'!V19","v":0},{"$f":"'4'!W19","v":0},{"$f":"'4'!X19","v":0},{"$f":"'4'!Y19","v":0},{"$f":"'4'!Z19","v":0},{"$f":"'4'!AA19","v":0},{"$f":"'4'!AB19","v":0},{"$f":"'4'!AC19","v":0},{"$f":"'4'!AD19","v":0},{"$f":"'4'!AE19","v":0},{"$f":"'4'!AF19","v":0},{"$f":"'4'!AG19","v":0},{"$f":"'4'!AH19","v":0},{"$f":"'4'!AI19","v":0},{"$f":"'4'!AJ19","v":0},{"$f":"'4'!AK19","v":0},{"$f":"'4'!AL19","v":0},{"$f":"'4'!AM19","v":0},{"$f":"'4'!AN19","v":0},{"$f":"'4'!AO19","v":0},{"$f":"'4'!AP19","v":0},{"$f":"'4'!AQ19","v":0},{"$f":"'4'!AR19","v":0},{"$f":"'4'!AS19","v":0},{"$f":"'4'!AT19","v":0},{"$f":"SUMPRODUCT(IF($N232=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N232=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B20","v":"4"},{"$f":"'4'!C20","v":"4.2"},{"$f":"'4'!D20","v":"4.2.1"},{"$f":"'4'!E20","v":""},{"$f":"'4'!F20","v":"4.2.1.1"},{"$f":"'4'!G20","v":0},{"$f":"'4'!H20","v":0},{"$f":"'4'!I20","v":"4.2.1.1.5"},{"$f":"'4'!J20","v":"4.2.1.1.5: Is the technical operations documentation reviewed at planned intervals to ensure its continued suitability and effectiveness and to make improvements as necessary?\n"},{"$f":"'4'!K20","v":0},{"$f":"'4'!L20","v":0},{"$f":"'4'!M20","v":"Recommended"},{"$f":"'4'!N20","v":"Recommended"},{"$f":"'4'!O20","v":"TechOps"},{"$f":"'4'!P20","v":0},{"$f":"'4'!Q20","v":0},{"$f":"'4'!R20","v":0},{"$f":"'4'!S20","v":0},{"$f":"'4'!T20","v":0},{"$f":"'4'!U20","v":0},{"$f":"'4'!V20","v":0},{"$f":"'4'!W20","v":0},{"$f":"'4'!X20","v":0},{"$f":"'4'!Y20","v":0},{"$f":"'4'!Z20","v":0},{"$f":"'4'!AA20","v":0},{"$f":"'4'!AB20","v":0},{"$f":"'4'!AC20","v":0},{"$f":"'4'!AD20","v":0},{"$f":"'4'!AE20","v":0},{"$f":"'4'!AF20","v":0},{"$f":"'4'!AG20","v":0},{"$f":"'4'!AH20","v":0},{"$f":"'4'!AI20","v":0},{"$f":"'4'!AJ20","v":0},{"$f":"'4'!AK20","v":0},{"$f":"'4'!AL20","v":0},{"$f":"'4'!AM20","v":0},{"$f":"'4'!AN20","v":0},{"$f":"'4'!AO20","v":0},{"$f":"'4'!AP20","v":0},{"$f":"'4'!AQ20","v":0},{"$f":"'4'!AR20","v":0},{"$f":"'4'!AS20","v":0},{"$f":"'4'!AT20","v":0},{"$f":"SUMPRODUCT(IF($N233=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N233=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B21","v":"4"},{"$f":"'4'!C21","v":"4.2"},{"$f":"'4'!D21","v":"4.2.1"},{"$f":"'4'!E21","v":""},{"$f":"'4'!F21","v":"4.2.1.2"},{"$f":"'4'!G21","v":"4.2.1.2: BACKUPS\nProviders should implement a process for backups of the mobile money system, which determines: \n- the data that should be backed up;\n- the frequency of backups;\n- the mechanism for making backups;\n- the storage of backups;\n- the data retention period.\n\nBackups of the mobile money system and all financial data should be implemented according to the policy and carried out at least daily. Financial data should be backed up by replication to the Disaster Recovery site.\n\nBackups should be stored securely offsite (e.g. at a second data centre or a commercial storage facility) and securely disposed of when the retention period is passed. \n\nA process for restoring backed-up data should be implemented and tested."},{"$f":"'4'!H21","v":"PCI DSS, ISO 27002:2013 Sec. 12.3 "},{"$f":"'4'!I21","v":"4.2.1.2.1"},{"$f":"'4'!J21","v":"4.2.1.2.1: Has a process for mobile money system backups been documented that determines the data that is backed up, the frequency of backups and the data retention period?\n"},{"$f":"'4'!K21","v":"1) Backup process documentation\n- Check that the backup process has been documented\n- Check that the document includes details on:\n     a) The data that should be backed up;\n     b) The frequency of backups;\n     c) The data retention period."},{"$f":"'4'!L21","v":0},{"$f":"'4'!M21","v":"Standard Required"},{"$f":"'4'!N21","v":"Required"},{"$f":"'4'!O21","v":"TechOps"},{"$f":"'4'!P21","v":0},{"$f":"'4'!Q21","v":0},{"$f":"'4'!R21","v":0},{"$f":"'4'!S21","v":0},{"$f":"'4'!T21","v":0},{"$f":"'4'!U21","v":0},{"$f":"'4'!V21","v":0},{"$f":"'4'!W21","v":0},{"$f":"'4'!X21","v":0},{"$f":"'4'!Y21","v":0},{"$f":"'4'!Z21","v":0},{"$f":"'4'!AA21","v":0},{"$f":"'4'!AB21","v":0},{"$f":"'4'!AC21","v":0},{"$f":"'4'!AD21","v":0},{"$f":"'4'!AE21","v":0},{"$f":"'4'!AF21","v":0},{"$f":"'4'!AG21","v":0},{"$f":"'4'!AH21","v":0},{"$f":"'4'!AI21","v":0},{"$f":"'4'!AJ21","v":0},{"$f":"'4'!AK21","v":0},{"$f":"'4'!AL21","v":0},{"$f":"'4'!AM21","v":0},{"$f":"'4'!AN21","v":0},{"$f":"'4'!AO21","v":0},{"$f":"'4'!AP21","v":0},{"$f":"'4'!AQ21","v":0},{"$f":"'4'!AR21","v":0},{"$f":"'4'!AS21","v":0},{"$f":"'4'!AT21","v":0},{"$f":"SUMPRODUCT(IF($N234=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N234=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B22","v":"4"},{"$f":"'4'!C22","v":"4.2"},{"$f":"'4'!D22","v":"4.2.1"},{"$f":"'4'!E22","v":""},{"$f":"'4'!F22","v":"4.2.1.2"},{"$f":"'4'!G22","v":0},{"$f":"'4'!H22","v":0},{"$f":"'4'!I22","v":"4.2.1.2.2"},{"$f":"'4'!J22","v":"4.2.1.2.2: Is the mobile money system and all financial data backed up at least daily?\n"},{"$f":"'4'!K22","v":"1) Backup process documentation or backup logs\n- Check that the frequency of backup of the mobile money system is at least daily\n- Check that the backup includes all financial data"},{"$f":"'4'!L22","v":0},{"$f":"'4'!M22","v":"Urgent Required"},{"$f":"'4'!N22","v":"Required"},{"$f":"'4'!O22","v":"TechOps"},{"$f":"'4'!P22","v":0},{"$f":"'4'!Q22","v":0},{"$f":"'4'!R22","v":0},{"$f":"'4'!S22","v":0},{"$f":"'4'!T22","v":0},{"$f":"'4'!U22","v":0},{"$f":"'4'!V22","v":0},{"$f":"'4'!W22","v":0},{"$f":"'4'!X22","v":0},{"$f":"'4'!Y22","v":0},{"$f":"'4'!Z22","v":0},{"$f":"'4'!AA22","v":0},{"$f":"'4'!AB22","v":0},{"$f":"'4'!AC22","v":0},{"$f":"'4'!AD22","v":0},{"$f":"'4'!AE22","v":0},{"$f":"'4'!AF22","v":0},{"$f":"'4'!AG22","v":0},{"$f":"'4'!AH22","v":0},{"$f":"'4'!AI22","v":0},{"$f":"'4'!AJ22","v":0},{"$f":"'4'!AK22","v":0},{"$f":"'4'!AL22","v":0},{"$f":"'4'!AM22","v":0},{"$f":"'4'!AN22","v":0},{"$f":"'4'!AO22","v":0},{"$f":"'4'!AP22","v":0},{"$f":"'4'!AQ22","v":0},{"$f":"'4'!AR22","v":0},{"$f":"'4'!AS22","v":0},{"$f":"'4'!AT22","v":0},{"$f":"SUMPRODUCT(IF($N235=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N235=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B23","v":"4"},{"$f":"'4'!C23","v":"4.2"},{"$f":"'4'!D23","v":"4.2.1"},{"$f":"'4'!E23","v":""},{"$f":"'4'!F23","v":"4.2.1.2"},{"$f":"'4'!G23","v":0},{"$f":"'4'!H23","v":0},{"$f":"'4'!I23","v":"4.2.1.2.3"},{"$f":"'4'!J23","v":"4.2.1.2.3: Are backups stored securely offsite (e.g. at a second data centre or a commercial storage facility)?\n"},{"$f":"'4'!K23","v":"1) Backup process documentation\n- Check that the storage of backup data for the mobile money system is secure and offsite."},{"$f":"'4'!L23","v":0},{"$f":"'4'!M23","v":"Urgent Required"},{"$f":"'4'!N23","v":"Required"},{"$f":"'4'!O23","v":"TechOps"},{"$f":"'4'!P23","v":0},{"$f":"'4'!Q23","v":0},{"$f":"'4'!R23","v":0},{"$f":"'4'!S23","v":0},{"$f":"'4'!T23","v":0},{"$f":"'4'!U23","v":0},{"$f":"'4'!V23","v":0},{"$f":"'4'!W23","v":0},{"$f":"'4'!X23","v":0},{"$f":"'4'!Y23","v":0},{"$f":"'4'!Z23","v":0},{"$f":"'4'!AA23","v":0},{"$f":"'4'!AB23","v":0},{"$f":"'4'!AC23","v":0},{"$f":"'4'!AD23","v":0},{"$f":"'4'!AE23","v":0},{"$f":"'4'!AF23","v":0},{"$f":"'4'!AG23","v":0},{"$f":"'4'!AH23","v":0},{"$f":"'4'!AI23","v":0},{"$f":"'4'!AJ23","v":0},{"$f":"'4'!AK23","v":0},{"$f":"'4'!AL23","v":0},{"$f":"'4'!AM23","v":0},{"$f":"'4'!AN23","v":0},{"$f":"'4'!AO23","v":0},{"$f":"'4'!AP23","v":0},{"$f":"'4'!AQ23","v":0},{"$f":"'4'!AR23","v":0},{"$f":"'4'!AS23","v":0},{"$f":"'4'!AT23","v":0},{"$f":"SUMPRODUCT(IF($N236=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N236=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B24","v":"4"},{"$f":"'4'!C24","v":"4.2"},{"$f":"'4'!D24","v":"4.2.1"},{"$f":"'4'!E24","v":""},{"$f":"'4'!F24","v":"4.2.1.2"},{"$f":"'4'!G24","v":0},{"$f":"'4'!H24","v":0},{"$f":"'4'!I24","v":"4.2.1.2.4"},{"$f":"'4'!J24","v":"4.2.1.2.4: Has a process for restoring backed-up data been implemented and tested?\n"},{"$f":"'4'!K24","v":"1) Backup process documentation\n- Check there is process to restore backed-up data\n\n2) Backup test logs\n- Check that the restoration process has been tested\n"},{"$f":"'4'!L24","v":0},{"$f":"'4'!M24","v":"Standard Required"},{"$f":"'4'!N24","v":"Required"},{"$f":"'4'!O24","v":"TechOps"},{"$f":"'4'!P24","v":0},{"$f":"'4'!Q24","v":0},{"$f":"'4'!R24","v":0},{"$f":"'4'!S24","v":0},{"$f":"'4'!T24","v":0},{"$f":"'4'!U24","v":0},{"$f":"'4'!V24","v":0},{"$f":"'4'!W24","v":0},{"$f":"'4'!X24","v":0},{"$f":"'4'!Y24","v":0},{"$f":"'4'!Z24","v":0},{"$f":"'4'!AA24","v":0},{"$f":"'4'!AB24","v":0},{"$f":"'4'!AC24","v":0},{"$f":"'4'!AD24","v":0},{"$f":"'4'!AE24","v":0},{"$f":"'4'!AF24","v":0},{"$f":"'4'!AG24","v":0},{"$f":"'4'!AH24","v":0},{"$f":"'4'!AI24","v":0},{"$f":"'4'!AJ24","v":0},{"$f":"'4'!AK24","v":0},{"$f":"'4'!AL24","v":0},{"$f":"'4'!AM24","v":0},{"$f":"'4'!AN24","v":0},{"$f":"'4'!AO24","v":0},{"$f":"'4'!AP24","v":0},{"$f":"'4'!AQ24","v":0},{"$f":"'4'!AR24","v":0},{"$f":"'4'!AS24","v":0},{"$f":"'4'!AT24","v":0},{"$f":"SUMPRODUCT(IF($N237=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N237=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B25","v":"4"},{"$f":"'4'!C25","v":"4.2"},{"$f":"'4'!D25","v":"4.2.1"},{"$f":"'4'!E25","v":""},{"$f":"'4'!F25","v":"4.2.1.3"},{"$f":"'4'!G25","v":0},{"$f":"'4'!H25","v":"ISO 20000-1:2018 Sec 6.3"},{"$f":"'4'!I25","v":"4.2.1.3.1"},{"$f":"'4'!J25","v":"4.2.1.3.1: Are service levels defined for the mobile money system for availability and incident response/resolution times?\n"},{"$f":"'4'!K25","v":"1) Service level definition for technical functions\n- Check there are clearly defined service levels for the mobile money system\n- Check the service levels include:\na) Availability \nb) Incident response/resolution times\n"},{"$f":"'4'!L25","v":0},{"$f":"'4'!M25","v":"Urgent Required"},{"$f":"'4'!N25","v":"Required"},{"$f":"'4'!O25","v":"TechOps"},{"$f":"'4'!P25","v":0},{"$f":"'4'!Q25","v":0},{"$f":"'4'!R25","v":0},{"$f":"'4'!S25","v":0},{"$f":"'4'!T25","v":0},{"$f":"'4'!U25","v":0},{"$f":"'4'!V25","v":0},{"$f":"'4'!W25","v":0},{"$f":"'4'!X25","v":0},{"$f":"'4'!Y25","v":0},{"$f":"'4'!Z25","v":0},{"$f":"'4'!AA25","v":0},{"$f":"'4'!AB25","v":0},{"$f":"'4'!AC25","v":0},{"$f":"'4'!AD25","v":0},{"$f":"'4'!AE25","v":0},{"$f":"'4'!AF25","v":0},{"$f":"'4'!AG25","v":0},{"$f":"'4'!AH25","v":0},{"$f":"'4'!AI25","v":0},{"$f":"'4'!AJ25","v":0},{"$f":"'4'!AK25","v":0},{"$f":"'4'!AL25","v":0},{"$f":"'4'!AM25","v":0},{"$f":"'4'!AN25","v":0},{"$f":"'4'!AO25","v":0},{"$f":"'4'!AP25","v":0},{"$f":"'4'!AQ25","v":0},{"$f":"'4'!AR25","v":0},{"$f":"'4'!AS25","v":0},{"$f":"'4'!AT25","v":0},{"$f":"SUMPRODUCT(IF($N238=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N238=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B26","v":"4"},{"$f":"'4'!C26","v":"4.2"},{"$f":"'4'!D26","v":"4.2.1"},{"$f":"'4'!E26","v":""},{"$f":"'4'!F26","v":"4.2.1.3"},{"$f":"'4'!G26","v":0},{"$f":"'4'!H26","v":0},{"$f":"'4'!I26","v":"4.2.1.3.2"},{"$f":"'4'!J26","v":"4.2.1.3.2: Is the availability of the mobile money system being monitored and reported against the service level?\n"},{"$f":"'4'!K26","v":"1) Service level reports for technical functions\n- Check that the availability of the mobile money system is monitored against the service level and reports generated."},{"$f":"'4'!L26","v":0},{"$f":"'4'!M26","v":"Urgent Required"},{"$f":"'4'!N26","v":"Required"},{"$f":"'4'!O26","v":"TechOps"},{"$f":"'4'!P26","v":0},{"$f":"'4'!Q26","v":0},{"$f":"'4'!R26","v":0},{"$f":"'4'!S26","v":0},{"$f":"'4'!T26","v":0},{"$f":"'4'!U26","v":0},{"$f":"'4'!V26","v":0},{"$f":"'4'!W26","v":0},{"$f":"'4'!X26","v":0},{"$f":"'4'!Y26","v":0},{"$f":"'4'!Z26","v":0},{"$f":"'4'!AA26","v":0},{"$f":"'4'!AB26","v":0},{"$f":"'4'!AC26","v":0},{"$f":"'4'!AD26","v":0},{"$f":"'4'!AE26","v":0},{"$f":"'4'!AF26","v":0},{"$f":"'4'!AG26","v":0},{"$f":"'4'!AH26","v":0},{"$f":"'4'!AI26","v":0},{"$f":"'4'!AJ26","v":0},{"$f":"'4'!AK26","v":0},{"$f":"'4'!AL26","v":0},{"$f":"'4'!AM26","v":0},{"$f":"'4'!AN26","v":0},{"$f":"'4'!AO26","v":0},{"$f":"'4'!AP26","v":0},{"$f":"'4'!AQ26","v":0},{"$f":"'4'!AR26","v":0},{"$f":"'4'!AS26","v":0},{"$f":"'4'!AT26","v":0},{"$f":"SUMPRODUCT(IF($N239=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N239=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B27","v":"4"},{"$f":"'4'!C27","v":"4.2"},{"$f":"'4'!D27","v":"4.2.1"},{"$f":"'4'!E27","v":""},{"$f":"'4'!F27","v":"4.2.1.3"},{"$f":"'4'!G27","v":0},{"$f":"'4'!H27","v":0},{"$f":"'4'!I27","v":"4.2.1.3.3"},{"$f":"'4'!J27","v":"4.2.1.3.3: Are incident management reports being produced regularly to indicate whether service level targets are being met?\n"},{"$f":"'4'!K27","v":"1) Service level reports for technical functions\n- Check that incident management reports are being produced regularly to indicate whether service level targets are being met."},{"$f":"'4'!L27","v":0},{"$f":"'4'!M27","v":"Urgent Required"},{"$f":"'4'!N27","v":"Required"},{"$f":"'4'!O27","v":"TechOps"},{"$f":"'4'!P27","v":0},{"$f":"'4'!Q27","v":0},{"$f":"'4'!R27","v":0},{"$f":"'4'!S27","v":0},{"$f":"'4'!T27","v":0},{"$f":"'4'!U27","v":0},{"$f":"'4'!V27","v":0},{"$f":"'4'!W27","v":0},{"$f":"'4'!X27","v":0},{"$f":"'4'!Y27","v":0},{"$f":"'4'!Z27","v":0},{"$f":"'4'!AA27","v":0},{"$f":"'4'!AB27","v":0},{"$f":"'4'!AC27","v":0},{"$f":"'4'!AD27","v":0},{"$f":"'4'!AE27","v":0},{"$f":"'4'!AF27","v":0},{"$f":"'4'!AG27","v":0},{"$f":"'4'!AH27","v":0},{"$f":"'4'!AI27","v":0},{"$f":"'4'!AJ27","v":0},{"$f":"'4'!AK27","v":0},{"$f":"'4'!AL27","v":0},{"$f":"'4'!AM27","v":0},{"$f":"'4'!AN27","v":0},{"$f":"'4'!AO27","v":0},{"$f":"'4'!AP27","v":0},{"$f":"'4'!AQ27","v":0},{"$f":"'4'!AR27","v":0},{"$f":"'4'!AS27","v":0},{"$f":"'4'!AT27","v":0},{"$f":"SUMPRODUCT(IF($N240=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N240=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B28","v":"4"},{"$f":"'4'!C28","v":"4.2"},{"$f":"'4'!D28","v":"4.2.1"},{"$f":"'4'!E28","v":""},{"$f":"'4'!F28","v":"4.2.1.3"},{"$f":"'4'!G28","v":0},{"$f":"'4'!H28","v":0},{"$f":"'4'!I28","v":"4.2.1.3.4"},{"$f":"'4'!J28","v":"4.2.1.3.4: Is the performance of the mobile money system being monitored against its service levels (via end-to-end monitoring) and reported?\n"},{"$f":"'4'!K28","v":0},{"$f":"'4'!L28","v":0},{"$f":"'4'!M28","v":"Recommended"},{"$f":"'4'!N28","v":"Recommended"},{"$f":"'4'!O28","v":"TechOps"},{"$f":"'4'!P28","v":0},{"$f":"'4'!Q28","v":0},{"$f":"'4'!R28","v":0},{"$f":"'4'!S28","v":0},{"$f":"'4'!T28","v":0},{"$f":"'4'!U28","v":0},{"$f":"'4'!V28","v":0},{"$f":"'4'!W28","v":0},{"$f":"'4'!X28","v":0},{"$f":"'4'!Y28","v":0},{"$f":"'4'!Z28","v":0},{"$f":"'4'!AA28","v":0},{"$f":"'4'!AB28","v":0},{"$f":"'4'!AC28","v":0},{"$f":"'4'!AD28","v":0},{"$f":"'4'!AE28","v":0},{"$f":"'4'!AF28","v":0},{"$f":"'4'!AG28","v":0},{"$f":"'4'!AH28","v":0},{"$f":"'4'!AI28","v":0},{"$f":"'4'!AJ28","v":0},{"$f":"'4'!AK28","v":0},{"$f":"'4'!AL28","v":0},{"$f":"'4'!AM28","v":0},{"$f":"'4'!AN28","v":0},{"$f":"'4'!AO28","v":0},{"$f":"'4'!AP28","v":0},{"$f":"'4'!AQ28","v":0},{"$f":"'4'!AR28","v":0},{"$f":"'4'!AS28","v":0},{"$f":"'4'!AT28","v":0},{"$f":"SUMPRODUCT(IF($N241=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N241=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B29","v":"4"},{"$f":"'4'!C29","v":"4.2"},{"$f":"'4'!D29","v":"4.2.1"},{"$f":"'4'!E29","v":""},{"$f":"'4'!F29","v":"4.2.1.3"},{"$f":"'4'!G29","v":0},{"$f":"'4'!H29","v":0},{"$f":"'4'!I29","v":"4.2.1.3.5"},{"$f":"'4'!J29","v":"4.2.1.3.5: Are service levels set and monitored for each technical component of the mobile money system?\n"},{"$f":"'4'!K29","v":0},{"$f":"'4'!L29","v":0},{"$f":"'4'!M29","v":"Recommended"},{"$f":"'4'!N29","v":"Recommended"},{"$f":"'4'!O29","v":"TechOps"},{"$f":"'4'!P29","v":0},{"$f":"'4'!Q29","v":0},{"$f":"'4'!R29","v":0},{"$f":"'4'!S29","v":0},{"$f":"'4'!T29","v":0},{"$f":"'4'!U29","v":0},{"$f":"'4'!V29","v":0},{"$f":"'4'!W29","v":0},{"$f":"'4'!X29","v":0},{"$f":"'4'!Y29","v":0},{"$f":"'4'!Z29","v":0},{"$f":"'4'!AA29","v":0},{"$f":"'4'!AB29","v":0},{"$f":"'4'!AC29","v":0},{"$f":"'4'!AD29","v":0},{"$f":"'4'!AE29","v":0},{"$f":"'4'!AF29","v":0},{"$f":"'4'!AG29","v":0},{"$f":"'4'!AH29","v":0},{"$f":"'4'!AI29","v":0},{"$f":"'4'!AJ29","v":0},{"$f":"'4'!AK29","v":0},{"$f":"'4'!AL29","v":0},{"$f":"'4'!AM29","v":0},{"$f":"'4'!AN29","v":0},{"$f":"'4'!AO29","v":0},{"$f":"'4'!AP29","v":0},{"$f":"'4'!AQ29","v":0},{"$f":"'4'!AR29","v":0},{"$f":"'4'!AS29","v":0},{"$f":"'4'!AT29","v":0},{"$f":"SUMPRODUCT(IF($N242=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N242=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B30","v":"4"},{"$f":"'4'!C30","v":"4.2"},{"$f":"'4'!D30","v":"4.2.1"},{"$f":"'4'!E30","v":""},{"$f":"'4'!F30","v":"4.2.1.3"},{"$f":"'4'!G30","v":0},{"$f":"'4'!H30","v":0},{"$f":"'4'!I30","v":"4.2.1.3.6"},{"$f":"'4'!J30","v":"4.2.1.3.6: Are technical service level targets updated when changes are made to the mobile money service / system?\n"},{"$f":"'4'!K30","v":0},{"$f":"'4'!L30","v":0},{"$f":"'4'!M30","v":"Recommended"},{"$f":"'4'!N30","v":"Recommended"},{"$f":"'4'!O30","v":"TechOps"},{"$f":"'4'!P30","v":0},{"$f":"'4'!Q30","v":0},{"$f":"'4'!R30","v":0},{"$f":"'4'!S30","v":0},{"$f":"'4'!T30","v":0},{"$f":"'4'!U30","v":0},{"$f":"'4'!V30","v":0},{"$f":"'4'!W30","v":0},{"$f":"'4'!X30","v":0},{"$f":"'4'!Y30","v":0},{"$f":"'4'!Z30","v":0},{"$f":"'4'!AA30","v":0},{"$f":"'4'!AB30","v":0},{"$f":"'4'!AC30","v":0},{"$f":"'4'!AD30","v":0},{"$f":"'4'!AE30","v":0},{"$f":"'4'!AF30","v":0},{"$f":"'4'!AG30","v":0},{"$f":"'4'!AH30","v":0},{"$f":"'4'!AI30","v":0},{"$f":"'4'!AJ30","v":0},{"$f":"'4'!AK30","v":0},{"$f":"'4'!AL30","v":0},{"$f":"'4'!AM30","v":0},{"$f":"'4'!AN30","v":0},{"$f":"'4'!AO30","v":0},{"$f":"'4'!AP30","v":0},{"$f":"'4'!AQ30","v":0},{"$f":"'4'!AR30","v":0},{"$f":"'4'!AS30","v":0},{"$f":"'4'!AT30","v":0},{"$f":"SUMPRODUCT(IF($N243=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N243=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B31","v":"4"},{"$f":"'4'!C31","v":"4.2"},{"$f":"'4'!D31","v":"4.2.1"},{"$f":"'4'!E31","v":""},{"$f":"'4'!F31","v":"4.2.1.4"},{"$f":"'4'!G31","v":"4.2.1.4: SYSTEM MONITORING\nThe mobile money system components should be monitored using a centralized monitoring system, and alerts should be raised in case of problems or failures. Alerts should result in incidents or problems being raised (see 4.4).\n"},{"$f":"'4'!H31","v":"PCI DSS, ISO 27002: 2013 Sec. 12.4 "},{"$f":"'4'!I31","v":"4.2.1.4.1"},{"$f":"'4'!J31","v":"4.2.1.4.1: Are all mobile money system components monitored, and are alerts raised in case of problems or failures?\n"},{"$f":"'4'!K31","v":"1) Monitoring and alerting system logs or specification\n- Check that there is a monitoring / alerting system to monitor log files of all components of the mobile money system.\n- Check that the monitoring system raises alerts in case of problems or failures."},{"$f":"'4'!L31","v":0},{"$f":"'4'!M31","v":"Urgent Required"},{"$f":"'4'!N31","v":"Required"},{"$f":"'4'!O31","v":"TechOps"},{"$f":"'4'!P31","v":0},{"$f":"'4'!Q31","v":0},{"$f":"'4'!R31","v":0},{"$f":"'4'!S31","v":0},{"$f":"'4'!T31","v":0},{"$f":"'4'!U31","v":0},{"$f":"'4'!V31","v":0},{"$f":"'4'!W31","v":0},{"$f":"'4'!X31","v":0},{"$f":"'4'!Y31","v":0},{"$f":"'4'!Z31","v":0},{"$f":"'4'!AA31","v":0},{"$f":"'4'!AB31","v":0},{"$f":"'4'!AC31","v":0},{"$f":"'4'!AD31","v":0},{"$f":"'4'!AE31","v":0},{"$f":"'4'!AF31","v":0},{"$f":"'4'!AG31","v":0},{"$f":"'4'!AH31","v":0},{"$f":"'4'!AI31","v":0},{"$f":"'4'!AJ31","v":0},{"$f":"'4'!AK31","v":0},{"$f":"'4'!AL31","v":0},{"$f":"'4'!AM31","v":0},{"$f":"'4'!AN31","v":0},{"$f":"'4'!AO31","v":0},{"$f":"'4'!AP31","v":0},{"$f":"'4'!AQ31","v":0},{"$f":"'4'!AR31","v":0},{"$f":"'4'!AS31","v":0},{"$f":"'4'!AT31","v":0},{"$f":"SUMPRODUCT(IF($N244=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N244=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B32","v":"4"},{"$f":"'4'!C32","v":"4.2"},{"$f":"'4'!D32","v":"4.2.1"},{"$f":"'4'!E32","v":""},{"$f":"'4'!F32","v":"4.2.1.5"},{"$f":"'4'!G32","v":"4.2.1.5: TIME SYNCHRONIZATION\nProviders should use up-to-date time-synchronization technology to synchronize all mobile money system clocks."},{"$f":"'4'!H32","v":"PCI DSS, ISO 27002: 2013 Sec. 12.4 "},{"$f":"'4'!I32","v":"4.2.1.5.1"},{"$f":"'4'!J32","v":"4.2.1.5.1: Is up-to-date time-synchronization technology used to synchronize all mobile money system clocks?\n"},{"$f":"'4'!K32","v":"1) System architecture specification \n- Check that there is a system for synchronisation of all mobile money system clocks (e.g. NTP server)."},{"$f":"'4'!L32","v":0},{"$f":"'4'!M32","v":"Standard Required"},{"$f":"'4'!N32","v":"Required"},{"$f":"'4'!O32","v":"TechOps"},{"$f":"'4'!P32","v":0},{"$f":"'4'!Q32","v":0},{"$f":"'4'!R32","v":0},{"$f":"'4'!S32","v":0},{"$f":"'4'!T32","v":0},{"$f":"'4'!U32","v":0},{"$f":"'4'!V32","v":0},{"$f":"'4'!W32","v":0},{"$f":"'4'!X32","v":0},{"$f":"'4'!Y32","v":0},{"$f":"'4'!Z32","v":0},{"$f":"'4'!AA32","v":0},{"$f":"'4'!AB32","v":0},{"$f":"'4'!AC32","v":0},{"$f":"'4'!AD32","v":0},{"$f":"'4'!AE32","v":0},{"$f":"'4'!AF32","v":0},{"$f":"'4'!AG32","v":0},{"$f":"'4'!AH32","v":0},{"$f":"'4'!AI32","v":0},{"$f":"'4'!AJ32","v":0},{"$f":"'4'!AK32","v":0},{"$f":"'4'!AL32","v":0},{"$f":"'4'!AM32","v":0},{"$f":"'4'!AN32","v":0},{"$f":"'4'!AO32","v":0},{"$f":"'4'!AP32","v":0},{"$f":"'4'!AQ32","v":0},{"$f":"'4'!AR32","v":0},{"$f":"'4'!AS32","v":0},{"$f":"'4'!AT32","v":0},{"$f":"SUMPRODUCT(IF($N245=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N245=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B33","v":"4"},{"$f":"'4'!C33","v":"4.2"},{"$f":"'4'!D33","v":"4.2.1"},{"$f":"'4'!E33","v":"4.2.2: Providers and partners should manage business operations and service levels"},{"$f":"'4'!F33","v":"4.2.2.1"},{"$f":"'4'!G33","v":"4.2.2.1: BUSINESS OPERATIONS\nThe business operations of mobile money should be organized and documented. Documentation of the business operations should include:\n -  Product definition documentation – describing mobile money features, functions, fees, customer transactions, etc.;\n -  Business function chart – which defines the roles of all the business functions (customer support, back-office operations, technical operations, financial operations, product management, etc.);\n -  Organization chart for the mobile money business.\n -  Business process definitions (i.e. standard operating procedures) for each back-office business function shown on the business function chart (i.e. functions such as agent / partner management, and product / service / channel management)."},{"$f":"'4'!H33","v":"ISO 20000-1:2018 Sec 6.3"},{"$f":"'4'!I33","v":"4.2.2.1.1"},{"$f":"'4'!J33","v":"4.2.2.1.1: Has product definition documentation been developed that describes mobile money services, features and fees?\n"},{"$f":"'4'!K33","v":"1) Commercial product catalogue\n- Check the commercial product catalogue describes the following aspects of the mobile money service:\n     a) Details of services and functions\n     b) Fees for each service"},{"$f":"'4'!L33","v":0},{"$f":"'4'!M33","v":"Urgent Required"},{"$f":"'4'!N33","v":"Required"},{"$f":"'4'!O33","v":"BizOps"},{"$f":"'4'!P33","v":0},{"$f":"'4'!Q33","v":0},{"$f":"'4'!R33","v":0},{"$f":"'4'!S33","v":0},{"$f":"'4'!T33","v":0},{"$f":"'4'!U33","v":0},{"$f":"'4'!V33","v":0},{"$f":"'4'!W33","v":0},{"$f":"'4'!X33","v":0},{"$f":"'4'!Y33","v":0},{"$f":"'4'!Z33","v":0},{"$f":"'4'!AA33","v":0},{"$f":"'4'!AB33","v":0},{"$f":"'4'!AC33","v":0},{"$f":"'4'!AD33","v":0},{"$f":"'4'!AE33","v":0},{"$f":"'4'!AF33","v":0},{"$f":"'4'!AG33","v":0},{"$f":"'4'!AH33","v":0},{"$f":"'4'!AI33","v":0},{"$f":"'4'!AJ33","v":0},{"$f":"'4'!AK33","v":0},{"$f":"'4'!AL33","v":0},{"$f":"'4'!AM33","v":0},{"$f":"'4'!AN33","v":0},{"$f":"'4'!AO33","v":0},{"$f":"'4'!AP33","v":0},{"$f":"'4'!AQ33","v":0},{"$f":"'4'!AR33","v":0},{"$f":"'4'!AS33","v":0},{"$f":"'4'!AT33","v":0},{"$f":"SUMPRODUCT(IF($N246=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N246=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B34","v":"4"},{"$f":"'4'!C34","v":"4.2"},{"$f":"'4'!D34","v":"4.2.1"},{"$f":"'4'!E34","v":0},{"$f":"'4'!F34","v":"4.2.2.1"},{"$f":"'4'!G34","v":0},{"$f":"'4'!H34","v":0},{"$f":"'4'!I34","v":"4.2.2.1.2"},{"$f":"'4'!J34","v":"4.2.2.1.2: Have business processes (standard operating procedures) been documented for each back-office business function?\n(i.e. functions such as agent / partner management, and product / service / channel management)\n\n[Note that this indicator is requesting process documentation for functions other than customer operations (principle 7), financial operations (principle 1), AML/CFT (principle 2), and technical operations (4.2.1.1).]\n"},{"$f":"'4'!K34","v":"1) Business processes (standard operating procedures) and Business function chart\n- Check that there are business processes for each back-office business function shown on the business function chart (i.e. functions such as agent / partner management, and product / service / channel management)."},{"$f":"'4'!L34","v":0},{"$f":"'4'!M34","v":"Recommended"},{"$f":"'4'!N34","v":"Recommended"},{"$f":"'4'!O34","v":"BizOps"},{"$f":"'4'!P34","v":0},{"$f":"'4'!Q34","v":0},{"$f":"'4'!R34","v":0},{"$f":"'4'!S34","v":0},{"$f":"'4'!T34","v":0},{"$f":"'4'!U34","v":0},{"$f":"'4'!V34","v":0},{"$f":"'4'!W34","v":0},{"$f":"'4'!X34","v":0},{"$f":"'4'!Y34","v":0},{"$f":"'4'!Z34","v":0},{"$f":"'4'!AA34","v":0},{"$f":"'4'!AB34","v":0},{"$f":"'4'!AC34","v":0},{"$f":"'4'!AD34","v":0},{"$f":"'4'!AE34","v":0},{"$f":"'4'!AF34","v":0},{"$f":"'4'!AG34","v":0},{"$f":"'4'!AH34","v":0},{"$f":"'4'!AI34","v":0},{"$f":"'4'!AJ34","v":0},{"$f":"'4'!AK34","v":0},{"$f":"'4'!AL34","v":0},{"$f":"'4'!AM34","v":0},{"$f":"'4'!AN34","v":0},{"$f":"'4'!AO34","v":0},{"$f":"'4'!AP34","v":0},{"$f":"'4'!AQ34","v":0},{"$f":"'4'!AR34","v":0},{"$f":"'4'!AS34","v":0},{"$f":"'4'!AT34","v":0},{"$f":"SUMPRODUCT(IF($N247=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N247=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B35","v":"4"},{"$f":"'4'!C35","v":"4.2"},{"$f":"'4'!D35","v":"4.2.1"},{"$f":"'4'!E35","v":0},{"$f":"'4'!F35","v":"4.2.2.1"},{"$f":"'4'!G35","v":0},{"$f":"'4'!H35","v":0},{"$f":"'4'!I35","v":"4.2.2.1.3"},{"$f":"'4'!J35","v":"4.2.2.1.3: Has a business function chart (or similar document) been developed that defines the roles of all the business functions (customer support, back-office operations, technical operations, financial operations, product management, etc.)?\n"},{"$f":"'4'!K35","v":0},{"$f":"'4'!L35","v":0},{"$f":"'4'!M35","v":"Recommended"},{"$f":"'4'!N35","v":"Recommended"},{"$f":"'4'!O35","v":"BizOps"},{"$f":"'4'!P35","v":0},{"$f":"'4'!Q35","v":0},{"$f":"'4'!R35","v":0},{"$f":"'4'!S35","v":0},{"$f":"'4'!T35","v":0},{"$f":"'4'!U35","v":0},{"$f":"'4'!V35","v":0},{"$f":"'4'!W35","v":0},{"$f":"'4'!X35","v":0},{"$f":"'4'!Y35","v":0},{"$f":"'4'!Z35","v":0},{"$f":"'4'!AA35","v":0},{"$f":"'4'!AB35","v":0},{"$f":"'4'!AC35","v":0},{"$f":"'4'!AD35","v":0},{"$f":"'4'!AE35","v":0},{"$f":"'4'!AF35","v":0},{"$f":"'4'!AG35","v":0},{"$f":"'4'!AH35","v":0},{"$f":"'4'!AI35","v":0},{"$f":"'4'!AJ35","v":0},{"$f":"'4'!AK35","v":0},{"$f":"'4'!AL35","v":0},{"$f":"'4'!AM35","v":0},{"$f":"'4'!AN35","v":0},{"$f":"'4'!AO35","v":0},{"$f":"'4'!AP35","v":0},{"$f":"'4'!AQ35","v":0},{"$f":"'4'!AR35","v":0},{"$f":"'4'!AS35","v":0},{"$f":"'4'!AT35","v":0},{"$f":"SUMPRODUCT(IF($N248=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N248=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B36","v":"4"},{"$f":"'4'!C36","v":"4.2"},{"$f":"'4'!D36","v":"4.2.1"},{"$f":"'4'!E36","v":""},{"$f":"'4'!F36","v":"4.2.2.2"},{"$f":"'4'!G36","v":"4.2.2.2: BUSINESS SERVICE LEVEL MANAGEMENT\nService levels should be defined for customer-facing business processes. Examples of such processes include:\n- Calls to customer service (response time);\n- Processing reversals (time to complete the reversal); \n- Registration (time to activate account);\n- Reconciliation and settlement (time to complete).\n\nMonitoring should be implemented for each customer-facing business process against their service level targets, and reports generated for the relevant functional managers and the head of mobile money.\n\nBusiness process service level targets should be updated when changes are made to the mobile money service."},{"$f":"'4'!H36","v":"ISO 20000-1:2011 Sec. 6.1"},{"$f":"'4'!I36","v":"4.2.2.2.1"},{"$f":"'4'!J36","v":"4.2.2.2.1: Have service levels been defined for all customer-facing business processes (e.g. response time for calls to customer service, completion time for reversals, and time to complete account activation)?\n"},{"$f":"'4'!K36","v":0},{"$f":"'4'!L36","v":0},{"$f":"'4'!M36","v":"Recommended"},{"$f":"'4'!N36","v":"Recommended"},{"$f":"'4'!O36","v":"BizOps"},{"$f":"'4'!P36","v":0},{"$f":"'4'!Q36","v":0},{"$f":"'4'!R36","v":0},{"$f":"'4'!S36","v":0},{"$f":"'4'!T36","v":0},{"$f":"'4'!U36","v":0},{"$f":"'4'!V36","v":0},{"$f":"'4'!W36","v":0},{"$f":"'4'!X36","v":0},{"$f":"'4'!Y36","v":0},{"$f":"'4'!Z36","v":0},{"$f":"'4'!AA36","v":0},{"$f":"'4'!AB36","v":0},{"$f":"'4'!AC36","v":0},{"$f":"'4'!AD36","v":0},{"$f":"'4'!AE36","v":0},{"$f":"'4'!AF36","v":0},{"$f":"'4'!AG36","v":0},{"$f":"'4'!AH36","v":0},{"$f":"'4'!AI36","v":0},{"$f":"'4'!AJ36","v":0},{"$f":"'4'!AK36","v":0},{"$f":"'4'!AL36","v":0},{"$f":"'4'!AM36","v":0},{"$f":"'4'!AN36","v":0},{"$f":"'4'!AO36","v":0},{"$f":"'4'!AP36","v":0},{"$f":"'4'!AQ36","v":0},{"$f":"'4'!AR36","v":0},{"$f":"'4'!AS36","v":0},{"$f":"'4'!AT36","v":0},{"$f":"SUMPRODUCT(IF($N249=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N249=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B37","v":"4"},{"$f":"'4'!C37","v":"4.2"},{"$f":"'4'!D37","v":"4.2.1"},{"$f":"'4'!E37","v":""},{"$f":"'4'!F37","v":"4.2.2.2"},{"$f":"'4'!G37","v":0},{"$f":"'4'!H37","v":0},{"$f":"'4'!I37","v":"4.2.2.2.2"},{"$f":"'4'!J37","v":"4.2.2.2.2: Are customer-facing business processes monitored to track performance of the processes against the service level targets?\n"},{"$f":"'4'!K37","v":0},{"$f":"'4'!L37","v":0},{"$f":"'4'!M37","v":"Recommended"},{"$f":"'4'!N37","v":"Recommended"},{"$f":"'4'!O37","v":"BizOps"},{"$f":"'4'!P37","v":0},{"$f":"'4'!Q37","v":0},{"$f":"'4'!R37","v":0},{"$f":"'4'!S37","v":0},{"$f":"'4'!T37","v":0},{"$f":"'4'!U37","v":0},{"$f":"'4'!V37","v":0},{"$f":"'4'!W37","v":0},{"$f":"'4'!X37","v":0},{"$f":"'4'!Y37","v":0},{"$f":"'4'!Z37","v":0},{"$f":"'4'!AA37","v":0},{"$f":"'4'!AB37","v":0},{"$f":"'4'!AC37","v":0},{"$f":"'4'!AD37","v":0},{"$f":"'4'!AE37","v":0},{"$f":"'4'!AF37","v":0},{"$f":"'4'!AG37","v":0},{"$f":"'4'!AH37","v":0},{"$f":"'4'!AI37","v":0},{"$f":"'4'!AJ37","v":0},{"$f":"'4'!AK37","v":0},{"$f":"'4'!AL37","v":0},{"$f":"'4'!AM37","v":0},{"$f":"'4'!AN37","v":0},{"$f":"'4'!AO37","v":0},{"$f":"'4'!AP37","v":0},{"$f":"'4'!AQ37","v":0},{"$f":"'4'!AR37","v":0},{"$f":"'4'!AS37","v":0},{"$f":"'4'!AT37","v":0},{"$f":"SUMPRODUCT(IF($N250=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N250=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B38","v":"4"},{"$f":"'4'!C38","v":"4.2"},{"$f":"'4'!D38","v":"4.2.1"},{"$f":"'4'!E38","v":""},{"$f":"'4'!F38","v":"4.2.2.2"},{"$f":"'4'!G38","v":0},{"$f":"'4'!H38","v":0},{"$f":"'4'!I38","v":"4.2.2.2.3"},{"$f":"'4'!J38","v":"4.2.2.2.3: Are service reports being produced regularly for business process service levels to assess whether customer-facing business processes are meeting their service level targets?\n"},{"$f":"'4'!K38","v":0},{"$f":"'4'!L38","v":0},{"$f":"'4'!M38","v":"Recommended"},{"$f":"'4'!N38","v":"Recommended"},{"$f":"'4'!O38","v":"BizOps"},{"$f":"'4'!P38","v":0},{"$f":"'4'!Q38","v":0},{"$f":"'4'!R38","v":0},{"$f":"'4'!S38","v":0},{"$f":"'4'!T38","v":0},{"$f":"'4'!U38","v":0},{"$f":"'4'!V38","v":0},{"$f":"'4'!W38","v":0},{"$f":"'4'!X38","v":0},{"$f":"'4'!Y38","v":0},{"$f":"'4'!Z38","v":0},{"$f":"'4'!AA38","v":0},{"$f":"'4'!AB38","v":0},{"$f":"'4'!AC38","v":0},{"$f":"'4'!AD38","v":0},{"$f":"'4'!AE38","v":0},{"$f":"'4'!AF38","v":0},{"$f":"'4'!AG38","v":0},{"$f":"'4'!AH38","v":0},{"$f":"'4'!AI38","v":0},{"$f":"'4'!AJ38","v":0},{"$f":"'4'!AK38","v":0},{"$f":"'4'!AL38","v":0},{"$f":"'4'!AM38","v":0},{"$f":"'4'!AN38","v":0},{"$f":"'4'!AO38","v":0},{"$f":"'4'!AP38","v":0},{"$f":"'4'!AQ38","v":0},{"$f":"'4'!AR38","v":0},{"$f":"'4'!AS38","v":0},{"$f":"'4'!AT38","v":0},{"$f":"SUMPRODUCT(IF($N251=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N251=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B39","v":"4"},{"$f":"'4'!C39","v":"4.2"},{"$f":"'4'!D39","v":"4.2.1"},{"$f":"'4'!E39","v":""},{"$f":"'4'!F39","v":"4.2.2.2"},{"$f":"'4'!G39","v":0},{"$f":"'4'!H39","v":0},{"$f":"'4'!I39","v":"4.2.2.2.4"},{"$f":"'4'!J39","v":"4.2.2.2.4: Are business process service level targets updated when changes are made to the mobile money service?\n"},{"$f":"'4'!K39","v":0},{"$f":"'4'!L39","v":0},{"$f":"'4'!M39","v":"Recommended"},{"$f":"'4'!N39","v":"Recommended"},{"$f":"'4'!O39","v":"BizOps"},{"$f":"'4'!P39","v":0},{"$f":"'4'!Q39","v":0},{"$f":"'4'!R39","v":0},{"$f":"'4'!S39","v":0},{"$f":"'4'!T39","v":0},{"$f":"'4'!U39","v":0},{"$f":"'4'!V39","v":0},{"$f":"'4'!W39","v":0},{"$f":"'4'!X39","v":0},{"$f":"'4'!Y39","v":0},{"$f":"'4'!Z39","v":0},{"$f":"'4'!AA39","v":0},{"$f":"'4'!AB39","v":0},{"$f":"'4'!AC39","v":0},{"$f":"'4'!AD39","v":0},{"$f":"'4'!AE39","v":0},{"$f":"'4'!AF39","v":0},{"$f":"'4'!AG39","v":0},{"$f":"'4'!AH39","v":0},{"$f":"'4'!AI39","v":0},{"$f":"'4'!AJ39","v":0},{"$f":"'4'!AK39","v":0},{"$f":"'4'!AL39","v":0},{"$f":"'4'!AM39","v":0},{"$f":"'4'!AN39","v":0},{"$f":"'4'!AO39","v":0},{"$f":"'4'!AP39","v":0},{"$f":"'4'!AQ39","v":0},{"$f":"'4'!AR39","v":0},{"$f":"'4'!AS39","v":0},{"$f":"'4'!AT39","v":0},{"$f":"SUMPRODUCT(IF($N252=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N252=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B40","v":"4"},{"$f":"'4'!C40","v":"4.2"},{"$f":"'4'!D40","v":"4.2.1"},{"$f":"'4'!E40","v":""},{"$f":"'4'!F40","v":"4.2.2.3"},{"$f":"'4'!G40","v":"4.2.2.3: MANAGEMENT REPORTING\nManagement reports should be produced regularly to report on the performance of the mobile money service. This should include volume-based reports and event-based reports.\n\nEvent-based service reports should contain relevant information about significant events including at least:\na) Incidents involving service disruption \nb) SLA breaches\nc) Deployment or new or changed services \n\nVolume-based service reports should include at least:\n- volume of mobile money customers (registered and active);\n- volume of transactions (by transaction type);\n- customer satisfaction measurements such as customer complaints.\n\nManagement reports should be communicated to all mobile money managers and the head of mobile money.\n"},{"$f":"'4'!H40","v":0},{"$f":"'4'!I40","v":"4.2.2.3.1"},{"$f":"'4'!J40","v":"4.2.2.3.1: Are event-based management reports produced that contain relevant information about significant events, including (at minimum):\na) Incidents involving service disruption \nb) SLA breaches\nc) Deployment or new or changed services?\n"},{"$f":"'4'!K40","v":"1) Management operational reports \n- Check that management operational reports are being produced and contain relevant information on service events:\na) Incidents involving service disruption \nb) SLA breaches\nc) Deployment or new or changed services \n\n"},{"$f":"'4'!L40","v":0},{"$f":"'4'!M40","v":"Standard Required"},{"$f":"'4'!N40","v":"Required"},{"$f":"'4'!O40","v":"BizOps"},{"$f":"'4'!P40","v":0},{"$f":"'4'!Q40","v":0},{"$f":"'4'!R40","v":0},{"$f":"'4'!S40","v":0},{"$f":"'4'!T40","v":0},{"$f":"'4'!U40","v":0},{"$f":"'4'!V40","v":0},{"$f":"'4'!W40","v":0},{"$f":"'4'!X40","v":0},{"$f":"'4'!Y40","v":0},{"$f":"'4'!Z40","v":0},{"$f":"'4'!AA40","v":0},{"$f":"'4'!AB40","v":0},{"$f":"'4'!AC40","v":0},{"$f":"'4'!AD40","v":0},{"$f":"'4'!AE40","v":0},{"$f":"'4'!AF40","v":0},{"$f":"'4'!AG40","v":0},{"$f":"'4'!AH40","v":0},{"$f":"'4'!AI40","v":0},{"$f":"'4'!AJ40","v":0},{"$f":"'4'!AK40","v":0},{"$f":"'4'!AL40","v":0},{"$f":"'4'!AM40","v":0},{"$f":"'4'!AN40","v":0},{"$f":"'4'!AO40","v":0},{"$f":"'4'!AP40","v":0},{"$f":"'4'!AQ40","v":0},{"$f":"'4'!AR40","v":0},{"$f":"'4'!AS40","v":0},{"$f":"'4'!AT40","v":0},{"$f":"SUMPRODUCT(IF($N253=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N253=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B41","v":"4"},{"$f":"'4'!C41","v":"4.2"},{"$f":"'4'!D41","v":"4.2.1"},{"$f":"'4'!E41","v":""},{"$f":"'4'!F41","v":"4.2.2.3"},{"$f":"'4'!G41","v":0},{"$f":"'4'!H41","v":"ISO 20000-1:2018 Sec 9.3"},{"$f":"'4'!I41","v":"4.2.2.3.2"},{"$f":"'4'!J41","v":"4.2.2.3.2: Are volume-based management reports produced regularly that detail (at minimum) the volume of mobile money customers (registered and active), transactions (by transaction type), and customer complaints?\n"},{"$f":"'4'!K41","v":0},{"$f":"'4'!L41","v":0},{"$f":"'4'!M41","v":"Recommended"},{"$f":"'4'!N41","v":"Recommended"},{"$f":"'4'!O41","v":"BizOps"},{"$f":"'4'!P41","v":0},{"$f":"'4'!Q41","v":0},{"$f":"'4'!R41","v":0},{"$f":"'4'!S41","v":0},{"$f":"'4'!T41","v":0},{"$f":"'4'!U41","v":0},{"$f":"'4'!V41","v":0},{"$f":"'4'!W41","v":0},{"$f":"'4'!X41","v":0},{"$f":"'4'!Y41","v":0},{"$f":"'4'!Z41","v":0},{"$f":"'4'!AA41","v":0},{"$f":"'4'!AB41","v":0},{"$f":"'4'!AC41","v":0},{"$f":"'4'!AD41","v":0},{"$f":"'4'!AE41","v":0},{"$f":"'4'!AF41","v":0},{"$f":"'4'!AG41","v":0},{"$f":"'4'!AH41","v":0},{"$f":"'4'!AI41","v":0},{"$f":"'4'!AJ41","v":0},{"$f":"'4'!AK41","v":0},{"$f":"'4'!AL41","v":0},{"$f":"'4'!AM41","v":0},{"$f":"'4'!AN41","v":0},{"$f":"'4'!AO41","v":0},{"$f":"'4'!AP41","v":0},{"$f":"'4'!AQ41","v":0},{"$f":"'4'!AR41","v":0},{"$f":"'4'!AS41","v":0},{"$f":"'4'!AT41","v":0},{"$f":"SUMPRODUCT(IF($N254=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N254=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B42","v":"4"},{"$f":"'4'!C42","v":"4.2"},{"$f":"'4'!D42","v":"4.2.1"},{"$f":"'4'!E42","v":""},{"$f":"'4'!F42","v":"4.2.2.3"},{"$f":"'4'!G42","v":0},{"$f":"'4'!H42","v":0},{"$f":"'4'!I42","v":"4.2.2.3.3"},{"$f":"'4'!J42","v":"4.2.2.3.3: Are management reports being communicated to all mobile money managers and the head of mobile money?\n"},{"$f":"'4'!K42","v":0},{"$f":"'4'!L42","v":0},{"$f":"'4'!M42","v":"Recommended"},{"$f":"'4'!N42","v":"Recommended"},{"$f":"'4'!O42","v":"BizOps"},{"$f":"'4'!P42","v":0},{"$f":"'4'!Q42","v":0},{"$f":"'4'!R42","v":0},{"$f":"'4'!S42","v":0},{"$f":"'4'!T42","v":0},{"$f":"'4'!U42","v":0},{"$f":"'4'!V42","v":0},{"$f":"'4'!W42","v":0},{"$f":"'4'!X42","v":0},{"$f":"'4'!Y42","v":0},{"$f":"'4'!Z42","v":0},{"$f":"'4'!AA42","v":0},{"$f":"'4'!AB42","v":0},{"$f":"'4'!AC42","v":0},{"$f":"'4'!AD42","v":0},{"$f":"'4'!AE42","v":0},{"$f":"'4'!AF42","v":0},{"$f":"'4'!AG42","v":0},{"$f":"'4'!AH42","v":0},{"$f":"'4'!AI42","v":0},{"$f":"'4'!AJ42","v":0},{"$f":"'4'!AK42","v":0},{"$f":"'4'!AL42","v":0},{"$f":"'4'!AM42","v":0},{"$f":"'4'!AN42","v":0},{"$f":"'4'!AO42","v":0},{"$f":"'4'!AP42","v":0},{"$f":"'4'!AQ42","v":0},{"$f":"'4'!AR42","v":0},{"$f":"'4'!AS42","v":0},{"$f":"'4'!AT42","v":0},{"$f":"SUMPRODUCT(IF($N255=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N255=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B44","v":"4"},{"$f":"'4'!C44","v":"4.3"},{"$f":"'4'!D44","v":"4.3.1"},{"$f":"'4'!E44","v":"4.3.1: Providers shall take steps to ensure sufficient service capacity through forecasting, monitoring and testing"},{"$f":"'4'!F44","v":"4.3.1.1"},{"$f":"'4'!G44","v":"4.3.1.1: BUSINESS FORECASTING\nBusiness forecasts provide the key information for capacity planning. Realistic business forecasts for the mobile money business should be generated based on:\n- Current performance of mobile money business;\n- Current growth trends;\n- Analysis of mobile money and financial market;\n- Competitor analysis;\n- Growth from new activities - new products, additional marketing, sales/distribution activities, etc. \n\nFor capacity planning purposes, it is helpful to split forecasts as Low forecast / On-target forecast / High forecast. Of these, the on-target forecast is the most important. \n\nQuarterly forecasts over the coming 1-3 year period are recommended, but forecasts should be at least annual.\n\nForecasts should include the following parameters:\n- Number of subscribers (registered/active);\n- Number of transactions (by transaction type);\n- Volume of other functions, such as web access;\n- Number of calls (or other communication) to customer service."},{"$f":"'4'!H44","v":"ISO 20000-1:2019 Sec 6.2"},{"$f":"'4'!I44","v":"4.3.1.1.1"},{"$f":"'4'!J44","v":"4.3.1.1.1: Are business forecasts generated at least annually to provide a realistic prediction of the mobile money business over the coming 1-3 year period?\n"},{"$f":"'4'!K44","v":"1) Business forecasts \n- Check that business forecasts are produced at least annually and forecast over a 1-3 year horizon\n"},{"$f":"'4'!L44","v":0},{"$f":"'4'!M44","v":"Urgent Required"},{"$f":"'4'!N44","v":"Required"},{"$f":"'4'!O44","v":"BizOps"},{"$f":"'4'!P44","v":0},{"$f":"'4'!Q44","v":0},{"$f":"'4'!R44","v":0},{"$f":"'4'!S44","v":0},{"$f":"'4'!T44","v":0},{"$f":"'4'!U44","v":0},{"$f":"'4'!V44","v":0},{"$f":"'4'!W44","v":0},{"$f":"'4'!X44","v":0},{"$f":"'4'!Y44","v":0},{"$f":"'4'!Z44","v":0},{"$f":"'4'!AA44","v":0},{"$f":"'4'!AB44","v":0},{"$f":"'4'!AC44","v":0},{"$f":"'4'!AD44","v":0},{"$f":"'4'!AE44","v":0},{"$f":"'4'!AF44","v":0},{"$f":"'4'!AG44","v":0},{"$f":"'4'!AH44","v":0},{"$f":"'4'!AI44","v":0},{"$f":"'4'!AJ44","v":0},{"$f":"'4'!AK44","v":0},{"$f":"'4'!AL44","v":0},{"$f":"'4'!AM44","v":0},{"$f":"'4'!AN44","v":0},{"$f":"'4'!AO44","v":0},{"$f":"'4'!AP44","v":0},{"$f":"'4'!AQ44","v":0},{"$f":"'4'!AR44","v":0},{"$f":"'4'!AS44","v":0},{"$f":"'4'!AT44","v":0},{"$f":"SUMPRODUCT(IF($N256=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N256=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B45","v":"4"},{"$f":"'4'!C45","v":"4.3"},{"$f":"'4'!D45","v":"4.3.1"},{"$f":"'4'!E45","v":0},{"$f":"'4'!F45","v":"4.3.1.1"},{"$f":"'4'!G45","v":0},{"$f":"'4'!H45","v":0},{"$f":"'4'!I45","v":"4.3.1.1.2"},{"$f":"'4'!J45","v":"4.3.1.1.2: Do business forecasts include number of subscribers (registered and active) and number of transactions (by transaction type)?\n"},{"$f":"'4'!K45","v":"1) Business forecasts \n- Check business forecasts include number of subscribers (registered and active) and number of transactions by transaction type."},{"$f":"'4'!L45","v":0},{"$f":"'4'!M45","v":"Standard Required"},{"$f":"'4'!N45","v":"Required"},{"$f":"'4'!O45","v":"BizOps"},{"$f":"'4'!P45","v":0},{"$f":"'4'!Q45","v":0},{"$f":"'4'!R45","v":0},{"$f":"'4'!S45","v":0},{"$f":"'4'!T45","v":0},{"$f":"'4'!U45","v":0},{"$f":"'4'!V45","v":0},{"$f":"'4'!W45","v":0},{"$f":"'4'!X45","v":0},{"$f":"'4'!Y45","v":0},{"$f":"'4'!Z45","v":0},{"$f":"'4'!AA45","v":0},{"$f":"'4'!AB45","v":0},{"$f":"'4'!AC45","v":0},{"$f":"'4'!AD45","v":0},{"$f":"'4'!AE45","v":0},{"$f":"'4'!AF45","v":0},{"$f":"'4'!AG45","v":0},{"$f":"'4'!AH45","v":0},{"$f":"'4'!AI45","v":0},{"$f":"'4'!AJ45","v":0},{"$f":"'4'!AK45","v":0},{"$f":"'4'!AL45","v":0},{"$f":"'4'!AM45","v":0},{"$f":"'4'!AN45","v":0},{"$f":"'4'!AO45","v":0},{"$f":"'4'!AP45","v":0},{"$f":"'4'!AQ45","v":0},{"$f":"'4'!AR45","v":0},{"$f":"'4'!AS45","v":0},{"$f":"'4'!AT45","v":0},{"$f":"SUMPRODUCT(IF($N257=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N257=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B46","v":"4"},{"$f":"'4'!C46","v":"4.3"},{"$f":"'4'!D46","v":"4.3.1"},{"$f":"'4'!E46","v":0},{"$f":"'4'!F46","v":"4.3.1.1"},{"$f":"'4'!G46","v":0},{"$f":"'4'!H46","v":0},{"$f":"'4'!I46","v":"4.3.1.1.3"},{"$f":"'4'!J46","v":"4.3.1.1.3: Do business forecasts include number of calls (or other communication) to customer service and number of agents?\n"},{"$f":"'4'!K46","v":0},{"$f":"'4'!L46","v":0},{"$f":"'4'!M46","v":"Recommended"},{"$f":"'4'!N46","v":"Recommended"},{"$f":"'4'!O46","v":"BizOps"},{"$f":"'4'!P46","v":0},{"$f":"'4'!Q46","v":0},{"$f":"'4'!R46","v":0},{"$f":"'4'!S46","v":0},{"$f":"'4'!T46","v":0},{"$f":"'4'!U46","v":0},{"$f":"'4'!V46","v":0},{"$f":"'4'!W46","v":0},{"$f":"'4'!X46","v":0},{"$f":"'4'!Y46","v":0},{"$f":"'4'!Z46","v":0},{"$f":"'4'!AA46","v":0},{"$f":"'4'!AB46","v":0},{"$f":"'4'!AC46","v":0},{"$f":"'4'!AD46","v":0},{"$f":"'4'!AE46","v":0},{"$f":"'4'!AF46","v":0},{"$f":"'4'!AG46","v":0},{"$f":"'4'!AH46","v":0},{"$f":"'4'!AI46","v":0},{"$f":"'4'!AJ46","v":0},{"$f":"'4'!AK46","v":0},{"$f":"'4'!AL46","v":0},{"$f":"'4'!AM46","v":0},{"$f":"'4'!AN46","v":0},{"$f":"'4'!AO46","v":0},{"$f":"'4'!AP46","v":0},{"$f":"'4'!AQ46","v":0},{"$f":"'4'!AR46","v":0},{"$f":"'4'!AS46","v":0},{"$f":"'4'!AT46","v":0},{"$f":"SUMPRODUCT(IF($N258=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N258=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B47","v":"4"},{"$f":"'4'!C47","v":"4.3"},{"$f":"'4'!D47","v":"4.3.1"},{"$f":"'4'!E47","v":""},{"$f":"'4'!F47","v":"4.3.1.2"},{"$f":"'4'!G47","v":"4.3.1.2: CAPACITY PLAN - TECHNICAL\nThe technical capacity plan should determine how the technical system will support the forecast business volumes and performance (see 4.3.1.1). It should be a forward-looking projection with anticipated technial hardware upgrades. Providers should produce a technical capacity plan at least annually or more frequently if required due to rates of change to services and service volumes. \n\n The capacity plan should include the following analysis:\n- analysis of the business forecast of mobile money service usage;\n- analysis of past, current and forecast technical component usage and performance, including an understanding of which resources support which services and the potential impact of new technologies (system modelling and trend analysis can be used to analyse performance);\n- analysis of the impact on capacity from changes to requirements for availability, service continuity and performance service levels;\n\nThe capacity plan should determine the following technical requirements:\n- Horizontal scaling of system infrastructure\n- Vertical scaling of system infrastructure\n- Changes to system architecture to support the forecast business volumes.\n- Performance tuning of the system.\n\nThe capacity plan should determine the following business requirements:\n- Human resource and cost requirements to deliver the required technical performance;\n- The time and planning required to implement the technical changes.\n"},{"$f":"'4'!H47","v":"ISO 20000-1:2019 Sec 8.4.3"},{"$f":"'4'!I47","v":"4.3.1.2.1"},{"$f":"'4'!J47","v":"4.3.1.2.1: Is a technical capacity plan produced at least annually - i.e. a forward-looking projection with anticipated technial hardware upgrades?\n"},{"$f":"'4'!K47","v":"1) Technical capacity plan \n-  Check the technical capacity plan (a forward-looking projection with anticipated technial hardware upgrades) is produced at least annually."},{"$f":"'4'!L47","v":0},{"$f":"'4'!M47","v":"Urgent Required"},{"$f":"'4'!N47","v":"Required"},{"$f":"'4'!O47","v":"TechOps"},{"$f":"'4'!P47","v":0},{"$f":"'4'!Q47","v":0},{"$f":"'4'!R47","v":0},{"$f":"'4'!S47","v":0},{"$f":"'4'!T47","v":0},{"$f":"'4'!U47","v":0},{"$f":"'4'!V47","v":0},{"$f":"'4'!W47","v":0},{"$f":"'4'!X47","v":0},{"$f":"'4'!Y47","v":0},{"$f":"'4'!Z47","v":0},{"$f":"'4'!AA47","v":0},{"$f":"'4'!AB47","v":0},{"$f":"'4'!AC47","v":0},{"$f":"'4'!AD47","v":0},{"$f":"'4'!AE47","v":0},{"$f":"'4'!AF47","v":0},{"$f":"'4'!AG47","v":0},{"$f":"'4'!AH47","v":0},{"$f":"'4'!AI47","v":0},{"$f":"'4'!AJ47","v":0},{"$f":"'4'!AK47","v":0},{"$f":"'4'!AL47","v":0},{"$f":"'4'!AM47","v":0},{"$f":"'4'!AN47","v":0},{"$f":"'4'!AO47","v":0},{"$f":"'4'!AP47","v":0},{"$f":"'4'!AQ47","v":0},{"$f":"'4'!AR47","v":0},{"$f":"'4'!AS47","v":0},{"$f":"'4'!AT47","v":0},{"$f":"SUMPRODUCT(IF($N259=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N259=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B48","v":"4"},{"$f":"'4'!C48","v":"4.3"},{"$f":"'4'!D48","v":"4.3.1"},{"$f":"'4'!E48","v":""},{"$f":"'4'!F48","v":"4.3.1.2"},{"$f":"'4'!G48","v":0},{"$f":"'4'!H48","v":0},{"$f":"'4'!I48","v":"4.3.1.2.2"},{"$f":"'4'!J48","v":"4.3.1.2.2: Is the capacity plan based on the business forecast of transactions, subscribers and other functional usage?\n"},{"$f":"'4'!K48","v":"1) Technical capacity plan \n2) Business forecasts\n-  Check the technical capacity plan is based on the business forecasts of subscribers, volumes and other functional usage to meet projected growth requirements."},{"$f":"'4'!L48","v":0},{"$f":"'4'!M48","v":"Urgent Required"},{"$f":"'4'!N48","v":"Required"},{"$f":"'4'!O48","v":"TechOps"},{"$f":"'4'!P48","v":0},{"$f":"'4'!Q48","v":0},{"$f":"'4'!R48","v":0},{"$f":"'4'!S48","v":0},{"$f":"'4'!T48","v":0},{"$f":"'4'!U48","v":0},{"$f":"'4'!V48","v":0},{"$f":"'4'!W48","v":0},{"$f":"'4'!X48","v":0},{"$f":"'4'!Y48","v":0},{"$f":"'4'!Z48","v":0},{"$f":"'4'!AA48","v":0},{"$f":"'4'!AB48","v":0},{"$f":"'4'!AC48","v":0},{"$f":"'4'!AD48","v":0},{"$f":"'4'!AE48","v":0},{"$f":"'4'!AF48","v":0},{"$f":"'4'!AG48","v":0},{"$f":"'4'!AH48","v":0},{"$f":"'4'!AI48","v":0},{"$f":"'4'!AJ48","v":0},{"$f":"'4'!AK48","v":0},{"$f":"'4'!AL48","v":0},{"$f":"'4'!AM48","v":0},{"$f":"'4'!AN48","v":0},{"$f":"'4'!AO48","v":0},{"$f":"'4'!AP48","v":0},{"$f":"'4'!AQ48","v":0},{"$f":"'4'!AR48","v":0},{"$f":"'4'!AS48","v":0},{"$f":"'4'!AT48","v":0},{"$f":"SUMPRODUCT(IF($N260=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N260=CategoryRecommended,1,0))","v":0},{"$f":"_xlfn.IFNA(MATCH($Q260,ComplianceYes,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q260,CompliancePartial,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q260,ComplianceNo,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q260,ComplianceNA,0),0)","v":0},{"$f":"$AU260*AW260","v":0},{"$f":"$AU260*AX260","v":0},{"$f":"$AU260*AY260","v":0},{"$f":"$AU260*AZ260","v":0},{"$f":"$AV260*AW260","v":0},{"$f":"$AV260*AX260","v":0},{"$f":"$AV260*AY260","v":0},{"$f":"$AV260*AZ260","v":0},{"$f":"_xlfn.IFNA(MATCH($AF260,ComplianceYes,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF260,CompliancePartial,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF260,ComplianceNo,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF260,ComplianceNA,0),0)","v":0},0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B49","v":"4"},{"$f":"'4'!C49","v":"4.3"},{"$f":"'4'!D49","v":"4.3.1"},{"$f":"'4'!E49","v":""},{"$f":"'4'!F49","v":"4.3.1.2"},{"$f":"'4'!G49","v":0},{"$f":"'4'!H49","v":0},{"$f":"'4'!I49","v":"4.3.1.2.3"},{"$f":"'4'!J49","v":"4.3.1.2.3: Is the capacity plan based on an analysis of usage and performance of all the components of the mobile money system?\n"},{"$f":"'4'!K49","v":"1) Technical capacity plan \n-  Check the technical capacity plan is based on analysis and usage of all the components of the mobile money system environment\n"},{"$f":"'4'!L49","v":0},{"$f":"'4'!M49","v":"Urgent Required"},{"$f":"'4'!N49","v":"Required"},{"$f":"'4'!O49","v":"TechOps"},{"$f":"'4'!P49","v":0},{"$f":"'4'!Q49","v":0},{"$f":"'4'!R49","v":0},{"$f":"'4'!S49","v":0},{"$f":"'4'!T49","v":0},{"$f":"'4'!U49","v":0},{"$f":"'4'!V49","v":0},{"$f":"'4'!W49","v":0},{"$f":"'4'!X49","v":0},{"$f":"'4'!Y49","v":0},{"$f":"'4'!Z49","v":0},{"$f":"'4'!AA49","v":0},{"$f":"'4'!AB49","v":0},{"$f":"'4'!AC49","v":0},{"$f":"'4'!AD49","v":0},{"$f":"'4'!AE49","v":0},{"$f":"'4'!AF49","v":0},{"$f":"'4'!AG49","v":0},{"$f":"'4'!AH49","v":0},{"$f":"'4'!AI49","v":0},{"$f":"'4'!AJ49","v":0},{"$f":"'4'!AK49","v":0},{"$f":"'4'!AL49","v":0},{"$f":"'4'!AM49","v":0},{"$f":"'4'!AN49","v":0},{"$f":"'4'!AO49","v":0},{"$f":"'4'!AP49","v":0},{"$f":"'4'!AQ49","v":0},{"$f":"'4'!AR49","v":0},{"$f":"'4'!AS49","v":0},{"$f":"'4'!AT49","v":0},{"$f":"SUMPRODUCT(IF($N261=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N261=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,{"$f":"$AU261*BI261","v":0},{"$f":"$AU261*BJ261","v":0},{"$f":"$AU261*BK261","v":0},{"$f":"$AU261*BL261","v":0},{"$f":"$AV261*BI261","v":0},{"$f":"$AV261*BJ261","v":0},{"$f":"$AV261*BK261","v":0},{"$f":"$AV261*BL261","v":0}]
[null,{"$f":"'4'!B50","v":"4"},{"$f":"'4'!C50","v":"4.3"},{"$f":"'4'!D50","v":"4.3.1"},{"$f":"'4'!E50","v":""},{"$f":"'4'!F50","v":"4.3.1.2"},{"$f":"'4'!G50","v":0},{"$f":"'4'!H50","v":0},{"$f":"'4'!I50","v":"4.3.1.2.4"},{"$f":"'4'!J50","v":"4.3.1.2.4: Does the capacity plan analyse changes to requirements for availability, service continuity and performance and the impact this has on system capacity?\n"},{"$f":"'4'!K50","v":0},{"$f":"'4'!L50","v":0},{"$f":"'4'!M50","v":"Recommended"},{"$f":"'4'!N50","v":"Recommended"},{"$f":"'4'!O50","v":"TechOps"},{"$f":"'4'!P50","v":0},{"$f":"'4'!Q50","v":0},{"$f":"'4'!R50","v":0},{"$f":"'4'!S50","v":0},{"$f":"'4'!T50","v":0},{"$f":"'4'!U50","v":0},{"$f":"'4'!V50","v":0},{"$f":"'4'!W50","v":0},{"$f":"'4'!X50","v":0},{"$f":"'4'!Y50","v":0},{"$f":"'4'!Z50","v":0},{"$f":"'4'!AA50","v":0},{"$f":"'4'!AB50","v":0},{"$f":"'4'!AC50","v":0},{"$f":"'4'!AD50","v":0},{"$f":"'4'!AE50","v":0},{"$f":"'4'!AF50","v":0},{"$f":"'4'!AG50","v":0},{"$f":"'4'!AH50","v":0},{"$f":"'4'!AI50","v":0},{"$f":"'4'!AJ50","v":0},{"$f":"'4'!AK50","v":0},{"$f":"'4'!AL50","v":0},{"$f":"'4'!AM50","v":0},{"$f":"'4'!AN50","v":0},{"$f":"'4'!AO50","v":0},{"$f":"'4'!AP50","v":0},{"$f":"'4'!AQ50","v":0},{"$f":"'4'!AR50","v":0},{"$f":"'4'!AS50","v":0},{"$f":"'4'!AT50","v":0},{"$f":"SUMPRODUCT(IF($N262=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N262=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B51","v":"4"},{"$f":"'4'!C51","v":"4.3"},{"$f":"'4'!D51","v":"4.3.1"},{"$f":"'4'!E51","v":""},{"$f":"'4'!F51","v":"4.3.1.2"},{"$f":"'4'!G51","v":0},{"$f":"'4'!H51","v":0},{"$f":"'4'!I51","v":"4.3.1.2.5"},{"$f":"'4'!J51","v":"4.3.1.2.5: Does the capacity plan determine all the technical changes to meet future capacity and performance needs, including horizontal and vertical scaling, changes to system architecture and performance tuning?\n"},{"$f":"'4'!K51","v":0},{"$f":"'4'!L51","v":0},{"$f":"'4'!M51","v":"Recommended"},{"$f":"'4'!N51","v":"Recommended"},{"$f":"'4'!O51","v":"TechOps"},{"$f":"'4'!P51","v":0},{"$f":"'4'!Q51","v":0},{"$f":"'4'!R51","v":0},{"$f":"'4'!S51","v":0},{"$f":"'4'!T51","v":0},{"$f":"'4'!U51","v":0},{"$f":"'4'!V51","v":0},{"$f":"'4'!W51","v":0},{"$f":"'4'!X51","v":0},{"$f":"'4'!Y51","v":0},{"$f":"'4'!Z51","v":0},{"$f":"'4'!AA51","v":0},{"$f":"'4'!AB51","v":0},{"$f":"'4'!AC51","v":0},{"$f":"'4'!AD51","v":0},{"$f":"'4'!AE51","v":0},{"$f":"'4'!AF51","v":0},{"$f":"'4'!AG51","v":0},{"$f":"'4'!AH51","v":0},{"$f":"'4'!AI51","v":0},{"$f":"'4'!AJ51","v":0},{"$f":"'4'!AK51","v":0},{"$f":"'4'!AL51","v":0},{"$f":"'4'!AM51","v":0},{"$f":"'4'!AN51","v":0},{"$f":"'4'!AO51","v":0},{"$f":"'4'!AP51","v":0},{"$f":"'4'!AQ51","v":0},{"$f":"'4'!AR51","v":0},{"$f":"'4'!AS51","v":0},{"$f":"'4'!AT51","v":0},{"$f":"SUMPRODUCT(IF($N263=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N263=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B52","v":"4"},{"$f":"'4'!C52","v":"4.3"},{"$f":"'4'!D52","v":"4.3.1"},{"$f":"'4'!E52","v":""},{"$f":"'4'!F52","v":"4.3.1.2"},{"$f":"'4'!G52","v":0},{"$f":"'4'!H52","v":0},{"$f":"'4'!I52","v":"4.3.1.2.6"},{"$f":"'4'!J52","v":"4.3.1.2.6: Does the capacity plan determine business requirements such as resources, time and planning to implement technical capacity changes?\n"},{"$f":"'4'!K52","v":0},{"$f":"'4'!L52","v":0},{"$f":"'4'!M52","v":"Recommended"},{"$f":"'4'!N52","v":"Recommended"},{"$f":"'4'!O52","v":"TechOps"},{"$f":"'4'!P52","v":0},{"$f":"'4'!Q52","v":0},{"$f":"'4'!R52","v":0},{"$f":"'4'!S52","v":0},{"$f":"'4'!T52","v":0},{"$f":"'4'!U52","v":0},{"$f":"'4'!V52","v":0},{"$f":"'4'!W52","v":0},{"$f":"'4'!X52","v":0},{"$f":"'4'!Y52","v":0},{"$f":"'4'!Z52","v":0},{"$f":"'4'!AA52","v":0},{"$f":"'4'!AB52","v":0},{"$f":"'4'!AC52","v":0},{"$f":"'4'!AD52","v":0},{"$f":"'4'!AE52","v":0},{"$f":"'4'!AF52","v":0},{"$f":"'4'!AG52","v":0},{"$f":"'4'!AH52","v":0},{"$f":"'4'!AI52","v":0},{"$f":"'4'!AJ52","v":0},{"$f":"'4'!AK52","v":0},{"$f":"'4'!AL52","v":0},{"$f":"'4'!AM52","v":0},{"$f":"'4'!AN52","v":0},{"$f":"'4'!AO52","v":0},{"$f":"'4'!AP52","v":0},{"$f":"'4'!AQ52","v":0},{"$f":"'4'!AR52","v":0},{"$f":"'4'!AS52","v":0},{"$f":"'4'!AT52","v":0},{"$f":"SUMPRODUCT(IF($N264=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N264=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B53","v":"4"},{"$f":"'4'!C53","v":"4.3"},{"$f":"'4'!D53","v":"4.3.1"},{"$f":"'4'!E53","v":""},{"$f":"'4'!F53","v":"4.3.1.3"},{"$f":"'4'!G53","v":"4.3.1.3: CAPACITY PLAN - BUSINESS\nThe business capacity plan should determine how the mobile money business team will be scaled to support the forecast business volumes (see 4.3.1.1). Providers should produce a business capacity plan at least annually or more frequently if required due to rates of change to services or service volumes. \n\nThe business capacity plan should address human resource requirements by function, including:\n- Customer service;\n- Agent management;\n- Financial operations;\n- Business operations;\n- AML/CFT;\n- Fraud management.\n"},{"$f":"'4'!H53","v":"ISO 20000-2:2012 Sec. 6.5.3.1-2"},{"$f":"'4'!I53","v":"4.3.1.3.1"},{"$f":"'4'!J53","v":"4.3.1.3.1: Is a business capacity plan produced at least annually or more frequently if required due to rates of change to services or service volumes?\n"},{"$f":"'4'!K53","v":"Business capacity (human resource) plan"},{"$f":"'4'!L53","v":0},{"$f":"'4'!M53","v":"Recommended"},{"$f":"'4'!N53","v":"Recommended"},{"$f":"'4'!O53","v":"BizOps"},{"$f":"'4'!P53","v":0},{"$f":"'4'!Q53","v":0},{"$f":"'4'!R53","v":0},{"$f":"'4'!S53","v":0},{"$f":"'4'!T53","v":0},{"$f":"'4'!U53","v":0},{"$f":"'4'!V53","v":0},{"$f":"'4'!W53","v":0},{"$f":"'4'!X53","v":0},{"$f":"'4'!Y53","v":0},{"$f":"'4'!Z53","v":0},{"$f":"'4'!AA53","v":0},{"$f":"'4'!AB53","v":0},{"$f":"'4'!AC53","v":0},{"$f":"'4'!AD53","v":0},{"$f":"'4'!AE53","v":0},{"$f":"'4'!AF53","v":0},{"$f":"'4'!AG53","v":0},{"$f":"'4'!AH53","v":0},{"$f":"'4'!AI53","v":0},{"$f":"'4'!AJ53","v":0},{"$f":"'4'!AK53","v":0},{"$f":"'4'!AL53","v":0},{"$f":"'4'!AM53","v":0},{"$f":"'4'!AN53","v":0},{"$f":"'4'!AO53","v":0},{"$f":"'4'!AP53","v":0},{"$f":"'4'!AQ53","v":0},{"$f":"'4'!AR53","v":0},{"$f":"'4'!AS53","v":0},{"$f":"'4'!AT53","v":0},{"$f":"SUMPRODUCT(IF($N265=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N265=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B54","v":"4"},{"$f":"'4'!C54","v":"4.3"},{"$f":"'4'!D54","v":"4.3.1"},{"$f":"'4'!E54","v":""},{"$f":"'4'!F54","v":"4.3.1.3"},{"$f":"'4'!G54","v":0},{"$f":"'4'!H54","v":0},{"$f":"'4'!I54","v":"4.3.1.3.2"},{"$f":"'4'!J54","v":"4.3.1.3.2: Does the business capacity plan address human resource requirements by function, including Customer service, Agent management, Financial operations, Business operations, AML/CFT, and Fraud management?\n"},{"$f":"'4'!K54","v":0},{"$f":"'4'!L54","v":0},{"$f":"'4'!M54","v":"Recommended"},{"$f":"'4'!N54","v":"Recommended"},{"$f":"'4'!O54","v":"BizOps"},{"$f":"'4'!P54","v":0},{"$f":"'4'!Q54","v":0},{"$f":"'4'!R54","v":0},{"$f":"'4'!S54","v":0},{"$f":"'4'!T54","v":0},{"$f":"'4'!U54","v":0},{"$f":"'4'!V54","v":0},{"$f":"'4'!W54","v":0},{"$f":"'4'!X54","v":0},{"$f":"'4'!Y54","v":0},{"$f":"'4'!Z54","v":0},{"$f":"'4'!AA54","v":0},{"$f":"'4'!AB54","v":0},{"$f":"'4'!AC54","v":0},{"$f":"'4'!AD54","v":0},{"$f":"'4'!AE54","v":0},{"$f":"'4'!AF54","v":0},{"$f":"'4'!AG54","v":0},{"$f":"'4'!AH54","v":0},{"$f":"'4'!AI54","v":0},{"$f":"'4'!AJ54","v":0},{"$f":"'4'!AK54","v":0},{"$f":"'4'!AL54","v":0},{"$f":"'4'!AM54","v":0},{"$f":"'4'!AN54","v":0},{"$f":"'4'!AO54","v":0},{"$f":"'4'!AP54","v":0},{"$f":"'4'!AQ54","v":0},{"$f":"'4'!AR54","v":0},{"$f":"'4'!AS54","v":0},{"$f":"'4'!AT54","v":0},{"$f":"SUMPRODUCT(IF($N266=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N266=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B55","v":"4"},{"$f":"'4'!C55","v":"4.3"},{"$f":"'4'!D55","v":"4.3.1"},{"$f":"'4'!E55","v":""},{"$f":"'4'!F55","v":"4.3.1.4"},{"$f":"'4'!G55","v":"4.3.1.4: CAPACITY AND PERFORMANCE ALERTS AND REPORTS\nOperational alerts should be raised when the capacity and/or performance of a particular component has become unacceptable.\n\nProviders should produce technical capacity and performance reports. Reports should be generated on the resource utilization of each system component, along with the corresponding transaction response times, transaction rates, and workload volumes. These reports can be used to compare current utilization against forecasts and are important in capacity planning."},{"$f":"'4'!H55","v":0},{"$f":"'4'!I55","v":"4.3.1.4.1"},{"$f":"'4'!J55","v":"4.3.1.4.1: Are operational alerts raised when the capacity and/or performance of a particular component has become unacceptable?\n"},{"$f":"'4'!K55","v":"1) Monitoring and alerting system logs or specification\n- Check there is a process for operational alerts to be raised when the capacity or performance of a particular component has become unacceptable in terms of planned thresholds.  \n"},{"$f":"'4'!L55","v":0},{"$f":"'4'!M55","v":"Standard Required"},{"$f":"'4'!N55","v":"Required"},{"$f":"'4'!O55","v":"TechOps"},{"$f":"'4'!P55","v":0},{"$f":"'4'!Q55","v":0},{"$f":"'4'!R55","v":0},{"$f":"'4'!S55","v":0},{"$f":"'4'!T55","v":0},{"$f":"'4'!U55","v":0},{"$f":"'4'!V55","v":0},{"$f":"'4'!W55","v":0},{"$f":"'4'!X55","v":0},{"$f":"'4'!Y55","v":0},{"$f":"'4'!Z55","v":0},{"$f":"'4'!AA55","v":0},{"$f":"'4'!AB55","v":0},{"$f":"'4'!AC55","v":0},{"$f":"'4'!AD55","v":0},{"$f":"'4'!AE55","v":0},{"$f":"'4'!AF55","v":0},{"$f":"'4'!AG55","v":0},{"$f":"'4'!AH55","v":0},{"$f":"'4'!AI55","v":0},{"$f":"'4'!AJ55","v":0},{"$f":"'4'!AK55","v":0},{"$f":"'4'!AL55","v":0},{"$f":"'4'!AM55","v":0},{"$f":"'4'!AN55","v":0},{"$f":"'4'!AO55","v":0},{"$f":"'4'!AP55","v":0},{"$f":"'4'!AQ55","v":0},{"$f":"'4'!AR55","v":0},{"$f":"'4'!AS55","v":0},{"$f":"'4'!AT55","v":0},{"$f":"SUMPRODUCT(IF($N267=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N267=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B56","v":"4"},{"$f":"'4'!C56","v":"4.3"},{"$f":"'4'!D56","v":"4.3.1"},{"$f":"'4'!E56","v":""},{"$f":"'4'!F56","v":"4.3.1.4"},{"$f":"'4'!G56","v":0},{"$f":"'4'!H56","v":"ISO 20000-1:2019 Sec 8.6.1"},{"$f":"'4'!I56","v":"4.3.1.4.2"},{"$f":"'4'!J56","v":"4.3.1.4.2: Are component-based capacity and performance reports that illustrate system component performance and capacity utilisation regularly produced?\n"},{"$f":"'4'!K56","v":0},{"$f":"'4'!L56","v":0},{"$f":"'4'!M56","v":"Recommended"},{"$f":"'4'!N56","v":"Recommended"},{"$f":"'4'!O56","v":"TechOps"},{"$f":"'4'!P56","v":0},{"$f":"'4'!Q56","v":0},{"$f":"'4'!R56","v":0},{"$f":"'4'!S56","v":0},{"$f":"'4'!T56","v":0},{"$f":"'4'!U56","v":0},{"$f":"'4'!V56","v":0},{"$f":"'4'!W56","v":0},{"$f":"'4'!X56","v":0},{"$f":"'4'!Y56","v":0},{"$f":"'4'!Z56","v":0},{"$f":"'4'!AA56","v":0},{"$f":"'4'!AB56","v":0},{"$f":"'4'!AC56","v":0},{"$f":"'4'!AD56","v":0},{"$f":"'4'!AE56","v":0},{"$f":"'4'!AF56","v":0},{"$f":"'4'!AG56","v":0},{"$f":"'4'!AH56","v":0},{"$f":"'4'!AI56","v":0},{"$f":"'4'!AJ56","v":0},{"$f":"'4'!AK56","v":0},{"$f":"'4'!AL56","v":0},{"$f":"'4'!AM56","v":0},{"$f":"'4'!AN56","v":0},{"$f":"'4'!AO56","v":0},{"$f":"'4'!AP56","v":0},{"$f":"'4'!AQ56","v":0},{"$f":"'4'!AR56","v":0},{"$f":"'4'!AS56","v":0},{"$f":"'4'!AT56","v":0},{"$f":"SUMPRODUCT(IF($N268=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N268=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B57","v":"4"},{"$f":"'4'!C57","v":"4.3"},{"$f":"'4'!D57","v":"4.3.1"},{"$f":"'4'!E57","v":""},{"$f":"'4'!F57","v":"4.3.1.5"},{"$f":"'4'!G57","v":"4.3.1.5: CAPACITY TESTING\nCapacity testing of the mobile money system should be performed whenever significant changes are made to the system, including application, architecture or infrastructure changes. \n\nTesting should be done on a test system that is scaled to be representative of the live system.\n\nDifferent configurations and transaction mixes can significantly impact system performance. Capacity testing should test a number of configurations and transaction mixes so that all realistically-expected scenarios are tested.\n\n"},{"$f":"'4'!H57","v":"ISO 20000-2:2012 Sec.6.5.3.1"},{"$f":"'4'!I57","v":"4.3.1.5.1"},{"$f":"'4'!J57","v":"4.3.1.5.1: Is capacity testing of the mobile money system performed whenever significant changes are made to the system, including application, architecture or infrastructure changes?\n"},{"$f":"'4'!K57","v":"Capacity testing plan"},{"$f":"'4'!L57","v":0},{"$f":"'4'!M57","v":"Recommended"},{"$f":"'4'!N57","v":"Recommended"},{"$f":"'4'!O57","v":"TechOps"},{"$f":"'4'!P57","v":0},{"$f":"'4'!Q57","v":0},{"$f":"'4'!R57","v":0},{"$f":"'4'!S57","v":0},{"$f":"'4'!T57","v":0},{"$f":"'4'!U57","v":0},{"$f":"'4'!V57","v":0},{"$f":"'4'!W57","v":0},{"$f":"'4'!X57","v":0},{"$f":"'4'!Y57","v":0},{"$f":"'4'!Z57","v":0},{"$f":"'4'!AA57","v":0},{"$f":"'4'!AB57","v":0},{"$f":"'4'!AC57","v":0},{"$f":"'4'!AD57","v":0},{"$f":"'4'!AE57","v":0},{"$f":"'4'!AF57","v":0},{"$f":"'4'!AG57","v":0},{"$f":"'4'!AH57","v":0},{"$f":"'4'!AI57","v":0},{"$f":"'4'!AJ57","v":0},{"$f":"'4'!AK57","v":0},{"$f":"'4'!AL57","v":0},{"$f":"'4'!AM57","v":0},{"$f":"'4'!AN57","v":0},{"$f":"'4'!AO57","v":0},{"$f":"'4'!AP57","v":0},{"$f":"'4'!AQ57","v":0},{"$f":"'4'!AR57","v":0},{"$f":"'4'!AS57","v":0},{"$f":"'4'!AT57","v":0},{"$f":"SUMPRODUCT(IF($N269=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N269=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B58","v":"4"},{"$f":"'4'!C58","v":"4.3"},{"$f":"'4'!D58","v":"4.3.1"},{"$f":"'4'!E58","v":""},{"$f":"'4'!F58","v":"4.3.1.5"},{"$f":"'4'!G58","v":0},{"$f":"'4'!H58","v":0},{"$f":"'4'!I58","v":"4.3.1.5.2"},{"$f":"'4'!J58","v":"4.3.1.5.2: Is capacity testing done on a test system that is scaled to be representative of the live system?\n"},{"$f":"'4'!K58","v":0},{"$f":"'4'!L58","v":0},{"$f":"'4'!M58","v":"Recommended"},{"$f":"'4'!N58","v":"Recommended"},{"$f":"'4'!O58","v":"TechOps"},{"$f":"'4'!P58","v":0},{"$f":"'4'!Q58","v":0},{"$f":"'4'!R58","v":0},{"$f":"'4'!S58","v":0},{"$f":"'4'!T58","v":0},{"$f":"'4'!U58","v":0},{"$f":"'4'!V58","v":0},{"$f":"'4'!W58","v":0},{"$f":"'4'!X58","v":0},{"$f":"'4'!Y58","v":0},{"$f":"'4'!Z58","v":0},{"$f":"'4'!AA58","v":0},{"$f":"'4'!AB58","v":0},{"$f":"'4'!AC58","v":0},{"$f":"'4'!AD58","v":0},{"$f":"'4'!AE58","v":0},{"$f":"'4'!AF58","v":0},{"$f":"'4'!AG58","v":0},{"$f":"'4'!AH58","v":0},{"$f":"'4'!AI58","v":0},{"$f":"'4'!AJ58","v":0},{"$f":"'4'!AK58","v":0},{"$f":"'4'!AL58","v":0},{"$f":"'4'!AM58","v":0},{"$f":"'4'!AN58","v":0},{"$f":"'4'!AO58","v":0},{"$f":"'4'!AP58","v":0},{"$f":"'4'!AQ58","v":0},{"$f":"'4'!AR58","v":0},{"$f":"'4'!AS58","v":0},{"$f":"'4'!AT58","v":0},{"$f":"SUMPRODUCT(IF($N270=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N270=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B59","v":"4"},{"$f":"'4'!C59","v":"4.3"},{"$f":"'4'!D59","v":"4.3.1"},{"$f":"'4'!E59","v":""},{"$f":"'4'!F59","v":"4.3.1.5"},{"$f":"'4'!G59","v":0},{"$f":"'4'!H59","v":0},{"$f":"'4'!I59","v":"4.3.1.5.3"},{"$f":"'4'!J59","v":"4.3.1.5.3: Does capacity testing test a number of configurations and transaction mixes so that all realistically-expected scenarios are tested?\n"},{"$f":"'4'!K59","v":0},{"$f":"'4'!L59","v":0},{"$f":"'4'!M59","v":"Recommended"},{"$f":"'4'!N59","v":"Recommended"},{"$f":"'4'!O59","v":"TechOps"},{"$f":"'4'!P59","v":0},{"$f":"'4'!Q59","v":0},{"$f":"'4'!R59","v":0},{"$f":"'4'!S59","v":0},{"$f":"'4'!T59","v":0},{"$f":"'4'!U59","v":0},{"$f":"'4'!V59","v":0},{"$f":"'4'!W59","v":0},{"$f":"'4'!X59","v":0},{"$f":"'4'!Y59","v":0},{"$f":"'4'!Z59","v":0},{"$f":"'4'!AA59","v":0},{"$f":"'4'!AB59","v":0},{"$f":"'4'!AC59","v":0},{"$f":"'4'!AD59","v":0},{"$f":"'4'!AE59","v":0},{"$f":"'4'!AF59","v":0},{"$f":"'4'!AG59","v":0},{"$f":"'4'!AH59","v":0},{"$f":"'4'!AI59","v":0},{"$f":"'4'!AJ59","v":0},{"$f":"'4'!AK59","v":0},{"$f":"'4'!AL59","v":0},{"$f":"'4'!AM59","v":0},{"$f":"'4'!AN59","v":0},{"$f":"'4'!AO59","v":0},{"$f":"'4'!AP59","v":0},{"$f":"'4'!AQ59","v":0},{"$f":"'4'!AR59","v":0},{"$f":"'4'!AS59","v":0},{"$f":"'4'!AT59","v":0},{"$f":"SUMPRODUCT(IF($N271=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N271=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B60","v":"4"},{"$f":"'4'!C60","v":"4.3"},{"$f":"'4'!D60","v":"4.3.1"},{"$f":"'4'!E60","v":""},{"$f":"'4'!F60","v":"4.3.1.6"},{"$f":"'4'!G60","v":"4.3.1.6: TECHNICAL CAPACITY ANALYSIS\nCapacity limitations of all system components should be assessed and the maximum recommended utilization level should be documented, beyond which the resource will be over-utilised and the performance of the services using the resource will be impaired.\n\nArchitectural bottlenecks and other known weaknesses should be identified, along with redundancy and spare capacity.\n\nCurrent and past throughput and performance should be recorded and analysed, including comparisons of actual achievements against forecasts. This will give a picture of the system capacity and expected resource utilization.\n\nModelling can be used to predict resource utilization as volumes increase. Trend analysis (using the business forecast) should be applied to a baseline model. Analytical system modelling can also be used to analyse performance – for example modelling transaction rates against a given system configuration.\n"},{"$f":"'4'!H60","v":"ISO 20000-1:2011 Sec. 6.5"},{"$f":"'4'!I60","v":"4.3.1.6.1"},{"$f":"'4'!J60","v":"4.3.1.6.1: Is the maximum recommended utilization level of each system component documented?\n"},{"$f":"'4'!K60","v":"Current system capacity report (disk, memory, CPU by system component)"},{"$f":"'4'!L60","v":0},{"$f":"'4'!M60","v":"Recommended"},{"$f":"'4'!N60","v":"Recommended"},{"$f":"'4'!O60","v":"TechOps"},{"$f":"'4'!P60","v":0},{"$f":"'4'!Q60","v":0},{"$f":"'4'!R60","v":0},{"$f":"'4'!S60","v":0},{"$f":"'4'!T60","v":0},{"$f":"'4'!U60","v":0},{"$f":"'4'!V60","v":0},{"$f":"'4'!W60","v":0},{"$f":"'4'!X60","v":0},{"$f":"'4'!Y60","v":0},{"$f":"'4'!Z60","v":0},{"$f":"'4'!AA60","v":0},{"$f":"'4'!AB60","v":0},{"$f":"'4'!AC60","v":0},{"$f":"'4'!AD60","v":0},{"$f":"'4'!AE60","v":0},{"$f":"'4'!AF60","v":0},{"$f":"'4'!AG60","v":0},{"$f":"'4'!AH60","v":0},{"$f":"'4'!AI60","v":0},{"$f":"'4'!AJ60","v":0},{"$f":"'4'!AK60","v":0},{"$f":"'4'!AL60","v":0},{"$f":"'4'!AM60","v":0},{"$f":"'4'!AN60","v":0},{"$f":"'4'!AO60","v":0},{"$f":"'4'!AP60","v":0},{"$f":"'4'!AQ60","v":0},{"$f":"'4'!AR60","v":0},{"$f":"'4'!AS60","v":0},{"$f":"'4'!AT60","v":0},{"$f":"SUMPRODUCT(IF($N272=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N272=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B61","v":"4"},{"$f":"'4'!C61","v":"4.3"},{"$f":"'4'!D61","v":"4.3.1"},{"$f":"'4'!E61","v":""},{"$f":"'4'!F61","v":"4.3.1.6"},{"$f":"'4'!G61","v":0},{"$f":"'4'!H61","v":0},{"$f":"'4'!I61","v":"4.3.1.6.2"},{"$f":"'4'!J61","v":"4.3.1.6.2: Are architectural bottlenecks and other known weaknesses identified, along with redundancy and spare capacity?\n"},{"$f":"'4'!K61","v":0},{"$f":"'4'!L61","v":0},{"$f":"'4'!M61","v":"Recommended"},{"$f":"'4'!N61","v":"Recommended"},{"$f":"'4'!O61","v":"TechOps"},{"$f":"'4'!P61","v":0},{"$f":"'4'!Q61","v":0},{"$f":"'4'!R61","v":0},{"$f":"'4'!S61","v":0},{"$f":"'4'!T61","v":0},{"$f":"'4'!U61","v":0},{"$f":"'4'!V61","v":0},{"$f":"'4'!W61","v":0},{"$f":"'4'!X61","v":0},{"$f":"'4'!Y61","v":0},{"$f":"'4'!Z61","v":0},{"$f":"'4'!AA61","v":0},{"$f":"'4'!AB61","v":0},{"$f":"'4'!AC61","v":0},{"$f":"'4'!AD61","v":0},{"$f":"'4'!AE61","v":0},{"$f":"'4'!AF61","v":0},{"$f":"'4'!AG61","v":0},{"$f":"'4'!AH61","v":0},{"$f":"'4'!AI61","v":0},{"$f":"'4'!AJ61","v":0},{"$f":"'4'!AK61","v":0},{"$f":"'4'!AL61","v":0},{"$f":"'4'!AM61","v":0},{"$f":"'4'!AN61","v":0},{"$f":"'4'!AO61","v":0},{"$f":"'4'!AP61","v":0},{"$f":"'4'!AQ61","v":0},{"$f":"'4'!AR61","v":0},{"$f":"'4'!AS61","v":0},{"$f":"'4'!AT61","v":0},{"$f":"SUMPRODUCT(IF($N273=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N273=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B62","v":"4"},{"$f":"'4'!C62","v":"4.3"},{"$f":"'4'!D62","v":"4.3.1"},{"$f":"'4'!E62","v":""},{"$f":"'4'!F62","v":"4.3.1.6"},{"$f":"'4'!G62","v":0},{"$f":"'4'!H62","v":0},{"$f":"'4'!I62","v":"4.3.1.6.3"},{"$f":"'4'!J62","v":"4.3.1.6.3: Is current and past throughput and performance recorded and analysed, including comparisons of actual achievements against forecasts?\n"},{"$f":"'4'!K62","v":0},{"$f":"'4'!L62","v":0},{"$f":"'4'!M62","v":"Recommended"},{"$f":"'4'!N62","v":"Recommended"},{"$f":"'4'!O62","v":"TechOps"},{"$f":"'4'!P62","v":0},{"$f":"'4'!Q62","v":0},{"$f":"'4'!R62","v":0},{"$f":"'4'!S62","v":0},{"$f":"'4'!T62","v":0},{"$f":"'4'!U62","v":0},{"$f":"'4'!V62","v":0},{"$f":"'4'!W62","v":0},{"$f":"'4'!X62","v":0},{"$f":"'4'!Y62","v":0},{"$f":"'4'!Z62","v":0},{"$f":"'4'!AA62","v":0},{"$f":"'4'!AB62","v":0},{"$f":"'4'!AC62","v":0},{"$f":"'4'!AD62","v":0},{"$f":"'4'!AE62","v":0},{"$f":"'4'!AF62","v":0},{"$f":"'4'!AG62","v":0},{"$f":"'4'!AH62","v":0},{"$f":"'4'!AI62","v":0},{"$f":"'4'!AJ62","v":0},{"$f":"'4'!AK62","v":0},{"$f":"'4'!AL62","v":0},{"$f":"'4'!AM62","v":0},{"$f":"'4'!AN62","v":0},{"$f":"'4'!AO62","v":0},{"$f":"'4'!AP62","v":0},{"$f":"'4'!AQ62","v":0},{"$f":"'4'!AR62","v":0},{"$f":"'4'!AS62","v":0},{"$f":"'4'!AT62","v":0},{"$f":"SUMPRODUCT(IF($N274=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N274=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B64","v":"4"},{"$f":"'4'!C64","v":"4.4"},{"$f":"'4'!D64","v":"4.4.1"},{"$f":"'4'!E64","v":"4.4.1: Providers shall set up an incident management process to restore the service within agreed service levels and to investigate root causes of problems"},{"$f":"'4'!F64","v":"4.4.1.1"},{"$f":"'4'!G64","v":"4.4.1.1: INCIDENT MANAGEMENT\nAn incident management process should be established that can:\n- record and classify incidents (see defnition);\n- analyse and prioritize incidents;\n- resolve and close incidents according to agreed service levels;\n- escalate incidents that have not progressed according to agreed service levels;\n- report to technical and business management on the status and progress of incidents.\n- Establish if there are any patterns in incidents.\n\nThe focus of incident management is on reducing the duration and limiting the consequences of the service issue (e.g. by implementing a workaround) and not on addressing the root cause of the incident.\n\nIncident management will be subject to an operational support period and an SLA - see 4.2.1.3."},{"$f":"'4'!H64","v":"ISO 20000-1:2019 Sec 8.6.1"},{"$f":"'4'!I64","v":"4.4.1.1.1"},{"$f":"'4'!J64","v":"4.4.1.1.1: Are incidents being recorded, analysed, and prioritised?\n"},{"$f":"'4'!K64","v":"1) Incident management process \n- Check incidents are being recorded, analysed and prioritised.  "},{"$f":"'4'!L64","v":0},{"$f":"'4'!M64","v":"Urgent Required"},{"$f":"'4'!N64","v":"Required"},{"$f":"'4'!O64","v":"TechOps"},{"$f":"'4'!P64","v":0},{"$f":"'4'!Q64","v":0},{"$f":"'4'!R64","v":0},{"$f":"'4'!S64","v":0},{"$f":"'4'!T64","v":0},{"$f":"'4'!U64","v":0},{"$f":"'4'!V64","v":0},{"$f":"'4'!W64","v":0},{"$f":"'4'!X64","v":0},{"$f":"'4'!Y64","v":0},{"$f":"'4'!Z64","v":0},{"$f":"'4'!AA64","v":0},{"$f":"'4'!AB64","v":0},{"$f":"'4'!AC64","v":0},{"$f":"'4'!AD64","v":0},{"$f":"'4'!AE64","v":0},{"$f":"'4'!AF64","v":0},{"$f":"'4'!AG64","v":0},{"$f":"'4'!AH64","v":0},{"$f":"'4'!AI64","v":0},{"$f":"'4'!AJ64","v":0},{"$f":"'4'!AK64","v":0},{"$f":"'4'!AL64","v":0},{"$f":"'4'!AM64","v":0},{"$f":"'4'!AN64","v":0},{"$f":"'4'!AO64","v":0},{"$f":"'4'!AP64","v":0},{"$f":"'4'!AQ64","v":0},{"$f":"'4'!AR64","v":0},{"$f":"'4'!AS64","v":0},{"$f":"'4'!AT64","v":0},{"$f":"SUMPRODUCT(IF($N275=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N275=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B65","v":"4"},{"$f":"'4'!C65","v":"4.4"},{"$f":"'4'!D65","v":"4.4.1"},{"$f":"'4'!E65","v":0},{"$f":"'4'!F65","v":"4.4.1.1"},{"$f":"'4'!G65","v":0},{"$f":"'4'!H65","v":0},{"$f":"'4'!I65","v":"4.4.1.1.2"},{"$f":"'4'!J65","v":"4.4.1.1.2: Are incidents which have not progressed according to agreed service levels being escalated?\n"},{"$f":"'4'!K65","v":"1) Incident management process\n- Check that incidents which are not closed within SLA have been escalated according to the incident management process."},{"$f":"'4'!L65","v":0},{"$f":"'4'!M65","v":"Urgent Required"},{"$f":"'4'!N65","v":"Required"},{"$f":"'4'!O65","v":"TechOps"},{"$f":"'4'!P65","v":0},{"$f":"'4'!Q65","v":0},{"$f":"'4'!R65","v":0},{"$f":"'4'!S65","v":0},{"$f":"'4'!T65","v":0},{"$f":"'4'!U65","v":0},{"$f":"'4'!V65","v":0},{"$f":"'4'!W65","v":0},{"$f":"'4'!X65","v":0},{"$f":"'4'!Y65","v":0},{"$f":"'4'!Z65","v":0},{"$f":"'4'!AA65","v":0},{"$f":"'4'!AB65","v":0},{"$f":"'4'!AC65","v":0},{"$f":"'4'!AD65","v":0},{"$f":"'4'!AE65","v":0},{"$f":"'4'!AF65","v":0},{"$f":"'4'!AG65","v":0},{"$f":"'4'!AH65","v":0},{"$f":"'4'!AI65","v":0},{"$f":"'4'!AJ65","v":0},{"$f":"'4'!AK65","v":0},{"$f":"'4'!AL65","v":0},{"$f":"'4'!AM65","v":0},{"$f":"'4'!AN65","v":0},{"$f":"'4'!AO65","v":0},{"$f":"'4'!AP65","v":0},{"$f":"'4'!AQ65","v":0},{"$f":"'4'!AR65","v":0},{"$f":"'4'!AS65","v":0},{"$f":"'4'!AT65","v":0},{"$f":"SUMPRODUCT(IF($N276=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N276=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B66","v":"4"},{"$f":"'4'!C66","v":"4.4"},{"$f":"'4'!D66","v":"4.4.1"},{"$f":"'4'!E66","v":0},{"$f":"'4'!F66","v":"4.4.1.1"},{"$f":"'4'!G66","v":0},{"$f":"'4'!H66","v":0},{"$f":"'4'!I66","v":"4.4.1.1.3"},{"$f":"'4'!J66","v":"4.4.1.1.3: Are incidents being resolved and closed according to agreed service levels?\n"},{"$f":"'4'!K66","v":0},{"$f":"'4'!L66","v":0},{"$f":"'4'!M66","v":"Recommended"},{"$f":"'4'!N66","v":"Recommended"},{"$f":"'4'!O66","v":"TechOps"},{"$f":"'4'!P66","v":0},{"$f":"'4'!Q66","v":0},{"$f":"'4'!R66","v":0},{"$f":"'4'!S66","v":0},{"$f":"'4'!T66","v":0},{"$f":"'4'!U66","v":0},{"$f":"'4'!V66","v":0},{"$f":"'4'!W66","v":0},{"$f":"'4'!X66","v":0},{"$f":"'4'!Y66","v":0},{"$f":"'4'!Z66","v":0},{"$f":"'4'!AA66","v":0},{"$f":"'4'!AB66","v":0},{"$f":"'4'!AC66","v":0},{"$f":"'4'!AD66","v":0},{"$f":"'4'!AE66","v":0},{"$f":"'4'!AF66","v":0},{"$f":"'4'!AG66","v":0},{"$f":"'4'!AH66","v":0},{"$f":"'4'!AI66","v":0},{"$f":"'4'!AJ66","v":0},{"$f":"'4'!AK66","v":0},{"$f":"'4'!AL66","v":0},{"$f":"'4'!AM66","v":0},{"$f":"'4'!AN66","v":0},{"$f":"'4'!AO66","v":0},{"$f":"'4'!AP66","v":0},{"$f":"'4'!AQ66","v":0},{"$f":"'4'!AR66","v":0},{"$f":"'4'!AS66","v":0},{"$f":"'4'!AT66","v":0},{"$f":"SUMPRODUCT(IF($N277=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N277=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B67","v":"4"},{"$f":"'4'!C67","v":"4.4"},{"$f":"'4'!D67","v":"4.4.1"},{"$f":"'4'!E67","v":0},{"$f":"'4'!F67","v":"4.4.1.1"},{"$f":"'4'!G67","v":0},{"$f":"'4'!H67","v":0},{"$f":"'4'!I67","v":"4.4.1.1.4"},{"$f":"'4'!J67","v":"4.4.1.1.4: Are reports generated on the status and progress of incidents and provided regularly to technical and business management?\n"},{"$f":"'4'!K67","v":0},{"$f":"'4'!L67","v":0},{"$f":"'4'!M67","v":"Recommended"},{"$f":"'4'!N67","v":"Recommended"},{"$f":"'4'!O67","v":"TechOps"},{"$f":"'4'!P67","v":0},{"$f":"'4'!Q67","v":0},{"$f":"'4'!R67","v":0},{"$f":"'4'!S67","v":0},{"$f":"'4'!T67","v":0},{"$f":"'4'!U67","v":0},{"$f":"'4'!V67","v":0},{"$f":"'4'!W67","v":0},{"$f":"'4'!X67","v":0},{"$f":"'4'!Y67","v":0},{"$f":"'4'!Z67","v":0},{"$f":"'4'!AA67","v":0},{"$f":"'4'!AB67","v":0},{"$f":"'4'!AC67","v":0},{"$f":"'4'!AD67","v":0},{"$f":"'4'!AE67","v":0},{"$f":"'4'!AF67","v":0},{"$f":"'4'!AG67","v":0},{"$f":"'4'!AH67","v":0},{"$f":"'4'!AI67","v":0},{"$f":"'4'!AJ67","v":0},{"$f":"'4'!AK67","v":0},{"$f":"'4'!AL67","v":0},{"$f":"'4'!AM67","v":0},{"$f":"'4'!AN67","v":0},{"$f":"'4'!AO67","v":0},{"$f":"'4'!AP67","v":0},{"$f":"'4'!AQ67","v":0},{"$f":"'4'!AR67","v":0},{"$f":"'4'!AS67","v":0},{"$f":"'4'!AT67","v":0},{"$f":"SUMPRODUCT(IF($N278=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N278=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B68","v":"4"},{"$f":"'4'!C68","v":"4.4"},{"$f":"'4'!D68","v":"4.4.1"},{"$f":"'4'!E68","v":""},{"$f":"'4'!F68","v":"4.4.1.2"},{"$f":"'4'!G68","v":"4.4.1.2: SERVICE REQUEST MANAGEMENT\nService requests (see definition) are routine requests that require action by the technical operations team. \n\nThe service request management process should:\n- record and classify service requests;\n- implement and close service requests according to agreed service levels;\n- escalate service requests which have not progressed according to agreed service levels;\n- report to technical and business management on the status and progress of service requests."},{"$f":"'4'!H68","v":"ISO 20000-1:2011 Sec. 8.1\nITIL 3"},{"$f":"'4'!I68","v":"4.4.1.2.1"},{"$f":"'4'!J68","v":"4.4.1.2.1: Has a service request process been implemented (see definition)?\n"},{"$f":"'4'!K68","v":0},{"$f":"'4'!L68","v":0},{"$f":"'4'!M68","v":"Recommended"},{"$f":"'4'!N68","v":"Recommended"},{"$f":"'4'!O68","v":"TechOps"},{"$f":"'4'!P68","v":0},{"$f":"'4'!Q68","v":0},{"$f":"'4'!R68","v":0},{"$f":"'4'!S68","v":0},{"$f":"'4'!T68","v":0},{"$f":"'4'!U68","v":0},{"$f":"'4'!V68","v":0},{"$f":"'4'!W68","v":0},{"$f":"'4'!X68","v":0},{"$f":"'4'!Y68","v":0},{"$f":"'4'!Z68","v":0},{"$f":"'4'!AA68","v":0},{"$f":"'4'!AB68","v":0},{"$f":"'4'!AC68","v":0},{"$f":"'4'!AD68","v":0},{"$f":"'4'!AE68","v":0},{"$f":"'4'!AF68","v":0},{"$f":"'4'!AG68","v":0},{"$f":"'4'!AH68","v":0},{"$f":"'4'!AI68","v":0},{"$f":"'4'!AJ68","v":0},{"$f":"'4'!AK68","v":0},{"$f":"'4'!AL68","v":0},{"$f":"'4'!AM68","v":0},{"$f":"'4'!AN68","v":0},{"$f":"'4'!AO68","v":0},{"$f":"'4'!AP68","v":0},{"$f":"'4'!AQ68","v":0},{"$f":"'4'!AR68","v":0},{"$f":"'4'!AS68","v":0},{"$f":"'4'!AT68","v":0},{"$f":"SUMPRODUCT(IF($N279=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N279=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B69","v":"4"},{"$f":"'4'!C69","v":"4.4"},{"$f":"'4'!D69","v":"4.4.1"},{"$f":"'4'!E69","v":""},{"$f":"'4'!F69","v":"4.4.1.2"},{"$f":"'4'!G69","v":0},{"$f":"'4'!H69","v":0},{"$f":"'4'!I69","v":"4.4.1.2.2"},{"$f":"'4'!J69","v":"4.4.1.2.2: Are service requests being implemented and closed according to agreed service levels (and escalated if necessary)?\n"},{"$f":"'4'!K69","v":0},{"$f":"'4'!L69","v":0},{"$f":"'4'!M69","v":"Recommended"},{"$f":"'4'!N69","v":"Recommended"},{"$f":"'4'!O69","v":"TechOps"},{"$f":"'4'!P69","v":0},{"$f":"'4'!Q69","v":0},{"$f":"'4'!R69","v":0},{"$f":"'4'!S69","v":0},{"$f":"'4'!T69","v":0},{"$f":"'4'!U69","v":0},{"$f":"'4'!V69","v":0},{"$f":"'4'!W69","v":0},{"$f":"'4'!X69","v":0},{"$f":"'4'!Y69","v":0},{"$f":"'4'!Z69","v":0},{"$f":"'4'!AA69","v":0},{"$f":"'4'!AB69","v":0},{"$f":"'4'!AC69","v":0},{"$f":"'4'!AD69","v":0},{"$f":"'4'!AE69","v":0},{"$f":"'4'!AF69","v":0},{"$f":"'4'!AG69","v":0},{"$f":"'4'!AH69","v":0},{"$f":"'4'!AI69","v":0},{"$f":"'4'!AJ69","v":0},{"$f":"'4'!AK69","v":0},{"$f":"'4'!AL69","v":0},{"$f":"'4'!AM69","v":0},{"$f":"'4'!AN69","v":0},{"$f":"'4'!AO69","v":0},{"$f":"'4'!AP69","v":0},{"$f":"'4'!AQ69","v":0},{"$f":"'4'!AR69","v":0},{"$f":"'4'!AS69","v":0},{"$f":"'4'!AT69","v":0},{"$f":"SUMPRODUCT(IF($N280=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N280=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B70","v":"4"},{"$f":"'4'!C70","v":"4.4"},{"$f":"'4'!D70","v":"4.4.1"},{"$f":"'4'!E70","v":""},{"$f":"'4'!F70","v":"4.4.1.2"},{"$f":"'4'!G70","v":0},{"$f":"'4'!H70","v":0},{"$f":"'4'!I70","v":"4.4.1.2.3"},{"$f":"'4'!J70","v":"4.4.1.2.3: Are reports generated on the status and progress of service requests and provided regularly to technical and business management?\n"},{"$f":"'4'!K70","v":0},{"$f":"'4'!L70","v":0},{"$f":"'4'!M70","v":"Recommended"},{"$f":"'4'!N70","v":"Recommended"},{"$f":"'4'!O70","v":"TechOps"},{"$f":"'4'!P70","v":0},{"$f":"'4'!Q70","v":0},{"$f":"'4'!R70","v":0},{"$f":"'4'!S70","v":0},{"$f":"'4'!T70","v":0},{"$f":"'4'!U70","v":0},{"$f":"'4'!V70","v":0},{"$f":"'4'!W70","v":0},{"$f":"'4'!X70","v":0},{"$f":"'4'!Y70","v":0},{"$f":"'4'!Z70","v":0},{"$f":"'4'!AA70","v":0},{"$f":"'4'!AB70","v":0},{"$f":"'4'!AC70","v":0},{"$f":"'4'!AD70","v":0},{"$f":"'4'!AE70","v":0},{"$f":"'4'!AF70","v":0},{"$f":"'4'!AG70","v":0},{"$f":"'4'!AH70","v":0},{"$f":"'4'!AI70","v":0},{"$f":"'4'!AJ70","v":0},{"$f":"'4'!AK70","v":0},{"$f":"'4'!AL70","v":0},{"$f":"'4'!AM70","v":0},{"$f":"'4'!AN70","v":0},{"$f":"'4'!AO70","v":0},{"$f":"'4'!AP70","v":0},{"$f":"'4'!AQ70","v":0},{"$f":"'4'!AR70","v":0},{"$f":"'4'!AS70","v":0},{"$f":"'4'!AT70","v":0},{"$f":"SUMPRODUCT(IF($N281=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N281=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B71","v":"4"},{"$f":"'4'!C71","v":"4.4"},{"$f":"'4'!D71","v":"4.4.1"},{"$f":"'4'!E71","v":""},{"$f":"'4'!F71","v":"4.4.1.3"},{"$f":"'4'!G71","v":"4.4.1.3: PROBLEM MANAGEMENT\nProblem management differs from incident management in that it deals with underlying issues that may or may not directly affect the user (see definition). The aim of incident management is to restore the service to the user as quickly as possible, often through a workaround, while the aim of problem management is to try to find a permanent solution to the problem.\n\nProviders should establish a problem management process to minimize service disruption by:\n- identifying, recording, and classifying problems proactively and reactively;\n- analysing and prioritizing problems;\n- resolving and closing problems according to agreed service levels;\n- escalating problems which have not progressed according to agreed service levels;\n- minimizing the effect of unresolved problems through workarounds and other solutions; and\n- communicating the status and progress of problem resolution to technical and business management.\n\nThe service level for resolving problems is often stated as a \"number of outstanding problems\" rather than a resolution time, as some problems can take a long time to solve. The number of outstanding problems should not grow over time."},{"$f":"'4'!H71","v":"ISO 20000-1:2019 Sec 8.6.3\nITIL"},{"$f":"'4'!I71","v":"4.4.1.3.1"},{"$f":"'4'!J71","v":"4.4.1.3.1: Are problems (see definition) being identified, recorded and prioritised?\n"},{"$f":"'4'!K71","v":"1) Documented problem management process \n- Check the process requires problems to be:\na) Identified\nb) Recorded \nc) Prioritised\n- Check the log to see if the process implemented\n\n\n"},{"$f":"'4'!L71","v":0},{"$f":"'4'!M71","v":"Standard Required"},{"$f":"'4'!N71","v":"Required"},{"$f":"'4'!O71","v":"TechOps"},{"$f":"'4'!P71","v":0},{"$f":"'4'!Q71","v":0},{"$f":"'4'!R71","v":0},{"$f":"'4'!S71","v":0},{"$f":"'4'!T71","v":0},{"$f":"'4'!U71","v":0},{"$f":"'4'!V71","v":0},{"$f":"'4'!W71","v":0},{"$f":"'4'!X71","v":0},{"$f":"'4'!Y71","v":0},{"$f":"'4'!Z71","v":0},{"$f":"'4'!AA71","v":0},{"$f":"'4'!AB71","v":0},{"$f":"'4'!AC71","v":0},{"$f":"'4'!AD71","v":0},{"$f":"'4'!AE71","v":0},{"$f":"'4'!AF71","v":0},{"$f":"'4'!AG71","v":0},{"$f":"'4'!AH71","v":0},{"$f":"'4'!AI71","v":0},{"$f":"'4'!AJ71","v":0},{"$f":"'4'!AK71","v":0},{"$f":"'4'!AL71","v":0},{"$f":"'4'!AM71","v":0},{"$f":"'4'!AN71","v":0},{"$f":"'4'!AO71","v":0},{"$f":"'4'!AP71","v":0},{"$f":"'4'!AQ71","v":0},{"$f":"'4'!AR71","v":0},{"$f":"'4'!AS71","v":0},{"$f":"'4'!AT71","v":0},{"$f":"SUMPRODUCT(IF($N282=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N282=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B72","v":"4"},{"$f":"'4'!C72","v":"4.4"},{"$f":"'4'!D72","v":"4.4.1"},{"$f":"'4'!E72","v":""},{"$f":"'4'!F72","v":"4.4.1.3"},{"$f":"'4'!G72","v":0},{"$f":"'4'!H72","v":0},{"$f":"'4'!I72","v":"4.4.1.3.2"},{"$f":"'4'!J72","v":"4.4.1.3.2: Are problems being resolved and closed according to agreed service levels?\n"},{"$f":"'4'!K72","v":0},{"$f":"'4'!L72","v":0},{"$f":"'4'!M72","v":"Recommended"},{"$f":"'4'!N72","v":"Recommended"},{"$f":"'4'!O72","v":"TechOps"},{"$f":"'4'!P72","v":0},{"$f":"'4'!Q72","v":0},{"$f":"'4'!R72","v":0},{"$f":"'4'!S72","v":0},{"$f":"'4'!T72","v":0},{"$f":"'4'!U72","v":0},{"$f":"'4'!V72","v":0},{"$f":"'4'!W72","v":0},{"$f":"'4'!X72","v":0},{"$f":"'4'!Y72","v":0},{"$f":"'4'!Z72","v":0},{"$f":"'4'!AA72","v":0},{"$f":"'4'!AB72","v":0},{"$f":"'4'!AC72","v":0},{"$f":"'4'!AD72","v":0},{"$f":"'4'!AE72","v":0},{"$f":"'4'!AF72","v":0},{"$f":"'4'!AG72","v":0},{"$f":"'4'!AH72","v":0},{"$f":"'4'!AI72","v":0},{"$f":"'4'!AJ72","v":0},{"$f":"'4'!AK72","v":0},{"$f":"'4'!AL72","v":0},{"$f":"'4'!AM72","v":0},{"$f":"'4'!AN72","v":0},{"$f":"'4'!AO72","v":0},{"$f":"'4'!AP72","v":0},{"$f":"'4'!AQ72","v":0},{"$f":"'4'!AR72","v":0},{"$f":"'4'!AS72","v":0},{"$f":"'4'!AT72","v":0},{"$f":"SUMPRODUCT(IF($N283=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N283=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B73","v":"4"},{"$f":"'4'!C73","v":"4.4"},{"$f":"'4'!D73","v":"4.4.1"},{"$f":"'4'!E73","v":""},{"$f":"'4'!F73","v":"4.4.1.3"},{"$f":"'4'!G73","v":0},{"$f":"'4'!H73","v":0},{"$f":"'4'!I73","v":"4.4.1.3.3"},{"$f":"'4'!J73","v":"4.4.1.3.3: Are problems which have not progressed according to agreed service levels being escalated?\n"},{"$f":"'4'!K73","v":0},{"$f":"'4'!L73","v":0},{"$f":"'4'!M73","v":"Recommended"},{"$f":"'4'!N73","v":"Recommended"},{"$f":"'4'!O73","v":"TechOps"},{"$f":"'4'!P73","v":0},{"$f":"'4'!Q73","v":0},{"$f":"'4'!R73","v":0},{"$f":"'4'!S73","v":0},{"$f":"'4'!T73","v":0},{"$f":"'4'!U73","v":0},{"$f":"'4'!V73","v":0},{"$f":"'4'!W73","v":0},{"$f":"'4'!X73","v":0},{"$f":"'4'!Y73","v":0},{"$f":"'4'!Z73","v":0},{"$f":"'4'!AA73","v":0},{"$f":"'4'!AB73","v":0},{"$f":"'4'!AC73","v":0},{"$f":"'4'!AD73","v":0},{"$f":"'4'!AE73","v":0},{"$f":"'4'!AF73","v":0},{"$f":"'4'!AG73","v":0},{"$f":"'4'!AH73","v":0},{"$f":"'4'!AI73","v":0},{"$f":"'4'!AJ73","v":0},{"$f":"'4'!AK73","v":0},{"$f":"'4'!AL73","v":0},{"$f":"'4'!AM73","v":0},{"$f":"'4'!AN73","v":0},{"$f":"'4'!AO73","v":0},{"$f":"'4'!AP73","v":0},{"$f":"'4'!AQ73","v":0},{"$f":"'4'!AR73","v":0},{"$f":"'4'!AS73","v":0},{"$f":"'4'!AT73","v":0},{"$f":"SUMPRODUCT(IF($N284=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N284=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B74","v":"4"},{"$f":"'4'!C74","v":"4.4"},{"$f":"'4'!D74","v":"4.4.1"},{"$f":"'4'!E74","v":""},{"$f":"'4'!F74","v":"4.4.1.3"},{"$f":"'4'!G74","v":0},{"$f":"'4'!H74","v":0},{"$f":"'4'!I74","v":"4.4.1.3.4"},{"$f":"'4'!J74","v":"4.4.1.3.4: Is the status and progress of problem resolution being communicated to technical and business management?\n"},{"$f":"'4'!K74","v":0},{"$f":"'4'!L74","v":0},{"$f":"'4'!M74","v":"Recommended"},{"$f":"'4'!N74","v":"Recommended"},{"$f":"'4'!O74","v":"TechOps"},{"$f":"'4'!P74","v":0},{"$f":"'4'!Q74","v":0},{"$f":"'4'!R74","v":0},{"$f":"'4'!S74","v":0},{"$f":"'4'!T74","v":0},{"$f":"'4'!U74","v":0},{"$f":"'4'!V74","v":0},{"$f":"'4'!W74","v":0},{"$f":"'4'!X74","v":0},{"$f":"'4'!Y74","v":0},{"$f":"'4'!Z74","v":0},{"$f":"'4'!AA74","v":0},{"$f":"'4'!AB74","v":0},{"$f":"'4'!AC74","v":0},{"$f":"'4'!AD74","v":0},{"$f":"'4'!AE74","v":0},{"$f":"'4'!AF74","v":0},{"$f":"'4'!AG74","v":0},{"$f":"'4'!AH74","v":0},{"$f":"'4'!AI74","v":0},{"$f":"'4'!AJ74","v":0},{"$f":"'4'!AK74","v":0},{"$f":"'4'!AL74","v":0},{"$f":"'4'!AM74","v":0},{"$f":"'4'!AN74","v":0},{"$f":"'4'!AO74","v":0},{"$f":"'4'!AP74","v":0},{"$f":"'4'!AQ74","v":0},{"$f":"'4'!AR74","v":0},{"$f":"'4'!AS74","v":0},{"$f":"'4'!AT74","v":0},{"$f":"SUMPRODUCT(IF($N285=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N285=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B76","v":"4"},{"$f":"'4'!C76","v":"4.5"},{"$f":"'4'!D76","v":"4.5.1"},{"$f":"'4'!E76","v":"4.5.1: Providers shall develop processes to ensure that systems and applications remain robust and secure following system and configuration changes"},{"$f":"'4'!F76","v":"4.5.1.1"},{"$f":"'4'!G76","v":"4.5.1.1: GATED PROJECT MANAGEMENT PROCESS\nProposed changes to the mobile money service should be managed by a gated project management process to ensure that requirements, design and implementation of the service change are fully considered and documented and approved. The process should cover both technical system changes and business process changes. \n\nThe gated project management process should include:\n- Requirements definition, including expected outcomes from the changed service, expressed in measurable terms;\n- Impact assessment, which should seek inputs from some or all of the following functions: Technical development, Business operations, Technical operations, Customer service, Agent management, Financial operations, AML/CFT/Fraud management;\n- Planning - timescales, risks and dependencies for the project;\n- Design - changes to processes, training, technical systems, reporting, SLAs and third party arrangements;\n- Costing - financial and human resources (including training);\n- Development and implementation (change release management for technical changes - see 4.5.1.3);\n- Testing and acceptance criteria (see 4.5.1.4);\n- Internal and external communication of the service changes;\n- Approval from management and all relevant functions."},{"$f":"'4'!H76","v":"ISO 20000-1:2019 Sec 8.5"},{"$f":"'4'!I76","v":"4.5.1.1.1"},{"$f":"'4'!J76","v":"4.5.1.1.1: Is there a formal gated project management process for managing changes to the mobile money service (both technical and commercial changes)?\n"},{"$f":"'4'!K76","v":"1) Project management process/plan or product development process\n-  Check there is a documented gated project management process for making changes to the mobile money service.\n- Check the process covers both technical and business changes."},{"$f":"'4'!L76","v":0},{"$f":"'4'!M76","v":"Urgent Required"},{"$f":"'4'!N76","v":"Required"},{"$f":"'4'!O76","v":"BizOps"},{"$f":"'4'!P76","v":0},{"$f":"'4'!Q76","v":0},{"$f":"'4'!R76","v":0},{"$f":"'4'!S76","v":0},{"$f":"'4'!T76","v":0},{"$f":"'4'!U76","v":0},{"$f":"'4'!V76","v":0},{"$f":"'4'!W76","v":0},{"$f":"'4'!X76","v":0},{"$f":"'4'!Y76","v":0},{"$f":"'4'!Z76","v":0},{"$f":"'4'!AA76","v":0},{"$f":"'4'!AB76","v":0},{"$f":"'4'!AC76","v":0},{"$f":"'4'!AD76","v":0},{"$f":"'4'!AE76","v":0},{"$f":"'4'!AF76","v":0},{"$f":"'4'!AG76","v":0},{"$f":"'4'!AH76","v":0},{"$f":"'4'!AI76","v":0},{"$f":"'4'!AJ76","v":0},{"$f":"'4'!AK76","v":0},{"$f":"'4'!AL76","v":0},{"$f":"'4'!AM76","v":0},{"$f":"'4'!AN76","v":0},{"$f":"'4'!AO76","v":0},{"$f":"'4'!AP76","v":0},{"$f":"'4'!AQ76","v":0},{"$f":"'4'!AR76","v":0},{"$f":"'4'!AS76","v":0},{"$f":"'4'!AT76","v":0},{"$f":"SUMPRODUCT(IF($N286=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N286=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B77","v":"4"},{"$f":"'4'!C77","v":"4.5"},{"$f":"'4'!D77","v":"4.5.1"},{"$f":"'4'!E77","v":0},{"$f":"'4'!F77","v":"4.5.1.1"},{"$f":"'4'!G77","v":0},{"$f":"'4'!H77","v":0},{"$f":"'4'!I77","v":"4.5.1.1.2"},{"$f":"'4'!J77","v":"4.5.1.1.2: Does the gated project management process ensure that all changes are clearly defined, planned & documented in advance?\n"},{"$f":"'4'!K77","v":"1) Project management process/plan or product development process\n-  Check that the gated project management process ensures that all changes are clearly defined, planned & documented in advance.\n- Check that the next update to the service is documented and planned."},{"$f":"'4'!L77","v":0},{"$f":"'4'!M77","v":"Standard Required"},{"$f":"'4'!N77","v":"Required"},{"$f":"'4'!O77","v":"BizOps"},{"$f":"'4'!P77","v":0},{"$f":"'4'!Q77","v":0},{"$f":"'4'!R77","v":0},{"$f":"'4'!S77","v":0},{"$f":"'4'!T77","v":0},{"$f":"'4'!U77","v":0},{"$f":"'4'!V77","v":0},{"$f":"'4'!W77","v":0},{"$f":"'4'!X77","v":0},{"$f":"'4'!Y77","v":0},{"$f":"'4'!Z77","v":0},{"$f":"'4'!AA77","v":0},{"$f":"'4'!AB77","v":0},{"$f":"'4'!AC77","v":0},{"$f":"'4'!AD77","v":0},{"$f":"'4'!AE77","v":0},{"$f":"'4'!AF77","v":0},{"$f":"'4'!AG77","v":0},{"$f":"'4'!AH77","v":0},{"$f":"'4'!AI77","v":0},{"$f":"'4'!AJ77","v":0},{"$f":"'4'!AK77","v":0},{"$f":"'4'!AL77","v":0},{"$f":"'4'!AM77","v":0},{"$f":"'4'!AN77","v":0},{"$f":"'4'!AO77","v":0},{"$f":"'4'!AP77","v":0},{"$f":"'4'!AQ77","v":0},{"$f":"'4'!AR77","v":0},{"$f":"'4'!AS77","v":0},{"$f":"'4'!AT77","v":0},{"$f":"SUMPRODUCT(IF($N287=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N287=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B78","v":"4"},{"$f":"'4'!C78","v":"4.5"},{"$f":"'4'!D78","v":"4.5.1"},{"$f":"'4'!E78","v":0},{"$f":"'4'!F78","v":"4.5.1.1"},{"$f":"'4'!G78","v":0},{"$f":"'4'!H78","v":0},{"$f":"'4'!I78","v":"4.5.1.1.3"},{"$f":"'4'!J78","v":"4.5.1.1.3: Does the gated project management process require input and approval from all relevant mobile money functions?\n"},{"$f":"'4'!K78","v":"1) Project management process/plan or product development process\n-  Check the gated project management process includes input and approval from all relevant mobile money functions."},{"$f":"'4'!L78","v":0},{"$f":"'4'!M78","v":"Standard Required"},{"$f":"'4'!N78","v":"Required"},{"$f":"'4'!O78","v":"BizOps"},{"$f":"'4'!P78","v":0},{"$f":"'4'!Q78","v":0},{"$f":"'4'!R78","v":0},{"$f":"'4'!S78","v":0},{"$f":"'4'!T78","v":0},{"$f":"'4'!U78","v":0},{"$f":"'4'!V78","v":0},{"$f":"'4'!W78","v":0},{"$f":"'4'!X78","v":0},{"$f":"'4'!Y78","v":0},{"$f":"'4'!Z78","v":0},{"$f":"'4'!AA78","v":0},{"$f":"'4'!AB78","v":0},{"$f":"'4'!AC78","v":0},{"$f":"'4'!AD78","v":0},{"$f":"'4'!AE78","v":0},{"$f":"'4'!AF78","v":0},{"$f":"'4'!AG78","v":0},{"$f":"'4'!AH78","v":0},{"$f":"'4'!AI78","v":0},{"$f":"'4'!AJ78","v":0},{"$f":"'4'!AK78","v":0},{"$f":"'4'!AL78","v":0},{"$f":"'4'!AM78","v":0},{"$f":"'4'!AN78","v":0},{"$f":"'4'!AO78","v":0},{"$f":"'4'!AP78","v":0},{"$f":"'4'!AQ78","v":0},{"$f":"'4'!AR78","v":0},{"$f":"'4'!AS78","v":0},{"$f":"'4'!AT78","v":0},{"$f":"SUMPRODUCT(IF($N288=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N288=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B79","v":"4"},{"$f":"'4'!C79","v":"4.5"},{"$f":"'4'!D79","v":"4.5.1"},{"$f":"'4'!E79","v":""},{"$f":"'4'!F79","v":"4.5.1.1"},{"$f":"'4'!G79","v":0},{"$f":"'4'!H79","v":0},{"$f":"'4'!I79","v":"4.5.1.1.4"},{"$f":"'4'!J79","v":"4.5.1.1.4: When designing and planning changes to the mobile money service, are changes to processes considered for all functions?\n"},{"$f":"'4'!K79","v":0},{"$f":"'4'!L79","v":0},{"$f":"'4'!M79","v":"Recommended"},{"$f":"'4'!N79","v":"Recommended"},{"$f":"'4'!O79","v":"BizOps"},{"$f":"'4'!P79","v":0},{"$f":"'4'!Q79","v":0},{"$f":"'4'!R79","v":0},{"$f":"'4'!S79","v":0},{"$f":"'4'!T79","v":0},{"$f":"'4'!U79","v":0},{"$f":"'4'!V79","v":0},{"$f":"'4'!W79","v":0},{"$f":"'4'!X79","v":0},{"$f":"'4'!Y79","v":0},{"$f":"'4'!Z79","v":0},{"$f":"'4'!AA79","v":0},{"$f":"'4'!AB79","v":0},{"$f":"'4'!AC79","v":0},{"$f":"'4'!AD79","v":0},{"$f":"'4'!AE79","v":0},{"$f":"'4'!AF79","v":0},{"$f":"'4'!AG79","v":0},{"$f":"'4'!AH79","v":0},{"$f":"'4'!AI79","v":0},{"$f":"'4'!AJ79","v":0},{"$f":"'4'!AK79","v":0},{"$f":"'4'!AL79","v":0},{"$f":"'4'!AM79","v":0},{"$f":"'4'!AN79","v":0},{"$f":"'4'!AO79","v":0},{"$f":"'4'!AP79","v":0},{"$f":"'4'!AQ79","v":0},{"$f":"'4'!AR79","v":0},{"$f":"'4'!AS79","v":0},{"$f":"'4'!AT79","v":0},{"$f":"SUMPRODUCT(IF($N289=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N289=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B80","v":"4"},{"$f":"'4'!C80","v":"4.5"},{"$f":"'4'!D80","v":"4.5.1"},{"$f":"'4'!E80","v":""},{"$f":"'4'!F80","v":"4.5.1.1"},{"$f":"'4'!G80","v":0},{"$f":"'4'!H80","v":0},{"$f":"'4'!I80","v":"4.5.1.1.5"},{"$f":"'4'!J80","v":"4.5.1.1.5: When designing and planning changes to the mobile money service, are changes to reporting requirements considered for all functions?\n"},{"$f":"'4'!K80","v":0},{"$f":"'4'!L80","v":0},{"$f":"'4'!M80","v":"Recommended"},{"$f":"'4'!N80","v":"Recommended"},{"$f":"'4'!O80","v":"BizOps"},{"$f":"'4'!P80","v":0},{"$f":"'4'!Q80","v":0},{"$f":"'4'!R80","v":0},{"$f":"'4'!S80","v":0},{"$f":"'4'!T80","v":0},{"$f":"'4'!U80","v":0},{"$f":"'4'!V80","v":0},{"$f":"'4'!W80","v":0},{"$f":"'4'!X80","v":0},{"$f":"'4'!Y80","v":0},{"$f":"'4'!Z80","v":0},{"$f":"'4'!AA80","v":0},{"$f":"'4'!AB80","v":0},{"$f":"'4'!AC80","v":0},{"$f":"'4'!AD80","v":0},{"$f":"'4'!AE80","v":0},{"$f":"'4'!AF80","v":0},{"$f":"'4'!AG80","v":0},{"$f":"'4'!AH80","v":0},{"$f":"'4'!AI80","v":0},{"$f":"'4'!AJ80","v":0},{"$f":"'4'!AK80","v":0},{"$f":"'4'!AL80","v":0},{"$f":"'4'!AM80","v":0},{"$f":"'4'!AN80","v":0},{"$f":"'4'!AO80","v":0},{"$f":"'4'!AP80","v":0},{"$f":"'4'!AQ80","v":0},{"$f":"'4'!AR80","v":0},{"$f":"'4'!AS80","v":0},{"$f":"'4'!AT80","v":0},{"$f":"SUMPRODUCT(IF($N290=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N290=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B81","v":"4"},{"$f":"'4'!C81","v":"4.5"},{"$f":"'4'!D81","v":"4.5.1"},{"$f":"'4'!E81","v":""},{"$f":"'4'!F81","v":"4.5.1.1"},{"$f":"'4'!G81","v":0},{"$f":"'4'!H81","v":0},{"$f":"'4'!I81","v":"4.5.1.1.6"},{"$f":"'4'!J81","v":"4.5.1.1.6: When designing and planning changes to the mobile money service, are changes to SLAs considered for all functions?\n"},{"$f":"'4'!K81","v":0},{"$f":"'4'!L81","v":0},{"$f":"'4'!M81","v":"Recommended"},{"$f":"'4'!N81","v":"Recommended"},{"$f":"'4'!O81","v":"BizOps"},{"$f":"'4'!P81","v":0},{"$f":"'4'!Q81","v":0},{"$f":"'4'!R81","v":0},{"$f":"'4'!S81","v":0},{"$f":"'4'!T81","v":0},{"$f":"'4'!U81","v":0},{"$f":"'4'!V81","v":0},{"$f":"'4'!W81","v":0},{"$f":"'4'!X81","v":0},{"$f":"'4'!Y81","v":0},{"$f":"'4'!Z81","v":0},{"$f":"'4'!AA81","v":0},{"$f":"'4'!AB81","v":0},{"$f":"'4'!AC81","v":0},{"$f":"'4'!AD81","v":0},{"$f":"'4'!AE81","v":0},{"$f":"'4'!AF81","v":0},{"$f":"'4'!AG81","v":0},{"$f":"'4'!AH81","v":0},{"$f":"'4'!AI81","v":0},{"$f":"'4'!AJ81","v":0},{"$f":"'4'!AK81","v":0},{"$f":"'4'!AL81","v":0},{"$f":"'4'!AM81","v":0},{"$f":"'4'!AN81","v":0},{"$f":"'4'!AO81","v":0},{"$f":"'4'!AP81","v":0},{"$f":"'4'!AQ81","v":0},{"$f":"'4'!AR81","v":0},{"$f":"'4'!AS81","v":0},{"$f":"'4'!AT81","v":0},{"$f":"SUMPRODUCT(IF($N291=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N291=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B82","v":"4"},{"$f":"'4'!C82","v":"4.5"},{"$f":"'4'!D82","v":"4.5.1"},{"$f":"'4'!E82","v":""},{"$f":"'4'!F82","v":"4.5.1.1"},{"$f":"'4'!G82","v":0},{"$f":"'4'!H82","v":0},{"$f":"'4'!I82","v":"4.5.1.1.7"},{"$f":"'4'!J82","v":"4.5.1.1.7: When designing and planning changes to the mobile money service, are changes to third party arrangements considered for all functions?\n"},{"$f":"'4'!K82","v":0},{"$f":"'4'!L82","v":0},{"$f":"'4'!M82","v":"Recommended"},{"$f":"'4'!N82","v":"Recommended"},{"$f":"'4'!O82","v":"BizOps"},{"$f":"'4'!P82","v":0},{"$f":"'4'!Q82","v":0},{"$f":"'4'!R82","v":0},{"$f":"'4'!S82","v":0},{"$f":"'4'!T82","v":0},{"$f":"'4'!U82","v":0},{"$f":"'4'!V82","v":0},{"$f":"'4'!W82","v":0},{"$f":"'4'!X82","v":0},{"$f":"'4'!Y82","v":0},{"$f":"'4'!Z82","v":0},{"$f":"'4'!AA82","v":0},{"$f":"'4'!AB82","v":0},{"$f":"'4'!AC82","v":0},{"$f":"'4'!AD82","v":0},{"$f":"'4'!AE82","v":0},{"$f":"'4'!AF82","v":0},{"$f":"'4'!AG82","v":0},{"$f":"'4'!AH82","v":0},{"$f":"'4'!AI82","v":0},{"$f":"'4'!AJ82","v":0},{"$f":"'4'!AK82","v":0},{"$f":"'4'!AL82","v":0},{"$f":"'4'!AM82","v":0},{"$f":"'4'!AN82","v":0},{"$f":"'4'!AO82","v":0},{"$f":"'4'!AP82","v":0},{"$f":"'4'!AQ82","v":0},{"$f":"'4'!AR82","v":0},{"$f":"'4'!AS82","v":0},{"$f":"'4'!AT82","v":0},{"$f":"SUMPRODUCT(IF($N292=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N292=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B83","v":"4"},{"$f":"'4'!C83","v":"4.5"},{"$f":"'4'!D83","v":"4.5.1"},{"$f":"'4'!E83","v":""},{"$f":"'4'!F83","v":"4.5.1.1"},{"$f":"'4'!G83","v":0},{"$f":"'4'!H83","v":0},{"$f":"'4'!I83","v":"4.5.1.1.8"},{"$f":"'4'!J83","v":"4.5.1.1.8: When designing and planning changes to the mobile money service, are human resource requirements (including training) considered for all functions?\n"},{"$f":"'4'!K83","v":0},{"$f":"'4'!L83","v":0},{"$f":"'4'!M83","v":"Recommended"},{"$f":"'4'!N83","v":"Recommended"},{"$f":"'4'!O83","v":"BizOps"},{"$f":"'4'!P83","v":0},{"$f":"'4'!Q83","v":0},{"$f":"'4'!R83","v":0},{"$f":"'4'!S83","v":0},{"$f":"'4'!T83","v":0},{"$f":"'4'!U83","v":0},{"$f":"'4'!V83","v":0},{"$f":"'4'!W83","v":0},{"$f":"'4'!X83","v":0},{"$f":"'4'!Y83","v":0},{"$f":"'4'!Z83","v":0},{"$f":"'4'!AA83","v":0},{"$f":"'4'!AB83","v":0},{"$f":"'4'!AC83","v":0},{"$f":"'4'!AD83","v":0},{"$f":"'4'!AE83","v":0},{"$f":"'4'!AF83","v":0},{"$f":"'4'!AG83","v":0},{"$f":"'4'!AH83","v":0},{"$f":"'4'!AI83","v":0},{"$f":"'4'!AJ83","v":0},{"$f":"'4'!AK83","v":0},{"$f":"'4'!AL83","v":0},{"$f":"'4'!AM83","v":0},{"$f":"'4'!AN83","v":0},{"$f":"'4'!AO83","v":0},{"$f":"'4'!AP83","v":0},{"$f":"'4'!AQ83","v":0},{"$f":"'4'!AR83","v":0},{"$f":"'4'!AS83","v":0},{"$f":"'4'!AT83","v":0},{"$f":"SUMPRODUCT(IF($N293=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N293=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B84","v":"4"},{"$f":"'4'!C84","v":"4.5"},{"$f":"'4'!D84","v":"4.5.1"},{"$f":"'4'!E84","v":""},{"$f":"'4'!F84","v":"4.5.1.1"},{"$f":"'4'!G84","v":0},{"$f":"'4'!H84","v":0},{"$f":"'4'!I84","v":"4.5.1.1.9"},{"$f":"'4'!J84","v":"4.5.1.1.9: When changes are made to the mobile money service does the planning include internal and external communication of the changes?\n"},{"$f":"'4'!K84","v":0},{"$f":"'4'!L84","v":0},{"$f":"'4'!M84","v":"Recommended"},{"$f":"'4'!N84","v":"Recommended"},{"$f":"'4'!O84","v":"BizOps"},{"$f":"'4'!P84","v":0},{"$f":"'4'!Q84","v":0},{"$f":"'4'!R84","v":0},{"$f":"'4'!S84","v":0},{"$f":"'4'!T84","v":0},{"$f":"'4'!U84","v":0},{"$f":"'4'!V84","v":0},{"$f":"'4'!W84","v":0},{"$f":"'4'!X84","v":0},{"$f":"'4'!Y84","v":0},{"$f":"'4'!Z84","v":0},{"$f":"'4'!AA84","v":0},{"$f":"'4'!AB84","v":0},{"$f":"'4'!AC84","v":0},{"$f":"'4'!AD84","v":0},{"$f":"'4'!AE84","v":0},{"$f":"'4'!AF84","v":0},{"$f":"'4'!AG84","v":0},{"$f":"'4'!AH84","v":0},{"$f":"'4'!AI84","v":0},{"$f":"'4'!AJ84","v":0},{"$f":"'4'!AK84","v":0},{"$f":"'4'!AL84","v":0},{"$f":"'4'!AM84","v":0},{"$f":"'4'!AN84","v":0},{"$f":"'4'!AO84","v":0},{"$f":"'4'!AP84","v":0},{"$f":"'4'!AQ84","v":0},{"$f":"'4'!AR84","v":0},{"$f":"'4'!AS84","v":0},{"$f":"'4'!AT84","v":0},{"$f":"SUMPRODUCT(IF($N294=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N294=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B85","v":"4"},{"$f":"'4'!C85","v":"4.5"},{"$f":"'4'!D85","v":"4.5.1"},{"$f":"'4'!E85","v":""},{"$f":"'4'!F85","v":"4.5.1.2"},{"$f":"'4'!G85","v":"4.5.1.2: CHANGES TO THE MOBILE MONEY SYSTEM (CHANGE ADVISORY BOARD)\nAll technical changes to the mobile money system should be subject to a technical change management process (e.g. Change Advisory Board) to review and approve proposed changes to the mobile money system. The process should include:\n- Definition of the proposed change;\n- Impact assessment;\n- Testing - user acceptance testing, operational acceptance testing (see 4.5.1.3);\n- Deployment process, including go/no-go and roll-back (see 4.5.1.4);\n- Communication plan;\n- Review and approval by all relevant technical areas.\n\nA schedule for deployment of releases should be planned and communicated to technical and business managers.\n\nRelease notes should document the changes that are being made with each system change, including  all changes, bug fixes, known issues, and deployment/roll-back procedures.\n\nFollowing deployment, there should be a period or observation on the live environment to validate the deployment and a post-implementation review.\n\nFollowing each update to the system a report of the testing and deployment should be sent to business and technical managers.\n\nEmergency releases (fixes to resolve an incident) should be managed and deployed according to a documented procedure that is part of the incident management process.\n"},{"$f":"'4'!H85","v":"ISO 20000-1:2019 Sec 8.5.2\nISO 27002: 2013 Sec. 12.5"},{"$f":"'4'!I85","v":"4.5.1.2.1"},{"$f":"'4'!J85","v":"4.5.1.2.1: Is there a formal technical change management process (e.g. Change Advisory Board) to manage all changes to the live technical environment (including patches, minor changes and major releases)?\n"},{"$f":"'4'!K85","v":"1) Technical change management process or example change management documentation\n- Check that there is a documented formal technical change management process (e.g. Change Advisory Board) to manage all changes to the live technical environment (including patches, minor changes and major releases).\n- Check that evidence exists for approval by the technical operations manager for all releases.  \n        a) Review sign-off of release documentation for examples of technical changes in the last year.\n        b) Review process documentation if no releases have been made in the last year.\n        c) If previous technical changes did not have approval, review process documentation and look for evidence that future releases will have approval (e.g. revised process)\n"},{"$f":"'4'!L85","v":0},{"$f":"'4'!M85","v":"Urgent Required"},{"$f":"'4'!N85","v":"Required"},{"$f":"'4'!O85","v":"TechOps"},{"$f":"'4'!P85","v":0},{"$f":"'4'!Q85","v":0},{"$f":"'4'!R85","v":0},{"$f":"'4'!S85","v":0},{"$f":"'4'!T85","v":0},{"$f":"'4'!U85","v":0},{"$f":"'4'!V85","v":0},{"$f":"'4'!W85","v":0},{"$f":"'4'!X85","v":0},{"$f":"'4'!Y85","v":0},{"$f":"'4'!Z85","v":0},{"$f":"'4'!AA85","v":0},{"$f":"'4'!AB85","v":0},{"$f":"'4'!AC85","v":0},{"$f":"'4'!AD85","v":0},{"$f":"'4'!AE85","v":0},{"$f":"'4'!AF85","v":0},{"$f":"'4'!AG85","v":0},{"$f":"'4'!AH85","v":0},{"$f":"'4'!AI85","v":0},{"$f":"'4'!AJ85","v":0},{"$f":"'4'!AK85","v":0},{"$f":"'4'!AL85","v":0},{"$f":"'4'!AM85","v":0},{"$f":"'4'!AN85","v":0},{"$f":"'4'!AO85","v":0},{"$f":"'4'!AP85","v":0},{"$f":"'4'!AQ85","v":0},{"$f":"'4'!AR85","v":0},{"$f":"'4'!AS85","v":0},{"$f":"'4'!AT85","v":0},{"$f":"SUMPRODUCT(IF($N295=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N295=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B86","v":"4"},{"$f":"'4'!C86","v":"4.5"},{"$f":"'4'!D86","v":"4.5.1"},{"$f":"'4'!E86","v":""},{"$f":"'4'!F86","v":"4.5.1.2"},{"$f":"'4'!G86","v":0},{"$f":"'4'!H86","v":0},{"$f":"'4'!I86","v":"4.5.1.2.2"},{"$f":"'4'!J86","v":"4.5.1.2.2: Are planned system changes documented in a change calendar and communicated to technical and business managers?\n"},{"$f":"'4'!K86","v":"1) Mobile money system deployment plan\n- Check that technical changes to the MM system have been documented in a change calendar.\n- Check that previous technical changes have been communicated to technical and business managers in advance.\n"},{"$f":"'4'!L86","v":0},{"$f":"'4'!M86","v":"Standard Required"},{"$f":"'4'!N86","v":"Required"},{"$f":"'4'!O86","v":"TechOps"},{"$f":"'4'!P86","v":0},{"$f":"'4'!Q86","v":0},{"$f":"'4'!R86","v":0},{"$f":"'4'!S86","v":0},{"$f":"'4'!T86","v":0},{"$f":"'4'!U86","v":0},{"$f":"'4'!V86","v":0},{"$f":"'4'!W86","v":0},{"$f":"'4'!X86","v":0},{"$f":"'4'!Y86","v":0},{"$f":"'4'!Z86","v":0},{"$f":"'4'!AA86","v":0},{"$f":"'4'!AB86","v":0},{"$f":"'4'!AC86","v":0},{"$f":"'4'!AD86","v":0},{"$f":"'4'!AE86","v":0},{"$f":"'4'!AF86","v":0},{"$f":"'4'!AG86","v":0},{"$f":"'4'!AH86","v":0},{"$f":"'4'!AI86","v":0},{"$f":"'4'!AJ86","v":0},{"$f":"'4'!AK86","v":0},{"$f":"'4'!AL86","v":0},{"$f":"'4'!AM86","v":0},{"$f":"'4'!AN86","v":0},{"$f":"'4'!AO86","v":0},{"$f":"'4'!AP86","v":0},{"$f":"'4'!AQ86","v":0},{"$f":"'4'!AR86","v":0},{"$f":"'4'!AS86","v":0},{"$f":"'4'!AT86","v":0},{"$f":"SUMPRODUCT(IF($N296=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N296=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B87","v":"4"},{"$f":"'4'!C87","v":"4.5"},{"$f":"'4'!D87","v":"4.5.1"},{"$f":"'4'!E87","v":""},{"$f":"'4'!F87","v":"4.5.1.2"},{"$f":"'4'!G87","v":0},{"$f":"'4'!H87","v":0},{"$f":"'4'!I87","v":"4.5.1.2.3"},{"$f":"'4'!J87","v":"4.5.1.2.3: Are release notes produced for each change, documenting the changes that are being made, including all changes, bug fixes, known issues, and deployment/roll-back procedures?\n"},{"$f":"'4'!K87","v":"1) Technical change management process or example change management documentation\n- Check that suitable release notes are produced for all changes. \n        a) Review release notes for example changes in the last year. \n        b) Review release notes template if no changes have been made in the last year.\n        c) If previous changes did not have release notes, review process documentation and look for evidence that future changes will have release notes (e.g. revised process)"},{"$f":"'4'!L87","v":0},{"$f":"'4'!M87","v":"Standard Required"},{"$f":"'4'!N87","v":"Required"},{"$f":"'4'!O87","v":"TechOps"},{"$f":"'4'!P87","v":0},{"$f":"'4'!Q87","v":0},{"$f":"'4'!R87","v":0},{"$f":"'4'!S87","v":0},{"$f":"'4'!T87","v":0},{"$f":"'4'!U87","v":0},{"$f":"'4'!V87","v":0},{"$f":"'4'!W87","v":0},{"$f":"'4'!X87","v":0},{"$f":"'4'!Y87","v":0},{"$f":"'4'!Z87","v":0},{"$f":"'4'!AA87","v":0},{"$f":"'4'!AB87","v":0},{"$f":"'4'!AC87","v":0},{"$f":"'4'!AD87","v":0},{"$f":"'4'!AE87","v":0},{"$f":"'4'!AF87","v":0},{"$f":"'4'!AG87","v":0},{"$f":"'4'!AH87","v":0},{"$f":"'4'!AI87","v":0},{"$f":"'4'!AJ87","v":0},{"$f":"'4'!AK87","v":0},{"$f":"'4'!AL87","v":0},{"$f":"'4'!AM87","v":0},{"$f":"'4'!AN87","v":0},{"$f":"'4'!AO87","v":0},{"$f":"'4'!AP87","v":0},{"$f":"'4'!AQ87","v":0},{"$f":"'4'!AR87","v":0},{"$f":"'4'!AS87","v":0},{"$f":"'4'!AT87","v":0},{"$f":"SUMPRODUCT(IF($N297=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N297=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B88","v":"4"},{"$f":"'4'!C88","v":"4.5"},{"$f":"'4'!D88","v":"4.5.1"},{"$f":"'4'!E88","v":""},{"$f":"'4'!F88","v":"4.5.1.2"},{"$f":"'4'!G88","v":0},{"$f":"'4'!H88","v":0},{"$f":"'4'!I88","v":"4.5.1.2.4"},{"$f":"'4'!J88","v":"4.5.1.2.4: Following deployment, is final testing performed on the live environment to validate the deployment?\n"},{"$f":"'4'!K88","v":0},{"$f":"'4'!L88","v":0},{"$f":"'4'!M88","v":"Recommended"},{"$f":"'4'!N88","v":"Recommended"},{"$f":"'4'!O88","v":"TechOps"},{"$f":"'4'!P88","v":0},{"$f":"'4'!Q88","v":0},{"$f":"'4'!R88","v":0},{"$f":"'4'!S88","v":0},{"$f":"'4'!T88","v":0},{"$f":"'4'!U88","v":0},{"$f":"'4'!V88","v":0},{"$f":"'4'!W88","v":0},{"$f":"'4'!X88","v":0},{"$f":"'4'!Y88","v":0},{"$f":"'4'!Z88","v":0},{"$f":"'4'!AA88","v":0},{"$f":"'4'!AB88","v":0},{"$f":"'4'!AC88","v":0},{"$f":"'4'!AD88","v":0},{"$f":"'4'!AE88","v":0},{"$f":"'4'!AF88","v":0},{"$f":"'4'!AG88","v":0},{"$f":"'4'!AH88","v":0},{"$f":"'4'!AI88","v":0},{"$f":"'4'!AJ88","v":0},{"$f":"'4'!AK88","v":0},{"$f":"'4'!AL88","v":0},{"$f":"'4'!AM88","v":0},{"$f":"'4'!AN88","v":0},{"$f":"'4'!AO88","v":0},{"$f":"'4'!AP88","v":0},{"$f":"'4'!AQ88","v":0},{"$f":"'4'!AR88","v":0},{"$f":"'4'!AS88","v":0},{"$f":"'4'!AT88","v":0},{"$f":"SUMPRODUCT(IF($N298=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N298=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B89","v":"4"},{"$f":"'4'!C89","v":"4.5"},{"$f":"'4'!D89","v":"4.5.1"},{"$f":"'4'!E89","v":""},{"$f":"'4'!F89","v":"4.5.1.2"},{"$f":"'4'!G89","v":0},{"$f":"'4'!H89","v":0},{"$f":"'4'!I89","v":"4.5.1.2.5"},{"$f":"'4'!J89","v":"4.5.1.2.5: Following each release, is a report of the testing and deployment sent to business and technical managers, comparing the outcomes achieved against the expected outcomes?\n"},{"$f":"'4'!K89","v":0},{"$f":"'4'!L89","v":0},{"$f":"'4'!M89","v":"Recommended"},{"$f":"'4'!N89","v":"Recommended"},{"$f":"'4'!O89","v":"TechOps"},{"$f":"'4'!P89","v":0},{"$f":"'4'!Q89","v":0},{"$f":"'4'!R89","v":0},{"$f":"'4'!S89","v":0},{"$f":"'4'!T89","v":0},{"$f":"'4'!U89","v":0},{"$f":"'4'!V89","v":0},{"$f":"'4'!W89","v":0},{"$f":"'4'!X89","v":0},{"$f":"'4'!Y89","v":0},{"$f":"'4'!Z89","v":0},{"$f":"'4'!AA89","v":0},{"$f":"'4'!AB89","v":0},{"$f":"'4'!AC89","v":0},{"$f":"'4'!AD89","v":0},{"$f":"'4'!AE89","v":0},{"$f":"'4'!AF89","v":0},{"$f":"'4'!AG89","v":0},{"$f":"'4'!AH89","v":0},{"$f":"'4'!AI89","v":0},{"$f":"'4'!AJ89","v":0},{"$f":"'4'!AK89","v":0},{"$f":"'4'!AL89","v":0},{"$f":"'4'!AM89","v":0},{"$f":"'4'!AN89","v":0},{"$f":"'4'!AO89","v":0},{"$f":"'4'!AP89","v":0},{"$f":"'4'!AQ89","v":0},{"$f":"'4'!AR89","v":0},{"$f":"'4'!AS89","v":0},{"$f":"'4'!AT89","v":0},{"$f":"SUMPRODUCT(IF($N299=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N299=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B90","v":"4"},{"$f":"'4'!C90","v":"4.5"},{"$f":"'4'!D90","v":"4.5.1"},{"$f":"'4'!E90","v":""},{"$f":"'4'!F90","v":"4.5.1.2"},{"$f":"'4'!G90","v":0},{"$f":"'4'!H90","v":0},{"$f":"'4'!I90","v":"4.5.1.2.6"},{"$f":"'4'!J90","v":"4.5.1.2.6: Are emergency changes managed and deployed according to a documented procedure that is part of the incident management process (e.g. Emergency Change Advisory Board)?\n"},{"$f":"'4'!K90","v":"1) Incident management process\n- Check the incident management procedure includes a process for emergency changes with suitable approval (e.g. Emergency Change Advisory Board)."},{"$f":"'4'!L90","v":0},{"$f":"'4'!M90","v":"Standard Required"},{"$f":"'4'!N90","v":"Required"},{"$f":"'4'!O90","v":"TechOps"},{"$f":"'4'!P90","v":0},{"$f":"'4'!Q90","v":0},{"$f":"'4'!R90","v":0},{"$f":"'4'!S90","v":0},{"$f":"'4'!T90","v":0},{"$f":"'4'!U90","v":0},{"$f":"'4'!V90","v":0},{"$f":"'4'!W90","v":0},{"$f":"'4'!X90","v":0},{"$f":"'4'!Y90","v":0},{"$f":"'4'!Z90","v":0},{"$f":"'4'!AA90","v":0},{"$f":"'4'!AB90","v":0},{"$f":"'4'!AC90","v":0},{"$f":"'4'!AD90","v":0},{"$f":"'4'!AE90","v":0},{"$f":"'4'!AF90","v":0},{"$f":"'4'!AG90","v":0},{"$f":"'4'!AH90","v":0},{"$f":"'4'!AI90","v":0},{"$f":"'4'!AJ90","v":0},{"$f":"'4'!AK90","v":0},{"$f":"'4'!AL90","v":0},{"$f":"'4'!AM90","v":0},{"$f":"'4'!AN90","v":0},{"$f":"'4'!AO90","v":0},{"$f":"'4'!AP90","v":0},{"$f":"'4'!AQ90","v":0},{"$f":"'4'!AR90","v":0},{"$f":"'4'!AS90","v":0},{"$f":"'4'!AT90","v":0},{"$f":"SUMPRODUCT(IF($N300=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N300=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B91","v":"4"},{"$f":"'4'!C91","v":"4.5"},{"$f":"'4'!D91","v":"4.5.1"},{"$f":"'4'!E91","v":""},{"$f":"'4'!F91","v":"4.5.1.3"},{"$f":"'4'!G91","v":"4.5.1.3: RELEASE MANAGEMENT - TESTING\nReleases should be built and tested in a separate testing environment prior to deployment to the live system. The testing environment should be a valid representation of the production environment. All releases should be tested before being released to production.\n\nUser Acceptance Testing (functional testing) should be done to ensure that the release fulfils the functional requirements and design. The release should be verified against service acceptance criteria agreed in advance by the mobile money business operations manager.\n\nOperational Acceptance Testing (non-functional testing) should be done to ensure that the release meets technical acceptance criteria, which should be agreed in advance of testing. At minimum, the following should be tested in every major release:\n- failover capability;\n- system security;\n- system performance;\n- operational requirements (e.g. logging, alerting).\n"},{"$f":"'4'!H91","v":"ISO 20000-1:2019 Sec. 8.5.3\nISO 27002: 2013 Sec. 12.5"},{"$f":"'4'!I91","v":"4.5.1.3.1"},{"$f":"'4'!J91","v":"4.5.1.3.1: is there a separate testing environment, which is a valid representation of the production environment?\n"},{"$f":"'4'!K91","v":"1) System architecture specification\n- Check that the testing environment is a valid representation of the live environment (i.e. comparable architecture, and the same version and configuration as the live system). If the test environment has a scaled-down architecture then there should be a documented risk assessment or reasoning."},{"$f":"'4'!L91","v":0},{"$f":"'4'!M91","v":"Urgent Required"},{"$f":"'4'!N91","v":"Required"},{"$f":"'4'!O91","v":"TechOps"},{"$f":"'4'!P91","v":0},{"$f":"'4'!Q91","v":0},{"$f":"'4'!R91","v":0},{"$f":"'4'!S91","v":0},{"$f":"'4'!T91","v":0},{"$f":"'4'!U91","v":0},{"$f":"'4'!V91","v":0},{"$f":"'4'!W91","v":0},{"$f":"'4'!X91","v":0},{"$f":"'4'!Y91","v":0},{"$f":"'4'!Z91","v":0},{"$f":"'4'!AA91","v":0},{"$f":"'4'!AB91","v":0},{"$f":"'4'!AC91","v":0},{"$f":"'4'!AD91","v":0},{"$f":"'4'!AE91","v":0},{"$f":"'4'!AF91","v":0},{"$f":"'4'!AG91","v":0},{"$f":"'4'!AH91","v":0},{"$f":"'4'!AI91","v":0},{"$f":"'4'!AJ91","v":0},{"$f":"'4'!AK91","v":0},{"$f":"'4'!AL91","v":0},{"$f":"'4'!AM91","v":0},{"$f":"'4'!AN91","v":0},{"$f":"'4'!AO91","v":0},{"$f":"'4'!AP91","v":0},{"$f":"'4'!AQ91","v":0},{"$f":"'4'!AR91","v":0},{"$f":"'4'!AS91","v":0},{"$f":"'4'!AT91","v":0},{"$f":"SUMPRODUCT(IF($N301=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N301=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B92","v":"4"},{"$f":"'4'!C92","v":"4.5"},{"$f":"'4'!D92","v":"4.5.1"},{"$f":"'4'!E92","v":""},{"$f":"'4'!F92","v":"4.5.1.3"},{"$f":"'4'!G92","v":0},{"$f":"'4'!H92","v":0},{"$f":"'4'!I92","v":"4.5.1.3.2"},{"$f":"'4'!J92","v":"4.5.1.3.2: Is User Acceptance Testing (functional testing) done to verify each release against acceptance criteria agreed in advance by the mobile money business operations manager?\n"},{"$f":"'4'!K92","v":"1) Release Management Process or testing specifications \n- Check there is a process to verify each release against agreed acceptance criteria (i.e. functional / user acceptance testing). \n- Check the process requires that all releases are built and tested in a separate testing environment prior to being deployed on the live system. \n"},{"$f":"'4'!L92","v":0},{"$f":"'4'!M92","v":"Urgent Required"},{"$f":"'4'!N92","v":"Required"},{"$f":"'4'!O92","v":"TechOps"},{"$f":"'4'!P92","v":0},{"$f":"'4'!Q92","v":0},{"$f":"'4'!R92","v":0},{"$f":"'4'!S92","v":0},{"$f":"'4'!T92","v":0},{"$f":"'4'!U92","v":0},{"$f":"'4'!V92","v":0},{"$f":"'4'!W92","v":0},{"$f":"'4'!X92","v":0},{"$f":"'4'!Y92","v":0},{"$f":"'4'!Z92","v":0},{"$f":"'4'!AA92","v":0},{"$f":"'4'!AB92","v":0},{"$f":"'4'!AC92","v":0},{"$f":"'4'!AD92","v":0},{"$f":"'4'!AE92","v":0},{"$f":"'4'!AF92","v":0},{"$f":"'4'!AG92","v":0},{"$f":"'4'!AH92","v":0},{"$f":"'4'!AI92","v":0},{"$f":"'4'!AJ92","v":0},{"$f":"'4'!AK92","v":0},{"$f":"'4'!AL92","v":0},{"$f":"'4'!AM92","v":0},{"$f":"'4'!AN92","v":0},{"$f":"'4'!AO92","v":0},{"$f":"'4'!AP92","v":0},{"$f":"'4'!AQ92","v":0},{"$f":"'4'!AR92","v":0},{"$f":"'4'!AS92","v":0},{"$f":"'4'!AT92","v":0},{"$f":"SUMPRODUCT(IF($N302=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N302=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B93","v":"4"},{"$f":"'4'!C93","v":"4.5"},{"$f":"'4'!D93","v":"4.5.1"},{"$f":"'4'!E93","v":""},{"$f":"'4'!F93","v":"4.5.1.3"},{"$f":"'4'!G93","v":0},{"$f":"'4'!H93","v":0},{"$f":"'4'!I93","v":"4.5.1.3.3"},{"$f":"'4'!J93","v":"4.5.1.3.3: Is Operational Acceptance Testing (non-functional testing) done on each major release?\n"},{"$f":"'4'!K93","v":"1) Release Management Process or testing specifications \n- Check there is a process to verify each major release against agreed operational acceptance criteria (i.e. non-functional / operational acceptance testing). "},{"$f":"'4'!L93","v":0},{"$f":"'4'!M93","v":"Standard Required"},{"$f":"'4'!N93","v":"Required"},{"$f":"'4'!O93","v":"TechOps"},{"$f":"'4'!P93","v":0},{"$f":"'4'!Q93","v":0},{"$f":"'4'!R93","v":0},{"$f":"'4'!S93","v":0},{"$f":"'4'!T93","v":0},{"$f":"'4'!U93","v":0},{"$f":"'4'!V93","v":0},{"$f":"'4'!W93","v":0},{"$f":"'4'!X93","v":0},{"$f":"'4'!Y93","v":0},{"$f":"'4'!Z93","v":0},{"$f":"'4'!AA93","v":0},{"$f":"'4'!AB93","v":0},{"$f":"'4'!AC93","v":0},{"$f":"'4'!AD93","v":0},{"$f":"'4'!AE93","v":0},{"$f":"'4'!AF93","v":0},{"$f":"'4'!AG93","v":0},{"$f":"'4'!AH93","v":0},{"$f":"'4'!AI93","v":0},{"$f":"'4'!AJ93","v":0},{"$f":"'4'!AK93","v":0},{"$f":"'4'!AL93","v":0},{"$f":"'4'!AM93","v":0},{"$f":"'4'!AN93","v":0},{"$f":"'4'!AO93","v":0},{"$f":"'4'!AP93","v":0},{"$f":"'4'!AQ93","v":0},{"$f":"'4'!AR93","v":0},{"$f":"'4'!AS93","v":0},{"$f":"'4'!AT93","v":0},{"$f":"SUMPRODUCT(IF($N303=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N303=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B94","v":"4"},{"$f":"'4'!C94","v":"4.5"},{"$f":"'4'!D94","v":"4.5.1"},{"$f":"'4'!E94","v":""},{"$f":"'4'!F94","v":"4.5.1.3"},{"$f":"'4'!G94","v":0},{"$f":"'4'!H94","v":0},{"$f":"'4'!I94","v":"4.5.1.3.4"},{"$f":"'4'!J94","v":"4.5.1.3.4: Does operational acceptance testing test failover capability, system security, system performance, and operational requirements in every major release?\n"},{"$f":"'4'!K94","v":0},{"$f":"'4'!L94","v":0},{"$f":"'4'!M94","v":"Recommended"},{"$f":"'4'!N94","v":"Recommended"},{"$f":"'4'!O94","v":"TechOps"},{"$f":"'4'!P94","v":0},{"$f":"'4'!Q94","v":0},{"$f":"'4'!R94","v":0},{"$f":"'4'!S94","v":0},{"$f":"'4'!T94","v":0},{"$f":"'4'!U94","v":0},{"$f":"'4'!V94","v":0},{"$f":"'4'!W94","v":0},{"$f":"'4'!X94","v":0},{"$f":"'4'!Y94","v":0},{"$f":"'4'!Z94","v":0},{"$f":"'4'!AA94","v":0},{"$f":"'4'!AB94","v":0},{"$f":"'4'!AC94","v":0},{"$f":"'4'!AD94","v":0},{"$f":"'4'!AE94","v":0},{"$f":"'4'!AF94","v":0},{"$f":"'4'!AG94","v":0},{"$f":"'4'!AH94","v":0},{"$f":"'4'!AI94","v":0},{"$f":"'4'!AJ94","v":0},{"$f":"'4'!AK94","v":0},{"$f":"'4'!AL94","v":0},{"$f":"'4'!AM94","v":0},{"$f":"'4'!AN94","v":0},{"$f":"'4'!AO94","v":0},{"$f":"'4'!AP94","v":0},{"$f":"'4'!AQ94","v":0},{"$f":"'4'!AR94","v":0},{"$f":"'4'!AS94","v":0},{"$f":"'4'!AT94","v":0},{"$f":"SUMPRODUCT(IF($N304=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N304=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B95","v":"4"},{"$f":"'4'!C95","v":"4.5"},{"$f":"'4'!D95","v":"4.5.1"},{"$f":"'4'!E95","v":""},{"$f":"'4'!F95","v":"4.5.1.4"},{"$f":"'4'!G95","v":"4.5.1.4: CONFIGURATION MANAGEMENT\nConfiguration management is used to maintain a detailed record of the mobile money system's hardware and software and their configuration and documentation.\n\nProviders should record all software and hardware components in a configuration management database. All system documentation should also be stored.\n\nPrevious versions of application software and configurations should be retained as a contingency measure: old versions of software and their configuration should be archived for as long as the data are retained in archive.\n\nThe configuration management database should be updated as part of the release management process when changes are made to the system.\n"},{"$f":"'4'!H95","v":"PCI DSS, ISO 20000-1:2011 Sec. 9.1\nISO 27002: 2013 Sec. 12.5 "},{"$f":"'4'!I95","v":"4.5.1.4.1"},{"$f":"'4'!J95","v":"4.5.1.4.1: Is a configuration management database used to maintain a detailed record of the mobile money system's hardware and software and their configuration and documentation?\n"},{"$f":"'4'!K95","v":"Configuration management specification"},{"$f":"'4'!L95","v":0},{"$f":"'4'!M95","v":"Recommended"},{"$f":"'4'!N95","v":"Recommended"},{"$f":"'4'!O95","v":"TechOps"},{"$f":"'4'!P95","v":0},{"$f":"'4'!Q95","v":0},{"$f":"'4'!R95","v":0},{"$f":"'4'!S95","v":0},{"$f":"'4'!T95","v":0},{"$f":"'4'!U95","v":0},{"$f":"'4'!V95","v":0},{"$f":"'4'!W95","v":0},{"$f":"'4'!X95","v":0},{"$f":"'4'!Y95","v":0},{"$f":"'4'!Z95","v":0},{"$f":"'4'!AA95","v":0},{"$f":"'4'!AB95","v":0},{"$f":"'4'!AC95","v":0},{"$f":"'4'!AD95","v":0},{"$f":"'4'!AE95","v":0},{"$f":"'4'!AF95","v":0},{"$f":"'4'!AG95","v":0},{"$f":"'4'!AH95","v":0},{"$f":"'4'!AI95","v":0},{"$f":"'4'!AJ95","v":0},{"$f":"'4'!AK95","v":0},{"$f":"'4'!AL95","v":0},{"$f":"'4'!AM95","v":0},{"$f":"'4'!AN95","v":0},{"$f":"'4'!AO95","v":0},{"$f":"'4'!AP95","v":0},{"$f":"'4'!AQ95","v":0},{"$f":"'4'!AR95","v":0},{"$f":"'4'!AS95","v":0},{"$f":"'4'!AT95","v":0},{"$f":"SUMPRODUCT(IF($N305=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N305=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B96","v":"4"},{"$f":"'4'!C96","v":"4.5"},{"$f":"'4'!D96","v":"4.5.1"},{"$f":"'4'!E96","v":""},{"$f":"'4'!F96","v":"4.5.1.4"},{"$f":"'4'!G96","v":0},{"$f":"'4'!H96","v":0},{"$f":"'4'!I96","v":"4.5.1.4.2"},{"$f":"'4'!J96","v":"4.5.1.4.2: Are previous versions of application software and configurations retained as a contingency measure for as long as the data are retained in archive?\n"},{"$f":"'4'!K96","v":0},{"$f":"'4'!L96","v":0},{"$f":"'4'!M96","v":"Recommended"},{"$f":"'4'!N96","v":"Recommended"},{"$f":"'4'!O96","v":"TechOps"},{"$f":"'4'!P96","v":0},{"$f":"'4'!Q96","v":0},{"$f":"'4'!R96","v":0},{"$f":"'4'!S96","v":0},{"$f":"'4'!T96","v":0},{"$f":"'4'!U96","v":0},{"$f":"'4'!V96","v":0},{"$f":"'4'!W96","v":0},{"$f":"'4'!X96","v":0},{"$f":"'4'!Y96","v":0},{"$f":"'4'!Z96","v":0},{"$f":"'4'!AA96","v":0},{"$f":"'4'!AB96","v":0},{"$f":"'4'!AC96","v":0},{"$f":"'4'!AD96","v":0},{"$f":"'4'!AE96","v":0},{"$f":"'4'!AF96","v":0},{"$f":"'4'!AG96","v":0},{"$f":"'4'!AH96","v":0},{"$f":"'4'!AI96","v":0},{"$f":"'4'!AJ96","v":0},{"$f":"'4'!AK96","v":0},{"$f":"'4'!AL96","v":0},{"$f":"'4'!AM96","v":0},{"$f":"'4'!AN96","v":0},{"$f":"'4'!AO96","v":0},{"$f":"'4'!AP96","v":0},{"$f":"'4'!AQ96","v":0},{"$f":"'4'!AR96","v":0},{"$f":"'4'!AS96","v":0},{"$f":"'4'!AT96","v":0},{"$f":"SUMPRODUCT(IF($N306=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N306=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B97","v":"4"},{"$f":"'4'!C97","v":"4.5"},{"$f":"'4'!D97","v":"4.5.1"},{"$f":"'4'!E97","v":""},{"$f":"'4'!F97","v":"4.5.1.4"},{"$f":"'4'!G97","v":0},{"$f":"'4'!H97","v":0},{"$f":"'4'!I97","v":"4.5.1.4.3"},{"$f":"'4'!J97","v":"4.5.1.4.3: Is the configuration management database updated as part of the release management process when changes are made to the system?\n"},{"$f":"'4'!K97","v":0},{"$f":"'4'!L97","v":0},{"$f":"'4'!M97","v":"Recommended"},{"$f":"'4'!N97","v":"Recommended"},{"$f":"'4'!O97","v":"TechOps"},{"$f":"'4'!P97","v":0},{"$f":"'4'!Q97","v":0},{"$f":"'4'!R97","v":0},{"$f":"'4'!S97","v":0},{"$f":"'4'!T97","v":0},{"$f":"'4'!U97","v":0},{"$f":"'4'!V97","v":0},{"$f":"'4'!W97","v":0},{"$f":"'4'!X97","v":0},{"$f":"'4'!Y97","v":0},{"$f":"'4'!Z97","v":0},{"$f":"'4'!AA97","v":0},{"$f":"'4'!AB97","v":0},{"$f":"'4'!AC97","v":0},{"$f":"'4'!AD97","v":0},{"$f":"'4'!AE97","v":0},{"$f":"'4'!AF97","v":0},{"$f":"'4'!AG97","v":0},{"$f":"'4'!AH97","v":0},{"$f":"'4'!AI97","v":0},{"$f":"'4'!AJ97","v":0},{"$f":"'4'!AK97","v":0},{"$f":"'4'!AL97","v":0},{"$f":"'4'!AM97","v":0},{"$f":"'4'!AN97","v":0},{"$f":"'4'!AO97","v":0},{"$f":"'4'!AP97","v":0},{"$f":"'4'!AQ97","v":0},{"$f":"'4'!AR97","v":0},{"$f":"'4'!AS97","v":0},{"$f":"'4'!AT97","v":0},{"$f":"SUMPRODUCT(IF($N307=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N307=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B98","v":"4"},{"$f":"'4'!C98","v":"4.5"},{"$f":"'4'!D98","v":"4.5.1"},{"$f":"'4'!E98","v":""},{"$f":"'4'!F98","v":"4.5.1.5"},{"$f":"'4'!G98","v":"4.5.1.5: REMOVAL OF SERVICES\nWhen services are to be removed, the removal should be performed under a formal process. \n\nCustomer data related to the removed service should be archived in a form that is retrievable. Archived data should be kept according to the data retention policy."},{"$f":"'4'!H98","v":"ISO 20000-1:2011 Sec. 5.2"},{"$f":"'4'!I98","v":"4.5.1.5.1"},{"$f":"'4'!J98","v":"4.5.1.5.1: When services are to be removed, is the removal performed under a formal process?\n"},{"$f":"'4'!K98","v":"1) Release management process \n- Check there is a documented process for the removal of services e.g. a formal project-management process for all changes to services.\n"},{"$f":"'4'!L98","v":0},{"$f":"'4'!M98","v":"Recommended"},{"$f":"'4'!N98","v":"Recommended"},{"$f":"'4'!O98","v":"BizOps"},{"$f":"'4'!P98","v":0},{"$f":"'4'!Q98","v":0},{"$f":"'4'!R98","v":0},{"$f":"'4'!S98","v":0},{"$f":"'4'!T98","v":0},{"$f":"'4'!U98","v":0},{"$f":"'4'!V98","v":0},{"$f":"'4'!W98","v":0},{"$f":"'4'!X98","v":0},{"$f":"'4'!Y98","v":0},{"$f":"'4'!Z98","v":0},{"$f":"'4'!AA98","v":0},{"$f":"'4'!AB98","v":0},{"$f":"'4'!AC98","v":0},{"$f":"'4'!AD98","v":0},{"$f":"'4'!AE98","v":0},{"$f":"'4'!AF98","v":0},{"$f":"'4'!AG98","v":0},{"$f":"'4'!AH98","v":0},{"$f":"'4'!AI98","v":0},{"$f":"'4'!AJ98","v":0},{"$f":"'4'!AK98","v":0},{"$f":"'4'!AL98","v":0},{"$f":"'4'!AM98","v":0},{"$f":"'4'!AN98","v":0},{"$f":"'4'!AO98","v":0},{"$f":"'4'!AP98","v":0},{"$f":"'4'!AQ98","v":0},{"$f":"'4'!AR98","v":0},{"$f":"'4'!AS98","v":0},{"$f":"'4'!AT98","v":0},{"$f":"SUMPRODUCT(IF($N308=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N308=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B99","v":"4"},{"$f":"'4'!C99","v":"4.5"},{"$f":"'4'!D99","v":"4.5.1"},{"$f":"'4'!E99","v":""},{"$f":"'4'!F99","v":"4.5.1.5"},{"$f":"'4'!G99","v":0},{"$f":"'4'!H99","v":0},{"$f":"'4'!I99","v":"4.5.1.5.2"},{"$f":"'4'!J99","v":"4.5.1.5.2: Is customer data related to the removed service archived in a form that is retrievable?\n"},{"$f":"'4'!K99","v":0},{"$f":"'4'!L99","v":0},{"$f":"'4'!M99","v":"Recommended"},{"$f":"'4'!N99","v":"Recommended"},{"$f":"'4'!O99","v":"TechOps"},{"$f":"'4'!P99","v":0},{"$f":"'4'!Q99","v":0},{"$f":"'4'!R99","v":0},{"$f":"'4'!S99","v":0},{"$f":"'4'!T99","v":0},{"$f":"'4'!U99","v":0},{"$f":"'4'!V99","v":0},{"$f":"'4'!W99","v":0},{"$f":"'4'!X99","v":0},{"$f":"'4'!Y99","v":0},{"$f":"'4'!Z99","v":0},{"$f":"'4'!AA99","v":0},{"$f":"'4'!AB99","v":0},{"$f":"'4'!AC99","v":0},{"$f":"'4'!AD99","v":0},{"$f":"'4'!AE99","v":0},{"$f":"'4'!AF99","v":0},{"$f":"'4'!AG99","v":0},{"$f":"'4'!AH99","v":0},{"$f":"'4'!AI99","v":0},{"$f":"'4'!AJ99","v":0},{"$f":"'4'!AK99","v":0},{"$f":"'4'!AL99","v":0},{"$f":"'4'!AM99","v":0},{"$f":"'4'!AN99","v":0},{"$f":"'4'!AO99","v":0},{"$f":"'4'!AP99","v":0},{"$f":"'4'!AQ99","v":0},{"$f":"'4'!AR99","v":0},{"$f":"'4'!AS99","v":0},{"$f":"'4'!AT99","v":0},{"$f":"SUMPRODUCT(IF($N309=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N309=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B101","v":"4"},{"$f":"'4'!C101","v":"4.6"},{"$f":"'4'!D101","v":"4.6.1"},{"$f":"'4'!E101","v":"4.6.1: Providers should establish a risk management framework for identifying, assessing and controlling risks"},{"$f":"'4'!F101","v":"4.6.1.1"},{"$f":"'4'!G101","v":"4.6.1.1: MOBILE MONEY RISK MANAGEMENT GOVERNANCE\nA mobile money risk management policy should be documented that defines the framework for mobile money risk management, including scope, process, governance and organization. The framework should be focused on mobile money risks, which are distinct from the usual mobile operator risks.\n\nA Risk Manager should be appointed as the single point of contact with responsibility for mobile money risk management.  This need not be a dedicated role and the individual could have other responsibilities.\n\nIf the provider has an enterprise risk management function, the mobile money Risk Manager should inform that team of the key mobile money risks.\n\nNote: GSMA has published a separate Risk Management Toolkit, which has examples of the risk management process and mobile money risks and controls."},{"$f":"'4'!H101","v":"ISO 27005:2018 Sec. 7.1"},{"$f":"'4'!I101","v":"4.6.1.1.1"},{"$f":"'4'!J101","v":"4.6.1.1.1: Has a mobile money risk management framework been documented that defines the mobile money risk management scope, process, governance and organization?\n"},{"$f":"'4'!K101","v":"1) Risk management framework, process or similar document\n- Check that the process has been documented\n- Check that it defines the framework for mobile money risk management, including:\na) Scope\nb) Process \nc) Governance\nd) Organization"},{"$f":"'4'!L101","v":0},{"$f":"'4'!M101","v":"Standard Required"},{"$f":"'4'!N101","v":"Required"},{"$f":"'4'!O101","v":"FraudRisk"},{"$f":"'4'!P101","v":0},{"$f":"'4'!Q101","v":0},{"$f":"'4'!R101","v":0},{"$f":"'4'!S101","v":0},{"$f":"'4'!T101","v":0},{"$f":"'4'!U101","v":0},{"$f":"'4'!V101","v":0},{"$f":"'4'!W101","v":0},{"$f":"'4'!X101","v":0},{"$f":"'4'!Y101","v":0},{"$f":"'4'!Z101","v":0},{"$f":"'4'!AA101","v":0},{"$f":"'4'!AB101","v":0},{"$f":"'4'!AC101","v":0},{"$f":"'4'!AD101","v":0},{"$f":"'4'!AE101","v":0},{"$f":"'4'!AF101","v":0},{"$f":"'4'!AG101","v":0},{"$f":"'4'!AH101","v":0},{"$f":"'4'!AI101","v":0},{"$f":"'4'!AJ101","v":0},{"$f":"'4'!AK101","v":0},{"$f":"'4'!AL101","v":0},{"$f":"'4'!AM101","v":0},{"$f":"'4'!AN101","v":0},{"$f":"'4'!AO101","v":0},{"$f":"'4'!AP101","v":0},{"$f":"'4'!AQ101","v":0},{"$f":"'4'!AR101","v":0},{"$f":"'4'!AS101","v":0},{"$f":"'4'!AT101","v":0},{"$f":"SUMPRODUCT(IF($N310=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N310=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B102","v":"4"},{"$f":"'4'!C102","v":"4.6"},{"$f":"'4'!D102","v":"4.6.1"},{"$f":"'4'!E102","v":0},{"$f":"'4'!F102","v":"4.6.1.1"},{"$f":"'4'!G102","v":0},{"$f":"'4'!H102","v":0},{"$f":"'4'!I102","v":"4.6.1.1.2"},{"$f":"'4'!J102","v":"4.6.1.1.2: Has an individual been appointed with responsibility for mobile money risk management?\n"},{"$f":"'4'!K102","v":"1) Risk management organization chart and/or risk manager job description\n- Check that an individual been appointed with responsibility for mobile money risk management, to be the single point of contact. "},{"$f":"'4'!L102","v":0},{"$f":"'4'!M102","v":"Standard Required"},{"$f":"'4'!N102","v":"Required"},{"$f":"'4'!O102","v":"FraudRisk"},{"$f":"'4'!P102","v":0},{"$f":"'4'!Q102","v":0},{"$f":"'4'!R102","v":0},{"$f":"'4'!S102","v":0},{"$f":"'4'!T102","v":0},{"$f":"'4'!U102","v":0},{"$f":"'4'!V102","v":0},{"$f":"'4'!W102","v":0},{"$f":"'4'!X102","v":0},{"$f":"'4'!Y102","v":0},{"$f":"'4'!Z102","v":0},{"$f":"'4'!AA102","v":0},{"$f":"'4'!AB102","v":0},{"$f":"'4'!AC102","v":0},{"$f":"'4'!AD102","v":0},{"$f":"'4'!AE102","v":0},{"$f":"'4'!AF102","v":0},{"$f":"'4'!AG102","v":0},{"$f":"'4'!AH102","v":0},{"$f":"'4'!AI102","v":0},{"$f":"'4'!AJ102","v":0},{"$f":"'4'!AK102","v":0},{"$f":"'4'!AL102","v":0},{"$f":"'4'!AM102","v":0},{"$f":"'4'!AN102","v":0},{"$f":"'4'!AO102","v":0},{"$f":"'4'!AP102","v":0},{"$f":"'4'!AQ102","v":0},{"$f":"'4'!AR102","v":0},{"$f":"'4'!AS102","v":0},{"$f":"'4'!AT102","v":0},{"$f":"SUMPRODUCT(IF($N311=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N311=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B103","v":"4"},{"$f":"'4'!C103","v":"4.6"},{"$f":"'4'!D103","v":"4.6.1"},{"$f":"'4'!E103","v":""},{"$f":"'4'!F103","v":"4.6.1.2"},{"$f":"'4'!G103","v":"4.6.1.2: RISK ASSESSMENT PROCESS\nRisk assessments should be carried out:\n- Regularly (at least annually);\n- Following a significant change to the mobile money system. \nThe assessment of each risk should be documented in a risk register.\n\nAll types of known risk that could impact the mobile money business should be included, including the following:\n- Fraud risks;\n- ML/ TF risks;\n- Financial risks;\n- Compliance risks;\n- Operational risks; and\n- Strategic risks.\n\nRisk management should be applied to all functions and systems delivering the mobile money service, including agents and other external parties that are part of the delivery of the mobile money service."},{"$f":"'4'!H103","v":"PCI DSS, ISO 27005:2018 Sec. 8 & 12.1, \nECB RSMP"},{"$f":"'4'!I103","v":"4.6.1.2.1"},{"$f":"'4'!J103","v":"4.6.1.2.1: Are risk assessments carried out at least annualy as well as following a significant change to the mobile money service?\n"},{"$f":"'4'!K103","v":"1) Risk register (extract)\n2) Risk management framework, process or similar document\n- Check a risk assessment has been performed in at least the last year, and following a significant change to the mobile money service.\n- If no significant changes made in the last year, check the process documentation.\nNote: it may not be possible to view the contents of the risk register, as it is sensitive, but is should be possible to view its change log"},{"$f":"'4'!L103","v":0},{"$f":"'4'!M103","v":"Urgent Required"},{"$f":"'4'!N103","v":"Required"},{"$f":"'4'!O103","v":"FraudRisk"},{"$f":"'4'!P103","v":0},{"$f":"'4'!Q103","v":0},{"$f":"'4'!R103","v":0},{"$f":"'4'!S103","v":0},{"$f":"'4'!T103","v":0},{"$f":"'4'!U103","v":0},{"$f":"'4'!V103","v":0},{"$f":"'4'!W103","v":0},{"$f":"'4'!X103","v":0},{"$f":"'4'!Y103","v":0},{"$f":"'4'!Z103","v":0},{"$f":"'4'!AA103","v":0},{"$f":"'4'!AB103","v":0},{"$f":"'4'!AC103","v":0},{"$f":"'4'!AD103","v":0},{"$f":"'4'!AE103","v":0},{"$f":"'4'!AF103","v":0},{"$f":"'4'!AG103","v":0},{"$f":"'4'!AH103","v":0},{"$f":"'4'!AI103","v":0},{"$f":"'4'!AJ103","v":0},{"$f":"'4'!AK103","v":0},{"$f":"'4'!AL103","v":0},{"$f":"'4'!AM103","v":0},{"$f":"'4'!AN103","v":0},{"$f":"'4'!AO103","v":0},{"$f":"'4'!AP103","v":0},{"$f":"'4'!AQ103","v":0},{"$f":"'4'!AR103","v":0},{"$f":"'4'!AS103","v":0},{"$f":"'4'!AT103","v":0},{"$f":"SUMPRODUCT(IF($N312=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N312=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B104","v":"4"},{"$f":"'4'!C104","v":"4.6"},{"$f":"'4'!D104","v":"4.6.1"},{"$f":"'4'!E104","v":""},{"$f":"'4'!F104","v":"4.6.1.2"},{"$f":"'4'!G104","v":0},{"$f":"'4'!H104","v":0},{"$f":"'4'!I104","v":"4.6.1.2.2"},{"$f":"'4'!J104","v":"4.6.1.2.2: Are risk assessments documented in a risk register?\n"},{"$f":"'4'!K104","v":"1) Risk register (extract)\n- Check that there is a documented risk register that has been updated/reviewed in at least the last year. \nNote: it may not be possible to view the contents of the risk register, as it is sensitive, but is should be possible to view a heat map showing number of risks identified and categorized, or similar extract. "},{"$f":"'4'!L104","v":0},{"$f":"'4'!M104","v":"Standard Required"},{"$f":"'4'!N104","v":"Required"},{"$f":"'4'!O104","v":"FraudRisk"},{"$f":"'4'!P104","v":0},{"$f":"'4'!Q104","v":0},{"$f":"'4'!R104","v":0},{"$f":"'4'!S104","v":0},{"$f":"'4'!T104","v":0},{"$f":"'4'!U104","v":0},{"$f":"'4'!V104","v":0},{"$f":"'4'!W104","v":0},{"$f":"'4'!X104","v":0},{"$f":"'4'!Y104","v":0},{"$f":"'4'!Z104","v":0},{"$f":"'4'!AA104","v":0},{"$f":"'4'!AB104","v":0},{"$f":"'4'!AC104","v":0},{"$f":"'4'!AD104","v":0},{"$f":"'4'!AE104","v":0},{"$f":"'4'!AF104","v":0},{"$f":"'4'!AG104","v":0},{"$f":"'4'!AH104","v":0},{"$f":"'4'!AI104","v":0},{"$f":"'4'!AJ104","v":0},{"$f":"'4'!AK104","v":0},{"$f":"'4'!AL104","v":0},{"$f":"'4'!AM104","v":0},{"$f":"'4'!AN104","v":0},{"$f":"'4'!AO104","v":0},{"$f":"'4'!AP104","v":0},{"$f":"'4'!AQ104","v":0},{"$f":"'4'!AR104","v":0},{"$f":"'4'!AS104","v":0},{"$f":"'4'!AT104","v":0},{"$f":"SUMPRODUCT(IF($N313=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N313=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B105","v":"4"},{"$f":"'4'!C105","v":"4.6"},{"$f":"'4'!D105","v":"4.6.1"},{"$f":"'4'!E105","v":""},{"$f":"'4'!F105","v":"4.6.1.2"},{"$f":"'4'!G105","v":0},{"$f":"'4'!H105","v":0},{"$f":"'4'!I105","v":"4.6.1.2.3"},{"$f":"'4'!J105","v":"4.6.1.2.3: Are all types of known risk that could impact the mobile money business included in risk assessments, including fraud risks, ML/ TF risks, financial risks, compliance risks, operational risks, strategic risks, agent risks, 3rd party risks?\n"},{"$f":"'4'!K105","v":"1) Risk management process or framework\n- Check there are suitable / sufficient categories including, for example\na) Fraud\nb) ML/CFT\nc) Financial\nd) Compliance\ne) Operational and strategic risks\nf) Agent and 3rd party risks\n"},{"$f":"'4'!L105","v":0},{"$f":"'4'!M105","v":"Standard Required"},{"$f":"'4'!N105","v":"Required"},{"$f":"'4'!O105","v":"FraudRisk"},{"$f":"'4'!P105","v":0},{"$f":"'4'!Q105","v":0},{"$f":"'4'!R105","v":0},{"$f":"'4'!S105","v":0},{"$f":"'4'!T105","v":0},{"$f":"'4'!U105","v":0},{"$f":"'4'!V105","v":0},{"$f":"'4'!W105","v":0},{"$f":"'4'!X105","v":0},{"$f":"'4'!Y105","v":0},{"$f":"'4'!Z105","v":0},{"$f":"'4'!AA105","v":0},{"$f":"'4'!AB105","v":0},{"$f":"'4'!AC105","v":0},{"$f":"'4'!AD105","v":0},{"$f":"'4'!AE105","v":0},{"$f":"'4'!AF105","v":0},{"$f":"'4'!AG105","v":0},{"$f":"'4'!AH105","v":0},{"$f":"'4'!AI105","v":0},{"$f":"'4'!AJ105","v":0},{"$f":"'4'!AK105","v":0},{"$f":"'4'!AL105","v":0},{"$f":"'4'!AM105","v":0},{"$f":"'4'!AN105","v":0},{"$f":"'4'!AO105","v":0},{"$f":"'4'!AP105","v":0},{"$f":"'4'!AQ105","v":0},{"$f":"'4'!AR105","v":0},{"$f":"'4'!AS105","v":0},{"$f":"'4'!AT105","v":0},{"$f":"SUMPRODUCT(IF($N314=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N314=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B106","v":"4"},{"$f":"'4'!C106","v":"4.6"},{"$f":"'4'!D106","v":"4.6.1"},{"$f":"'4'!E106","v":""},{"$f":"'4'!F106","v":"4.6.1.3"},{"$f":"'4'!G106","v":"4.6.1.3: RISK IDENTIFICATION AND EVALUATION \nEach risk assessment should identify new risks and evaluate their severity. It should also re-evaluate risks that were reviewed in the previous risk assessment. This information can be used to prioritize the application of resources to address these risks.\n\nAn owner should be assigned to each risk, which is usually the relevant functional manager.\n\nThe severity of each risk should be assessed. Usually, this is calculated using a formula combining risk impact and likelihood:\n- Impact - the impact that the risk would have if it materialized;\n- Likelihood - the probability (or frequency) that the risk will materialize.\nThe impact and likelihood scores should take into account the existing controls that are in place to mitigate the risk (net risk). Additionally, if desired, scoring can be done on the assumption of no controls (gross risk).\n\nOne way to measure severity is to assign a score (e.g. 1-5) to Impact and to Likelihood and to multiply these values together to give a combined score for Severity (1-25).\n\nExamples of types of impact that should be considered include:\n- Financial loss for the provider or customers;\n- Reputation / brand damage;\n- Non-compliance with regulatory requirements; and\n- Operational impact on the mobile money business."},{"$f":"'4'!H106","v":"ISO 27005:2018 Sec. 7 & 7.2.3"},{"$f":"'4'!I106","v":"4.6.1.3.1"},{"$f":"'4'!J106","v":"4.6.1.3.1: Do risk assessments identify and evaluate new risks that have emerged since the previous risk assessment?\n"},{"$f":"'4'!K106","v":0},{"$f":"'4'!L106","v":0},{"$f":"'4'!M106","v":"Recommended"},{"$f":"'4'!N106","v":"Recommended"},{"$f":"'4'!O106","v":"FraudRisk"},{"$f":"'4'!P106","v":0},{"$f":"'4'!Q106","v":0},{"$f":"'4'!R106","v":0},{"$f":"'4'!S106","v":0},{"$f":"'4'!T106","v":0},{"$f":"'4'!U106","v":0},{"$f":"'4'!V106","v":0},{"$f":"'4'!W106","v":0},{"$f":"'4'!X106","v":0},{"$f":"'4'!Y106","v":0},{"$f":"'4'!Z106","v":0},{"$f":"'4'!AA106","v":0},{"$f":"'4'!AB106","v":0},{"$f":"'4'!AC106","v":0},{"$f":"'4'!AD106","v":0},{"$f":"'4'!AE106","v":0},{"$f":"'4'!AF106","v":0},{"$f":"'4'!AG106","v":0},{"$f":"'4'!AH106","v":0},{"$f":"'4'!AI106","v":0},{"$f":"'4'!AJ106","v":0},{"$f":"'4'!AK106","v":0},{"$f":"'4'!AL106","v":0},{"$f":"'4'!AM106","v":0},{"$f":"'4'!AN106","v":0},{"$f":"'4'!AO106","v":0},{"$f":"'4'!AP106","v":0},{"$f":"'4'!AQ106","v":0},{"$f":"'4'!AR106","v":0},{"$f":"'4'!AS106","v":0},{"$f":"'4'!AT106","v":0},{"$f":"SUMPRODUCT(IF($N315=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N315=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B107","v":"4"},{"$f":"'4'!C107","v":"4.6"},{"$f":"'4'!D107","v":"4.6.1"},{"$f":"'4'!E107","v":""},{"$f":"'4'!F107","v":"4.6.1.3"},{"$f":"'4'!G107","v":0},{"$f":"'4'!H107","v":0},{"$f":"'4'!I107","v":"4.6.1.3.2"},{"$f":"'4'!J107","v":"4.6.1.3.2: Do risk assessments re-evaluate risks that were reviewed in the previous risk assessment?\n"},{"$f":"'4'!K107","v":0},{"$f":"'4'!L107","v":0},{"$f":"'4'!M107","v":"Recommended"},{"$f":"'4'!N107","v":"Recommended"},{"$f":"'4'!O107","v":"FraudRisk"},{"$f":"'4'!P107","v":0},{"$f":"'4'!Q107","v":0},{"$f":"'4'!R107","v":0},{"$f":"'4'!S107","v":0},{"$f":"'4'!T107","v":0},{"$f":"'4'!U107","v":0},{"$f":"'4'!V107","v":0},{"$f":"'4'!W107","v":0},{"$f":"'4'!X107","v":0},{"$f":"'4'!Y107","v":0},{"$f":"'4'!Z107","v":0},{"$f":"'4'!AA107","v":0},{"$f":"'4'!AB107","v":0},{"$f":"'4'!AC107","v":0},{"$f":"'4'!AD107","v":0},{"$f":"'4'!AE107","v":0},{"$f":"'4'!AF107","v":0},{"$f":"'4'!AG107","v":0},{"$f":"'4'!AH107","v":0},{"$f":"'4'!AI107","v":0},{"$f":"'4'!AJ107","v":0},{"$f":"'4'!AK107","v":0},{"$f":"'4'!AL107","v":0},{"$f":"'4'!AM107","v":0},{"$f":"'4'!AN107","v":0},{"$f":"'4'!AO107","v":0},{"$f":"'4'!AP107","v":0},{"$f":"'4'!AQ107","v":0},{"$f":"'4'!AR107","v":0},{"$f":"'4'!AS107","v":0},{"$f":"'4'!AT107","v":0},{"$f":"SUMPRODUCT(IF($N316=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N316=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B108","v":"4"},{"$f":"'4'!C108","v":"4.6"},{"$f":"'4'!D108","v":"4.6.1"},{"$f":"'4'!E108","v":""},{"$f":"'4'!F108","v":"4.6.1.3"},{"$f":"'4'!G108","v":0},{"$f":"'4'!H108","v":0},{"$f":"'4'!I108","v":"4.6.1.3.3"},{"$f":"'4'!J108","v":"4.6.1.3.3: Is an owner assigned to each risk (e.g. the relevant functional manager)?\n"},{"$f":"'4'!K108","v":"1) Risk register (extract)\n2) Risk management framework, process or similar document\n- Check that all risks in the register have an owner assigned from the relevant functional department."},{"$f":"'4'!L108","v":0},{"$f":"'4'!M108","v":"Standard Required"},{"$f":"'4'!N108","v":"Required"},{"$f":"'4'!O108","v":"FraudRisk"},{"$f":"'4'!P108","v":0},{"$f":"'4'!Q108","v":0},{"$f":"'4'!R108","v":0},{"$f":"'4'!S108","v":0},{"$f":"'4'!T108","v":0},{"$f":"'4'!U108","v":0},{"$f":"'4'!V108","v":0},{"$f":"'4'!W108","v":0},{"$f":"'4'!X108","v":0},{"$f":"'4'!Y108","v":0},{"$f":"'4'!Z108","v":0},{"$f":"'4'!AA108","v":0},{"$f":"'4'!AB108","v":0},{"$f":"'4'!AC108","v":0},{"$f":"'4'!AD108","v":0},{"$f":"'4'!AE108","v":0},{"$f":"'4'!AF108","v":0},{"$f":"'4'!AG108","v":0},{"$f":"'4'!AH108","v":0},{"$f":"'4'!AI108","v":0},{"$f":"'4'!AJ108","v":0},{"$f":"'4'!AK108","v":0},{"$f":"'4'!AL108","v":0},{"$f":"'4'!AM108","v":0},{"$f":"'4'!AN108","v":0},{"$f":"'4'!AO108","v":0},{"$f":"'4'!AP108","v":0},{"$f":"'4'!AQ108","v":0},{"$f":"'4'!AR108","v":0},{"$f":"'4'!AS108","v":0},{"$f":"'4'!AT108","v":0},{"$f":"SUMPRODUCT(IF($N317=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N317=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B109","v":"4"},{"$f":"'4'!C109","v":"4.6"},{"$f":"'4'!D109","v":"4.6.1"},{"$f":"'4'!E109","v":""},{"$f":"'4'!F109","v":"4.6.1.3"},{"$f":"'4'!G109","v":0},{"$f":"'4'!H109","v":0},{"$f":"'4'!I109","v":"4.6.1.3.4"},{"$f":"'4'!J109","v":"4.6.1.3.4: Is the severity of each risk assessed by considering the impact and likelihood of the risk occurring, taking into account the controls that are in place to mitigate the risk?\n"},{"$f":"'4'!K109","v":"1) Risk register (extract)\n2) Risk management framework, process or similar document\n- Check that all risks in the register have a severity rating assigned."},{"$f":"'4'!L109","v":0},{"$f":"'4'!M109","v":"Standard Required"},{"$f":"'4'!N109","v":"Required"},{"$f":"'4'!O109","v":"FraudRisk"},{"$f":"'4'!P109","v":0},{"$f":"'4'!Q109","v":0},{"$f":"'4'!R109","v":0},{"$f":"'4'!S109","v":0},{"$f":"'4'!T109","v":0},{"$f":"'4'!U109","v":0},{"$f":"'4'!V109","v":0},{"$f":"'4'!W109","v":0},{"$f":"'4'!X109","v":0},{"$f":"'4'!Y109","v":0},{"$f":"'4'!Z109","v":0},{"$f":"'4'!AA109","v":0},{"$f":"'4'!AB109","v":0},{"$f":"'4'!AC109","v":0},{"$f":"'4'!AD109","v":0},{"$f":"'4'!AE109","v":0},{"$f":"'4'!AF109","v":0},{"$f":"'4'!AG109","v":0},{"$f":"'4'!AH109","v":0},{"$f":"'4'!AI109","v":0},{"$f":"'4'!AJ109","v":0},{"$f":"'4'!AK109","v":0},{"$f":"'4'!AL109","v":0},{"$f":"'4'!AM109","v":0},{"$f":"'4'!AN109","v":0},{"$f":"'4'!AO109","v":0},{"$f":"'4'!AP109","v":0},{"$f":"'4'!AQ109","v":0},{"$f":"'4'!AR109","v":0},{"$f":"'4'!AS109","v":0},{"$f":"'4'!AT109","v":0},{"$f":"SUMPRODUCT(IF($N318=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N318=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B110","v":"4"},{"$f":"'4'!C110","v":"4.6"},{"$f":"'4'!D110","v":"4.6.1"},{"$f":"'4'!E110","v":""},{"$f":"'4'!F110","v":"4.6.1.4"},{"$f":"'4'!G110","v":"4.6.1.4: RISK ACTIONS\nThe risk management process should identify actions to be taken to manage each risk. Actions include:\n- treat (apply additional controls);\n- tolerate (accept the level of risk);\n- transfer (pass the risk onto another party - e.g. insurance); or\n- terminate (cease the business activity that has the risk).\n\nThe usual course of action is to implement improved controls to improve the risk severity score to an acceptable level. Controls reduce the severity of the risk by reducing the impact and/or likelihood.\n\nActions should be assigned to the owners of the risks, which are usually the functional managers and not the Risk Manager."},{"$f":"'4'!H110","v":"ISO 27005:2018 Sec. 9"},{"$f":"'4'!I110","v":"4.6.1.4.1"},{"$f":"'4'!J110","v":"4.6.1.4.1: Does the risk management process identify actions to be taken to manage each risk, such as improving controls where necessary (i.e. treat / tolerate / transfer / terminate)?\n"},{"$f":"'4'!K110","v":"1) Risk register (extract)\n2) Risk management framework, process or similar document\n- Check the risk management process has actions identified for each risk,  (e.g. treat / tolerate / transfer / terminate), with a responsible party for each action."},{"$f":"'4'!L110","v":0},{"$f":"'4'!M110","v":"Standard Required"},{"$f":"'4'!N110","v":"Required"},{"$f":"'4'!O110","v":"FraudRisk"},{"$f":"'4'!P110","v":0},{"$f":"'4'!Q110","v":0},{"$f":"'4'!R110","v":0},{"$f":"'4'!S110","v":0},{"$f":"'4'!T110","v":0},{"$f":"'4'!U110","v":0},{"$f":"'4'!V110","v":0},{"$f":"'4'!W110","v":0},{"$f":"'4'!X110","v":0},{"$f":"'4'!Y110","v":0},{"$f":"'4'!Z110","v":0},{"$f":"'4'!AA110","v":0},{"$f":"'4'!AB110","v":0},{"$f":"'4'!AC110","v":0},{"$f":"'4'!AD110","v":0},{"$f":"'4'!AE110","v":0},{"$f":"'4'!AF110","v":0},{"$f":"'4'!AG110","v":0},{"$f":"'4'!AH110","v":0},{"$f":"'4'!AI110","v":0},{"$f":"'4'!AJ110","v":0},{"$f":"'4'!AK110","v":0},{"$f":"'4'!AL110","v":0},{"$f":"'4'!AM110","v":0},{"$f":"'4'!AN110","v":0},{"$f":"'4'!AO110","v":0},{"$f":"'4'!AP110","v":0},{"$f":"'4'!AQ110","v":0},{"$f":"'4'!AR110","v":0},{"$f":"'4'!AS110","v":0},{"$f":"'4'!AT110","v":0},{"$f":"SUMPRODUCT(IF($N319=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N319=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B111","v":"4"},{"$f":"'4'!C111","v":"4.6"},{"$f":"'4'!D111","v":"4.6.1"},{"$f":"'4'!E111","v":""},{"$f":"'4'!F111","v":"4.6.1.5"},{"$f":"'4'!G111","v":"4.6.1.5: RISK ACCEPTANCE \nRisks cannot, in general, be reduced to zero. This means that the provider should make a formal decision to tolerate certain levels of risk. This requires acceptance of the risk at the appropriate level of management, with the justification documented.\n\nRisk acceptance criteria should be set to help determine when to accept risks. Typically, a maximum target level of risk should be set. Exceptions may be allowed under certain circumstances. For example:\n- Provisions may be included for senior managers to accept risks above the maximum level under defined circumstances;\n- Higher risks may be accepted by comparing estimated profit (or other business benefit) to the cost of controlling the risk;\n- Higher risks may be accepted temporarily pending controls to be implemented within a defined time period.\n\nNOTE: A lower threshold of risk acceptability may be established for compliance risks.\n"},{"$f":"'4'!H111","v":"ISO 27005:2011 Sec. 7.2.4, Sec. 10"},{"$f":"'4'!I111","v":"4.6.1.5.1"},{"$f":"'4'!J111","v":"4.6.1.5.1: Has the decision to tolerate certain levels of risk been signed off at the appropriate level of management?\n"},{"$f":"'4'!K111","v":0},{"$f":"'4'!L111","v":0},{"$f":"'4'!M111","v":"Recommended"},{"$f":"'4'!N111","v":"Recommended"},{"$f":"'4'!O111","v":"FraudRisk"},{"$f":"'4'!P111","v":0},{"$f":"'4'!Q111","v":0},{"$f":"'4'!R111","v":0},{"$f":"'4'!S111","v":0},{"$f":"'4'!T111","v":0},{"$f":"'4'!U111","v":0},{"$f":"'4'!V111","v":0},{"$f":"'4'!W111","v":0},{"$f":"'4'!X111","v":0},{"$f":"'4'!Y111","v":0},{"$f":"'4'!Z111","v":0},{"$f":"'4'!AA111","v":0},{"$f":"'4'!AB111","v":0},{"$f":"'4'!AC111","v":0},{"$f":"'4'!AD111","v":0},{"$f":"'4'!AE111","v":0},{"$f":"'4'!AF111","v":0},{"$f":"'4'!AG111","v":0},{"$f":"'4'!AH111","v":0},{"$f":"'4'!AI111","v":0},{"$f":"'4'!AJ111","v":0},{"$f":"'4'!AK111","v":0},{"$f":"'4'!AL111","v":0},{"$f":"'4'!AM111","v":0},{"$f":"'4'!AN111","v":0},{"$f":"'4'!AO111","v":0},{"$f":"'4'!AP111","v":0},{"$f":"'4'!AQ111","v":0},{"$f":"'4'!AR111","v":0},{"$f":"'4'!AS111","v":0},{"$f":"'4'!AT111","v":0},{"$f":"SUMPRODUCT(IF($N320=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N320=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B112","v":"4"},{"$f":"'4'!C112","v":"4.6"},{"$f":"'4'!D112","v":"4.6.1"},{"$f":"'4'!E112","v":""},{"$f":"'4'!F112","v":"4.6.1.5"},{"$f":"'4'!G112","v":0},{"$f":"'4'!H112","v":0},{"$f":"'4'!I112","v":"4.6.1.5.2"},{"$f":"'4'!J112","v":"4.6.1.5.2: Have risk acceptance criteria been defined to help determine when to accept risks and to establish maximum target levels of risk?\n"},{"$f":"'4'!K112","v":0},{"$f":"'4'!L112","v":0},{"$f":"'4'!M112","v":"Recommended"},{"$f":"'4'!N112","v":"Recommended"},{"$f":"'4'!O112","v":"FraudRisk"},{"$f":"'4'!P112","v":0},{"$f":"'4'!Q112","v":0},{"$f":"'4'!R112","v":0},{"$f":"'4'!S112","v":0},{"$f":"'4'!T112","v":0},{"$f":"'4'!U112","v":0},{"$f":"'4'!V112","v":0},{"$f":"'4'!W112","v":0},{"$f":"'4'!X112","v":0},{"$f":"'4'!Y112","v":0},{"$f":"'4'!Z112","v":0},{"$f":"'4'!AA112","v":0},{"$f":"'4'!AB112","v":0},{"$f":"'4'!AC112","v":0},{"$f":"'4'!AD112","v":0},{"$f":"'4'!AE112","v":0},{"$f":"'4'!AF112","v":0},{"$f":"'4'!AG112","v":0},{"$f":"'4'!AH112","v":0},{"$f":"'4'!AI112","v":0},{"$f":"'4'!AJ112","v":0},{"$f":"'4'!AK112","v":0},{"$f":"'4'!AL112","v":0},{"$f":"'4'!AM112","v":0},{"$f":"'4'!AN112","v":0},{"$f":"'4'!AO112","v":0},{"$f":"'4'!AP112","v":0},{"$f":"'4'!AQ112","v":0},{"$f":"'4'!AR112","v":0},{"$f":"'4'!AS112","v":0},{"$f":"'4'!AT112","v":0},{"$f":"SUMPRODUCT(IF($N321=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N321=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B113","v":"4"},{"$f":"'4'!C113","v":"4.6"},{"$f":"'4'!D113","v":"4.6.1"},{"$f":"'4'!E113","v":""},{"$f":"'4'!F113","v":"4.6.1.5"},{"$f":"'4'!G113","v":0},{"$f":"'4'!H113","v":0},{"$f":"'4'!I113","v":"4.6.1.5.3"},{"$f":"'4'!J113","v":"4.6.1.5.3: Do risk acceptance criteria allow exceptions, such as higher risks being approved by senior management or higher risks being accepted temporarily pending planned implementation of controls?\n"},{"$f":"'4'!K113","v":0},{"$f":"'4'!L113","v":0},{"$f":"'4'!M113","v":"Recommended"},{"$f":"'4'!N113","v":"Recommended"},{"$f":"'4'!O113","v":"FraudRisk"},{"$f":"'4'!P113","v":0},{"$f":"'4'!Q113","v":0},{"$f":"'4'!R113","v":0},{"$f":"'4'!S113","v":0},{"$f":"'4'!T113","v":0},{"$f":"'4'!U113","v":0},{"$f":"'4'!V113","v":0},{"$f":"'4'!W113","v":0},{"$f":"'4'!X113","v":0},{"$f":"'4'!Y113","v":0},{"$f":"'4'!Z113","v":0},{"$f":"'4'!AA113","v":0},{"$f":"'4'!AB113","v":0},{"$f":"'4'!AC113","v":0},{"$f":"'4'!AD113","v":0},{"$f":"'4'!AE113","v":0},{"$f":"'4'!AF113","v":0},{"$f":"'4'!AG113","v":0},{"$f":"'4'!AH113","v":0},{"$f":"'4'!AI113","v":0},{"$f":"'4'!AJ113","v":0},{"$f":"'4'!AK113","v":0},{"$f":"'4'!AL113","v":0},{"$f":"'4'!AM113","v":0},{"$f":"'4'!AN113","v":0},{"$f":"'4'!AO113","v":0},{"$f":"'4'!AP113","v":0},{"$f":"'4'!AQ113","v":0},{"$f":"'4'!AR113","v":0},{"$f":"'4'!AS113","v":0},{"$f":"'4'!AT113","v":0},{"$f":"SUMPRODUCT(IF($N322=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N322=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B114","v":"4"},{"$f":"'4'!C114","v":"4.6"},{"$f":"'4'!D114","v":"4.6.1"},{"$f":"'4'!E114","v":""},{"$f":"'4'!F114","v":"4.6.1.5"},{"$f":"'4'!G114","v":0},{"$f":"'4'!H114","v":0},{"$f":"'4'!I114","v":"4.6.1.5.4"},{"$f":"'4'!J114","v":"4.6.1.5.4: Do compliance risks have a lower threshold of risk acceptability?\n"},{"$f":"'4'!K114","v":0},{"$f":"'4'!L114","v":0},{"$f":"'4'!M114","v":"Recommended"},{"$f":"'4'!N114","v":"Recommended"},{"$f":"'4'!O114","v":"FraudRisk"},{"$f":"'4'!P114","v":0},{"$f":"'4'!Q114","v":0},{"$f":"'4'!R114","v":0},{"$f":"'4'!S114","v":0},{"$f":"'4'!T114","v":0},{"$f":"'4'!U114","v":0},{"$f":"'4'!V114","v":0},{"$f":"'4'!W114","v":0},{"$f":"'4'!X114","v":0},{"$f":"'4'!Y114","v":0},{"$f":"'4'!Z114","v":0},{"$f":"'4'!AA114","v":0},{"$f":"'4'!AB114","v":0},{"$f":"'4'!AC114","v":0},{"$f":"'4'!AD114","v":0},{"$f":"'4'!AE114","v":0},{"$f":"'4'!AF114","v":0},{"$f":"'4'!AG114","v":0},{"$f":"'4'!AH114","v":0},{"$f":"'4'!AI114","v":0},{"$f":"'4'!AJ114","v":0},{"$f":"'4'!AK114","v":0},{"$f":"'4'!AL114","v":0},{"$f":"'4'!AM114","v":0},{"$f":"'4'!AN114","v":0},{"$f":"'4'!AO114","v":0},{"$f":"'4'!AP114","v":0},{"$f":"'4'!AQ114","v":0},{"$f":"'4'!AR114","v":0},{"$f":"'4'!AS114","v":0},{"$f":"'4'!AT114","v":0},{"$f":"SUMPRODUCT(IF($N323=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N323=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B115","v":"4"},{"$f":"'4'!C115","v":"4.6"},{"$f":"'4'!D115","v":"4.6.1"},{"$f":"'4'!E115","v":""},{"$f":"'4'!F115","v":"4.6.1.6"},{"$f":"'4'!G115","v":"4.6.1.6: RISK COMMUNICATION AND MONITORING\nThe risk register should be communicated to risk owners and the head of mobile money at least every 12 months. High-severity risks should be highlighted to senior management.\n\nRisk owners should be informed of the required actions for implementing further controls, and these actions should be monitored by the Risk Manager to ensure that they are implemented.\n\nRegular reporting should be implemented to track Key Risk Indicators (KRIs) which will show whether risks are materializing. KRIs fall into two categories:\n - Leading indicators, which give an indication of risks that may be about to materialize;\n - Lagging indicators, which report on risks that are already starting to materialize.\n"},{"$f":"'4'!H115","v":"ISO 27005:2018 Sec. 11"},{"$f":"'4'!I115","v":"4.6.1.6.1"},{"$f":"'4'!J115","v":"4.6.1.6.1: Is the risk register been communicated to risk owners, the head of mobile money and senior management at least every 12 months?\n"},{"$f":"'4'!K115","v":"1) Risk management process \n-  Check that in the last 12 months the risk register has been communicated to risk owners, the head of mobile money and senior management (including the board risk committee or similar governance entity). "},{"$f":"'4'!L115","v":0},{"$f":"'4'!M115","v":"Standard Required"},{"$f":"'4'!N115","v":"Required"},{"$f":"'4'!O115","v":"FraudRisk"},{"$f":"'4'!P115","v":0},{"$f":"'4'!Q115","v":0},{"$f":"'4'!R115","v":0},{"$f":"'4'!S115","v":0},{"$f":"'4'!T115","v":0},{"$f":"'4'!U115","v":0},{"$f":"'4'!V115","v":0},{"$f":"'4'!W115","v":0},{"$f":"'4'!X115","v":0},{"$f":"'4'!Y115","v":0},{"$f":"'4'!Z115","v":0},{"$f":"'4'!AA115","v":0},{"$f":"'4'!AB115","v":0},{"$f":"'4'!AC115","v":0},{"$f":"'4'!AD115","v":0},{"$f":"'4'!AE115","v":0},{"$f":"'4'!AF115","v":0},{"$f":"'4'!AG115","v":0},{"$f":"'4'!AH115","v":0},{"$f":"'4'!AI115","v":0},{"$f":"'4'!AJ115","v":0},{"$f":"'4'!AK115","v":0},{"$f":"'4'!AL115","v":0},{"$f":"'4'!AM115","v":0},{"$f":"'4'!AN115","v":0},{"$f":"'4'!AO115","v":0},{"$f":"'4'!AP115","v":0},{"$f":"'4'!AQ115","v":0},{"$f":"'4'!AR115","v":0},{"$f":"'4'!AS115","v":0},{"$f":"'4'!AT115","v":0},{"$f":"SUMPRODUCT(IF($N324=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N324=CategoryRecommended,1,0))","v":0},{"$f":"_xlfn.IFNA(MATCH($Q324,ComplianceYes,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q324,CompliancePartial,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q324,ComplianceNo,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q324,ComplianceNA,0),0)","v":0},{"$f":"$AU324*AW324","v":0},{"$f":"$AU324*AX324","v":0},{"$f":"$AU324*AY324","v":0},{"$f":"$AU324*AZ324","v":0},{"$f":"$AV324*AW324","v":0},{"$f":"$AV324*AX324","v":0},{"$f":"$AV324*AY324","v":0},{"$f":"$AV324*AZ324","v":0},{"$f":"_xlfn.IFNA(MATCH($AF324,ComplianceYes,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF324,CompliancePartial,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF324,ComplianceNo,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF324,ComplianceNA,0),0)","v":0},0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B116","v":"4"},{"$f":"'4'!C116","v":"4.6"},{"$f":"'4'!D116","v":"4.6.1"},{"$f":"'4'!E116","v":""},{"$f":"'4'!F116","v":"4.6.1.6"},{"$f":"'4'!G116","v":0},{"$f":"'4'!H116","v":0},{"$f":"'4'!I116","v":"4.6.1.6.2"},{"$f":"'4'!J116","v":"4.6.1.6.2: Are the required actions for implementing further controls monitored by the Risk Manager to ensure that they are implemented by the risk owners?\n"},{"$f":"'4'!K116","v":0},{"$f":"'4'!L116","v":0},{"$f":"'4'!M116","v":"Recommended"},{"$f":"'4'!N116","v":"Recommended"},{"$f":"'4'!O116","v":"FraudRisk"},{"$f":"'4'!P116","v":0},{"$f":"'4'!Q116","v":0},{"$f":"'4'!R116","v":0},{"$f":"'4'!S116","v":0},{"$f":"'4'!T116","v":0},{"$f":"'4'!U116","v":0},{"$f":"'4'!V116","v":0},{"$f":"'4'!W116","v":0},{"$f":"'4'!X116","v":0},{"$f":"'4'!Y116","v":0},{"$f":"'4'!Z116","v":0},{"$f":"'4'!AA116","v":0},{"$f":"'4'!AB116","v":0},{"$f":"'4'!AC116","v":0},{"$f":"'4'!AD116","v":0},{"$f":"'4'!AE116","v":0},{"$f":"'4'!AF116","v":0},{"$f":"'4'!AG116","v":0},{"$f":"'4'!AH116","v":0},{"$f":"'4'!AI116","v":0},{"$f":"'4'!AJ116","v":0},{"$f":"'4'!AK116","v":0},{"$f":"'4'!AL116","v":0},{"$f":"'4'!AM116","v":0},{"$f":"'4'!AN116","v":0},{"$f":"'4'!AO116","v":0},{"$f":"'4'!AP116","v":0},{"$f":"'4'!AQ116","v":0},{"$f":"'4'!AR116","v":0},{"$f":"'4'!AS116","v":0},{"$f":"'4'!AT116","v":0},{"$f":"SUMPRODUCT(IF($N325=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N325=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,{"$f":"$AU325*BI325","v":0},{"$f":"$AU325*BJ325","v":0},{"$f":"$AU325*BK325","v":0},{"$f":"$AU325*BL325","v":0},{"$f":"$AV325*BI325","v":0},{"$f":"$AV325*BJ325","v":0},{"$f":"$AV325*BK325","v":0},{"$f":"$AV325*BL325","v":0}]
[null,{"$f":"'4'!B117","v":"4"},{"$f":"'4'!C117","v":"4.6"},{"$f":"'4'!D117","v":"4.6.1"},{"$f":"'4'!E117","v":0},{"$f":"'4'!F117","v":"4.6.1.6"},{"$f":"'4'!G117","v":0},{"$f":"'4'!H117","v":0},{"$f":"'4'!I117","v":"4.6.1.6.3"},{"$f":"'4'!J117","v":"4.6.1.6.3: Has regular reporting been implemented to track Key Risk Indicators (KRIs), showing risks that may be about to materialize or which have started to materialize?\n"},{"$f":"'4'!K117","v":0},{"$f":"'4'!L117","v":0},{"$f":"'4'!M117","v":"Recommended"},{"$f":"'4'!N117","v":"Recommended"},{"$f":"'4'!O117","v":"FraudRisk"},{"$f":"'4'!P117","v":0},{"$f":"'4'!Q117","v":0},{"$f":"'4'!R117","v":0},{"$f":"'4'!S117","v":0},{"$f":"'4'!T117","v":0},{"$f":"'4'!U117","v":0},{"$f":"'4'!V117","v":0},{"$f":"'4'!W117","v":0},{"$f":"'4'!X117","v":0},{"$f":"'4'!Y117","v":0},{"$f":"'4'!Z117","v":0},{"$f":"'4'!AA117","v":0},{"$f":"'4'!AB117","v":0},{"$f":"'4'!AC117","v":0},{"$f":"'4'!AD117","v":0},{"$f":"'4'!AE117","v":0},{"$f":"'4'!AF117","v":0},{"$f":"'4'!AG117","v":0},{"$f":"'4'!AH117","v":0},{"$f":"'4'!AI117","v":0},{"$f":"'4'!AJ117","v":0},{"$f":"'4'!AK117","v":0},{"$f":"'4'!AL117","v":0},{"$f":"'4'!AM117","v":0},{"$f":"'4'!AN117","v":0},{"$f":"'4'!AO117","v":0},{"$f":"'4'!AP117","v":0},{"$f":"'4'!AQ117","v":0},{"$f":"'4'!AR117","v":0},{"$f":"'4'!AS117","v":0},{"$f":"'4'!AT117","v":0},{"$f":"SUMPRODUCT(IF($N326=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N326=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B119","v":"4"},{"$f":"'4'!C119","v":"4.7"},{"$f":"'4'!D119","v":"4.7.1"},{"$f":"'4'!E119","v":"4.7.1: Providers shall develop effective business continuity and contingency plans"},{"$f":"'4'!F119","v":"4.7.1.1"},{"$f":"'4'!G119","v":"4.7.1.1: BUSINESS CONTINUITY FRAMEWORK\nProviders should define their approach to maintaining continuity of mobile money business functions in the event of major disruptions (such as fire, flood or earthquake). The framework should define the process, roles and responsibilities for managing the Business Continuity Plan (see 4.7.1.3).  This could be documented as part of a mobile operator-wide framework.\n\nBusiness continuity should address all critical mobile money business functions. Special consideration should be given to disaster recovery for the mobile money technical system - see 4.7.1.4.\n\nSomeone with sufficient seniority should be appointed as the single point of contact for business continuity planning, with responsibility for ensuring that all functions set up appropriate business continuity plans and that the plans are co-ordinated. \n\nThe policy should be communicated and made available to senior management, the head of mobile money and all managers. It should be reviewed and updated at least every two years.\n"},{"$f":"'4'!H119","v":"ISO 22313:2020 Sec. 5.2 & 5.3"},{"$f":"'4'!I119","v":"4.7.1.1.1"},{"$f":"'4'!J119","v":"4.7.1.1.1: Is there a business continuity framework that defines the approach to maintaining continuity of mobile money business functions in the event of major disruptions?\n"},{"$f":"'4'!K119","v":"1) Business Continuity Framework or Process\n-  Check the documentation defines the approach to maintaining continuity of mobile money business operations in the event of disruption\n- Check that the policy/process  has been signed by a current member of senior management in the last 2 years.  "},{"$f":"'4'!L119","v":0},{"$f":"'4'!M119","v":"Urgent Required"},{"$f":"'4'!N119","v":"Required"},{"$f":"'4'!O119","v":"BizOps"},{"$f":"'4'!P119","v":0},{"$f":"'4'!Q119","v":0},{"$f":"'4'!R119","v":0},{"$f":"'4'!S119","v":0},{"$f":"'4'!T119","v":0},{"$f":"'4'!U119","v":0},{"$f":"'4'!V119","v":0},{"$f":"'4'!W119","v":0},{"$f":"'4'!X119","v":0},{"$f":"'4'!Y119","v":0},{"$f":"'4'!Z119","v":0},{"$f":"'4'!AA119","v":0},{"$f":"'4'!AB119","v":0},{"$f":"'4'!AC119","v":0},{"$f":"'4'!AD119","v":0},{"$f":"'4'!AE119","v":0},{"$f":"'4'!AF119","v":0},{"$f":"'4'!AG119","v":0},{"$f":"'4'!AH119","v":0},{"$f":"'4'!AI119","v":0},{"$f":"'4'!AJ119","v":0},{"$f":"'4'!AK119","v":0},{"$f":"'4'!AL119","v":0},{"$f":"'4'!AM119","v":0},{"$f":"'4'!AN119","v":0},{"$f":"'4'!AO119","v":0},{"$f":"'4'!AP119","v":0},{"$f":"'4'!AQ119","v":0},{"$f":"'4'!AR119","v":0},{"$f":"'4'!AS119","v":0},{"$f":"'4'!AT119","v":0},{"$f":"SUMPRODUCT(IF($N327=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N327=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B120","v":"4"},{"$f":"'4'!C120","v":"4.7"},{"$f":"'4'!D120","v":"4.7.1"},{"$f":"'4'!E120","v":""},{"$f":"'4'!F120","v":"4.7.1.1"},{"$f":"'4'!G120","v":0},{"$f":"'4'!H120","v":0},{"$f":"'4'!I120","v":"4.7.1.1.2"},{"$f":"'4'!J120","v":"4.7.1.1.2: Does someone with sufficient seniority have overall responsibility and accountability for the business continuity of the mobile money service?\n"},{"$f":"'4'!K120","v":"1) Business Continuity Process\n-  Check a senior member of management has been allocated direct responsibility for business continuity of the mobile money service"},{"$f":"'4'!L120","v":0},{"$f":"'4'!M120","v":"Standard Required"},{"$f":"'4'!N120","v":"Required"},{"$f":"'4'!O120","v":"BizOps"},{"$f":"'4'!P120","v":0},{"$f":"'4'!Q120","v":0},{"$f":"'4'!R120","v":0},{"$f":"'4'!S120","v":0},{"$f":"'4'!T120","v":0},{"$f":"'4'!U120","v":0},{"$f":"'4'!V120","v":0},{"$f":"'4'!W120","v":0},{"$f":"'4'!X120","v":0},{"$f":"'4'!Y120","v":0},{"$f":"'4'!Z120","v":0},{"$f":"'4'!AA120","v":0},{"$f":"'4'!AB120","v":0},{"$f":"'4'!AC120","v":0},{"$f":"'4'!AD120","v":0},{"$f":"'4'!AE120","v":0},{"$f":"'4'!AF120","v":0},{"$f":"'4'!AG120","v":0},{"$f":"'4'!AH120","v":0},{"$f":"'4'!AI120","v":0},{"$f":"'4'!AJ120","v":0},{"$f":"'4'!AK120","v":0},{"$f":"'4'!AL120","v":0},{"$f":"'4'!AM120","v":0},{"$f":"'4'!AN120","v":0},{"$f":"'4'!AO120","v":0},{"$f":"'4'!AP120","v":0},{"$f":"'4'!AQ120","v":0},{"$f":"'4'!AR120","v":0},{"$f":"'4'!AS120","v":0},{"$f":"'4'!AT120","v":0},{"$f":"SUMPRODUCT(IF($N328=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N328=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B121","v":"4"},{"$f":"'4'!C121","v":"4.7"},{"$f":"'4'!D121","v":"4.7.1"},{"$f":"'4'!E121","v":""},{"$f":"'4'!F121","v":"4.7.1.1"},{"$f":"'4'!G121","v":0},{"$f":"'4'!H121","v":0},{"$f":"'4'!I121","v":"4.7.1.1.3"},{"$f":"'4'!J121","v":"4.7.1.1.3: Are roles and responsibilities defined for design and management of Business Continuity?\n"},{"$f":"'4'!K121","v":0},{"$f":"'4'!L121","v":0},{"$f":"'4'!M121","v":"Recommended"},{"$f":"'4'!N121","v":"Recommended"},{"$f":"'4'!O121","v":"BizOps"},{"$f":"'4'!P121","v":0},{"$f":"'4'!Q121","v":0},{"$f":"'4'!R121","v":0},{"$f":"'4'!S121","v":0},{"$f":"'4'!T121","v":0},{"$f":"'4'!U121","v":0},{"$f":"'4'!V121","v":0},{"$f":"'4'!W121","v":0},{"$f":"'4'!X121","v":0},{"$f":"'4'!Y121","v":0},{"$f":"'4'!Z121","v":0},{"$f":"'4'!AA121","v":0},{"$f":"'4'!AB121","v":0},{"$f":"'4'!AC121","v":0},{"$f":"'4'!AD121","v":0},{"$f":"'4'!AE121","v":0},{"$f":"'4'!AF121","v":0},{"$f":"'4'!AG121","v":0},{"$f":"'4'!AH121","v":0},{"$f":"'4'!AI121","v":0},{"$f":"'4'!AJ121","v":0},{"$f":"'4'!AK121","v":0},{"$f":"'4'!AL121","v":0},{"$f":"'4'!AM121","v":0},{"$f":"'4'!AN121","v":0},{"$f":"'4'!AO121","v":0},{"$f":"'4'!AP121","v":0},{"$f":"'4'!AQ121","v":0},{"$f":"'4'!AR121","v":0},{"$f":"'4'!AS121","v":0},{"$f":"'4'!AT121","v":0},{"$f":"SUMPRODUCT(IF($N329=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N329=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B122","v":"4"},{"$f":"'4'!C122","v":"4.7"},{"$f":"'4'!D122","v":"4.7.1"},{"$f":"'4'!E122","v":""},{"$f":"'4'!F122","v":"4.7.1.1"},{"$f":"'4'!G122","v":0},{"$f":"'4'!H122","v":0},{"$f":"'4'!I122","v":"4.7.1.1.4"},{"$f":"'4'!J122","v":"4.7.1.1.4: Is the business continuity framework communicated and made available to senior management, the head of mobile money and all managers?\n"},{"$f":"'4'!K122","v":0},{"$f":"'4'!L122","v":0},{"$f":"'4'!M122","v":"Recommended"},{"$f":"'4'!N122","v":"Recommended"},{"$f":"'4'!O122","v":"BizOps"},{"$f":"'4'!P122","v":0},{"$f":"'4'!Q122","v":0},{"$f":"'4'!R122","v":0},{"$f":"'4'!S122","v":0},{"$f":"'4'!T122","v":0},{"$f":"'4'!U122","v":0},{"$f":"'4'!V122","v":0},{"$f":"'4'!W122","v":0},{"$f":"'4'!X122","v":0},{"$f":"'4'!Y122","v":0},{"$f":"'4'!Z122","v":0},{"$f":"'4'!AA122","v":0},{"$f":"'4'!AB122","v":0},{"$f":"'4'!AC122","v":0},{"$f":"'4'!AD122","v":0},{"$f":"'4'!AE122","v":0},{"$f":"'4'!AF122","v":0},{"$f":"'4'!AG122","v":0},{"$f":"'4'!AH122","v":0},{"$f":"'4'!AI122","v":0},{"$f":"'4'!AJ122","v":0},{"$f":"'4'!AK122","v":0},{"$f":"'4'!AL122","v":0},{"$f":"'4'!AM122","v":0},{"$f":"'4'!AN122","v":0},{"$f":"'4'!AO122","v":0},{"$f":"'4'!AP122","v":0},{"$f":"'4'!AQ122","v":0},{"$f":"'4'!AR122","v":0},{"$f":"'4'!AS122","v":0},{"$f":"'4'!AT122","v":0},{"$f":"SUMPRODUCT(IF($N330=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N330=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B123","v":"4"},{"$f":"'4'!C123","v":"4.7"},{"$f":"'4'!D123","v":"4.7.1"},{"$f":"'4'!E123","v":""},{"$f":"'4'!F123","v":"4.7.1.2"},{"$f":"'4'!G123","v":"4.7.1.2: BUSINESS CONTINUITY RISK ASSESSMENT\nProviders should carry out a business continuity risk assessment as an input into the Business Continuity Plan. \n\nThe risk assessment should include:\n1. Business Impact Analysis (BIA)\n2. Threat evaluation.\n\nThe BIA determines the key business activities that should be maintained in the event of a major disruption. The BIA:\n- identifies key mobile money business activities;\n- sets a recovery objective for each activity (a minimum timeframe for recovery); and\n- identifies dependencies and 3rd party resources for these activities.\n\nThe threat evaluation identifies risks of disruption, such as fire, flood, power failure, staff loss or disruptive incidents. Each threat should be evaluated in terms of its potential impact on business activities in the BIA. This is normally documented in the Business Continuity Plan (see 4.7.1.3)."},{"$f":"'4'!H123","v":"ISO 22313:2020 Sec. 8.2.2 & 8.2.3"},{"$f":"'4'!I123","v":"4.7.1.2.1"},{"$f":"'4'!J123","v":"4.7.1.2.1: Has a business continuity risk assessment been carried out?\n"},{"$f":"'4'!K123","v":"1) Business Continuity Risk Assessment or Impact Analysis (or similar document)\n- Check that the BIA has been updated in the last year"},{"$f":"'4'!L123","v":0},{"$f":"'4'!M123","v":"Standard Required"},{"$f":"'4'!N123","v":"Required"},{"$f":"'4'!O123","v":"BizOps"},{"$f":"'4'!P123","v":0},{"$f":"'4'!Q123","v":0},{"$f":"'4'!R123","v":0},{"$f":"'4'!S123","v":0},{"$f":"'4'!T123","v":0},{"$f":"'4'!U123","v":0},{"$f":"'4'!V123","v":0},{"$f":"'4'!W123","v":0},{"$f":"'4'!X123","v":0},{"$f":"'4'!Y123","v":0},{"$f":"'4'!Z123","v":0},{"$f":"'4'!AA123","v":0},{"$f":"'4'!AB123","v":0},{"$f":"'4'!AC123","v":0},{"$f":"'4'!AD123","v":0},{"$f":"'4'!AE123","v":0},{"$f":"'4'!AF123","v":0},{"$f":"'4'!AG123","v":0},{"$f":"'4'!AH123","v":0},{"$f":"'4'!AI123","v":0},{"$f":"'4'!AJ123","v":0},{"$f":"'4'!AK123","v":0},{"$f":"'4'!AL123","v":0},{"$f":"'4'!AM123","v":0},{"$f":"'4'!AN123","v":0},{"$f":"'4'!AO123","v":0},{"$f":"'4'!AP123","v":0},{"$f":"'4'!AQ123","v":0},{"$f":"'4'!AR123","v":0},{"$f":"'4'!AS123","v":0},{"$f":"'4'!AT123","v":0},{"$f":"SUMPRODUCT(IF($N331=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N331=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B124","v":"4"},{"$f":"'4'!C124","v":"4.7"},{"$f":"'4'!D124","v":"4.7.1"},{"$f":"'4'!E124","v":""},{"$f":"'4'!F124","v":"4.7.1.2"},{"$f":"'4'!G124","v":0},{"$f":"'4'!H124","v":0},{"$f":"'4'!I124","v":"4.7.1.2.2"},{"$f":"'4'!J124","v":"4.7.1.2.2: Does the risk assessment include a Business Impact Analysis (BIA) that determines the key business activities that should be maintained in the event of a major disruption, and the minimum timeframe for recovery of each activity?\n"},{"$f":"'4'!K124","v":"1) Business Continuity Risk Assessment or Impact Analysis (or similar document)\n- Check the document identifies key business activities that should be maintained in the event of a disruption.\n- Check that the documentation sets the minimum timeframe for recovery of each key business activity."},{"$f":"'4'!L124","v":0},{"$f":"'4'!M124","v":"Standard Required"},{"$f":"'4'!N124","v":"Required"},{"$f":"'4'!O124","v":"BizOps"},{"$f":"'4'!P124","v":0},{"$f":"'4'!Q124","v":0},{"$f":"'4'!R124","v":0},{"$f":"'4'!S124","v":0},{"$f":"'4'!T124","v":0},{"$f":"'4'!U124","v":0},{"$f":"'4'!V124","v":0},{"$f":"'4'!W124","v":0},{"$f":"'4'!X124","v":0},{"$f":"'4'!Y124","v":0},{"$f":"'4'!Z124","v":0},{"$f":"'4'!AA124","v":0},{"$f":"'4'!AB124","v":0},{"$f":"'4'!AC124","v":0},{"$f":"'4'!AD124","v":0},{"$f":"'4'!AE124","v":0},{"$f":"'4'!AF124","v":0},{"$f":"'4'!AG124","v":0},{"$f":"'4'!AH124","v":0},{"$f":"'4'!AI124","v":0},{"$f":"'4'!AJ124","v":0},{"$f":"'4'!AK124","v":0},{"$f":"'4'!AL124","v":0},{"$f":"'4'!AM124","v":0},{"$f":"'4'!AN124","v":0},{"$f":"'4'!AO124","v":0},{"$f":"'4'!AP124","v":0},{"$f":"'4'!AQ124","v":0},{"$f":"'4'!AR124","v":0},{"$f":"'4'!AS124","v":0},{"$f":"'4'!AT124","v":0},{"$f":"SUMPRODUCT(IF($N332=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N332=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B125","v":"4"},{"$f":"'4'!C125","v":"4.7"},{"$f":"'4'!D125","v":"4.7.1"},{"$f":"'4'!E125","v":""},{"$f":"'4'!F125","v":"4.7.1.2"},{"$f":"'4'!G125","v":0},{"$f":"'4'!H125","v":0},{"$f":"'4'!I125","v":"4.7.1.2.3"},{"$f":"'4'!J125","v":"4.7.1.2.3: Does the risk assessment include a threat evaluation to identify risks of disruption (such as fire, flood, power failure, staff loss or disruptive incidents), with each threat evaluated in terms of its potential impact on business activities?\n"},{"$f":"'4'!K125","v":"1) Business Continuity Risk Assessment or Impact Analysis (or similar document)\n- Check the documenation includes a threat evaluation to identify risks of disruption (such as fire, flood, power failure, staff loss or disruptive incidents).\n- Check  each threat has been evaluated in terms of its potential impact on each key mobile money business activity."},{"$f":"'4'!L125","v":0},{"$f":"'4'!M125","v":"Standard Required"},{"$f":"'4'!N125","v":"Required"},{"$f":"'4'!O125","v":"BizOps"},{"$f":"'4'!P125","v":0},{"$f":"'4'!Q125","v":0},{"$f":"'4'!R125","v":0},{"$f":"'4'!S125","v":0},{"$f":"'4'!T125","v":0},{"$f":"'4'!U125","v":0},{"$f":"'4'!V125","v":0},{"$f":"'4'!W125","v":0},{"$f":"'4'!X125","v":0},{"$f":"'4'!Y125","v":0},{"$f":"'4'!Z125","v":0},{"$f":"'4'!AA125","v":0},{"$f":"'4'!AB125","v":0},{"$f":"'4'!AC125","v":0},{"$f":"'4'!AD125","v":0},{"$f":"'4'!AE125","v":0},{"$f":"'4'!AF125","v":0},{"$f":"'4'!AG125","v":0},{"$f":"'4'!AH125","v":0},{"$f":"'4'!AI125","v":0},{"$f":"'4'!AJ125","v":0},{"$f":"'4'!AK125","v":0},{"$f":"'4'!AL125","v":0},{"$f":"'4'!AM125","v":0},{"$f":"'4'!AN125","v":0},{"$f":"'4'!AO125","v":0},{"$f":"'4'!AP125","v":0},{"$f":"'4'!AQ125","v":0},{"$f":"'4'!AR125","v":0},{"$f":"'4'!AS125","v":0},{"$f":"'4'!AT125","v":0},{"$f":"SUMPRODUCT(IF($N333=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N333=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B126","v":"4"},{"$f":"'4'!C126","v":"4.7"},{"$f":"'4'!D126","v":"4.7.1"},{"$f":"'4'!E126","v":""},{"$f":"'4'!F126","v":"4.7.1.2"},{"$f":"'4'!G126","v":0},{"$f":"'4'!H126","v":0},{"$f":"'4'!I126","v":"4.7.1.2.4"},{"$f":"'4'!J126","v":"4.7.1.2.4: Does the BIA identify dependencies and 3rd party resources for each key business activity?\n"},{"$f":"'4'!K126","v":0},{"$f":"'4'!L126","v":0},{"$f":"'4'!M126","v":"Recommended"},{"$f":"'4'!N126","v":"Recommended"},{"$f":"'4'!O126","v":"BizOps"},{"$f":"'4'!P126","v":0},{"$f":"'4'!Q126","v":0},{"$f":"'4'!R126","v":0},{"$f":"'4'!S126","v":0},{"$f":"'4'!T126","v":0},{"$f":"'4'!U126","v":0},{"$f":"'4'!V126","v":0},{"$f":"'4'!W126","v":0},{"$f":"'4'!X126","v":0},{"$f":"'4'!Y126","v":0},{"$f":"'4'!Z126","v":0},{"$f":"'4'!AA126","v":0},{"$f":"'4'!AB126","v":0},{"$f":"'4'!AC126","v":0},{"$f":"'4'!AD126","v":0},{"$f":"'4'!AE126","v":0},{"$f":"'4'!AF126","v":0},{"$f":"'4'!AG126","v":0},{"$f":"'4'!AH126","v":0},{"$f":"'4'!AI126","v":0},{"$f":"'4'!AJ126","v":0},{"$f":"'4'!AK126","v":0},{"$f":"'4'!AL126","v":0},{"$f":"'4'!AM126","v":0},{"$f":"'4'!AN126","v":0},{"$f":"'4'!AO126","v":0},{"$f":"'4'!AP126","v":0},{"$f":"'4'!AQ126","v":0},{"$f":"'4'!AR126","v":0},{"$f":"'4'!AS126","v":0},{"$f":"'4'!AT126","v":0},{"$f":"SUMPRODUCT(IF($N334=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N334=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B127","v":"4"},{"$f":"'4'!C127","v":"4.7"},{"$f":"'4'!D127","v":"4.7.1"},{"$f":"'4'!E127","v":""},{"$f":"'4'!F127","v":"4.7.1.3"},{"$f":"'4'!G127","v":"4.7.1.3: BUSINESS CONTINUITY PLAN\nA Business Continuity Plan (BCP) should be documented that defines the responses in the event of a disruptive incident. It should be implemented by all affected business functions, including agents and 3rd parties where relevant. The BCP should be updated regularly and following significant changes to the mobile money business. \n\nThe BCP should identify how each key mobile money activity will be resumed within its recovery objective, considering each threat identified in the business continuity risk assessment. It should also cover potential disruption of outsourced services.\n\nThe BCP should create:\n- an incident response management structure, including resources responsible for responding to the major incident;\n- the procedures for returning to 'business as usual'; and\n- a communications plan to be actioned during a disruptive event.\n\nThe BCP should be:\n- specific – with regard to the immediate steps that should be taken by staff, agents and 3rd parties if an identified threat materialises;\n- flexible – to respond to unanticipated threat scenarios and changing conditions; and\n- focused on the key business activities to be resumed.\n\nThe BCP should consider a range of response options and assign the appropriate response to each activity/risk. Response options include:\n- Activity relocation: re-establish operations at an alternate location;\n- Resource reallocation: resources, including staff, may be transferred from another activity or from a third party; or\n- Alternate processes: using workaround processes temporarily.\n"},{"$f":"'4'!H127","v":"ISO 22313:2020 Sec. 8.3 & 8.4"},{"$f":"'4'!I127","v":"4.7.1.3.1"},{"$f":"'4'!J127","v":"4.7.1.3.1: Has a Business Continuity Plan (BCP) been documented and updated everey two years and following significant changes to the mobile money business?\n"},{"$f":"'4'!K127","v":"1) Business Continuity Plan (BCP) \n- Check that the business continuity plan is documented \n- Check that the BCP has been updated in the last 24 months\n- Check the BCP has been reviewed and updated following significant changes to the mobile money business. If there have been no major changes, refer to the BCP process / framework."},{"$f":"'4'!L127","v":0},{"$f":"'4'!M127","v":"Urgent Required"},{"$f":"'4'!N127","v":"Required"},{"$f":"'4'!O127","v":"BizOps"},{"$f":"'4'!P127","v":0},{"$f":"'4'!Q127","v":0},{"$f":"'4'!R127","v":0},{"$f":"'4'!S127","v":0},{"$f":"'4'!T127","v":0},{"$f":"'4'!U127","v":0},{"$f":"'4'!V127","v":0},{"$f":"'4'!W127","v":0},{"$f":"'4'!X127","v":0},{"$f":"'4'!Y127","v":0},{"$f":"'4'!Z127","v":0},{"$f":"'4'!AA127","v":0},{"$f":"'4'!AB127","v":0},{"$f":"'4'!AC127","v":0},{"$f":"'4'!AD127","v":0},{"$f":"'4'!AE127","v":0},{"$f":"'4'!AF127","v":0},{"$f":"'4'!AG127","v":0},{"$f":"'4'!AH127","v":0},{"$f":"'4'!AI127","v":0},{"$f":"'4'!AJ127","v":0},{"$f":"'4'!AK127","v":0},{"$f":"'4'!AL127","v":0},{"$f":"'4'!AM127","v":0},{"$f":"'4'!AN127","v":0},{"$f":"'4'!AO127","v":0},{"$f":"'4'!AP127","v":0},{"$f":"'4'!AQ127","v":0},{"$f":"'4'!AR127","v":0},{"$f":"'4'!AS127","v":0},{"$f":"'4'!AT127","v":0},{"$f":"SUMPRODUCT(IF($N335=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N335=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B128","v":"4"},{"$f":"'4'!C128","v":"4.7"},{"$f":"'4'!D128","v":"4.7.1"},{"$f":"'4'!E128","v":""},{"$f":"'4'!F128","v":"4.7.1.3"},{"$f":"'4'!G128","v":0},{"$f":"'4'!H128","v":0},{"$f":"'4'!I128","v":"4.7.1.3.2"},{"$f":"'4'!J128","v":"4.7.1.3.2: Has the BCP been implemented by all affected business functions and 3rd parties?\n"},{"$f":"'4'!K128","v":"1) Business Continuity Plan (BCP) \n- Check the acceptance of the BCP by all business functions and key 3rd parties identified in the BCP. Acceptance should be indicated by signature of the BCP.\n"},{"$f":"'4'!L128","v":0},{"$f":"'4'!M128","v":"Standard Required"},{"$f":"'4'!N128","v":"Required"},{"$f":"'4'!O128","v":"BizOps"},{"$f":"'4'!P128","v":0},{"$f":"'4'!Q128","v":0},{"$f":"'4'!R128","v":0},{"$f":"'4'!S128","v":0},{"$f":"'4'!T128","v":0},{"$f":"'4'!U128","v":0},{"$f":"'4'!V128","v":0},{"$f":"'4'!W128","v":0},{"$f":"'4'!X128","v":0},{"$f":"'4'!Y128","v":0},{"$f":"'4'!Z128","v":0},{"$f":"'4'!AA128","v":0},{"$f":"'4'!AB128","v":0},{"$f":"'4'!AC128","v":0},{"$f":"'4'!AD128","v":0},{"$f":"'4'!AE128","v":0},{"$f":"'4'!AF128","v":0},{"$f":"'4'!AG128","v":0},{"$f":"'4'!AH128","v":0},{"$f":"'4'!AI128","v":0},{"$f":"'4'!AJ128","v":0},{"$f":"'4'!AK128","v":0},{"$f":"'4'!AL128","v":0},{"$f":"'4'!AM128","v":0},{"$f":"'4'!AN128","v":0},{"$f":"'4'!AO128","v":0},{"$f":"'4'!AP128","v":0},{"$f":"'4'!AQ128","v":0},{"$f":"'4'!AR128","v":0},{"$f":"'4'!AS128","v":0},{"$f":"'4'!AT128","v":0},{"$f":"SUMPRODUCT(IF($N336=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N336=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B129","v":"4"},{"$f":"'4'!C129","v":"4.7"},{"$f":"'4'!D129","v":"4.7.1"},{"$f":"'4'!E129","v":""},{"$f":"'4'!F129","v":"4.7.1.3"},{"$f":"'4'!G129","v":0},{"$f":"'4'!H129","v":0},{"$f":"'4'!I129","v":"4.7.1.3.3"},{"$f":"'4'!J129","v":"4.7.1.3.3: Does the BCP identify how each key mobile money activity will be resumed within its recovery objective, considering each threat identified in the business continuity risk assessment?\n"},{"$f":"'4'!K129","v":"1) Business Continuity Plan (BCP)\n- Check the BCP contains processes for how each key mobile money activity will be resumed within its recovery objective.\n- Check the BCP processes identify responses for each threat identified in the business continuity risk assessment."},{"$f":"'4'!L129","v":0},{"$f":"'4'!M129","v":"Standard Required"},{"$f":"'4'!N129","v":"Required"},{"$f":"'4'!O129","v":"BizOps"},{"$f":"'4'!P129","v":0},{"$f":"'4'!Q129","v":0},{"$f":"'4'!R129","v":0},{"$f":"'4'!S129","v":0},{"$f":"'4'!T129","v":0},{"$f":"'4'!U129","v":0},{"$f":"'4'!V129","v":0},{"$f":"'4'!W129","v":0},{"$f":"'4'!X129","v":0},{"$f":"'4'!Y129","v":0},{"$f":"'4'!Z129","v":0},{"$f":"'4'!AA129","v":0},{"$f":"'4'!AB129","v":0},{"$f":"'4'!AC129","v":0},{"$f":"'4'!AD129","v":0},{"$f":"'4'!AE129","v":0},{"$f":"'4'!AF129","v":0},{"$f":"'4'!AG129","v":0},{"$f":"'4'!AH129","v":0},{"$f":"'4'!AI129","v":0},{"$f":"'4'!AJ129","v":0},{"$f":"'4'!AK129","v":0},{"$f":"'4'!AL129","v":0},{"$f":"'4'!AM129","v":0},{"$f":"'4'!AN129","v":0},{"$f":"'4'!AO129","v":0},{"$f":"'4'!AP129","v":0},{"$f":"'4'!AQ129","v":0},{"$f":"'4'!AR129","v":0},{"$f":"'4'!AS129","v":0},{"$f":"'4'!AT129","v":0},{"$f":"SUMPRODUCT(IF($N337=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N337=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B130","v":"4"},{"$f":"'4'!C130","v":"4.7"},{"$f":"'4'!D130","v":"4.7.1"},{"$f":"'4'!E130","v":""},{"$f":"'4'!F130","v":"4.7.1.3"},{"$f":"'4'!G130","v":0},{"$f":"'4'!H130","v":0},{"$f":"'4'!I130","v":"4.7.1.3.4"},{"$f":"'4'!J130","v":"4.7.1.3.4: Does the BCP define an incident response management structure, including individual roles responsible for responding to the major incident?\n"},{"$f":"'4'!K130","v":"1) Business Continuity Plan (BCP) \n- Check the BCP defines an incident response management structure and individual roles responsible for responding to major incidents."},{"$f":"'4'!L130","v":0},{"$f":"'4'!M130","v":"Standard Required"},{"$f":"'4'!N130","v":"Required"},{"$f":"'4'!O130","v":"BizOps"},{"$f":"'4'!P130","v":0},{"$f":"'4'!Q130","v":0},{"$f":"'4'!R130","v":0},{"$f":"'4'!S130","v":0},{"$f":"'4'!T130","v":0},{"$f":"'4'!U130","v":0},{"$f":"'4'!V130","v":0},{"$f":"'4'!W130","v":0},{"$f":"'4'!X130","v":0},{"$f":"'4'!Y130","v":0},{"$f":"'4'!Z130","v":0},{"$f":"'4'!AA130","v":0},{"$f":"'4'!AB130","v":0},{"$f":"'4'!AC130","v":0},{"$f":"'4'!AD130","v":0},{"$f":"'4'!AE130","v":0},{"$f":"'4'!AF130","v":0},{"$f":"'4'!AG130","v":0},{"$f":"'4'!AH130","v":0},{"$f":"'4'!AI130","v":0},{"$f":"'4'!AJ130","v":0},{"$f":"'4'!AK130","v":0},{"$f":"'4'!AL130","v":0},{"$f":"'4'!AM130","v":0},{"$f":"'4'!AN130","v":0},{"$f":"'4'!AO130","v":0},{"$f":"'4'!AP130","v":0},{"$f":"'4'!AQ130","v":0},{"$f":"'4'!AR130","v":0},{"$f":"'4'!AS130","v":0},{"$f":"'4'!AT130","v":0},{"$f":"SUMPRODUCT(IF($N338=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N338=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B131","v":"4"},{"$f":"'4'!C131","v":"4.7"},{"$f":"'4'!D131","v":"4.7.1"},{"$f":"'4'!E131","v":""},{"$f":"'4'!F131","v":"4.7.1.3"},{"$f":"'4'!G131","v":0},{"$f":"'4'!H131","v":0},{"$f":"'4'!I131","v":"4.7.1.3.5"},{"$f":"'4'!J131","v":"4.7.1.3.5: Does the BCP define contingency plans for each entity providing material outsourced services and have they accepted the BCP?\n"},{"$f":"'4'!K131","v":"1) Business Continuity Plan (BCP) \n- Check the acceptance of the BCP by all business functions and key 3rd parties identified in the BCP. Acceptance should be indicated by signature of the BCP.\n\n"},{"$f":"'4'!L131","v":0},{"$f":"'4'!M131","v":"Recommended"},{"$f":"'4'!N131","v":"Recommended"},{"$f":"'4'!O131","v":"BizOps"},{"$f":"'4'!P131","v":0},{"$f":"'4'!Q131","v":0},{"$f":"'4'!R131","v":0},{"$f":"'4'!S131","v":0},{"$f":"'4'!T131","v":0},{"$f":"'4'!U131","v":0},{"$f":"'4'!V131","v":0},{"$f":"'4'!W131","v":0},{"$f":"'4'!X131","v":0},{"$f":"'4'!Y131","v":0},{"$f":"'4'!Z131","v":0},{"$f":"'4'!AA131","v":0},{"$f":"'4'!AB131","v":0},{"$f":"'4'!AC131","v":0},{"$f":"'4'!AD131","v":0},{"$f":"'4'!AE131","v":0},{"$f":"'4'!AF131","v":0},{"$f":"'4'!AG131","v":0},{"$f":"'4'!AH131","v":0},{"$f":"'4'!AI131","v":0},{"$f":"'4'!AJ131","v":0},{"$f":"'4'!AK131","v":0},{"$f":"'4'!AL131","v":0},{"$f":"'4'!AM131","v":0},{"$f":"'4'!AN131","v":0},{"$f":"'4'!AO131","v":0},{"$f":"'4'!AP131","v":0},{"$f":"'4'!AQ131","v":0},{"$f":"'4'!AR131","v":0},{"$f":"'4'!AS131","v":0},{"$f":"'4'!AT131","v":0},{"$f":"SUMPRODUCT(IF($N339=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N339=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B132","v":"4"},{"$f":"'4'!C132","v":"4.7"},{"$f":"'4'!D132","v":"4.7.1"},{"$f":"'4'!E132","v":""},{"$f":"'4'!F132","v":"4.7.1.3"},{"$f":"'4'!G132","v":0},{"$f":"'4'!H132","v":0},{"$f":"'4'!I132","v":"4.7.1.3.6"},{"$f":"'4'!J132","v":"4.7.1.3.6: Does the BCP contain the immediate steps that should be taken by staff, agents and 3rd parties if an identified threat materialises?\n"},{"$f":"'4'!K132","v":0},{"$f":"'4'!L132","v":0},{"$f":"'4'!M132","v":"Recommended"},{"$f":"'4'!N132","v":"Recommended"},{"$f":"'4'!O132","v":"BizOps"},{"$f":"'4'!P132","v":0},{"$f":"'4'!Q132","v":0},{"$f":"'4'!R132","v":0},{"$f":"'4'!S132","v":0},{"$f":"'4'!T132","v":0},{"$f":"'4'!U132","v":0},{"$f":"'4'!V132","v":0},{"$f":"'4'!W132","v":0},{"$f":"'4'!X132","v":0},{"$f":"'4'!Y132","v":0},{"$f":"'4'!Z132","v":0},{"$f":"'4'!AA132","v":0},{"$f":"'4'!AB132","v":0},{"$f":"'4'!AC132","v":0},{"$f":"'4'!AD132","v":0},{"$f":"'4'!AE132","v":0},{"$f":"'4'!AF132","v":0},{"$f":"'4'!AG132","v":0},{"$f":"'4'!AH132","v":0},{"$f":"'4'!AI132","v":0},{"$f":"'4'!AJ132","v":0},{"$f":"'4'!AK132","v":0},{"$f":"'4'!AL132","v":0},{"$f":"'4'!AM132","v":0},{"$f":"'4'!AN132","v":0},{"$f":"'4'!AO132","v":0},{"$f":"'4'!AP132","v":0},{"$f":"'4'!AQ132","v":0},{"$f":"'4'!AR132","v":0},{"$f":"'4'!AS132","v":0},{"$f":"'4'!AT132","v":0},{"$f":"SUMPRODUCT(IF($N340=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N340=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B133","v":"4"},{"$f":"'4'!C133","v":"4.7"},{"$f":"'4'!D133","v":"4.7.1"},{"$f":"'4'!E133","v":""},{"$f":"'4'!F133","v":"4.7.1.3"},{"$f":"'4'!G133","v":0},{"$f":"'4'!H133","v":0},{"$f":"'4'!I133","v":"4.7.1.3.7"},{"$f":"'4'!J133","v":"4.7.1.3.7: Does the BCP contain the procedures for returning to 'business as usual' following the occurrence of an identified threat?\n"},{"$f":"'4'!K133","v":0},{"$f":"'4'!L133","v":0},{"$f":"'4'!M133","v":"Recommended"},{"$f":"'4'!N133","v":"Recommended"},{"$f":"'4'!O133","v":"BizOps"},{"$f":"'4'!P133","v":0},{"$f":"'4'!Q133","v":0},{"$f":"'4'!R133","v":0},{"$f":"'4'!S133","v":0},{"$f":"'4'!T133","v":0},{"$f":"'4'!U133","v":0},{"$f":"'4'!V133","v":0},{"$f":"'4'!W133","v":0},{"$f":"'4'!X133","v":0},{"$f":"'4'!Y133","v":0},{"$f":"'4'!Z133","v":0},{"$f":"'4'!AA133","v":0},{"$f":"'4'!AB133","v":0},{"$f":"'4'!AC133","v":0},{"$f":"'4'!AD133","v":0},{"$f":"'4'!AE133","v":0},{"$f":"'4'!AF133","v":0},{"$f":"'4'!AG133","v":0},{"$f":"'4'!AH133","v":0},{"$f":"'4'!AI133","v":0},{"$f":"'4'!AJ133","v":0},{"$f":"'4'!AK133","v":0},{"$f":"'4'!AL133","v":0},{"$f":"'4'!AM133","v":0},{"$f":"'4'!AN133","v":0},{"$f":"'4'!AO133","v":0},{"$f":"'4'!AP133","v":0},{"$f":"'4'!AQ133","v":0},{"$f":"'4'!AR133","v":0},{"$f":"'4'!AS133","v":0},{"$f":"'4'!AT133","v":0},{"$f":"SUMPRODUCT(IF($N341=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N341=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B134","v":"4"},{"$f":"'4'!C134","v":"4.7"},{"$f":"'4'!D134","v":"4.7.1"},{"$f":"'4'!E134","v":0},{"$f":"'4'!F134","v":"4.7.1.3"},{"$f":"'4'!G134","v":0},{"$f":"'4'!H134","v":0},{"$f":"'4'!I134","v":"4.7.1.3.8"},{"$f":"'4'!J134","v":"4.7.1.3.8: Does the BCP contain protocols for communicating internally and externally (including to agents) in the event of a major incident?\n"},{"$f":"'4'!K134","v":0},{"$f":"'4'!L134","v":0},{"$f":"'4'!M134","v":"Recommended"},{"$f":"'4'!N134","v":"Recommended"},{"$f":"'4'!O134","v":"BizOps"},{"$f":"'4'!P134","v":0},{"$f":"'4'!Q134","v":0},{"$f":"'4'!R134","v":0},{"$f":"'4'!S134","v":0},{"$f":"'4'!T134","v":0},{"$f":"'4'!U134","v":0},{"$f":"'4'!V134","v":0},{"$f":"'4'!W134","v":0},{"$f":"'4'!X134","v":0},{"$f":"'4'!Y134","v":0},{"$f":"'4'!Z134","v":0},{"$f":"'4'!AA134","v":0},{"$f":"'4'!AB134","v":0},{"$f":"'4'!AC134","v":0},{"$f":"'4'!AD134","v":0},{"$f":"'4'!AE134","v":0},{"$f":"'4'!AF134","v":0},{"$f":"'4'!AG134","v":0},{"$f":"'4'!AH134","v":0},{"$f":"'4'!AI134","v":0},{"$f":"'4'!AJ134","v":0},{"$f":"'4'!AK134","v":0},{"$f":"'4'!AL134","v":0},{"$f":"'4'!AM134","v":0},{"$f":"'4'!AN134","v":0},{"$f":"'4'!AO134","v":0},{"$f":"'4'!AP134","v":0},{"$f":"'4'!AQ134","v":0},{"$f":"'4'!AR134","v":0},{"$f":"'4'!AS134","v":0},{"$f":"'4'!AT134","v":0},{"$f":"SUMPRODUCT(IF($N342=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N342=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B135","v":"4"},{"$f":"'4'!C135","v":"4.7"},{"$f":"'4'!D135","v":"4.7.1"},{"$f":"'4'!E135","v":""},{"$f":"'4'!F135","v":"4.7.1.4"},{"$f":"'4'!G135","v":"4.7.1.4: DISASTER RECOVERY (TECHNICAL SYSTEMS)\nA disaster recovery (DR) plan should be implemented for the mobile money technical system. The DR plan defines how the system will be recovered if one or more of the identified threats in the BCP materialises.\n\nIt is essential that the DR plan minimize the loss of customer transaction data, otherwise customer accounts will be incorrect. This is particularly significant given that the accounts contain money rather than airtime. At minimum, all transaction and account data should be replicated to a database hosted with geographical separation.\n\nRecovery objectives should be set for the mobile money system:\n- Recovery Time Objective (RTO) defines the time it should take to recover the system, usually in a separate DR data centre.\n- Recovery Point Objective (RPO) defines the amount of data loss that can be accepted, expressed as a time - i.e. how out-of-date the accounts can become. This should be minimized and set to zero if possible.\n\nThe DR plan should include:\n- The Recovery Time Objective (RTO) and Recovery Point Objective (RPO)\n- Technical architecture for disaster recovery (e.g. data replication);\n- A plan for recovery of systems following a disaster (for  example, acquisition of hardware, relocation of processing into second datacentre) to achieve both RTO and RPO in case any of the identified threats materializes;\n- Management and staffing arrangements for each identified scenario."},{"$f":"'4'!H135","v":0},{"$f":"'4'!I135","v":"4.7.1.4.1"},{"$f":"'4'!J135","v":"4.7.1.4.1: Has a disaster recovery (DR) plan been implemented for the mobile money technical system that defines how the system will be recovered if one or more of the identified risks materialises?\n"},{"$f":"'4'!K135","v":"1) Disaster Recovery Plan \n- Check the DRP has been documented\n- Check the DRP defines how each technical system will be recovered if any identified risks materialise. \n"},{"$f":"'4'!L135","v":0},{"$f":"'4'!M135","v":"Urgent Required"},{"$f":"'4'!N135","v":"Required"},{"$f":"'4'!O135","v":"TechOps"},{"$f":"'4'!P135","v":0},{"$f":"'4'!Q135","v":0},{"$f":"'4'!R135","v":0},{"$f":"'4'!S135","v":0},{"$f":"'4'!T135","v":0},{"$f":"'4'!U135","v":0},{"$f":"'4'!V135","v":0},{"$f":"'4'!W135","v":0},{"$f":"'4'!X135","v":0},{"$f":"'4'!Y135","v":0},{"$f":"'4'!Z135","v":0},{"$f":"'4'!AA135","v":0},{"$f":"'4'!AB135","v":0},{"$f":"'4'!AC135","v":0},{"$f":"'4'!AD135","v":0},{"$f":"'4'!AE135","v":0},{"$f":"'4'!AF135","v":0},{"$f":"'4'!AG135","v":0},{"$f":"'4'!AH135","v":0},{"$f":"'4'!AI135","v":0},{"$f":"'4'!AJ135","v":0},{"$f":"'4'!AK135","v":0},{"$f":"'4'!AL135","v":0},{"$f":"'4'!AM135","v":0},{"$f":"'4'!AN135","v":0},{"$f":"'4'!AO135","v":0},{"$f":"'4'!AP135","v":0},{"$f":"'4'!AQ135","v":0},{"$f":"'4'!AR135","v":0},{"$f":"'4'!AS135","v":0},{"$f":"'4'!AT135","v":0},{"$f":"SUMPRODUCT(IF($N343=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N343=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B136","v":"4"},{"$f":"'4'!C136","v":"4.7"},{"$f":"'4'!D136","v":"4.7.1"},{"$f":"'4'!E136","v":""},{"$f":"'4'!F136","v":"4.7.1.4"},{"$f":"'4'!G136","v":0},{"$f":"'4'!H136","v":0},{"$f":"'4'!I136","v":"4.7.1.4.2"},{"$f":"'4'!J136","v":"4.7.1.4.2: Is all transaction and account data replicated to a second database hosted with geographcal separation?\n"},{"$f":"'4'!K136","v":"1) Disaster Recovery Plan and/or \n2) System architecture spec.\n- Check there is a process for all transaction and account data to be replicated to a second database with geographic separation"},{"$f":"'4'!L136","v":0},{"$f":"'4'!M136","v":"Urgent Required"},{"$f":"'4'!N136","v":"Required"},{"$f":"'4'!O136","v":"TechOps"},{"$f":"'4'!P136","v":0},{"$f":"'4'!Q136","v":0},{"$f":"'4'!R136","v":0},{"$f":"'4'!S136","v":0},{"$f":"'4'!T136","v":0},{"$f":"'4'!U136","v":0},{"$f":"'4'!V136","v":0},{"$f":"'4'!W136","v":0},{"$f":"'4'!X136","v":0},{"$f":"'4'!Y136","v":0},{"$f":"'4'!Z136","v":0},{"$f":"'4'!AA136","v":0},{"$f":"'4'!AB136","v":0},{"$f":"'4'!AC136","v":0},{"$f":"'4'!AD136","v":0},{"$f":"'4'!AE136","v":0},{"$f":"'4'!AF136","v":0},{"$f":"'4'!AG136","v":0},{"$f":"'4'!AH136","v":0},{"$f":"'4'!AI136","v":0},{"$f":"'4'!AJ136","v":0},{"$f":"'4'!AK136","v":0},{"$f":"'4'!AL136","v":0},{"$f":"'4'!AM136","v":0},{"$f":"'4'!AN136","v":0},{"$f":"'4'!AO136","v":0},{"$f":"'4'!AP136","v":0},{"$f":"'4'!AQ136","v":0},{"$f":"'4'!AR136","v":0},{"$f":"'4'!AS136","v":0},{"$f":"'4'!AT136","v":0},{"$f":"SUMPRODUCT(IF($N344=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N344=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B137","v":"4"},{"$f":"'4'!C137","v":"4.7"},{"$f":"'4'!D137","v":"4.7.1"},{"$f":"'4'!E137","v":""},{"$f":"'4'!F137","v":"4.7.1.4"},{"$f":"'4'!G137","v":0},{"$f":"'4'!H137","v":0},{"$f":"'4'!I137","v":"4.7.1.4.3"},{"$f":"'4'!J137","v":"4.7.1.4.3: Has a Recovery Time Objective (RTO) been set to define the time it should take to recover the system, usually in a separate DR data centre?\n"},{"$f":"'4'!K137","v":"1) Disaster Recovery Plan (DRP) \n- Check that a recovery time objective (RTO) has been set.\n- Check the RTO has been accepted by the head of mobile money and the board risk committee (or similar governance entity)."},{"$f":"'4'!L137","v":0},{"$f":"'4'!M137","v":"Standard Required"},{"$f":"'4'!N137","v":"Required"},{"$f":"'4'!O137","v":"TechOps"},{"$f":"'4'!P137","v":0},{"$f":"'4'!Q137","v":0},{"$f":"'4'!R137","v":0},{"$f":"'4'!S137","v":0},{"$f":"'4'!T137","v":0},{"$f":"'4'!U137","v":0},{"$f":"'4'!V137","v":0},{"$f":"'4'!W137","v":0},{"$f":"'4'!X137","v":0},{"$f":"'4'!Y137","v":0},{"$f":"'4'!Z137","v":0},{"$f":"'4'!AA137","v":0},{"$f":"'4'!AB137","v":0},{"$f":"'4'!AC137","v":0},{"$f":"'4'!AD137","v":0},{"$f":"'4'!AE137","v":0},{"$f":"'4'!AF137","v":0},{"$f":"'4'!AG137","v":0},{"$f":"'4'!AH137","v":0},{"$f":"'4'!AI137","v":0},{"$f":"'4'!AJ137","v":0},{"$f":"'4'!AK137","v":0},{"$f":"'4'!AL137","v":0},{"$f":"'4'!AM137","v":0},{"$f":"'4'!AN137","v":0},{"$f":"'4'!AO137","v":0},{"$f":"'4'!AP137","v":0},{"$f":"'4'!AQ137","v":0},{"$f":"'4'!AR137","v":0},{"$f":"'4'!AS137","v":0},{"$f":"'4'!AT137","v":0},{"$f":"SUMPRODUCT(IF($N345=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N345=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B138","v":"4"},{"$f":"'4'!C138","v":"4.7"},{"$f":"'4'!D138","v":"4.7.1"},{"$f":"'4'!E138","v":""},{"$f":"'4'!F138","v":"4.7.1.4"},{"$f":"'4'!G138","v":0},{"$f":"'4'!H138","v":0},{"$f":"'4'!I138","v":"4.7.1.4.4"},{"$f":"'4'!J138","v":"4.7.1.4.4: Has a Recovery Point Objective (RPO) been set close to zero to define the amount of data loss that can be accepted, expressed as a time (i.e. how out-of-date the accounts can become)?\n"},{"$f":"'4'!K138","v":"1) Disaster Recovery Plan (DRP) \n- Check that a low or zero recovery point objective (RPO) has been set.\n- Check the RPO has been accepted by the head of mobile money and the board risk committee (or similar governance entity)."},{"$f":"'4'!L138","v":0},{"$f":"'4'!M138","v":"Standard Required"},{"$f":"'4'!N138","v":"Required"},{"$f":"'4'!O138","v":"TechOps"},{"$f":"'4'!P138","v":0},{"$f":"'4'!Q138","v":0},{"$f":"'4'!R138","v":0},{"$f":"'4'!S138","v":0},{"$f":"'4'!T138","v":0},{"$f":"'4'!U138","v":0},{"$f":"'4'!V138","v":0},{"$f":"'4'!W138","v":0},{"$f":"'4'!X138","v":0},{"$f":"'4'!Y138","v":0},{"$f":"'4'!Z138","v":0},{"$f":"'4'!AA138","v":0},{"$f":"'4'!AB138","v":0},{"$f":"'4'!AC138","v":0},{"$f":"'4'!AD138","v":0},{"$f":"'4'!AE138","v":0},{"$f":"'4'!AF138","v":0},{"$f":"'4'!AG138","v":0},{"$f":"'4'!AH138","v":0},{"$f":"'4'!AI138","v":0},{"$f":"'4'!AJ138","v":0},{"$f":"'4'!AK138","v":0},{"$f":"'4'!AL138","v":0},{"$f":"'4'!AM138","v":0},{"$f":"'4'!AN138","v":0},{"$f":"'4'!AO138","v":0},{"$f":"'4'!AP138","v":0},{"$f":"'4'!AQ138","v":0},{"$f":"'4'!AR138","v":0},{"$f":"'4'!AS138","v":0},{"$f":"'4'!AT138","v":0},{"$f":"SUMPRODUCT(IF($N346=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N346=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B139","v":"4"},{"$f":"'4'!C139","v":"4.7"},{"$f":"'4'!D139","v":"4.7.1"},{"$f":"'4'!E139","v":""},{"$f":"'4'!F139","v":"4.7.1.5"},{"$f":"'4'!G139","v":"4.7.1.5: DISASTER RECOVERY TESTING\nDisaster recovery (failover) plans for the mobile money system should be tested every two years at minimum and annually if possible.\n\nDR testing should test the failover scenarios for all identified threats and evaluate whether the recovery time objective (RTO) and recovery point objective (RPO) is met for each identified threat.\n\nDR testing should evaluate internal procedures as well as dependencies on 3rd party suppliers.\n\nRecords of all periodic evaluations and their results should be maintained. DR testing reports should be sent to mobile money technical and business managers."},{"$f":"'4'!H139","v":"ISO 22313:2020 Sec. 8.5, 9.1 & 9.3"},{"$f":"'4'!I139","v":"4.7.1.5.1"},{"$f":"'4'!J139","v":"4.7.1.5.1: Are disaster recovery (failover) plans for the mobile money system tested every two years at minimum?\n"},{"$f":"'4'!K139","v":"1) Disaster Recovery testing plan\n- Check that the disaster recover (failover) plan has been tested in at least the last 2 years for the core mobile money system as well as any other systems identified as mission critical to the mobile money service.  "},{"$f":"'4'!L139","v":0},{"$f":"'4'!M139","v":"Standard Required"},{"$f":"'4'!N139","v":"Required"},{"$f":"'4'!O139","v":"TechOps"},{"$f":"'4'!P139","v":0},{"$f":"'4'!Q139","v":0},{"$f":"'4'!R139","v":0},{"$f":"'4'!S139","v":0},{"$f":"'4'!T139","v":0},{"$f":"'4'!U139","v":0},{"$f":"'4'!V139","v":0},{"$f":"'4'!W139","v":0},{"$f":"'4'!X139","v":0},{"$f":"'4'!Y139","v":0},{"$f":"'4'!Z139","v":0},{"$f":"'4'!AA139","v":0},{"$f":"'4'!AB139","v":0},{"$f":"'4'!AC139","v":0},{"$f":"'4'!AD139","v":0},{"$f":"'4'!AE139","v":0},{"$f":"'4'!AF139","v":0},{"$f":"'4'!AG139","v":0},{"$f":"'4'!AH139","v":0},{"$f":"'4'!AI139","v":0},{"$f":"'4'!AJ139","v":0},{"$f":"'4'!AK139","v":0},{"$f":"'4'!AL139","v":0},{"$f":"'4'!AM139","v":0},{"$f":"'4'!AN139","v":0},{"$f":"'4'!AO139","v":0},{"$f":"'4'!AP139","v":0},{"$f":"'4'!AQ139","v":0},{"$f":"'4'!AR139","v":0},{"$f":"'4'!AS139","v":0},{"$f":"'4'!AT139","v":0},{"$f":"SUMPRODUCT(IF($N347=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N347=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B140","v":"4"},{"$f":"'4'!C140","v":"4.7"},{"$f":"'4'!D140","v":"4.7.1"},{"$f":"'4'!E140","v":""},{"$f":"'4'!F140","v":"4.7.1.5"},{"$f":"'4'!G140","v":0},{"$f":"'4'!H140","v":0},{"$f":"'4'!I140","v":"4.7.1.5.2"},{"$f":"'4'!J140","v":"4.7.1.5.2: Does DR testing evaluate whether the recovery time objective (RTO) and recovery point objective (RPO) is met for each identified risk?\n"},{"$f":"'4'!K140","v":"1) Disaster Recovery testing plan\n-  Check that the targeted recovery time objective (RTO) and the recovery point objective (RPO) where evaluated during the last failover test performed."},{"$f":"'4'!L140","v":0},{"$f":"'4'!M140","v":"Standard Required"},{"$f":"'4'!N140","v":"Required"},{"$f":"'4'!O140","v":"TechOps"},{"$f":"'4'!P140","v":0},{"$f":"'4'!Q140","v":0},{"$f":"'4'!R140","v":0},{"$f":"'4'!S140","v":0},{"$f":"'4'!T140","v":0},{"$f":"'4'!U140","v":0},{"$f":"'4'!V140","v":0},{"$f":"'4'!W140","v":0},{"$f":"'4'!X140","v":0},{"$f":"'4'!Y140","v":0},{"$f":"'4'!Z140","v":0},{"$f":"'4'!AA140","v":0},{"$f":"'4'!AB140","v":0},{"$f":"'4'!AC140","v":0},{"$f":"'4'!AD140","v":0},{"$f":"'4'!AE140","v":0},{"$f":"'4'!AF140","v":0},{"$f":"'4'!AG140","v":0},{"$f":"'4'!AH140","v":0},{"$f":"'4'!AI140","v":0},{"$f":"'4'!AJ140","v":0},{"$f":"'4'!AK140","v":0},{"$f":"'4'!AL140","v":0},{"$f":"'4'!AM140","v":0},{"$f":"'4'!AN140","v":0},{"$f":"'4'!AO140","v":0},{"$f":"'4'!AP140","v":0},{"$f":"'4'!AQ140","v":0},{"$f":"'4'!AR140","v":0},{"$f":"'4'!AS140","v":0},{"$f":"'4'!AT140","v":0},{"$f":"SUMPRODUCT(IF($N348=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N348=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B141","v":"4"},{"$f":"'4'!C141","v":"4.7"},{"$f":"'4'!D141","v":"4.7.1"},{"$f":"'4'!E141","v":""},{"$f":"'4'!F141","v":"4.7.1.5"},{"$f":"'4'!G141","v":0},{"$f":"'4'!H141","v":0},{"$f":"'4'!I141","v":"4.7.1.5.3"},{"$f":"'4'!J141","v":"4.7.1.5.3: Does DR testing evaluate internal continuity procedures as well as dependencies on 3rd party suppliers?\n"},{"$f":"'4'!K141","v":0},{"$f":"'4'!L141","v":0},{"$f":"'4'!M141","v":"Recommended"},{"$f":"'4'!N141","v":"Recommended"},{"$f":"'4'!O141","v":"TechOps"},{"$f":"'4'!P141","v":0},{"$f":"'4'!Q141","v":0},{"$f":"'4'!R141","v":0},{"$f":"'4'!S141","v":0},{"$f":"'4'!T141","v":0},{"$f":"'4'!U141","v":0},{"$f":"'4'!V141","v":0},{"$f":"'4'!W141","v":0},{"$f":"'4'!X141","v":0},{"$f":"'4'!Y141","v":0},{"$f":"'4'!Z141","v":0},{"$f":"'4'!AA141","v":0},{"$f":"'4'!AB141","v":0},{"$f":"'4'!AC141","v":0},{"$f":"'4'!AD141","v":0},{"$f":"'4'!AE141","v":0},{"$f":"'4'!AF141","v":0},{"$f":"'4'!AG141","v":0},{"$f":"'4'!AH141","v":0},{"$f":"'4'!AI141","v":0},{"$f":"'4'!AJ141","v":0},{"$f":"'4'!AK141","v":0},{"$f":"'4'!AL141","v":0},{"$f":"'4'!AM141","v":0},{"$f":"'4'!AN141","v":0},{"$f":"'4'!AO141","v":0},{"$f":"'4'!AP141","v":0},{"$f":"'4'!AQ141","v":0},{"$f":"'4'!AR141","v":0},{"$f":"'4'!AS141","v":0},{"$f":"'4'!AT141","v":0},{"$f":"SUMPRODUCT(IF($N349=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N349=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'4'!B142","v":"4"},{"$f":"'4'!C142","v":"4.7"},{"$f":"'4'!D142","v":"4.7.1"},{"$f":"'4'!E142","v":""},{"$f":"'4'!F142","v":"4.7.1.5"},{"$f":"'4'!G142","v":0},{"$f":"'4'!H142","v":0},{"$f":"'4'!I142","v":"4.7.1.5.4"},{"$f":"'4'!J142","v":"4.7.1.5.4: Are DR testing reports sent to mobile money technical and business managers?\n"},{"$f":"'4'!K142","v":0},{"$f":"'4'!L142","v":0},{"$f":"'4'!M142","v":"Recommended"},{"$f":"'4'!N142","v":"Recommended"},{"$f":"'4'!O142","v":"TechOps"},{"$f":"'4'!P142","v":0},{"$f":"'4'!Q142","v":0},{"$f":"'4'!R142","v":0},{"$f":"'4'!S142","v":0},{"$f":"'4'!T142","v":0},{"$f":"'4'!U142","v":0},{"$f":"'4'!V142","v":0},{"$f":"'4'!W142","v":0},{"$f":"'4'!X142","v":0},{"$f":"'4'!Y142","v":0},{"$f":"'4'!Z142","v":0},{"$f":"'4'!AA142","v":0},{"$f":"'4'!AB142","v":0},{"$f":"'4'!AC142","v":0},{"$f":"'4'!AD142","v":0},{"$f":"'4'!AE142","v":0},{"$f":"'4'!AF142","v":0},{"$f":"'4'!AG142","v":0},{"$f":"'4'!AH142","v":0},{"$f":"'4'!AI142","v":0},{"$f":"'4'!AJ142","v":0},{"$f":"'4'!AK142","v":0},{"$f":"'4'!AL142","v":0},{"$f":"'4'!AM142","v":0},{"$f":"'4'!AN142","v":0},{"$f":"'4'!AO142","v":0},{"$f":"'4'!AP142","v":0},{"$f":"'4'!AQ142","v":0},{"$f":"'4'!AR142","v":0},{"$f":"'4'!AS142","v":0},{"$f":"'4'!AT142","v":0},{"$f":"SUMPRODUCT(IF($N350=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N350=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B5","v":"5"},{"$f":"'5'!C5","v":"5.1"},{"$f":"'5'!D5","v":"5.1.1"},{"$f":"'5'!E5","v":"5.1.1: Providers shall develop, implement, and regularly review a formal security policy for mobile money services"},{"$f":"'5'!F5","v":"5.1.1.1"},{"$f":"'5'!G5","v":"5.1.1.1: SECURITY POLICY\nProviders should define an information security policy which should be:\n- properly documented;\n- approved by senior technical management and the head of mobile money;\n- reviewed at least annually and updated when the environment changes.\n\nThe policy should require a security manager with sufficient seniority that has responsibility for implementing the security policy across the mobile money system and its operations. Other key roles and responsibilities for fulfilling the security objectives should also be defined.\n\nThe policy should ensure that all relevant legal and regulatory requirements related to information security are identified and met (e.g. cryptographic controls)."},{"$f":"'5'!H5","v":"ECB RSMP, PCI DSS, ISO 27002:2013 Sec. 5"},{"$f":"'5'!I5","v":"5.1.1.1.1"},{"$f":"'5'!J5","v":"5.1.1.1.1: Is there an information security policy that is properly documented and approved by senior technical management?\n"},{"$f":"'5'!K5","v":"1) Security policy or equivalent compliance framework or audit documentation\n- Check the security policy is properly documented \n- Check the document has been approved by senior technical management "},{"$f":"'5'!L5","v":0},{"$f":"'5'!M5","v":"Urgent Required"},{"$f":"'5'!N5","v":"Required"},{"$f":"'5'!O5","v":"TechOps"},{"$f":"'5'!P5","v":0},{"$f":"'5'!Q5","v":0},{"$f":"'5'!R5","v":0},{"$f":"'5'!S5","v":0},{"$f":"'5'!T5","v":0},{"$f":"'5'!U5","v":0},{"$f":"'5'!V5","v":0},{"$f":"'5'!W5","v":0},{"$f":"'5'!X5","v":0},{"$f":"'5'!Y5","v":0},{"$f":"'5'!Z5","v":0},{"$f":"'5'!AA5","v":0},{"$f":"'5'!AB5","v":0},{"$f":"'5'!AC5","v":0},{"$f":"'5'!AD5","v":0},{"$f":"'5'!AE5","v":0},{"$f":"'5'!AF5","v":0},{"$f":"'5'!AG5","v":0},{"$f":"'5'!AH5","v":0},{"$f":"'5'!AI5","v":0},{"$f":"'5'!AJ5","v":0},{"$f":"'5'!AK5","v":0},{"$f":"'5'!AL5","v":0},{"$f":"'5'!AM5","v":0},{"$f":"'5'!AN5","v":0},{"$f":"'5'!AO5","v":0},{"$f":"'5'!AP5","v":0},{"$f":"'5'!AQ5","v":0},{"$f":"'5'!AR5","v":0},{"$f":"'5'!AS5","v":0},{"$f":"'5'!AT5","v":0},{"$f":"SUMPRODUCT(IF($N351=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N351=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B6","v":"5"},{"$f":"'5'!C6","v":"5.1"},{"$f":"'5'!D6","v":"5.1.1"},{"$f":"'5'!E6","v":0},{"$f":"'5'!F6","v":"5.1.1.1"},{"$f":"'5'!G6","v":0},{"$f":"'5'!H6","v":0},{"$f":"'5'!I6","v":"5.1.1.1.2"},{"$f":"'5'!J6","v":"5.1.1.1.2: Is there someone with sufficient seniority that has responsibility for implementing the security policy across the mobile money system and its operations?\n"},{"$f":"'5'!K6","v":"1) Technical operations organisation chart\n- Check that an officer has responsibility for implementing security policy across the mobile money system and its operations\n- Check that the officer's grade/rank/band is sufficiently senior to carry out their role effectively\n- Check the officer's job description to see that they are charged with the implementation of security polices for mobile system and its operations."},{"$f":"'5'!L6","v":0},{"$f":"'5'!M6","v":"Standard Required"},{"$f":"'5'!N6","v":"Required"},{"$f":"'5'!O6","v":"TechOps"},{"$f":"'5'!P6","v":0},{"$f":"'5'!Q6","v":0},{"$f":"'5'!R6","v":0},{"$f":"'5'!S6","v":0},{"$f":"'5'!T6","v":0},{"$f":"'5'!U6","v":0},{"$f":"'5'!V6","v":0},{"$f":"'5'!W6","v":0},{"$f":"'5'!X6","v":0},{"$f":"'5'!Y6","v":0},{"$f":"'5'!Z6","v":0},{"$f":"'5'!AA6","v":0},{"$f":"'5'!AB6","v":0},{"$f":"'5'!AC6","v":0},{"$f":"'5'!AD6","v":0},{"$f":"'5'!AE6","v":0},{"$f":"'5'!AF6","v":0},{"$f":"'5'!AG6","v":0},{"$f":"'5'!AH6","v":0},{"$f":"'5'!AI6","v":0},{"$f":"'5'!AJ6","v":0},{"$f":"'5'!AK6","v":0},{"$f":"'5'!AL6","v":0},{"$f":"'5'!AM6","v":0},{"$f":"'5'!AN6","v":0},{"$f":"'5'!AO6","v":0},{"$f":"'5'!AP6","v":0},{"$f":"'5'!AQ6","v":0},{"$f":"'5'!AR6","v":0},{"$f":"'5'!AS6","v":0},{"$f":"'5'!AT6","v":0},{"$f":"SUMPRODUCT(IF($N352=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N352=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B7","v":"5"},{"$f":"'5'!C7","v":"5.1"},{"$f":"'5'!D7","v":"5.1.1"},{"$f":"'5'!E7","v":0},{"$f":"'5'!F7","v":"5.1.1.1"},{"$f":"'5'!G7","v":0},{"$f":"'5'!H7","v":0},{"$f":"'5'!I7","v":"5.1.1.1.3"},{"$f":"'5'!J7","v":"5.1.1.1.3: Is the information security policy reviewed at least annually and updated when the environment changes?\n"},{"$f":"'5'!K7","v":0},{"$f":"'5'!L7","v":0},{"$f":"'5'!M7","v":"Recommended"},{"$f":"'5'!N7","v":"Recommended"},{"$f":"'5'!O7","v":"TechOps"},{"$f":"'5'!P7","v":0},{"$f":"'5'!Q7","v":0},{"$f":"'5'!R7","v":0},{"$f":"'5'!S7","v":0},{"$f":"'5'!T7","v":0},{"$f":"'5'!U7","v":0},{"$f":"'5'!V7","v":0},{"$f":"'5'!W7","v":0},{"$f":"'5'!X7","v":0},{"$f":"'5'!Y7","v":0},{"$f":"'5'!Z7","v":0},{"$f":"'5'!AA7","v":0},{"$f":"'5'!AB7","v":0},{"$f":"'5'!AC7","v":0},{"$f":"'5'!AD7","v":0},{"$f":"'5'!AE7","v":0},{"$f":"'5'!AF7","v":0},{"$f":"'5'!AG7","v":0},{"$f":"'5'!AH7","v":0},{"$f":"'5'!AI7","v":0},{"$f":"'5'!AJ7","v":0},{"$f":"'5'!AK7","v":0},{"$f":"'5'!AL7","v":0},{"$f":"'5'!AM7","v":0},{"$f":"'5'!AN7","v":0},{"$f":"'5'!AO7","v":0},{"$f":"'5'!AP7","v":0},{"$f":"'5'!AQ7","v":0},{"$f":"'5'!AR7","v":0},{"$f":"'5'!AS7","v":0},{"$f":"'5'!AT7","v":0},{"$f":"SUMPRODUCT(IF($N353=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N353=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B8","v":"5"},{"$f":"'5'!C8","v":"5.1"},{"$f":"'5'!D8","v":"5.1.1"},{"$f":"'5'!E8","v":""},{"$f":"'5'!F8","v":"5.1.1.2"},{"$f":"'5'!G8","v":"5.1.1.2: SECURITY OBJECTIVES AND APPROACH\nThe information security policy should set the security objectives, including objectives created by:\n- regulations, legislation and contracts;\n- the current and projected information security threat environment;\n- business appetite for risk.\n\nThe policy should set out the approach to managing the security objectives. The approach should provide multiple levels of security risk monitoring and mitigation e.g. Three Lines of Defence (3LoD) or similar model. This typically means:\n - operational security management (5.3 - especially 5.3.5);\n - security risk management (5.3.1);\n - auditing of security (5.1.1.4)."},{"$f":"'5'!H8","v":"ECB RSMP, ISO 27002:2013 Sec. 6.1"},{"$f":"'5'!I8","v":"5.1.1.2.1"},{"$f":"'5'!J8","v":"5.1.1.2.1: Does the security policy specify security objectives that provide for multiple levels of security risk monitoring and mitigation (e.g.3LoD or similar)?\n"},{"$f":"'5'!K8","v":"1) Security policy or equivalent compliance framework or audit documentation\n- Check the security policy specifies security objectives that provide multiple levels of security risk monitoring, for example 3 line of defence etc."},{"$f":"'5'!L8","v":0},{"$f":"'5'!M8","v":"Recommended"},{"$f":"'5'!N8","v":"Recommended"},{"$f":"'5'!O8","v":"TechOps"},{"$f":"'5'!P8","v":0},{"$f":"'5'!Q8","v":0},{"$f":"'5'!R8","v":0},{"$f":"'5'!S8","v":0},{"$f":"'5'!T8","v":0},{"$f":"'5'!U8","v":0},{"$f":"'5'!V8","v":0},{"$f":"'5'!W8","v":0},{"$f":"'5'!X8","v":0},{"$f":"'5'!Y8","v":0},{"$f":"'5'!Z8","v":0},{"$f":"'5'!AA8","v":0},{"$f":"'5'!AB8","v":0},{"$f":"'5'!AC8","v":0},{"$f":"'5'!AD8","v":0},{"$f":"'5'!AE8","v":0},{"$f":"'5'!AF8","v":0},{"$f":"'5'!AG8","v":0},{"$f":"'5'!AH8","v":0},{"$f":"'5'!AI8","v":0},{"$f":"'5'!AJ8","v":0},{"$f":"'5'!AK8","v":0},{"$f":"'5'!AL8","v":0},{"$f":"'5'!AM8","v":0},{"$f":"'5'!AN8","v":0},{"$f":"'5'!AO8","v":0},{"$f":"'5'!AP8","v":0},{"$f":"'5'!AQ8","v":0},{"$f":"'5'!AR8","v":0},{"$f":"'5'!AS8","v":0},{"$f":"'5'!AT8","v":0},{"$f":"SUMPRODUCT(IF($N354=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N354=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B9","v":"5"},{"$f":"'5'!C9","v":"5.1"},{"$f":"'5'!D9","v":"5.1.1"},{"$f":"'5'!E9","v":""},{"$f":"'5'!F9","v":"5.1.1.3"},{"$f":"'5'!G9","v":"5.1.1.3: SECURITY AUDIT\nThe provider's approach to managing information security, and its implementation (i.e. security policy, procedures and controls), should be independently audited at planned intervals, and when significant changes occur. Management should initiate the independent review, which should include:\n- assessing compliance of the security processes with the security policy and standards;\n- identifying required improvements to the security policy and its approach and control objectives.\n\nThe security audit / compliance review could be carried out by an internal audit team, provided it is independent.\n\nIn addition, technical operations managers should regularly review the compliance of their procedures with the security policy."},{"$f":"'5'!H9","v":"ISO 27002:2013 Sec. 18.2 "},{"$f":"'5'!I9","v":"5.1.1.3.1"},{"$f":"'5'!J9","v":"5.1.1.3.1: Are security audits / compliance reviews carried out regularly to assess compliance of the security processes with the mobile money security policy?\n"},{"$f":"'5'!K9","v":"1) Security policy or equivalent compliance framework or audit documentation (Note this could be a  group-level document)\n- Check the policy includes requirements security processes to be audited against policy requirements, its approach and control objectives.\n- Check the policy set out frequency for the audits.\n- Check the most recent security audit report to ensure it is within the timescales set out in the policy (if not, look for evidence of change to ensure future audits will be timely).\n- Check there is a process for reporting and following up actions.\n\n"},{"$f":"'5'!L9","v":0},{"$f":"'5'!M9","v":"Standard Required"},{"$f":"'5'!N9","v":"Required"},{"$f":"'5'!O9","v":"TechOps"},{"$f":"'5'!P9","v":0},{"$f":"'5'!Q9","v":0},{"$f":"'5'!R9","v":0},{"$f":"'5'!S9","v":0},{"$f":"'5'!T9","v":0},{"$f":"'5'!U9","v":0},{"$f":"'5'!V9","v":0},{"$f":"'5'!W9","v":0},{"$f":"'5'!X9","v":0},{"$f":"'5'!Y9","v":0},{"$f":"'5'!Z9","v":0},{"$f":"'5'!AA9","v":0},{"$f":"'5'!AB9","v":0},{"$f":"'5'!AC9","v":0},{"$f":"'5'!AD9","v":0},{"$f":"'5'!AE9","v":0},{"$f":"'5'!AF9","v":0},{"$f":"'5'!AG9","v":0},{"$f":"'5'!AH9","v":0},{"$f":"'5'!AI9","v":0},{"$f":"'5'!AJ9","v":0},{"$f":"'5'!AK9","v":0},{"$f":"'5'!AL9","v":0},{"$f":"'5'!AM9","v":0},{"$f":"'5'!AN9","v":0},{"$f":"'5'!AO9","v":0},{"$f":"'5'!AP9","v":0},{"$f":"'5'!AQ9","v":0},{"$f":"'5'!AR9","v":0},{"$f":"'5'!AS9","v":0},{"$f":"'5'!AT9","v":0},{"$f":"SUMPRODUCT(IF($N355=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N355=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B10","v":"5"},{"$f":"'5'!C10","v":"5.1"},{"$f":"'5'!D10","v":"5.1.2"},{"$f":"'5'!E10","v":"5.1.2: Providers shall train internal staff about their security responsibilities"},{"$f":"'5'!F10","v":"5.1.2.1"},{"$f":"'5'!G10","v":"5.1.2.1: EMPLOYEE SECURITY TRAINING\nAll mobile money staff (including contractors) should receive training in the security policy and procedures before being granted access to the mobile money system.\n\nThe security training programme should be updated regularly to account for changes in procedures and staff should be given regular security training updates. Staff should be briefed on any relevant emerging threats. \n\nThe training should ensure that staff are properly briefed on their security responsibilities including:\n - security of customer data;\n - protection of user IDs and passwords."},{"$f":"'5'!H10","v":"ISO 27002:2013 Sec. 7.2"},{"$f":"'5'!I10","v":"5.1.2.1.1"},{"$f":"'5'!J10","v":"5.1.2.1.1: Do all mobile money staff (including contractors) receive training in security policies and procedures before being granted access to the mobile money system?\n"},{"$f":"'5'!K10","v":"1) Security training plan\n- Check the plan includes a process to deliver relevant job specific training to all staff and contractors prior to them being granted access to the system.\n"},{"$f":"'5'!L10","v":0},{"$f":"'5'!M10","v":"Urgent Required"},{"$f":"'5'!N10","v":"Required"},{"$f":"'5'!O10","v":"TechOps"},{"$f":"'5'!P10","v":0},{"$f":"'5'!Q10","v":0},{"$f":"'5'!R10","v":0},{"$f":"'5'!S10","v":0},{"$f":"'5'!T10","v":0},{"$f":"'5'!U10","v":0},{"$f":"'5'!V10","v":0},{"$f":"'5'!W10","v":0},{"$f":"'5'!X10","v":0},{"$f":"'5'!Y10","v":0},{"$f":"'5'!Z10","v":0},{"$f":"'5'!AA10","v":0},{"$f":"'5'!AB10","v":0},{"$f":"'5'!AC10","v":0},{"$f":"'5'!AD10","v":0},{"$f":"'5'!AE10","v":0},{"$f":"'5'!AF10","v":0},{"$f":"'5'!AG10","v":0},{"$f":"'5'!AH10","v":0},{"$f":"'5'!AI10","v":0},{"$f":"'5'!AJ10","v":0},{"$f":"'5'!AK10","v":0},{"$f":"'5'!AL10","v":0},{"$f":"'5'!AM10","v":0},{"$f":"'5'!AN10","v":0},{"$f":"'5'!AO10","v":0},{"$f":"'5'!AP10","v":0},{"$f":"'5'!AQ10","v":0},{"$f":"'5'!AR10","v":0},{"$f":"'5'!AS10","v":0},{"$f":"'5'!AT10","v":0},{"$f":"SUMPRODUCT(IF($N356=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N356=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B11","v":"5"},{"$f":"'5'!C11","v":"5.1"},{"$f":"'5'!D11","v":"5.1.2"},{"$f":"'5'!E11","v":""},{"$f":"'5'!F11","v":"5.1.2.1"},{"$f":"'5'!G11","v":0},{"$f":"'5'!H11","v":0},{"$f":"'5'!I11","v":"5.1.2.1.2"},{"$f":"'5'!J11","v":"5.1.2.1.2: Does senior management arrange a regular audit of the mobile money service (at least every two years) to evaluate whether the MM governance, internal control and risk management processes are operating effectively.\n"},{"$f":"'5'!K11","v":"1. Header page of last audit, or audit policy/process/plan, or compliance framework\n- Check that an audit of mobile money is performed at least every 2 years by an independent function (e.g. internal audit or compliance team).\n"},{"$f":"'5'!L11","v":0},{"$f":"'5'!M11","v":"Recommended"},{"$f":"'5'!N11","v":"Recommended"},{"$f":"'5'!O11","v":"TechOps"},{"$f":"'5'!P11","v":0},{"$f":"'5'!Q11","v":0},{"$f":"'5'!R11","v":0},{"$f":"'5'!S11","v":0},{"$f":"'5'!T11","v":0},{"$f":"'5'!U11","v":0},{"$f":"'5'!V11","v":0},{"$f":"'5'!W11","v":0},{"$f":"'5'!X11","v":0},{"$f":"'5'!Y11","v":0},{"$f":"'5'!Z11","v":0},{"$f":"'5'!AA11","v":0},{"$f":"'5'!AB11","v":0},{"$f":"'5'!AC11","v":0},{"$f":"'5'!AD11","v":0},{"$f":"'5'!AE11","v":0},{"$f":"'5'!AF11","v":0},{"$f":"'5'!AG11","v":0},{"$f":"'5'!AH11","v":0},{"$f":"'5'!AI11","v":0},{"$f":"'5'!AJ11","v":0},{"$f":"'5'!AK11","v":0},{"$f":"'5'!AL11","v":0},{"$f":"'5'!AM11","v":0},{"$f":"'5'!AN11","v":0},{"$f":"'5'!AO11","v":0},{"$f":"'5'!AP11","v":0},{"$f":"'5'!AQ11","v":0},{"$f":"'5'!AR11","v":0},{"$f":"'5'!AS11","v":0},{"$f":"'5'!AT11","v":0},{"$f":"SUMPRODUCT(IF($N357=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N357=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B12","v":"5"},{"$f":"'5'!C12","v":"5.1"},{"$f":"'5'!D12","v":"5.1.2"},{"$f":"'5'!E12","v":""},{"$f":"'5'!F12","v":"5.1.2.1"},{"$f":"'5'!G12","v":0},{"$f":"'5'!H12","v":0},{"$f":"'5'!I12","v":"5.1.2.1.3"},{"$f":"'5'!J12","v":"5.1.2.1.3: Are issues raised by audits being followed up by senior management to ensure they are addressed promptly?\n"},{"$f":"'5'!K12","v":"1) Records of last audit, or audit policy/process/plan, or compliance framework\n- Check that issues raised by audits are being followed up by senior management to ensure they are addressed promptly\n(Note: Records of the last audit could be redacted to remove sensitive contents but to show that actions are being followed up. Alternatively, the process documentation could be reviewed)"},{"$f":"'5'!L12","v":0},{"$f":"'5'!M12","v":"Recommended"},{"$f":"'5'!N12","v":"Recommended"},{"$f":"'5'!O12","v":"TechOps"},{"$f":"'5'!P12","v":0},{"$f":"'5'!Q12","v":0},{"$f":"'5'!R12","v":0},{"$f":"'5'!S12","v":0},{"$f":"'5'!T12","v":0},{"$f":"'5'!U12","v":0},{"$f":"'5'!V12","v":0},{"$f":"'5'!W12","v":0},{"$f":"'5'!X12","v":0},{"$f":"'5'!Y12","v":0},{"$f":"'5'!Z12","v":0},{"$f":"'5'!AA12","v":0},{"$f":"'5'!AB12","v":0},{"$f":"'5'!AC12","v":0},{"$f":"'5'!AD12","v":0},{"$f":"'5'!AE12","v":0},{"$f":"'5'!AF12","v":0},{"$f":"'5'!AG12","v":0},{"$f":"'5'!AH12","v":0},{"$f":"'5'!AI12","v":0},{"$f":"'5'!AJ12","v":0},{"$f":"'5'!AK12","v":0},{"$f":"'5'!AL12","v":0},{"$f":"'5'!AM12","v":0},{"$f":"'5'!AN12","v":0},{"$f":"'5'!AO12","v":0},{"$f":"'5'!AP12","v":0},{"$f":"'5'!AQ12","v":0},{"$f":"'5'!AR12","v":0},{"$f":"'5'!AS12","v":0},{"$f":"'5'!AT12","v":0},{"$f":"SUMPRODUCT(IF($N358=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N358=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B13","v":"5"},{"$f":"'5'!C13","v":"5.1"},{"$f":"'5'!D13","v":"5.1.2"},{"$f":"'5'!E13","v":""},{"$f":"'5'!F13","v":"5.1.2.2"},{"$f":"'5'!G13","v":"5.1.2.2: SECURITY RESPONSIBILITIES AFTER TERMINATION OF EMPLOYMENT\nProviders should define security responsibilities that will remain valid after termination or change of employment. These should be  communicated to staff (including contractors) and included in their terms and conditions of employment."},{"$f":"'5'!H13","v":"ISO 27002:2013 Sec. 7.3"},{"$f":"'5'!I13","v":"5.1.2.2.1"},{"$f":"'5'!J13","v":"5.1.2.2.1: Are security responsibilities that apply after termination of employment communicated to staff and enforced?\n"},{"$f":"'5'!K13","v":0},{"$f":"'5'!L13","v":0},{"$f":"'5'!M13","v":"Recommended"},{"$f":"'5'!N13","v":"Recommended"},{"$f":"'5'!O13","v":"TechOps"},{"$f":"'5'!P13","v":0},{"$f":"'5'!Q13","v":0},{"$f":"'5'!R13","v":0},{"$f":"'5'!S13","v":0},{"$f":"'5'!T13","v":0},{"$f":"'5'!U13","v":0},{"$f":"'5'!V13","v":0},{"$f":"'5'!W13","v":0},{"$f":"'5'!X13","v":0},{"$f":"'5'!Y13","v":0},{"$f":"'5'!Z13","v":0},{"$f":"'5'!AA13","v":0},{"$f":"'5'!AB13","v":0},{"$f":"'5'!AC13","v":0},{"$f":"'5'!AD13","v":0},{"$f":"'5'!AE13","v":0},{"$f":"'5'!AF13","v":0},{"$f":"'5'!AG13","v":0},{"$f":"'5'!AH13","v":0},{"$f":"'5'!AI13","v":0},{"$f":"'5'!AJ13","v":0},{"$f":"'5'!AK13","v":0},{"$f":"'5'!AL13","v":0},{"$f":"'5'!AM13","v":0},{"$f":"'5'!AN13","v":0},{"$f":"'5'!AO13","v":0},{"$f":"'5'!AP13","v":0},{"$f":"'5'!AQ13","v":0},{"$f":"'5'!AR13","v":0},{"$f":"'5'!AS13","v":0},{"$f":"'5'!AT13","v":0},{"$f":"SUMPRODUCT(IF($N359=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N359=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B14","v":"5"},{"$f":"'5'!C14","v":"5.1"},{"$f":"'5'!D14","v":"5.1.3"},{"$f":"'5'!E14","v":"5.1.3: Providers shall ensure policies are in place for the secure handling of information and assets"},{"$f":"'5'!F14","v":"5.1.3.1"},{"$f":"'5'!G14","v":"5.1.3.1: INVENTORY AND SECURITY CLASSIFICATION OF ALL DATA ASSETS\nProviders should identify all data assets associated with the mobile money system. An inventory of these assets should be maintained and an owner identified for each asset. The owner should be responsible for the customer data that is held by it. \n\nThe data sensitivity should be classified and documented for all mobile money data systems (databases, SANs etc.) and removable media, including laptops, smartphones, tablets, storage media, and paper receipts /reports /forms. Removable assets in particular risk exposure of the data they contain.\nSecurity requirements for each system and removable data asset should be determined according to data sensitivity.\n"},{"$f":"'5'!H14","v":"ISO 27002:2013 Sec. 8.1, Sec 8.3"},{"$f":"'5'!I14","v":"5.1.3.1.1"},{"$f":"'5'!J14","v":"5.1.3.1.1: Is each mobile money data asset identified with an owner who is responsible the customer data that is held by it?\n"},{"$f":"'5'!K14","v":"1) Asset management process\n- Check the policy to ensure there is a process for all assets to be added to the asset register.\n- Check the asset register includes an owner for each and every asset, and any personal data held on it."},{"$f":"'5'!L14","v":0},{"$f":"'5'!M14","v":"Standard Required"},{"$f":"'5'!N14","v":"Required"},{"$f":"'5'!O14","v":"TechOps"},{"$f":"'5'!P14","v":0},{"$f":"'5'!Q14","v":0},{"$f":"'5'!R14","v":0},{"$f":"'5'!S14","v":0},{"$f":"'5'!T14","v":0},{"$f":"'5'!U14","v":0},{"$f":"'5'!V14","v":0},{"$f":"'5'!W14","v":0},{"$f":"'5'!X14","v":0},{"$f":"'5'!Y14","v":0},{"$f":"'5'!Z14","v":0},{"$f":"'5'!AA14","v":0},{"$f":"'5'!AB14","v":0},{"$f":"'5'!AC14","v":0},{"$f":"'5'!AD14","v":0},{"$f":"'5'!AE14","v":0},{"$f":"'5'!AF14","v":0},{"$f":"'5'!AG14","v":0},{"$f":"'5'!AH14","v":0},{"$f":"'5'!AI14","v":0},{"$f":"'5'!AJ14","v":0},{"$f":"'5'!AK14","v":0},{"$f":"'5'!AL14","v":0},{"$f":"'5'!AM14","v":0},{"$f":"'5'!AN14","v":0},{"$f":"'5'!AO14","v":0},{"$f":"'5'!AP14","v":0},{"$f":"'5'!AQ14","v":0},{"$f":"'5'!AR14","v":0},{"$f":"'5'!AS14","v":0},{"$f":"'5'!AT14","v":0},{"$f":"SUMPRODUCT(IF($N360=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N360=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B15","v":"5"},{"$f":"'5'!C15","v":"5.1"},{"$f":"'5'!D15","v":"5.1.3"},{"$f":"'5'!E15","v":0},{"$f":"'5'!F15","v":"5.1.3.1"},{"$f":"'5'!G15","v":0},{"$f":"'5'!H15","v":0},{"$f":"'5'!I15","v":"5.1.3.1.2"},{"$f":"'5'!J15","v":"5.1.3.1.2: Has data sensitivity classification been documented for:\n - Mobile money data systems;\n - Removable media, including laptops, smartphones, tablets, storage media, and paper media (e.g. registration forms and agent log books)?\n"},{"$f":"'5'!K15","v":"1) Asset management process\n- Check that there is a documented process and standards for classifying all data held in mobile money systems and removable media."},{"$f":"'5'!L15","v":0},{"$f":"'5'!M15","v":"Standard Required"},{"$f":"'5'!N15","v":"Required"},{"$f":"'5'!O15","v":"TechOps"},{"$f":"'5'!P15","v":0},{"$f":"'5'!Q15","v":0},{"$f":"'5'!R15","v":0},{"$f":"'5'!S15","v":0},{"$f":"'5'!T15","v":0},{"$f":"'5'!U15","v":0},{"$f":"'5'!V15","v":0},{"$f":"'5'!W15","v":0},{"$f":"'5'!X15","v":0},{"$f":"'5'!Y15","v":0},{"$f":"'5'!Z15","v":0},{"$f":"'5'!AA15","v":0},{"$f":"'5'!AB15","v":0},{"$f":"'5'!AC15","v":0},{"$f":"'5'!AD15","v":0},{"$f":"'5'!AE15","v":0},{"$f":"'5'!AF15","v":0},{"$f":"'5'!AG15","v":0},{"$f":"'5'!AH15","v":0},{"$f":"'5'!AI15","v":0},{"$f":"'5'!AJ15","v":0},{"$f":"'5'!AK15","v":0},{"$f":"'5'!AL15","v":0},{"$f":"'5'!AM15","v":0},{"$f":"'5'!AN15","v":0},{"$f":"'5'!AO15","v":0},{"$f":"'5'!AP15","v":0},{"$f":"'5'!AQ15","v":0},{"$f":"'5'!AR15","v":0},{"$f":"'5'!AS15","v":0},{"$f":"'5'!AT15","v":0},{"$f":"SUMPRODUCT(IF($N361=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N361=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B16","v":"5"},{"$f":"'5'!C16","v":"5.1"},{"$f":"'5'!D16","v":"5.1.3"},{"$f":"'5'!E16","v":0},{"$f":"'5'!F16","v":"5.1.3.1"},{"$f":"'5'!G16","v":0},{"$f":"'5'!H16","v":0},{"$f":"'5'!I16","v":"5.1.3.1.3"},{"$f":"'5'!J16","v":"5.1.3.1.3: Are inventory logs of data systems and removable media maintained and updated at least annually?\n"},{"$f":"'5'!K16","v":0},{"$f":"'5'!L16","v":0},{"$f":"'5'!M16","v":"Recommended"},{"$f":"'5'!N16","v":"Recommended"},{"$f":"'5'!O16","v":"TechOps"},{"$f":"'5'!P16","v":0},{"$f":"'5'!Q16","v":0},{"$f":"'5'!R16","v":0},{"$f":"'5'!S16","v":0},{"$f":"'5'!T16","v":0},{"$f":"'5'!U16","v":0},{"$f":"'5'!V16","v":0},{"$f":"'5'!W16","v":0},{"$f":"'5'!X16","v":0},{"$f":"'5'!Y16","v":0},{"$f":"'5'!Z16","v":0},{"$f":"'5'!AA16","v":0},{"$f":"'5'!AB16","v":0},{"$f":"'5'!AC16","v":0},{"$f":"'5'!AD16","v":0},{"$f":"'5'!AE16","v":0},{"$f":"'5'!AF16","v":0},{"$f":"'5'!AG16","v":0},{"$f":"'5'!AH16","v":0},{"$f":"'5'!AI16","v":0},{"$f":"'5'!AJ16","v":0},{"$f":"'5'!AK16","v":0},{"$f":"'5'!AL16","v":0},{"$f":"'5'!AM16","v":0},{"$f":"'5'!AN16","v":0},{"$f":"'5'!AO16","v":0},{"$f":"'5'!AP16","v":0},{"$f":"'5'!AQ16","v":0},{"$f":"'5'!AR16","v":0},{"$f":"'5'!AS16","v":0},{"$f":"'5'!AT16","v":0},{"$f":"SUMPRODUCT(IF($N362=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N362=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B17","v":"5"},{"$f":"'5'!C17","v":"5.1"},{"$f":"'5'!D17","v":"5.1.3"},{"$f":"'5'!E17","v":""},{"$f":"'5'!F17","v":"5.1.3.2"},{"$f":"'5'!G17","v":"5.1.3.2: SECURE DISPOSAL OF DATA SYSTEMS AND MEDIA\nFormal procedures should be implemented for the secure disposal of data storage systems and media that are no longer needed. This is important to minimize the risk of confidential information leakage. The procedures for secure disposal of data systems and media should be proportionate to the sensitivity of the information stored. The procedured should also apply to paper and other non-electronic media.\n\nProviders should:\n- take steps to verify that customer data has been removed or securely overwritten prior to disposal or re-use of data storage systems or media;\n- render customer and financial data on electronic media unrecoverable so that the data cannot be reconstructed;\n- shred, incinerate, or pulp paper materials (e.g. agent log books) so that customer and financial data cannot be reconstructed; \n\nThis practice should extend to assets accessible by third parties (see 5.1.4)."},{"$f":"'5'!H17","v":"PCI DSS, ISO 27002:2013 Sec. 8.3 "},{"$f":"'5'!I17","v":"5.1.3.2.1"},{"$f":"'5'!J17","v":"5.1.3.2.1: Are there procedures for the secure reuse or disposal of all data storage systems to minimize the risk of confidential information leakage (e.g. by making electronic data unrecoverable?\nAre old paper records (e.g. agent log books) securely destroyed by shredding/incineration?\n"},{"$f":"'5'!K17","v":"1) Asset management process\n- Check there are documented procedures for the secure reuse or disposal of all data storage systems to minimize the risk of confidential information leakage (e.g. by making electronic data unrecoverable)\n- Check that old paper records (e.g. agent log books) are securely destroyed by shredding/incineration.\n"},{"$f":"'5'!L17","v":0},{"$f":"'5'!M17","v":"Standard Required"},{"$f":"'5'!N17","v":"Required"},{"$f":"'5'!O17","v":"TechOps"},{"$f":"'5'!P17","v":0},{"$f":"'5'!Q17","v":0},{"$f":"'5'!R17","v":0},{"$f":"'5'!S17","v":0},{"$f":"'5'!T17","v":0},{"$f":"'5'!U17","v":0},{"$f":"'5'!V17","v":0},{"$f":"'5'!W17","v":0},{"$f":"'5'!X17","v":0},{"$f":"'5'!Y17","v":0},{"$f":"'5'!Z17","v":0},{"$f":"'5'!AA17","v":0},{"$f":"'5'!AB17","v":0},{"$f":"'5'!AC17","v":0},{"$f":"'5'!AD17","v":0},{"$f":"'5'!AE17","v":0},{"$f":"'5'!AF17","v":0},{"$f":"'5'!AG17","v":0},{"$f":"'5'!AH17","v":0},{"$f":"'5'!AI17","v":0},{"$f":"'5'!AJ17","v":0},{"$f":"'5'!AK17","v":0},{"$f":"'5'!AL17","v":0},{"$f":"'5'!AM17","v":0},{"$f":"'5'!AN17","v":0},{"$f":"'5'!AO17","v":0},{"$f":"'5'!AP17","v":0},{"$f":"'5'!AQ17","v":0},{"$f":"'5'!AR17","v":0},{"$f":"'5'!AS17","v":0},{"$f":"'5'!AT17","v":0},{"$f":"SUMPRODUCT(IF($N363=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N363=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B18","v":"5"},{"$f":"'5'!C18","v":"5.1"},{"$f":"'5'!D18","v":"5.1.4"},{"$f":"'5'!E18","v":"5.1.4: Providers shall ensure the protection of their assets that are accessible by suppliers and third parties"},{"$f":"'5'!F18","v":"5.1.4.1"},{"$f":"'5'!G18","v":"5.1.4.1: SECURITY POLICY AND THIRD PARTIES\nThe information security policy should apply to suppliers and third parties and should include:\n- security controls for managing their access; \n- security training as and when needed;\n- processes that these parties have to follow.\nThis should be enforced in third party contracts."},{"$f":"'5'!H18","v":"ISO 27002:2013 Sec. 15.2 "},{"$f":"'5'!I18","v":"5.1.4.1.1"},{"$f":"'5'!J18","v":"5.1.4.1.1: Does the information security policy contractually apply to suppliers and third parties?\n"},{"$f":"'5'!K18","v":"1) Contracts with key third parties (e.g. mobile money system supplier)\n- Check the contracts specify adherence to the provider's security policy and processes.\n"},{"$f":"'5'!L18","v":0},{"$f":"'5'!M18","v":"Urgent Required"},{"$f":"'5'!N18","v":"Required"},{"$f":"'5'!O18","v":"TechOps"},{"$f":"'5'!P18","v":0},{"$f":"'5'!Q18","v":0},{"$f":"'5'!R18","v":0},{"$f":"'5'!S18","v":0},{"$f":"'5'!T18","v":0},{"$f":"'5'!U18","v":0},{"$f":"'5'!V18","v":0},{"$f":"'5'!W18","v":0},{"$f":"'5'!X18","v":0},{"$f":"'5'!Y18","v":0},{"$f":"'5'!Z18","v":0},{"$f":"'5'!AA18","v":0},{"$f":"'5'!AB18","v":0},{"$f":"'5'!AC18","v":0},{"$f":"'5'!AD18","v":0},{"$f":"'5'!AE18","v":0},{"$f":"'5'!AF18","v":0},{"$f":"'5'!AG18","v":0},{"$f":"'5'!AH18","v":0},{"$f":"'5'!AI18","v":0},{"$f":"'5'!AJ18","v":0},{"$f":"'5'!AK18","v":0},{"$f":"'5'!AL18","v":0},{"$f":"'5'!AM18","v":0},{"$f":"'5'!AN18","v":0},{"$f":"'5'!AO18","v":0},{"$f":"'5'!AP18","v":0},{"$f":"'5'!AQ18","v":0},{"$f":"'5'!AR18","v":0},{"$f":"'5'!AS18","v":0},{"$f":"'5'!AT18","v":0},{"$f":"SUMPRODUCT(IF($N364=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N364=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B19","v":"5"},{"$f":"'5'!C19","v":"5.1"},{"$f":"'5'!D19","v":"5.1.4"},{"$f":"'5'!E19","v":0},{"$f":"'5'!F19","v":"5.1.4.2"},{"$f":"'5'!G19","v":"5.1.4.2: SECURITY BRIEFING AND REVIEWS FOR THIRD PARTIES\nThird parties and suppliers should be briefed on the security policy and their security obligations before being granted access to the mobile money system, including:\n - protection of physical and information assets;\n - current security threats; and\n - promotion of the importance of customer data security.\n\nPeriodic reviews should be performed to ensure that the mobile money security policy is being adhered to."},{"$f":"'5'!H19","v":"ISO 27002:2013 Sec. 15.1 "},{"$f":"'5'!I19","v":"5.1.4.2.1"},{"$f":"'5'!J19","v":"5.1.4.2.1: Have suppliers and third parties been briefed on the security policy and their security obligations, and are periodic reviews performed to verify adherence to the security policy?\n"},{"$f":"'5'!K19","v":0},{"$f":"'5'!L19","v":0},{"$f":"'5'!M19","v":"Recommended"},{"$f":"'5'!N19","v":"Recommended"},{"$f":"'5'!O19","v":"TechOps"},{"$f":"'5'!P19","v":0},{"$f":"'5'!Q19","v":0},{"$f":"'5'!R19","v":0},{"$f":"'5'!S19","v":0},{"$f":"'5'!T19","v":0},{"$f":"'5'!U19","v":0},{"$f":"'5'!V19","v":0},{"$f":"'5'!W19","v":0},{"$f":"'5'!X19","v":0},{"$f":"'5'!Y19","v":0},{"$f":"'5'!Z19","v":0},{"$f":"'5'!AA19","v":0},{"$f":"'5'!AB19","v":0},{"$f":"'5'!AC19","v":0},{"$f":"'5'!AD19","v":0},{"$f":"'5'!AE19","v":0},{"$f":"'5'!AF19","v":0},{"$f":"'5'!AG19","v":0},{"$f":"'5'!AH19","v":0},{"$f":"'5'!AI19","v":0},{"$f":"'5'!AJ19","v":0},{"$f":"'5'!AK19","v":0},{"$f":"'5'!AL19","v":0},{"$f":"'5'!AM19","v":0},{"$f":"'5'!AN19","v":0},{"$f":"'5'!AO19","v":0},{"$f":"'5'!AP19","v":0},{"$f":"'5'!AQ19","v":0},{"$f":"'5'!AR19","v":0},{"$f":"'5'!AS19","v":0},{"$f":"'5'!AT19","v":0},{"$f":"SUMPRODUCT(IF($N365=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N365=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B21","v":"5"},{"$f":"'5'!C21","v":"5.2"},{"$f":"'5'!D21","v":"5.2.1"},{"$f":"'5'!E21","v":"5.2.1: Providers shall ensure that data is protected by cryptography and network security controls"},{"$f":"'5'!F21","v":"5.2.1.1"},{"$f":"'5'!G21","v":"5.2.1.1: ENCRYPTION POLICY\nProviders should develop a policy on the use of cryptographic controls for protection of customer data, transactions and security credentials. \n\nThe policy should define when encryption is required, and which data should be encrypted. For example, encryption may be required for:\n- sensitive data within the mobile money system;\n- data transmitted externally; and\n- security credentials or customer account data.\n\nThe approach to key management should also be defined in the policy (see 5.2.1.4).\n\nCryptographic algorithms and key lengths should be selected according to best practice and local laws."},{"$f":"'5'!H21","v":"ISO 27002:2013 Sec. 10"},{"$f":"'5'!I21","v":"5.2.1.1.1"},{"$f":"'5'!J21","v":"5.2.1.1.1: Is there a data encryption policy that defines when cryptographic controls are required to protect mobile money data, such as when data is transmitted externally or security credentials are held in the system?\n"},{"$f":"'5'!K21","v":"1) Security policy or equivalent compliance framework or audit documentation\n- Check that the policy is documented and approved by current senior management\n- Check it outlines when cryptographic controls required to protect mobile money data\n(note: this should include when data is transmitted externally or security credentials are held on the system etc.)"},{"$f":"'5'!L21","v":0},{"$f":"'5'!M21","v":"Recommended"},{"$f":"'5'!N21","v":"Recommended"},{"$f":"'5'!O21","v":"TechOps"},{"$f":"'5'!P21","v":0},{"$f":"'5'!Q21","v":0},{"$f":"'5'!R21","v":0},{"$f":"'5'!S21","v":0},{"$f":"'5'!T21","v":0},{"$f":"'5'!U21","v":0},{"$f":"'5'!V21","v":0},{"$f":"'5'!W21","v":0},{"$f":"'5'!X21","v":0},{"$f":"'5'!Y21","v":0},{"$f":"'5'!Z21","v":0},{"$f":"'5'!AA21","v":0},{"$f":"'5'!AB21","v":0},{"$f":"'5'!AC21","v":0},{"$f":"'5'!AD21","v":0},{"$f":"'5'!AE21","v":0},{"$f":"'5'!AF21","v":0},{"$f":"'5'!AG21","v":0},{"$f":"'5'!AH21","v":0},{"$f":"'5'!AI21","v":0},{"$f":"'5'!AJ21","v":0},{"$f":"'5'!AK21","v":0},{"$f":"'5'!AL21","v":0},{"$f":"'5'!AM21","v":0},{"$f":"'5'!AN21","v":0},{"$f":"'5'!AO21","v":0},{"$f":"'5'!AP21","v":0},{"$f":"'5'!AQ21","v":0},{"$f":"'5'!AR21","v":0},{"$f":"'5'!AS21","v":0},{"$f":"'5'!AT21","v":0},{"$f":"SUMPRODUCT(IF($N366=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N366=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B22","v":"5"},{"$f":"'5'!C22","v":"5.2"},{"$f":"'5'!D22","v":"5.2.1"},{"$f":"'5'!E22","v":"5.2.1: Providers shall ensure that data is protected by cryptography and network security controls"},{"$f":"'5'!F22","v":"5.2.1.2"},{"$f":"'5'!G22","v":"5.2.1.2: ENCRYPTION CONTROLS - SENSITIVE DATA\nAll security credentials (PINs, passwords, etc.) should be stored using at minimum a strong cryptographic hash function with a salted hash. It is recomended that a hash be chosen such that it is computationally impractical to generate any other string that generates the same hash.\n\nAlternatively, providers should consider encrypting PINs and passwords using a Hardware Security Module (HSM) or other method to harden the level of security. Providers may also consider encrypting all stored customer account data for additional security."},{"$f":"'5'!H22","v":"PCI DSS, ISO 27002: 2013 Sec. 10, 12.1 "},{"$f":"'5'!I22","v":"5.2.1.2.1"},{"$f":"'5'!J22","v":"5.2.1.2.1: Are all security credentials (PINs, passwords, etc.) stored using either a strong cryptograpic hash with salt or strong encryption?\n"},{"$f":"'5'!K22","v":"1) System architecture specification \n- Check the documentation outlines the encryption requirements for all security credentials \n- Check PINs and passwords are secured using a cryptographic hash with salt, or encryption with a Hardware Security Module (HSM) or equivalent.\n\n\n\n"},{"$f":"'5'!L22","v":0},{"$f":"'5'!M22","v":"Urgent Required"},{"$f":"'5'!N22","v":"Required"},{"$f":"'5'!O22","v":"TechOps"},{"$f":"'5'!P22","v":0},{"$f":"'5'!Q22","v":0},{"$f":"'5'!R22","v":0},{"$f":"'5'!S22","v":0},{"$f":"'5'!T22","v":0},{"$f":"'5'!U22","v":0},{"$f":"'5'!V22","v":0},{"$f":"'5'!W22","v":0},{"$f":"'5'!X22","v":0},{"$f":"'5'!Y22","v":0},{"$f":"'5'!Z22","v":0},{"$f":"'5'!AA22","v":0},{"$f":"'5'!AB22","v":0},{"$f":"'5'!AC22","v":0},{"$f":"'5'!AD22","v":0},{"$f":"'5'!AE22","v":0},{"$f":"'5'!AF22","v":0},{"$f":"'5'!AG22","v":0},{"$f":"'5'!AH22","v":0},{"$f":"'5'!AI22","v":0},{"$f":"'5'!AJ22","v":0},{"$f":"'5'!AK22","v":0},{"$f":"'5'!AL22","v":0},{"$f":"'5'!AM22","v":0},{"$f":"'5'!AN22","v":0},{"$f":"'5'!AO22","v":0},{"$f":"'5'!AP22","v":0},{"$f":"'5'!AQ22","v":0},{"$f":"'5'!AR22","v":0},{"$f":"'5'!AS22","v":0},{"$f":"'5'!AT22","v":0},{"$f":"SUMPRODUCT(IF($N367=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N367=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B23","v":"5"},{"$f":"'5'!C23","v":"5.2"},{"$f":"'5'!D23","v":"5.2.1"},{"$f":"'5'!E23","v":""},{"$f":"'5'!F23","v":"5.2.1.2"},{"$f":"'5'!G23","v":0},{"$f":"'5'!H23","v":0},{"$f":"'5'!I23","v":"5.2.1.2.2"},{"$f":"'5'!J23","v":"5.2.1.2.2: Has all stored customer account data been encrypted for additional security?\n"},{"$f":"'5'!K23","v":0},{"$f":"'5'!L23","v":0},{"$f":"'5'!M23","v":"Recommended"},{"$f":"'5'!N23","v":"Recommended"},{"$f":"'5'!O23","v":"TechOps"},{"$f":"'5'!P23","v":0},{"$f":"'5'!Q23","v":0},{"$f":"'5'!R23","v":0},{"$f":"'5'!S23","v":0},{"$f":"'5'!T23","v":0},{"$f":"'5'!U23","v":0},{"$f":"'5'!V23","v":0},{"$f":"'5'!W23","v":0},{"$f":"'5'!X23","v":0},{"$f":"'5'!Y23","v":0},{"$f":"'5'!Z23","v":0},{"$f":"'5'!AA23","v":0},{"$f":"'5'!AB23","v":0},{"$f":"'5'!AC23","v":0},{"$f":"'5'!AD23","v":0},{"$f":"'5'!AE23","v":0},{"$f":"'5'!AF23","v":0},{"$f":"'5'!AG23","v":0},{"$f":"'5'!AH23","v":0},{"$f":"'5'!AI23","v":0},{"$f":"'5'!AJ23","v":0},{"$f":"'5'!AK23","v":0},{"$f":"'5'!AL23","v":0},{"$f":"'5'!AM23","v":0},{"$f":"'5'!AN23","v":0},{"$f":"'5'!AO23","v":0},{"$f":"'5'!AP23","v":0},{"$f":"'5'!AQ23","v":0},{"$f":"'5'!AR23","v":0},{"$f":"'5'!AS23","v":0},{"$f":"'5'!AT23","v":0},{"$f":"SUMPRODUCT(IF($N368=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N368=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B24","v":"5"},{"$f":"'5'!C24","v":"5.2"},{"$f":"'5'!D24","v":"5.2.1"},{"$f":"'5'!E24","v":""},{"$f":"'5'!F24","v":"5.2.1.3"},{"$f":"'5'!G24","v":"5.2.1.3: ENCRYPTION CONTROLS - EXTERNAL CONNECTIONS\nTransactions and customer data (especially security credentials) should be encrypted with strong cryptography (e.g. SSL/TLS, IPSEC, SSH) whenever they are transmitted outside the mobile money system. Data transfer mechanisms must prevent data from interception, copying, modification, misrouting and destruction by ensuring:\n- data integrity (data has not been tampered with);\n- confidentiality (data can not be read by unauthorised party); and\n- authentication (connected parties are identified).\n\nEncryption should be implemented for these external connections, at minimum:\n- all connectivity over the Internet;\n- API connections to third parties; and\n- connectivity to smartphones and PoS devices.\n\nThe following cryptographic controls should be implemented:\n- Electronic signatures should be used by each of the parties involved in the transaction to verify identity of both client and server;\n- When exchanging transactions with external systems, electronic signatures / certificates should be used by each of the parties involved to verify identity of both client and server, and the end-to end certificate handling process should be secure;\n- Data integrity of all messages should be ensured via a suitable mechanism, such as digital signatures or message authentication codes;\n- The implemented security protocols should use only secure versions and secure configurations; and\n- Appropriate encryption strength should be implemented for the encryption methodology in use, following vendor recommendations/ best practices."},{"$f":"'5'!H24","v":"ISO 27002:2013 Sec. 10, PCI DSS"},{"$f":"'5'!I24","v":"5.2.1.3.1"},{"$f":"'5'!J24","v":"5.2.1.3.1: Is all transaction data and customer data encrypted when transmitted externally (e.g. to financial ecosystem partners / merchants / businesses)?\n"},{"$f":"'5'!K24","v":"1) System architecture specification / interface specifications\n- Check that every external interface and its encryption is documented.\n- Check that all transactions data encrypted when transmitted externally (e.g. to financial ecosystem partners / merchants / businesses)."},{"$f":"'5'!L24","v":0},{"$f":"'5'!M24","v":"Urgent Required"},{"$f":"'5'!N24","v":"Required"},{"$f":"'5'!O24","v":"TechOps"},{"$f":"'5'!P24","v":0},{"$f":"'5'!Q24","v":0},{"$f":"'5'!R24","v":0},{"$f":"'5'!S24","v":0},{"$f":"'5'!T24","v":0},{"$f":"'5'!U24","v":0},{"$f":"'5'!V24","v":0},{"$f":"'5'!W24","v":0},{"$f":"'5'!X24","v":0},{"$f":"'5'!Y24","v":0},{"$f":"'5'!Z24","v":0},{"$f":"'5'!AA24","v":0},{"$f":"'5'!AB24","v":0},{"$f":"'5'!AC24","v":0},{"$f":"'5'!AD24","v":0},{"$f":"'5'!AE24","v":0},{"$f":"'5'!AF24","v":0},{"$f":"'5'!AG24","v":0},{"$f":"'5'!AH24","v":0},{"$f":"'5'!AI24","v":0},{"$f":"'5'!AJ24","v":0},{"$f":"'5'!AK24","v":0},{"$f":"'5'!AL24","v":0},{"$f":"'5'!AM24","v":0},{"$f":"'5'!AN24","v":0},{"$f":"'5'!AO24","v":0},{"$f":"'5'!AP24","v":0},{"$f":"'5'!AQ24","v":0},{"$f":"'5'!AR24","v":0},{"$f":"'5'!AS24","v":0},{"$f":"'5'!AT24","v":0},{"$f":"SUMPRODUCT(IF($N369=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N369=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B25","v":"5"},{"$f":"'5'!C25","v":"5.2"},{"$f":"'5'!D25","v":"5.2.1"},{"$f":"'5'!E25","v":""},{"$f":"'5'!F25","v":"5.2.1.3"},{"$f":"'5'!G25","v":0},{"$f":"'5'!H25","v":0},{"$f":"'5'!I25","v":"5.2.1.3.2"},{"$f":"'5'!J25","v":"5.2.1.3.2: Are transactions encrypted when transmitted to and from smartphones?\n"},{"$f":"'5'!K25","v":0},{"$f":"'5'!L25","v":0},{"$f":"'5'!M25","v":"Recommended"},{"$f":"'5'!N25","v":"Recommended"},{"$f":"'5'!O25","v":"TechOps"},{"$f":"'5'!P25","v":0},{"$f":"'5'!Q25","v":0},{"$f":"'5'!R25","v":0},{"$f":"'5'!S25","v":0},{"$f":"'5'!T25","v":0},{"$f":"'5'!U25","v":0},{"$f":"'5'!V25","v":0},{"$f":"'5'!W25","v":0},{"$f":"'5'!X25","v":0},{"$f":"'5'!Y25","v":0},{"$f":"'5'!Z25","v":0},{"$f":"'5'!AA25","v":0},{"$f":"'5'!AB25","v":0},{"$f":"'5'!AC25","v":0},{"$f":"'5'!AD25","v":0},{"$f":"'5'!AE25","v":0},{"$f":"'5'!AF25","v":0},{"$f":"'5'!AG25","v":0},{"$f":"'5'!AH25","v":0},{"$f":"'5'!AI25","v":0},{"$f":"'5'!AJ25","v":0},{"$f":"'5'!AK25","v":0},{"$f":"'5'!AL25","v":0},{"$f":"'5'!AM25","v":0},{"$f":"'5'!AN25","v":0},{"$f":"'5'!AO25","v":0},{"$f":"'5'!AP25","v":0},{"$f":"'5'!AQ25","v":0},{"$f":"'5'!AR25","v":0},{"$f":"'5'!AS25","v":0},{"$f":"'5'!AT25","v":0},{"$f":"SUMPRODUCT(IF($N370=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N370=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B26","v":"5"},{"$f":"'5'!C26","v":"5.2"},{"$f":"'5'!D26","v":"5.2.1"},{"$f":"'5'!E26","v":""},{"$f":"'5'!F26","v":"5.2.1.3"},{"$f":"'5'!G26","v":0},{"$f":"'5'!H26","v":0},{"$f":"'5'!I26","v":"5.2.1.3.3"},{"$f":"'5'!J26","v":"5.2.1.3.3: When exchanging transactions with external systems, are electronic signatures / certificates used by each of the parties involved to verify identity of both client and server, and is the end-to end certificate handling process secure?\n"},{"$f":"'5'!K26","v":0},{"$f":"'5'!L26","v":0},{"$f":"'5'!M26","v":"Recommended"},{"$f":"'5'!N26","v":"Recommended"},{"$f":"'5'!O26","v":"TechOps"},{"$f":"'5'!P26","v":0},{"$f":"'5'!Q26","v":0},{"$f":"'5'!R26","v":0},{"$f":"'5'!S26","v":0},{"$f":"'5'!T26","v":0},{"$f":"'5'!U26","v":0},{"$f":"'5'!V26","v":0},{"$f":"'5'!W26","v":0},{"$f":"'5'!X26","v":0},{"$f":"'5'!Y26","v":0},{"$f":"'5'!Z26","v":0},{"$f":"'5'!AA26","v":0},{"$f":"'5'!AB26","v":0},{"$f":"'5'!AC26","v":0},{"$f":"'5'!AD26","v":0},{"$f":"'5'!AE26","v":0},{"$f":"'5'!AF26","v":0},{"$f":"'5'!AG26","v":0},{"$f":"'5'!AH26","v":0},{"$f":"'5'!AI26","v":0},{"$f":"'5'!AJ26","v":0},{"$f":"'5'!AK26","v":0},{"$f":"'5'!AL26","v":0},{"$f":"'5'!AM26","v":0},{"$f":"'5'!AN26","v":0},{"$f":"'5'!AO26","v":0},{"$f":"'5'!AP26","v":0},{"$f":"'5'!AQ26","v":0},{"$f":"'5'!AR26","v":0},{"$f":"'5'!AS26","v":0},{"$f":"'5'!AT26","v":0},{"$f":"SUMPRODUCT(IF($N371=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N371=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B27","v":"5"},{"$f":"'5'!C27","v":"5.2"},{"$f":"'5'!D27","v":"5.2.1"},{"$f":"'5'!E27","v":""},{"$f":"'5'!F27","v":"5.2.1.3"},{"$f":"'5'!G27","v":0},{"$f":"'5'!H27","v":0},{"$f":"'5'!I27","v":"5.2.1.3.4"},{"$f":"'5'!J27","v":"5.2.1.3.4: Have the security protocols for encrypting external data connections been implemented with secure versions and secure configurations?\n"},{"$f":"'5'!K27","v":0},{"$f":"'5'!L27","v":0},{"$f":"'5'!M27","v":"Recommended"},{"$f":"'5'!N27","v":"Recommended"},{"$f":"'5'!O27","v":"TechOps"},{"$f":"'5'!P27","v":0},{"$f":"'5'!Q27","v":0},{"$f":"'5'!R27","v":0},{"$f":"'5'!S27","v":0},{"$f":"'5'!T27","v":0},{"$f":"'5'!U27","v":0},{"$f":"'5'!V27","v":0},{"$f":"'5'!W27","v":0},{"$f":"'5'!X27","v":0},{"$f":"'5'!Y27","v":0},{"$f":"'5'!Z27","v":0},{"$f":"'5'!AA27","v":0},{"$f":"'5'!AB27","v":0},{"$f":"'5'!AC27","v":0},{"$f":"'5'!AD27","v":0},{"$f":"'5'!AE27","v":0},{"$f":"'5'!AF27","v":0},{"$f":"'5'!AG27","v":0},{"$f":"'5'!AH27","v":0},{"$f":"'5'!AI27","v":0},{"$f":"'5'!AJ27","v":0},{"$f":"'5'!AK27","v":0},{"$f":"'5'!AL27","v":0},{"$f":"'5'!AM27","v":0},{"$f":"'5'!AN27","v":0},{"$f":"'5'!AO27","v":0},{"$f":"'5'!AP27","v":0},{"$f":"'5'!AQ27","v":0},{"$f":"'5'!AR27","v":0},{"$f":"'5'!AS27","v":0},{"$f":"'5'!AT27","v":0},{"$f":"SUMPRODUCT(IF($N372=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N372=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B28","v":"5"},{"$f":"'5'!C28","v":"5.2"},{"$f":"'5'!D28","v":"5.2.1"},{"$f":"'5'!E28","v":""},{"$f":"'5'!F28","v":"5.2.1.3"},{"$f":"'5'!G28","v":0},{"$f":"'5'!H28","v":0},{"$f":"'5'!I28","v":"5.2.1.3.5"},{"$f":"'5'!J28","v":"5.2.1.3.5: Has appropriate encryption strength been implemented for the encryption methodology in use, following vendor recommendations/ best practices?\n"},{"$f":"'5'!K28","v":0},{"$f":"'5'!L28","v":0},{"$f":"'5'!M28","v":"Recommended"},{"$f":"'5'!N28","v":"Recommended"},{"$f":"'5'!O28","v":"TechOps"},{"$f":"'5'!P28","v":0},{"$f":"'5'!Q28","v":0},{"$f":"'5'!R28","v":0},{"$f":"'5'!S28","v":0},{"$f":"'5'!T28","v":0},{"$f":"'5'!U28","v":0},{"$f":"'5'!V28","v":0},{"$f":"'5'!W28","v":0},{"$f":"'5'!X28","v":0},{"$f":"'5'!Y28","v":0},{"$f":"'5'!Z28","v":0},{"$f":"'5'!AA28","v":0},{"$f":"'5'!AB28","v":0},{"$f":"'5'!AC28","v":0},{"$f":"'5'!AD28","v":0},{"$f":"'5'!AE28","v":0},{"$f":"'5'!AF28","v":0},{"$f":"'5'!AG28","v":0},{"$f":"'5'!AH28","v":0},{"$f":"'5'!AI28","v":0},{"$f":"'5'!AJ28","v":0},{"$f":"'5'!AK28","v":0},{"$f":"'5'!AL28","v":0},{"$f":"'5'!AM28","v":0},{"$f":"'5'!AN28","v":0},{"$f":"'5'!AO28","v":0},{"$f":"'5'!AP28","v":0},{"$f":"'5'!AQ28","v":0},{"$f":"'5'!AR28","v":0},{"$f":"'5'!AS28","v":0},{"$f":"'5'!AT28","v":0},{"$f":"SUMPRODUCT(IF($N373=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N373=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B29","v":"5"},{"$f":"'5'!C29","v":"5.2"},{"$f":"'5'!D29","v":"5.2.1"},{"$f":"'5'!E29","v":""},{"$f":"'5'!F29","v":"5.2.1.4"},{"$f":"'5'!G29","v":"5.2.1.4: ENCRYPTION KEY MANAGEMENT\nIf PINs/passwords are encrypted, providers should implement robust key-management procedures for protecting encryption keys. The whole lifecycle should be documented, including generating, storing, retrieving, distributing, retiring, archiving and destroying keys. \n\nKey custodians should be nominated and should formally acknowledge that they understand their key-custodian responsibilities and processes.\n\nKey management processes should include the following:\n- store keys securely and protect equipment used to generate, store and archive keys. \n- ideally, store keys in an encrypted format and store key-encrypting keys separately from data-encrypting keys;\n- restrict access to keys to the fewest custodians necessary;\n- store keys in the fewest possible locations and forms;\n- prevent reuse of retired security keys when changing keys;\n- replace keys when the integrity of the key has been weakened or is suspect;\n- split knowledge and control of keys where manual clear-text keys are used;\n- backup keys and certificates securely and sufficiently to protect against system failure or disaster;\n- use sufficiently random numbers for cryptographic key generation (this is a common failing).\n"},{"$f":"'5'!H29","v":"ISO 27002: 2013 Sec. 10, 12.1,\nPCI DSS"},{"$f":"'5'!I29","v":"5.2.1.4.1"},{"$f":"'5'!J29","v":"5.2.1.4.1: If PINs/passwords are encrypted, have robust procedures been implemented for protecting encryption keys throughout the whole lifecycle of generating, storing, retrieving, distributing, retiring, archiving and destroying keys?\n"},{"$f":"'5'!K29","v":"1) Encryption key management process.\n- Check there are processes for protecting encryption keys and certificates\n- Check the process covers requirements for:\na) Generating\nb) Storing\nc) Retrieving\nd) Distribution\ne) Retiring\nf) Archiving \ng) Destroying keys and certificates\n- Check that the procedure give consideration to both physical and logical security requirements\n\n[If encryption is not used to secure PINs/passwords/data then this can be marked N/A]"},{"$f":"'5'!L29","v":0},{"$f":"'5'!M29","v":"Recommended"},{"$f":"'5'!N29","v":"Recommended"},{"$f":"'5'!O29","v":"TechOps"},{"$f":"'5'!P29","v":0},{"$f":"'5'!Q29","v":0},{"$f":"'5'!R29","v":0},{"$f":"'5'!S29","v":0},{"$f":"'5'!T29","v":0},{"$f":"'5'!U29","v":0},{"$f":"'5'!V29","v":0},{"$f":"'5'!W29","v":0},{"$f":"'5'!X29","v":0},{"$f":"'5'!Y29","v":0},{"$f":"'5'!Z29","v":0},{"$f":"'5'!AA29","v":0},{"$f":"'5'!AB29","v":0},{"$f":"'5'!AC29","v":0},{"$f":"'5'!AD29","v":0},{"$f":"'5'!AE29","v":0},{"$f":"'5'!AF29","v":0},{"$f":"'5'!AG29","v":0},{"$f":"'5'!AH29","v":0},{"$f":"'5'!AI29","v":0},{"$f":"'5'!AJ29","v":0},{"$f":"'5'!AK29","v":0},{"$f":"'5'!AL29","v":0},{"$f":"'5'!AM29","v":0},{"$f":"'5'!AN29","v":0},{"$f":"'5'!AO29","v":0},{"$f":"'5'!AP29","v":0},{"$f":"'5'!AQ29","v":0},{"$f":"'5'!AR29","v":0},{"$f":"'5'!AS29","v":0},{"$f":"'5'!AT29","v":0},{"$f":"SUMPRODUCT(IF($N374=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N374=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B30","v":"5"},{"$f":"'5'!C30","v":"5.2"},{"$f":"'5'!D30","v":"5.2.1"},{"$f":"'5'!E30","v":""},{"$f":"'5'!F30","v":"5.2.1.4"},{"$f":"'5'!G30","v":0},{"$f":"'5'!H30","v":0},{"$f":"'5'!I30","v":"5.2.1.4.2"},{"$f":"'5'!J30","v":"5.2.1.4.2: If PINs/passwords are encrypted, have encryption key custodians been nominated and formally acknowledged that they understand their key-custodian responsibilities and processes?\n"},{"$f":"'5'!K30","v":"1) Encryption policy\n- Check the policy states who the custodians of the keys are\n- Check the custodians have received a briefing regarding their responsibilities and the processes they are required to undertake\n- Check the custodians have formally acknowledged and understand their role\n\n[If encryption is not used to secure PINs/passwords/data then this can be marked N/A]"},{"$f":"'5'!L30","v":0},{"$f":"'5'!M30","v":"Standard Required"},{"$f":"'5'!N30","v":"Required"},{"$f":"'5'!O30","v":"TechOps"},{"$f":"'5'!P30","v":0},{"$f":"'5'!Q30","v":0},{"$f":"'5'!R30","v":0},{"$f":"'5'!S30","v":0},{"$f":"'5'!T30","v":0},{"$f":"'5'!U30","v":0},{"$f":"'5'!V30","v":0},{"$f":"'5'!W30","v":0},{"$f":"'5'!X30","v":0},{"$f":"'5'!Y30","v":0},{"$f":"'5'!Z30","v":0},{"$f":"'5'!AA30","v":0},{"$f":"'5'!AB30","v":0},{"$f":"'5'!AC30","v":0},{"$f":"'5'!AD30","v":0},{"$f":"'5'!AE30","v":0},{"$f":"'5'!AF30","v":0},{"$f":"'5'!AG30","v":0},{"$f":"'5'!AH30","v":0},{"$f":"'5'!AI30","v":0},{"$f":"'5'!AJ30","v":0},{"$f":"'5'!AK30","v":0},{"$f":"'5'!AL30","v":0},{"$f":"'5'!AM30","v":0},{"$f":"'5'!AN30","v":0},{"$f":"'5'!AO30","v":0},{"$f":"'5'!AP30","v":0},{"$f":"'5'!AQ30","v":0},{"$f":"'5'!AR30","v":0},{"$f":"'5'!AS30","v":0},{"$f":"'5'!AT30","v":0},{"$f":"SUMPRODUCT(IF($N375=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N375=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B31","v":"5"},{"$f":"'5'!C31","v":"5.2"},{"$f":"'5'!D31","v":"5.2.1"},{"$f":"'5'!E31","v":""},{"$f":"'5'!F31","v":"5.2.1.4"},{"$f":"'5'!G31","v":0},{"$f":"'5'!H31","v":0},{"$f":"'5'!I31","v":"5.2.1.4.3"},{"$f":"'5'!J31","v":"5.2.1.4.3: If PINs/passwords are encrypted, are encryption keys stored securely and protected against disaster, and is equipment used to generate, store and archive keys protected?\n"},{"$f":"'5'!K31","v":"1) Encryption policy\n- Check there are processes for the secure storage of the keys\n- Check that keys are protected against key storage system failure or disaster.\n- Check that are security measures to protect any equipment that is used to store the keys.\n\n[If encryption is not used to secure PINs/passwords/data then this can be marked N/A]"},{"$f":"'5'!L31","v":0},{"$f":"'5'!M31","v":"Urgent Required"},{"$f":"'5'!N31","v":"Required"},{"$f":"'5'!O31","v":"TechOps"},{"$f":"'5'!P31","v":0},{"$f":"'5'!Q31","v":0},{"$f":"'5'!R31","v":0},{"$f":"'5'!S31","v":0},{"$f":"'5'!T31","v":0},{"$f":"'5'!U31","v":0},{"$f":"'5'!V31","v":0},{"$f":"'5'!W31","v":0},{"$f":"'5'!X31","v":0},{"$f":"'5'!Y31","v":0},{"$f":"'5'!Z31","v":0},{"$f":"'5'!AA31","v":0},{"$f":"'5'!AB31","v":0},{"$f":"'5'!AC31","v":0},{"$f":"'5'!AD31","v":0},{"$f":"'5'!AE31","v":0},{"$f":"'5'!AF31","v":0},{"$f":"'5'!AG31","v":0},{"$f":"'5'!AH31","v":0},{"$f":"'5'!AI31","v":0},{"$f":"'5'!AJ31","v":0},{"$f":"'5'!AK31","v":0},{"$f":"'5'!AL31","v":0},{"$f":"'5'!AM31","v":0},{"$f":"'5'!AN31","v":0},{"$f":"'5'!AO31","v":0},{"$f":"'5'!AP31","v":0},{"$f":"'5'!AQ31","v":0},{"$f":"'5'!AR31","v":0},{"$f":"'5'!AS31","v":0},{"$f":"'5'!AT31","v":0},{"$f":"SUMPRODUCT(IF($N376=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N376=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B32","v":"5"},{"$f":"'5'!C32","v":"5.2"},{"$f":"'5'!D32","v":"5.2.1"},{"$f":"'5'!E32","v":""},{"$f":"'5'!F32","v":"5.2.1.4"},{"$f":"'5'!G32","v":0},{"$f":"'5'!H32","v":0},{"$f":"'5'!I32","v":"5.2.1.4.4"},{"$f":"'5'!J32","v":"5.2.1.4.4: Are keys stored in an encrypted format and key-encrypting keys stored separately from data-encrypting keys?\n"},{"$f":"'5'!K32","v":0},{"$f":"'5'!L32","v":0},{"$f":"'5'!M32","v":"Recommended"},{"$f":"'5'!N32","v":"Recommended"},{"$f":"'5'!O32","v":"TechOps"},{"$f":"'5'!P32","v":0},{"$f":"'5'!Q32","v":0},{"$f":"'5'!R32","v":0},{"$f":"'5'!S32","v":0},{"$f":"'5'!T32","v":0},{"$f":"'5'!U32","v":0},{"$f":"'5'!V32","v":0},{"$f":"'5'!W32","v":0},{"$f":"'5'!X32","v":0},{"$f":"'5'!Y32","v":0},{"$f":"'5'!Z32","v":0},{"$f":"'5'!AA32","v":0},{"$f":"'5'!AB32","v":0},{"$f":"'5'!AC32","v":0},{"$f":"'5'!AD32","v":0},{"$f":"'5'!AE32","v":0},{"$f":"'5'!AF32","v":0},{"$f":"'5'!AG32","v":0},{"$f":"'5'!AH32","v":0},{"$f":"'5'!AI32","v":0},{"$f":"'5'!AJ32","v":0},{"$f":"'5'!AK32","v":0},{"$f":"'5'!AL32","v":0},{"$f":"'5'!AM32","v":0},{"$f":"'5'!AN32","v":0},{"$f":"'5'!AO32","v":0},{"$f":"'5'!AP32","v":0},{"$f":"'5'!AQ32","v":0},{"$f":"'5'!AR32","v":0},{"$f":"'5'!AS32","v":0},{"$f":"'5'!AT32","v":0},{"$f":"SUMPRODUCT(IF($N377=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N377=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B33","v":"5"},{"$f":"'5'!C33","v":"5.2"},{"$f":"'5'!D33","v":"5.2.1"},{"$f":"'5'!E33","v":""},{"$f":"'5'!F33","v":"5.2.1.4"},{"$f":"'5'!G33","v":0},{"$f":"'5'!H33","v":0},{"$f":"'5'!I33","v":"5.2.1.4.5"},{"$f":"'5'!J33","v":"5.2.1.4.5: If manual clear-text keys are used, do key-management procedures require split knowledge and dual control of keys?\n"},{"$f":"'5'!K33","v":0},{"$f":"'5'!L33","v":0},{"$f":"'5'!M33","v":"Recommended"},{"$f":"'5'!N33","v":"Recommended"},{"$f":"'5'!O33","v":"TechOps"},{"$f":"'5'!P33","v":0},{"$f":"'5'!Q33","v":0},{"$f":"'5'!R33","v":0},{"$f":"'5'!S33","v":0},{"$f":"'5'!T33","v":0},{"$f":"'5'!U33","v":0},{"$f":"'5'!V33","v":0},{"$f":"'5'!W33","v":0},{"$f":"'5'!X33","v":0},{"$f":"'5'!Y33","v":0},{"$f":"'5'!Z33","v":0},{"$f":"'5'!AA33","v":0},{"$f":"'5'!AB33","v":0},{"$f":"'5'!AC33","v":0},{"$f":"'5'!AD33","v":0},{"$f":"'5'!AE33","v":0},{"$f":"'5'!AF33","v":0},{"$f":"'5'!AG33","v":0},{"$f":"'5'!AH33","v":0},{"$f":"'5'!AI33","v":0},{"$f":"'5'!AJ33","v":0},{"$f":"'5'!AK33","v":0},{"$f":"'5'!AL33","v":0},{"$f":"'5'!AM33","v":0},{"$f":"'5'!AN33","v":0},{"$f":"'5'!AO33","v":0},{"$f":"'5'!AP33","v":0},{"$f":"'5'!AQ33","v":0},{"$f":"'5'!AR33","v":0},{"$f":"'5'!AS33","v":0},{"$f":"'5'!AT33","v":0},{"$f":"SUMPRODUCT(IF($N378=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N378=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B34","v":"5"},{"$f":"'5'!C34","v":"5.2"},{"$f":"'5'!D34","v":"5.2.1"},{"$f":"'5'!E34","v":""},{"$f":"'5'!F34","v":"5.2.1.4"},{"$f":"'5'!G34","v":0},{"$f":"'5'!H34","v":0},{"$f":"'5'!I34","v":"5.2.1.4.6"},{"$f":"'5'!J34","v":"5.2.1.4.6: Are sufficiently random numbers used for cryptographic key generation?\n"},{"$f":"'5'!K34","v":0},{"$f":"'5'!L34","v":0},{"$f":"'5'!M34","v":"Recommended"},{"$f":"'5'!N34","v":"Recommended"},{"$f":"'5'!O34","v":"TechOps"},{"$f":"'5'!P34","v":0},{"$f":"'5'!Q34","v":0},{"$f":"'5'!R34","v":0},{"$f":"'5'!S34","v":0},{"$f":"'5'!T34","v":0},{"$f":"'5'!U34","v":0},{"$f":"'5'!V34","v":0},{"$f":"'5'!W34","v":0},{"$f":"'5'!X34","v":0},{"$f":"'5'!Y34","v":0},{"$f":"'5'!Z34","v":0},{"$f":"'5'!AA34","v":0},{"$f":"'5'!AB34","v":0},{"$f":"'5'!AC34","v":0},{"$f":"'5'!AD34","v":0},{"$f":"'5'!AE34","v":0},{"$f":"'5'!AF34","v":0},{"$f":"'5'!AG34","v":0},{"$f":"'5'!AH34","v":0},{"$f":"'5'!AI34","v":0},{"$f":"'5'!AJ34","v":0},{"$f":"'5'!AK34","v":0},{"$f":"'5'!AL34","v":0},{"$f":"'5'!AM34","v":0},{"$f":"'5'!AN34","v":0},{"$f":"'5'!AO34","v":0},{"$f":"'5'!AP34","v":0},{"$f":"'5'!AQ34","v":0},{"$f":"'5'!AR34","v":0},{"$f":"'5'!AS34","v":0},{"$f":"'5'!AT34","v":0},{"$f":"SUMPRODUCT(IF($N379=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N379=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B35","v":"5"},{"$f":"'5'!C35","v":"5.2"},{"$f":"'5'!D35","v":"5.2.1"},{"$f":"'5'!E35","v":""},{"$f":"'5'!F35","v":"5.2.1.5"},{"$f":"'5'!G35","v":"5.2.1.5: AD-HOC AND OFFLINE DATA TRANSFER\nAn data transfer policy or process should be implemented that defines how offline and ad-hoc transfers of mobile money data to/from third parties should be done (i.e. to/from agents, entities providing outsourced services, and financial ecosystem partners).\n\nThe detailed security measures to ensure the confidentiality and integrity of the data should be documented (e.g. encryption, anonymization).\n"},{"$f":"'5'!H35","v":"ISO 27002:2013 Sec. 13.2 "},{"$f":"'5'!I35","v":"5.2.1.5.1"},{"$f":"'5'!J35","v":"5.2.1.5.1: Has a data transfer policy or process been implemented that defines how offline and ad-hoc transfers of mobile money data to/from third parties should be done, including the detailed security measures to ensure the confidentiality and integrity of the data?\n"},{"$f":"'5'!K35","v":"1) Data protection policy, security policy, process or equivalent.\n- Check the document specifies how the data should be protected (e.g. anonymisation, encryption).\n- Check the document identifies applicable data (e.g. via classification level).\n- Check the policy covers all ad-hoc and offline external data transfers.\n"},{"$f":"'5'!L35","v":0},{"$f":"'5'!M35","v":"Standard Required"},{"$f":"'5'!N35","v":"Required"},{"$f":"'5'!O35","v":"TechOps"},{"$f":"'5'!P35","v":0},{"$f":"'5'!Q35","v":0},{"$f":"'5'!R35","v":0},{"$f":"'5'!S35","v":0},{"$f":"'5'!T35","v":0},{"$f":"'5'!U35","v":0},{"$f":"'5'!V35","v":0},{"$f":"'5'!W35","v":0},{"$f":"'5'!X35","v":0},{"$f":"'5'!Y35","v":0},{"$f":"'5'!Z35","v":0},{"$f":"'5'!AA35","v":0},{"$f":"'5'!AB35","v":0},{"$f":"'5'!AC35","v":0},{"$f":"'5'!AD35","v":0},{"$f":"'5'!AE35","v":0},{"$f":"'5'!AF35","v":0},{"$f":"'5'!AG35","v":0},{"$f":"'5'!AH35","v":0},{"$f":"'5'!AI35","v":0},{"$f":"'5'!AJ35","v":0},{"$f":"'5'!AK35","v":0},{"$f":"'5'!AL35","v":0},{"$f":"'5'!AM35","v":0},{"$f":"'5'!AN35","v":0},{"$f":"'5'!AO35","v":0},{"$f":"'5'!AP35","v":0},{"$f":"'5'!AQ35","v":0},{"$f":"'5'!AR35","v":0},{"$f":"'5'!AS35","v":0},{"$f":"'5'!AT35","v":0},{"$f":"SUMPRODUCT(IF($N380=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N380=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B36","v":"5"},{"$f":"'5'!C36","v":"5.2"},{"$f":"'5'!D36","v":"5.2.1"},{"$f":"'5'!E36","v":""},{"$f":"'5'!F36","v":"5.2.1.6"},{"$f":"'5'!G36","v":"5.2.1.6: NETWORK SECURITY\nExternal connectivity of the mobile money system should be protected with firewalls to only allow authorized traffic and protect access to customer data. An external-facing DMZ should be established that is separate from the internal network segment (see 5.2.1.8). Sensitive mobile money system components should be located in the internal network segment, segregated from the DMZ and other untrusted networks.\n\nA network diagram should be documented, identifying connections between the mobile money network environment and external networks.\n\nFirewalls and routers should be set up as follows:\n- position firewalls on every Internet connection and between the DMZ and internal network segment;\n- position firewalls between the internal network segment and the network segment for the wireless phone network;\n- restrict inbound and outbound traffic to that which is necessary for the customer data environment and specifically deny all other traffic;\n- document the rule set for each firewall, including business justification for use of all services, protocols, and ports allowed;\n- ensure firewall and router configuration files are secure and backed up regularly;\n- review firewall and router rule sets at least every six months.\n\nThe DMZ should be set up to:\n- limit inbound Internet traffic to authorized publicly-accessible services, protocols, and ports within the DMZ to prevent direct connections to the mobile money network segment;\n- implement anti-spoofing measures to detect and block forged source IP addresses from entering the network;\n- implement stateful inspection (dynamic packet filtering), ensuring that only established connections are allowed into the network;\n- not disclose private IP addresses and routing information externally (e.g. using NAT).\n\nMeasures should be put in place to prevent devices from being simultaneously connected to the organization’s trusted internal network and untrusted external networks (e.g. establishing connectivity via Ethernet adapter and wireless adapter on the same device)."},{"$f":"'5'!H36","v":"PCI DSS, ISO 27002:2013 Sec. 13.1 "},{"$f":"'5'!I36","v":"5.2.1.6.1"},{"$f":"'5'!J36","v":"5.2.1.6.1: Is external connectivity of the mobile money system protected with firewalls to only allow authorized traffic and protect access to customer data, with external-facing components located in a DMZ?\n"},{"$f":"'5'!K36","v":"1) Network design and communications matrix\n- Check the Mobile Money System is protected by firewalls defining internal zone and DMZs.\n- Check the firewall only permits necessary traffic and denies all other traffic.\n- Check all routes through firewalls are documented."},{"$f":"'5'!L36","v":0},{"$f":"'5'!M36","v":"Urgent Required"},{"$f":"'5'!N36","v":"Required"},{"$f":"'5'!O36","v":"TechOps"},{"$f":"'5'!P36","v":0},{"$f":"'5'!Q36","v":0},{"$f":"'5'!R36","v":0},{"$f":"'5'!S36","v":0},{"$f":"'5'!T36","v":0},{"$f":"'5'!U36","v":0},{"$f":"'5'!V36","v":0},{"$f":"'5'!W36","v":0},{"$f":"'5'!X36","v":0},{"$f":"'5'!Y36","v":0},{"$f":"'5'!Z36","v":0},{"$f":"'5'!AA36","v":0},{"$f":"'5'!AB36","v":0},{"$f":"'5'!AC36","v":0},{"$f":"'5'!AD36","v":0},{"$f":"'5'!AE36","v":0},{"$f":"'5'!AF36","v":0},{"$f":"'5'!AG36","v":0},{"$f":"'5'!AH36","v":0},{"$f":"'5'!AI36","v":0},{"$f":"'5'!AJ36","v":0},{"$f":"'5'!AK36","v":0},{"$f":"'5'!AL36","v":0},{"$f":"'5'!AM36","v":0},{"$f":"'5'!AN36","v":0},{"$f":"'5'!AO36","v":0},{"$f":"'5'!AP36","v":0},{"$f":"'5'!AQ36","v":0},{"$f":"'5'!AR36","v":0},{"$f":"'5'!AS36","v":0},{"$f":"'5'!AT36","v":0},{"$f":"SUMPRODUCT(IF($N381=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N381=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B37","v":"5"},{"$f":"'5'!C37","v":"5.2"},{"$f":"'5'!D37","v":"5.2.1"},{"$f":"'5'!E37","v":""},{"$f":"'5'!F37","v":"5.2.1.6"},{"$f":"'5'!G37","v":0},{"$f":"'5'!H37","v":0},{"$f":"'5'!I37","v":"5.2.1.6.2"},{"$f":"'5'!J37","v":"5.2.1.6.2: Have the rule sets for all mobile money system firewalls been documented, including all services, protocols, and ports allowed and business justification for each?\n"},{"$f":"'5'!K37","v":"1) Network security policy (or equivalent documents) or firewall/router rules documentation\n- Check the document includes rules for all mobile money system firewalls\n- Check the document includes:\n     a) All services\n     b) Protocols\n     c) Allowed ports\n- Check there is a business justification for each of the above\n- Check all routes through firewalls are documented."},{"$f":"'5'!L37","v":0},{"$f":"'5'!M37","v":"Recommended"},{"$f":"'5'!N37","v":"Recommended"},{"$f":"'5'!O37","v":"TechOps"},{"$f":"'5'!P37","v":0},{"$f":"'5'!Q37","v":0},{"$f":"'5'!R37","v":0},{"$f":"'5'!S37","v":0},{"$f":"'5'!T37","v":0},{"$f":"'5'!U37","v":0},{"$f":"'5'!V37","v":0},{"$f":"'5'!W37","v":0},{"$f":"'5'!X37","v":0},{"$f":"'5'!Y37","v":0},{"$f":"'5'!Z37","v":0},{"$f":"'5'!AA37","v":0},{"$f":"'5'!AB37","v":0},{"$f":"'5'!AC37","v":0},{"$f":"'5'!AD37","v":0},{"$f":"'5'!AE37","v":0},{"$f":"'5'!AF37","v":0},{"$f":"'5'!AG37","v":0},{"$f":"'5'!AH37","v":0},{"$f":"'5'!AI37","v":0},{"$f":"'5'!AJ37","v":0},{"$f":"'5'!AK37","v":0},{"$f":"'5'!AL37","v":0},{"$f":"'5'!AM37","v":0},{"$f":"'5'!AN37","v":0},{"$f":"'5'!AO37","v":0},{"$f":"'5'!AP37","v":0},{"$f":"'5'!AQ37","v":0},{"$f":"'5'!AR37","v":0},{"$f":"'5'!AS37","v":0},{"$f":"'5'!AT37","v":0},{"$f":"SUMPRODUCT(IF($N382=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N382=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B38","v":"5"},{"$f":"'5'!C38","v":"5.2"},{"$f":"'5'!D38","v":"5.2.1"},{"$f":"'5'!E38","v":""},{"$f":"'5'!F38","v":"5.2.1.6"},{"$f":"'5'!G38","v":0},{"$f":"'5'!H38","v":0},{"$f":"'5'!I38","v":"5.2.1.6.3"},{"$f":"'5'!J38","v":"5.2.1.6.3: Is there a formal process for approval of all network connections and changes to firewall and router configurations?\n"},{"$f":"'5'!K38","v":"1) Network security policy (or equivalent documents) or firewall/router rules documentation\n- Check that there is a process for approving:\n     a) all network connections\n     b) all router configurations\n"},{"$f":"'5'!L38","v":0},{"$f":"'5'!M38","v":"Urgent Required"},{"$f":"'5'!N38","v":"Required"},{"$f":"'5'!O38","v":"TechOps"},{"$f":"'5'!P38","v":0},{"$f":"'5'!Q38","v":0},{"$f":"'5'!R38","v":0},{"$f":"'5'!S38","v":0},{"$f":"'5'!T38","v":0},{"$f":"'5'!U38","v":0},{"$f":"'5'!V38","v":0},{"$f":"'5'!W38","v":0},{"$f":"'5'!X38","v":0},{"$f":"'5'!Y38","v":0},{"$f":"'5'!Z38","v":0},{"$f":"'5'!AA38","v":0},{"$f":"'5'!AB38","v":0},{"$f":"'5'!AC38","v":0},{"$f":"'5'!AD38","v":0},{"$f":"'5'!AE38","v":0},{"$f":"'5'!AF38","v":0},{"$f":"'5'!AG38","v":0},{"$f":"'5'!AH38","v":0},{"$f":"'5'!AI38","v":0},{"$f":"'5'!AJ38","v":0},{"$f":"'5'!AK38","v":0},{"$f":"'5'!AL38","v":0},{"$f":"'5'!AM38","v":0},{"$f":"'5'!AN38","v":0},{"$f":"'5'!AO38","v":0},{"$f":"'5'!AP38","v":0},{"$f":"'5'!AQ38","v":0},{"$f":"'5'!AR38","v":0},{"$f":"'5'!AS38","v":0},{"$f":"'5'!AT38","v":0},{"$f":"SUMPRODUCT(IF($N383=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N383=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B39","v":"5"},{"$f":"'5'!C39","v":"5.2"},{"$f":"'5'!D39","v":"5.2.1"},{"$f":"'5'!E39","v":""},{"$f":"'5'!F39","v":"5.2.1.6"},{"$f":"'5'!G39","v":0},{"$f":"'5'!H39","v":0},{"$f":"'5'!I39","v":"5.2.1.6.4"},{"$f":"'5'!J39","v":"5.2.1.6.4: Is there a network diagram identifying connections within the mobile money network environment and to external networks?\n"},{"$f":"'5'!K39","v":"1) Network Diagram\n- Check that there is a network diagram details connections within the mobile money network environment and to the external network\n\n"},{"$f":"'5'!L39","v":0},{"$f":"'5'!M39","v":"Standard Required"},{"$f":"'5'!N39","v":"Required"},{"$f":"'5'!O39","v":"TechOps"},{"$f":"'5'!P39","v":0},{"$f":"'5'!Q39","v":0},{"$f":"'5'!R39","v":0},{"$f":"'5'!S39","v":0},{"$f":"'5'!T39","v":0},{"$f":"'5'!U39","v":0},{"$f":"'5'!V39","v":0},{"$f":"'5'!W39","v":0},{"$f":"'5'!X39","v":0},{"$f":"'5'!Y39","v":0},{"$f":"'5'!Z39","v":0},{"$f":"'5'!AA39","v":0},{"$f":"'5'!AB39","v":0},{"$f":"'5'!AC39","v":0},{"$f":"'5'!AD39","v":0},{"$f":"'5'!AE39","v":0},{"$f":"'5'!AF39","v":0},{"$f":"'5'!AG39","v":0},{"$f":"'5'!AH39","v":0},{"$f":"'5'!AI39","v":0},{"$f":"'5'!AJ39","v":0},{"$f":"'5'!AK39","v":0},{"$f":"'5'!AL39","v":0},{"$f":"'5'!AM39","v":0},{"$f":"'5'!AN39","v":0},{"$f":"'5'!AO39","v":0},{"$f":"'5'!AP39","v":0},{"$f":"'5'!AQ39","v":0},{"$f":"'5'!AR39","v":0},{"$f":"'5'!AS39","v":0},{"$f":"'5'!AT39","v":0},{"$f":"SUMPRODUCT(IF($N384=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N384=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B40","v":"5"},{"$f":"'5'!C40","v":"5.2"},{"$f":"'5'!D40","v":"5.2.1"},{"$f":"'5'!E40","v":""},{"$f":"'5'!F40","v":"5.2.1.6"},{"$f":"'5'!G40","v":0},{"$f":"'5'!H40","v":0},{"$f":"'5'!I40","v":"5.2.1.6.5"},{"$f":"'5'!J40","v":"5.2.1.6.5: Are all firewall and router configuration files secure and backed up regularly?\n"},{"$f":"'5'!K40","v":0},{"$f":"'5'!L40","v":0},{"$f":"'5'!M40","v":"Recommended"},{"$f":"'5'!N40","v":"Recommended"},{"$f":"'5'!O40","v":"TechOps"},{"$f":"'5'!P40","v":0},{"$f":"'5'!Q40","v":0},{"$f":"'5'!R40","v":0},{"$f":"'5'!S40","v":0},{"$f":"'5'!T40","v":0},{"$f":"'5'!U40","v":0},{"$f":"'5'!V40","v":0},{"$f":"'5'!W40","v":0},{"$f":"'5'!X40","v":0},{"$f":"'5'!Y40","v":0},{"$f":"'5'!Z40","v":0},{"$f":"'5'!AA40","v":0},{"$f":"'5'!AB40","v":0},{"$f":"'5'!AC40","v":0},{"$f":"'5'!AD40","v":0},{"$f":"'5'!AE40","v":0},{"$f":"'5'!AF40","v":0},{"$f":"'5'!AG40","v":0},{"$f":"'5'!AH40","v":0},{"$f":"'5'!AI40","v":0},{"$f":"'5'!AJ40","v":0},{"$f":"'5'!AK40","v":0},{"$f":"'5'!AL40","v":0},{"$f":"'5'!AM40","v":0},{"$f":"'5'!AN40","v":0},{"$f":"'5'!AO40","v":0},{"$f":"'5'!AP40","v":0},{"$f":"'5'!AQ40","v":0},{"$f":"'5'!AR40","v":0},{"$f":"'5'!AS40","v":0},{"$f":"'5'!AT40","v":0},{"$f":"SUMPRODUCT(IF($N385=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N385=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B41","v":"5"},{"$f":"'5'!C41","v":"5.2"},{"$f":"'5'!D41","v":"5.2.1"},{"$f":"'5'!E41","v":""},{"$f":"'5'!F41","v":"5.2.1.6"},{"$f":"'5'!G41","v":0},{"$f":"'5'!H41","v":0},{"$f":"'5'!I41","v":"5.2.1.6.6"},{"$f":"'5'!J41","v":"5.2.1.6.6: Are firewall and router rule sets reviewed at least every six months?\n"},{"$f":"'5'!K41","v":0},{"$f":"'5'!L41","v":0},{"$f":"'5'!M41","v":"Recommended"},{"$f":"'5'!N41","v":"Recommended"},{"$f":"'5'!O41","v":"TechOps"},{"$f":"'5'!P41","v":0},{"$f":"'5'!Q41","v":0},{"$f":"'5'!R41","v":0},{"$f":"'5'!S41","v":0},{"$f":"'5'!T41","v":0},{"$f":"'5'!U41","v":0},{"$f":"'5'!V41","v":0},{"$f":"'5'!W41","v":0},{"$f":"'5'!X41","v":0},{"$f":"'5'!Y41","v":0},{"$f":"'5'!Z41","v":0},{"$f":"'5'!AA41","v":0},{"$f":"'5'!AB41","v":0},{"$f":"'5'!AC41","v":0},{"$f":"'5'!AD41","v":0},{"$f":"'5'!AE41","v":0},{"$f":"'5'!AF41","v":0},{"$f":"'5'!AG41","v":0},{"$f":"'5'!AH41","v":0},{"$f":"'5'!AI41","v":0},{"$f":"'5'!AJ41","v":0},{"$f":"'5'!AK41","v":0},{"$f":"'5'!AL41","v":0},{"$f":"'5'!AM41","v":0},{"$f":"'5'!AN41","v":0},{"$f":"'5'!AO41","v":0},{"$f":"'5'!AP41","v":0},{"$f":"'5'!AQ41","v":0},{"$f":"'5'!AR41","v":0},{"$f":"'5'!AS41","v":0},{"$f":"'5'!AT41","v":0},{"$f":"SUMPRODUCT(IF($N386=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N386=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B42","v":"5"},{"$f":"'5'!C42","v":"5.2"},{"$f":"'5'!D42","v":"5.2.1"},{"$f":"'5'!E42","v":0},{"$f":"'5'!F42","v":"5.2.1.6"},{"$f":"'5'!G42","v":0},{"$f":"'5'!H42","v":0},{"$f":"'5'!I42","v":"5.2.1.6.7"},{"$f":"'5'!J42","v":"5.2.1.6.7: Are measures in place to prevent devices from being simultaneously connected to the organization’s trusted internal network and untrusted external network?\n(e.g. establishing connectivity via Ethernet adapter and wireless adapter on the same device).\n"},{"$f":"'5'!K42","v":0},{"$f":"'5'!L42","v":0},{"$f":"'5'!M42","v":"Recommended"},{"$f":"'5'!N42","v":"Recommended"},{"$f":"'5'!O42","v":"TechOps"},{"$f":"'5'!P42","v":0},{"$f":"'5'!Q42","v":0},{"$f":"'5'!R42","v":0},{"$f":"'5'!S42","v":0},{"$f":"'5'!T42","v":0},{"$f":"'5'!U42","v":0},{"$f":"'5'!V42","v":0},{"$f":"'5'!W42","v":0},{"$f":"'5'!X42","v":0},{"$f":"'5'!Y42","v":0},{"$f":"'5'!Z42","v":0},{"$f":"'5'!AA42","v":0},{"$f":"'5'!AB42","v":0},{"$f":"'5'!AC42","v":0},{"$f":"'5'!AD42","v":0},{"$f":"'5'!AE42","v":0},{"$f":"'5'!AF42","v":0},{"$f":"'5'!AG42","v":0},{"$f":"'5'!AH42","v":0},{"$f":"'5'!AI42","v":0},{"$f":"'5'!AJ42","v":0},{"$f":"'5'!AK42","v":0},{"$f":"'5'!AL42","v":0},{"$f":"'5'!AM42","v":0},{"$f":"'5'!AN42","v":0},{"$f":"'5'!AO42","v":0},{"$f":"'5'!AP42","v":0},{"$f":"'5'!AQ42","v":0},{"$f":"'5'!AR42","v":0},{"$f":"'5'!AS42","v":0},{"$f":"'5'!AT42","v":0},{"$f":"SUMPRODUCT(IF($N387=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N387=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B43","v":"5"},{"$f":"'5'!C43","v":"5.2"},{"$f":"'5'!D43","v":"5.2.2"},{"$f":"'5'!E43","v":"5.2.2: Providers shall ensure that systems and applications are designed and developed securely and are thoroughly tested"},{"$f":"'5'!F43","v":"5.2.2.1"},{"$f":"'5'!G43","v":"5.2.2.1: SECURE SOFTWARE DEVELOPMENT PROCESSES\nCustom development of mobile money system software should be developed using secure processes. Industry standard best practices should be followed (e.g. ISO 27034-01:2011, PCI-DSS v3.0) as well as other recommended practices (for example, secure authentication and logging). This practice is applicable to custom software development by either internal staff or outsourced suppliers.\n\nInformation security should be incorporated throughout the software-development life cycle to ensure that secure software is developed. \n\nProviders should train developers in secure coding techniques, including how to avoid common coding vulnerabilities, understanding how sensitive data is handled in memory, and developing applications based on secure coding guidelines."},{"$f":"'5'!H43","v":"PCI DSS, ISO 27002:2013 Sec. 14.2 "},{"$f":"'5'!I43","v":"5.2.2.1.1"},{"$f":"'5'!J43","v":"5.2.2.1.1: Are custom developments of mobile money system software developed using secure processes throughout the software development life cycle, following industry standard best practices?\n"},{"$f":"'5'!K43","v":0},{"$f":"'5'!L43","v":0},{"$f":"'5'!M43","v":"Recommended"},{"$f":"'5'!N43","v":"Recommended"},{"$f":"'5'!O43","v":"TechOps"},{"$f":"'5'!P43","v":0},{"$f":"'5'!Q43","v":0},{"$f":"'5'!R43","v":0},{"$f":"'5'!S43","v":0},{"$f":"'5'!T43","v":0},{"$f":"'5'!U43","v":0},{"$f":"'5'!V43","v":0},{"$f":"'5'!W43","v":0},{"$f":"'5'!X43","v":0},{"$f":"'5'!Y43","v":0},{"$f":"'5'!Z43","v":0},{"$f":"'5'!AA43","v":0},{"$f":"'5'!AB43","v":0},{"$f":"'5'!AC43","v":0},{"$f":"'5'!AD43","v":0},{"$f":"'5'!AE43","v":0},{"$f":"'5'!AF43","v":0},{"$f":"'5'!AG43","v":0},{"$f":"'5'!AH43","v":0},{"$f":"'5'!AI43","v":0},{"$f":"'5'!AJ43","v":0},{"$f":"'5'!AK43","v":0},{"$f":"'5'!AL43","v":0},{"$f":"'5'!AM43","v":0},{"$f":"'5'!AN43","v":0},{"$f":"'5'!AO43","v":0},{"$f":"'5'!AP43","v":0},{"$f":"'5'!AQ43","v":0},{"$f":"'5'!AR43","v":0},{"$f":"'5'!AS43","v":0},{"$f":"'5'!AT43","v":0},{"$f":"SUMPRODUCT(IF($N388=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N388=CategoryRecommended,1,0))","v":1},{"$f":"_xlfn.IFNA(MATCH($Q388,ComplianceYes,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q388,CompliancePartial,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q388,ComplianceNo,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q388,ComplianceNA,0),0)","v":0},{"$f":"$AU388*AW388","v":0},{"$f":"$AU388*AX388","v":0},{"$f":"$AU388*AY388","v":0},{"$f":"$AU388*AZ388","v":0},{"$f":"$AV388*AW388","v":0},{"$f":"$AV388*AX388","v":0},{"$f":"$AV388*AY388","v":0},{"$f":"$AV388*AZ388","v":0},{"$f":"_xlfn.IFNA(MATCH($AF388,ComplianceYes,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF388,CompliancePartial,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF388,ComplianceNo,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF388,ComplianceNA,0),0)","v":0},0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B44","v":"5"},{"$f":"'5'!C44","v":"5.2"},{"$f":"'5'!D44","v":"5.2.2"},{"$f":"'5'!E44","v":0},{"$f":"'5'!F44","v":"5.2.2.1"},{"$f":"'5'!G44","v":0},{"$f":"'5'!H44","v":0},{"$f":"'5'!I44","v":"5.2.2.1.2"},{"$f":"'5'!J44","v":"5.2.2.1.2: Is best practice for development of secure software enforced on entities providing outsourced software development services?\n"},{"$f":"'5'!K44","v":0},{"$f":"'5'!L44","v":0},{"$f":"'5'!M44","v":"Recommended"},{"$f":"'5'!N44","v":"Recommended"},{"$f":"'5'!O44","v":"TechOps"},{"$f":"'5'!P44","v":0},{"$f":"'5'!Q44","v":0},{"$f":"'5'!R44","v":0},{"$f":"'5'!S44","v":0},{"$f":"'5'!T44","v":0},{"$f":"'5'!U44","v":0},{"$f":"'5'!V44","v":0},{"$f":"'5'!W44","v":0},{"$f":"'5'!X44","v":0},{"$f":"'5'!Y44","v":0},{"$f":"'5'!Z44","v":0},{"$f":"'5'!AA44","v":0},{"$f":"'5'!AB44","v":0},{"$f":"'5'!AC44","v":0},{"$f":"'5'!AD44","v":0},{"$f":"'5'!AE44","v":0},{"$f":"'5'!AF44","v":0},{"$f":"'5'!AG44","v":0},{"$f":"'5'!AH44","v":0},{"$f":"'5'!AI44","v":0},{"$f":"'5'!AJ44","v":0},{"$f":"'5'!AK44","v":0},{"$f":"'5'!AL44","v":0},{"$f":"'5'!AM44","v":0},{"$f":"'5'!AN44","v":0},{"$f":"'5'!AO44","v":0},{"$f":"'5'!AP44","v":0},{"$f":"'5'!AQ44","v":0},{"$f":"'5'!AR44","v":0},{"$f":"'5'!AS44","v":0},{"$f":"'5'!AT44","v":0},{"$f":"SUMPRODUCT(IF($N389=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N389=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,{"$f":"$AU389*BI389","v":0},{"$f":"$AU389*BJ389","v":0},{"$f":"$AU389*BK389","v":0},{"$f":"$AU389*BL389","v":0},{"$f":"$AV389*BI389","v":0},{"$f":"$AV389*BJ389","v":0},{"$f":"$AV389*BK389","v":0},{"$f":"$AV389*BL389","v":0}]
[null,{"$f":"'5'!B45","v":"5"},{"$f":"'5'!C45","v":"5.2"},{"$f":"'5'!D45","v":"5.2.2"},{"$f":"'5'!E45","v":""},{"$f":"'5'!F45","v":"5.2.2.2"},{"$f":"'5'!G45","v":"5.2.2.2: DEVELOPMENT OF SECURE MOBILE MONEY SOFTWARE\nNew software for the mobile money system should be developed so that it is secure. This applies to any new software component that forms part of the mobile money system, including:\n  - MM core system;\n  - MM ancillary systems (e.g. for use of agents / business customers);\n  - MM integrations with external systems such as banks and ATMs.\n\nNew software should include the following security features:\n- protection of transactions from unauthorized distortion, falsification, readdressing and destruction;\n- authentication and authorization of all transaction requests;\n- authentication and authorization of sensitive back end operator activities; and\n- authentication and authorization of all automated processes and external systems.\n"},{"$f":"'5'!H45","v":"ISO 27015: 2012 Sec. 12.1, \nISO 27002: 2013 Sec. 14.2 \nPCI DSS"},{"$f":"'5'!I45","v":"5.2.2.2.1"},{"$f":"'5'!J45","v":"5.2.2.2.1: Does new software for the mobile money system include security features that ensure that transactions are protected from unauthorized distortion, falsification, readdressing and destruction?\n"},{"$f":"'5'!K45","v":0},{"$f":"'5'!L45","v":0},{"$f":"'5'!M45","v":"Recommended"},{"$f":"'5'!N45","v":"Recommended"},{"$f":"'5'!O45","v":"TechOps"},{"$f":"'5'!P45","v":0},{"$f":"'5'!Q45","v":0},{"$f":"'5'!R45","v":0},{"$f":"'5'!S45","v":0},{"$f":"'5'!T45","v":0},{"$f":"'5'!U45","v":0},{"$f":"'5'!V45","v":0},{"$f":"'5'!W45","v":0},{"$f":"'5'!X45","v":0},{"$f":"'5'!Y45","v":0},{"$f":"'5'!Z45","v":0},{"$f":"'5'!AA45","v":0},{"$f":"'5'!AB45","v":0},{"$f":"'5'!AC45","v":0},{"$f":"'5'!AD45","v":0},{"$f":"'5'!AE45","v":0},{"$f":"'5'!AF45","v":0},{"$f":"'5'!AG45","v":0},{"$f":"'5'!AH45","v":0},{"$f":"'5'!AI45","v":0},{"$f":"'5'!AJ45","v":0},{"$f":"'5'!AK45","v":0},{"$f":"'5'!AL45","v":0},{"$f":"'5'!AM45","v":0},{"$f":"'5'!AN45","v":0},{"$f":"'5'!AO45","v":0},{"$f":"'5'!AP45","v":0},{"$f":"'5'!AQ45","v":0},{"$f":"'5'!AR45","v":0},{"$f":"'5'!AS45","v":0},{"$f":"'5'!AT45","v":0},{"$f":"SUMPRODUCT(IF($N390=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N390=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B46","v":"5"},{"$f":"'5'!C46","v":"5.2"},{"$f":"'5'!D46","v":"5.2.2"},{"$f":"'5'!E46","v":""},{"$f":"'5'!F46","v":"5.2.2.2"},{"$f":"'5'!G46","v":0},{"$f":"'5'!H46","v":0},{"$f":"'5'!I46","v":"5.2.2.2.2"},{"$f":"'5'!J46","v":"5.2.2.2.2: Does new software for the mobile money system include security features that ensure that all automated processes and external systems are authenticated and authorized correctly?\n"},{"$f":"'5'!K46","v":0},{"$f":"'5'!L46","v":0},{"$f":"'5'!M46","v":"Recommended"},{"$f":"'5'!N46","v":"Recommended"},{"$f":"'5'!O46","v":"TechOps"},{"$f":"'5'!P46","v":0},{"$f":"'5'!Q46","v":0},{"$f":"'5'!R46","v":0},{"$f":"'5'!S46","v":0},{"$f":"'5'!T46","v":0},{"$f":"'5'!U46","v":0},{"$f":"'5'!V46","v":0},{"$f":"'5'!W46","v":0},{"$f":"'5'!X46","v":0},{"$f":"'5'!Y46","v":0},{"$f":"'5'!Z46","v":0},{"$f":"'5'!AA46","v":0},{"$f":"'5'!AB46","v":0},{"$f":"'5'!AC46","v":0},{"$f":"'5'!AD46","v":0},{"$f":"'5'!AE46","v":0},{"$f":"'5'!AF46","v":0},{"$f":"'5'!AG46","v":0},{"$f":"'5'!AH46","v":0},{"$f":"'5'!AI46","v":0},{"$f":"'5'!AJ46","v":0},{"$f":"'5'!AK46","v":0},{"$f":"'5'!AL46","v":0},{"$f":"'5'!AM46","v":0},{"$f":"'5'!AN46","v":0},{"$f":"'5'!AO46","v":0},{"$f":"'5'!AP46","v":0},{"$f":"'5'!AQ46","v":0},{"$f":"'5'!AR46","v":0},{"$f":"'5'!AS46","v":0},{"$f":"'5'!AT46","v":0},{"$f":"SUMPRODUCT(IF($N391=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N391=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B47","v":"5"},{"$f":"'5'!C47","v":"5.2"},{"$f":"'5'!D47","v":"5.2.2"},{"$f":"'5'!E47","v":"5.2.2: Providers shall ensure that systems and applications are designed and developed securely and are thoroughly tested"},{"$f":"'5'!F47","v":"5.2.2.3"},{"$f":"'5'!G47","v":"5.2.2.3: SECURE MOBILE MONEY SMARTPHONE APPS\nMobile applications accessible via public networks are especially subject to a range of threats. A security review of the mobile money smartphone app(s) should be carried out to ensure that controls have been properly implemented. A suitably qualified and trusted third party should also be used to validate and test the provider's mobile money apps to certify that they are secure and conform to suitable security standards.\n\nInformation security considerations for mobile application transactions should include the following:\n-   Client-side authentication by the app should not be used. The user's authentication information should be presented by the app for every call to the system.\n-   User credentials and transaction information should be held securely by the app (and not stored in log files, for example).\n-   Transaction notifications and messages should be sent and received within the app and stored securely, not via SMS.\n-   Client and server should identify themselves with trusted certificates and the communications path between all parties should be encrypted (see 5.2.1.3).\n\nMark these indicators as N/A if a smartphone app is not supported."},{"$f":"'5'!H47","v":"PCI DSS, ISO 27002:2013 Sec. 14.1,\nFlorida uni app review"},{"$f":"'5'!I47","v":"5.2.2.3.1"},{"$f":"'5'!J47","v":"5.2.2.3.1: Has a qualified and trusted third party been employed to validate and test the provider's mobile money app(s) to certify that they are secure and conform to suitable security standards?\n"},{"$f":"'5'!K47","v":"1) Secure development requirements documentation or third party smartphone test report\n- Check that a third party has been employed to test the providers mobile money app(s)\n- Check that third party is qualified and trusted to carry out the validation and testing\n- Check that an assessment has been made to identify which security standards are required for the providers app(s)\n- Check that the third party has certified against the identified security standard"},{"$f":"'5'!L47","v":0},{"$f":"'5'!M47","v":"Standard Required"},{"$f":"'5'!N47","v":"Required"},{"$f":"'5'!O47","v":"TechOps"},{"$f":"'5'!P47","v":0},{"$f":"'5'!Q47","v":0},{"$f":"'5'!R47","v":0},{"$f":"'5'!S47","v":0},{"$f":"'5'!T47","v":0},{"$f":"'5'!U47","v":0},{"$f":"'5'!V47","v":0},{"$f":"'5'!W47","v":0},{"$f":"'5'!X47","v":0},{"$f":"'5'!Y47","v":0},{"$f":"'5'!Z47","v":0},{"$f":"'5'!AA47","v":0},{"$f":"'5'!AB47","v":0},{"$f":"'5'!AC47","v":0},{"$f":"'5'!AD47","v":0},{"$f":"'5'!AE47","v":0},{"$f":"'5'!AF47","v":0},{"$f":"'5'!AG47","v":0},{"$f":"'5'!AH47","v":0},{"$f":"'5'!AI47","v":0},{"$f":"'5'!AJ47","v":0},{"$f":"'5'!AK47","v":0},{"$f":"'5'!AL47","v":0},{"$f":"'5'!AM47","v":0},{"$f":"'5'!AN47","v":0},{"$f":"'5'!AO47","v":0},{"$f":"'5'!AP47","v":0},{"$f":"'5'!AQ47","v":0},{"$f":"'5'!AR47","v":0},{"$f":"'5'!AS47","v":0},{"$f":"'5'!AT47","v":0},{"$f":"SUMPRODUCT(IF($N392=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N392=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B48","v":"5"},{"$f":"'5'!C48","v":"5.2"},{"$f":"'5'!D48","v":"5.2.2"},{"$f":"'5'!E48","v":""},{"$f":"'5'!F48","v":"5.2.2.3"},{"$f":"'5'!G48","v":0},{"$f":"'5'!H48","v":0},{"$f":"'5'!I48","v":"5.2.2.3.2"},{"$f":"'5'!J48","v":"5.2.2.3.2: Is authentication of the mobile money app(s) secure (i.e., no use of client-side authentication; the user's authentication information is presented by the app for every call to the system)?\n"},{"$f":"'5'!K48","v":0},{"$f":"'5'!L48","v":0},{"$f":"'5'!M48","v":"Recommended"},{"$f":"'5'!N48","v":"Recommended"},{"$f":"'5'!O48","v":"TechOps"},{"$f":"'5'!P48","v":0},{"$f":"'5'!Q48","v":0},{"$f":"'5'!R48","v":0},{"$f":"'5'!S48","v":0},{"$f":"'5'!T48","v":0},{"$f":"'5'!U48","v":0},{"$f":"'5'!V48","v":0},{"$f":"'5'!W48","v":0},{"$f":"'5'!X48","v":0},{"$f":"'5'!Y48","v":0},{"$f":"'5'!Z48","v":0},{"$f":"'5'!AA48","v":0},{"$f":"'5'!AB48","v":0},{"$f":"'5'!AC48","v":0},{"$f":"'5'!AD48","v":0},{"$f":"'5'!AE48","v":0},{"$f":"'5'!AF48","v":0},{"$f":"'5'!AG48","v":0},{"$f":"'5'!AH48","v":0},{"$f":"'5'!AI48","v":0},{"$f":"'5'!AJ48","v":0},{"$f":"'5'!AK48","v":0},{"$f":"'5'!AL48","v":0},{"$f":"'5'!AM48","v":0},{"$f":"'5'!AN48","v":0},{"$f":"'5'!AO48","v":0},{"$f":"'5'!AP48","v":0},{"$f":"'5'!AQ48","v":0},{"$f":"'5'!AR48","v":0},{"$f":"'5'!AS48","v":0},{"$f":"'5'!AT48","v":0},{"$f":"SUMPRODUCT(IF($N393=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N393=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B49","v":"5"},{"$f":"'5'!C49","v":"5.2"},{"$f":"'5'!D49","v":"5.2.2"},{"$f":"'5'!E49","v":""},{"$f":"'5'!F49","v":"5.2.2.3"},{"$f":"'5'!G49","v":0},{"$f":"'5'!H49","v":0},{"$f":"'5'!I49","v":"5.2.2.3.3"},{"$f":"'5'!J49","v":"5.2.2.3.3: Are user credentials and transaction information held securely by the mobile money app(s) (and not stored in log files, for example)?\n"},{"$f":"'5'!K49","v":0},{"$f":"'5'!L49","v":0},{"$f":"'5'!M49","v":"Recommended"},{"$f":"'5'!N49","v":"Recommended"},{"$f":"'5'!O49","v":"TechOps"},{"$f":"'5'!P49","v":0},{"$f":"'5'!Q49","v":0},{"$f":"'5'!R49","v":0},{"$f":"'5'!S49","v":0},{"$f":"'5'!T49","v":0},{"$f":"'5'!U49","v":0},{"$f":"'5'!V49","v":0},{"$f":"'5'!W49","v":0},{"$f":"'5'!X49","v":0},{"$f":"'5'!Y49","v":0},{"$f":"'5'!Z49","v":0},{"$f":"'5'!AA49","v":0},{"$f":"'5'!AB49","v":0},{"$f":"'5'!AC49","v":0},{"$f":"'5'!AD49","v":0},{"$f":"'5'!AE49","v":0},{"$f":"'5'!AF49","v":0},{"$f":"'5'!AG49","v":0},{"$f":"'5'!AH49","v":0},{"$f":"'5'!AI49","v":0},{"$f":"'5'!AJ49","v":0},{"$f":"'5'!AK49","v":0},{"$f":"'5'!AL49","v":0},{"$f":"'5'!AM49","v":0},{"$f":"'5'!AN49","v":0},{"$f":"'5'!AO49","v":0},{"$f":"'5'!AP49","v":0},{"$f":"'5'!AQ49","v":0},{"$f":"'5'!AR49","v":0},{"$f":"'5'!AS49","v":0},{"$f":"'5'!AT49","v":0},{"$f":"SUMPRODUCT(IF($N394=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N394=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B50","v":"5"},{"$f":"'5'!C50","v":"5.2"},{"$f":"'5'!D50","v":"5.2.2"},{"$f":"'5'!E50","v":""},{"$f":"'5'!F50","v":"5.2.2.3"},{"$f":"'5'!G50","v":0},{"$f":"'5'!H50","v":0},{"$f":"'5'!I50","v":"5.2.2.3.4"},{"$f":"'5'!J50","v":"5.2.2.3.4: Are transaction notifications and messages sent and received within the mobile money app(s) and stored securely, and not exchanged via SMS?\n"},{"$f":"'5'!K50","v":0},{"$f":"'5'!L50","v":0},{"$f":"'5'!M50","v":"Recommended"},{"$f":"'5'!N50","v":"Recommended"},{"$f":"'5'!O50","v":"TechOps"},{"$f":"'5'!P50","v":0},{"$f":"'5'!Q50","v":0},{"$f":"'5'!R50","v":0},{"$f":"'5'!S50","v":0},{"$f":"'5'!T50","v":0},{"$f":"'5'!U50","v":0},{"$f":"'5'!V50","v":0},{"$f":"'5'!W50","v":0},{"$f":"'5'!X50","v":0},{"$f":"'5'!Y50","v":0},{"$f":"'5'!Z50","v":0},{"$f":"'5'!AA50","v":0},{"$f":"'5'!AB50","v":0},{"$f":"'5'!AC50","v":0},{"$f":"'5'!AD50","v":0},{"$f":"'5'!AE50","v":0},{"$f":"'5'!AF50","v":0},{"$f":"'5'!AG50","v":0},{"$f":"'5'!AH50","v":0},{"$f":"'5'!AI50","v":0},{"$f":"'5'!AJ50","v":0},{"$f":"'5'!AK50","v":0},{"$f":"'5'!AL50","v":0},{"$f":"'5'!AM50","v":0},{"$f":"'5'!AN50","v":0},{"$f":"'5'!AO50","v":0},{"$f":"'5'!AP50","v":0},{"$f":"'5'!AQ50","v":0},{"$f":"'5'!AR50","v":0},{"$f":"'5'!AS50","v":0},{"$f":"'5'!AT50","v":0},{"$f":"SUMPRODUCT(IF($N395=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N395=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B51","v":"5"},{"$f":"'5'!C51","v":"5.2"},{"$f":"'5'!D51","v":"5.2.2"},{"$f":"'5'!E51","v":""},{"$f":"'5'!F51","v":"5.2.2.3"},{"$f":"'5'!G51","v":0},{"$f":"'5'!H51","v":0},{"$f":"'5'!I51","v":"5.2.2.3.5"},{"$f":"'5'!J51","v":"5.2.2.3.5: In mobile money app communication, do client and server identify themselves with trusted certificates and is the communications path between all parties encrypted?\n"},{"$f":"'5'!K51","v":0},{"$f":"'5'!L51","v":0},{"$f":"'5'!M51","v":"Recommended"},{"$f":"'5'!N51","v":"Recommended"},{"$f":"'5'!O51","v":"TechOps"},{"$f":"'5'!P51","v":0},{"$f":"'5'!Q51","v":0},{"$f":"'5'!R51","v":0},{"$f":"'5'!S51","v":0},{"$f":"'5'!T51","v":0},{"$f":"'5'!U51","v":0},{"$f":"'5'!V51","v":0},{"$f":"'5'!W51","v":0},{"$f":"'5'!X51","v":0},{"$f":"'5'!Y51","v":0},{"$f":"'5'!Z51","v":0},{"$f":"'5'!AA51","v":0},{"$f":"'5'!AB51","v":0},{"$f":"'5'!AC51","v":0},{"$f":"'5'!AD51","v":0},{"$f":"'5'!AE51","v":0},{"$f":"'5'!AF51","v":0},{"$f":"'5'!AG51","v":0},{"$f":"'5'!AH51","v":0},{"$f":"'5'!AI51","v":0},{"$f":"'5'!AJ51","v":0},{"$f":"'5'!AK51","v":0},{"$f":"'5'!AL51","v":0},{"$f":"'5'!AM51","v":0},{"$f":"'5'!AN51","v":0},{"$f":"'5'!AO51","v":0},{"$f":"'5'!AP51","v":0},{"$f":"'5'!AQ51","v":0},{"$f":"'5'!AR51","v":0},{"$f":"'5'!AS51","v":0},{"$f":"'5'!AT51","v":0},{"$f":"SUMPRODUCT(IF($N396=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N396=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B52","v":"5"},{"$f":"'5'!C52","v":"5.2"},{"$f":"'5'!D52","v":"5.2.2"},{"$f":"'5'!E52","v":""},{"$f":"'5'!F52","v":"5.2.2.4"},{"$f":"'5'!G52","v":"5.2.2.4: SECURITY TESTING OF NEW MOBILE MONEY SOFTWARE\nProviders should test major changes to software prior to release into production in order to identify any potential security vulnerabilities. Security testing should include all system components involved in providing the mobile money service (application servers, databases, gateways, etc.) and also handset and other terminals such as smartphones and PoS devices. For more information, please refer to security testing in the definitions.\n\nSecurity testing should be part of Operational Acceptance Testing (OAT) in the software release process (refer to 4.5.1.3). \n\nAutomated security testing is a useful tool but is not sufficient to discover all security weaknesses, so manual white-box security testing should also be performed.\n\nSecurity testing should be performed by individuals other than the originating code author. Security testers should be knowledgeable about code-review techniques and secure coding practices. Significant changes should be reviewed by external security experts before release. \n\nSecurity issues should be risk-assessed and higher-risk bugs fixed before software is released to production."},{"$f":"'5'!H52","v":"PCI-DSS, ISO 27002:2013 Sec. 14.2 "},{"$f":"'5'!I52","v":"5.2.2.4.1"},{"$f":"'5'!J52","v":"5.2.2.4.1: Is security testing done on all major software changes to the mobile money system prior to release into production?\n"},{"$f":"'5'!K52","v":"1) Security testing process documentation\n- Check there is a process for security testing of all major software changes.\n- Check the process requires testing to be completed prior to the release into production."},{"$f":"'5'!L52","v":0},{"$f":"'5'!M52","v":"Urgent Required"},{"$f":"'5'!N52","v":"Required"},{"$f":"'5'!O52","v":"TechOps"},{"$f":"'5'!P52","v":0},{"$f":"'5'!Q52","v":0},{"$f":"'5'!R52","v":0},{"$f":"'5'!S52","v":0},{"$f":"'5'!T52","v":0},{"$f":"'5'!U52","v":0},{"$f":"'5'!V52","v":0},{"$f":"'5'!W52","v":0},{"$f":"'5'!X52","v":0},{"$f":"'5'!Y52","v":0},{"$f":"'5'!Z52","v":0},{"$f":"'5'!AA52","v":0},{"$f":"'5'!AB52","v":0},{"$f":"'5'!AC52","v":0},{"$f":"'5'!AD52","v":0},{"$f":"'5'!AE52","v":0},{"$f":"'5'!AF52","v":0},{"$f":"'5'!AG52","v":0},{"$f":"'5'!AH52","v":0},{"$f":"'5'!AI52","v":0},{"$f":"'5'!AJ52","v":0},{"$f":"'5'!AK52","v":0},{"$f":"'5'!AL52","v":0},{"$f":"'5'!AM52","v":0},{"$f":"'5'!AN52","v":0},{"$f":"'5'!AO52","v":0},{"$f":"'5'!AP52","v":0},{"$f":"'5'!AQ52","v":0},{"$f":"'5'!AR52","v":0},{"$f":"'5'!AS52","v":0},{"$f":"'5'!AT52","v":0},{"$f":"SUMPRODUCT(IF($N397=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N397=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B53","v":"5"},{"$f":"'5'!C53","v":"5.2"},{"$f":"'5'!D53","v":"5.2.2"},{"$f":"'5'!E53","v":""},{"$f":"'5'!F53","v":"5.2.2.4"},{"$f":"'5'!G53","v":0},{"$f":"'5'!H53","v":0},{"$f":"'5'!I53","v":"5.2.2.4.2"},{"$f":"'5'!J53","v":"5.2.2.4.2: Are all security issues risk-assessed and higher-risk bugs fixed before software is released to production?\n"},{"$f":"'5'!K53","v":"1) Security testing process documentation\n- Check that the process requires all security issues to be risk-assessed and higher-risk bugs fixed before software is released to production."},{"$f":"'5'!L53","v":0},{"$f":"'5'!M53","v":"Standard Required"},{"$f":"'5'!N53","v":"Required"},{"$f":"'5'!O53","v":"TechOps"},{"$f":"'5'!P53","v":0},{"$f":"'5'!Q53","v":0},{"$f":"'5'!R53","v":0},{"$f":"'5'!S53","v":0},{"$f":"'5'!T53","v":0},{"$f":"'5'!U53","v":0},{"$f":"'5'!V53","v":0},{"$f":"'5'!W53","v":0},{"$f":"'5'!X53","v":0},{"$f":"'5'!Y53","v":0},{"$f":"'5'!Z53","v":0},{"$f":"'5'!AA53","v":0},{"$f":"'5'!AB53","v":0},{"$f":"'5'!AC53","v":0},{"$f":"'5'!AD53","v":0},{"$f":"'5'!AE53","v":0},{"$f":"'5'!AF53","v":0},{"$f":"'5'!AG53","v":0},{"$f":"'5'!AH53","v":0},{"$f":"'5'!AI53","v":0},{"$f":"'5'!AJ53","v":0},{"$f":"'5'!AK53","v":0},{"$f":"'5'!AL53","v":0},{"$f":"'5'!AM53","v":0},{"$f":"'5'!AN53","v":0},{"$f":"'5'!AO53","v":0},{"$f":"'5'!AP53","v":0},{"$f":"'5'!AQ53","v":0},{"$f":"'5'!AR53","v":0},{"$f":"'5'!AS53","v":0},{"$f":"'5'!AT53","v":0},{"$f":"SUMPRODUCT(IF($N398=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N398=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B54","v":"5"},{"$f":"'5'!C54","v":"5.2"},{"$f":"'5'!D54","v":"5.2.2"},{"$f":"'5'!E54","v":0},{"$f":"'5'!F54","v":"5.2.2.4"},{"$f":"'5'!G54","v":0},{"$f":"'5'!H54","v":0},{"$f":"'5'!I54","v":"5.2.2.4.3"},{"$f":"'5'!J54","v":"5.2.2.4.3: Does security testing of new software include testing of all system components of mobile money as well as handsets and other terminals (e.g. smartphones, PoS devices)?\n"},{"$f":"'5'!K54","v":0},{"$f":"'5'!L54","v":0},{"$f":"'5'!M54","v":"Recommended"},{"$f":"'5'!N54","v":"Recommended"},{"$f":"'5'!O54","v":"TechOps"},{"$f":"'5'!P54","v":0},{"$f":"'5'!Q54","v":0},{"$f":"'5'!R54","v":0},{"$f":"'5'!S54","v":0},{"$f":"'5'!T54","v":0},{"$f":"'5'!U54","v":0},{"$f":"'5'!V54","v":0},{"$f":"'5'!W54","v":0},{"$f":"'5'!X54","v":0},{"$f":"'5'!Y54","v":0},{"$f":"'5'!Z54","v":0},{"$f":"'5'!AA54","v":0},{"$f":"'5'!AB54","v":0},{"$f":"'5'!AC54","v":0},{"$f":"'5'!AD54","v":0},{"$f":"'5'!AE54","v":0},{"$f":"'5'!AF54","v":0},{"$f":"'5'!AG54","v":0},{"$f":"'5'!AH54","v":0},{"$f":"'5'!AI54","v":0},{"$f":"'5'!AJ54","v":0},{"$f":"'5'!AK54","v":0},{"$f":"'5'!AL54","v":0},{"$f":"'5'!AM54","v":0},{"$f":"'5'!AN54","v":0},{"$f":"'5'!AO54","v":0},{"$f":"'5'!AP54","v":0},{"$f":"'5'!AQ54","v":0},{"$f":"'5'!AR54","v":0},{"$f":"'5'!AS54","v":0},{"$f":"'5'!AT54","v":0},{"$f":"SUMPRODUCT(IF($N399=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N399=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B55","v":"5"},{"$f":"'5'!C55","v":"5.2"},{"$f":"'5'!D55","v":"5.2.2"},{"$f":"'5'!E55","v":""},{"$f":"'5'!F55","v":"5.2.2.4"},{"$f":"'5'!G55","v":0},{"$f":"'5'!H55","v":0},{"$f":"'5'!I55","v":"5.2.2.4.4"},{"$f":"'5'!J55","v":"5.2.2.4.4: Is new software reviewed by individuals other than the originating code author who are knowledgeable about code-review techniques and secure coding practices?\n"},{"$f":"'5'!K55","v":0},{"$f":"'5'!L55","v":0},{"$f":"'5'!M55","v":"Recommended"},{"$f":"'5'!N55","v":"Recommended"},{"$f":"'5'!O55","v":"TechOps"},{"$f":"'5'!P55","v":0},{"$f":"'5'!Q55","v":0},{"$f":"'5'!R55","v":0},{"$f":"'5'!S55","v":0},{"$f":"'5'!T55","v":0},{"$f":"'5'!U55","v":0},{"$f":"'5'!V55","v":0},{"$f":"'5'!W55","v":0},{"$f":"'5'!X55","v":0},{"$f":"'5'!Y55","v":0},{"$f":"'5'!Z55","v":0},{"$f":"'5'!AA55","v":0},{"$f":"'5'!AB55","v":0},{"$f":"'5'!AC55","v":0},{"$f":"'5'!AD55","v":0},{"$f":"'5'!AE55","v":0},{"$f":"'5'!AF55","v":0},{"$f":"'5'!AG55","v":0},{"$f":"'5'!AH55","v":0},{"$f":"'5'!AI55","v":0},{"$f":"'5'!AJ55","v":0},{"$f":"'5'!AK55","v":0},{"$f":"'5'!AL55","v":0},{"$f":"'5'!AM55","v":0},{"$f":"'5'!AN55","v":0},{"$f":"'5'!AO55","v":0},{"$f":"'5'!AP55","v":0},{"$f":"'5'!AQ55","v":0},{"$f":"'5'!AR55","v":0},{"$f":"'5'!AS55","v":0},{"$f":"'5'!AT55","v":0},{"$f":"SUMPRODUCT(IF($N400=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N400=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B56","v":"5"},{"$f":"'5'!C56","v":"5.2"},{"$f":"'5'!D56","v":"5.2.2"},{"$f":"'5'!E56","v":""},{"$f":"'5'!F56","v":"5.2.2.5"},{"$f":"'5'!G56","v":"5.2.2.5: REMOVAL OF TEST DATA FROM SOFTWARE\nDevelopment and test accounts and test data should be removed from mobile money software before it is released to production, since these items may give away sensitive information or present back-doors for attackers.\n\nDevelopment code or compilers should also be removed from software before it is released into the live mobile money system.\n\nActual customer data should be anonymised if it is used in development or test environments (see also 8.1.1.9)."},{"$f":"'5'!H56","v":"PCI-DSS, ISO 27002:2013 Sec. 14.3 "},{"$f":"'5'!I56","v":"5.2.2.5.1"},{"$f":"'5'!J56","v":"5.2.2.5.1: Are development and test accounts and test data removed from mobile money software before it is released to production?\n"},{"$f":"'5'!K56","v":"1) User acceptance testing specification\n- Check that there is a process to remove all test accounts and test data from the mobile money system  software prior to its release to production"},{"$f":"'5'!L56","v":0},{"$f":"'5'!M56","v":"Standard Required"},{"$f":"'5'!N56","v":"Required"},{"$f":"'5'!O56","v":"TechOps"},{"$f":"'5'!P56","v":0},{"$f":"'5'!Q56","v":0},{"$f":"'5'!R56","v":0},{"$f":"'5'!S56","v":0},{"$f":"'5'!T56","v":0},{"$f":"'5'!U56","v":0},{"$f":"'5'!V56","v":0},{"$f":"'5'!W56","v":0},{"$f":"'5'!X56","v":0},{"$f":"'5'!Y56","v":0},{"$f":"'5'!Z56","v":0},{"$f":"'5'!AA56","v":0},{"$f":"'5'!AB56","v":0},{"$f":"'5'!AC56","v":0},{"$f":"'5'!AD56","v":0},{"$f":"'5'!AE56","v":0},{"$f":"'5'!AF56","v":0},{"$f":"'5'!AG56","v":0},{"$f":"'5'!AH56","v":0},{"$f":"'5'!AI56","v":0},{"$f":"'5'!AJ56","v":0},{"$f":"'5'!AK56","v":0},{"$f":"'5'!AL56","v":0},{"$f":"'5'!AM56","v":0},{"$f":"'5'!AN56","v":0},{"$f":"'5'!AO56","v":0},{"$f":"'5'!AP56","v":0},{"$f":"'5'!AQ56","v":0},{"$f":"'5'!AR56","v":0},{"$f":"'5'!AS56","v":0},{"$f":"'5'!AT56","v":0},{"$f":"SUMPRODUCT(IF($N401=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N401=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B57","v":"5"},{"$f":"'5'!C57","v":"5.2"},{"$f":"'5'!D57","v":"5.2.2"},{"$f":"'5'!E57","v":""},{"$f":"'5'!F57","v":"5.2.2.5"},{"$f":"'5'!G57","v":0},{"$f":"'5'!H57","v":0},{"$f":"'5'!I57","v":"5.2.2.5.2"},{"$f":"'5'!J57","v":"5.2.2.5.2: Are all development code and compilers removed from software before it is released into the live mobile money system?\n"},{"$f":"'5'!K57","v":"1) User acceptance testing specification\n- Check that there is a process to remove all code and compliers from the mobile money system  software prior to its release to production"},{"$f":"'5'!L57","v":0},{"$f":"'5'!M57","v":"Standard Required"},{"$f":"'5'!N57","v":"Required"},{"$f":"'5'!O57","v":"TechOps"},{"$f":"'5'!P57","v":0},{"$f":"'5'!Q57","v":0},{"$f":"'5'!R57","v":0},{"$f":"'5'!S57","v":0},{"$f":"'5'!T57","v":0},{"$f":"'5'!U57","v":0},{"$f":"'5'!V57","v":0},{"$f":"'5'!W57","v":0},{"$f":"'5'!X57","v":0},{"$f":"'5'!Y57","v":0},{"$f":"'5'!Z57","v":0},{"$f":"'5'!AA57","v":0},{"$f":"'5'!AB57","v":0},{"$f":"'5'!AC57","v":0},{"$f":"'5'!AD57","v":0},{"$f":"'5'!AE57","v":0},{"$f":"'5'!AF57","v":0},{"$f":"'5'!AG57","v":0},{"$f":"'5'!AH57","v":0},{"$f":"'5'!AI57","v":0},{"$f":"'5'!AJ57","v":0},{"$f":"'5'!AK57","v":0},{"$f":"'5'!AL57","v":0},{"$f":"'5'!AM57","v":0},{"$f":"'5'!AN57","v":0},{"$f":"'5'!AO57","v":0},{"$f":"'5'!AP57","v":0},{"$f":"'5'!AQ57","v":0},{"$f":"'5'!AR57","v":0},{"$f":"'5'!AS57","v":0},{"$f":"'5'!AT57","v":0},{"$f":"SUMPRODUCT(IF($N402=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N402=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B58","v":"5"},{"$f":"'5'!C58","v":"5.2"},{"$f":"'5'!D58","v":"5.2.2"},{"$f":"'5'!E58","v":""},{"$f":"'5'!F58","v":"5.2.2.5"},{"$f":"'5'!G58","v":0},{"$f":"'5'!H58","v":0},{"$f":"'5'!I58","v":"5.2.2.5.3"},{"$f":"'5'!J58","v":"5.2.2.5.3: If actual customer data is used in development or test environments, is it anonymised ?\n"},{"$f":"'5'!K58","v":"1) User acceptance testing specification\n- Check that there is a process to anonymise customer data if it is used in the development or test environments\n[Mark as N/A if customer data is not used for development/test purposes]"},{"$f":"'5'!L58","v":0},{"$f":"'5'!M58","v":"Standard Required"},{"$f":"'5'!N58","v":"Required"},{"$f":"'5'!O58","v":"TechOps"},{"$f":"'5'!P58","v":0},{"$f":"'5'!Q58","v":0},{"$f":"'5'!R58","v":0},{"$f":"'5'!S58","v":0},{"$f":"'5'!T58","v":0},{"$f":"'5'!U58","v":0},{"$f":"'5'!V58","v":0},{"$f":"'5'!W58","v":0},{"$f":"'5'!X58","v":0},{"$f":"'5'!Y58","v":0},{"$f":"'5'!Z58","v":0},{"$f":"'5'!AA58","v":0},{"$f":"'5'!AB58","v":0},{"$f":"'5'!AC58","v":0},{"$f":"'5'!AD58","v":0},{"$f":"'5'!AE58","v":0},{"$f":"'5'!AF58","v":0},{"$f":"'5'!AG58","v":0},{"$f":"'5'!AH58","v":0},{"$f":"'5'!AI58","v":0},{"$f":"'5'!AJ58","v":0},{"$f":"'5'!AK58","v":0},{"$f":"'5'!AL58","v":0},{"$f":"'5'!AM58","v":0},{"$f":"'5'!AN58","v":0},{"$f":"'5'!AO58","v":0},{"$f":"'5'!AP58","v":0},{"$f":"'5'!AQ58","v":0},{"$f":"'5'!AR58","v":0},{"$f":"'5'!AS58","v":0},{"$f":"'5'!AT58","v":0},{"$f":"SUMPRODUCT(IF($N403=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N403=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B59","v":"5"},{"$f":"'5'!C59","v":"5.2"},{"$f":"'5'!D59","v":"5.2.2"},{"$f":"'5'!E59","v":""},{"$f":"'5'!F59","v":"5.2.2.6"},{"$f":"'5'!G59","v":"5.2.2.6: VENDOR SOFTWARE VERSIONS AND SECURITY PATCHES\nVendor-supplied software used in the mobile money system should be maintained at a level supported by the supplier. In particular, security patches should be applied promptly.\n\nSecurity patches should be implemented as soon as possible after they  are released by vendors. Critical security patches should be installed within 30 days, and other lower-risk patches should be installed within 2-3 months. \n\nAny decision to upgrade to a new release should take into account the security of the release, including:\n- the introduction of new information security functionality; and\n- the number and severity of information security problems affecting the new release.\n\nSecurity patches should be implemented on all mobile money components, including:\n - infrastructure components (routers, gateways, etc.); and\n - application components (accounting system, middleware, etc.)."},{"$f":"'5'!H59","v":"PCI DSS, ISO 27002: 2013 Sec. 12.5, 14.1 "},{"$f":"'5'!I59","v":"5.2.2.6.1"},{"$f":"'5'!J59","v":"5.2.2.6.1: Are critical security patches from vendors prioritized and installed within one month of release on mobile money infrastructure components (routers, gateways, etc.)?\n"},{"$f":"'5'!K59","v":"1) Security Operations Manual or Technical Operations documentation\n- Check that there is a process for critical security patches from vendors to be installed on the mobile money infrastructure components\n- Check that infrastructure patches are installed within a month of release\n"},{"$f":"'5'!L59","v":0},{"$f":"'5'!M59","v":"Standard Required"},{"$f":"'5'!N59","v":"Required"},{"$f":"'5'!O59","v":"TechOps"},{"$f":"'5'!P59","v":0},{"$f":"'5'!Q59","v":0},{"$f":"'5'!R59","v":0},{"$f":"'5'!S59","v":0},{"$f":"'5'!T59","v":0},{"$f":"'5'!U59","v":0},{"$f":"'5'!V59","v":0},{"$f":"'5'!W59","v":0},{"$f":"'5'!X59","v":0},{"$f":"'5'!Y59","v":0},{"$f":"'5'!Z59","v":0},{"$f":"'5'!AA59","v":0},{"$f":"'5'!AB59","v":0},{"$f":"'5'!AC59","v":0},{"$f":"'5'!AD59","v":0},{"$f":"'5'!AE59","v":0},{"$f":"'5'!AF59","v":0},{"$f":"'5'!AG59","v":0},{"$f":"'5'!AH59","v":0},{"$f":"'5'!AI59","v":0},{"$f":"'5'!AJ59","v":0},{"$f":"'5'!AK59","v":0},{"$f":"'5'!AL59","v":0},{"$f":"'5'!AM59","v":0},{"$f":"'5'!AN59","v":0},{"$f":"'5'!AO59","v":0},{"$f":"'5'!AP59","v":0},{"$f":"'5'!AQ59","v":0},{"$f":"'5'!AR59","v":0},{"$f":"'5'!AS59","v":0},{"$f":"'5'!AT59","v":0},{"$f":"SUMPRODUCT(IF($N404=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N404=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B60","v":"5"},{"$f":"'5'!C60","v":"5.2"},{"$f":"'5'!D60","v":"5.2.2"},{"$f":"'5'!E60","v":""},{"$f":"'5'!F60","v":"5.2.2.6"},{"$f":"'5'!G60","v":0},{"$f":"'5'!H60","v":0},{"$f":"'5'!I60","v":"5.2.2.6.2"},{"$f":"'5'!J60","v":"5.2.2.6.2: Are critical security patches from vendors prioritized and installed within one month of release on mobile money application components (accounting system, middleware, etc.)?\n"},{"$f":"'5'!K60","v":"1) Security Operations Manual or Technical Operations documentation\n- Check that there is a process for critical security patches from vendors to be installed on the mobile money application components\n- Check that application patches are installed within a month of release\n"},{"$f":"'5'!L60","v":0},{"$f":"'5'!M60","v":"Standard Required"},{"$f":"'5'!N60","v":"Required"},{"$f":"'5'!O60","v":"TechOps"},{"$f":"'5'!P60","v":0},{"$f":"'5'!Q60","v":0},{"$f":"'5'!R60","v":0},{"$f":"'5'!S60","v":0},{"$f":"'5'!T60","v":0},{"$f":"'5'!U60","v":0},{"$f":"'5'!V60","v":0},{"$f":"'5'!W60","v":0},{"$f":"'5'!X60","v":0},{"$f":"'5'!Y60","v":0},{"$f":"'5'!Z60","v":0},{"$f":"'5'!AA60","v":0},{"$f":"'5'!AB60","v":0},{"$f":"'5'!AC60","v":0},{"$f":"'5'!AD60","v":0},{"$f":"'5'!AE60","v":0},{"$f":"'5'!AF60","v":0},{"$f":"'5'!AG60","v":0},{"$f":"'5'!AH60","v":0},{"$f":"'5'!AI60","v":0},{"$f":"'5'!AJ60","v":0},{"$f":"'5'!AK60","v":0},{"$f":"'5'!AL60","v":0},{"$f":"'5'!AM60","v":0},{"$f":"'5'!AN60","v":0},{"$f":"'5'!AO60","v":0},{"$f":"'5'!AP60","v":0},{"$f":"'5'!AQ60","v":0},{"$f":"'5'!AR60","v":0},{"$f":"'5'!AS60","v":0},{"$f":"'5'!AT60","v":0},{"$f":"SUMPRODUCT(IF($N405=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N405=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B61","v":"5"},{"$f":"'5'!C61","v":"5.2"},{"$f":"'5'!D61","v":"5.2.2"},{"$f":"'5'!E61","v":""},{"$f":"'5'!F61","v":"5.2.2.6"},{"$f":"'5'!G61","v":0},{"$f":"'5'!H61","v":0},{"$f":"'5'!I61","v":"5.2.2.6.3"},{"$f":"'5'!J61","v":"5.2.2.6.3: Are all other lower-risk vendor-supplied security patches installed within an appropriate time frame - i.e. within three months?\n"},{"$f":"'5'!K61","v":0},{"$f":"'5'!L61","v":0},{"$f":"'5'!M61","v":"Recommended"},{"$f":"'5'!N61","v":"Recommended"},{"$f":"'5'!O61","v":"TechOps"},{"$f":"'5'!P61","v":0},{"$f":"'5'!Q61","v":0},{"$f":"'5'!R61","v":0},{"$f":"'5'!S61","v":0},{"$f":"'5'!T61","v":0},{"$f":"'5'!U61","v":0},{"$f":"'5'!V61","v":0},{"$f":"'5'!W61","v":0},{"$f":"'5'!X61","v":0},{"$f":"'5'!Y61","v":0},{"$f":"'5'!Z61","v":0},{"$f":"'5'!AA61","v":0},{"$f":"'5'!AB61","v":0},{"$f":"'5'!AC61","v":0},{"$f":"'5'!AD61","v":0},{"$f":"'5'!AE61","v":0},{"$f":"'5'!AF61","v":0},{"$f":"'5'!AG61","v":0},{"$f":"'5'!AH61","v":0},{"$f":"'5'!AI61","v":0},{"$f":"'5'!AJ61","v":0},{"$f":"'5'!AK61","v":0},{"$f":"'5'!AL61","v":0},{"$f":"'5'!AM61","v":0},{"$f":"'5'!AN61","v":0},{"$f":"'5'!AO61","v":0},{"$f":"'5'!AP61","v":0},{"$f":"'5'!AQ61","v":0},{"$f":"'5'!AR61","v":0},{"$f":"'5'!AS61","v":0},{"$f":"'5'!AT61","v":0},{"$f":"SUMPRODUCT(IF($N406=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N406=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B62","v":"5"},{"$f":"'5'!C62","v":"5.2"},{"$f":"'5'!D62","v":"5.2.2"},{"$f":"'5'!E62","v":""},{"$f":"'5'!F62","v":"5.2.2.6"},{"$f":"'5'!G62","v":0},{"$f":"'5'!H62","v":0},{"$f":"'5'!I62","v":"5.2.2.6.4"},{"$f":"'5'!J62","v":"5.2.2.6.4: Does the decision whether to upgrade to a new release of vendor software consider both the introduction of new information security functionality and the number and severity of information security problems affecting the new release?\n"},{"$f":"'5'!K62","v":0},{"$f":"'5'!L62","v":0},{"$f":"'5'!M62","v":"Recommended"},{"$f":"'5'!N62","v":"Recommended"},{"$f":"'5'!O62","v":"TechOps"},{"$f":"'5'!P62","v":0},{"$f":"'5'!Q62","v":0},{"$f":"'5'!R62","v":0},{"$f":"'5'!S62","v":0},{"$f":"'5'!T62","v":0},{"$f":"'5'!U62","v":0},{"$f":"'5'!V62","v":0},{"$f":"'5'!W62","v":0},{"$f":"'5'!X62","v":0},{"$f":"'5'!Y62","v":0},{"$f":"'5'!Z62","v":0},{"$f":"'5'!AA62","v":0},{"$f":"'5'!AB62","v":0},{"$f":"'5'!AC62","v":0},{"$f":"'5'!AD62","v":0},{"$f":"'5'!AE62","v":0},{"$f":"'5'!AF62","v":0},{"$f":"'5'!AG62","v":0},{"$f":"'5'!AH62","v":0},{"$f":"'5'!AI62","v":0},{"$f":"'5'!AJ62","v":0},{"$f":"'5'!AK62","v":0},{"$f":"'5'!AL62","v":0},{"$f":"'5'!AM62","v":0},{"$f":"'5'!AN62","v":0},{"$f":"'5'!AO62","v":0},{"$f":"'5'!AP62","v":0},{"$f":"'5'!AQ62","v":0},{"$f":"'5'!AR62","v":0},{"$f":"'5'!AS62","v":0},{"$f":"'5'!AT62","v":0},{"$f":"SUMPRODUCT(IF($N407=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N407=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B64","v":"5"},{"$f":"'5'!C64","v":"5.3"},{"$f":"'5'!D64","v":"5.3.1"},{"$f":"'5'!E64","v":"5.3.1: Providers shall identify and assess security risks prior to offering mobile money services and shall continue to monitor such risks on an ongoing basis."},{"$f":"'5'!F64","v":"5.3.1.1"},{"$f":"'5'!G64","v":"5.3.1.1: SECURITY RISK MANAGEMENT\nProviders should establish an Information Security Risk Management process and deploy sufficient resources to implement it. Security risks should be assessed at least annually, following a significant change in infrastructure or operating systems, and when new threats or vulnerabilities have been identified.\n\nSecurity risk assessments should be applied to all information systems and processes delivering the mobile money service (both internal and 3rd party). "},{"$f":"'5'!H64","v":"ISO 27005: 2011, \nPCI DSS, \nECB RSMP"},{"$f":"'5'!I64","v":"5.3.1.1.1"},{"$f":"'5'!J64","v":"5.3.1.1.1: Has an information security risk management process been documented?\n"},{"$f":"'5'!K64","v":"1) Information security risk management process and security risk register\n- Check that the security risk management process has been documented. \nNote that security risk management could be done either at operator-level or at group level\n"},{"$f":"'5'!L64","v":0},{"$f":"'5'!M64","v":"Standard Required"},{"$f":"'5'!N64","v":"Required"},{"$f":"'5'!O64","v":"TechOps"},{"$f":"'5'!P64","v":0},{"$f":"'5'!Q64","v":0},{"$f":"'5'!R64","v":0},{"$f":"'5'!S64","v":0},{"$f":"'5'!T64","v":0},{"$f":"'5'!U64","v":0},{"$f":"'5'!V64","v":0},{"$f":"'5'!W64","v":0},{"$f":"'5'!X64","v":0},{"$f":"'5'!Y64","v":0},{"$f":"'5'!Z64","v":0},{"$f":"'5'!AA64","v":0},{"$f":"'5'!AB64","v":0},{"$f":"'5'!AC64","v":0},{"$f":"'5'!AD64","v":0},{"$f":"'5'!AE64","v":0},{"$f":"'5'!AF64","v":0},{"$f":"'5'!AG64","v":0},{"$f":"'5'!AH64","v":0},{"$f":"'5'!AI64","v":0},{"$f":"'5'!AJ64","v":0},{"$f":"'5'!AK64","v":0},{"$f":"'5'!AL64","v":0},{"$f":"'5'!AM64","v":0},{"$f":"'5'!AN64","v":0},{"$f":"'5'!AO64","v":0},{"$f":"'5'!AP64","v":0},{"$f":"'5'!AQ64","v":0},{"$f":"'5'!AR64","v":0},{"$f":"'5'!AS64","v":0},{"$f":"'5'!AT64","v":0},{"$f":"SUMPRODUCT(IF($N408=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N408=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B65","v":"5"},{"$f":"'5'!C65","v":"5.3"},{"$f":"'5'!D65","v":"5.3.1"},{"$f":"'5'!E65","v":0},{"$f":"'5'!F65","v":"5.3.1.1"},{"$f":"'5'!G65","v":0},{"$f":"'5'!H65","v":0},{"$f":"'5'!I65","v":"5.3.1.1.2"},{"$f":"'5'!J65","v":"5.3.1.1.2: Are security risks assessed at least annually, following a significant change to the mobile money system, and when new threats or vulnerabilities have been identified?\n"},{"$f":"'5'!K65","v":"1) Information security risk management process\n- Check that security risk assessments are carried out at least annually.\n- Check that the date of the last documented risk assessment has occurred in the last 12 months.\n"},{"$f":"'5'!L65","v":0},{"$f":"'5'!M65","v":"Standard Required"},{"$f":"'5'!N65","v":"Required"},{"$f":"'5'!O65","v":"TechOps"},{"$f":"'5'!P65","v":0},{"$f":"'5'!Q65","v":0},{"$f":"'5'!R65","v":0},{"$f":"'5'!S65","v":0},{"$f":"'5'!T65","v":0},{"$f":"'5'!U65","v":0},{"$f":"'5'!V65","v":0},{"$f":"'5'!W65","v":0},{"$f":"'5'!X65","v":0},{"$f":"'5'!Y65","v":0},{"$f":"'5'!Z65","v":0},{"$f":"'5'!AA65","v":0},{"$f":"'5'!AB65","v":0},{"$f":"'5'!AC65","v":0},{"$f":"'5'!AD65","v":0},{"$f":"'5'!AE65","v":0},{"$f":"'5'!AF65","v":0},{"$f":"'5'!AG65","v":0},{"$f":"'5'!AH65","v":0},{"$f":"'5'!AI65","v":0},{"$f":"'5'!AJ65","v":0},{"$f":"'5'!AK65","v":0},{"$f":"'5'!AL65","v":0},{"$f":"'5'!AM65","v":0},{"$f":"'5'!AN65","v":0},{"$f":"'5'!AO65","v":0},{"$f":"'5'!AP65","v":0},{"$f":"'5'!AQ65","v":0},{"$f":"'5'!AR65","v":0},{"$f":"'5'!AS65","v":0},{"$f":"'5'!AT65","v":0},{"$f":"SUMPRODUCT(IF($N409=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N409=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B66","v":"5"},{"$f":"'5'!C66","v":"5.3"},{"$f":"'5'!D66","v":"5.3.1"},{"$f":"'5'!E66","v":0},{"$f":"'5'!F66","v":"5.3.1.2"},{"$f":"'5'!G66","v":"5.3.1.2: OBTAIN INFORMATION ABOUT KNOWN SECURITY RISKS\nProviders should establish a process to identify security vulnerabilities, using reputable outside sources for security vulnerability information.\n\nProviders should keep up to date with new vulnerabilities that may impact their environment. Sources for vulnerability information should be trustworthy and may include (among others) vendor websites, industry news groups, mailing lists, or RSS feeds."},{"$f":"'5'!H66","v":"PCI DSS, ISO 27002: 2013 Sec. 14.1 "},{"$f":"'5'!I66","v":"5.3.1.2.1"},{"$f":"'5'!J66","v":"5.3.1.2.1: Are processes in place to identify new security vulnerabilities using information from reputable outside sources?\n"},{"$f":"'5'!K66","v":"1) Information security risk management process\n- Check that there is a process to identify new security vulnerabilities\n- Check that the process includes information from reputable outside sources "},{"$f":"'5'!L66","v":0},{"$f":"'5'!M66","v":"Urgent Required"},{"$f":"'5'!N66","v":"Required"},{"$f":"'5'!O66","v":"TechOps"},{"$f":"'5'!P66","v":0},{"$f":"'5'!Q66","v":0},{"$f":"'5'!R66","v":0},{"$f":"'5'!S66","v":0},{"$f":"'5'!T66","v":0},{"$f":"'5'!U66","v":0},{"$f":"'5'!V66","v":0},{"$f":"'5'!W66","v":0},{"$f":"'5'!X66","v":0},{"$f":"'5'!Y66","v":0},{"$f":"'5'!Z66","v":0},{"$f":"'5'!AA66","v":0},{"$f":"'5'!AB66","v":0},{"$f":"'5'!AC66","v":0},{"$f":"'5'!AD66","v":0},{"$f":"'5'!AE66","v":0},{"$f":"'5'!AF66","v":0},{"$f":"'5'!AG66","v":0},{"$f":"'5'!AH66","v":0},{"$f":"'5'!AI66","v":0},{"$f":"'5'!AJ66","v":0},{"$f":"'5'!AK66","v":0},{"$f":"'5'!AL66","v":0},{"$f":"'5'!AM66","v":0},{"$f":"'5'!AN66","v":0},{"$f":"'5'!AO66","v":0},{"$f":"'5'!AP66","v":0},{"$f":"'5'!AQ66","v":0},{"$f":"'5'!AR66","v":0},{"$f":"'5'!AS66","v":0},{"$f":"'5'!AT66","v":0},{"$f":"SUMPRODUCT(IF($N410=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N410=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B67","v":"5"},{"$f":"'5'!C67","v":"5.3"},{"$f":"'5'!D67","v":"5.3.1"},{"$f":"'5'!E67","v":""},{"$f":"'5'!F67","v":"5.3.1.3"},{"$f":"'5'!G67","v":"5.3.1.3: SECURITY RISK MANAGEMENT PROCESS\nSecurity risk assessments should be conducted to identify new risks and evaluate their severity. They should also re-evaluate risks that were reviewed in the previous risk assessment. \n\nThe severity of each risk should be assessed by evaluating the risk's impact (if it materialised) and likelihood of materialising. Examples of types of impact include:\n- Impairment of operations or service availability;\n- Loss of integrity of financial data;\n- Loss of financial value;\n- Damage to reputation;\n- Breaches of legal/ regulatory requirements;\n- Loss of customer confidentiality.\n\nThe security risk management process should identify controls that are in place or which could be implemented to reduce the severity of the risk by reducing the impact and/or likelihood. Actions should be identified to manage each risk, such as treating the risk by applying additional controls or deciding to tolerate the level of risk. The decision to tolerate risks should be confirmed at the appropriate level of management, and the justification should be documented."},{"$f":"'5'!H67","v":"ISO 27005: 2011, \nPCI DSS, \nECB RSMP"},{"$f":"'5'!I67","v":"5.3.1.3.1"},{"$f":"'5'!J67","v":"5.3.1.3.1: Do security risk assessments evaluate both new risks and previously-assessed risks?\n"},{"$f":"'5'!K67","v":"1) Information security risk management process\n- Check that the security risk assessments evaluate new risk and previously -assessed risk\n- Check that there is a populated risk register"},{"$f":"'5'!L67","v":0},{"$f":"'5'!M67","v":"Recommended"},{"$f":"'5'!N67","v":"Recommended"},{"$f":"'5'!O67","v":"TechOps"},{"$f":"'5'!P67","v":0},{"$f":"'5'!Q67","v":0},{"$f":"'5'!R67","v":0},{"$f":"'5'!S67","v":0},{"$f":"'5'!T67","v":0},{"$f":"'5'!U67","v":0},{"$f":"'5'!V67","v":0},{"$f":"'5'!W67","v":0},{"$f":"'5'!X67","v":0},{"$f":"'5'!Y67","v":0},{"$f":"'5'!Z67","v":0},{"$f":"'5'!AA67","v":0},{"$f":"'5'!AB67","v":0},{"$f":"'5'!AC67","v":0},{"$f":"'5'!AD67","v":0},{"$f":"'5'!AE67","v":0},{"$f":"'5'!AF67","v":0},{"$f":"'5'!AG67","v":0},{"$f":"'5'!AH67","v":0},{"$f":"'5'!AI67","v":0},{"$f":"'5'!AJ67","v":0},{"$f":"'5'!AK67","v":0},{"$f":"'5'!AL67","v":0},{"$f":"'5'!AM67","v":0},{"$f":"'5'!AN67","v":0},{"$f":"'5'!AO67","v":0},{"$f":"'5'!AP67","v":0},{"$f":"'5'!AQ67","v":0},{"$f":"'5'!AR67","v":0},{"$f":"'5'!AS67","v":0},{"$f":"'5'!AT67","v":0},{"$f":"SUMPRODUCT(IF($N411=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N411=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B68","v":"5"},{"$f":"'5'!C68","v":"5.3"},{"$f":"'5'!D68","v":"5.3.1"},{"$f":"'5'!E68","v":""},{"$f":"'5'!F68","v":"5.3.1.3"},{"$f":"'5'!G68","v":0},{"$f":"'5'!H68","v":0},{"$f":"'5'!I68","v":"5.3.1.3.2"},{"$f":"'5'!J68","v":"5.3.1.3.2: Is the severity of each security risk assessed by considering the impact and likelihood of the risk occurring, taking into account the controls that are in place to mitigate the risk?\n"},{"$f":"'5'!K68","v":"1) Information security risk management process\n- Check that there is a process to assess security risks\n- Check that the assessment process includes the assessment of the impact and likelihood of a risk occurring\n- Check that the assessment includes consideration of controls that are in place to mitigate the risk"},{"$f":"'5'!L68","v":0},{"$f":"'5'!M68","v":"Recommended"},{"$f":"'5'!N68","v":"Recommended"},{"$f":"'5'!O68","v":"TechOps"},{"$f":"'5'!P68","v":0},{"$f":"'5'!Q68","v":0},{"$f":"'5'!R68","v":0},{"$f":"'5'!S68","v":0},{"$f":"'5'!T68","v":0},{"$f":"'5'!U68","v":0},{"$f":"'5'!V68","v":0},{"$f":"'5'!W68","v":0},{"$f":"'5'!X68","v":0},{"$f":"'5'!Y68","v":0},{"$f":"'5'!Z68","v":0},{"$f":"'5'!AA68","v":0},{"$f":"'5'!AB68","v":0},{"$f":"'5'!AC68","v":0},{"$f":"'5'!AD68","v":0},{"$f":"'5'!AE68","v":0},{"$f":"'5'!AF68","v":0},{"$f":"'5'!AG68","v":0},{"$f":"'5'!AH68","v":0},{"$f":"'5'!AI68","v":0},{"$f":"'5'!AJ68","v":0},{"$f":"'5'!AK68","v":0},{"$f":"'5'!AL68","v":0},{"$f":"'5'!AM68","v":0},{"$f":"'5'!AN68","v":0},{"$f":"'5'!AO68","v":0},{"$f":"'5'!AP68","v":0},{"$f":"'5'!AQ68","v":0},{"$f":"'5'!AR68","v":0},{"$f":"'5'!AS68","v":0},{"$f":"'5'!AT68","v":0},{"$f":"SUMPRODUCT(IF($N412=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N412=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B69","v":"5"},{"$f":"'5'!C69","v":"5.3"},{"$f":"'5'!D69","v":"5.3.1"},{"$f":"'5'!E69","v":""},{"$f":"'5'!F69","v":"5.3.1.3"},{"$f":"'5'!G69","v":0},{"$f":"'5'!H69","v":0},{"$f":"'5'!I69","v":"5.3.1.3.3"},{"$f":"'5'!J69","v":"5.3.1.3.3: Does the security risk management process identify controls which could be implemented to reduce the severity of the risk by reducing the impact and/or likelihood?\n"},{"$f":"'5'!K69","v":"1) Information security risk management process\n- Check that there is a process identifies controls that should be implemented to reduce the severity of the risk by reducing the impact and/or likelihood of the risk occurring"},{"$f":"'5'!L69","v":0},{"$f":"'5'!M69","v":"Recommended"},{"$f":"'5'!N69","v":"Recommended"},{"$f":"'5'!O69","v":"TechOps"},{"$f":"'5'!P69","v":0},{"$f":"'5'!Q69","v":0},{"$f":"'5'!R69","v":0},{"$f":"'5'!S69","v":0},{"$f":"'5'!T69","v":0},{"$f":"'5'!U69","v":0},{"$f":"'5'!V69","v":0},{"$f":"'5'!W69","v":0},{"$f":"'5'!X69","v":0},{"$f":"'5'!Y69","v":0},{"$f":"'5'!Z69","v":0},{"$f":"'5'!AA69","v":0},{"$f":"'5'!AB69","v":0},{"$f":"'5'!AC69","v":0},{"$f":"'5'!AD69","v":0},{"$f":"'5'!AE69","v":0},{"$f":"'5'!AF69","v":0},{"$f":"'5'!AG69","v":0},{"$f":"'5'!AH69","v":0},{"$f":"'5'!AI69","v":0},{"$f":"'5'!AJ69","v":0},{"$f":"'5'!AK69","v":0},{"$f":"'5'!AL69","v":0},{"$f":"'5'!AM69","v":0},{"$f":"'5'!AN69","v":0},{"$f":"'5'!AO69","v":0},{"$f":"'5'!AP69","v":0},{"$f":"'5'!AQ69","v":0},{"$f":"'5'!AR69","v":0},{"$f":"'5'!AS69","v":0},{"$f":"'5'!AT69","v":0},{"$f":"SUMPRODUCT(IF($N413=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N413=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B70","v":"5"},{"$f":"'5'!C70","v":"5.3"},{"$f":"'5'!D70","v":"5.3.1"},{"$f":"'5'!E70","v":""},{"$f":"'5'!F70","v":"5.3.1.3"},{"$f":"'5'!G70","v":0},{"$f":"'5'!H70","v":0},{"$f":"'5'!I70","v":"5.3.1.3.4"},{"$f":"'5'!J70","v":"5.3.1.3.4: Does the security risk management process identify actions to be taken to treat each risk by applying additional controls or deciding to tolerate the level of risk?\n"},{"$f":"'5'!K70","v":"1) Information security risk management process\n- Check that there is a process identifies actions to be taken to treat each risk by applying additional controls or deciding to tolerate the level of risk"},{"$f":"'5'!L70","v":0},{"$f":"'5'!M70","v":"Recommended"},{"$f":"'5'!N70","v":"Recommended"},{"$f":"'5'!O70","v":"TechOps"},{"$f":"'5'!P70","v":0},{"$f":"'5'!Q70","v":0},{"$f":"'5'!R70","v":0},{"$f":"'5'!S70","v":0},{"$f":"'5'!T70","v":0},{"$f":"'5'!U70","v":0},{"$f":"'5'!V70","v":0},{"$f":"'5'!W70","v":0},{"$f":"'5'!X70","v":0},{"$f":"'5'!Y70","v":0},{"$f":"'5'!Z70","v":0},{"$f":"'5'!AA70","v":0},{"$f":"'5'!AB70","v":0},{"$f":"'5'!AC70","v":0},{"$f":"'5'!AD70","v":0},{"$f":"'5'!AE70","v":0},{"$f":"'5'!AF70","v":0},{"$f":"'5'!AG70","v":0},{"$f":"'5'!AH70","v":0},{"$f":"'5'!AI70","v":0},{"$f":"'5'!AJ70","v":0},{"$f":"'5'!AK70","v":0},{"$f":"'5'!AL70","v":0},{"$f":"'5'!AM70","v":0},{"$f":"'5'!AN70","v":0},{"$f":"'5'!AO70","v":0},{"$f":"'5'!AP70","v":0},{"$f":"'5'!AQ70","v":0},{"$f":"'5'!AR70","v":0},{"$f":"'5'!AS70","v":0},{"$f":"'5'!AT70","v":0},{"$f":"SUMPRODUCT(IF($N414=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N414=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B71","v":"5"},{"$f":"'5'!C71","v":"5.3"},{"$f":"'5'!D71","v":"5.3.1"},{"$f":"'5'!E71","v":""},{"$f":"'5'!F71","v":"5.3.1.3"},{"$f":"'5'!G71","v":0},{"$f":"'5'!H71","v":0},{"$f":"'5'!I71","v":"5.3.1.3.5"},{"$f":"'5'!J71","v":"5.3.1.3.5: Are all decisions to tolerate security risks confirmed at the appropriate level of management and documented?\n"},{"$f":"'5'!K71","v":"1) Information security risk management process\n- Check that where a decision is taken to tolerate a security risk that this is confirmed by an appropriate level of management\n- Check that the process identifies what level of management is required to confirm a decision to tolerate a risk\n- Check that the decision and confirmation is records including the details of the confirmer\n- Check that the process is documented"},{"$f":"'5'!L71","v":0},{"$f":"'5'!M71","v":"Recommended"},{"$f":"'5'!N71","v":"Recommended"},{"$f":"'5'!O71","v":"TechOps"},{"$f":"'5'!P71","v":0},{"$f":"'5'!Q71","v":0},{"$f":"'5'!R71","v":0},{"$f":"'5'!S71","v":0},{"$f":"'5'!T71","v":0},{"$f":"'5'!U71","v":0},{"$f":"'5'!V71","v":0},{"$f":"'5'!W71","v":0},{"$f":"'5'!X71","v":0},{"$f":"'5'!Y71","v":0},{"$f":"'5'!Z71","v":0},{"$f":"'5'!AA71","v":0},{"$f":"'5'!AB71","v":0},{"$f":"'5'!AC71","v":0},{"$f":"'5'!AD71","v":0},{"$f":"'5'!AE71","v":0},{"$f":"'5'!AF71","v":0},{"$f":"'5'!AG71","v":0},{"$f":"'5'!AH71","v":0},{"$f":"'5'!AI71","v":0},{"$f":"'5'!AJ71","v":0},{"$f":"'5'!AK71","v":0},{"$f":"'5'!AL71","v":0},{"$f":"'5'!AM71","v":0},{"$f":"'5'!AN71","v":0},{"$f":"'5'!AO71","v":0},{"$f":"'5'!AP71","v":0},{"$f":"'5'!AQ71","v":0},{"$f":"'5'!AR71","v":0},{"$f":"'5'!AS71","v":0},{"$f":"'5'!AT71","v":0},{"$f":"SUMPRODUCT(IF($N415=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N415=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B72","v":"5"},{"$f":"'5'!C72","v":"5.3"},{"$f":"'5'!D72","v":"5.3.1"},{"$f":"'5'!E72","v":""},{"$f":"'5'!F72","v":"5.3.1.4"},{"$f":"'5'!G72","v":"5.3.1.4: SECURITY RISK COMMUNICATION AND ACTION MONITORING\nThe results of the security risk assessment should be communicated to risk owners and technical & business managers. High-severity risks should be highlighted.\n\nSecurity risk owners should be informed of their actions for implementing further controls, and these actions should be monitored by the IT Security team to ensure that they are implemented."},{"$f":"'5'!H72","v":"ISO 27005: 2011, \nPCI DSS, \nECB RSMP"},{"$f":"'5'!I72","v":"5.3.1.4.1"},{"$f":"'5'!J72","v":"5.3.1.4.1: Have the results of the security risk assessment been communicated to risk owners and technical & business managers?\n"},{"$f":"'5'!K72","v":0},{"$f":"'5'!L72","v":0},{"$f":"'5'!M72","v":"Recommended"},{"$f":"'5'!N72","v":"Recommended"},{"$f":"'5'!O72","v":"TechOps"},{"$f":"'5'!P72","v":0},{"$f":"'5'!Q72","v":0},{"$f":"'5'!R72","v":0},{"$f":"'5'!S72","v":0},{"$f":"'5'!T72","v":0},{"$f":"'5'!U72","v":0},{"$f":"'5'!V72","v":0},{"$f":"'5'!W72","v":0},{"$f":"'5'!X72","v":0},{"$f":"'5'!Y72","v":0},{"$f":"'5'!Z72","v":0},{"$f":"'5'!AA72","v":0},{"$f":"'5'!AB72","v":0},{"$f":"'5'!AC72","v":0},{"$f":"'5'!AD72","v":0},{"$f":"'5'!AE72","v":0},{"$f":"'5'!AF72","v":0},{"$f":"'5'!AG72","v":0},{"$f":"'5'!AH72","v":0},{"$f":"'5'!AI72","v":0},{"$f":"'5'!AJ72","v":0},{"$f":"'5'!AK72","v":0},{"$f":"'5'!AL72","v":0},{"$f":"'5'!AM72","v":0},{"$f":"'5'!AN72","v":0},{"$f":"'5'!AO72","v":0},{"$f":"'5'!AP72","v":0},{"$f":"'5'!AQ72","v":0},{"$f":"'5'!AR72","v":0},{"$f":"'5'!AS72","v":0},{"$f":"'5'!AT72","v":0},{"$f":"SUMPRODUCT(IF($N416=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N416=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B73","v":"5"},{"$f":"'5'!C73","v":"5.3"},{"$f":"'5'!D73","v":"5.3.1"},{"$f":"'5'!E73","v":""},{"$f":"'5'!F73","v":"5.3.1.4"},{"$f":"'5'!G73","v":0},{"$f":"'5'!H73","v":0},{"$f":"'5'!I73","v":"5.3.1.4.2"},{"$f":"'5'!J73","v":"5.3.1.4.2: Are the actions for implementing further controls monitored by the IT Security team to ensure they are implemented by the risk owners?\n"},{"$f":"'5'!K73","v":"1) Information security risk management process\n- Check that the IT Security team have a process to monitor that the required additional controls are being implemented by the risk owners\n"},{"$f":"'5'!L73","v":0},{"$f":"'5'!M73","v":"Recommended"},{"$f":"'5'!N73","v":"Recommended"},{"$f":"'5'!O73","v":"TechOps"},{"$f":"'5'!P73","v":0},{"$f":"'5'!Q73","v":0},{"$f":"'5'!R73","v":0},{"$f":"'5'!S73","v":0},{"$f":"'5'!T73","v":0},{"$f":"'5'!U73","v":0},{"$f":"'5'!V73","v":0},{"$f":"'5'!W73","v":0},{"$f":"'5'!X73","v":0},{"$f":"'5'!Y73","v":0},{"$f":"'5'!Z73","v":0},{"$f":"'5'!AA73","v":0},{"$f":"'5'!AB73","v":0},{"$f":"'5'!AC73","v":0},{"$f":"'5'!AD73","v":0},{"$f":"'5'!AE73","v":0},{"$f":"'5'!AF73","v":0},{"$f":"'5'!AG73","v":0},{"$f":"'5'!AH73","v":0},{"$f":"'5'!AI73","v":0},{"$f":"'5'!AJ73","v":0},{"$f":"'5'!AK73","v":0},{"$f":"'5'!AL73","v":0},{"$f":"'5'!AM73","v":0},{"$f":"'5'!AN73","v":0},{"$f":"'5'!AO73","v":0},{"$f":"'5'!AP73","v":0},{"$f":"'5'!AQ73","v":0},{"$f":"'5'!AR73","v":0},{"$f":"'5'!AS73","v":0},{"$f":"'5'!AT73","v":0},{"$f":"SUMPRODUCT(IF($N417=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N417=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B74","v":"5"},{"$f":"'5'!C74","v":"5.3"},{"$f":"'5'!D74","v":"5.3.2"},{"$f":"'5'!E74","v":"5.3.2: Providers shall properly identify and authenticate system users"},{"$f":"'5'!F74","v":"5.3.2.1"},{"$f":"'5'!G74","v":"5.3.2.1: ACCESS CONTROL POLICY - AUTHENTICATION\nAn access control policy should be documented. The policy should specify how authentication of users for access to the mobile money back end system and service will be managed.\n\nProviders should implement authentication measures for access to the mobile money application and system components. This should include the following:\n- assign all users and administrators a unique ID;\n- disable or remove generic user IDs;\n- control the addition, deletion, and modification accounts and credentials;\n- promptly revoke access for any terminated users;\n- review user accounts at least every 90 days and remove or disable inactive/inappropriate accounts;\n- manage IDs used by vendors to access, support, or maintain system components via remote access;\n- disable interactive login for all system-to-system accounts.\n\nProviders may also wish to:\n- limit repeated access attempts by locking out the user ID after not more than six attempts;\n- require the user to re-authenticate to re-activate the terminal or session after a session has been idle for more than 15 minutes.\n\nSteps should be taken to ensure that IDs are not shared by multiple users. For example, a security awareness programme should be run, backed up by discliplinary action for non-compliance."},{"$f":"'5'!H74","v":"PCI DSS, ISO 27002: 2013 Sec. 9.1"},{"$f":"'5'!I74","v":"5.3.2.1.1"},{"$f":"'5'!J74","v":"5.3.2.1.1: Is there a documented access control policy, standard or procedure that specifies how authentication of users will be managed, both for mobile money application users and system components?\n"},{"$f":"'5'!K74","v":"1) Access control standard or security policy or similar document\n- Check there is a documented access control policy\n- Check that it specifies how authentication of users will be managed, both  for mobile money application users and system components."},{"$f":"'5'!L74","v":0},{"$f":"'5'!M74","v":"Standard Required"},{"$f":"'5'!N74","v":"Required"},{"$f":"'5'!O74","v":"TechOps"},{"$f":"'5'!P74","v":0},{"$f":"'5'!Q74","v":0},{"$f":"'5'!R74","v":0},{"$f":"'5'!S74","v":0},{"$f":"'5'!T74","v":0},{"$f":"'5'!U74","v":0},{"$f":"'5'!V74","v":0},{"$f":"'5'!W74","v":0},{"$f":"'5'!X74","v":0},{"$f":"'5'!Y74","v":0},{"$f":"'5'!Z74","v":0},{"$f":"'5'!AA74","v":0},{"$f":"'5'!AB74","v":0},{"$f":"'5'!AC74","v":0},{"$f":"'5'!AD74","v":0},{"$f":"'5'!AE74","v":0},{"$f":"'5'!AF74","v":0},{"$f":"'5'!AG74","v":0},{"$f":"'5'!AH74","v":0},{"$f":"'5'!AI74","v":0},{"$f":"'5'!AJ74","v":0},{"$f":"'5'!AK74","v":0},{"$f":"'5'!AL74","v":0},{"$f":"'5'!AM74","v":0},{"$f":"'5'!AN74","v":0},{"$f":"'5'!AO74","v":0},{"$f":"'5'!AP74","v":0},{"$f":"'5'!AQ74","v":0},{"$f":"'5'!AR74","v":0},{"$f":"'5'!AS74","v":0},{"$f":"'5'!AT74","v":0},{"$f":"SUMPRODUCT(IF($N418=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N418=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B75","v":"5"},{"$f":"'5'!C75","v":"5.3"},{"$f":"'5'!D75","v":"5.3.2"},{"$f":"'5'!E75","v":0},{"$f":"'5'!F75","v":"5.3.2.1"},{"$f":"'5'!G75","v":0},{"$f":"'5'!H75","v":0},{"$f":"'5'!I75","v":"5.3.2.1.2"},{"$f":"'5'!J75","v":"5.3.2.1.2: Are all users that access the mobile money application and system components assigned a unique ID and have generic user IDs been disabled or removed?\n"},{"$f":"'5'!K75","v":"1) Access control standard or security policy or similar document\n- Check there is a process to allocate a unique ID to any user who accesses the mobile money application.\n- Check there is a process to allocate a unique ID to any user who accesses the mobile money system components.\n- Check that generic/system user IDs are disabled, removed or allocated to a single named owner."},{"$f":"'5'!L75","v":0},{"$f":"'5'!M75","v":"Urgent Required"},{"$f":"'5'!N75","v":"Required"},{"$f":"'5'!O75","v":"TechOps"},{"$f":"'5'!P75","v":0},{"$f":"'5'!Q75","v":0},{"$f":"'5'!R75","v":0},{"$f":"'5'!S75","v":0},{"$f":"'5'!T75","v":0},{"$f":"'5'!U75","v":0},{"$f":"'5'!V75","v":0},{"$f":"'5'!W75","v":0},{"$f":"'5'!X75","v":0},{"$f":"'5'!Y75","v":0},{"$f":"'5'!Z75","v":0},{"$f":"'5'!AA75","v":0},{"$f":"'5'!AB75","v":0},{"$f":"'5'!AC75","v":0},{"$f":"'5'!AD75","v":0},{"$f":"'5'!AE75","v":0},{"$f":"'5'!AF75","v":0},{"$f":"'5'!AG75","v":0},{"$f":"'5'!AH75","v":0},{"$f":"'5'!AI75","v":0},{"$f":"'5'!AJ75","v":0},{"$f":"'5'!AK75","v":0},{"$f":"'5'!AL75","v":0},{"$f":"'5'!AM75","v":0},{"$f":"'5'!AN75","v":0},{"$f":"'5'!AO75","v":0},{"$f":"'5'!AP75","v":0},{"$f":"'5'!AQ75","v":0},{"$f":"'5'!AR75","v":0},{"$f":"'5'!AS75","v":0},{"$f":"'5'!AT75","v":0},{"$f":"SUMPRODUCT(IF($N419=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N419=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B76","v":"5"},{"$f":"'5'!C76","v":"5.3"},{"$f":"'5'!D76","v":"5.3.2"},{"$f":"'5'!E76","v":""},{"$f":"'5'!F76","v":"5.3.2.1"},{"$f":"'5'!G76","v":0},{"$f":"'5'!H76","v":0},{"$f":"'5'!I76","v":"5.3.2.1.3"},{"$f":"'5'!J76","v":"5.3.2.1.3: Is the addition, deletion, and modification of user accounts and credentials properly controlled?\n"},{"$f":"'5'!K76","v":"1) Access control standard or security policy or similar document\n- Check there is a process for managing back-end user accounts\n- Check this covers addition, deletion and modification of accounts\n- Check the process is properly controlled"},{"$f":"'5'!L76","v":0},{"$f":"'5'!M76","v":"Urgent Required"},{"$f":"'5'!N76","v":"Required"},{"$f":"'5'!O76","v":"TechOps"},{"$f":"'5'!P76","v":0},{"$f":"'5'!Q76","v":0},{"$f":"'5'!R76","v":0},{"$f":"'5'!S76","v":0},{"$f":"'5'!T76","v":0},{"$f":"'5'!U76","v":0},{"$f":"'5'!V76","v":0},{"$f":"'5'!W76","v":0},{"$f":"'5'!X76","v":0},{"$f":"'5'!Y76","v":0},{"$f":"'5'!Z76","v":0},{"$f":"'5'!AA76","v":0},{"$f":"'5'!AB76","v":0},{"$f":"'5'!AC76","v":0},{"$f":"'5'!AD76","v":0},{"$f":"'5'!AE76","v":0},{"$f":"'5'!AF76","v":0},{"$f":"'5'!AG76","v":0},{"$f":"'5'!AH76","v":0},{"$f":"'5'!AI76","v":0},{"$f":"'5'!AJ76","v":0},{"$f":"'5'!AK76","v":0},{"$f":"'5'!AL76","v":0},{"$f":"'5'!AM76","v":0},{"$f":"'5'!AN76","v":0},{"$f":"'5'!AO76","v":0},{"$f":"'5'!AP76","v":0},{"$f":"'5'!AQ76","v":0},{"$f":"'5'!AR76","v":0},{"$f":"'5'!AS76","v":0},{"$f":"'5'!AT76","v":0},{"$f":"SUMPRODUCT(IF($N420=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N420=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B77","v":"5"},{"$f":"'5'!C77","v":"5.3"},{"$f":"'5'!D77","v":"5.3.2"},{"$f":"'5'!E77","v":""},{"$f":"'5'!F77","v":"5.3.2.1"},{"$f":"'5'!G77","v":0},{"$f":"'5'!H77","v":0},{"$f":"'5'!I77","v":"5.3.2.1.4"},{"$f":"'5'!J77","v":"5.3.2.1.4: Is user access promptly revoked for any terminated users?\n"},{"$f":"'5'!K77","v":"1) Access control standard or security policy or similar document\n- Check there is a process for the prompt revocation of access rights for any terminated user"},{"$f":"'5'!L77","v":0},{"$f":"'5'!M77","v":"Standard Required"},{"$f":"'5'!N77","v":"Required"},{"$f":"'5'!O77","v":"TechOps"},{"$f":"'5'!P77","v":0},{"$f":"'5'!Q77","v":0},{"$f":"'5'!R77","v":0},{"$f":"'5'!S77","v":0},{"$f":"'5'!T77","v":0},{"$f":"'5'!U77","v":0},{"$f":"'5'!V77","v":0},{"$f":"'5'!W77","v":0},{"$f":"'5'!X77","v":0},{"$f":"'5'!Y77","v":0},{"$f":"'5'!Z77","v":0},{"$f":"'5'!AA77","v":0},{"$f":"'5'!AB77","v":0},{"$f":"'5'!AC77","v":0},{"$f":"'5'!AD77","v":0},{"$f":"'5'!AE77","v":0},{"$f":"'5'!AF77","v":0},{"$f":"'5'!AG77","v":0},{"$f":"'5'!AH77","v":0},{"$f":"'5'!AI77","v":0},{"$f":"'5'!AJ77","v":0},{"$f":"'5'!AK77","v":0},{"$f":"'5'!AL77","v":0},{"$f":"'5'!AM77","v":0},{"$f":"'5'!AN77","v":0},{"$f":"'5'!AO77","v":0},{"$f":"'5'!AP77","v":0},{"$f":"'5'!AQ77","v":0},{"$f":"'5'!AR77","v":0},{"$f":"'5'!AS77","v":0},{"$f":"'5'!AT77","v":0},{"$f":"SUMPRODUCT(IF($N421=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N421=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B78","v":"5"},{"$f":"'5'!C78","v":"5.3"},{"$f":"'5'!D78","v":"5.3.2"},{"$f":"'5'!E78","v":""},{"$f":"'5'!F78","v":"5.3.2.1"},{"$f":"'5'!G78","v":0},{"$f":"'5'!H78","v":0},{"$f":"'5'!I78","v":"5.3.2.1.5"},{"$f":"'5'!J78","v":"5.3.2.1.5: Are steps taken to ensure that IDs are not shared by multiple users?\n"},{"$f":"'5'!K78","v":"1) Security awareness programme\n- Check there is a process to educate staff about not sharing login credentials, for example, training, screen notices, disciplinary processes etc."},{"$f":"'5'!L78","v":0},{"$f":"'5'!M78","v":"Urgent Required"},{"$f":"'5'!N78","v":"Required"},{"$f":"'5'!O78","v":"TechOps"},{"$f":"'5'!P78","v":0},{"$f":"'5'!Q78","v":0},{"$f":"'5'!R78","v":0},{"$f":"'5'!S78","v":0},{"$f":"'5'!T78","v":0},{"$f":"'5'!U78","v":0},{"$f":"'5'!V78","v":0},{"$f":"'5'!W78","v":0},{"$f":"'5'!X78","v":0},{"$f":"'5'!Y78","v":0},{"$f":"'5'!Z78","v":0},{"$f":"'5'!AA78","v":0},{"$f":"'5'!AB78","v":0},{"$f":"'5'!AC78","v":0},{"$f":"'5'!AD78","v":0},{"$f":"'5'!AE78","v":0},{"$f":"'5'!AF78","v":0},{"$f":"'5'!AG78","v":0},{"$f":"'5'!AH78","v":0},{"$f":"'5'!AI78","v":0},{"$f":"'5'!AJ78","v":0},{"$f":"'5'!AK78","v":0},{"$f":"'5'!AL78","v":0},{"$f":"'5'!AM78","v":0},{"$f":"'5'!AN78","v":0},{"$f":"'5'!AO78","v":0},{"$f":"'5'!AP78","v":0},{"$f":"'5'!AQ78","v":0},{"$f":"'5'!AR78","v":0},{"$f":"'5'!AS78","v":0},{"$f":"'5'!AT78","v":0},{"$f":"SUMPRODUCT(IF($N422=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N422=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B79","v":"5"},{"$f":"'5'!C79","v":"5.3"},{"$f":"'5'!D79","v":"5.3.2"},{"$f":"'5'!E79","v":""},{"$f":"'5'!F79","v":"5.3.2.1"},{"$f":"'5'!G79","v":0},{"$f":"'5'!H79","v":0},{"$f":"'5'!I79","v":"5.3.2.1.6"},{"$f":"'5'!J79","v":"5.3.2.1.6: Are user accounts reviewed at least every 90 days, and are inactive/inappropriate accounts removed or disabled?\n"},{"$f":"'5'!K79","v":0},{"$f":"'5'!L79","v":0},{"$f":"'5'!M79","v":"Recommended"},{"$f":"'5'!N79","v":"Recommended"},{"$f":"'5'!O79","v":"TechOps"},{"$f":"'5'!P79","v":0},{"$f":"'5'!Q79","v":0},{"$f":"'5'!R79","v":0},{"$f":"'5'!S79","v":0},{"$f":"'5'!T79","v":0},{"$f":"'5'!U79","v":0},{"$f":"'5'!V79","v":0},{"$f":"'5'!W79","v":0},{"$f":"'5'!X79","v":0},{"$f":"'5'!Y79","v":0},{"$f":"'5'!Z79","v":0},{"$f":"'5'!AA79","v":0},{"$f":"'5'!AB79","v":0},{"$f":"'5'!AC79","v":0},{"$f":"'5'!AD79","v":0},{"$f":"'5'!AE79","v":0},{"$f":"'5'!AF79","v":0},{"$f":"'5'!AG79","v":0},{"$f":"'5'!AH79","v":0},{"$f":"'5'!AI79","v":0},{"$f":"'5'!AJ79","v":0},{"$f":"'5'!AK79","v":0},{"$f":"'5'!AL79","v":0},{"$f":"'5'!AM79","v":0},{"$f":"'5'!AN79","v":0},{"$f":"'5'!AO79","v":0},{"$f":"'5'!AP79","v":0},{"$f":"'5'!AQ79","v":0},{"$f":"'5'!AR79","v":0},{"$f":"'5'!AS79","v":0},{"$f":"'5'!AT79","v":0},{"$f":"SUMPRODUCT(IF($N423=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N423=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B80","v":"5"},{"$f":"'5'!C80","v":"5.3"},{"$f":"'5'!D80","v":"5.3.2"},{"$f":"'5'!E80","v":""},{"$f":"'5'!F80","v":"5.3.2.1"},{"$f":"'5'!G80","v":0},{"$f":"'5'!H80","v":0},{"$f":"'5'!I80","v":"5.3.2.1.7"},{"$f":"'5'!J80","v":"5.3.2.1.7: Is interactive login disabled for all system-to-system accounts?\n"},{"$f":"'5'!K80","v":0},{"$f":"'5'!L80","v":0},{"$f":"'5'!M80","v":"Recommended"},{"$f":"'5'!N80","v":"Recommended"},{"$f":"'5'!O80","v":"TechOps"},{"$f":"'5'!P80","v":0},{"$f":"'5'!Q80","v":0},{"$f":"'5'!R80","v":0},{"$f":"'5'!S80","v":0},{"$f":"'5'!T80","v":0},{"$f":"'5'!U80","v":0},{"$f":"'5'!V80","v":0},{"$f":"'5'!W80","v":0},{"$f":"'5'!X80","v":0},{"$f":"'5'!Y80","v":0},{"$f":"'5'!Z80","v":0},{"$f":"'5'!AA80","v":0},{"$f":"'5'!AB80","v":0},{"$f":"'5'!AC80","v":0},{"$f":"'5'!AD80","v":0},{"$f":"'5'!AE80","v":0},{"$f":"'5'!AF80","v":0},{"$f":"'5'!AG80","v":0},{"$f":"'5'!AH80","v":0},{"$f":"'5'!AI80","v":0},{"$f":"'5'!AJ80","v":0},{"$f":"'5'!AK80","v":0},{"$f":"'5'!AL80","v":0},{"$f":"'5'!AM80","v":0},{"$f":"'5'!AN80","v":0},{"$f":"'5'!AO80","v":0},{"$f":"'5'!AP80","v":0},{"$f":"'5'!AQ80","v":0},{"$f":"'5'!AR80","v":0},{"$f":"'5'!AS80","v":0},{"$f":"'5'!AT80","v":0},{"$f":"SUMPRODUCT(IF($N424=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N424=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B81","v":"5"},{"$f":"'5'!C81","v":"5.3"},{"$f":"'5'!D81","v":"5.3.2"},{"$f":"'5'!E81","v":""},{"$f":"'5'!F81","v":"5.3.2.2"},{"$f":"'5'!G81","v":"5.3.2.2: TWO-FACTOR AUTHENTICATION\nTwo-factor authentication means identifying users by two means. One factor is usually a security credential (such as a PIN or password), and the second factor is normally the user's handset.\n\nTwo-factor authentication should be employed for any access route that is higher risk. For mobile money, two-factor authentication should be enforced for the following access:\n- USSD or STK handset transactions should identify the handset via the MSISDN associated with the SIM;\n- Smartphone users should have their handset securely associated with their account before it is used for transactions;\n- Web and PoS transactions should include a customer confirmation step which involves use of both their handset and PIN.\n- Each user of the mobile money application should have a certificate installed on their computer to identify it (e.g. customer service staff and agents);\n- Remote access to mobile money system components (from outside the premises) should require a certificate on the user's computer or an access card that generates a pass code."},{"$f":"'5'!H81","v":"PCI DSS, ISO 27002: 2013 Sec. 9.1"},{"$f":"'5'!I81","v":"5.3.2.2.1"},{"$f":"'5'!J81","v":"5.3.2.2.1: Are both handset and PIN required for all account-debiting customer transactions?\n"},{"$f":"'5'!K81","v":"1) Access control standard or security policy or similar document\n- Check that both handset and PIN are required for all account-debiting customer transactions (including transactions from both feature phones and smartphones).\n\n2) Demonstration of a customer and agent login on feature phone and smartphone (if applicable).\n- Review transaction initiation to confirm authentication is effective (both positive and negative cases)"},{"$f":"'5'!L81","v":0},{"$f":"'5'!M81","v":"Urgent Required"},{"$f":"'5'!N81","v":"Required"},{"$f":"'5'!O81","v":"TechOps"},{"$f":"'5'!P81","v":0},{"$f":"'5'!Q81","v":0},{"$f":"'5'!R81","v":0},{"$f":"'5'!S81","v":0},{"$f":"'5'!T81","v":0},{"$f":"'5'!U81","v":0},{"$f":"'5'!V81","v":0},{"$f":"'5'!W81","v":0},{"$f":"'5'!X81","v":0},{"$f":"'5'!Y81","v":0},{"$f":"'5'!Z81","v":0},{"$f":"'5'!AA81","v":0},{"$f":"'5'!AB81","v":0},{"$f":"'5'!AC81","v":0},{"$f":"'5'!AD81","v":0},{"$f":"'5'!AE81","v":0},{"$f":"'5'!AF81","v":0},{"$f":"'5'!AG81","v":0},{"$f":"'5'!AH81","v":0},{"$f":"'5'!AI81","v":0},{"$f":"'5'!AJ81","v":0},{"$f":"'5'!AK81","v":0},{"$f":"'5'!AL81","v":0},{"$f":"'5'!AM81","v":0},{"$f":"'5'!AN81","v":0},{"$f":"'5'!AO81","v":0},{"$f":"'5'!AP81","v":0},{"$f":"'5'!AQ81","v":0},{"$f":"'5'!AR81","v":0},{"$f":"'5'!AS81","v":0},{"$f":"'5'!AT81","v":0},{"$f":"SUMPRODUCT(IF($N425=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N425=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B82","v":"5"},{"$f":"'5'!C82","v":"5.3"},{"$f":"'5'!D82","v":"5.3.2"},{"$f":"'5'!E82","v":0},{"$f":"'5'!F82","v":"5.3.2.2"},{"$f":"'5'!G82","v":0},{"$f":"'5'!H82","v":0},{"$f":"'5'!I82","v":0},{"$f":"'5'!J82","v":"5.3.2.2.2: Do all online purchase, ATM and PoS transactions (both merchant and cash-out if applicable) include a customer confirmation step which involves use of both their handset and PIN?\n"},{"$f":"'5'!K82","v":"1) Access control standard or security policy or similar document\n- Check that all online purchase and PoS transactions (both merchant and cash-out if applicable) include a customer confirmation step which involves use of both their handset and PIN.\n\n2) Demonstration of web and PoS transactions (if possible)\n- Check that all web and PoS merchant / cash-out transactions include a customer confirmation step which involves use of both their handset and PIN."},{"$f":"'5'!L82","v":0},{"$f":"'5'!M82","v":"Urgent Required"},{"$f":"'5'!N82","v":"Required"},{"$f":"'5'!O82","v":"TechOps"},{"$f":"'5'!P82","v":0},{"$f":"'5'!Q82","v":0},{"$f":"'5'!R82","v":0},{"$f":"'5'!S82","v":0},{"$f":"'5'!T82","v":0},{"$f":"'5'!U82","v":0},{"$f":"'5'!V82","v":0},{"$f":"'5'!W82","v":0},{"$f":"'5'!X82","v":0},{"$f":"'5'!Y82","v":0},{"$f":"'5'!Z82","v":0},{"$f":"'5'!AA82","v":0},{"$f":"'5'!AB82","v":0},{"$f":"'5'!AC82","v":0},{"$f":"'5'!AD82","v":0},{"$f":"'5'!AE82","v":0},{"$f":"'5'!AF82","v":0},{"$f":"'5'!AG82","v":0},{"$f":"'5'!AH82","v":0},{"$f":"'5'!AI82","v":0},{"$f":"'5'!AJ82","v":0},{"$f":"'5'!AK82","v":0},{"$f":"'5'!AL82","v":0},{"$f":"'5'!AM82","v":0},{"$f":"'5'!AN82","v":0},{"$f":"'5'!AO82","v":0},{"$f":"'5'!AP82","v":0},{"$f":"'5'!AQ82","v":0},{"$f":"'5'!AR82","v":0},{"$f":"'5'!AS82","v":0},{"$f":"'5'!AT82","v":0},{"$f":"SUMPRODUCT(IF($N426=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N426=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B83","v":"5"},{"$f":"'5'!C83","v":"5.3"},{"$f":"'5'!D83","v":"5.3.2"},{"$f":"'5'!E83","v":""},{"$f":"'5'!F83","v":"5.3.2.2"},{"$f":"'5'!G83","v":0},{"$f":"'5'!H83","v":0},{"$f":"'5'!I83","v":"5.3.2.2.3"},{"$f":"'5'!J83","v":"5.3.2.2.3: Do all mobile money application users (e.g. customer service staff and agents) have certificates installed on their computers (or another two-factor authentication mechanism)?\n"},{"$f":"'5'!K83","v":"1) Access control standard or security policy or similar document\n- Check that all mobile money application users (e.g. customer service staff and agents) have certificates installed on their computers (or another two-factor authentication mechanism)\n"},{"$f":"'5'!L83","v":0},{"$f":"'5'!M83","v":"Urgent Required"},{"$f":"'5'!N83","v":"Required"},{"$f":"'5'!O83","v":"TechOps"},{"$f":"'5'!P83","v":0},{"$f":"'5'!Q83","v":0},{"$f":"'5'!R83","v":0},{"$f":"'5'!S83","v":0},{"$f":"'5'!T83","v":0},{"$f":"'5'!U83","v":0},{"$f":"'5'!V83","v":0},{"$f":"'5'!W83","v":0},{"$f":"'5'!X83","v":0},{"$f":"'5'!Y83","v":0},{"$f":"'5'!Z83","v":0},{"$f":"'5'!AA83","v":0},{"$f":"'5'!AB83","v":0},{"$f":"'5'!AC83","v":0},{"$f":"'5'!AD83","v":0},{"$f":"'5'!AE83","v":0},{"$f":"'5'!AF83","v":0},{"$f":"'5'!AG83","v":0},{"$f":"'5'!AH83","v":0},{"$f":"'5'!AI83","v":0},{"$f":"'5'!AJ83","v":0},{"$f":"'5'!AK83","v":0},{"$f":"'5'!AL83","v":0},{"$f":"'5'!AM83","v":0},{"$f":"'5'!AN83","v":0},{"$f":"'5'!AO83","v":0},{"$f":"'5'!AP83","v":0},{"$f":"'5'!AQ83","v":0},{"$f":"'5'!AR83","v":0},{"$f":"'5'!AS83","v":0},{"$f":"'5'!AT83","v":0},{"$f":"SUMPRODUCT(IF($N427=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N427=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B84","v":"5"},{"$f":"'5'!C84","v":"5.3"},{"$f":"'5'!D84","v":"5.3.2"},{"$f":"'5'!E84","v":""},{"$f":"'5'!F84","v":"5.3.2.2"},{"$f":"'5'!G84","v":0},{"$f":"'5'!H84","v":0},{"$f":"'5'!I84","v":"5.3.2.2.4"},{"$f":"'5'!J84","v":"5.3.2.2.4: Is two-factor authentication required for any remote access by staff or third parties to mobile money system components (e.g. a certificate on their computer or an access card that generates a pass code)?\n"},{"$f":"'5'!K84","v":"1) Access control standard or security policy or similar document\n- Check that two-factor authentication is required for any remote access (from outside the premises) by staff or third parties to mobile money system components (e.g. a certificate on their computer or an access card that generates a pass code)."},{"$f":"'5'!L84","v":0},{"$f":"'5'!M84","v":"Standard Required"},{"$f":"'5'!N84","v":"Required"},{"$f":"'5'!O84","v":"TechOps"},{"$f":"'5'!P84","v":0},{"$f":"'5'!Q84","v":0},{"$f":"'5'!R84","v":0},{"$f":"'5'!S84","v":0},{"$f":"'5'!T84","v":0},{"$f":"'5'!U84","v":0},{"$f":"'5'!V84","v":0},{"$f":"'5'!W84","v":0},{"$f":"'5'!X84","v":0},{"$f":"'5'!Y84","v":0},{"$f":"'5'!Z84","v":0},{"$f":"'5'!AA84","v":0},{"$f":"'5'!AB84","v":0},{"$f":"'5'!AC84","v":0},{"$f":"'5'!AD84","v":0},{"$f":"'5'!AE84","v":0},{"$f":"'5'!AF84","v":0},{"$f":"'5'!AG84","v":0},{"$f":"'5'!AH84","v":0},{"$f":"'5'!AI84","v":0},{"$f":"'5'!AJ84","v":0},{"$f":"'5'!AK84","v":0},{"$f":"'5'!AL84","v":0},{"$f":"'5'!AM84","v":0},{"$f":"'5'!AN84","v":0},{"$f":"'5'!AO84","v":0},{"$f":"'5'!AP84","v":0},{"$f":"'5'!AQ84","v":0},{"$f":"'5'!AR84","v":0},{"$f":"'5'!AS84","v":0},{"$f":"'5'!AT84","v":0},{"$f":"SUMPRODUCT(IF($N428=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N428=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B85","v":"5"},{"$f":"'5'!C85","v":"5.3"},{"$f":"'5'!D85","v":"5.3.2"},{"$f":"'5'!E85","v":""},{"$f":"'5'!F85","v":"5.3.2.3"},{"$f":"'5'!G85","v":"5.3.2.3: ALLOCATION OF SECURITY CREDENTIALS (PINs) TO CUSTOMERS\nProcedures should be implemented to verify the identity of a customer/agent prior to providing new or replacement security credentials (e.g. PIN or password).\n\nUsers should set their own PIN/password, and steps should be taken to prevent third parties from interference in the setup of customer security credentials. For example, agents should  be made aware that they should not set or change a customer's PIN. \n\nIf customers are provided initially with a temporary PIN/password it should be unique and not guessable and customers should be required to change it on first use. It should be sent in a secure manner: the use of clear text email messages should be avoided. \n\nCustomers and agents should be able to change their own PIN or password."},{"$f":"'5'!H85","v":"PCI DSS, ISO 27002: 2013 Sec. 9.1, 9.2"},{"$f":"'5'!I85","v":"5.3.2.3.1"},{"$f":"'5'!J85","v":"5.3.2.3.1: Are procedures implemented to verify the identity of a customer/agent prior to providing replacement security credentials (e.g. PIN/password)?\n"},{"$f":"'5'!K85","v":"1) Access control standard or security policy or similar document\n- Check that there is a process to verify the identity of a customer/agent prior to providing replacement security credential (e.g. the process in 7.1.1.5)\n2) Demonstration of self-service PIN / password change process (if applicable)\n- Check the process has been implemented"},{"$f":"'5'!L85","v":0},{"$f":"'5'!M85","v":"Urgent Required"},{"$f":"'5'!N85","v":"Required"},{"$f":"'5'!O85","v":"TechOps"},{"$f":"'5'!P85","v":0},{"$f":"'5'!Q85","v":0},{"$f":"'5'!R85","v":0},{"$f":"'5'!S85","v":0},{"$f":"'5'!T85","v":0},{"$f":"'5'!U85","v":0},{"$f":"'5'!V85","v":0},{"$f":"'5'!W85","v":0},{"$f":"'5'!X85","v":0},{"$f":"'5'!Y85","v":0},{"$f":"'5'!Z85","v":0},{"$f":"'5'!AA85","v":0},{"$f":"'5'!AB85","v":0},{"$f":"'5'!AC85","v":0},{"$f":"'5'!AD85","v":0},{"$f":"'5'!AE85","v":0},{"$f":"'5'!AF85","v":0},{"$f":"'5'!AG85","v":0},{"$f":"'5'!AH85","v":0},{"$f":"'5'!AI85","v":0},{"$f":"'5'!AJ85","v":0},{"$f":"'5'!AK85","v":0},{"$f":"'5'!AL85","v":0},{"$f":"'5'!AM85","v":0},{"$f":"'5'!AN85","v":0},{"$f":"'5'!AO85","v":0},{"$f":"'5'!AP85","v":0},{"$f":"'5'!AQ85","v":0},{"$f":"'5'!AR85","v":0},{"$f":"'5'!AS85","v":0},{"$f":"'5'!AT85","v":0},{"$f":"SUMPRODUCT(IF($N429=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N429=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B86","v":"5"},{"$f":"'5'!C86","v":"5.3"},{"$f":"'5'!D86","v":"5.3.2"},{"$f":"'5'!E86","v":""},{"$f":"'5'!F86","v":"5.3.2.3"},{"$f":"'5'!G86","v":0},{"$f":"'5'!H86","v":0},{"$f":"'5'!I86","v":"5.3.2.3.2"},{"$f":"'5'!J86","v":"5.3.2.3.2: If customers and agents are sent temporary PINs / passwords are they required to change them prior to using the mobile money service?\n"},{"$f":"'5'!K86","v":"1) Access control standard or security policy or similar document or demonstration of account creation\n- Check that if temporary PINs/passwords are sent to users they have to change them prior to using the mobile money service.\n"},{"$f":"'5'!L86","v":0},{"$f":"'5'!M86","v":"Standard Required"},{"$f":"'5'!N86","v":"Required"},{"$f":"'5'!O86","v":"TechOps"},{"$f":"'5'!P86","v":0},{"$f":"'5'!Q86","v":0},{"$f":"'5'!R86","v":0},{"$f":"'5'!S86","v":0},{"$f":"'5'!T86","v":0},{"$f":"'5'!U86","v":0},{"$f":"'5'!V86","v":0},{"$f":"'5'!W86","v":0},{"$f":"'5'!X86","v":0},{"$f":"'5'!Y86","v":0},{"$f":"'5'!Z86","v":0},{"$f":"'5'!AA86","v":0},{"$f":"'5'!AB86","v":0},{"$f":"'5'!AC86","v":0},{"$f":"'5'!AD86","v":0},{"$f":"'5'!AE86","v":0},{"$f":"'5'!AF86","v":0},{"$f":"'5'!AG86","v":0},{"$f":"'5'!AH86","v":0},{"$f":"'5'!AI86","v":0},{"$f":"'5'!AJ86","v":0},{"$f":"'5'!AK86","v":0},{"$f":"'5'!AL86","v":0},{"$f":"'5'!AM86","v":0},{"$f":"'5'!AN86","v":0},{"$f":"'5'!AO86","v":0},{"$f":"'5'!AP86","v":0},{"$f":"'5'!AQ86","v":0},{"$f":"'5'!AR86","v":0},{"$f":"'5'!AS86","v":0},{"$f":"'5'!AT86","v":0},{"$f":"SUMPRODUCT(IF($N430=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N430=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B87","v":"5"},{"$f":"'5'!C87","v":"5.3"},{"$f":"'5'!D87","v":"5.3.2"},{"$f":"'5'!E87","v":""},{"$f":"'5'!F87","v":"5.3.2.3"},{"$f":"'5'!G87","v":0},{"$f":"'5'!H87","v":0},{"$f":"'5'!I87","v":"5.3.2.3.3"},{"$f":"'5'!J87","v":"5.3.2.3.3: Are temporary PINs sent to customers securely, and are all temporary PINs unique and not guessable?\n"},{"$f":"'5'!K87","v":0},{"$f":"'5'!L87","v":0},{"$f":"'5'!M87","v":"Recommended"},{"$f":"'5'!N87","v":"Recommended"},{"$f":"'5'!O87","v":"TechOps"},{"$f":"'5'!P87","v":0},{"$f":"'5'!Q87","v":0},{"$f":"'5'!R87","v":0},{"$f":"'5'!S87","v":0},{"$f":"'5'!T87","v":0},{"$f":"'5'!U87","v":0},{"$f":"'5'!V87","v":0},{"$f":"'5'!W87","v":0},{"$f":"'5'!X87","v":0},{"$f":"'5'!Y87","v":0},{"$f":"'5'!Z87","v":0},{"$f":"'5'!AA87","v":0},{"$f":"'5'!AB87","v":0},{"$f":"'5'!AC87","v":0},{"$f":"'5'!AD87","v":0},{"$f":"'5'!AE87","v":0},{"$f":"'5'!AF87","v":0},{"$f":"'5'!AG87","v":0},{"$f":"'5'!AH87","v":0},{"$f":"'5'!AI87","v":0},{"$f":"'5'!AJ87","v":0},{"$f":"'5'!AK87","v":0},{"$f":"'5'!AL87","v":0},{"$f":"'5'!AM87","v":0},{"$f":"'5'!AN87","v":0},{"$f":"'5'!AO87","v":0},{"$f":"'5'!AP87","v":0},{"$f":"'5'!AQ87","v":0},{"$f":"'5'!AR87","v":0},{"$f":"'5'!AS87","v":0},{"$f":"'5'!AT87","v":0},{"$f":"SUMPRODUCT(IF($N431=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N431=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B88","v":"5"},{"$f":"'5'!C88","v":"5.3"},{"$f":"'5'!D88","v":"5.3.2"},{"$f":"'5'!E88","v":0},{"$f":"'5'!F88","v":"5.3.2.3"},{"$f":"'5'!G88","v":0},{"$f":"'5'!H88","v":0},{"$f":"'5'!I88","v":0},{"$f":"'5'!J88","v":"5.3.2.3.4: Can customers and agents change their own PIN or password?\n"},{"$f":"'5'!K88","v":0},{"$f":"'5'!L88","v":0},{"$f":"'5'!M88","v":"Recommended"},{"$f":"'5'!N88","v":"Recommended"},{"$f":"'5'!O88","v":"TechOps"},{"$f":"'5'!P88","v":0},{"$f":"'5'!Q88","v":0},{"$f":"'5'!R88","v":0},{"$f":"'5'!S88","v":0},{"$f":"'5'!T88","v":0},{"$f":"'5'!U88","v":0},{"$f":"'5'!V88","v":0},{"$f":"'5'!W88","v":0},{"$f":"'5'!X88","v":0},{"$f":"'5'!Y88","v":0},{"$f":"'5'!Z88","v":0},{"$f":"'5'!AA88","v":0},{"$f":"'5'!AB88","v":0},{"$f":"'5'!AC88","v":0},{"$f":"'5'!AD88","v":0},{"$f":"'5'!AE88","v":0},{"$f":"'5'!AF88","v":0},{"$f":"'5'!AG88","v":0},{"$f":"'5'!AH88","v":0},{"$f":"'5'!AI88","v":0},{"$f":"'5'!AJ88","v":0},{"$f":"'5'!AK88","v":0},{"$f":"'5'!AL88","v":0},{"$f":"'5'!AM88","v":0},{"$f":"'5'!AN88","v":0},{"$f":"'5'!AO88","v":0},{"$f":"'5'!AP88","v":0},{"$f":"'5'!AQ88","v":0},{"$f":"'5'!AR88","v":0},{"$f":"'5'!AS88","v":0},{"$f":"'5'!AT88","v":0},{"$f":"SUMPRODUCT(IF($N432=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N432=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B89","v":"5"},{"$f":"'5'!C89","v":"5.3"},{"$f":"'5'!D89","v":"5.3.2"},{"$f":"'5'!E89","v":""},{"$f":"'5'!F89","v":"5.3.2.3"},{"$f":"'5'!G89","v":0},{"$f":"'5'!H89","v":0},{"$f":"'5'!I89","v":"5.3.2.3.5"},{"$f":"'5'!J89","v":"5.3.2.3.5: Are agents made aware that they should not set up or change a customer's security credentials?\n"},{"$f":"'5'!K89","v":0},{"$f":"'5'!L89","v":0},{"$f":"'5'!M89","v":"Recommended"},{"$f":"'5'!N89","v":"Recommended"},{"$f":"'5'!O89","v":"TechOps"},{"$f":"'5'!P89","v":0},{"$f":"'5'!Q89","v":0},{"$f":"'5'!R89","v":0},{"$f":"'5'!S89","v":0},{"$f":"'5'!T89","v":0},{"$f":"'5'!U89","v":0},{"$f":"'5'!V89","v":0},{"$f":"'5'!W89","v":0},{"$f":"'5'!X89","v":0},{"$f":"'5'!Y89","v":0},{"$f":"'5'!Z89","v":0},{"$f":"'5'!AA89","v":0},{"$f":"'5'!AB89","v":0},{"$f":"'5'!AC89","v":0},{"$f":"'5'!AD89","v":0},{"$f":"'5'!AE89","v":0},{"$f":"'5'!AF89","v":0},{"$f":"'5'!AG89","v":0},{"$f":"'5'!AH89","v":0},{"$f":"'5'!AI89","v":0},{"$f":"'5'!AJ89","v":0},{"$f":"'5'!AK89","v":0},{"$f":"'5'!AL89","v":0},{"$f":"'5'!AM89","v":0},{"$f":"'5'!AN89","v":0},{"$f":"'5'!AO89","v":0},{"$f":"'5'!AP89","v":0},{"$f":"'5'!AQ89","v":0},{"$f":"'5'!AR89","v":0},{"$f":"'5'!AS89","v":0},{"$f":"'5'!AT89","v":0},{"$f":"SUMPRODUCT(IF($N433=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N433=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B90","v":"5"},{"$f":"'5'!C90","v":"5.3"},{"$f":"'5'!D90","v":"5.3.3"},{"$f":"'5'!E90","v":"5.3.3: Providers shall limit access to customer data on a “need to know” basis"},{"$f":"'5'!F90","v":"5.3.3.1"},{"$f":"'5'!G90","v":"5.3.3.1: ROLE-BASED AUTHORIZATION FOR MOBILE MONEY APPLICATION USERS\nRole-based permissions should be employed for operator accounts in the mobile money system so that specific functions can be assigned to individuals on a granular level, so that users can be restricted to access only the data and perform only the functions that they are supposed to.\n\nMaker-checker should be implemented to prevent a single person from accessing or modifying financial information without authorization or detection. Maker-checker should be enforced for these functions:\n  - financially-sensitive actions/events such as moving money between accounts, \n  - creating more operator accounts (which could be used to steal funds);\n  - accessing and modifying audit records to hide their tracks.\n\nThe possibility of collusion should be considered in designing the controls. Whenever it is difficult to segregate, other controls such as monitoring of activities, audit trails and management supervision should be prioritised."},{"$f":"'5'!H90","v":"ISO 27002:2013 Sec. 9.2, BCBS RMPEB"},{"$f":"'5'!I90","v":"5.3.3.1.1"},{"$f":"'5'!J90","v":"5.3.3.1.1: Are role-based permissions employed to restrict users to access only the data and perform only the functions that they are supposed to?\n"},{"$f":"'5'!K90","v":"1) Role permission report / matrix\n- Check that operator accounts in the mobile money system are role-based.\n- Check that there is an assessment on what roles are required and what permissions each role should have."},{"$f":"'5'!L90","v":0},{"$f":"'5'!M90","v":"Urgent Required"},{"$f":"'5'!N90","v":"Required"},{"$f":"'5'!O90","v":"TechOps"},{"$f":"'5'!P90","v":0},{"$f":"'5'!Q90","v":0},{"$f":"'5'!R90","v":0},{"$f":"'5'!S90","v":0},{"$f":"'5'!T90","v":0},{"$f":"'5'!U90","v":0},{"$f":"'5'!V90","v":0},{"$f":"'5'!W90","v":0},{"$f":"'5'!X90","v":0},{"$f":"'5'!Y90","v":0},{"$f":"'5'!Z90","v":0},{"$f":"'5'!AA90","v":0},{"$f":"'5'!AB90","v":0},{"$f":"'5'!AC90","v":0},{"$f":"'5'!AD90","v":0},{"$f":"'5'!AE90","v":0},{"$f":"'5'!AF90","v":0},{"$f":"'5'!AG90","v":0},{"$f":"'5'!AH90","v":0},{"$f":"'5'!AI90","v":0},{"$f":"'5'!AJ90","v":0},{"$f":"'5'!AK90","v":0},{"$f":"'5'!AL90","v":0},{"$f":"'5'!AM90","v":0},{"$f":"'5'!AN90","v":0},{"$f":"'5'!AO90","v":0},{"$f":"'5'!AP90","v":0},{"$f":"'5'!AQ90","v":0},{"$f":"'5'!AR90","v":0},{"$f":"'5'!AS90","v":0},{"$f":"'5'!AT90","v":0},{"$f":"SUMPRODUCT(IF($N434=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N434=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B91","v":"5"},{"$f":"'5'!C91","v":"5.3"},{"$f":"'5'!D91","v":"5.3.3"},{"$f":"'5'!E91","v":0},{"$f":"'5'!F91","v":"5.3.3.1"},{"$f":"'5'!G91","v":0},{"$f":"'5'!H91","v":0},{"$f":"'5'!I91","v":"5.3.3.1.2"},{"$f":"'5'!J91","v":"5.3.3.1.2: Is maker-checker enforced for all financially-sensitive actions (e.g. moving money between accounts)?\n"},{"$f":"'5'!K91","v":"1) Role permission report / matrix\n- Check that maker-checker controls are in place for all financially-sensitive actions.\n"},{"$f":"'5'!L91","v":0},{"$f":"'5'!M91","v":"Urgent Required"},{"$f":"'5'!N91","v":"Required"},{"$f":"'5'!O91","v":"TechOps"},{"$f":"'5'!P91","v":0},{"$f":"'5'!Q91","v":0},{"$f":"'5'!R91","v":0},{"$f":"'5'!S91","v":0},{"$f":"'5'!T91","v":0},{"$f":"'5'!U91","v":0},{"$f":"'5'!V91","v":0},{"$f":"'5'!W91","v":0},{"$f":"'5'!X91","v":0},{"$f":"'5'!Y91","v":0},{"$f":"'5'!Z91","v":0},{"$f":"'5'!AA91","v":0},{"$f":"'5'!AB91","v":0},{"$f":"'5'!AC91","v":0},{"$f":"'5'!AD91","v":0},{"$f":"'5'!AE91","v":0},{"$f":"'5'!AF91","v":0},{"$f":"'5'!AG91","v":0},{"$f":"'5'!AH91","v":0},{"$f":"'5'!AI91","v":0},{"$f":"'5'!AJ91","v":0},{"$f":"'5'!AK91","v":0},{"$f":"'5'!AL91","v":0},{"$f":"'5'!AM91","v":0},{"$f":"'5'!AN91","v":0},{"$f":"'5'!AO91","v":0},{"$f":"'5'!AP91","v":0},{"$f":"'5'!AQ91","v":0},{"$f":"'5'!AR91","v":0},{"$f":"'5'!AS91","v":0},{"$f":"'5'!AT91","v":0},{"$f":"SUMPRODUCT(IF($N435=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N435=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B92","v":"5"},{"$f":"'5'!C92","v":"5.3"},{"$f":"'5'!D92","v":"5.3.3"},{"$f":"'5'!E92","v":0},{"$f":"'5'!F92","v":"5.3.3.1"},{"$f":"'5'!G92","v":0},{"$f":"'5'!H92","v":0},{"$f":"'5'!I92","v":"5.3.3.1.3"},{"$f":"'5'!J92","v":"5.3.3.1.3: Is maker-checker enforced for operator-creation functions, so that normal operators cannot create more operator accounts (which could potentially be used to steal funds)?\n"},{"$f":"'5'!K92","v":"1) Role permission report / matrix\n- Check there is maker-checker in place for operator-creation functions.\n- Check that regular operator permissions do not include the ability to create more operators."},{"$f":"'5'!L92","v":0},{"$f":"'5'!M92","v":"Urgent Required"},{"$f":"'5'!N92","v":"Required"},{"$f":"'5'!O92","v":"TechOps"},{"$f":"'5'!P92","v":0},{"$f":"'5'!Q92","v":0},{"$f":"'5'!R92","v":0},{"$f":"'5'!S92","v":0},{"$f":"'5'!T92","v":0},{"$f":"'5'!U92","v":0},{"$f":"'5'!V92","v":0},{"$f":"'5'!W92","v":0},{"$f":"'5'!X92","v":0},{"$f":"'5'!Y92","v":0},{"$f":"'5'!Z92","v":0},{"$f":"'5'!AA92","v":0},{"$f":"'5'!AB92","v":0},{"$f":"'5'!AC92","v":0},{"$f":"'5'!AD92","v":0},{"$f":"'5'!AE92","v":0},{"$f":"'5'!AF92","v":0},{"$f":"'5'!AG92","v":0},{"$f":"'5'!AH92","v":0},{"$f":"'5'!AI92","v":0},{"$f":"'5'!AJ92","v":0},{"$f":"'5'!AK92","v":0},{"$f":"'5'!AL92","v":0},{"$f":"'5'!AM92","v":0},{"$f":"'5'!AN92","v":0},{"$f":"'5'!AO92","v":0},{"$f":"'5'!AP92","v":0},{"$f":"'5'!AQ92","v":0},{"$f":"'5'!AR92","v":0},{"$f":"'5'!AS92","v":0},{"$f":"'5'!AT92","v":0},{"$f":"SUMPRODUCT(IF($N436=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N436=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B93","v":"5"},{"$f":"'5'!C93","v":"5.3"},{"$f":"'5'!D93","v":"5.3.3"},{"$f":"'5'!E93","v":""},{"$f":"'5'!F93","v":"5.3.3.1"},{"$f":"'5'!G93","v":0},{"$f":"'5'!H93","v":0},{"$f":"'5'!I93","v":"5.3.3.1.4"},{"$f":"'5'!J93","v":"5.3.3.1.4: Where segregation of duties is difficult, are other controls such as monitoring of activities, audit trails, and management supervision prioritised?\n"},{"$f":"'5'!K93","v":0},{"$f":"'5'!L93","v":0},{"$f":"'5'!M93","v":"Recommended"},{"$f":"'5'!N93","v":"Recommended"},{"$f":"'5'!O93","v":"TechOps"},{"$f":"'5'!P93","v":0},{"$f":"'5'!Q93","v":0},{"$f":"'5'!R93","v":0},{"$f":"'5'!S93","v":0},{"$f":"'5'!T93","v":0},{"$f":"'5'!U93","v":0},{"$f":"'5'!V93","v":0},{"$f":"'5'!W93","v":0},{"$f":"'5'!X93","v":0},{"$f":"'5'!Y93","v":0},{"$f":"'5'!Z93","v":0},{"$f":"'5'!AA93","v":0},{"$f":"'5'!AB93","v":0},{"$f":"'5'!AC93","v":0},{"$f":"'5'!AD93","v":0},{"$f":"'5'!AE93","v":0},{"$f":"'5'!AF93","v":0},{"$f":"'5'!AG93","v":0},{"$f":"'5'!AH93","v":0},{"$f":"'5'!AI93","v":0},{"$f":"'5'!AJ93","v":0},{"$f":"'5'!AK93","v":0},{"$f":"'5'!AL93","v":0},{"$f":"'5'!AM93","v":0},{"$f":"'5'!AN93","v":0},{"$f":"'5'!AO93","v":0},{"$f":"'5'!AP93","v":0},{"$f":"'5'!AQ93","v":0},{"$f":"'5'!AR93","v":0},{"$f":"'5'!AS93","v":0},{"$f":"'5'!AT93","v":0},{"$f":"SUMPRODUCT(IF($N437=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N437=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B94","v":"5"},{"$f":"'5'!C94","v":"5.3"},{"$f":"'5'!D94","v":"5.3.3"},{"$f":"'5'!E94","v":0},{"$f":"'5'!F94","v":"5.3.3.2"},{"$f":"'5'!G94","v":"5.3.3.2: AUTHORIZATION FOR MOBILE MONEY SYSTEM COMPONENTS\nProviders should limit access to system components, databases and log files to only those individuals whose job requires such access, following the principle of \"least privilege\". Providers should: \n- restrict access to the system components and data resources that each user needs to access for their job function;\n- restrict access to the least privilege necessary to perform job responsibilities;\n- require documented approval (electronically or in writing) by authorized parties for all new and changed account privileges.\n\nSpecific controls should be applied to databases containing financial and customer data:\n- Direct access to databases should be carefully controlled and only granted to database administrators.\n- Application IDs for database applications must only be used by the applications (and not by individual users or other non-application processes). It is recommended that monitoring is implemented to check for this.\n\nA user account and role/permissions report should be run at least every three months to highlight those accounts with inappropriate permissions."},{"$f":"'5'!H94","v":"PCI DSS, ISO 27002: 2013 Sec. 9.2, 9.4"},{"$f":"'5'!I94","v":"5.3.3.2.1"},{"$f":"'5'!J94","v":"5.3.3.2.1: Is access to back-end mobile money system components/ databases/log files restricted to only those individuals whose job requires such access, restricting access to the least privilege and only those components necessary to perform job responsibilities?\n"},{"$f":"'5'!K94","v":"1) Access control standard or security policy or similar document\n- Check there is a process to give access to back-end mobile money system components/databases/log files.\n- Check the process include assessment as to what access is required.\n- Check the process only gives the access permissions that are required and only to the required components.\n"},{"$f":"'5'!L94","v":0},{"$f":"'5'!M94","v":"Urgent Required"},{"$f":"'5'!N94","v":"Required"},{"$f":"'5'!O94","v":"TechOps"},{"$f":"'5'!P94","v":0},{"$f":"'5'!Q94","v":0},{"$f":"'5'!R94","v":0},{"$f":"'5'!S94","v":0},{"$f":"'5'!T94","v":0},{"$f":"'5'!U94","v":0},{"$f":"'5'!V94","v":0},{"$f":"'5'!W94","v":0},{"$f":"'5'!X94","v":0},{"$f":"'5'!Y94","v":0},{"$f":"'5'!Z94","v":0},{"$f":"'5'!AA94","v":0},{"$f":"'5'!AB94","v":0},{"$f":"'5'!AC94","v":0},{"$f":"'5'!AD94","v":0},{"$f":"'5'!AE94","v":0},{"$f":"'5'!AF94","v":0},{"$f":"'5'!AG94","v":0},{"$f":"'5'!AH94","v":0},{"$f":"'5'!AI94","v":0},{"$f":"'5'!AJ94","v":0},{"$f":"'5'!AK94","v":0},{"$f":"'5'!AL94","v":0},{"$f":"'5'!AM94","v":0},{"$f":"'5'!AN94","v":0},{"$f":"'5'!AO94","v":0},{"$f":"'5'!AP94","v":0},{"$f":"'5'!AQ94","v":0},{"$f":"'5'!AR94","v":0},{"$f":"'5'!AS94","v":0},{"$f":"'5'!AT94","v":0},{"$f":"SUMPRODUCT(IF($N438=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N438=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B95","v":"5"},{"$f":"'5'!C95","v":"5.3"},{"$f":"'5'!D95","v":"5.3.3"},{"$f":"'5'!E95","v":""},{"$f":"'5'!F95","v":"5.3.3.2"},{"$f":"'5'!G95","v":0},{"$f":"'5'!H95","v":0},{"$f":"'5'!I95","v":"5.3.3.2.2"},{"$f":"'5'!J95","v":"5.3.3.2.2: Is documented approval by authorized parties required for all new and changed account privileges?\n"},{"$f":"'5'!K95","v":"1) Access control standard or security policy or similar document\n- Check that there is a process that requires documented approval by authorised parties required for all:\na) new account privileges\nb) changes in account privileges\n- Check that there is a process to identify who is authorised to approve new and changes to account privileges\n"},{"$f":"'5'!L95","v":0},{"$f":"'5'!M95","v":"Urgent Required"},{"$f":"'5'!N95","v":"Required"},{"$f":"'5'!O95","v":"TechOps"},{"$f":"'5'!P95","v":0},{"$f":"'5'!Q95","v":0},{"$f":"'5'!R95","v":0},{"$f":"'5'!S95","v":0},{"$f":"'5'!T95","v":0},{"$f":"'5'!U95","v":0},{"$f":"'5'!V95","v":0},{"$f":"'5'!W95","v":0},{"$f":"'5'!X95","v":0},{"$f":"'5'!Y95","v":0},{"$f":"'5'!Z95","v":0},{"$f":"'5'!AA95","v":0},{"$f":"'5'!AB95","v":0},{"$f":"'5'!AC95","v":0},{"$f":"'5'!AD95","v":0},{"$f":"'5'!AE95","v":0},{"$f":"'5'!AF95","v":0},{"$f":"'5'!AG95","v":0},{"$f":"'5'!AH95","v":0},{"$f":"'5'!AI95","v":0},{"$f":"'5'!AJ95","v":0},{"$f":"'5'!AK95","v":0},{"$f":"'5'!AL95","v":0},{"$f":"'5'!AM95","v":0},{"$f":"'5'!AN95","v":0},{"$f":"'5'!AO95","v":0},{"$f":"'5'!AP95","v":0},{"$f":"'5'!AQ95","v":0},{"$f":"'5'!AR95","v":0},{"$f":"'5'!AS95","v":0},{"$f":"'5'!AT95","v":0},{"$f":"SUMPRODUCT(IF($N439=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N439=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B96","v":"5"},{"$f":"'5'!C96","v":"5.3"},{"$f":"'5'!D96","v":"5.3.3"},{"$f":"'5'!E96","v":""},{"$f":"'5'!F96","v":"5.3.3.2"},{"$f":"'5'!G96","v":0},{"$f":"'5'!H96","v":0},{"$f":"'5'!I96","v":"5.3.3.2.3"},{"$f":"'5'!J96","v":"5.3.3.2.3: Is direct access to databases carefully controlled and only given to database administrators?\n"},{"$f":"'5'!K96","v":"1) Access control standard or security policy or similar document\n- Check that there is a process that restricts direct access to databases with only database administrators granted access\n- Check that there are controls in place for granting direct access to the database\n"},{"$f":"'5'!L96","v":0},{"$f":"'5'!M96","v":"Standard Required"},{"$f":"'5'!N96","v":"Required"},{"$f":"'5'!O96","v":"TechOps"},{"$f":"'5'!P96","v":0},{"$f":"'5'!Q96","v":0},{"$f":"'5'!R96","v":0},{"$f":"'5'!S96","v":0},{"$f":"'5'!T96","v":0},{"$f":"'5'!U96","v":0},{"$f":"'5'!V96","v":0},{"$f":"'5'!W96","v":0},{"$f":"'5'!X96","v":0},{"$f":"'5'!Y96","v":0},{"$f":"'5'!Z96","v":0},{"$f":"'5'!AA96","v":0},{"$f":"'5'!AB96","v":0},{"$f":"'5'!AC96","v":0},{"$f":"'5'!AD96","v":0},{"$f":"'5'!AE96","v":0},{"$f":"'5'!AF96","v":0},{"$f":"'5'!AG96","v":0},{"$f":"'5'!AH96","v":0},{"$f":"'5'!AI96","v":0},{"$f":"'5'!AJ96","v":0},{"$f":"'5'!AK96","v":0},{"$f":"'5'!AL96","v":0},{"$f":"'5'!AM96","v":0},{"$f":"'5'!AN96","v":0},{"$f":"'5'!AO96","v":0},{"$f":"'5'!AP96","v":0},{"$f":"'5'!AQ96","v":0},{"$f":"'5'!AR96","v":0},{"$f":"'5'!AS96","v":0},{"$f":"'5'!AT96","v":0},{"$f":"SUMPRODUCT(IF($N440=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N440=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B97","v":"5"},{"$f":"'5'!C97","v":"5.3"},{"$f":"'5'!D97","v":"5.3.3"},{"$f":"'5'!E97","v":""},{"$f":"'5'!F97","v":"5.3.3.2"},{"$f":"'5'!G97","v":0},{"$f":"'5'!H97","v":0},{"$f":"'5'!I97","v":"5.3.3.2.4"},{"$f":"'5'!J97","v":"5.3.3.2.4: Are application IDs for database applications only used by the applications and not by individual users or other non-application processes?\n"},{"$f":"'5'!K97","v":"1) Access control standard or security policy or similar document\n- Check there is a process to ensure application IDs for databases are not used by individuals or other non-application processes."},{"$f":"'5'!L97","v":0},{"$f":"'5'!M97","v":"Recommended"},{"$f":"'5'!N97","v":"Recommended"},{"$f":"'5'!O97","v":"TechOps"},{"$f":"'5'!P97","v":0},{"$f":"'5'!Q97","v":0},{"$f":"'5'!R97","v":0},{"$f":"'5'!S97","v":0},{"$f":"'5'!T97","v":0},{"$f":"'5'!U97","v":0},{"$f":"'5'!V97","v":0},{"$f":"'5'!W97","v":0},{"$f":"'5'!X97","v":0},{"$f":"'5'!Y97","v":0},{"$f":"'5'!Z97","v":0},{"$f":"'5'!AA97","v":0},{"$f":"'5'!AB97","v":0},{"$f":"'5'!AC97","v":0},{"$f":"'5'!AD97","v":0},{"$f":"'5'!AE97","v":0},{"$f":"'5'!AF97","v":0},{"$f":"'5'!AG97","v":0},{"$f":"'5'!AH97","v":0},{"$f":"'5'!AI97","v":0},{"$f":"'5'!AJ97","v":0},{"$f":"'5'!AK97","v":0},{"$f":"'5'!AL97","v":0},{"$f":"'5'!AM97","v":0},{"$f":"'5'!AN97","v":0},{"$f":"'5'!AO97","v":0},{"$f":"'5'!AP97","v":0},{"$f":"'5'!AQ97","v":0},{"$f":"'5'!AR97","v":0},{"$f":"'5'!AS97","v":0},{"$f":"'5'!AT97","v":0},{"$f":"SUMPRODUCT(IF($N441=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N441=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B98","v":"5"},{"$f":"'5'!C98","v":"5.3"},{"$f":"'5'!D98","v":"5.3.3"},{"$f":"'5'!E98","v":""},{"$f":"'5'!F98","v":"5.3.3.2"},{"$f":"'5'!G98","v":0},{"$f":"'5'!H98","v":0},{"$f":"'5'!I98","v":"5.3.3.2.5"},{"$f":"'5'!J98","v":"5.3.3.2.5: Is a user account and role/ permissions report run at least every three months to highlight those accounts with inappropriate permissions?\n"},{"$f":"'5'!K98","v":"1) Access control standard or security policy or similar document\n- Check that there is a process to run reports on user account and role permissions to highlight accounts with inappropriate permissions\n- Check that the process is scheduled to be run at least every three months\n- Check the records of reports to assess that the process is being run at least every three months\n"},{"$f":"'5'!L98","v":0},{"$f":"'5'!M98","v":"Standard Required"},{"$f":"'5'!N98","v":"Required"},{"$f":"'5'!O98","v":"TechOps"},{"$f":"'5'!P98","v":0},{"$f":"'5'!Q98","v":0},{"$f":"'5'!R98","v":0},{"$f":"'5'!S98","v":0},{"$f":"'5'!T98","v":0},{"$f":"'5'!U98","v":0},{"$f":"'5'!V98","v":0},{"$f":"'5'!W98","v":0},{"$f":"'5'!X98","v":0},{"$f":"'5'!Y98","v":0},{"$f":"'5'!Z98","v":0},{"$f":"'5'!AA98","v":0},{"$f":"'5'!AB98","v":0},{"$f":"'5'!AC98","v":0},{"$f":"'5'!AD98","v":0},{"$f":"'5'!AE98","v":0},{"$f":"'5'!AF98","v":0},{"$f":"'5'!AG98","v":0},{"$f":"'5'!AH98","v":0},{"$f":"'5'!AI98","v":0},{"$f":"'5'!AJ98","v":0},{"$f":"'5'!AK98","v":0},{"$f":"'5'!AL98","v":0},{"$f":"'5'!AM98","v":0},{"$f":"'5'!AN98","v":0},{"$f":"'5'!AO98","v":0},{"$f":"'5'!AP98","v":0},{"$f":"'5'!AQ98","v":0},{"$f":"'5'!AR98","v":0},{"$f":"'5'!AS98","v":0},{"$f":"'5'!AT98","v":0},{"$f":"SUMPRODUCT(IF($N442=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N442=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B99","v":"5"},{"$f":"'5'!C99","v":"5.3"},{"$f":"'5'!D99","v":"5.3.4"},{"$f":"'5'!E99","v":"5.3.4: Providers shall limit physical access to systems"},{"$f":"'5'!F99","v":"5.3.4.1"},{"$f":"'5'!G99","v":"5.3.4.1: ACCESS CONTROL POLICY - PHYSICAL ACCESS\nProviders should control physical access for onsite personnel to sensitive areas such as data centres. Access must be authorized and based on individual job function. \n\nThe policy should require that physical access privileges should be assigned only to those users that require it. Visitor access should be strictly controlled.\n\nPhysical access rights should be revoked promptly upon termination, and all physical access mechanisms (such as keys and access cards) should be returned or disabled."},{"$f":"'5'!H99","v":"PCI DSS, ISO 27002:2013 Sec. 11.1"},{"$f":"'5'!I99","v":"5.3.4.1.1"},{"$f":"'5'!J99","v":"5.3.4.1.1: Is access to mobile money system data centres restricted to authorized personnel, and only when required for the individual’s job function?\n"},{"$f":"'5'!K99","v":"1) Access control standard or security policy or similar document\n- Check physical access to the mobile money system's data centre is restricted to authorised personnel.\n- Check those who have authorised access the data-centre only access it when their individual job requires it.\n(Note: if practical, visit the datacentre to assess if the above is operational)\n"},{"$f":"'5'!L99","v":0},{"$f":"'5'!M99","v":"Urgent Required"},{"$f":"'5'!N99","v":"Required"},{"$f":"'5'!O99","v":"TechOps"},{"$f":"'5'!P99","v":0},{"$f":"'5'!Q99","v":0},{"$f":"'5'!R99","v":0},{"$f":"'5'!S99","v":0},{"$f":"'5'!T99","v":0},{"$f":"'5'!U99","v":0},{"$f":"'5'!V99","v":0},{"$f":"'5'!W99","v":0},{"$f":"'5'!X99","v":0},{"$f":"'5'!Y99","v":0},{"$f":"'5'!Z99","v":0},{"$f":"'5'!AA99","v":0},{"$f":"'5'!AB99","v":0},{"$f":"'5'!AC99","v":0},{"$f":"'5'!AD99","v":0},{"$f":"'5'!AE99","v":0},{"$f":"'5'!AF99","v":0},{"$f":"'5'!AG99","v":0},{"$f":"'5'!AH99","v":0},{"$f":"'5'!AI99","v":0},{"$f":"'5'!AJ99","v":0},{"$f":"'5'!AK99","v":0},{"$f":"'5'!AL99","v":0},{"$f":"'5'!AM99","v":0},{"$f":"'5'!AN99","v":0},{"$f":"'5'!AO99","v":0},{"$f":"'5'!AP99","v":0},{"$f":"'5'!AQ99","v":0},{"$f":"'5'!AR99","v":0},{"$f":"'5'!AS99","v":0},{"$f":"'5'!AT99","v":0},{"$f":"SUMPRODUCT(IF($N443=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N443=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B100","v":"5"},{"$f":"'5'!C100","v":"5.3"},{"$f":"'5'!D100","v":"5.3.4"},{"$f":"'5'!E100","v":""},{"$f":"'5'!F100","v":"5.3.4.1"},{"$f":"'5'!G100","v":0},{"$f":"'5'!H100","v":0},{"$f":"'5'!I100","v":"5.3.4.1.2"},{"$f":"'5'!J100","v":"5.3.4.1.2: Are physical access rights revoked promptly upon termination of an employee, and all physical access mechanisms (such as keys and access cards) returned or disabled?\n"},{"$f":"'5'!K100","v":"1) Access control standard or security policy or similar document\n- Check that there is a process to revoke all physical access rights promptly upon the termination of an employee\n- Check that the process includes the return/disabling of access mechanisms (i.e. keys and access cards)\n(Note: if practical, visit the data centre to assess if the above is operational)\n"},{"$f":"'5'!L100","v":0},{"$f":"'5'!M100","v":"Standard Required"},{"$f":"'5'!N100","v":"Required"},{"$f":"'5'!O100","v":"TechOps"},{"$f":"'5'!P100","v":0},{"$f":"'5'!Q100","v":0},{"$f":"'5'!R100","v":0},{"$f":"'5'!S100","v":0},{"$f":"'5'!T100","v":0},{"$f":"'5'!U100","v":0},{"$f":"'5'!V100","v":0},{"$f":"'5'!W100","v":0},{"$f":"'5'!X100","v":0},{"$f":"'5'!Y100","v":0},{"$f":"'5'!Z100","v":0},{"$f":"'5'!AA100","v":0},{"$f":"'5'!AB100","v":0},{"$f":"'5'!AC100","v":0},{"$f":"'5'!AD100","v":0},{"$f":"'5'!AE100","v":0},{"$f":"'5'!AF100","v":0},{"$f":"'5'!AG100","v":0},{"$f":"'5'!AH100","v":0},{"$f":"'5'!AI100","v":0},{"$f":"'5'!AJ100","v":0},{"$f":"'5'!AK100","v":0},{"$f":"'5'!AL100","v":0},{"$f":"'5'!AM100","v":0},{"$f":"'5'!AN100","v":0},{"$f":"'5'!AO100","v":0},{"$f":"'5'!AP100","v":0},{"$f":"'5'!AQ100","v":0},{"$f":"'5'!AR100","v":0},{"$f":"'5'!AS100","v":0},{"$f":"'5'!AT100","v":0},{"$f":"SUMPRODUCT(IF($N444=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N444=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B101","v":"5"},{"$f":"'5'!C101","v":"5.3"},{"$f":"'5'!D101","v":"5.3.4"},{"$f":"'5'!E101","v":""},{"$f":"'5'!F101","v":"5.3.4.2"},{"$f":"'5'!G101","v":"5.3.4.2: PHYSICAL ACCESS - ENTRY CONTROLS\nProviders should use appropriate facility entry controls to limit and monitor physical access to computer rooms, data centres, and other physical areas with mobile money system components. Providers should:\n- control entry with locked doors and mechanisms to avoid tailgating (unauthorized people following authorized users into the area);\n- maintain logs of people entering the data centre and keep the logs for at least three months;\n- implement controls to restrict access to network points and telecommunication lines.\n"},{"$f":"'5'!H101","v":"PCI DSS, ISO 27002: 2013 Sec. 11.1"},{"$f":"'5'!I101","v":"5.3.4.2.1"},{"$f":"'5'!J101","v":"5.3.4.2.1: Are there physical security controls for each computer room, data centre, and other physical areas with mobile money system components?\n"},{"$f":"'5'!K101","v":"1) Access control standard or security policy or similar document\n- Check that there are physical security controls for each computer room, data centre and any other physical areas that contain mobile money system components\n(Note: if practical, visit the data centre to assess if the above is operational)\n"},{"$f":"'5'!L101","v":0},{"$f":"'5'!M101","v":"Urgent Required"},{"$f":"'5'!N101","v":"Required"},{"$f":"'5'!O101","v":"TechOps"},{"$f":"'5'!P101","v":0},{"$f":"'5'!Q101","v":0},{"$f":"'5'!R101","v":0},{"$f":"'5'!S101","v":0},{"$f":"'5'!T101","v":0},{"$f":"'5'!U101","v":0},{"$f":"'5'!V101","v":0},{"$f":"'5'!W101","v":0},{"$f":"'5'!X101","v":0},{"$f":"'5'!Y101","v":0},{"$f":"'5'!Z101","v":0},{"$f":"'5'!AA101","v":0},{"$f":"'5'!AB101","v":0},{"$f":"'5'!AC101","v":0},{"$f":"'5'!AD101","v":0},{"$f":"'5'!AE101","v":0},{"$f":"'5'!AF101","v":0},{"$f":"'5'!AG101","v":0},{"$f":"'5'!AH101","v":0},{"$f":"'5'!AI101","v":0},{"$f":"'5'!AJ101","v":0},{"$f":"'5'!AK101","v":0},{"$f":"'5'!AL101","v":0},{"$f":"'5'!AM101","v":0},{"$f":"'5'!AN101","v":0},{"$f":"'5'!AO101","v":0},{"$f":"'5'!AP101","v":0},{"$f":"'5'!AQ101","v":0},{"$f":"'5'!AR101","v":0},{"$f":"'5'!AS101","v":0},{"$f":"'5'!AT101","v":0},{"$f":"SUMPRODUCT(IF($N445=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N445=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B102","v":"5"},{"$f":"'5'!C102","v":"5.3"},{"$f":"'5'!D102","v":"5.3.4"},{"$f":"'5'!E102","v":""},{"$f":"'5'!F102","v":"5.3.4.2"},{"$f":"'5'!G102","v":0},{"$f":"'5'!H102","v":0},{"$f":"'5'!I102","v":"5.3.4.2.2"},{"$f":"'5'!J102","v":"5.3.4.2.2: Are logs maintained of people entering the mobile money data centre and kept for at least three months?\n"},{"$f":"'5'!K102","v":"1)  Access control standard or security policy or similar document\n- Check there is a process to log all people that access the mobile money data-centres.\n- Check the log is kept for at least three months.\n\n2) Access log \n- Review log to confirm that logs are maintained of people entering the mobile money data centre and kept for at least three months.\n\n"},{"$f":"'5'!L102","v":0},{"$f":"'5'!M102","v":"Urgent Required"},{"$f":"'5'!N102","v":"Required"},{"$f":"'5'!O102","v":"TechOps"},{"$f":"'5'!P102","v":0},{"$f":"'5'!Q102","v":0},{"$f":"'5'!R102","v":0},{"$f":"'5'!S102","v":0},{"$f":"'5'!T102","v":0},{"$f":"'5'!U102","v":0},{"$f":"'5'!V102","v":0},{"$f":"'5'!W102","v":0},{"$f":"'5'!X102","v":0},{"$f":"'5'!Y102","v":0},{"$f":"'5'!Z102","v":0},{"$f":"'5'!AA102","v":0},{"$f":"'5'!AB102","v":0},{"$f":"'5'!AC102","v":0},{"$f":"'5'!AD102","v":0},{"$f":"'5'!AE102","v":0},{"$f":"'5'!AF102","v":0},{"$f":"'5'!AG102","v":0},{"$f":"'5'!AH102","v":0},{"$f":"'5'!AI102","v":0},{"$f":"'5'!AJ102","v":0},{"$f":"'5'!AK102","v":0},{"$f":"'5'!AL102","v":0},{"$f":"'5'!AM102","v":0},{"$f":"'5'!AN102","v":0},{"$f":"'5'!AO102","v":0},{"$f":"'5'!AP102","v":0},{"$f":"'5'!AQ102","v":0},{"$f":"'5'!AR102","v":0},{"$f":"'5'!AS102","v":0},{"$f":"'5'!AT102","v":0},{"$f":"SUMPRODUCT(IF($N446=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N446=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B103","v":"5"},{"$f":"'5'!C103","v":"5.3"},{"$f":"'5'!D103","v":"5.3.4"},{"$f":"'5'!E103","v":""},{"$f":"'5'!F103","v":"5.3.4.2"},{"$f":"'5'!G103","v":0},{"$f":"'5'!H103","v":0},{"$f":"'5'!I103","v":"5.3.4.2.3"},{"$f":"'5'!J103","v":"5.3.4.2.3: Have controls been implemented in the mobile money data centre to restrict access to network points and telecommunication lines?\n"},{"$f":"'5'!K103","v":"1) Access control standard or security policy or similar document\n- Check that there are security controls that restrict access to network points and telecommunication lines."},{"$f":"'5'!L103","v":0},{"$f":"'5'!M103","v":"Standard Required"},{"$f":"'5'!N103","v":"Required"},{"$f":"'5'!O103","v":"TechOps"},{"$f":"'5'!P103","v":0},{"$f":"'5'!Q103","v":0},{"$f":"'5'!R103","v":0},{"$f":"'5'!S103","v":0},{"$f":"'5'!T103","v":0},{"$f":"'5'!U103","v":0},{"$f":"'5'!V103","v":0},{"$f":"'5'!W103","v":0},{"$f":"'5'!X103","v":0},{"$f":"'5'!Y103","v":0},{"$f":"'5'!Z103","v":0},{"$f":"'5'!AA103","v":0},{"$f":"'5'!AB103","v":0},{"$f":"'5'!AC103","v":0},{"$f":"'5'!AD103","v":0},{"$f":"'5'!AE103","v":0},{"$f":"'5'!AF103","v":0},{"$f":"'5'!AG103","v":0},{"$f":"'5'!AH103","v":0},{"$f":"'5'!AI103","v":0},{"$f":"'5'!AJ103","v":0},{"$f":"'5'!AK103","v":0},{"$f":"'5'!AL103","v":0},{"$f":"'5'!AM103","v":0},{"$f":"'5'!AN103","v":0},{"$f":"'5'!AO103","v":0},{"$f":"'5'!AP103","v":0},{"$f":"'5'!AQ103","v":0},{"$f":"'5'!AR103","v":0},{"$f":"'5'!AS103","v":0},{"$f":"'5'!AT103","v":0},{"$f":"SUMPRODUCT(IF($N447=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N447=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B104","v":"5"},{"$f":"'5'!C104","v":"5.3"},{"$f":"'5'!D104","v":"5.3.4"},{"$f":"'5'!E104","v":""},{"$f":"'5'!F104","v":"5.3.4.2"},{"$f":"'5'!G104","v":0},{"$f":"'5'!H104","v":0},{"$f":"'5'!I104","v":"5.3.4.2.4"},{"$f":"'5'!J104","v":"5.3.4.2.4: Is entry to the mobile money data centre controlled with locked doors and mechanisms to avoid tailgating (unauthorized people following authorized users into the area)?\n"},{"$f":"'5'!K104","v":0},{"$f":"'5'!L104","v":0},{"$f":"'5'!M104","v":"Recommended"},{"$f":"'5'!N104","v":"Recommended"},{"$f":"'5'!O104","v":"TechOps"},{"$f":"'5'!P104","v":0},{"$f":"'5'!Q104","v":0},{"$f":"'5'!R104","v":0},{"$f":"'5'!S104","v":0},{"$f":"'5'!T104","v":0},{"$f":"'5'!U104","v":0},{"$f":"'5'!V104","v":0},{"$f":"'5'!W104","v":0},{"$f":"'5'!X104","v":0},{"$f":"'5'!Y104","v":0},{"$f":"'5'!Z104","v":0},{"$f":"'5'!AA104","v":0},{"$f":"'5'!AB104","v":0},{"$f":"'5'!AC104","v":0},{"$f":"'5'!AD104","v":0},{"$f":"'5'!AE104","v":0},{"$f":"'5'!AF104","v":0},{"$f":"'5'!AG104","v":0},{"$f":"'5'!AH104","v":0},{"$f":"'5'!AI104","v":0},{"$f":"'5'!AJ104","v":0},{"$f":"'5'!AK104","v":0},{"$f":"'5'!AL104","v":0},{"$f":"'5'!AM104","v":0},{"$f":"'5'!AN104","v":0},{"$f":"'5'!AO104","v":0},{"$f":"'5'!AP104","v":0},{"$f":"'5'!AQ104","v":0},{"$f":"'5'!AR104","v":0},{"$f":"'5'!AS104","v":0},{"$f":"'5'!AT104","v":0},{"$f":"SUMPRODUCT(IF($N448=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N448=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B105","v":"5"},{"$f":"'5'!C105","v":"5.3"},{"$f":"'5'!D105","v":"5.3.4"},{"$f":"'5'!E105","v":""},{"$f":"'5'!F105","v":"5.3.4.3"},{"$f":"'5'!G105","v":"5.3.4.3: PHYSICAL ACCESS - VISITORS/ EXTERNAL PERSONS\nProviders should implement procedures to identify and authorize visitors/ external persons. Providers should ensure that:\n- visitors are authorized before entering - and escorted at all times within - areas where customer data is processed or maintained;\n- visitors are identified and given a badge or other identification that expires and that visibly distinguishes the visitors from onsite personnel;\n- visitors are asked to surrender the badge or identification before leaving the facility or at the date of expiration; and\n- a visitor log is used to maintain a physical audit trail of visitor activity to the facility as well as computer rooms and data centres where customer and financial data is stored or transmitted."},{"$f":"'5'!H105","v":"PCI DSS, ISO 27002: 2013 Sec. 11.1"},{"$f":"'5'!I105","v":"5.3.4.3.1"},{"$f":"'5'!J105","v":"5.3.4.3.1: Are there procedures defined for identifying and authorizing datacentre visitors / external persons and ensuring that they can be distinguished from onsite personnel?\n"},{"$f":"'5'!K105","v":"1) Access control standard or security policy or similar document\n- Check there are process to identify and authorise external persons visiting the mobile money datacentres\n- Check there is a process to distinguish external persons from onsite datacentre personnel\n(Note: if practical, visit the datacentre to assess if the above is operational)\n"},{"$f":"'5'!L105","v":0},{"$f":"'5'!M105","v":"Standard Required"},{"$f":"'5'!N105","v":"Required"},{"$f":"'5'!O105","v":"TechOps"},{"$f":"'5'!P105","v":0},{"$f":"'5'!Q105","v":0},{"$f":"'5'!R105","v":0},{"$f":"'5'!S105","v":0},{"$f":"'5'!T105","v":0},{"$f":"'5'!U105","v":0},{"$f":"'5'!V105","v":0},{"$f":"'5'!W105","v":0},{"$f":"'5'!X105","v":0},{"$f":"'5'!Y105","v":0},{"$f":"'5'!Z105","v":0},{"$f":"'5'!AA105","v":0},{"$f":"'5'!AB105","v":0},{"$f":"'5'!AC105","v":0},{"$f":"'5'!AD105","v":0},{"$f":"'5'!AE105","v":0},{"$f":"'5'!AF105","v":0},{"$f":"'5'!AG105","v":0},{"$f":"'5'!AH105","v":0},{"$f":"'5'!AI105","v":0},{"$f":"'5'!AJ105","v":0},{"$f":"'5'!AK105","v":0},{"$f":"'5'!AL105","v":0},{"$f":"'5'!AM105","v":0},{"$f":"'5'!AN105","v":0},{"$f":"'5'!AO105","v":0},{"$f":"'5'!AP105","v":0},{"$f":"'5'!AQ105","v":0},{"$f":"'5'!AR105","v":0},{"$f":"'5'!AS105","v":0},{"$f":"'5'!AT105","v":0},{"$f":"SUMPRODUCT(IF($N449=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N449=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B106","v":"5"},{"$f":"'5'!C106","v":"5.3"},{"$f":"'5'!D106","v":"5.3.4"},{"$f":"'5'!E106","v":""},{"$f":"'5'!F106","v":"5.3.4.3"},{"$f":"'5'!G106","v":0},{"$f":"'5'!H106","v":0},{"$f":"'5'!I106","v":"5.3.4.3.2"},{"$f":"'5'!J106","v":"5.3.4.3.2: Are external persons accompanied whenever visiting computer rooms and data centres where customer and financial data is stored or transmitted?\n"},{"$f":"'5'!K106","v":""},{"$f":"'5'!L106","v":0},{"$f":"'5'!M106","v":"Recommended"},{"$f":"'5'!N106","v":"Recommended"},{"$f":"'5'!O106","v":"TechOps"},{"$f":"'5'!P106","v":0},{"$f":"'5'!Q106","v":0},{"$f":"'5'!R106","v":0},{"$f":"'5'!S106","v":0},{"$f":"'5'!T106","v":0},{"$f":"'5'!U106","v":0},{"$f":"'5'!V106","v":0},{"$f":"'5'!W106","v":0},{"$f":"'5'!X106","v":0},{"$f":"'5'!Y106","v":0},{"$f":"'5'!Z106","v":0},{"$f":"'5'!AA106","v":0},{"$f":"'5'!AB106","v":0},{"$f":"'5'!AC106","v":0},{"$f":"'5'!AD106","v":0},{"$f":"'5'!AE106","v":0},{"$f":"'5'!AF106","v":0},{"$f":"'5'!AG106","v":0},{"$f":"'5'!AH106","v":0},{"$f":"'5'!AI106","v":0},{"$f":"'5'!AJ106","v":0},{"$f":"'5'!AK106","v":0},{"$f":"'5'!AL106","v":0},{"$f":"'5'!AM106","v":0},{"$f":"'5'!AN106","v":0},{"$f":"'5'!AO106","v":0},{"$f":"'5'!AP106","v":0},{"$f":"'5'!AQ106","v":0},{"$f":"'5'!AR106","v":0},{"$f":"'5'!AS106","v":0},{"$f":"'5'!AT106","v":0},{"$f":"SUMPRODUCT(IF($N450=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N450=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B107","v":"5"},{"$f":"'5'!C107","v":"5.3"},{"$f":"'5'!D107","v":"5.3.5"},{"$f":"'5'!E107","v":"5.3.5: Providers shall ensure correct and secure operations of information processing"},{"$f":"'5'!F107","v":"5.3.5.1"},{"$f":"'5'!G107","v":"5.3.5.1: MALWARE PROTECTION\nUp-to-date malware detection and anti-virus prevention software should be run regularly on any Windows components of the mobile money system.\n\nThe following controls should be implemented on staff devices that have access to the mobile money system (Windows computers and smartphones):\n- regularly run up-to-date malware detection and anti-virus prevention software;\n- prevent the use of unauthorized software;\n- prevent or detect the use of known or suspected malicious websites."},{"$f":"'5'!H107","v":"ISO 27002:2013 Sec. 12.2 \nPCI DSS "},{"$f":"'5'!I107","v":"5.3.5.1.1"},{"$f":"'5'!J107","v":"5.3.5.1.1: Is up-to-date malware detection and anti-virus prevention software run regularly on Windows components of the mobile money system?\n"},{"$f":"'5'!K107","v":"1) Security Operations Manual or Technical Operations documentation\n- Check that there is a process to run malware detection and anti-virus prevention on the mobile money system\n- Check that the process includes the regular updating of the software\n- Check that the process is scheduled to run regularly\n- Check the date of the last malware and anti-virus screen is recent\n\n2) Malware update logs\n- Confirm that anti-malware software is run regularly on Windows components of the mobile money system. Note: if there are no Windows system components, mark this as N/A."},{"$f":"'5'!L107","v":0},{"$f":"'5'!M107","v":"Standard Required"},{"$f":"'5'!N107","v":"Required"},{"$f":"'5'!O107","v":"TechOps"},{"$f":"'5'!P107","v":0},{"$f":"'5'!Q107","v":0},{"$f":"'5'!R107","v":0},{"$f":"'5'!S107","v":0},{"$f":"'5'!T107","v":0},{"$f":"'5'!U107","v":0},{"$f":"'5'!V107","v":0},{"$f":"'5'!W107","v":0},{"$f":"'5'!X107","v":0},{"$f":"'5'!Y107","v":0},{"$f":"'5'!Z107","v":0},{"$f":"'5'!AA107","v":0},{"$f":"'5'!AB107","v":0},{"$f":"'5'!AC107","v":0},{"$f":"'5'!AD107","v":0},{"$f":"'5'!AE107","v":0},{"$f":"'5'!AF107","v":0},{"$f":"'5'!AG107","v":0},{"$f":"'5'!AH107","v":0},{"$f":"'5'!AI107","v":0},{"$f":"'5'!AJ107","v":0},{"$f":"'5'!AK107","v":0},{"$f":"'5'!AL107","v":0},{"$f":"'5'!AM107","v":0},{"$f":"'5'!AN107","v":0},{"$f":"'5'!AO107","v":0},{"$f":"'5'!AP107","v":0},{"$f":"'5'!AQ107","v":0},{"$f":"'5'!AR107","v":0},{"$f":"'5'!AS107","v":0},{"$f":"'5'!AT107","v":0},{"$f":"SUMPRODUCT(IF($N451=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N451=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B108","v":"5"},{"$f":"'5'!C108","v":"5.3"},{"$f":"'5'!D108","v":"5.3.5"},{"$f":"'5'!E108","v":""},{"$f":"'5'!F108","v":"5.3.5.1"},{"$f":"'5'!G108","v":0},{"$f":"'5'!H108","v":0},{"$f":"'5'!I108","v":"5.3.5.1.2"},{"$f":"'5'!J108","v":"5.3.5.1.2: Is up-to-date malware detection and anti-virus prevention software run regularly on Windows computers that staff use to access to the mobile money system?\n"},{"$f":"'5'!K108","v":"1) Security Operations Manual or Technical Operations documentation\n- Check that there is a process to regularly run malware detection and anti-virus prevention on Windows computers that staff use to access to the mobile money system.\n- Check that the process includes the regular updating of the software.\n- Check the date of the last malware and anti-virus screen is recent.\n\n2) Malware update logs\n- Confirm that anti-malware software is run regularly on Windows computers that staff use to access to the mobile money system."},{"$f":"'5'!L108","v":0},{"$f":"'5'!M108","v":"Standard Required"},{"$f":"'5'!N108","v":"Required"},{"$f":"'5'!O108","v":"TechOps"},{"$f":"'5'!P108","v":0},{"$f":"'5'!Q108","v":0},{"$f":"'5'!R108","v":0},{"$f":"'5'!S108","v":0},{"$f":"'5'!T108","v":0},{"$f":"'5'!U108","v":0},{"$f":"'5'!V108","v":0},{"$f":"'5'!W108","v":0},{"$f":"'5'!X108","v":0},{"$f":"'5'!Y108","v":0},{"$f":"'5'!Z108","v":0},{"$f":"'5'!AA108","v":0},{"$f":"'5'!AB108","v":0},{"$f":"'5'!AC108","v":0},{"$f":"'5'!AD108","v":0},{"$f":"'5'!AE108","v":0},{"$f":"'5'!AF108","v":0},{"$f":"'5'!AG108","v":0},{"$f":"'5'!AH108","v":0},{"$f":"'5'!AI108","v":0},{"$f":"'5'!AJ108","v":0},{"$f":"'5'!AK108","v":0},{"$f":"'5'!AL108","v":0},{"$f":"'5'!AM108","v":0},{"$f":"'5'!AN108","v":0},{"$f":"'5'!AO108","v":0},{"$f":"'5'!AP108","v":0},{"$f":"'5'!AQ108","v":0},{"$f":"'5'!AR108","v":0},{"$f":"'5'!AS108","v":0},{"$f":"'5'!AT108","v":0},{"$f":"SUMPRODUCT(IF($N452=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N452=CategoryRecommended,1,0))","v":0},{"$f":"_xlfn.IFNA(MATCH($Q452,ComplianceYes,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q452,CompliancePartial,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q452,ComplianceNo,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q452,ComplianceNA,0),0)","v":0},{"$f":"$AU452*AW452","v":0},{"$f":"$AU452*AX452","v":0},{"$f":"$AU452*AY452","v":0},{"$f":"$AU452*AZ452","v":0},{"$f":"$AV452*AW452","v":0},{"$f":"$AV452*AX452","v":0},{"$f":"$AV452*AY452","v":0},{"$f":"$AV452*AZ452","v":0},{"$f":"_xlfn.IFNA(MATCH($AF452,ComplianceYes,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF452,CompliancePartial,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF452,ComplianceNo,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF452,ComplianceNA,0),0)","v":0},0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B109","v":"5"},{"$f":"'5'!C109","v":"5.3"},{"$f":"'5'!D109","v":"5.3.5"},{"$f":"'5'!E109","v":""},{"$f":"'5'!F109","v":"5.3.5.1"},{"$f":"'5'!G109","v":0},{"$f":"'5'!H109","v":0},{"$f":"'5'!I109","v":"5.3.5.1.3"},{"$f":"'5'!J109","v":"5.3.5.1.3: Are controls implemented on staff devices that have access to the mobile money system to prevent the use of unauthorized software and prevent or detect the use of known or suspected malicious websites?\n"},{"$f":"'5'!K109","v":0},{"$f":"'5'!L109","v":0},{"$f":"'5'!M109","v":"Recommended"},{"$f":"'5'!N109","v":"Recommended"},{"$f":"'5'!O109","v":"TechOps"},{"$f":"'5'!P109","v":0},{"$f":"'5'!Q109","v":0},{"$f":"'5'!R109","v":0},{"$f":"'5'!S109","v":0},{"$f":"'5'!T109","v":0},{"$f":"'5'!U109","v":0},{"$f":"'5'!V109","v":0},{"$f":"'5'!W109","v":0},{"$f":"'5'!X109","v":0},{"$f":"'5'!Y109","v":0},{"$f":"'5'!Z109","v":0},{"$f":"'5'!AA109","v":0},{"$f":"'5'!AB109","v":0},{"$f":"'5'!AC109","v":0},{"$f":"'5'!AD109","v":0},{"$f":"'5'!AE109","v":0},{"$f":"'5'!AF109","v":0},{"$f":"'5'!AG109","v":0},{"$f":"'5'!AH109","v":0},{"$f":"'5'!AI109","v":0},{"$f":"'5'!AJ109","v":0},{"$f":"'5'!AK109","v":0},{"$f":"'5'!AL109","v":0},{"$f":"'5'!AM109","v":0},{"$f":"'5'!AN109","v":0},{"$f":"'5'!AO109","v":0},{"$f":"'5'!AP109","v":0},{"$f":"'5'!AQ109","v":0},{"$f":"'5'!AR109","v":0},{"$f":"'5'!AS109","v":0},{"$f":"'5'!AT109","v":0},{"$f":"SUMPRODUCT(IF($N453=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N453=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,{"$f":"$AU453*BI453","v":0},{"$f":"$AU453*BJ453","v":0},{"$f":"$AU453*BK453","v":0},{"$f":"$AU453*BL453","v":0},{"$f":"$AV453*BI453","v":0},{"$f":"$AV453*BJ453","v":0},{"$f":"$AV453*BK453","v":0},{"$f":"$AV453*BL453","v":0}]
[null,{"$f":"'5'!B110","v":"5"},{"$f":"'5'!C110","v":"5.3"},{"$f":"'5'!D110","v":"5.3.5"},{"$f":"'5'!E110","v":""},{"$f":"'5'!F110","v":"5.3.5.2"},{"$f":"'5'!G110","v":"5.3.5.2: INTRUSION DETECTION\nIntrusion-detection and/or intrusion-prevention systems should be implemented to detect and/or prevent intrusions into the network. \n\nAll traffic should be monitored at the perimeter of the user data environment as well as at critical points in the user data environment. Alerts should be raised when there is a suspicion that a system may be compromised.\n\nIntrusion detection/ prevention systems should be configured, maintained, and updated per vendor instructions to ensure optimal protection."},{"$f":"'5'!H110","v":"ISO 27002:2013 Sec. 12.5, PCI DSS "},{"$f":"'5'!I110","v":"5.3.5.2.1"},{"$f":"'5'!J110","v":"5.3.5.2.1: Are intrusion detection/ prevention systems in use, such that all traffic at the perimeter of the data environment as well as at critical points in the service data environment is monitored for intrusion attempts?\n"},{"$f":"'5'!K110","v":0},{"$f":"'5'!L110","v":0},{"$f":"'5'!M110","v":"Recommended"},{"$f":"'5'!N110","v":"Recommended"},{"$f":"'5'!O110","v":"TechOps"},{"$f":"'5'!P110","v":0},{"$f":"'5'!Q110","v":0},{"$f":"'5'!R110","v":0},{"$f":"'5'!S110","v":0},{"$f":"'5'!T110","v":0},{"$f":"'5'!U110","v":0},{"$f":"'5'!V110","v":0},{"$f":"'5'!W110","v":0},{"$f":"'5'!X110","v":0},{"$f":"'5'!Y110","v":0},{"$f":"'5'!Z110","v":0},{"$f":"'5'!AA110","v":0},{"$f":"'5'!AB110","v":0},{"$f":"'5'!AC110","v":0},{"$f":"'5'!AD110","v":0},{"$f":"'5'!AE110","v":0},{"$f":"'5'!AF110","v":0},{"$f":"'5'!AG110","v":0},{"$f":"'5'!AH110","v":0},{"$f":"'5'!AI110","v":0},{"$f":"'5'!AJ110","v":0},{"$f":"'5'!AK110","v":0},{"$f":"'5'!AL110","v":0},{"$f":"'5'!AM110","v":0},{"$f":"'5'!AN110","v":0},{"$f":"'5'!AO110","v":0},{"$f":"'5'!AP110","v":0},{"$f":"'5'!AQ110","v":0},{"$f":"'5'!AR110","v":0},{"$f":"'5'!AS110","v":0},{"$f":"'5'!AT110","v":0},{"$f":"SUMPRODUCT(IF($N454=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N454=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B111","v":"5"},{"$f":"'5'!C111","v":"5.3"},{"$f":"'5'!D111","v":"5.3.5"},{"$f":"'5'!E111","v":""},{"$f":"'5'!F111","v":"5.3.5.2"},{"$f":"'5'!G111","v":0},{"$f":"'5'!H111","v":0},{"$f":"'5'!I111","v":"5.3.5.2.2"},{"$f":"'5'!J111","v":"5.3.5.2.2: Are intrusion detection/ prevention systems configured to raise alerts whenever there is a suspicion that a system may be compromised?\n"},{"$f":"'5'!K111","v":0},{"$f":"'5'!L111","v":0},{"$f":"'5'!M111","v":"Recommended"},{"$f":"'5'!N111","v":"Recommended"},{"$f":"'5'!O111","v":"TechOps"},{"$f":"'5'!P111","v":0},{"$f":"'5'!Q111","v":0},{"$f":"'5'!R111","v":0},{"$f":"'5'!S111","v":0},{"$f":"'5'!T111","v":0},{"$f":"'5'!U111","v":0},{"$f":"'5'!V111","v":0},{"$f":"'5'!W111","v":0},{"$f":"'5'!X111","v":0},{"$f":"'5'!Y111","v":0},{"$f":"'5'!Z111","v":0},{"$f":"'5'!AA111","v":0},{"$f":"'5'!AB111","v":0},{"$f":"'5'!AC111","v":0},{"$f":"'5'!AD111","v":0},{"$f":"'5'!AE111","v":0},{"$f":"'5'!AF111","v":0},{"$f":"'5'!AG111","v":0},{"$f":"'5'!AH111","v":0},{"$f":"'5'!AI111","v":0},{"$f":"'5'!AJ111","v":0},{"$f":"'5'!AK111","v":0},{"$f":"'5'!AL111","v":0},{"$f":"'5'!AM111","v":0},{"$f":"'5'!AN111","v":0},{"$f":"'5'!AO111","v":0},{"$f":"'5'!AP111","v":0},{"$f":"'5'!AQ111","v":0},{"$f":"'5'!AR111","v":0},{"$f":"'5'!AS111","v":0},{"$f":"'5'!AT111","v":0},{"$f":"SUMPRODUCT(IF($N455=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N455=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B112","v":"5"},{"$f":"'5'!C112","v":"5.3"},{"$f":"'5'!D112","v":"5.3.5"},{"$f":"'5'!E112","v":""},{"$f":"'5'!F112","v":"5.3.5.3"},{"$f":"'5'!G112","v":"5.3.5.3: MOBILE DEVICES AND TELEWORKING\nMobile devices (e.g., laptops, phones, tablets) that can connect to the mobile money system remotely or which contain sensitive customer data present a security risk. Such devices may be used by developers or by system support staff to provide remote operational support, for example. Particular care should be taken by sagents and by staff with privileged roles that can be accessed via handsets.\n\nAll such devices should be password-protected and sensitive customer data should be encrypted. Firewall software should be set up on the devices. Mobile devices should also be physically protected against theft and should be locked away when not in use.\n\nA procedure should be established for cases of theft or loss of mobile devices that (1) can connect to the mobile money system remotely or (2) which contain sensitive data. \n\nA policy should be documented for teleworking, indicating which staff may connect remotely to the system and the controls that should be implemented.\n\nStaff using mobile devices to connect to the mobile money system should be trained regarding (1) the risks that these devices present and (2) the controls that should be implemented."},{"$f":"'5'!H112","v":"ISO 27002:2013 Sec. 6.2"},{"$f":"'5'!I112","v":"5.3.5.3.1"},{"$f":"'5'!J112","v":"5.3.5.3.1: Is data encryption and password protection enabled on all mobile devices (e.g., laptops, phones, tablets) that can connect to the mobile money system remotely or which contain sensitive customer data?\n"},{"$f":"'5'!K112","v":0},{"$f":"'5'!L112","v":0},{"$f":"'5'!M112","v":"Recommended"},{"$f":"'5'!N112","v":"Recommended"},{"$f":"'5'!O112","v":"TechOps"},{"$f":"'5'!P112","v":0},{"$f":"'5'!Q112","v":0},{"$f":"'5'!R112","v":0},{"$f":"'5'!S112","v":0},{"$f":"'5'!T112","v":0},{"$f":"'5'!U112","v":0},{"$f":"'5'!V112","v":0},{"$f":"'5'!W112","v":0},{"$f":"'5'!X112","v":0},{"$f":"'5'!Y112","v":0},{"$f":"'5'!Z112","v":0},{"$f":"'5'!AA112","v":0},{"$f":"'5'!AB112","v":0},{"$f":"'5'!AC112","v":0},{"$f":"'5'!AD112","v":0},{"$f":"'5'!AE112","v":0},{"$f":"'5'!AF112","v":0},{"$f":"'5'!AG112","v":0},{"$f":"'5'!AH112","v":0},{"$f":"'5'!AI112","v":0},{"$f":"'5'!AJ112","v":0},{"$f":"'5'!AK112","v":0},{"$f":"'5'!AL112","v":0},{"$f":"'5'!AM112","v":0},{"$f":"'5'!AN112","v":0},{"$f":"'5'!AO112","v":0},{"$f":"'5'!AP112","v":0},{"$f":"'5'!AQ112","v":0},{"$f":"'5'!AR112","v":0},{"$f":"'5'!AS112","v":0},{"$f":"'5'!AT112","v":0},{"$f":"SUMPRODUCT(IF($N456=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N456=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B113","v":"5"},{"$f":"'5'!C113","v":"5.3"},{"$f":"'5'!D113","v":"5.3.5"},{"$f":"'5'!E113","v":""},{"$f":"'5'!F113","v":"5.3.5.3"},{"$f":"'5'!G113","v":0},{"$f":"'5'!H113","v":0},{"$f":"'5'!I113","v":"5.3.5.3.2"},{"$f":"'5'!J113","v":"5.3.5.3.2: Is firewall software set up on all mobile devices that can connect to the mobile money system remotely or which contain sensitive customer data?\n"},{"$f":"'5'!K113","v":0},{"$f":"'5'!L113","v":0},{"$f":"'5'!M113","v":"Recommended"},{"$f":"'5'!N113","v":"Recommended"},{"$f":"'5'!O113","v":"TechOps"},{"$f":"'5'!P113","v":0},{"$f":"'5'!Q113","v":0},{"$f":"'5'!R113","v":0},{"$f":"'5'!S113","v":0},{"$f":"'5'!T113","v":0},{"$f":"'5'!U113","v":0},{"$f":"'5'!V113","v":0},{"$f":"'5'!W113","v":0},{"$f":"'5'!X113","v":0},{"$f":"'5'!Y113","v":0},{"$f":"'5'!Z113","v":0},{"$f":"'5'!AA113","v":0},{"$f":"'5'!AB113","v":0},{"$f":"'5'!AC113","v":0},{"$f":"'5'!AD113","v":0},{"$f":"'5'!AE113","v":0},{"$f":"'5'!AF113","v":0},{"$f":"'5'!AG113","v":0},{"$f":"'5'!AH113","v":0},{"$f":"'5'!AI113","v":0},{"$f":"'5'!AJ113","v":0},{"$f":"'5'!AK113","v":0},{"$f":"'5'!AL113","v":0},{"$f":"'5'!AM113","v":0},{"$f":"'5'!AN113","v":0},{"$f":"'5'!AO113","v":0},{"$f":"'5'!AP113","v":0},{"$f":"'5'!AQ113","v":0},{"$f":"'5'!AR113","v":0},{"$f":"'5'!AS113","v":0},{"$f":"'5'!AT113","v":0},{"$f":"SUMPRODUCT(IF($N457=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N457=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B114","v":"5"},{"$f":"'5'!C114","v":"5.3"},{"$f":"'5'!D114","v":"5.3.5"},{"$f":"'5'!E114","v":""},{"$f":"'5'!F114","v":"5.3.5.3"},{"$f":"'5'!G114","v":0},{"$f":"'5'!H114","v":0},{"$f":"'5'!I114","v":"5.3.5.3.3"},{"$f":"'5'!J114","v":"5.3.5.3.3: Are specific procedures established for cases of theft or loss of mobile devices that can connect to the mobile money system remotely or which contain sensitive customer data?\n"},{"$f":"'5'!K114","v":0},{"$f":"'5'!L114","v":0},{"$f":"'5'!M114","v":"Recommended"},{"$f":"'5'!N114","v":"Recommended"},{"$f":"'5'!O114","v":"TechOps"},{"$f":"'5'!P114","v":0},{"$f":"'5'!Q114","v":0},{"$f":"'5'!R114","v":0},{"$f":"'5'!S114","v":0},{"$f":"'5'!T114","v":0},{"$f":"'5'!U114","v":0},{"$f":"'5'!V114","v":0},{"$f":"'5'!W114","v":0},{"$f":"'5'!X114","v":0},{"$f":"'5'!Y114","v":0},{"$f":"'5'!Z114","v":0},{"$f":"'5'!AA114","v":0},{"$f":"'5'!AB114","v":0},{"$f":"'5'!AC114","v":0},{"$f":"'5'!AD114","v":0},{"$f":"'5'!AE114","v":0},{"$f":"'5'!AF114","v":0},{"$f":"'5'!AG114","v":0},{"$f":"'5'!AH114","v":0},{"$f":"'5'!AI114","v":0},{"$f":"'5'!AJ114","v":0},{"$f":"'5'!AK114","v":0},{"$f":"'5'!AL114","v":0},{"$f":"'5'!AM114","v":0},{"$f":"'5'!AN114","v":0},{"$f":"'5'!AO114","v":0},{"$f":"'5'!AP114","v":0},{"$f":"'5'!AQ114","v":0},{"$f":"'5'!AR114","v":0},{"$f":"'5'!AS114","v":0},{"$f":"'5'!AT114","v":0},{"$f":"SUMPRODUCT(IF($N458=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N458=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B115","v":"5"},{"$f":"'5'!C115","v":"5.3"},{"$f":"'5'!D115","v":"5.3.5"},{"$f":"'5'!E115","v":""},{"$f":"'5'!F115","v":"5.3.5.3"},{"$f":"'5'!G115","v":0},{"$f":"'5'!H115","v":0},{"$f":"'5'!I115","v":"5.3.5.3.4"},{"$f":"'5'!J115","v":"5.3.5.3.4: Has a policy been documented for teleworking, indicating which staff may connect remotely to the system and the controls that should be implemented?\n"},{"$f":"'5'!K115","v":0},{"$f":"'5'!L115","v":0},{"$f":"'5'!M115","v":"Recommended"},{"$f":"'5'!N115","v":"Recommended"},{"$f":"'5'!O115","v":"TechOps"},{"$f":"'5'!P115","v":0},{"$f":"'5'!Q115","v":0},{"$f":"'5'!R115","v":0},{"$f":"'5'!S115","v":0},{"$f":"'5'!T115","v":0},{"$f":"'5'!U115","v":0},{"$f":"'5'!V115","v":0},{"$f":"'5'!W115","v":0},{"$f":"'5'!X115","v":0},{"$f":"'5'!Y115","v":0},{"$f":"'5'!Z115","v":0},{"$f":"'5'!AA115","v":0},{"$f":"'5'!AB115","v":0},{"$f":"'5'!AC115","v":0},{"$f":"'5'!AD115","v":0},{"$f":"'5'!AE115","v":0},{"$f":"'5'!AF115","v":0},{"$f":"'5'!AG115","v":0},{"$f":"'5'!AH115","v":0},{"$f":"'5'!AI115","v":0},{"$f":"'5'!AJ115","v":0},{"$f":"'5'!AK115","v":0},{"$f":"'5'!AL115","v":0},{"$f":"'5'!AM115","v":0},{"$f":"'5'!AN115","v":0},{"$f":"'5'!AO115","v":0},{"$f":"'5'!AP115","v":0},{"$f":"'5'!AQ115","v":0},{"$f":"'5'!AR115","v":0},{"$f":"'5'!AS115","v":0},{"$f":"'5'!AT115","v":0},{"$f":"SUMPRODUCT(IF($N459=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N459=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B116","v":"5"},{"$f":"'5'!C116","v":"5.3"},{"$f":"'5'!D116","v":"5.3.5"},{"$f":"'5'!E116","v":""},{"$f":"'5'!F116","v":"5.3.5.3"},{"$f":"'5'!G116","v":0},{"$f":"'5'!H116","v":0},{"$f":"'5'!I116","v":"5.3.5.3.5"},{"$f":"'5'!J116","v":"5.3.5.3.5: Have staff using mobile devices to connect to the mobile money system been trained regarding (1) the risks that these devices present and (2) the controls that should be implemented?\n"},{"$f":"'5'!K116","v":0},{"$f":"'5'!L116","v":0},{"$f":"'5'!M116","v":"Recommended"},{"$f":"'5'!N116","v":"Recommended"},{"$f":"'5'!O116","v":"TechOps"},{"$f":"'5'!P116","v":0},{"$f":"'5'!Q116","v":0},{"$f":"'5'!R116","v":0},{"$f":"'5'!S116","v":0},{"$f":"'5'!T116","v":0},{"$f":"'5'!U116","v":0},{"$f":"'5'!V116","v":0},{"$f":"'5'!W116","v":0},{"$f":"'5'!X116","v":0},{"$f":"'5'!Y116","v":0},{"$f":"'5'!Z116","v":0},{"$f":"'5'!AA116","v":0},{"$f":"'5'!AB116","v":0},{"$f":"'5'!AC116","v":0},{"$f":"'5'!AD116","v":0},{"$f":"'5'!AE116","v":0},{"$f":"'5'!AF116","v":0},{"$f":"'5'!AG116","v":0},{"$f":"'5'!AH116","v":0},{"$f":"'5'!AI116","v":0},{"$f":"'5'!AJ116","v":0},{"$f":"'5'!AK116","v":0},{"$f":"'5'!AL116","v":0},{"$f":"'5'!AM116","v":0},{"$f":"'5'!AN116","v":0},{"$f":"'5'!AO116","v":0},{"$f":"'5'!AP116","v":0},{"$f":"'5'!AQ116","v":0},{"$f":"'5'!AR116","v":0},{"$f":"'5'!AS116","v":0},{"$f":"'5'!AT116","v":0},{"$f":"SUMPRODUCT(IF($N460=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N460=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B117","v":"5"},{"$f":"'5'!C117","v":"5.3"},{"$f":"'5'!D117","v":"5.3.6"},{"$f":"'5'!E117","v":"5.3.6: Providers shall develop processes to ensure that all transactions and user activities are logged with appropriate audit trails."},{"$f":"'5'!F117","v":"5.3.6.1"},{"$f":"'5'!G117","v":"5.3.6.1: LOGGING: MOBILE MONEY SYSTEM COMPONENTS \nLogging should be set up on all mobile money system components to track all important events. Logging should include the following events:\n- all actions by administrators (i.e. people with root or administrative privileges);\n- all logical access attempts (e.g. log-on and log-off, whether successful or failed);\n- creation, modification, and deletion of system-level objects and configuration;\n- access to audit trails;\n- all access to customer data; and\n- key system activities/ events.\n\nFor each event the following should be included in the log, when relevant:\n- user ID;\n- date & time;\n- device identity/ location/ network address;\n- type of event;\n- success or failure of the event; and\n- origination of event."},{"$f":"'5'!H117","v":"ISO 27002: 2013 Sec. 12.4 \nPCI DSS"},{"$f":"'5'!I117","v":"5.3.6.1.1"},{"$f":"'5'!J117","v":"5.3.6.1.1: Has logging been set up on all mobile money system components to track all important events?\n"},{"$f":"'5'!K117","v":"1) Monitoring / logging specification\n- Check that system-level logging has been set up on all mobile money system components."},{"$f":"'5'!L117","v":0},{"$f":"'5'!M117","v":"Urgent Required"},{"$f":"'5'!N117","v":"Required"},{"$f":"'5'!O117","v":"TechOps"},{"$f":"'5'!P117","v":0},{"$f":"'5'!Q117","v":0},{"$f":"'5'!R117","v":0},{"$f":"'5'!S117","v":0},{"$f":"'5'!T117","v":0},{"$f":"'5'!U117","v":0},{"$f":"'5'!V117","v":0},{"$f":"'5'!W117","v":0},{"$f":"'5'!X117","v":0},{"$f":"'5'!Y117","v":0},{"$f":"'5'!Z117","v":0},{"$f":"'5'!AA117","v":0},{"$f":"'5'!AB117","v":0},{"$f":"'5'!AC117","v":0},{"$f":"'5'!AD117","v":0},{"$f":"'5'!AE117","v":0},{"$f":"'5'!AF117","v":0},{"$f":"'5'!AG117","v":0},{"$f":"'5'!AH117","v":0},{"$f":"'5'!AI117","v":0},{"$f":"'5'!AJ117","v":0},{"$f":"'5'!AK117","v":0},{"$f":"'5'!AL117","v":0},{"$f":"'5'!AM117","v":0},{"$f":"'5'!AN117","v":0},{"$f":"'5'!AO117","v":0},{"$f":"'5'!AP117","v":0},{"$f":"'5'!AQ117","v":0},{"$f":"'5'!AR117","v":0},{"$f":"'5'!AS117","v":0},{"$f":"'5'!AT117","v":0},{"$f":"SUMPRODUCT(IF($N461=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N461=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B118","v":"5"},{"$f":"'5'!C118","v":"5.3"},{"$f":"'5'!D118","v":"5.3.6"},{"$f":"'5'!E118","v":0},{"$f":"'5'!F118","v":"5.3.6.1"},{"$f":"'5'!G118","v":0},{"$f":"'5'!H118","v":0},{"$f":"'5'!I118","v":"5.3.6.1.2"},{"$f":"'5'!J118","v":"5.3.6.1.2: Does mobile money system-level logging include all actions by administrators, all logical access attempts, creation/ modification/ deletion of system objects and configuration, access to logs, access to customer data, and key system events?\n"},{"$f":"'5'!K118","v":"1) Monitoring / logging specification\n- Check that mobile money system level logging includes all the following:\na) Actions by administrators\nb) Logical access attempts, \nc) creation/ modification/ deletion of system objects and configuration, \nd) access to audit trails, \ne) access to customer data, \nf) key system events"},{"$f":"'5'!L118","v":0},{"$f":"'5'!M118","v":"Urgent Required"},{"$f":"'5'!N118","v":"Required"},{"$f":"'5'!O118","v":"TechOps"},{"$f":"'5'!P118","v":0},{"$f":"'5'!Q118","v":0},{"$f":"'5'!R118","v":0},{"$f":"'5'!S118","v":0},{"$f":"'5'!T118","v":0},{"$f":"'5'!U118","v":0},{"$f":"'5'!V118","v":0},{"$f":"'5'!W118","v":0},{"$f":"'5'!X118","v":0},{"$f":"'5'!Y118","v":0},{"$f":"'5'!Z118","v":0},{"$f":"'5'!AA118","v":0},{"$f":"'5'!AB118","v":0},{"$f":"'5'!AC118","v":0},{"$f":"'5'!AD118","v":0},{"$f":"'5'!AE118","v":0},{"$f":"'5'!AF118","v":0},{"$f":"'5'!AG118","v":0},{"$f":"'5'!AH118","v":0},{"$f":"'5'!AI118","v":0},{"$f":"'5'!AJ118","v":0},{"$f":"'5'!AK118","v":0},{"$f":"'5'!AL118","v":0},{"$f":"'5'!AM118","v":0},{"$f":"'5'!AN118","v":0},{"$f":"'5'!AO118","v":0},{"$f":"'5'!AP118","v":0},{"$f":"'5'!AQ118","v":0},{"$f":"'5'!AR118","v":0},{"$f":"'5'!AS118","v":0},{"$f":"'5'!AT118","v":0},{"$f":"SUMPRODUCT(IF($N462=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N462=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B119","v":"5"},{"$f":"'5'!C119","v":"5.3"},{"$f":"'5'!D119","v":"5.3.6"},{"$f":"'5'!E119","v":""},{"$f":"'5'!F119","v":"5.3.6.1"},{"$f":"'5'!G119","v":0},{"$f":"'5'!H119","v":0},{"$f":"'5'!I119","v":"5.3.6.1.3"},{"$f":"'5'!J119","v":"5.3.6.1.3: For each event in the mobile money system-level log is the following logged (as relevant): user ID, date & time, device identity/ location/ network address, type of event, success or failure of the event, and origination of event?\n"},{"$f":"'5'!K119","v":"1) Monitoring / logging specification\n- Check that mobile money system level logging captures the following for each event:\na) The user ID, \nb) Date & time,\nc)  Device identity/ location/ network address, \nd) Type of event, \ne) Success or failure of the event, \nf) Origination of the event\n\n"},{"$f":"'5'!L119","v":0},{"$f":"'5'!M119","v":"Urgent Required"},{"$f":"'5'!N119","v":"Required"},{"$f":"'5'!O119","v":"TechOps"},{"$f":"'5'!P119","v":0},{"$f":"'5'!Q119","v":0},{"$f":"'5'!R119","v":0},{"$f":"'5'!S119","v":0},{"$f":"'5'!T119","v":0},{"$f":"'5'!U119","v":0},{"$f":"'5'!V119","v":0},{"$f":"'5'!W119","v":0},{"$f":"'5'!X119","v":0},{"$f":"'5'!Y119","v":0},{"$f":"'5'!Z119","v":0},{"$f":"'5'!AA119","v":0},{"$f":"'5'!AB119","v":0},{"$f":"'5'!AC119","v":0},{"$f":"'5'!AD119","v":0},{"$f":"'5'!AE119","v":0},{"$f":"'5'!AF119","v":0},{"$f":"'5'!AG119","v":0},{"$f":"'5'!AH119","v":0},{"$f":"'5'!AI119","v":0},{"$f":"'5'!AJ119","v":0},{"$f":"'5'!AK119","v":0},{"$f":"'5'!AL119","v":0},{"$f":"'5'!AM119","v":0},{"$f":"'5'!AN119","v":0},{"$f":"'5'!AO119","v":0},{"$f":"'5'!AP119","v":0},{"$f":"'5'!AQ119","v":0},{"$f":"'5'!AR119","v":0},{"$f":"'5'!AS119","v":0},{"$f":"'5'!AT119","v":0},{"$f":"SUMPRODUCT(IF($N463=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N463=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B120","v":"5"},{"$f":"'5'!C120","v":"5.3"},{"$f":"'5'!D120","v":"5.3.6"},{"$f":"'5'!E120","v":""},{"$f":"'5'!F120","v":"5.3.6.2"},{"$f":"'5'!G120","v":"5.3.6.2: AUDIT TRAIL: MOBILE MONEY APPLICATION\nFull audit trails should be implemented in the mobile money system in order to be able to track all transactions and events in the mobile money application.\n\nThe following events should be included in the audit trail:\n- all transactions initiated by any party (including failed transactions and automated transactions);\n- all logical access attempts (e.g. log-on and log-off, whether successful or failed);\n- creation, deletion and modification of operator accounts;\n- access to audit trails;\n- all access to customer data by service operators (e.g. customer service operators, finance operators); and\n- key system activities/ events.\n\nFor each event the following should be included in the audit trail, when relevant:\n- date & time;\n- credit party and debit party account details;\n- transaction/event ID;\n- transaction/event initiator (ID of customer/ agent/ operator/ system process that initiates transaction/event);\n- type of event/ transaction; and\n- success or failure of the event/ transaction."},{"$f":"'5'!H120","v":"ECB RSMP, ISO 27002:2013 Sec. 12.4 "},{"$f":"'5'!I120","v":"5.3.6.2.1"},{"$f":"'5'!J120","v":"5.3.6.2.1: Does the mobile money audit trail include all transactions initiated by any party (including failed transactions and automated transactions)?\n"},{"$f":"'5'!K120","v":"1) Monitoring / logging / audit trail specification\n- Check that the process to log all event includes capturing all transactions initiated by any party (including failed transactions and automated transactions)\n\n"},{"$f":"'5'!L120","v":0},{"$f":"'5'!M120","v":"Urgent Required"},{"$f":"'5'!N120","v":"Required"},{"$f":"'5'!O120","v":"TechOps"},{"$f":"'5'!P120","v":0},{"$f":"'5'!Q120","v":0},{"$f":"'5'!R120","v":0},{"$f":"'5'!S120","v":0},{"$f":"'5'!T120","v":0},{"$f":"'5'!U120","v":0},{"$f":"'5'!V120","v":0},{"$f":"'5'!W120","v":0},{"$f":"'5'!X120","v":0},{"$f":"'5'!Y120","v":0},{"$f":"'5'!Z120","v":0},{"$f":"'5'!AA120","v":0},{"$f":"'5'!AB120","v":0},{"$f":"'5'!AC120","v":0},{"$f":"'5'!AD120","v":0},{"$f":"'5'!AE120","v":0},{"$f":"'5'!AF120","v":0},{"$f":"'5'!AG120","v":0},{"$f":"'5'!AH120","v":0},{"$f":"'5'!AI120","v":0},{"$f":"'5'!AJ120","v":0},{"$f":"'5'!AK120","v":0},{"$f":"'5'!AL120","v":0},{"$f":"'5'!AM120","v":0},{"$f":"'5'!AN120","v":0},{"$f":"'5'!AO120","v":0},{"$f":"'5'!AP120","v":0},{"$f":"'5'!AQ120","v":0},{"$f":"'5'!AR120","v":0},{"$f":"'5'!AS120","v":0},{"$f":"'5'!AT120","v":0},{"$f":"SUMPRODUCT(IF($N464=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N464=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B121","v":"5"},{"$f":"'5'!C121","v":"5.3"},{"$f":"'5'!D121","v":"5.3.6"},{"$f":"'5'!E121","v":""},{"$f":"'5'!F121","v":"5.3.6.2"},{"$f":"'5'!G121","v":0},{"$f":"'5'!H121","v":0},{"$f":"'5'!I121","v":"5.3.6.2.2"},{"$f":"'5'!J121","v":"5.3.6.2.2: Does the mobile money audit trail include all actions on the mobile money system (logical access attempts, creation/ deletion/ modification of operator accounts, access to audit trails, access to customer data, and key system activities/ events)?\n"},{"$f":"'5'!K121","v":"1) Monitoring / logging / audit trail specification\n- Check that there is an audit trail of the all actions on the mobile money system including:\na) Logical access attempts, \nb) Creation/ deletion/ modification of operator accounts, \nc) Access to audit trails, \nd) Access to customer data, \ne) Key system activities/ events\n\n\n\n"},{"$f":"'5'!L121","v":0},{"$f":"'5'!M121","v":"Urgent Required"},{"$f":"'5'!N121","v":"Required"},{"$f":"'5'!O121","v":"TechOps"},{"$f":"'5'!P121","v":0},{"$f":"'5'!Q121","v":0},{"$f":"'5'!R121","v":0},{"$f":"'5'!S121","v":0},{"$f":"'5'!T121","v":0},{"$f":"'5'!U121","v":0},{"$f":"'5'!V121","v":0},{"$f":"'5'!W121","v":0},{"$f":"'5'!X121","v":0},{"$f":"'5'!Y121","v":0},{"$f":"'5'!Z121","v":0},{"$f":"'5'!AA121","v":0},{"$f":"'5'!AB121","v":0},{"$f":"'5'!AC121","v":0},{"$f":"'5'!AD121","v":0},{"$f":"'5'!AE121","v":0},{"$f":"'5'!AF121","v":0},{"$f":"'5'!AG121","v":0},{"$f":"'5'!AH121","v":0},{"$f":"'5'!AI121","v":0},{"$f":"'5'!AJ121","v":0},{"$f":"'5'!AK121","v":0},{"$f":"'5'!AL121","v":0},{"$f":"'5'!AM121","v":0},{"$f":"'5'!AN121","v":0},{"$f":"'5'!AO121","v":0},{"$f":"'5'!AP121","v":0},{"$f":"'5'!AQ121","v":0},{"$f":"'5'!AR121","v":0},{"$f":"'5'!AS121","v":0},{"$f":"'5'!AT121","v":0},{"$f":"SUMPRODUCT(IF($N465=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N465=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B122","v":"5"},{"$f":"'5'!C122","v":"5.3"},{"$f":"'5'!D122","v":"5.3.6"},{"$f":"'5'!E122","v":""},{"$f":"'5'!F122","v":"5.3.6.2"},{"$f":"'5'!G122","v":0},{"$f":"'5'!H122","v":0},{"$f":"'5'!I122","v":"5.3.6.2.3"},{"$f":"'5'!J122","v":"5.3.6.2.3: For each event in the mobile money audit trail, is the following logged (as relevant): credit and debit party, transaction ID, date & time, initiator ID (i.e. operator/ customer/ agent/ system ID), type of event, and success or failure of the event?\n"},{"$f":"'5'!K122","v":"1) Monitoring / logging / audit trail specification\n- Check that for each event in the audit trail the following is captured:\na) Credit and debit party,\nb) Transaction ID, \nc) Date & time, \nd) Initiator ID (i.e. operator/ customer/ agent/ system ID), \ne) Type of event,  \nf) Success or failure of the event\n\n\n\n\n"},{"$f":"'5'!L122","v":0},{"$f":"'5'!M122","v":"Urgent Required"},{"$f":"'5'!N122","v":"Required"},{"$f":"'5'!O122","v":"TechOps"},{"$f":"'5'!P122","v":0},{"$f":"'5'!Q122","v":0},{"$f":"'5'!R122","v":0},{"$f":"'5'!S122","v":0},{"$f":"'5'!T122","v":0},{"$f":"'5'!U122","v":0},{"$f":"'5'!V122","v":0},{"$f":"'5'!W122","v":0},{"$f":"'5'!X122","v":0},{"$f":"'5'!Y122","v":0},{"$f":"'5'!Z122","v":0},{"$f":"'5'!AA122","v":0},{"$f":"'5'!AB122","v":0},{"$f":"'5'!AC122","v":0},{"$f":"'5'!AD122","v":0},{"$f":"'5'!AE122","v":0},{"$f":"'5'!AF122","v":0},{"$f":"'5'!AG122","v":0},{"$f":"'5'!AH122","v":0},{"$f":"'5'!AI122","v":0},{"$f":"'5'!AJ122","v":0},{"$f":"'5'!AK122","v":0},{"$f":"'5'!AL122","v":0},{"$f":"'5'!AM122","v":0},{"$f":"'5'!AN122","v":0},{"$f":"'5'!AO122","v":0},{"$f":"'5'!AP122","v":0},{"$f":"'5'!AQ122","v":0},{"$f":"'5'!AR122","v":0},{"$f":"'5'!AS122","v":0},{"$f":"'5'!AT122","v":0},{"$f":"SUMPRODUCT(IF($N466=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N466=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B123","v":"5"},{"$f":"'5'!C123","v":"5.3"},{"$f":"'5'!D123","v":"5.3.6"},{"$f":"'5'!E123","v":""},{"$f":"'5'!F123","v":"5.3.6.3"},{"$f":"'5'!G123","v":"5.3.6.3: PROTECTION OF LOGS & AUDIT TRAILS\nMobile money system logs and application audit trails should be protected to prevent tampering by users and administrators to cover their tracks. \nControls should include:\n- prevention of alterations to the message types that are recorded in system log files and application audit trails;\n- prevention of edits or deletions to system log files and application audit trails; \n- steps to avoid exceeding the storage capacity of the log file media, resulting in either the failure to record events or over-writing of past recorded events;\n- ensuring only individuals who have a job-related need can view logs and audit trail files (see 5.3.3);\n- using file-integrity monitoring or change-detection software for logs and audit trail files; and\n- real-time copying of logs and audit trails to a separate secure logging system, particularly for external-facing systems.\n\nIt is recommended that a centralised log storage system be used.\n\nProviders should retain logs and audit trails for at least one year, with a minimum of three months immediately available online for analysis."},{"$f":"'5'!H123","v":"ISO 27002: 2013 Sec. 12.4, \nPCI DSS"},{"$f":"'5'!I123","v":"5.3.6.3.1"},{"$f":"'5'!J123","v":"5.3.6.3.1: Are system logs and application audit trails protected to restrict access, to prevent alterations to the message types that are recorded, and to prevent edits or deletions to the log files themselves?\n"},{"$f":"'5'!K123","v":"1) Monitoring / logging / audit trail specification\n- Check that there are controls in place to restrict access to logs, to prevent alterations to the message types that are recorded, and to prevent edits or deletions to the log files themselves.\n\n\n\n\n"},{"$f":"'5'!L123","v":0},{"$f":"'5'!M123","v":"Standard Required"},{"$f":"'5'!N123","v":"Required"},{"$f":"'5'!O123","v":"TechOps"},{"$f":"'5'!P123","v":0},{"$f":"'5'!Q123","v":0},{"$f":"'5'!R123","v":0},{"$f":"'5'!S123","v":0},{"$f":"'5'!T123","v":0},{"$f":"'5'!U123","v":0},{"$f":"'5'!V123","v":0},{"$f":"'5'!W123","v":0},{"$f":"'5'!X123","v":0},{"$f":"'5'!Y123","v":0},{"$f":"'5'!Z123","v":0},{"$f":"'5'!AA123","v":0},{"$f":"'5'!AB123","v":0},{"$f":"'5'!AC123","v":0},{"$f":"'5'!AD123","v":0},{"$f":"'5'!AE123","v":0},{"$f":"'5'!AF123","v":0},{"$f":"'5'!AG123","v":0},{"$f":"'5'!AH123","v":0},{"$f":"'5'!AI123","v":0},{"$f":"'5'!AJ123","v":0},{"$f":"'5'!AK123","v":0},{"$f":"'5'!AL123","v":0},{"$f":"'5'!AM123","v":0},{"$f":"'5'!AN123","v":0},{"$f":"'5'!AO123","v":0},{"$f":"'5'!AP123","v":0},{"$f":"'5'!AQ123","v":0},{"$f":"'5'!AR123","v":0},{"$f":"'5'!AS123","v":0},{"$f":"'5'!AT123","v":0},{"$f":"SUMPRODUCT(IF($N467=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N467=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B124","v":"5"},{"$f":"'5'!C124","v":"5.3"},{"$f":"'5'!D124","v":"5.3.6"},{"$f":"'5'!E124","v":""},{"$f":"'5'!F124","v":"5.3.6.3"},{"$f":"'5'!G124","v":0},{"$f":"'5'!H124","v":0},{"$f":"'5'!I124","v":"5.3.6.3.2"},{"$f":"'5'!J124","v":"5.3.6.3.2: Are there controls in place that protect against exceeding the storage capacity of the log file media?\n"},{"$f":"'5'!K124","v":"1) Monitoring / logging / audit trail specification\n- Check that there are controls in place to protect against exceeding the storage capacity of the log file media\n\n\n\n\n"},{"$f":"'5'!L124","v":0},{"$f":"'5'!M124","v":"Standard Required"},{"$f":"'5'!N124","v":"Required"},{"$f":"'5'!O124","v":"TechOps"},{"$f":"'5'!P124","v":0},{"$f":"'5'!Q124","v":0},{"$f":"'5'!R124","v":0},{"$f":"'5'!S124","v":0},{"$f":"'5'!T124","v":0},{"$f":"'5'!U124","v":0},{"$f":"'5'!V124","v":0},{"$f":"'5'!W124","v":0},{"$f":"'5'!X124","v":0},{"$f":"'5'!Y124","v":0},{"$f":"'5'!Z124","v":0},{"$f":"'5'!AA124","v":0},{"$f":"'5'!AB124","v":0},{"$f":"'5'!AC124","v":0},{"$f":"'5'!AD124","v":0},{"$f":"'5'!AE124","v":0},{"$f":"'5'!AF124","v":0},{"$f":"'5'!AG124","v":0},{"$f":"'5'!AH124","v":0},{"$f":"'5'!AI124","v":0},{"$f":"'5'!AJ124","v":0},{"$f":"'5'!AK124","v":0},{"$f":"'5'!AL124","v":0},{"$f":"'5'!AM124","v":0},{"$f":"'5'!AN124","v":0},{"$f":"'5'!AO124","v":0},{"$f":"'5'!AP124","v":0},{"$f":"'5'!AQ124","v":0},{"$f":"'5'!AR124","v":0},{"$f":"'5'!AS124","v":0},{"$f":"'5'!AT124","v":0},{"$f":"SUMPRODUCT(IF($N468=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N468=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B125","v":"5"},{"$f":"'5'!C125","v":"5.3"},{"$f":"'5'!D125","v":"5.3.6"},{"$f":"'5'!E125","v":0},{"$f":"'5'!F125","v":"5.3.6.3"},{"$f":"'5'!G125","v":0},{"$f":"'5'!H125","v":0},{"$f":"'5'!I125","v":0},{"$f":"'5'!J125","v":"5.3.6.3.3: Has a centralized log storage system been implemented?\n"},{"$f":"'5'!K125","v":0},{"$f":"'5'!L125","v":0},{"$f":"'5'!M125","v":"Recommended"},{"$f":"'5'!N125","v":"Recommended"},{"$f":"'5'!O125","v":"TechOps"},{"$f":"'5'!P125","v":0},{"$f":"'5'!Q125","v":0},{"$f":"'5'!R125","v":0},{"$f":"'5'!S125","v":0},{"$f":"'5'!T125","v":0},{"$f":"'5'!U125","v":0},{"$f":"'5'!V125","v":0},{"$f":"'5'!W125","v":0},{"$f":"'5'!X125","v":0},{"$f":"'5'!Y125","v":0},{"$f":"'5'!Z125","v":0},{"$f":"'5'!AA125","v":0},{"$f":"'5'!AB125","v":0},{"$f":"'5'!AC125","v":0},{"$f":"'5'!AD125","v":0},{"$f":"'5'!AE125","v":0},{"$f":"'5'!AF125","v":0},{"$f":"'5'!AG125","v":0},{"$f":"'5'!AH125","v":0},{"$f":"'5'!AI125","v":0},{"$f":"'5'!AJ125","v":0},{"$f":"'5'!AK125","v":0},{"$f":"'5'!AL125","v":0},{"$f":"'5'!AM125","v":0},{"$f":"'5'!AN125","v":0},{"$f":"'5'!AO125","v":0},{"$f":"'5'!AP125","v":0},{"$f":"'5'!AQ125","v":0},{"$f":"'5'!AR125","v":0},{"$f":"'5'!AS125","v":0},{"$f":"'5'!AT125","v":0},{"$f":"SUMPRODUCT(IF($N469=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N469=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B126","v":"5"},{"$f":"'5'!C126","v":"5.3"},{"$f":"'5'!D126","v":"5.3.6"},{"$f":"'5'!E126","v":""},{"$f":"'5'!F126","v":"5.3.6.3"},{"$f":"'5'!G126","v":0},{"$f":"'5'!H126","v":0},{"$f":"'5'!I126","v":"5.3.6.3.4"},{"$f":"'5'!J126","v":"5.3.6.3.4: Is file-integrity monitoring or change-detection software in use for logs and audit trail files?\n"},{"$f":"'5'!K126","v":0},{"$f":"'5'!L126","v":0},{"$f":"'5'!M126","v":"Recommended"},{"$f":"'5'!N126","v":"Recommended"},{"$f":"'5'!O126","v":"TechOps"},{"$f":"'5'!P126","v":0},{"$f":"'5'!Q126","v":0},{"$f":"'5'!R126","v":0},{"$f":"'5'!S126","v":0},{"$f":"'5'!T126","v":0},{"$f":"'5'!U126","v":0},{"$f":"'5'!V126","v":0},{"$f":"'5'!W126","v":0},{"$f":"'5'!X126","v":0},{"$f":"'5'!Y126","v":0},{"$f":"'5'!Z126","v":0},{"$f":"'5'!AA126","v":0},{"$f":"'5'!AB126","v":0},{"$f":"'5'!AC126","v":0},{"$f":"'5'!AD126","v":0},{"$f":"'5'!AE126","v":0},{"$f":"'5'!AF126","v":0},{"$f":"'5'!AG126","v":0},{"$f":"'5'!AH126","v":0},{"$f":"'5'!AI126","v":0},{"$f":"'5'!AJ126","v":0},{"$f":"'5'!AK126","v":0},{"$f":"'5'!AL126","v":0},{"$f":"'5'!AM126","v":0},{"$f":"'5'!AN126","v":0},{"$f":"'5'!AO126","v":0},{"$f":"'5'!AP126","v":0},{"$f":"'5'!AQ126","v":0},{"$f":"'5'!AR126","v":0},{"$f":"'5'!AS126","v":0},{"$f":"'5'!AT126","v":0},{"$f":"SUMPRODUCT(IF($N470=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N470=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B127","v":"5"},{"$f":"'5'!C127","v":"5.3"},{"$f":"'5'!D127","v":"5.3.6"},{"$f":"'5'!E127","v":""},{"$f":"'5'!F127","v":"5.3.6.3"},{"$f":"'5'!G127","v":0},{"$f":"'5'!H127","v":0},{"$f":"'5'!I127","v":"5.3.6.3.5"},{"$f":"'5'!J127","v":"5.3.6.3.5: Are logs and audit trails copied in real time to a separate secure logging system, particularly for external-facing systems?\n"},{"$f":"'5'!K127","v":0},{"$f":"'5'!L127","v":0},{"$f":"'5'!M127","v":"Recommended"},{"$f":"'5'!N127","v":"Recommended"},{"$f":"'5'!O127","v":"TechOps"},{"$f":"'5'!P127","v":0},{"$f":"'5'!Q127","v":0},{"$f":"'5'!R127","v":0},{"$f":"'5'!S127","v":0},{"$f":"'5'!T127","v":0},{"$f":"'5'!U127","v":0},{"$f":"'5'!V127","v":0},{"$f":"'5'!W127","v":0},{"$f":"'5'!X127","v":0},{"$f":"'5'!Y127","v":0},{"$f":"'5'!Z127","v":0},{"$f":"'5'!AA127","v":0},{"$f":"'5'!AB127","v":0},{"$f":"'5'!AC127","v":0},{"$f":"'5'!AD127","v":0},{"$f":"'5'!AE127","v":0},{"$f":"'5'!AF127","v":0},{"$f":"'5'!AG127","v":0},{"$f":"'5'!AH127","v":0},{"$f":"'5'!AI127","v":0},{"$f":"'5'!AJ127","v":0},{"$f":"'5'!AK127","v":0},{"$f":"'5'!AL127","v":0},{"$f":"'5'!AM127","v":0},{"$f":"'5'!AN127","v":0},{"$f":"'5'!AO127","v":0},{"$f":"'5'!AP127","v":0},{"$f":"'5'!AQ127","v":0},{"$f":"'5'!AR127","v":0},{"$f":"'5'!AS127","v":0},{"$f":"'5'!AT127","v":0},{"$f":"SUMPRODUCT(IF($N471=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N471=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B128","v":"5"},{"$f":"'5'!C128","v":"5.3"},{"$f":"'5'!D128","v":"5.3.6"},{"$f":"'5'!E128","v":""},{"$f":"'5'!F128","v":"5.3.6.3"},{"$f":"'5'!G128","v":0},{"$f":"'5'!H128","v":0},{"$f":"'5'!I128","v":"5.3.6.3.6"},{"$f":"'5'!J128","v":"5.3.6.3.6: Are logs and audit trail files retained for at least one year, with at least three months of logs available online for analysis?\n"},{"$f":"'5'!K128","v":0},{"$f":"'5'!L128","v":0},{"$f":"'5'!M128","v":"Recommended"},{"$f":"'5'!N128","v":"Recommended"},{"$f":"'5'!O128","v":"TechOps"},{"$f":"'5'!P128","v":0},{"$f":"'5'!Q128","v":0},{"$f":"'5'!R128","v":0},{"$f":"'5'!S128","v":0},{"$f":"'5'!T128","v":0},{"$f":"'5'!U128","v":0},{"$f":"'5'!V128","v":0},{"$f":"'5'!W128","v":0},{"$f":"'5'!X128","v":0},{"$f":"'5'!Y128","v":0},{"$f":"'5'!Z128","v":0},{"$f":"'5'!AA128","v":0},{"$f":"'5'!AB128","v":0},{"$f":"'5'!AC128","v":0},{"$f":"'5'!AD128","v":0},{"$f":"'5'!AE128","v":0},{"$f":"'5'!AF128","v":0},{"$f":"'5'!AG128","v":0},{"$f":"'5'!AH128","v":0},{"$f":"'5'!AI128","v":0},{"$f":"'5'!AJ128","v":0},{"$f":"'5'!AK128","v":0},{"$f":"'5'!AL128","v":0},{"$f":"'5'!AM128","v":0},{"$f":"'5'!AN128","v":0},{"$f":"'5'!AO128","v":0},{"$f":"'5'!AP128","v":0},{"$f":"'5'!AQ128","v":0},{"$f":"'5'!AR128","v":0},{"$f":"'5'!AS128","v":0},{"$f":"'5'!AT128","v":0},{"$f":"SUMPRODUCT(IF($N472=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N472=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B129","v":"5"},{"$f":"'5'!C129","v":"5.3"},{"$f":"'5'!D129","v":"5.3.7"},{"$f":"'5'!E129","v":"5.3.7: Providers shall regularly test security systems and processes."},{"$f":"'5'!F129","v":"5.3.7.1"},{"$f":"'5'!G129","v":"5.3.7.1: VULNERABILITY SCANS\nVulnerability scans should be performed on the mobile money system to search for security weaknesses. Vulnerability scans should be performed at least every three months and after any significant change to the mobile money system or the network supporting it.\n\nVulnerability scans should include:\n - System: scans of the mobile money application.\n - Network: internal and external (public API) scans on the network supporting the mobile money system;\n\nRemedial actions should be determined and prioritized according to criticality. Additional scans should be run to ensure that the fixes have been implemented correctly.\n\nVulnerability scans should be performed by qualified internal personnel or a qualified external third party, and the organizational independence of the tester should be assured.\n\nFor more information, please refer to security testing in the definitions."},{"$f":"'5'!H129","v":"ISO 27002:2013 Sec. 12.6, PCI DSS"},{"$f":"'5'!I129","v":"5.3.7.1.1"},{"$f":"'5'!J129","v":"5.3.7.1.1: Are vulnerability scans of the mobile money system performed at least every six months and after any significant change to the mobile money system?\n"},{"$f":"'5'!K129","v":"1) Security testing process documentation\n- Check that there is a process to perform vulnerability scans of the mobile money system.\n- Check that the process schedules scans at least every six months.\n- Check that the process requires a scan after any significant change to the mobile money platform.\n- Check that a scan has been completed in the last six months (and if not, look for evidence that the process will be run in future)."},{"$f":"'5'!L129","v":0},{"$f":"'5'!M129","v":"Standard Required"},{"$f":"'5'!N129","v":"Required"},{"$f":"'5'!O129","v":"TechOps"},{"$f":"'5'!P129","v":0},{"$f":"'5'!Q129","v":0},{"$f":"'5'!R129","v":0},{"$f":"'5'!S129","v":0},{"$f":"'5'!T129","v":0},{"$f":"'5'!U129","v":0},{"$f":"'5'!V129","v":0},{"$f":"'5'!W129","v":0},{"$f":"'5'!X129","v":0},{"$f":"'5'!Y129","v":0},{"$f":"'5'!Z129","v":0},{"$f":"'5'!AA129","v":0},{"$f":"'5'!AB129","v":0},{"$f":"'5'!AC129","v":0},{"$f":"'5'!AD129","v":0},{"$f":"'5'!AE129","v":0},{"$f":"'5'!AF129","v":0},{"$f":"'5'!AG129","v":0},{"$f":"'5'!AH129","v":0},{"$f":"'5'!AI129","v":0},{"$f":"'5'!AJ129","v":0},{"$f":"'5'!AK129","v":0},{"$f":"'5'!AL129","v":0},{"$f":"'5'!AM129","v":0},{"$f":"'5'!AN129","v":0},{"$f":"'5'!AO129","v":0},{"$f":"'5'!AP129","v":0},{"$f":"'5'!AQ129","v":0},{"$f":"'5'!AR129","v":0},{"$f":"'5'!AS129","v":0},{"$f":"'5'!AT129","v":0},{"$f":"SUMPRODUCT(IF($N473=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N473=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B130","v":"5"},{"$f":"'5'!C130","v":"5.3"},{"$f":"'5'!D130","v":"5.3.7"},{"$f":"'5'!E130","v":""},{"$f":"'5'!F130","v":"5.3.7.1"},{"$f":"'5'!G130","v":0},{"$f":"'5'!H130","v":0},{"$f":"'5'!I130","v":"5.3.7.1.2"},{"$f":"'5'!J130","v":"5.3.7.1.2: Are remedial actions prioritized and dealt with according to criticality?\n"},{"$f":"'5'!K130","v":"1) Security testing process documentation\n- Check there is a process to address remedial issues identified by scans\n- Check these are prioritised using a risk-based approach\n\n"},{"$f":"'5'!L130","v":0},{"$f":"'5'!M130","v":"Standard Required"},{"$f":"'5'!N130","v":"Required"},{"$f":"'5'!O130","v":"TechOps"},{"$f":"'5'!P130","v":0},{"$f":"'5'!Q130","v":0},{"$f":"'5'!R130","v":0},{"$f":"'5'!S130","v":0},{"$f":"'5'!T130","v":0},{"$f":"'5'!U130","v":0},{"$f":"'5'!V130","v":0},{"$f":"'5'!W130","v":0},{"$f":"'5'!X130","v":0},{"$f":"'5'!Y130","v":0},{"$f":"'5'!Z130","v":0},{"$f":"'5'!AA130","v":0},{"$f":"'5'!AB130","v":0},{"$f":"'5'!AC130","v":0},{"$f":"'5'!AD130","v":0},{"$f":"'5'!AE130","v":0},{"$f":"'5'!AF130","v":0},{"$f":"'5'!AG130","v":0},{"$f":"'5'!AH130","v":0},{"$f":"'5'!AI130","v":0},{"$f":"'5'!AJ130","v":0},{"$f":"'5'!AK130","v":0},{"$f":"'5'!AL130","v":0},{"$f":"'5'!AM130","v":0},{"$f":"'5'!AN130","v":0},{"$f":"'5'!AO130","v":0},{"$f":"'5'!AP130","v":0},{"$f":"'5'!AQ130","v":0},{"$f":"'5'!AR130","v":0},{"$f":"'5'!AS130","v":0},{"$f":"'5'!AT130","v":0},{"$f":"SUMPRODUCT(IF($N474=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N474=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B131","v":"5"},{"$f":"'5'!C131","v":"5.3"},{"$f":"'5'!D131","v":"5.3.7"},{"$f":"'5'!E131","v":""},{"$f":"'5'!F131","v":"5.3.7.2"},{"$f":"'5'!G131","v":"5.3.7.2: PENETRATION TESTING\nPenetration testing of the mobile money system should be performed annually and whenever a significant change is made to the mobile money system (e.g. a major release). Testing should be done on all external interfaces to the system.\n\nThe methodology for penetration testing should:\n- be based on industry-accepted penetration testing approaches (for example, NIST SP800-115);\n- include all system components involved in providing the mobile money service (application servers, databases, gateways, etc.);\n- include handset and other terminals such as smartphones and PoS devices;\n- test the network segmentation that separates mobile money from other systems in the network;\n- include both application-layer tests (using real accounts) and network-layer penetration testing; and\n- include consideration of threats and vulnerabilities experienced in the last 12 months.\n\nRemedial actions should be determined and prioritized according to criticality. The actions should be tracked and followed up to ensure completion.\n\nPenetration testing should be performed by a qualified internal resource(s) or qualified external third party, and the independence of the tester should be assured.\n\nFor more information, please refer to security testing in the definitions."},{"$f":"'5'!H131","v":"PCI DSS "},{"$f":"'5'!I131","v":"5.3.7.2.1"},{"$f":"'5'!J131","v":"5.3.7.2.1: Is penetration testing of the mobile money system performed annually and after any significant changes, using all external interfaces?\n"},{"$f":"'5'!K131","v":"1) Security testing process documentation\n-  Check there is a process to perform penetration testing of the mobile money application system annually and after any significant changes to the mobile money platform.\n\n2) Header page of penetration test report or purchase prder for penetration testing\n- Review document to confirm penetration testing has been conducted in the last year"},{"$f":"'5'!L131","v":0},{"$f":"'5'!M131","v":"Standard Required"},{"$f":"'5'!N131","v":"Required"},{"$f":"'5'!O131","v":"TechOps"},{"$f":"'5'!P131","v":0},{"$f":"'5'!Q131","v":0},{"$f":"'5'!R131","v":0},{"$f":"'5'!S131","v":0},{"$f":"'5'!T131","v":0},{"$f":"'5'!U131","v":0},{"$f":"'5'!V131","v":0},{"$f":"'5'!W131","v":0},{"$f":"'5'!X131","v":0},{"$f":"'5'!Y131","v":0},{"$f":"'5'!Z131","v":0},{"$f":"'5'!AA131","v":0},{"$f":"'5'!AB131","v":0},{"$f":"'5'!AC131","v":0},{"$f":"'5'!AD131","v":0},{"$f":"'5'!AE131","v":0},{"$f":"'5'!AF131","v":0},{"$f":"'5'!AG131","v":0},{"$f":"'5'!AH131","v":0},{"$f":"'5'!AI131","v":0},{"$f":"'5'!AJ131","v":0},{"$f":"'5'!AK131","v":0},{"$f":"'5'!AL131","v":0},{"$f":"'5'!AM131","v":0},{"$f":"'5'!AN131","v":0},{"$f":"'5'!AO131","v":0},{"$f":"'5'!AP131","v":0},{"$f":"'5'!AQ131","v":0},{"$f":"'5'!AR131","v":0},{"$f":"'5'!AS131","v":0},{"$f":"'5'!AT131","v":0},{"$f":"SUMPRODUCT(IF($N475=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N475=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B132","v":"5"},{"$f":"'5'!C132","v":"5.3"},{"$f":"'5'!D132","v":"5.3.7"},{"$f":"'5'!E132","v":""},{"$f":"'5'!F132","v":"5.3.7.2"},{"$f":"'5'!G132","v":0},{"$f":"'5'!H132","v":0},{"$f":"'5'!I132","v":"5.3.7.2.2"},{"$f":"'5'!J132","v":"5.3.7.2.2: Are remedial actions prioritized according to criticality and actions tracked and followed up to ensure completion?\n"},{"$f":"'5'!K132","v":"1) Security Testing Process Documentation\n- Check there is a process to address remedial issues identified by scans\n- Check these are prioritised using a risk-based approach\n- Check there is a process to track actions until they are closed\n"},{"$f":"'5'!L132","v":0},{"$f":"'5'!M132","v":"Standard Required"},{"$f":"'5'!N132","v":"Required"},{"$f":"'5'!O132","v":"TechOps"},{"$f":"'5'!P132","v":0},{"$f":"'5'!Q132","v":0},{"$f":"'5'!R132","v":0},{"$f":"'5'!S132","v":0},{"$f":"'5'!T132","v":0},{"$f":"'5'!U132","v":0},{"$f":"'5'!V132","v":0},{"$f":"'5'!W132","v":0},{"$f":"'5'!X132","v":0},{"$f":"'5'!Y132","v":0},{"$f":"'5'!Z132","v":0},{"$f":"'5'!AA132","v":0},{"$f":"'5'!AB132","v":0},{"$f":"'5'!AC132","v":0},{"$f":"'5'!AD132","v":0},{"$f":"'5'!AE132","v":0},{"$f":"'5'!AF132","v":0},{"$f":"'5'!AG132","v":0},{"$f":"'5'!AH132","v":0},{"$f":"'5'!AI132","v":0},{"$f":"'5'!AJ132","v":0},{"$f":"'5'!AK132","v":0},{"$f":"'5'!AL132","v":0},{"$f":"'5'!AM132","v":0},{"$f":"'5'!AN132","v":0},{"$f":"'5'!AO132","v":0},{"$f":"'5'!AP132","v":0},{"$f":"'5'!AQ132","v":0},{"$f":"'5'!AR132","v":0},{"$f":"'5'!AS132","v":0},{"$f":"'5'!AT132","v":0},{"$f":"SUMPRODUCT(IF($N476=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N476=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B133","v":"5"},{"$f":"'5'!C133","v":"5.3"},{"$f":"'5'!D133","v":"5.3.7"},{"$f":"'5'!E133","v":""},{"$f":"'5'!F133","v":"5.3.7.2"},{"$f":"'5'!G133","v":0},{"$f":"'5'!H133","v":0},{"$f":"'5'!I133","v":"5.3.7.2.3"},{"$f":"'5'!J133","v":"5.3.7.2.3: Are penetration tests performed by qualified internal resource(s) or a qualified external third party, and is the independence of the tester assured?\n"},{"$f":"'5'!K133","v":"1) Security Testing Process Documentation\n- Check the penetration tests are carried out by qualified person(s)\n- Check there are controls in place to assure the independence of the tester\n\n2) Purchase Order for penetration testing\n- Check purchase order to confirm the above\n"},{"$f":"'5'!L133","v":0},{"$f":"'5'!M133","v":"Standard Required"},{"$f":"'5'!N133","v":"Required"},{"$f":"'5'!O133","v":"TechOps"},{"$f":"'5'!P133","v":0},{"$f":"'5'!Q133","v":0},{"$f":"'5'!R133","v":0},{"$f":"'5'!S133","v":0},{"$f":"'5'!T133","v":0},{"$f":"'5'!U133","v":0},{"$f":"'5'!V133","v":0},{"$f":"'5'!W133","v":0},{"$f":"'5'!X133","v":0},{"$f":"'5'!Y133","v":0},{"$f":"'5'!Z133","v":0},{"$f":"'5'!AA133","v":0},{"$f":"'5'!AB133","v":0},{"$f":"'5'!AC133","v":0},{"$f":"'5'!AD133","v":0},{"$f":"'5'!AE133","v":0},{"$f":"'5'!AF133","v":0},{"$f":"'5'!AG133","v":0},{"$f":"'5'!AH133","v":0},{"$f":"'5'!AI133","v":0},{"$f":"'5'!AJ133","v":0},{"$f":"'5'!AK133","v":0},{"$f":"'5'!AL133","v":0},{"$f":"'5'!AM133","v":0},{"$f":"'5'!AN133","v":0},{"$f":"'5'!AO133","v":0},{"$f":"'5'!AP133","v":0},{"$f":"'5'!AQ133","v":0},{"$f":"'5'!AR133","v":0},{"$f":"'5'!AS133","v":0},{"$f":"'5'!AT133","v":0},{"$f":"SUMPRODUCT(IF($N477=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N477=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B134","v":"5"},{"$f":"'5'!C134","v":"5.3"},{"$f":"'5'!D134","v":"5.3.7"},{"$f":"'5'!E134","v":""},{"$f":"'5'!F134","v":"5.3.7.2"},{"$f":"'5'!G134","v":0},{"$f":"'5'!H134","v":0},{"$f":"'5'!I134","v":"5.3.7.2.4"},{"$f":"'5'!J134","v":"5.3.7.2.4: Does penetration testing validate the network segmentation that separates mobile money from other systems in the network?\n"},{"$f":"'5'!K134","v":0},{"$f":"'5'!L134","v":0},{"$f":"'5'!M134","v":"Recommended"},{"$f":"'5'!N134","v":"Recommended"},{"$f":"'5'!O134","v":"TechOps"},{"$f":"'5'!P134","v":0},{"$f":"'5'!Q134","v":0},{"$f":"'5'!R134","v":0},{"$f":"'5'!S134","v":0},{"$f":"'5'!T134","v":0},{"$f":"'5'!U134","v":0},{"$f":"'5'!V134","v":0},{"$f":"'5'!W134","v":0},{"$f":"'5'!X134","v":0},{"$f":"'5'!Y134","v":0},{"$f":"'5'!Z134","v":0},{"$f":"'5'!AA134","v":0},{"$f":"'5'!AB134","v":0},{"$f":"'5'!AC134","v":0},{"$f":"'5'!AD134","v":0},{"$f":"'5'!AE134","v":0},{"$f":"'5'!AF134","v":0},{"$f":"'5'!AG134","v":0},{"$f":"'5'!AH134","v":0},{"$f":"'5'!AI134","v":0},{"$f":"'5'!AJ134","v":0},{"$f":"'5'!AK134","v":0},{"$f":"'5'!AL134","v":0},{"$f":"'5'!AM134","v":0},{"$f":"'5'!AN134","v":0},{"$f":"'5'!AO134","v":0},{"$f":"'5'!AP134","v":0},{"$f":"'5'!AQ134","v":0},{"$f":"'5'!AR134","v":0},{"$f":"'5'!AS134","v":0},{"$f":"'5'!AT134","v":0},{"$f":"SUMPRODUCT(IF($N478=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N478=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B135","v":"5"},{"$f":"'5'!C135","v":"5.3"},{"$f":"'5'!D135","v":"5.3.7"},{"$f":"'5'!E135","v":""},{"$f":"'5'!F135","v":"5.3.7.2"},{"$f":"'5'!G135","v":0},{"$f":"'5'!H135","v":0},{"$f":"'5'!I135","v":"5.3.7.2.5"},{"$f":"'5'!J135","v":"5.3.7.2.5: Does penetration testing include both application-layer tests (using real accounts) and network-layer penetration testing?\n"},{"$f":"'5'!K135","v":0},{"$f":"'5'!L135","v":0},{"$f":"'5'!M135","v":"Recommended"},{"$f":"'5'!N135","v":"Recommended"},{"$f":"'5'!O135","v":"TechOps"},{"$f":"'5'!P135","v":0},{"$f":"'5'!Q135","v":0},{"$f":"'5'!R135","v":0},{"$f":"'5'!S135","v":0},{"$f":"'5'!T135","v":0},{"$f":"'5'!U135","v":0},{"$f":"'5'!V135","v":0},{"$f":"'5'!W135","v":0},{"$f":"'5'!X135","v":0},{"$f":"'5'!Y135","v":0},{"$f":"'5'!Z135","v":0},{"$f":"'5'!AA135","v":0},{"$f":"'5'!AB135","v":0},{"$f":"'5'!AC135","v":0},{"$f":"'5'!AD135","v":0},{"$f":"'5'!AE135","v":0},{"$f":"'5'!AF135","v":0},{"$f":"'5'!AG135","v":0},{"$f":"'5'!AH135","v":0},{"$f":"'5'!AI135","v":0},{"$f":"'5'!AJ135","v":0},{"$f":"'5'!AK135","v":0},{"$f":"'5'!AL135","v":0},{"$f":"'5'!AM135","v":0},{"$f":"'5'!AN135","v":0},{"$f":"'5'!AO135","v":0},{"$f":"'5'!AP135","v":0},{"$f":"'5'!AQ135","v":0},{"$f":"'5'!AR135","v":0},{"$f":"'5'!AS135","v":0},{"$f":"'5'!AT135","v":0},{"$f":"SUMPRODUCT(IF($N479=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N479=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B136","v":"5"},{"$f":"'5'!C136","v":"5.3"},{"$f":"'5'!D136","v":"5.3.7"},{"$f":"'5'!E136","v":""},{"$f":"'5'!F136","v":"5.3.7.2"},{"$f":"'5'!G136","v":0},{"$f":"'5'!H136","v":0},{"$f":"'5'!I136","v":"5.3.7.2.6"},{"$f":"'5'!J136","v":"5.3.7.2.6: Does penetration testing include consideration of threats and vulnerabilities experienced in the last 12 months?\n"},{"$f":"'5'!K136","v":0},{"$f":"'5'!L136","v":0},{"$f":"'5'!M136","v":"Recommended"},{"$f":"'5'!N136","v":"Recommended"},{"$f":"'5'!O136","v":"TechOps"},{"$f":"'5'!P136","v":0},{"$f":"'5'!Q136","v":0},{"$f":"'5'!R136","v":0},{"$f":"'5'!S136","v":0},{"$f":"'5'!T136","v":0},{"$f":"'5'!U136","v":0},{"$f":"'5'!V136","v":0},{"$f":"'5'!W136","v":0},{"$f":"'5'!X136","v":0},{"$f":"'5'!Y136","v":0},{"$f":"'5'!Z136","v":0},{"$f":"'5'!AA136","v":0},{"$f":"'5'!AB136","v":0},{"$f":"'5'!AC136","v":0},{"$f":"'5'!AD136","v":0},{"$f":"'5'!AE136","v":0},{"$f":"'5'!AF136","v":0},{"$f":"'5'!AG136","v":0},{"$f":"'5'!AH136","v":0},{"$f":"'5'!AI136","v":0},{"$f":"'5'!AJ136","v":0},{"$f":"'5'!AK136","v":0},{"$f":"'5'!AL136","v":0},{"$f":"'5'!AM136","v":0},{"$f":"'5'!AN136","v":0},{"$f":"'5'!AO136","v":0},{"$f":"'5'!AP136","v":0},{"$f":"'5'!AQ136","v":0},{"$f":"'5'!AR136","v":0},{"$f":"'5'!AS136","v":0},{"$f":"'5'!AT136","v":0},{"$f":"SUMPRODUCT(IF($N480=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N480=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B137","v":"5"},{"$f":"'5'!C137","v":"5.3"},{"$f":"'5'!D137","v":"5.3.8"},{"$f":"'5'!E137","v":"5.3.8: Providers shall ensure continuity of information security."},{"$f":"'5'!F137","v":"5.3.8.1"},{"$f":"'5'!G137","v":"5.3.8.1: SECURITY AND DISASTER RECOVERY\nIt is important that security is maintained in a crisis situation, especially one in which the Disaster Recovery Plan is implemented.\n\nThe security team should provide input into the Disaster Recovery Plan to ensure that security is maintained in the case of each threat identified in the Business Continuity risk assessment. \nIn particular:\n- The disaster recovery site should have the same standard of physical security controls as the primary datacentre;\n- Entities providing outsourced services should be included in the disaster recovery plan to ensure that they maintain security levels following major service failures or disasters."},{"$f":"'5'!H137","v":"ISO 27002:2013 Sec. 17.1 "},{"$f":"'5'!I137","v":"5.3.8.1.1"},{"$f":"'5'!J137","v":"5.3.8.1.1: Are the physical security controls at the disaster recovery site the same standard as those at the the primary datacentre?\n"},{"$f":"'5'!K137","v":"1) Disaster recovery plan\n- Check the the physical security controls at the disaster recovery site are the same standard as those at the the primary datacentre."},{"$f":"'5'!L137","v":0},{"$f":"'5'!M137","v":"Standard Required"},{"$f":"'5'!N137","v":"Required"},{"$f":"'5'!O137","v":"TechOps"},{"$f":"'5'!P137","v":0},{"$f":"'5'!Q137","v":0},{"$f":"'5'!R137","v":0},{"$f":"'5'!S137","v":0},{"$f":"'5'!T137","v":0},{"$f":"'5'!U137","v":0},{"$f":"'5'!V137","v":0},{"$f":"'5'!W137","v":0},{"$f":"'5'!X137","v":0},{"$f":"'5'!Y137","v":0},{"$f":"'5'!Z137","v":0},{"$f":"'5'!AA137","v":0},{"$f":"'5'!AB137","v":0},{"$f":"'5'!AC137","v":0},{"$f":"'5'!AD137","v":0},{"$f":"'5'!AE137","v":0},{"$f":"'5'!AF137","v":0},{"$f":"'5'!AG137","v":0},{"$f":"'5'!AH137","v":0},{"$f":"'5'!AI137","v":0},{"$f":"'5'!AJ137","v":0},{"$f":"'5'!AK137","v":0},{"$f":"'5'!AL137","v":0},{"$f":"'5'!AM137","v":0},{"$f":"'5'!AN137","v":0},{"$f":"'5'!AO137","v":0},{"$f":"'5'!AP137","v":0},{"$f":"'5'!AQ137","v":0},{"$f":"'5'!AR137","v":0},{"$f":"'5'!AS137","v":0},{"$f":"'5'!AT137","v":0},{"$f":"SUMPRODUCT(IF($N481=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N481=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B138","v":"5"},{"$f":"'5'!C138","v":"5.3"},{"$f":"'5'!D138","v":"5.3.8"},{"$f":"'5'!E138","v":""},{"$f":"'5'!F138","v":"5.3.8.1"},{"$f":"'5'!G138","v":0},{"$f":"'5'!H138","v":0},{"$f":"'5'!I138","v":"5.3.8.1.2"},{"$f":"'5'!J138","v":"5.3.8.1.2: Are entities providing outsourced services included in the disaster recovery plan to ensure that they maintain security levels following major service failures or disasters?\n"},{"$f":"'5'!K138","v":0},{"$f":"'5'!L138","v":0},{"$f":"'5'!M138","v":"Recommended"},{"$f":"'5'!N138","v":"Recommended"},{"$f":"'5'!O138","v":"TechOps"},{"$f":"'5'!P138","v":0},{"$f":"'5'!Q138","v":0},{"$f":"'5'!R138","v":0},{"$f":"'5'!S138","v":0},{"$f":"'5'!T138","v":0},{"$f":"'5'!U138","v":0},{"$f":"'5'!V138","v":0},{"$f":"'5'!W138","v":0},{"$f":"'5'!X138","v":0},{"$f":"'5'!Y138","v":0},{"$f":"'5'!Z138","v":0},{"$f":"'5'!AA138","v":0},{"$f":"'5'!AB138","v":0},{"$f":"'5'!AC138","v":0},{"$f":"'5'!AD138","v":0},{"$f":"'5'!AE138","v":0},{"$f":"'5'!AF138","v":0},{"$f":"'5'!AG138","v":0},{"$f":"'5'!AH138","v":0},{"$f":"'5'!AI138","v":0},{"$f":"'5'!AJ138","v":0},{"$f":"'5'!AK138","v":0},{"$f":"'5'!AL138","v":0},{"$f":"'5'!AM138","v":0},{"$f":"'5'!AN138","v":0},{"$f":"'5'!AO138","v":0},{"$f":"'5'!AP138","v":0},{"$f":"'5'!AQ138","v":0},{"$f":"'5'!AR138","v":0},{"$f":"'5'!AS138","v":0},{"$f":"'5'!AT138","v":0},{"$f":"SUMPRODUCT(IF($N482=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N482=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B139","v":"5"},{"$f":"'5'!C139","v":"5.3"},{"$f":"'5'!D139","v":"5.3.9"},{"$f":"'5'!E139","v":"5.3.9: Providers shall develop a process to identify, address, and monitor security incidents and security-related complaints."},{"$f":"'5'!F139","v":"5.3.9.1"},{"$f":"'5'!G139","v":"5.3.9.1: REPORTING SECURITY INCIDENTS\nSecurity incidents may be detected by system monitoring, but often they are reported by users. Processes to enable reporting of security incidents should be implemented.\n\nAll mobile money employees, agents, and third parties should be educated on reporting security incidents, including:\n- their contractual responsibility to report security events as quickly as possible;\n- the procedure for reporting information security events, including noting all details of the incident such as names, data and messages on the screen; and\n- deferring all action and communication to the security incident team.\n\nExamples of security events that could be reported include:\n- ineffective security control;\n- breach of information integrity, confidentiality or availability expectations;\n- non-compliance with regulation;\n- breach of logical or physical security arrangements; and\n- uncontrolled system changes.\n\nProviders should prepare security event reporting forms to help the person reporting to remember all necessary actions in case of an information security event.\n\nThere should be a channel for staff to anonymously report security incidents and violations of information security policies or procedures (i.e., 'whistle blowing')."},{"$f":"'5'!H139","v":"ISO 27002: 2013 Sec. 16 "},{"$f":"'5'!I139","v":"5.3.9.1.1"},{"$f":"'5'!J139","v":"5.3.9.1.1: Are employees, agents, and third parties aware of their responsibility to report information security events as quickly as possible?\n"},{"$f":"'5'!K139","v":0},{"$f":"'5'!L139","v":0},{"$f":"'5'!M139","v":"Recommended"},{"$f":"'5'!N139","v":"Recommended"},{"$f":"'5'!O139","v":"TechOps"},{"$f":"'5'!P139","v":0},{"$f":"'5'!Q139","v":0},{"$f":"'5'!R139","v":0},{"$f":"'5'!S139","v":0},{"$f":"'5'!T139","v":0},{"$f":"'5'!U139","v":0},{"$f":"'5'!V139","v":0},{"$f":"'5'!W139","v":0},{"$f":"'5'!X139","v":0},{"$f":"'5'!Y139","v":0},{"$f":"'5'!Z139","v":0},{"$f":"'5'!AA139","v":0},{"$f":"'5'!AB139","v":0},{"$f":"'5'!AC139","v":0},{"$f":"'5'!AD139","v":0},{"$f":"'5'!AE139","v":0},{"$f":"'5'!AF139","v":0},{"$f":"'5'!AG139","v":0},{"$f":"'5'!AH139","v":0},{"$f":"'5'!AI139","v":0},{"$f":"'5'!AJ139","v":0},{"$f":"'5'!AK139","v":0},{"$f":"'5'!AL139","v":0},{"$f":"'5'!AM139","v":0},{"$f":"'5'!AN139","v":0},{"$f":"'5'!AO139","v":0},{"$f":"'5'!AP139","v":0},{"$f":"'5'!AQ139","v":0},{"$f":"'5'!AR139","v":0},{"$f":"'5'!AS139","v":0},{"$f":"'5'!AT139","v":0},{"$f":"SUMPRODUCT(IF($N483=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N483=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B140","v":"5"},{"$f":"'5'!C140","v":"5.3"},{"$f":"'5'!D140","v":"5.3.9"},{"$f":"'5'!E140","v":0},{"$f":"'5'!F140","v":"5.3.9.1"},{"$f":"'5'!G140","v":0},{"$f":"'5'!H140","v":0},{"$f":"'5'!I140","v":"5.3.9.1.2"},{"$f":"'5'!J140","v":"5.3.9.1.2: Have employees, agents, and third parties been educated in the procedure for reporting security incidents, including (1) noting all details of the incident such as names, data and messages on the screen; (2) deferring all action and communication to the security incident team?\n"},{"$f":"'5'!K140","v":0},{"$f":"'5'!L140","v":0},{"$f":"'5'!M140","v":"Recommended"},{"$f":"'5'!N140","v":"Recommended"},{"$f":"'5'!O140","v":"TechOps"},{"$f":"'5'!P140","v":0},{"$f":"'5'!Q140","v":0},{"$f":"'5'!R140","v":0},{"$f":"'5'!S140","v":0},{"$f":"'5'!T140","v":0},{"$f":"'5'!U140","v":0},{"$f":"'5'!V140","v":0},{"$f":"'5'!W140","v":0},{"$f":"'5'!X140","v":0},{"$f":"'5'!Y140","v":0},{"$f":"'5'!Z140","v":0},{"$f":"'5'!AA140","v":0},{"$f":"'5'!AB140","v":0},{"$f":"'5'!AC140","v":0},{"$f":"'5'!AD140","v":0},{"$f":"'5'!AE140","v":0},{"$f":"'5'!AF140","v":0},{"$f":"'5'!AG140","v":0},{"$f":"'5'!AH140","v":0},{"$f":"'5'!AI140","v":0},{"$f":"'5'!AJ140","v":0},{"$f":"'5'!AK140","v":0},{"$f":"'5'!AL140","v":0},{"$f":"'5'!AM140","v":0},{"$f":"'5'!AN140","v":0},{"$f":"'5'!AO140","v":0},{"$f":"'5'!AP140","v":0},{"$f":"'5'!AQ140","v":0},{"$f":"'5'!AR140","v":0},{"$f":"'5'!AS140","v":0},{"$f":"'5'!AT140","v":0},{"$f":"SUMPRODUCT(IF($N484=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N484=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B141","v":"5"},{"$f":"'5'!C141","v":"5.3"},{"$f":"'5'!D141","v":"5.3.9"},{"$f":"'5'!E141","v":""},{"$f":"'5'!F141","v":"5.3.9.1"},{"$f":"'5'!G141","v":0},{"$f":"'5'!H141","v":0},{"$f":"'5'!I141","v":"5.3.9.1.3"},{"$f":"'5'!J141","v":"5.3.9.1.3: Are employees, agents, and third parties provided with an anonymous reporting channel to report security incidents or violations of security policies or procedures (i.e. 'whistle blowing')?\n"},{"$f":"'5'!K141","v":0},{"$f":"'5'!L141","v":0},{"$f":"'5'!M141","v":"Recommended"},{"$f":"'5'!N141","v":"Recommended"},{"$f":"'5'!O141","v":"TechOps"},{"$f":"'5'!P141","v":0},{"$f":"'5'!Q141","v":0},{"$f":"'5'!R141","v":0},{"$f":"'5'!S141","v":0},{"$f":"'5'!T141","v":0},{"$f":"'5'!U141","v":0},{"$f":"'5'!V141","v":0},{"$f":"'5'!W141","v":0},{"$f":"'5'!X141","v":0},{"$f":"'5'!Y141","v":0},{"$f":"'5'!Z141","v":0},{"$f":"'5'!AA141","v":0},{"$f":"'5'!AB141","v":0},{"$f":"'5'!AC141","v":0},{"$f":"'5'!AD141","v":0},{"$f":"'5'!AE141","v":0},{"$f":"'5'!AF141","v":0},{"$f":"'5'!AG141","v":0},{"$f":"'5'!AH141","v":0},{"$f":"'5'!AI141","v":0},{"$f":"'5'!AJ141","v":0},{"$f":"'5'!AK141","v":0},{"$f":"'5'!AL141","v":0},{"$f":"'5'!AM141","v":0},{"$f":"'5'!AN141","v":0},{"$f":"'5'!AO141","v":0},{"$f":"'5'!AP141","v":0},{"$f":"'5'!AQ141","v":0},{"$f":"'5'!AR141","v":0},{"$f":"'5'!AS141","v":0},{"$f":"'5'!AT141","v":0},{"$f":"SUMPRODUCT(IF($N485=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N485=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B142","v":"5"},{"$f":"'5'!C142","v":"5.3"},{"$f":"'5'!D142","v":"5.3.9"},{"$f":"'5'!E142","v":"5.3.9: Providers shall develop a process to identify, address, and monitor security incidents and security-related complaints."},{"$f":"'5'!F142","v":"5.3.9.2"},{"$f":"'5'!G142","v":"5.3.9.2: RESPONSE TO SECURITY INCIDENTS\nProviders should implement a documented procedure for responding to major security incidents. The response should include the following:\n- collecting evidence as soon as possible after the occurrence;\n- conducting information security forensics analysis;\n- escalation of the incident, as required;\n- ensuring that all response activities are logged;\n- communicating the information security incident to internal and external people or organizations with a need to know;\n- recovering systems and data that may have been damaged by the incident;\n- addressing information security weaknesses found to cause or contribute to the incident; \n- once the incident has been successfully addressed, formally closing and recording it.\n\nIn the event of a major security incident, a nominated point of contact in the provider should report information security incidents as quickly as possible, through appropriate management channels, to relevant authorities. The security incident procedure should specify which security incidents should be reported (e.g. if intrusion has been detected, systemic risks have been created, and/or it is suspected that laws may have been broken) and how to report them promptly."},{"$f":"'5'!H142","v":"ISO 27002: 2013 \nSec. 16\nSec. 6.1"},{"$f":"'5'!I142","v":"5.3.9.2.1"},{"$f":"'5'!J142","v":"5.3.9.2.1: Is there a documented procedure for managing and responding to security incidents (including escalation when required) and fixing the root cause?\n"},{"$f":"'5'!K142","v":"1) Security incident response plan \n- Check that there is process for managing and responding to security incidents and fixing the root cause.\n- Check that the process is documented.\n- Check that the process includes escalation steps, including when and incident should be escalated and to whom."},{"$f":"'5'!L142","v":0},{"$f":"'5'!M142","v":"Standard Required"},{"$f":"'5'!N142","v":"Required"},{"$f":"'5'!O142","v":"TechOps"},{"$f":"'5'!P142","v":0},{"$f":"'5'!Q142","v":0},{"$f":"'5'!R142","v":0},{"$f":"'5'!S142","v":0},{"$f":"'5'!T142","v":0},{"$f":"'5'!U142","v":0},{"$f":"'5'!V142","v":0},{"$f":"'5'!W142","v":0},{"$f":"'5'!X142","v":0},{"$f":"'5'!Y142","v":0},{"$f":"'5'!Z142","v":0},{"$f":"'5'!AA142","v":0},{"$f":"'5'!AB142","v":0},{"$f":"'5'!AC142","v":0},{"$f":"'5'!AD142","v":0},{"$f":"'5'!AE142","v":0},{"$f":"'5'!AF142","v":0},{"$f":"'5'!AG142","v":0},{"$f":"'5'!AH142","v":0},{"$f":"'5'!AI142","v":0},{"$f":"'5'!AJ142","v":0},{"$f":"'5'!AK142","v":0},{"$f":"'5'!AL142","v":0},{"$f":"'5'!AM142","v":0},{"$f":"'5'!AN142","v":0},{"$f":"'5'!AO142","v":0},{"$f":"'5'!AP142","v":0},{"$f":"'5'!AQ142","v":0},{"$f":"'5'!AR142","v":0},{"$f":"'5'!AS142","v":0},{"$f":"'5'!AT142","v":0},{"$f":"SUMPRODUCT(IF($N486=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N486=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B143","v":"5"},{"$f":"'5'!C143","v":"5.3"},{"$f":"'5'!D143","v":"5.3.9"},{"$f":"'5'!E143","v":""},{"$f":"'5'!F143","v":"5.3.9.2"},{"$f":"'5'!G143","v":0},{"$f":"'5'!H143","v":0},{"$f":"'5'!I143","v":"5.3.9.2.2"},{"$f":"'5'!J143","v":"5.3.9.2.2: Does the response to security incidents require collecting evidence as soon as possible after the occurrence and conducting information security forensics analysis?\n"},{"$f":"'5'!K143","v":0},{"$f":"'5'!L143","v":0},{"$f":"'5'!M143","v":"Recommended"},{"$f":"'5'!N143","v":"Recommended"},{"$f":"'5'!O143","v":"TechOps"},{"$f":"'5'!P143","v":0},{"$f":"'5'!Q143","v":0},{"$f":"'5'!R143","v":0},{"$f":"'5'!S143","v":0},{"$f":"'5'!T143","v":0},{"$f":"'5'!U143","v":0},{"$f":"'5'!V143","v":0},{"$f":"'5'!W143","v":0},{"$f":"'5'!X143","v":0},{"$f":"'5'!Y143","v":0},{"$f":"'5'!Z143","v":0},{"$f":"'5'!AA143","v":0},{"$f":"'5'!AB143","v":0},{"$f":"'5'!AC143","v":0},{"$f":"'5'!AD143","v":0},{"$f":"'5'!AE143","v":0},{"$f":"'5'!AF143","v":0},{"$f":"'5'!AG143","v":0},{"$f":"'5'!AH143","v":0},{"$f":"'5'!AI143","v":0},{"$f":"'5'!AJ143","v":0},{"$f":"'5'!AK143","v":0},{"$f":"'5'!AL143","v":0},{"$f":"'5'!AM143","v":0},{"$f":"'5'!AN143","v":0},{"$f":"'5'!AO143","v":0},{"$f":"'5'!AP143","v":0},{"$f":"'5'!AQ143","v":0},{"$f":"'5'!AR143","v":0},{"$f":"'5'!AS143","v":0},{"$f":"'5'!AT143","v":0},{"$f":"SUMPRODUCT(IF($N487=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N487=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B144","v":"5"},{"$f":"'5'!C144","v":"5.3"},{"$f":"'5'!D144","v":"5.3.9"},{"$f":"'5'!E144","v":""},{"$f":"'5'!F144","v":"5.3.9.2"},{"$f":"'5'!G144","v":0},{"$f":"'5'!H144","v":0},{"$f":"'5'!I144","v":"5.3.9.2.3"},{"$f":"'5'!J144","v":"5.3.9.2.3: Are all activities in response to a security incident properly logged?\n"},{"$f":"'5'!K144","v":0},{"$f":"'5'!L144","v":0},{"$f":"'5'!M144","v":"Recommended"},{"$f":"'5'!N144","v":"Recommended"},{"$f":"'5'!O144","v":"TechOps"},{"$f":"'5'!P144","v":0},{"$f":"'5'!Q144","v":0},{"$f":"'5'!R144","v":0},{"$f":"'5'!S144","v":0},{"$f":"'5'!T144","v":0},{"$f":"'5'!U144","v":0},{"$f":"'5'!V144","v":0},{"$f":"'5'!W144","v":0},{"$f":"'5'!X144","v":0},{"$f":"'5'!Y144","v":0},{"$f":"'5'!Z144","v":0},{"$f":"'5'!AA144","v":0},{"$f":"'5'!AB144","v":0},{"$f":"'5'!AC144","v":0},{"$f":"'5'!AD144","v":0},{"$f":"'5'!AE144","v":0},{"$f":"'5'!AF144","v":0},{"$f":"'5'!AG144","v":0},{"$f":"'5'!AH144","v":0},{"$f":"'5'!AI144","v":0},{"$f":"'5'!AJ144","v":0},{"$f":"'5'!AK144","v":0},{"$f":"'5'!AL144","v":0},{"$f":"'5'!AM144","v":0},{"$f":"'5'!AN144","v":0},{"$f":"'5'!AO144","v":0},{"$f":"'5'!AP144","v":0},{"$f":"'5'!AQ144","v":0},{"$f":"'5'!AR144","v":0},{"$f":"'5'!AS144","v":0},{"$f":"'5'!AT144","v":0},{"$f":"SUMPRODUCT(IF($N488=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N488=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B145","v":"5"},{"$f":"'5'!C145","v":"5.3"},{"$f":"'5'!D145","v":"5.3.9"},{"$f":"'5'!E145","v":""},{"$f":"'5'!F145","v":"5.3.9.2"},{"$f":"'5'!G145","v":0},{"$f":"'5'!H145","v":0},{"$f":"'5'!I145","v":"5.3.9.2.4"},{"$f":"'5'!J145","v":"5.3.9.2.4: Does the security and fraud incident procedure include a communications plan that addresses internal and external communications?\n"},{"$f":"'5'!K145","v":0},{"$f":"'5'!L145","v":0},{"$f":"'5'!M145","v":"Recommended"},{"$f":"'5'!N145","v":"Recommended"},{"$f":"'5'!O145","v":"TechOps"},{"$f":"'5'!P145","v":0},{"$f":"'5'!Q145","v":0},{"$f":"'5'!R145","v":0},{"$f":"'5'!S145","v":0},{"$f":"'5'!T145","v":0},{"$f":"'5'!U145","v":0},{"$f":"'5'!V145","v":0},{"$f":"'5'!W145","v":0},{"$f":"'5'!X145","v":0},{"$f":"'5'!Y145","v":0},{"$f":"'5'!Z145","v":0},{"$f":"'5'!AA145","v":0},{"$f":"'5'!AB145","v":0},{"$f":"'5'!AC145","v":0},{"$f":"'5'!AD145","v":0},{"$f":"'5'!AE145","v":0},{"$f":"'5'!AF145","v":0},{"$f":"'5'!AG145","v":0},{"$f":"'5'!AH145","v":0},{"$f":"'5'!AI145","v":0},{"$f":"'5'!AJ145","v":0},{"$f":"'5'!AK145","v":0},{"$f":"'5'!AL145","v":0},{"$f":"'5'!AM145","v":0},{"$f":"'5'!AN145","v":0},{"$f":"'5'!AO145","v":0},{"$f":"'5'!AP145","v":0},{"$f":"'5'!AQ145","v":0},{"$f":"'5'!AR145","v":0},{"$f":"'5'!AS145","v":0},{"$f":"'5'!AT145","v":0},{"$f":"SUMPRODUCT(IF($N489=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N489=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'5'!B146","v":"5"},{"$f":"'5'!C146","v":"5.1"},{"$f":"'5'!D146","v":"5.1.1"},{"$f":"'5'!E146","v":""},{"$f":"'5'!F146","v":"5.1.1.3"},{"$f":"'5'!G146","v":0},{"$f":"'5'!H146","v":0},{"$f":"'5'!I146","v":"5.3.9.2.5"},{"$f":"'5'!J146","v":"5.3.9.2.5: Does the information security policy specify which security incidents should be reported to the relevant authorities and how to report them promptly?\n(e.g. if intrusion has been detected, systemic risks have been created, and/or it is suspected that laws may have been broken) \n"},{"$f":"'5'!K146","v":0},{"$f":"'5'!L146","v":0},{"$f":"'5'!M146","v":"Recommended"},{"$f":"'5'!N146","v":"Recommended"},{"$f":"'5'!O146","v":"TechOps"},{"$f":"'5'!P146","v":0},{"$f":"'5'!Q146","v":0},{"$f":"'5'!R146","v":0},{"$f":"'5'!S146","v":0},{"$f":"'5'!T146","v":0},{"$f":"'5'!U146","v":0},{"$f":"'5'!V146","v":0},{"$f":"'5'!W146","v":0},{"$f":"'5'!X146","v":0},{"$f":"'5'!Y146","v":0},{"$f":"'5'!Z146","v":0},{"$f":"'5'!AA146","v":0},{"$f":"'5'!AB146","v":0},{"$f":"'5'!AC146","v":0},{"$f":"'5'!AD146","v":0},{"$f":"'5'!AE146","v":0},{"$f":"'5'!AF146","v":0},{"$f":"'5'!AG146","v":0},{"$f":"'5'!AH146","v":0},{"$f":"'5'!AI146","v":0},{"$f":"'5'!AJ146","v":0},{"$f":"'5'!AK146","v":0},{"$f":"'5'!AL146","v":0},{"$f":"'5'!AM146","v":0},{"$f":"'5'!AN146","v":0},{"$f":"'5'!AO146","v":0},{"$f":"'5'!AP146","v":0},{"$f":"'5'!AQ146","v":0},{"$f":"'5'!AR146","v":0},{"$f":"'5'!AS146","v":0},{"$f":"'5'!AT146","v":0},{"$f":"SUMPRODUCT(IF($N490=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N490=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B5","v":"6"},{"$f":"'6'!C5","v":"6.1"},{"$f":"'6'!D5","v":"6.1.1"},{"$f":"'6'!E5","v":"6.1.1: Providers shall ensure that customers are provided with clear, prominent, and timely information regarding fees and terms and conditions."},{"$f":"'6'!F5","v":"6.1.1.1"},{"$f":"'6'!G5","v":"6.1.1.1: INFORM CUSTOMERS OF ALL FEES AND TERMS & CONDITIONS \nFees: Customers should be informed of all applicable fees, including transaction-based fees, non-transaction-based fees and exceptional fees In-scope services may include the following, depending on the provider.\n1. Transaction-based fees (The fee schedule should make clear the factors that determine the rates, such as transaction size):\n   • Transfers on-net (to registered and unregistered users)\n   • Transfers off-net (e.g. to interoperability partners & banks)\n   • Transfers internationally (IMT)\n   • Deposits/withdrawals at agent or ATM\n   • Bill payments (as payment channel only)\n   • Merchant payments (as payment channel only)\n2. Non-transaction-based fees:\n   • Balance enquiry or mini statement\n   • Recurring charges \n   • PIN change\n   • Loan / savings / insurance offered as part of mobile money\n3. Fees for exceptional events:\n   • Penalty fees (e.g. for non-repayment of loan)\n   • Additional SMS charges for service use while roaming\n\nT&Cs: Customers should be provided with the T&Cs in an accessible manner (e.g. physical copy, or summary on posters) before they start using mobile money services. Good practice is to make a summary of key points from the T&Cs available on posters or handouts.\n\nGood practice is to make key information available to customers via handset menus. This should ideally include fees, key points from T&Cs, FAQs, how to use the service, and how to contact customer support."},{"$f":"'6'!H5","v":0},{"$f":"'6'!I5","v":"6.1.1.1.1"},{"$f":"'6'!J5","v":"6.1.1.1.1: Are customers informed of complete fee schedules before using the service, including transaction-based, non-transaction-based and exceptional fees (e.g. at agents, on leaflets, posters etc.)?\n"},{"$f":"'6'!K5","v":"1) Point of sale (agent) material or publicity material or handset interface or other mechanism for informing customers of fees (different services could have different mechanisms)\n- Check that customers are informed of all fees before using the service, including the following examples, where applicable:\n1. Transaction-based fees:\n   • Transfers on-net (to registered and unregistered users)\n   • Transfers off-net (e.g. to interoperability partners & banks)\n   • Transfers internationally (IMT)\n   • Deposits/withdrawals at agent or ATM\n   • Bill payments (as payment channel only)\n   • Merchant payments (as payment channel only)\n2. Non-transaction-based fees:\n   • Balance enquiry or mini statement\n   • Recurring charges \n   • PIN change\n   • Loan / savings / insurance offered as part of mobile money\n3. Fees for exceptional events:\n   • Penalty fees (e.g. for non-repayment of loan)\n   • Additional SMS charges for service use while roaming\n\nNote: in-scope services are defined in the Definitions - see \"Mobile Money Services in scope of MMC\"\nNote: fees could be viewed by customer as part of acceptance process when signing up to the service."},{"$f":"'6'!L5","v":0},{"$f":"'6'!M5","v":"Urgent Required"},{"$f":"'6'!N5","v":"Required"},{"$f":"'6'!O5","v":"BizOps"},{"$f":"'6'!P5","v":0},{"$f":"'6'!Q5","v":0},{"$f":"'6'!R5","v":0},{"$f":"'6'!S5","v":0},{"$f":"'6'!T5","v":0},{"$f":"'6'!U5","v":0},{"$f":"'6'!V5","v":0},{"$f":"'6'!W5","v":0},{"$f":"'6'!X5","v":0},{"$f":"'6'!Y5","v":0},{"$f":"'6'!Z5","v":0},{"$f":"'6'!AA5","v":0},{"$f":"'6'!AB5","v":0},{"$f":"'6'!AC5","v":0},{"$f":"'6'!AD5","v":0},{"$f":"'6'!AE5","v":0},{"$f":"'6'!AF5","v":0},{"$f":"'6'!AG5","v":0},{"$f":"'6'!AH5","v":0},{"$f":"'6'!AI5","v":0},{"$f":"'6'!AJ5","v":0},{"$f":"'6'!AK5","v":0},{"$f":"'6'!AL5","v":0},{"$f":"'6'!AM5","v":0},{"$f":"'6'!AN5","v":0},{"$f":"'6'!AO5","v":0},{"$f":"'6'!AP5","v":0},{"$f":"'6'!AQ5","v":0},{"$f":"'6'!AR5","v":0},{"$f":"'6'!AS5","v":0},{"$f":"'6'!AT5","v":0},{"$f":"SUMPRODUCT(IF($N491=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N491=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B6","v":"6"},{"$f":"'6'!C6","v":"6.1"},{"$f":"'6'!D6","v":"6.1.1"},{"$f":"'6'!E6","v":0},{"$f":"'6'!F6","v":"6.1.1.1"},{"$f":"'6'!G6","v":0},{"$f":"'6'!H6","v":0},{"$f":"'6'!I6","v":"6.1.1.1.2"},{"$f":"'6'!J6","v":"6.1.1.1.2: Are the T&Cs provided to customers in an accessible manner (e.g. physical copy, or summary on posters) before using the service?\n"},{"$f":"'6'!K6","v":"Point of sale (agent) material or publicity material or handset interface or other mechanism for informing customers of T&Cs\n- Check the T&Cs are provided to customers in an accessible manner (e.g. physical copy, or summary on posters) before using the service.\nNote: Different services may have separate T&Cs (e.g. loans/savings), which should also be provided to customers before using the service."},{"$f":"'6'!L6","v":0},{"$f":"'6'!M6","v":"Urgent Required"},{"$f":"'6'!N6","v":"Required"},{"$f":"'6'!O6","v":"BizOps"},{"$f":"'6'!P6","v":0},{"$f":"'6'!Q6","v":0},{"$f":"'6'!R6","v":0},{"$f":"'6'!S6","v":0},{"$f":"'6'!T6","v":0},{"$f":"'6'!U6","v":0},{"$f":"'6'!V6","v":0},{"$f":"'6'!W6","v":0},{"$f":"'6'!X6","v":0},{"$f":"'6'!Y6","v":0},{"$f":"'6'!Z6","v":0},{"$f":"'6'!AA6","v":0},{"$f":"'6'!AB6","v":0},{"$f":"'6'!AC6","v":0},{"$f":"'6'!AD6","v":0},{"$f":"'6'!AE6","v":0},{"$f":"'6'!AF6","v":0},{"$f":"'6'!AG6","v":0},{"$f":"'6'!AH6","v":0},{"$f":"'6'!AI6","v":0},{"$f":"'6'!AJ6","v":0},{"$f":"'6'!AK6","v":0},{"$f":"'6'!AL6","v":0},{"$f":"'6'!AM6","v":0},{"$f":"'6'!AN6","v":0},{"$f":"'6'!AO6","v":0},{"$f":"'6'!AP6","v":0},{"$f":"'6'!AQ6","v":0},{"$f":"'6'!AR6","v":0},{"$f":"'6'!AS6","v":0},{"$f":"'6'!AT6","v":0},{"$f":"SUMPRODUCT(IF($N492=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N492=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B7","v":"6"},{"$f":"'6'!C7","v":"6.1"},{"$f":"'6'!D7","v":"6.1.1"},{"$f":"'6'!E7","v":0},{"$f":"'6'!F7","v":"6.1.1.1"},{"$f":"'6'!G7","v":0},{"$f":"'6'!H7","v":0},{"$f":"'6'!I7","v":"6.1.1.1.3"},{"$f":"'6'!J7","v":"6.1.1.1.3: Is a summary of key points from the T&Cs clarified to customers on posters or handouts?\n"},{"$f":"'6'!K7","v":0},{"$f":"'6'!L7","v":0},{"$f":"'6'!M7","v":"Recommended"},{"$f":"'6'!N7","v":"Recommended"},{"$f":"'6'!O7","v":"BizOps"},{"$f":"'6'!P7","v":0},{"$f":"'6'!Q7","v":0},{"$f":"'6'!R7","v":0},{"$f":"'6'!S7","v":0},{"$f":"'6'!T7","v":0},{"$f":"'6'!U7","v":0},{"$f":"'6'!V7","v":0},{"$f":"'6'!W7","v":0},{"$f":"'6'!X7","v":0},{"$f":"'6'!Y7","v":0},{"$f":"'6'!Z7","v":0},{"$f":"'6'!AA7","v":0},{"$f":"'6'!AB7","v":0},{"$f":"'6'!AC7","v":0},{"$f":"'6'!AD7","v":0},{"$f":"'6'!AE7","v":0},{"$f":"'6'!AF7","v":0},{"$f":"'6'!AG7","v":0},{"$f":"'6'!AH7","v":0},{"$f":"'6'!AI7","v":0},{"$f":"'6'!AJ7","v":0},{"$f":"'6'!AK7","v":0},{"$f":"'6'!AL7","v":0},{"$f":"'6'!AM7","v":0},{"$f":"'6'!AN7","v":0},{"$f":"'6'!AO7","v":0},{"$f":"'6'!AP7","v":0},{"$f":"'6'!AQ7","v":0},{"$f":"'6'!AR7","v":0},{"$f":"'6'!AS7","v":0},{"$f":"'6'!AT7","v":0},{"$f":"SUMPRODUCT(IF($N493=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N493=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B8","v":"6"},{"$f":"'6'!C8","v":"6.1"},{"$f":"'6'!D8","v":"6.1.1"},{"$f":"'6'!E8","v":0},{"$f":"'6'!F8","v":"6.1.1.1"},{"$f":"'6'!G8","v":0},{"$f":"'6'!H8","v":0},{"$f":"'6'!I8","v":"6.1.1.1.4"},{"$f":"'6'!J8","v":"6.1.1.1.4: Are fees, T&Cs, FAQ, and contact information for customer support available to customers via handset menus?\n"},{"$f":"'6'!K8","v":0},{"$f":"'6'!L8","v":0},{"$f":"'6'!M8","v":"Recommended"},{"$f":"'6'!N8","v":"Recommended"},{"$f":"'6'!O8","v":"BizOps"},{"$f":"'6'!P8","v":0},{"$f":"'6'!Q8","v":0},{"$f":"'6'!R8","v":0},{"$f":"'6'!S8","v":0},{"$f":"'6'!T8","v":0},{"$f":"'6'!U8","v":0},{"$f":"'6'!V8","v":0},{"$f":"'6'!W8","v":0},{"$f":"'6'!X8","v":0},{"$f":"'6'!Y8","v":0},{"$f":"'6'!Z8","v":0},{"$f":"'6'!AA8","v":0},{"$f":"'6'!AB8","v":0},{"$f":"'6'!AC8","v":0},{"$f":"'6'!AD8","v":0},{"$f":"'6'!AE8","v":0},{"$f":"'6'!AF8","v":0},{"$f":"'6'!AG8","v":0},{"$f":"'6'!AH8","v":0},{"$f":"'6'!AI8","v":0},{"$f":"'6'!AJ8","v":0},{"$f":"'6'!AK8","v":0},{"$f":"'6'!AL8","v":0},{"$f":"'6'!AM8","v":0},{"$f":"'6'!AN8","v":0},{"$f":"'6'!AO8","v":0},{"$f":"'6'!AP8","v":0},{"$f":"'6'!AQ8","v":0},{"$f":"'6'!AR8","v":0},{"$f":"'6'!AS8","v":0},{"$f":"'6'!AT8","v":0},{"$f":"SUMPRODUCT(IF($N494=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N494=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B9","v":"6"},{"$f":"'6'!C9","v":"6.1"},{"$f":"'6'!D9","v":"6.1.1"},{"$f":"'6'!E9","v":0},{"$f":"'6'!F9","v":"6.1.1.2"},{"$f":"'6'!G9","v":"6.1.1.2: PROPERLY ORGANISE AND FORMAT TERMS & CONDITIONS AND FEE SCHEDULES\nProviders should ensure that T&Cs and fees schedules are structured such that they reflect proper subject issues, e.g. fees, customer care, consumer rights, processes to follow in case of problems, etc."},{"$f":"'6'!H9","v":0},{"$f":"'6'!I9","v":"6.1.1.2.1"},{"$f":"'6'!J9","v":"6.1.1.2.1: Have the T&Cs and the fee schedule been properly organised and structured under clear and appropriate subject headings?\n"},{"$f":"'6'!K9","v":0},{"$f":"'6'!L9","v":0},{"$f":"'6'!M9","v":"Recommended"},{"$f":"'6'!N9","v":"Recommended"},{"$f":"'6'!O9","v":"BizOps"},{"$f":"'6'!P9","v":0},{"$f":"'6'!Q9","v":0},{"$f":"'6'!R9","v":0},{"$f":"'6'!S9","v":0},{"$f":"'6'!T9","v":0},{"$f":"'6'!U9","v":0},{"$f":"'6'!V9","v":0},{"$f":"'6'!W9","v":0},{"$f":"'6'!X9","v":0},{"$f":"'6'!Y9","v":0},{"$f":"'6'!Z9","v":0},{"$f":"'6'!AA9","v":0},{"$f":"'6'!AB9","v":0},{"$f":"'6'!AC9","v":0},{"$f":"'6'!AD9","v":0},{"$f":"'6'!AE9","v":0},{"$f":"'6'!AF9","v":0},{"$f":"'6'!AG9","v":0},{"$f":"'6'!AH9","v":0},{"$f":"'6'!AI9","v":0},{"$f":"'6'!AJ9","v":0},{"$f":"'6'!AK9","v":0},{"$f":"'6'!AL9","v":0},{"$f":"'6'!AM9","v":0},{"$f":"'6'!AN9","v":0},{"$f":"'6'!AO9","v":0},{"$f":"'6'!AP9","v":0},{"$f":"'6'!AQ9","v":0},{"$f":"'6'!AR9","v":0},{"$f":"'6'!AS9","v":0},{"$f":"'6'!AT9","v":0},{"$f":"SUMPRODUCT(IF($N495=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N495=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B10","v":"6"},{"$f":"'6'!C10","v":"6.1"},{"$f":"'6'!D10","v":"6.1.1"},{"$f":"'6'!E10","v":0},{"$f":"'6'!F10","v":"6.1.1.3"},{"$f":"'6'!G10","v":"6.1.1.3: PUBLISH T&CS IN PLAIN LANGUAGE WHERE POSSIBLE\nProviders should ensure that all T&Cs should be written in plain language as much as possible, unless specific sections and wording are required by law & regulation to be written in a specific legalistic way.\n\nThe information should be presented in ways that the customers can be expected to comprehend, taking due account of the literacy and numeracy constraints of the customer base. For example, providers may wish to use diagrams where feasible."},{"$f":"'6'!H10","v":0},{"$f":"'6'!I10","v":"6.1.1.3.1"},{"$f":"'6'!J10","v":"6.1.1.3.1: Have the T&Cs been written in plain language to the greatest extent possible, while both complying with regulatory requirements and taking due account of the literacy and numeracy constraints of the customer base?\n"},{"$f":"'6'!K10","v":0},{"$f":"'6'!L10","v":0},{"$f":"'6'!M10","v":"Recommended"},{"$f":"'6'!N10","v":"Recommended"},{"$f":"'6'!O10","v":"BizOps"},{"$f":"'6'!P10","v":0},{"$f":"'6'!Q10","v":0},{"$f":"'6'!R10","v":0},{"$f":"'6'!S10","v":0},{"$f":"'6'!T10","v":0},{"$f":"'6'!U10","v":0},{"$f":"'6'!V10","v":0},{"$f":"'6'!W10","v":0},{"$f":"'6'!X10","v":0},{"$f":"'6'!Y10","v":0},{"$f":"'6'!Z10","v":0},{"$f":"'6'!AA10","v":0},{"$f":"'6'!AB10","v":0},{"$f":"'6'!AC10","v":0},{"$f":"'6'!AD10","v":0},{"$f":"'6'!AE10","v":0},{"$f":"'6'!AF10","v":0},{"$f":"'6'!AG10","v":0},{"$f":"'6'!AH10","v":0},{"$f":"'6'!AI10","v":0},{"$f":"'6'!AJ10","v":0},{"$f":"'6'!AK10","v":0},{"$f":"'6'!AL10","v":0},{"$f":"'6'!AM10","v":0},{"$f":"'6'!AN10","v":0},{"$f":"'6'!AO10","v":0},{"$f":"'6'!AP10","v":0},{"$f":"'6'!AQ10","v":0},{"$f":"'6'!AR10","v":0},{"$f":"'6'!AS10","v":0},{"$f":"'6'!AT10","v":0},{"$f":"SUMPRODUCT(IF($N496=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N496=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B11","v":"6"},{"$f":"'6'!C11","v":"6.1"},{"$f":"'6'!D11","v":"6.1.1"},{"$f":"'6'!E11","v":0},{"$f":"'6'!F11","v":"6.1.1.4"},{"$f":"'6'!G11","v":"6.1.1.4: NOTIFY CUSTOMERS IN ADVANCE OF CHANGES TO TERMS & CONDITIONS OR FEE SCHEDULES\nProviders should notify customers of any changes to T&Cs or fee schedules before these take effect, with an appropriate notice period. The notification should be pushed to customers (for example, in the form of an SMS or notification through a mobile app). The method of notifying customer should take account of the significance of the change; major changes to fees and/or T&Cs also should be advertised through methods such as posters and/or media campaigns.\n\nProviders should have internal processes in place to ensure that updated materials are developed and disseminated prior to the implementation of new T&Cs or fee schedules. Materials should be updated at all agents and retail outlets where services are provided."},{"$f":"'6'!H11","v":0},{"$f":"'6'!I11","v":"6.1.1.4.1"},{"$f":"'6'!J11","v":"6.1.1.4.1: Are customers notified of any changes to the T&Cs or fee schedules?\n"},{"$f":"'6'!K11","v":"1) Process for changes to fees & T&Cs, or customer communication plan\n- Check there is a process for notifying customers of changes to T&Cs and/or fee schedules.\n- Check that the process includes timescales for the customer to be notified with appropriate notice.\n"},{"$f":"'6'!L11","v":0},{"$f":"'6'!M11","v":"Standard Required"},{"$f":"'6'!N11","v":"Required"},{"$f":"'6'!O11","v":"BizOps"},{"$f":"'6'!P11","v":0},{"$f":"'6'!Q11","v":0},{"$f":"'6'!R11","v":0},{"$f":"'6'!S11","v":0},{"$f":"'6'!T11","v":0},{"$f":"'6'!U11","v":0},{"$f":"'6'!V11","v":0},{"$f":"'6'!W11","v":0},{"$f":"'6'!X11","v":0},{"$f":"'6'!Y11","v":0},{"$f":"'6'!Z11","v":0},{"$f":"'6'!AA11","v":0},{"$f":"'6'!AB11","v":0},{"$f":"'6'!AC11","v":0},{"$f":"'6'!AD11","v":0},{"$f":"'6'!AE11","v":0},{"$f":"'6'!AF11","v":0},{"$f":"'6'!AG11","v":0},{"$f":"'6'!AH11","v":0},{"$f":"'6'!AI11","v":0},{"$f":"'6'!AJ11","v":0},{"$f":"'6'!AK11","v":0},{"$f":"'6'!AL11","v":0},{"$f":"'6'!AM11","v":0},{"$f":"'6'!AN11","v":0},{"$f":"'6'!AO11","v":0},{"$f":"'6'!AP11","v":0},{"$f":"'6'!AQ11","v":0},{"$f":"'6'!AR11","v":0},{"$f":"'6'!AS11","v":0},{"$f":"'6'!AT11","v":0},{"$f":"SUMPRODUCT(IF($N497=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N497=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B12","v":"6"},{"$f":"'6'!C12","v":"6.1"},{"$f":"'6'!D12","v":"6.1.1"},{"$f":"'6'!E12","v":0},{"$f":"'6'!F12","v":"6.1.1.4"},{"$f":"'6'!G12","v":0},{"$f":"'6'!H12","v":0},{"$f":"'6'!I12","v":"6.1.1.4.2"},{"$f":"'6'!J12","v":"6.1.1.4.2: Are customers given advance notice of any changes to the T&Cs or fee schedules before these changes take effect, with an appropriate notice period?\n"},{"$f":"'6'!K12","v":0},{"$f":"'6'!L12","v":0},{"$f":"'6'!M12","v":"Recommended"},{"$f":"'6'!N12","v":"Recommended"},{"$f":"'6'!O12","v":"BizOps"},{"$f":"'6'!P12","v":0},{"$f":"'6'!Q12","v":0},{"$f":"'6'!R12","v":0},{"$f":"'6'!S12","v":0},{"$f":"'6'!T12","v":0},{"$f":"'6'!U12","v":0},{"$f":"'6'!V12","v":0},{"$f":"'6'!W12","v":0},{"$f":"'6'!X12","v":0},{"$f":"'6'!Y12","v":0},{"$f":"'6'!Z12","v":0},{"$f":"'6'!AA12","v":0},{"$f":"'6'!AB12","v":0},{"$f":"'6'!AC12","v":0},{"$f":"'6'!AD12","v":0},{"$f":"'6'!AE12","v":0},{"$f":"'6'!AF12","v":0},{"$f":"'6'!AG12","v":0},{"$f":"'6'!AH12","v":0},{"$f":"'6'!AI12","v":0},{"$f":"'6'!AJ12","v":0},{"$f":"'6'!AK12","v":0},{"$f":"'6'!AL12","v":0},{"$f":"'6'!AM12","v":0},{"$f":"'6'!AN12","v":0},{"$f":"'6'!AO12","v":0},{"$f":"'6'!AP12","v":0},{"$f":"'6'!AQ12","v":0},{"$f":"'6'!AR12","v":0},{"$f":"'6'!AS12","v":0},{"$f":"'6'!AT12","v":0},{"$f":"SUMPRODUCT(IF($N498=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N498=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B13","v":"6"},{"$f":"'6'!C13","v":"6.1"},{"$f":"'6'!D13","v":"6.1.1"},{"$f":"'6'!E13","v":0},{"$f":"'6'!F13","v":"6.1.1.4"},{"$f":"'6'!G13","v":0},{"$f":"'6'!H13","v":0},{"$f":"'6'!I13","v":"6.1.1.4.3"},{"$f":"'6'!J13","v":"6.1.1.4.3: Are major changes to fees and/or T&Cs also advertised through methods such as posters and/or media campaigns?\n"},{"$f":"'6'!K13","v":0},{"$f":"'6'!L13","v":0},{"$f":"'6'!M13","v":"Recommended"},{"$f":"'6'!N13","v":"Recommended"},{"$f":"'6'!O13","v":"BizOps"},{"$f":"'6'!P13","v":0},{"$f":"'6'!Q13","v":0},{"$f":"'6'!R13","v":0},{"$f":"'6'!S13","v":0},{"$f":"'6'!T13","v":0},{"$f":"'6'!U13","v":0},{"$f":"'6'!V13","v":0},{"$f":"'6'!W13","v":0},{"$f":"'6'!X13","v":0},{"$f":"'6'!Y13","v":0},{"$f":"'6'!Z13","v":0},{"$f":"'6'!AA13","v":0},{"$f":"'6'!AB13","v":0},{"$f":"'6'!AC13","v":0},{"$f":"'6'!AD13","v":0},{"$f":"'6'!AE13","v":0},{"$f":"'6'!AF13","v":0},{"$f":"'6'!AG13","v":0},{"$f":"'6'!AH13","v":0},{"$f":"'6'!AI13","v":0},{"$f":"'6'!AJ13","v":0},{"$f":"'6'!AK13","v":0},{"$f":"'6'!AL13","v":0},{"$f":"'6'!AM13","v":0},{"$f":"'6'!AN13","v":0},{"$f":"'6'!AO13","v":0},{"$f":"'6'!AP13","v":0},{"$f":"'6'!AQ13","v":0},{"$f":"'6'!AR13","v":0},{"$f":"'6'!AS13","v":0},{"$f":"'6'!AT13","v":0},{"$f":"SUMPRODUCT(IF($N499=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N499=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B14","v":"6"},{"$f":"'6'!C14","v":"6.1"},{"$f":"'6'!D14","v":"6.1.1"},{"$f":"'6'!E14","v":0},{"$f":"'6'!F14","v":"6.1.1.4"},{"$f":"'6'!G14","v":0},{"$f":"'6'!H14","v":0},{"$f":"'6'!I14","v":"6.1.1.4.4"},{"$f":"'6'!J14","v":"6.1.1.4.4: Are internal processes in place to ensure that updated T&C or fee schedule materials have been developed and disseminated prior to the implementation of the new T&Cs or fee schedules?\n"},{"$f":"'6'!K14","v":0},{"$f":"'6'!L14","v":0},{"$f":"'6'!M14","v":"Recommended"},{"$f":"'6'!N14","v":"Recommended"},{"$f":"'6'!O14","v":"BizOps"},{"$f":"'6'!P14","v":0},{"$f":"'6'!Q14","v":0},{"$f":"'6'!R14","v":0},{"$f":"'6'!S14","v":0},{"$f":"'6'!T14","v":0},{"$f":"'6'!U14","v":0},{"$f":"'6'!V14","v":0},{"$f":"'6'!W14","v":0},{"$f":"'6'!X14","v":0},{"$f":"'6'!Y14","v":0},{"$f":"'6'!Z14","v":0},{"$f":"'6'!AA14","v":0},{"$f":"'6'!AB14","v":0},{"$f":"'6'!AC14","v":0},{"$f":"'6'!AD14","v":0},{"$f":"'6'!AE14","v":0},{"$f":"'6'!AF14","v":0},{"$f":"'6'!AG14","v":0},{"$f":"'6'!AH14","v":0},{"$f":"'6'!AI14","v":0},{"$f":"'6'!AJ14","v":0},{"$f":"'6'!AK14","v":0},{"$f":"'6'!AL14","v":0},{"$f":"'6'!AM14","v":0},{"$f":"'6'!AN14","v":0},{"$f":"'6'!AO14","v":0},{"$f":"'6'!AP14","v":0},{"$f":"'6'!AQ14","v":0},{"$f":"'6'!AR14","v":0},{"$f":"'6'!AS14","v":0},{"$f":"'6'!AT14","v":0},{"$f":"SUMPRODUCT(IF($N500=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N500=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B15","v":"6"},{"$f":"'6'!C15","v":"6.1"},{"$f":"'6'!D15","v":"6.1.1"},{"$f":"'6'!E15","v":0},{"$f":"'6'!F15","v":"6.1.1.5"},{"$f":"'6'!G15","v":"6.1.1.5: USE OFFICIAL AND LOCAL LANGUAGES\nWhere feasible, information for customers should be available in the official language(s) and/or other commonly spoken languages (including regional languages). All channels through which information is made available (leaflets, posters, media campaigns, handset menus, etc.) should support the customer's language preferences. \n\nNOTE:  It may not be feasible or commercially sustainable to provide information in the official language(s) and/or other commonly spoken languages. Where feasible and commercially sustainable, however, providers should make a reasonable effort to communicate in languages that can be comprehended by people from different regions and with varying levels of education."},{"$f":"'6'!H15","v":0},{"$f":"'6'!I15","v":"6.1.1.5.1"},{"$f":"'6'!J15","v":"6.1.1.5.1: Are fees, T&Cs, FAQs, contact information for customer support, media campaigns, and other relevant information communicated in languages that can be comprehended by people from different regions and with varying levels of education?\n"},{"$f":"'6'!K15","v":0},{"$f":"'6'!L15","v":0},{"$f":"'6'!M15","v":"Recommended"},{"$f":"'6'!N15","v":"Recommended"},{"$f":"'6'!O15","v":"BizOps"},{"$f":"'6'!P15","v":0},{"$f":"'6'!Q15","v":0},{"$f":"'6'!R15","v":0},{"$f":"'6'!S15","v":0},{"$f":"'6'!T15","v":0},{"$f":"'6'!U15","v":0},{"$f":"'6'!V15","v":0},{"$f":"'6'!W15","v":0},{"$f":"'6'!X15","v":0},{"$f":"'6'!Y15","v":0},{"$f":"'6'!Z15","v":0},{"$f":"'6'!AA15","v":0},{"$f":"'6'!AB15","v":0},{"$f":"'6'!AC15","v":0},{"$f":"'6'!AD15","v":0},{"$f":"'6'!AE15","v":0},{"$f":"'6'!AF15","v":0},{"$f":"'6'!AG15","v":0},{"$f":"'6'!AH15","v":0},{"$f":"'6'!AI15","v":0},{"$f":"'6'!AJ15","v":0},{"$f":"'6'!AK15","v":0},{"$f":"'6'!AL15","v":0},{"$f":"'6'!AM15","v":0},{"$f":"'6'!AN15","v":0},{"$f":"'6'!AO15","v":0},{"$f":"'6'!AP15","v":0},{"$f":"'6'!AQ15","v":0},{"$f":"'6'!AR15","v":0},{"$f":"'6'!AS15","v":0},{"$f":"'6'!AT15","v":0},{"$f":"SUMPRODUCT(IF($N501=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N501=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B16","v":"6"},{"$f":"'6'!C16","v":"6.1"},{"$f":"'6'!D16","v":"6.1.1"},{"$f":"'6'!E16","v":0},{"$f":"'6'!F16","v":"6.1.1.6"},{"$f":"'6'!G16","v":"6.1.1.6: INFORM CUSTOMERS OF EXPECTED DOWNTIME AND COMMUNICATE UNEXPECTED OUTAGES\nProviders should inform customers if the mobile money system is experiencing an extended outage or processing delays. \n\nProviders should inform customers of periods of scheduled downtime, particularly for extended outages. Providers should give sufficient notice of scheduled downtime to ensure that customers can plan accordingly.\n\nIn case of a complete outage, users should receive a 'system down' message on their handset and transactions should not accepted. Handset messages should also be used in the case of significant delays. This will help to avoid problems due to a lack of clarity regarding whether a transaction has gone through.\n\nCustomers should be educated on what to do if a transaction confirmation message is not received (for example, the customer could be advised to check their account balance and to contact customer care prior to repeating the transaction).\n"},{"$f":"'6'!H16","v":0},{"$f":"'6'!I16","v":"6.1.1.6.1"},{"$f":"'6'!J16","v":"6.1.1.6.1: Are customers given advance notice of scheduled downtime?\n"},{"$f":"'6'!K16","v":"1)  Customer communication plan / materal\n- Check there is a process for notifying customers of planned system downtime (e.g. MM system messages or other mechanism)\n- Check that the process includes timescales for the customer to be notified with appropriate notice \n"},{"$f":"'6'!L16","v":0},{"$f":"'6'!M16","v":"Standard Required"},{"$f":"'6'!N16","v":"Required"},{"$f":"'6'!O16","v":"BizOps"},{"$f":"'6'!P16","v":0},{"$f":"'6'!Q16","v":0},{"$f":"'6'!R16","v":0},{"$f":"'6'!S16","v":0},{"$f":"'6'!T16","v":0},{"$f":"'6'!U16","v":0},{"$f":"'6'!V16","v":0},{"$f":"'6'!W16","v":0},{"$f":"'6'!X16","v":0},{"$f":"'6'!Y16","v":0},{"$f":"'6'!Z16","v":0},{"$f":"'6'!AA16","v":0},{"$f":"'6'!AB16","v":0},{"$f":"'6'!AC16","v":0},{"$f":"'6'!AD16","v":0},{"$f":"'6'!AE16","v":0},{"$f":"'6'!AF16","v":0},{"$f":"'6'!AG16","v":0},{"$f":"'6'!AH16","v":0},{"$f":"'6'!AI16","v":0},{"$f":"'6'!AJ16","v":0},{"$f":"'6'!AK16","v":0},{"$f":"'6'!AL16","v":0},{"$f":"'6'!AM16","v":0},{"$f":"'6'!AN16","v":0},{"$f":"'6'!AO16","v":0},{"$f":"'6'!AP16","v":0},{"$f":"'6'!AQ16","v":0},{"$f":"'6'!AR16","v":0},{"$f":"'6'!AS16","v":0},{"$f":"'6'!AT16","v":0},{"$f":"SUMPRODUCT(IF($N502=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N502=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B17","v":"6"},{"$f":"'6'!C17","v":"6.1"},{"$f":"'6'!D17","v":"6.1.1"},{"$f":"'6'!E17","v":0},{"$f":"'6'!F17","v":"6.1.1.6"},{"$f":"'6'!G17","v":0},{"$f":"'6'!H17","v":0},{"$f":"'6'!I17","v":"6.1.1.6.2"},{"$f":"'6'!J17","v":"6.1.1.6.2: In the event of an extended unexpected system outage, do users receive a 'system down' message via the handset?\n"},{"$f":"'6'!K17","v":0},{"$f":"'6'!L17","v":0},{"$f":"'6'!M17","v":"Recommended"},{"$f":"'6'!N17","v":"Recommended"},{"$f":"'6'!O17","v":"BizOps"},{"$f":"'6'!P17","v":0},{"$f":"'6'!Q17","v":0},{"$f":"'6'!R17","v":0},{"$f":"'6'!S17","v":0},{"$f":"'6'!T17","v":0},{"$f":"'6'!U17","v":0},{"$f":"'6'!V17","v":0},{"$f":"'6'!W17","v":0},{"$f":"'6'!X17","v":0},{"$f":"'6'!Y17","v":0},{"$f":"'6'!Z17","v":0},{"$f":"'6'!AA17","v":0},{"$f":"'6'!AB17","v":0},{"$f":"'6'!AC17","v":0},{"$f":"'6'!AD17","v":0},{"$f":"'6'!AE17","v":0},{"$f":"'6'!AF17","v":0},{"$f":"'6'!AG17","v":0},{"$f":"'6'!AH17","v":0},{"$f":"'6'!AI17","v":0},{"$f":"'6'!AJ17","v":0},{"$f":"'6'!AK17","v":0},{"$f":"'6'!AL17","v":0},{"$f":"'6'!AM17","v":0},{"$f":"'6'!AN17","v":0},{"$f":"'6'!AO17","v":0},{"$f":"'6'!AP17","v":0},{"$f":"'6'!AQ17","v":0},{"$f":"'6'!AR17","v":0},{"$f":"'6'!AS17","v":0},{"$f":"'6'!AT17","v":0},{"$f":"SUMPRODUCT(IF($N503=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N503=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B18","v":"6"},{"$f":"'6'!C18","v":"6.1"},{"$f":"'6'!D18","v":"6.1.1"},{"$f":"'6'!E18","v":0},{"$f":"'6'!F18","v":"6.1.1.6"},{"$f":"'6'!G18","v":0},{"$f":"'6'!H18","v":0},{"$f":"'6'!I18","v":"6.1.1.6.3"},{"$f":"'6'!J18","v":"6.1.1.6.3: Are customers told what to do if a transaction confirmation is not received, such as check their account balance and contact customer care prior to repeating the transaction?\n"},{"$f":"'6'!K18","v":0},{"$f":"'6'!L18","v":0},{"$f":"'6'!M18","v":"Recommended"},{"$f":"'6'!N18","v":"Recommended"},{"$f":"'6'!O18","v":"BizOps"},{"$f":"'6'!P18","v":0},{"$f":"'6'!Q18","v":0},{"$f":"'6'!R18","v":0},{"$f":"'6'!S18","v":0},{"$f":"'6'!T18","v":0},{"$f":"'6'!U18","v":0},{"$f":"'6'!V18","v":0},{"$f":"'6'!W18","v":0},{"$f":"'6'!X18","v":0},{"$f":"'6'!Y18","v":0},{"$f":"'6'!Z18","v":0},{"$f":"'6'!AA18","v":0},{"$f":"'6'!AB18","v":0},{"$f":"'6'!AC18","v":0},{"$f":"'6'!AD18","v":0},{"$f":"'6'!AE18","v":0},{"$f":"'6'!AF18","v":0},{"$f":"'6'!AG18","v":0},{"$f":"'6'!AH18","v":0},{"$f":"'6'!AI18","v":0},{"$f":"'6'!AJ18","v":0},{"$f":"'6'!AK18","v":0},{"$f":"'6'!AL18","v":0},{"$f":"'6'!AM18","v":0},{"$f":"'6'!AN18","v":0},{"$f":"'6'!AO18","v":0},{"$f":"'6'!AP18","v":0},{"$f":"'6'!AQ18","v":0},{"$f":"'6'!AR18","v":0},{"$f":"'6'!AS18","v":0},{"$f":"'6'!AT18","v":0},{"$f":"SUMPRODUCT(IF($N504=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N504=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B19","v":"6"},{"$f":"'6'!C19","v":"6.1"},{"$f":"'6'!D19","v":"6.1.1"},{"$f":"'6'!E19","v":0},{"$f":"'6'!F19","v":"6.1.1.7"},{"$f":"'6'!G19","v":"6.1.1.7: TRAIN CUSTOMER SERVICE PERSONNEL IN TERMS & CONDITIONS AND THE FEE SCHEDULE\nProviders should ensure that first-level customer service personnel have sufficient access to T&Cs and fee schedules and are trained to provide the information accurately and efficiently to customers.\n\nProviders should ensure that customer service personnel are properly trained to understand changes to T&Cs or fee schedules and the potential impacts of these changes. This training should be completed before any changes are made."},{"$f":"'6'!H19","v":0},{"$f":"'6'!I19","v":"6.1.1.7.1"},{"$f":"'6'!J19","v":"6.1.1.7.1: Do customer service personnel have access to information so that they can provide customers with accurate information on T&Cs and the full set of fees?\n"},{"$f":"'6'!K19","v":"1) Training plan / material for customer service staff, or customer service process documentation\n- Check that customer care are provided with information on T&Cs and the full set of fees.\n"},{"$f":"'6'!L19","v":0},{"$f":"'6'!M19","v":"Standard Required"},{"$f":"'6'!N19","v":"Required"},{"$f":"'6'!O19","v":"CustServ"},{"$f":"'6'!P19","v":0},{"$f":"'6'!Q19","v":0},{"$f":"'6'!R19","v":0},{"$f":"'6'!S19","v":0},{"$f":"'6'!T19","v":0},{"$f":"'6'!U19","v":0},{"$f":"'6'!V19","v":0},{"$f":"'6'!W19","v":0},{"$f":"'6'!X19","v":0},{"$f":"'6'!Y19","v":0},{"$f":"'6'!Z19","v":0},{"$f":"'6'!AA19","v":0},{"$f":"'6'!AB19","v":0},{"$f":"'6'!AC19","v":0},{"$f":"'6'!AD19","v":0},{"$f":"'6'!AE19","v":0},{"$f":"'6'!AF19","v":0},{"$f":"'6'!AG19","v":0},{"$f":"'6'!AH19","v":0},{"$f":"'6'!AI19","v":0},{"$f":"'6'!AJ19","v":0},{"$f":"'6'!AK19","v":0},{"$f":"'6'!AL19","v":0},{"$f":"'6'!AM19","v":0},{"$f":"'6'!AN19","v":0},{"$f":"'6'!AO19","v":0},{"$f":"'6'!AP19","v":0},{"$f":"'6'!AQ19","v":0},{"$f":"'6'!AR19","v":0},{"$f":"'6'!AS19","v":0},{"$f":"'6'!AT19","v":0},{"$f":"SUMPRODUCT(IF($N505=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N505=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B20","v":"6"},{"$f":"'6'!C20","v":"6.1"},{"$f":"'6'!D20","v":"6.1.1"},{"$f":"'6'!E20","v":0},{"$f":"'6'!F20","v":"6.1.1.7"},{"$f":"'6'!G20","v":0},{"$f":"'6'!H20","v":0},{"$f":"'6'!I20","v":"6.1.1.7.2"},{"$f":"'6'!J20","v":"6.1.1.7.2: When changes are made to to T&Cs or fee schedules, are customer service personnel briefed to understand the impact of these changes before the changes are made?\n"},{"$f":"'6'!K20","v":"1) Training plan / material for customer service staff, or customer service process documentation\n- Check that when changes are made to T&Cs / fees, the process requires a briefing to be given to customer care personnel prior to any changes being made."},{"$f":"'6'!L20","v":0},{"$f":"'6'!M20","v":"Standard Required"},{"$f":"'6'!N20","v":"Required"},{"$f":"'6'!O20","v":"CustServ"},{"$f":"'6'!P20","v":0},{"$f":"'6'!Q20","v":0},{"$f":"'6'!R20","v":0},{"$f":"'6'!S20","v":0},{"$f":"'6'!T20","v":0},{"$f":"'6'!U20","v":0},{"$f":"'6'!V20","v":0},{"$f":"'6'!W20","v":0},{"$f":"'6'!X20","v":0},{"$f":"'6'!Y20","v":0},{"$f":"'6'!Z20","v":0},{"$f":"'6'!AA20","v":0},{"$f":"'6'!AB20","v":0},{"$f":"'6'!AC20","v":0},{"$f":"'6'!AD20","v":0},{"$f":"'6'!AE20","v":0},{"$f":"'6'!AF20","v":0},{"$f":"'6'!AG20","v":0},{"$f":"'6'!AH20","v":0},{"$f":"'6'!AI20","v":0},{"$f":"'6'!AJ20","v":0},{"$f":"'6'!AK20","v":0},{"$f":"'6'!AL20","v":0},{"$f":"'6'!AM20","v":0},{"$f":"'6'!AN20","v":0},{"$f":"'6'!AO20","v":0},{"$f":"'6'!AP20","v":0},{"$f":"'6'!AQ20","v":0},{"$f":"'6'!AR20","v":0},{"$f":"'6'!AS20","v":0},{"$f":"'6'!AT20","v":0},{"$f":"SUMPRODUCT(IF($N506=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N506=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B21","v":"6"},{"$f":"'6'!C21","v":"6.1"},{"$f":"'6'!D21","v":"6.1.1"},{"$f":"'6'!E21","v":0},{"$f":"'6'!F21","v":"6.1.1.8"},{"$f":"'6'!G21","v":"6.1.1.8: INFORM CUSTOMERS OF KYC REQUIREMENTS FOR OPENING ACCOUNTS IN DIFFERENT KYC TIERS\nProviders should ensure that customers are made aware of all KYC requirements for opening an account, and where relevant, the KYC requirements for different KYC tiers. These requirements should be included in the T&Cs or be available on request from agents or customer care.\n\nAccount transaction / balance limits for each KYC tier should be made explicit in the T&Cs. If additional KYC verification must be carried out by the provider then this should be explained, especially if the customer's ability to use the service is limited until the KYC verification is completed."},{"$f":"'6'!H21","v":0},{"$f":"'6'!I21","v":"6.1.1.8.1"},{"$f":"'6'!J21","v":"6.1.1.8.1: Are the KYC requirements for opening an account and for different KYC tiers made clear to customers, and particularly at the point of registration?\n"},{"$f":"'6'!K21","v":"1) Point of sale (agent) material / customer T&Cs / customer service training material / customer communication material\n- Check that registering agents have material to give customers full information on the KYC requirements for opening an account.\n- Check the material includes the KYC requirements for opening an account/different KYC tiers.\n"},{"$f":"'6'!L21","v":0},{"$f":"'6'!M21","v":"Urgent Required"},{"$f":"'6'!N21","v":"Required"},{"$f":"'6'!O21","v":"BizOps"},{"$f":"'6'!P21","v":0},{"$f":"'6'!Q21","v":0},{"$f":"'6'!R21","v":0},{"$f":"'6'!S21","v":0},{"$f":"'6'!T21","v":0},{"$f":"'6'!U21","v":0},{"$f":"'6'!V21","v":0},{"$f":"'6'!W21","v":0},{"$f":"'6'!X21","v":0},{"$f":"'6'!Y21","v":0},{"$f":"'6'!Z21","v":0},{"$f":"'6'!AA21","v":0},{"$f":"'6'!AB21","v":0},{"$f":"'6'!AC21","v":0},{"$f":"'6'!AD21","v":0},{"$f":"'6'!AE21","v":0},{"$f":"'6'!AF21","v":0},{"$f":"'6'!AG21","v":0},{"$f":"'6'!AH21","v":0},{"$f":"'6'!AI21","v":0},{"$f":"'6'!AJ21","v":0},{"$f":"'6'!AK21","v":0},{"$f":"'6'!AL21","v":0},{"$f":"'6'!AM21","v":0},{"$f":"'6'!AN21","v":0},{"$f":"'6'!AO21","v":0},{"$f":"'6'!AP21","v":0},{"$f":"'6'!AQ21","v":0},{"$f":"'6'!AR21","v":0},{"$f":"'6'!AS21","v":0},{"$f":"'6'!AT21","v":0},{"$f":"SUMPRODUCT(IF($N507=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N507=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B22","v":"6"},{"$f":"'6'!C22","v":"6.1"},{"$f":"'6'!D22","v":"6.1.1"},{"$f":"'6'!E22","v":0},{"$f":"'6'!F22","v":"6.1.1.9"},{"$f":"'6'!G22","v":"6.1.1.9: HELP CUSTOMERS TO LOCATE AGENTS, SERVICE CENTRES, AND OTHER RETAIL LOCATIONS\nProviders should provide tools to help customers locate agents, service centres, and other retail locations. These tools should be tailored to the needs of the target market.\n\nSuitable resources may include posters, customer care personnel and/or handset menus."},{"$f":"'6'!H22","v":0},{"$f":"'6'!I22","v":"6.1.1.9.1"},{"$f":"'6'!J22","v":"6.1.1.9.1: Are customers provided with tools to locate agents, service centres, and other retail locations (e.g. posters, customer care personnel and/or handset menus)?\n"},{"$f":"'6'!K22","v":0},{"$f":"'6'!L22","v":0},{"$f":"'6'!M22","v":"Recommended"},{"$f":"'6'!N22","v":"Recommended"},{"$f":"'6'!O22","v":"BizOps"},{"$f":"'6'!P22","v":0},{"$f":"'6'!Q22","v":0},{"$f":"'6'!R22","v":0},{"$f":"'6'!S22","v":0},{"$f":"'6'!T22","v":0},{"$f":"'6'!U22","v":0},{"$f":"'6'!V22","v":0},{"$f":"'6'!W22","v":0},{"$f":"'6'!X22","v":0},{"$f":"'6'!Y22","v":0},{"$f":"'6'!Z22","v":0},{"$f":"'6'!AA22","v":0},{"$f":"'6'!AB22","v":0},{"$f":"'6'!AC22","v":0},{"$f":"'6'!AD22","v":0},{"$f":"'6'!AE22","v":0},{"$f":"'6'!AF22","v":0},{"$f":"'6'!AG22","v":0},{"$f":"'6'!AH22","v":0},{"$f":"'6'!AI22","v":0},{"$f":"'6'!AJ22","v":0},{"$f":"'6'!AK22","v":0},{"$f":"'6'!AL22","v":0},{"$f":"'6'!AM22","v":0},{"$f":"'6'!AN22","v":0},{"$f":"'6'!AO22","v":0},{"$f":"'6'!AP22","v":0},{"$f":"'6'!AQ22","v":0},{"$f":"'6'!AR22","v":0},{"$f":"'6'!AS22","v":0},{"$f":"'6'!AT22","v":0},{"$f":"SUMPRODUCT(IF($N508=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N508=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B24","v":"6"},{"$f":"'6'!C24","v":"6.2"},{"$f":"'6'!D24","v":"6.2.1"},{"$f":"'6'!E24","v":"6.2.1: Providers shall educate customers about how to use mobile money services safely and securely"},{"$f":"'6'!F24","v":"6.2.1.1"},{"$f":"'6'!G24","v":"6.2.1.1: EDUCATE CUSTOMERS ON HOW TO USE THE SERVICE SECURELY\nProviders should educate customers on how to use the mobile money service securely. Additional guidance may be required for customers who are not familiar with financial services. Guidance should include at least the following advice:\n- Lock phones with a code and do not leave phones unattended or accessible by other people;\n- Choose security credentials (PIN, password and/or any other credentials) that are difficult to guess;\n- Do not share security credentials with anyone, including customer care agents and mobile money agents;\n- Do not store security credentials in a manner that would allow them to easily be read by another person (e.g., taped to phone, on home screen, etc.); \n- Change security credentials if they may have compromised; and\n- Be aware of the risks of social engineering, such as phishing.\n\nProviders should inform customers that it is their responsibility to safeguard access to their account. Providers should also inform customers of any liability that they may assume for losses resulting from their failure to protect their security credentials and/or safeguard access to their accounts.\n\nPossible delivery channels include electronic content included in welcome messages, verbal explanations from agents or staff during account opening, physical documentation (e.g., brochures), and in the T&Cs."},{"$f":"'6'!H24","v":0},{"$f":"'6'!I24","v":"6.2.1.1.1"},{"$f":"'6'!J24","v":"6.2.1.1.1: Are customers advised not to share security credentials (PIN) with anyone, including customer care agents and mobile money agents?\n"},{"$f":"'6'!K24","v":"1) Customer communication plan / material\n- Check there is an awareness program for customers informing them not to share security credentials i.e. PIN\n- Check the program includes reference to not sharing PINs with customer care staff and agents."},{"$f":"'6'!L24","v":0},{"$f":"'6'!M24","v":"Standard Required"},{"$f":"'6'!N24","v":"Required"},{"$f":"'6'!O24","v":"BizOps"},{"$f":"'6'!P24","v":0},{"$f":"'6'!Q24","v":0},{"$f":"'6'!R24","v":0},{"$f":"'6'!S24","v":0},{"$f":"'6'!T24","v":0},{"$f":"'6'!U24","v":0},{"$f":"'6'!V24","v":0},{"$f":"'6'!W24","v":0},{"$f":"'6'!X24","v":0},{"$f":"'6'!Y24","v":0},{"$f":"'6'!Z24","v":0},{"$f":"'6'!AA24","v":0},{"$f":"'6'!AB24","v":0},{"$f":"'6'!AC24","v":0},{"$f":"'6'!AD24","v":0},{"$f":"'6'!AE24","v":0},{"$f":"'6'!AF24","v":0},{"$f":"'6'!AG24","v":0},{"$f":"'6'!AH24","v":0},{"$f":"'6'!AI24","v":0},{"$f":"'6'!AJ24","v":0},{"$f":"'6'!AK24","v":0},{"$f":"'6'!AL24","v":0},{"$f":"'6'!AM24","v":0},{"$f":"'6'!AN24","v":0},{"$f":"'6'!AO24","v":0},{"$f":"'6'!AP24","v":0},{"$f":"'6'!AQ24","v":0},{"$f":"'6'!AR24","v":0},{"$f":"'6'!AS24","v":0},{"$f":"'6'!AT24","v":0},{"$f":"SUMPRODUCT(IF($N509=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N509=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B25","v":"6"},{"$f":"'6'!C25","v":"6.2"},{"$f":"'6'!D25","v":"6.2.1"},{"$f":"'6'!E25","v":0},{"$f":"'6'!F25","v":"6.2.1.1"},{"$f":"'6'!G25","v":0},{"$f":"'6'!H25","v":0},{"$f":"'6'!I25","v":"6.2.1.1.2"},{"$f":"'6'!J25","v":"6.2.1.1.2: Are customers advised not to store security credentials (PIN) in a manner that would allow them to easily be read by another person (e.g. taped to phone, on home screen, etc.)?\n"},{"$f":"'6'!K25","v":"1) Customer communication plan / material\n- Check there is an awareness program for customers informing them not to write/store security credentials  (i.e. PIN) in a way that can be easily read by another person."},{"$f":"'6'!L25","v":0},{"$f":"'6'!M25","v":"Standard Required"},{"$f":"'6'!N25","v":"Required"},{"$f":"'6'!O25","v":"BizOps"},{"$f":"'6'!P25","v":0},{"$f":"'6'!Q25","v":0},{"$f":"'6'!R25","v":0},{"$f":"'6'!S25","v":0},{"$f":"'6'!T25","v":0},{"$f":"'6'!U25","v":0},{"$f":"'6'!V25","v":0},{"$f":"'6'!W25","v":0},{"$f":"'6'!X25","v":0},{"$f":"'6'!Y25","v":0},{"$f":"'6'!Z25","v":0},{"$f":"'6'!AA25","v":0},{"$f":"'6'!AB25","v":0},{"$f":"'6'!AC25","v":0},{"$f":"'6'!AD25","v":0},{"$f":"'6'!AE25","v":0},{"$f":"'6'!AF25","v":0},{"$f":"'6'!AG25","v":0},{"$f":"'6'!AH25","v":0},{"$f":"'6'!AI25","v":0},{"$f":"'6'!AJ25","v":0},{"$f":"'6'!AK25","v":0},{"$f":"'6'!AL25","v":0},{"$f":"'6'!AM25","v":0},{"$f":"'6'!AN25","v":0},{"$f":"'6'!AO25","v":0},{"$f":"'6'!AP25","v":0},{"$f":"'6'!AQ25","v":0},{"$f":"'6'!AR25","v":0},{"$f":"'6'!AS25","v":0},{"$f":"'6'!AT25","v":0},{"$f":"SUMPRODUCT(IF($N510=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N510=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B26","v":"6"},{"$f":"'6'!C26","v":"6.2"},{"$f":"'6'!D26","v":"6.2.1"},{"$f":"'6'!E26","v":0},{"$f":"'6'!F26","v":"6.2.1.1"},{"$f":"'6'!G26","v":0},{"$f":"'6'!H26","v":0},{"$f":"'6'!I26","v":"6.2.1.1.3"},{"$f":"'6'!J26","v":"6.2.1.1.3: Are customers advised to change security credentials (PIN) if they may be compromised?\n"},{"$f":"'6'!K26","v":"1) Customer communication plan / material\n- Check there is an awareness program for customers informing them change security credentials (i.e. PIN) if they think they have been compromised."},{"$f":"'6'!L26","v":0},{"$f":"'6'!M26","v":"Standard Required"},{"$f":"'6'!N26","v":"Required"},{"$f":"'6'!O26","v":"BizOps"},{"$f":"'6'!P26","v":0},{"$f":"'6'!Q26","v":0},{"$f":"'6'!R26","v":0},{"$f":"'6'!S26","v":0},{"$f":"'6'!T26","v":0},{"$f":"'6'!U26","v":0},{"$f":"'6'!V26","v":0},{"$f":"'6'!W26","v":0},{"$f":"'6'!X26","v":0},{"$f":"'6'!Y26","v":0},{"$f":"'6'!Z26","v":0},{"$f":"'6'!AA26","v":0},{"$f":"'6'!AB26","v":0},{"$f":"'6'!AC26","v":0},{"$f":"'6'!AD26","v":0},{"$f":"'6'!AE26","v":0},{"$f":"'6'!AF26","v":0},{"$f":"'6'!AG26","v":0},{"$f":"'6'!AH26","v":0},{"$f":"'6'!AI26","v":0},{"$f":"'6'!AJ26","v":0},{"$f":"'6'!AK26","v":0},{"$f":"'6'!AL26","v":0},{"$f":"'6'!AM26","v":0},{"$f":"'6'!AN26","v":0},{"$f":"'6'!AO26","v":0},{"$f":"'6'!AP26","v":0},{"$f":"'6'!AQ26","v":0},{"$f":"'6'!AR26","v":0},{"$f":"'6'!AS26","v":0},{"$f":"'6'!AT26","v":0},{"$f":"SUMPRODUCT(IF($N511=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N511=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B27","v":"6"},{"$f":"'6'!C27","v":"6.2"},{"$f":"'6'!D27","v":"6.2.1"},{"$f":"'6'!E27","v":0},{"$f":"'6'!F27","v":"6.2.1.1"},{"$f":"'6'!G27","v":0},{"$f":"'6'!H27","v":0},{"$f":"'6'!I27","v":"6.2.1.1.4"},{"$f":"'6'!J27","v":"6.2.1.1.4: Have customers been informed of any liability that they may assume for losses resulting from their failure to protect their security credentials and/or safeguard access to their accounts.\n"},{"$f":"'6'!K27","v":"1) Customer communication plan / material \n- Check there are communication materials (or clause in the T&Cs) to tell customers that they could lose money if their PIN is not protected."},{"$f":"'6'!L27","v":0},{"$f":"'6'!M27","v":"Standard Required"},{"$f":"'6'!N27","v":"Required"},{"$f":"'6'!O27","v":"BizOps"},{"$f":"'6'!P27","v":0},{"$f":"'6'!Q27","v":0},{"$f":"'6'!R27","v":0},{"$f":"'6'!S27","v":0},{"$f":"'6'!T27","v":0},{"$f":"'6'!U27","v":0},{"$f":"'6'!V27","v":0},{"$f":"'6'!W27","v":0},{"$f":"'6'!X27","v":0},{"$f":"'6'!Y27","v":0},{"$f":"'6'!Z27","v":0},{"$f":"'6'!AA27","v":0},{"$f":"'6'!AB27","v":0},{"$f":"'6'!AC27","v":0},{"$f":"'6'!AD27","v":0},{"$f":"'6'!AE27","v":0},{"$f":"'6'!AF27","v":0},{"$f":"'6'!AG27","v":0},{"$f":"'6'!AH27","v":0},{"$f":"'6'!AI27","v":0},{"$f":"'6'!AJ27","v":0},{"$f":"'6'!AK27","v":0},{"$f":"'6'!AL27","v":0},{"$f":"'6'!AM27","v":0},{"$f":"'6'!AN27","v":0},{"$f":"'6'!AO27","v":0},{"$f":"'6'!AP27","v":0},{"$f":"'6'!AQ27","v":0},{"$f":"'6'!AR27","v":0},{"$f":"'6'!AS27","v":0},{"$f":"'6'!AT27","v":0},{"$f":"SUMPRODUCT(IF($N512=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N512=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B28","v":"6"},{"$f":"'6'!C28","v":"6.2"},{"$f":"'6'!D28","v":"6.2.1"},{"$f":"'6'!E28","v":0},{"$f":"'6'!F28","v":"6.2.1.1"},{"$f":"'6'!G28","v":0},{"$f":"'6'!H28","v":0},{"$f":"'6'!I28","v":"6.2.1.1.5"},{"$f":"'6'!J28","v":"6.2.1.1.5: Are customers advised to lock their phones with a code and not to leave their phone unattended or accessible by other people?\n"},{"$f":"'6'!K28","v":0},{"$f":"'6'!L28","v":0},{"$f":"'6'!M28","v":"Recommended"},{"$f":"'6'!N28","v":"Recommended"},{"$f":"'6'!O28","v":"BizOps"},{"$f":"'6'!P28","v":0},{"$f":"'6'!Q28","v":0},{"$f":"'6'!R28","v":0},{"$f":"'6'!S28","v":0},{"$f":"'6'!T28","v":0},{"$f":"'6'!U28","v":0},{"$f":"'6'!V28","v":0},{"$f":"'6'!W28","v":0},{"$f":"'6'!X28","v":0},{"$f":"'6'!Y28","v":0},{"$f":"'6'!Z28","v":0},{"$f":"'6'!AA28","v":0},{"$f":"'6'!AB28","v":0},{"$f":"'6'!AC28","v":0},{"$f":"'6'!AD28","v":0},{"$f":"'6'!AE28","v":0},{"$f":"'6'!AF28","v":0},{"$f":"'6'!AG28","v":0},{"$f":"'6'!AH28","v":0},{"$f":"'6'!AI28","v":0},{"$f":"'6'!AJ28","v":0},{"$f":"'6'!AK28","v":0},{"$f":"'6'!AL28","v":0},{"$f":"'6'!AM28","v":0},{"$f":"'6'!AN28","v":0},{"$f":"'6'!AO28","v":0},{"$f":"'6'!AP28","v":0},{"$f":"'6'!AQ28","v":0},{"$f":"'6'!AR28","v":0},{"$f":"'6'!AS28","v":0},{"$f":"'6'!AT28","v":0},{"$f":"SUMPRODUCT(IF($N513=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N513=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B29","v":"6"},{"$f":"'6'!C29","v":"6.2"},{"$f":"'6'!D29","v":"6.2.1"},{"$f":"'6'!E29","v":0},{"$f":"'6'!F29","v":"6.2.1.1"},{"$f":"'6'!G29","v":0},{"$f":"'6'!H29","v":0},{"$f":"'6'!I29","v":"6.2.1.1.6"},{"$f":"'6'!J29","v":"6.2.1.1.6: Are customers advised to choose security credentials (PIN, password and/or any other credentials) that are difficult to guess?\n"},{"$f":"'6'!K29","v":0},{"$f":"'6'!L29","v":0},{"$f":"'6'!M29","v":"Recommended"},{"$f":"'6'!N29","v":"Recommended"},{"$f":"'6'!O29","v":"BizOps"},{"$f":"'6'!P29","v":0},{"$f":"'6'!Q29","v":0},{"$f":"'6'!R29","v":0},{"$f":"'6'!S29","v":0},{"$f":"'6'!T29","v":0},{"$f":"'6'!U29","v":0},{"$f":"'6'!V29","v":0},{"$f":"'6'!W29","v":0},{"$f":"'6'!X29","v":0},{"$f":"'6'!Y29","v":0},{"$f":"'6'!Z29","v":0},{"$f":"'6'!AA29","v":0},{"$f":"'6'!AB29","v":0},{"$f":"'6'!AC29","v":0},{"$f":"'6'!AD29","v":0},{"$f":"'6'!AE29","v":0},{"$f":"'6'!AF29","v":0},{"$f":"'6'!AG29","v":0},{"$f":"'6'!AH29","v":0},{"$f":"'6'!AI29","v":0},{"$f":"'6'!AJ29","v":0},{"$f":"'6'!AK29","v":0},{"$f":"'6'!AL29","v":0},{"$f":"'6'!AM29","v":0},{"$f":"'6'!AN29","v":0},{"$f":"'6'!AO29","v":0},{"$f":"'6'!AP29","v":0},{"$f":"'6'!AQ29","v":0},{"$f":"'6'!AR29","v":0},{"$f":"'6'!AS29","v":0},{"$f":"'6'!AT29","v":0},{"$f":"SUMPRODUCT(IF($N514=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N514=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B30","v":"6"},{"$f":"'6'!C30","v":"6.2"},{"$f":"'6'!D30","v":"6.2.1"},{"$f":"'6'!E30","v":0},{"$f":"'6'!F30","v":"6.2.1.1"},{"$f":"'6'!G30","v":0},{"$f":"'6'!H30","v":0},{"$f":"'6'!I30","v":"6.2.1.1.7"},{"$f":"'6'!J30","v":"6.2.1.1.7: Are customers advised to be aware of the risks of social engineering, such as phishing?\n"},{"$f":"'6'!K30","v":0},{"$f":"'6'!L30","v":0},{"$f":"'6'!M30","v":"Recommended"},{"$f":"'6'!N30","v":"Recommended"},{"$f":"'6'!O30","v":"BizOps"},{"$f":"'6'!P30","v":0},{"$f":"'6'!Q30","v":0},{"$f":"'6'!R30","v":0},{"$f":"'6'!S30","v":0},{"$f":"'6'!T30","v":0},{"$f":"'6'!U30","v":0},{"$f":"'6'!V30","v":0},{"$f":"'6'!W30","v":0},{"$f":"'6'!X30","v":0},{"$f":"'6'!Y30","v":0},{"$f":"'6'!Z30","v":0},{"$f":"'6'!AA30","v":0},{"$f":"'6'!AB30","v":0},{"$f":"'6'!AC30","v":0},{"$f":"'6'!AD30","v":0},{"$f":"'6'!AE30","v":0},{"$f":"'6'!AF30","v":0},{"$f":"'6'!AG30","v":0},{"$f":"'6'!AH30","v":0},{"$f":"'6'!AI30","v":0},{"$f":"'6'!AJ30","v":0},{"$f":"'6'!AK30","v":0},{"$f":"'6'!AL30","v":0},{"$f":"'6'!AM30","v":0},{"$f":"'6'!AN30","v":0},{"$f":"'6'!AO30","v":0},{"$f":"'6'!AP30","v":0},{"$f":"'6'!AQ30","v":0},{"$f":"'6'!AR30","v":0},{"$f":"'6'!AS30","v":0},{"$f":"'6'!AT30","v":0},{"$f":"SUMPRODUCT(IF($N515=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N515=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B31","v":"6"},{"$f":"'6'!C31","v":"6.2"},{"$f":"'6'!D31","v":"6.2.1"},{"$f":"'6'!E31","v":0},{"$f":"'6'!F31","v":"6.2.1.2"},{"$f":"'6'!G31","v":"6.2.1.2: INFORM CUSTOMERS OF MOBILE MONEY FRAUD THREATS\nProviders should run information campaigns to inform customers of prevailing fraud threats (e.g. social engineering frauds, identity theft, or unsolicited offers etc.). Information should be distributed:\n- through the media; and/or\n- through direct contact with customers, e.g. by SMS or via agents.\n\nCampaigns should, where possible, be localized to areas or situations where fraudsters are known to be active."},{"$f":"'6'!H31","v":0},{"$f":"'6'!I31","v":"6.2.1.2.1"},{"$f":"'6'!J31","v":"6.2.1.2.1: Are customers informed of prevailing mobile money fraud threats?\n"},{"$f":"'6'!K31","v":0},{"$f":"'6'!L31","v":0},{"$f":"'6'!M31","v":"Recommended"},{"$f":"'6'!N31","v":"Recommended"},{"$f":"'6'!O31","v":"BizOps"},{"$f":"'6'!P31","v":0},{"$f":"'6'!Q31","v":0},{"$f":"'6'!R31","v":0},{"$f":"'6'!S31","v":0},{"$f":"'6'!T31","v":0},{"$f":"'6'!U31","v":0},{"$f":"'6'!V31","v":0},{"$f":"'6'!W31","v":0},{"$f":"'6'!X31","v":0},{"$f":"'6'!Y31","v":0},{"$f":"'6'!Z31","v":0},{"$f":"'6'!AA31","v":0},{"$f":"'6'!AB31","v":0},{"$f":"'6'!AC31","v":0},{"$f":"'6'!AD31","v":0},{"$f":"'6'!AE31","v":0},{"$f":"'6'!AF31","v":0},{"$f":"'6'!AG31","v":0},{"$f":"'6'!AH31","v":0},{"$f":"'6'!AI31","v":0},{"$f":"'6'!AJ31","v":0},{"$f":"'6'!AK31","v":0},{"$f":"'6'!AL31","v":0},{"$f":"'6'!AM31","v":0},{"$f":"'6'!AN31","v":0},{"$f":"'6'!AO31","v":0},{"$f":"'6'!AP31","v":0},{"$f":"'6'!AQ31","v":0},{"$f":"'6'!AR31","v":0},{"$f":"'6'!AS31","v":0},{"$f":"'6'!AT31","v":0},{"$f":"SUMPRODUCT(IF($N516=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N516=CategoryRecommended,1,0))","v":1},{"$f":"_xlfn.IFNA(MATCH($Q516,ComplianceYes,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q516,CompliancePartial,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q516,ComplianceNo,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q516,ComplianceNA,0),0)","v":0},{"$f":"$AU516*AW516","v":0},{"$f":"$AU516*AX516","v":0},{"$f":"$AU516*AY516","v":0},{"$f":"$AU516*AZ516","v":0},{"$f":"$AV516*AW516","v":0},{"$f":"$AV516*AX516","v":0},{"$f":"$AV516*AY516","v":0},{"$f":"$AV516*AZ516","v":0},{"$f":"_xlfn.IFNA(MATCH($AF516,ComplianceYes,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF516,CompliancePartial,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF516,ComplianceNo,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF516,ComplianceNA,0),0)","v":0},0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B32","v":"6"},{"$f":"'6'!C32","v":"6.2"},{"$f":"'6'!D32","v":"6.2.1"},{"$f":"'6'!E32","v":0},{"$f":"'6'!F32","v":"6.2.1.2"},{"$f":"'6'!G32","v":0},{"$f":"'6'!H32","v":0},{"$f":"'6'!I32","v":"6.2.1.2.2"},{"$f":"'6'!J32","v":"6.2.1.2.2: Are information campaigns localized to inform customers of threats where fraudsters are known to be active?\n"},{"$f":"'6'!K32","v":0},{"$f":"'6'!L32","v":0},{"$f":"'6'!M32","v":"Recommended"},{"$f":"'6'!N32","v":"Recommended"},{"$f":"'6'!O32","v":"BizOps"},{"$f":"'6'!P32","v":0},{"$f":"'6'!Q32","v":0},{"$f":"'6'!R32","v":0},{"$f":"'6'!S32","v":0},{"$f":"'6'!T32","v":0},{"$f":"'6'!U32","v":0},{"$f":"'6'!V32","v":0},{"$f":"'6'!W32","v":0},{"$f":"'6'!X32","v":0},{"$f":"'6'!Y32","v":0},{"$f":"'6'!Z32","v":0},{"$f":"'6'!AA32","v":0},{"$f":"'6'!AB32","v":0},{"$f":"'6'!AC32","v":0},{"$f":"'6'!AD32","v":0},{"$f":"'6'!AE32","v":0},{"$f":"'6'!AF32","v":0},{"$f":"'6'!AG32","v":0},{"$f":"'6'!AH32","v":0},{"$f":"'6'!AI32","v":0},{"$f":"'6'!AJ32","v":0},{"$f":"'6'!AK32","v":0},{"$f":"'6'!AL32","v":0},{"$f":"'6'!AM32","v":0},{"$f":"'6'!AN32","v":0},{"$f":"'6'!AO32","v":0},{"$f":"'6'!AP32","v":0},{"$f":"'6'!AQ32","v":0},{"$f":"'6'!AR32","v":0},{"$f":"'6'!AS32","v":0},{"$f":"'6'!AT32","v":0},{"$f":"SUMPRODUCT(IF($N517=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N517=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,{"$f":"$AU517*BI517","v":0},{"$f":"$AU517*BJ517","v":0},{"$f":"$AU517*BK517","v":0},{"$f":"$AU517*BL517","v":0},{"$f":"$AV517*BI517","v":0},{"$f":"$AV517*BJ517","v":0},{"$f":"$AV517*BK517","v":0},{"$f":"$AV517*BL517","v":0}]
[null,{"$f":"'6'!B33","v":"6"},{"$f":"'6'!C33","v":"6.2"},{"$f":"'6'!D33","v":"6.2.1"},{"$f":"'6'!E33","v":0},{"$f":"'6'!F33","v":"6.2.1.3"},{"$f":"'6'!G33","v":"6.2.1.3: EMERGENCY CONTACT DETAILS FOR LOSS OF HANDSET/SIM OR SUSPICIOUS ACTIVITY\nProviders should give customers emergency contact numbers for reporting (i) loss or theft of handset or SIM or (ii) suspicious or potentially illegal activity relating to the mobile money service. Where possible, providers should ensure that contact numbers are toll-free in order to reduce any barriers that customers may face when they need to call the emergency contact service, particularly when reporting loss or theft of a handset or SIM."},{"$f":"'6'!H33","v":0},{"$f":"'6'!I33","v":"6.2.1.3.1"},{"$f":"'6'!J33","v":"6.2.1.3.1: Have contact numbers for reporting (i) loss or theft of handset or SIM or (ii) suspicious or illegal activity relating to the service been provided to customers?\n"},{"$f":"'6'!K33","v":"1) Customer communication plan / material\n- Check there is a contact number for customers to call in the event of:\na) Loss or theft of handset/SIM\nb) Suspicious or potentially illegal activity relating to the service\n"},{"$f":"'6'!L33","v":0},{"$f":"'6'!M33","v":"Standard Required"},{"$f":"'6'!N33","v":"Required"},{"$f":"'6'!O33","v":"BizOps"},{"$f":"'6'!P33","v":0},{"$f":"'6'!Q33","v":0},{"$f":"'6'!R33","v":0},{"$f":"'6'!S33","v":0},{"$f":"'6'!T33","v":0},{"$f":"'6'!U33","v":0},{"$f":"'6'!V33","v":0},{"$f":"'6'!W33","v":0},{"$f":"'6'!X33","v":0},{"$f":"'6'!Y33","v":0},{"$f":"'6'!Z33","v":0},{"$f":"'6'!AA33","v":0},{"$f":"'6'!AB33","v":0},{"$f":"'6'!AC33","v":0},{"$f":"'6'!AD33","v":0},{"$f":"'6'!AE33","v":0},{"$f":"'6'!AF33","v":0},{"$f":"'6'!AG33","v":0},{"$f":"'6'!AH33","v":0},{"$f":"'6'!AI33","v":0},{"$f":"'6'!AJ33","v":0},{"$f":"'6'!AK33","v":0},{"$f":"'6'!AL33","v":0},{"$f":"'6'!AM33","v":0},{"$f":"'6'!AN33","v":0},{"$f":"'6'!AO33","v":0},{"$f":"'6'!AP33","v":0},{"$f":"'6'!AQ33","v":0},{"$f":"'6'!AR33","v":0},{"$f":"'6'!AS33","v":0},{"$f":"'6'!AT33","v":0},{"$f":"SUMPRODUCT(IF($N518=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N518=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B34","v":"6"},{"$f":"'6'!C34","v":"6.2"},{"$f":"'6'!D34","v":"6.2.1"},{"$f":"'6'!E34","v":0},{"$f":"'6'!F34","v":"6.2.1.3"},{"$f":"'6'!G34","v":0},{"$f":"'6'!H34","v":0},{"$f":"'6'!I34","v":"6.2.1.3.2"},{"$f":"'6'!J34","v":"6.2.1.3.2: Has a national toll-free number been provided to customers for reporting lost or stolen handsets or SIMs?\n"},{"$f":"'6'!K34","v":0},{"$f":"'6'!L34","v":0},{"$f":"'6'!M34","v":"Recommended"},{"$f":"'6'!N34","v":"Recommended"},{"$f":"'6'!O34","v":"BizOps"},{"$f":"'6'!P34","v":0},{"$f":"'6'!Q34","v":0},{"$f":"'6'!R34","v":0},{"$f":"'6'!S34","v":0},{"$f":"'6'!T34","v":0},{"$f":"'6'!U34","v":0},{"$f":"'6'!V34","v":0},{"$f":"'6'!W34","v":0},{"$f":"'6'!X34","v":0},{"$f":"'6'!Y34","v":0},{"$f":"'6'!Z34","v":0},{"$f":"'6'!AA34","v":0},{"$f":"'6'!AB34","v":0},{"$f":"'6'!AC34","v":0},{"$f":"'6'!AD34","v":0},{"$f":"'6'!AE34","v":0},{"$f":"'6'!AF34","v":0},{"$f":"'6'!AG34","v":0},{"$f":"'6'!AH34","v":0},{"$f":"'6'!AI34","v":0},{"$f":"'6'!AJ34","v":0},{"$f":"'6'!AK34","v":0},{"$f":"'6'!AL34","v":0},{"$f":"'6'!AM34","v":0},{"$f":"'6'!AN34","v":0},{"$f":"'6'!AO34","v":0},{"$f":"'6'!AP34","v":0},{"$f":"'6'!AQ34","v":0},{"$f":"'6'!AR34","v":0},{"$f":"'6'!AS34","v":0},{"$f":"'6'!AT34","v":0},{"$f":"SUMPRODUCT(IF($N519=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N519=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B35","v":"6"},{"$f":"'6'!C35","v":"6.2"},{"$f":"'6'!D35","v":"6.2.1"},{"$f":"'6'!E35","v":0},{"$f":"'6'!F35","v":"6.2.1.4"},{"$f":"'6'!G35","v":"6.2.1.4: ENTERING SECURITY CREDENTIALS AND RESETTING ACCOUNT ACCESS\nCustomers should be: \n- instructed on how to properly input security credentials;\n- informed of the impact of incorrectly inputting security credentials (e.g., account access locked).\n\nCustomer service personnel should be trained in how to reset PINs securely when a customer's account has been locked because security credentials have been incorrectly input a certain number of times."},{"$f":"'6'!H35","v":0},{"$f":"'6'!I35","v":"6.2.1.4.1"},{"$f":"'6'!J35","v":"6.2.1.4.1: Are customers informed of the impact of incorrectly entering security credentials (e.g. account access locked)?\n"},{"$f":"'6'!K35","v":"1) Customer communication plan / material\n- Check there is some customer communication to make customers aware of the impact of entering security credentials incorrectly (e.g. T&Cs, system message)."},{"$f":"'6'!L35","v":0},{"$f":"'6'!M35","v":"Standard Required"},{"$f":"'6'!N35","v":"Required"},{"$f":"'6'!O35","v":"CustServ"},{"$f":"'6'!P35","v":0},{"$f":"'6'!Q35","v":0},{"$f":"'6'!R35","v":0},{"$f":"'6'!S35","v":0},{"$f":"'6'!T35","v":0},{"$f":"'6'!U35","v":0},{"$f":"'6'!V35","v":0},{"$f":"'6'!W35","v":0},{"$f":"'6'!X35","v":0},{"$f":"'6'!Y35","v":0},{"$f":"'6'!Z35","v":0},{"$f":"'6'!AA35","v":0},{"$f":"'6'!AB35","v":0},{"$f":"'6'!AC35","v":0},{"$f":"'6'!AD35","v":0},{"$f":"'6'!AE35","v":0},{"$f":"'6'!AF35","v":0},{"$f":"'6'!AG35","v":0},{"$f":"'6'!AH35","v":0},{"$f":"'6'!AI35","v":0},{"$f":"'6'!AJ35","v":0},{"$f":"'6'!AK35","v":0},{"$f":"'6'!AL35","v":0},{"$f":"'6'!AM35","v":0},{"$f":"'6'!AN35","v":0},{"$f":"'6'!AO35","v":0},{"$f":"'6'!AP35","v":0},{"$f":"'6'!AQ35","v":0},{"$f":"'6'!AR35","v":0},{"$f":"'6'!AS35","v":0},{"$f":"'6'!AT35","v":0},{"$f":"SUMPRODUCT(IF($N520=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N520=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B36","v":"6"},{"$f":"'6'!C36","v":"6.2"},{"$f":"'6'!D36","v":"6.2.1"},{"$f":"'6'!E36","v":0},{"$f":"'6'!F36","v":"6.2.1.4"},{"$f":"'6'!G36","v":0},{"$f":"'6'!H36","v":0},{"$f":"'6'!I36","v":"6.2.1.4.2"},{"$f":"'6'!J36","v":"6.2.1.4.2: Are customer service staff trained in how to reset PINs securely when a customer's account has been locked?\n"},{"$f":"'6'!K36","v":"1) Training plan / material for customer service staff, or customer service process documentation\n- Check that customer service personnel are trained in how to reset PINs securely when a customer's account has been locked.\n"},{"$f":"'6'!L36","v":0},{"$f":"'6'!M36","v":"Urgent Required"},{"$f":"'6'!N36","v":"Required"},{"$f":"'6'!O36","v":"CustServ"},{"$f":"'6'!P36","v":0},{"$f":"'6'!Q36","v":0},{"$f":"'6'!R36","v":0},{"$f":"'6'!S36","v":0},{"$f":"'6'!T36","v":0},{"$f":"'6'!U36","v":0},{"$f":"'6'!V36","v":0},{"$f":"'6'!W36","v":0},{"$f":"'6'!X36","v":0},{"$f":"'6'!Y36","v":0},{"$f":"'6'!Z36","v":0},{"$f":"'6'!AA36","v":0},{"$f":"'6'!AB36","v":0},{"$f":"'6'!AC36","v":0},{"$f":"'6'!AD36","v":0},{"$f":"'6'!AE36","v":0},{"$f":"'6'!AF36","v":0},{"$f":"'6'!AG36","v":0},{"$f":"'6'!AH36","v":0},{"$f":"'6'!AI36","v":0},{"$f":"'6'!AJ36","v":0},{"$f":"'6'!AK36","v":0},{"$f":"'6'!AL36","v":0},{"$f":"'6'!AM36","v":0},{"$f":"'6'!AN36","v":0},{"$f":"'6'!AO36","v":0},{"$f":"'6'!AP36","v":0},{"$f":"'6'!AQ36","v":0},{"$f":"'6'!AR36","v":0},{"$f":"'6'!AS36","v":0},{"$f":"'6'!AT36","v":0},{"$f":"SUMPRODUCT(IF($N521=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N521=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B37","v":"6"},{"$f":"'6'!C37","v":"6.2"},{"$f":"'6'!D37","v":"6.2.1"},{"$f":"'6'!E37","v":0},{"$f":"'6'!F37","v":"6.2.1.5"},{"$f":"'6'!G37","v":"6.2.1.5: EXERCISING CAUTION WITH CASH-IN/-OUT TRANSACTIONS AT AGENTS\nProviders should advise customers on how to exercise caution when conducting cash-in or cash-out transactions at agent locations. Customers should confirm the following while still at the agent or other cash-in or cash-out location:\n- For cash-in transactions, confirm that the balance on their mobile money account includes the full amount that they have deposited (less any authorised fees); and\n- For cash-out transactions, confirm that they have the correct amount of cash, that the notes appear genuine, and that the remaining balance in their account is correct."},{"$f":"'6'!H37","v":0},{"$f":"'6'!I37","v":"6.2.1.5.1"},{"$f":"'6'!J37","v":"6.2.1.5.1: For cash-in transactions, are customers advised to make sure that their transaction has completed successfully and that the balance on their mobile money account includes the full amount that they have deposited (less any authorised fees)?\n"},{"$f":"'6'!K37","v":"1) Customer communication plan / material \n- Check there are communication mechanisms or T&Cs to make customers aware that they should:\n     a) Check their cash-in transaction has completed successfully;\n     b) Check the balance on their mobile money account includes the full amount that they have deposited (less any authorised fees)."},{"$f":"'6'!L37","v":0},{"$f":"'6'!M37","v":"Urgent Required"},{"$f":"'6'!N37","v":"Required"},{"$f":"'6'!O37","v":"BizOps"},{"$f":"'6'!P37","v":0},{"$f":"'6'!Q37","v":0},{"$f":"'6'!R37","v":0},{"$f":"'6'!S37","v":0},{"$f":"'6'!T37","v":0},{"$f":"'6'!U37","v":0},{"$f":"'6'!V37","v":0},{"$f":"'6'!W37","v":0},{"$f":"'6'!X37","v":0},{"$f":"'6'!Y37","v":0},{"$f":"'6'!Z37","v":0},{"$f":"'6'!AA37","v":0},{"$f":"'6'!AB37","v":0},{"$f":"'6'!AC37","v":0},{"$f":"'6'!AD37","v":0},{"$f":"'6'!AE37","v":0},{"$f":"'6'!AF37","v":0},{"$f":"'6'!AG37","v":0},{"$f":"'6'!AH37","v":0},{"$f":"'6'!AI37","v":0},{"$f":"'6'!AJ37","v":0},{"$f":"'6'!AK37","v":0},{"$f":"'6'!AL37","v":0},{"$f":"'6'!AM37","v":0},{"$f":"'6'!AN37","v":0},{"$f":"'6'!AO37","v":0},{"$f":"'6'!AP37","v":0},{"$f":"'6'!AQ37","v":0},{"$f":"'6'!AR37","v":0},{"$f":"'6'!AS37","v":0},{"$f":"'6'!AT37","v":0},{"$f":"SUMPRODUCT(IF($N522=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N522=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B38","v":"6"},{"$f":"'6'!C38","v":"6.2"},{"$f":"'6'!D38","v":"6.2.1"},{"$f":"'6'!E38","v":0},{"$f":"'6'!F38","v":"6.2.1.5"},{"$f":"'6'!G38","v":0},{"$f":"'6'!H38","v":0},{"$f":"'6'!I38","v":"6.2.1.5.2"},{"$f":"'6'!J38","v":"6.2.1.5.2: For cash-out transactions, are customers advised to make sure that their transaction has completed successfully, that they have the correct amount of cash, and that the remaining balance in their account is correct?\n"},{"$f":"'6'!K38","v":"1) Customer communication plan / material\n- Check there is a process to make customers aware they should check that their cash-out transaction has:\n     a) Completed successfully, \n     b) That they have the correct amount of cash, \n     c) That the remaining balance in their account is correct"},{"$f":"'6'!L38","v":0},{"$f":"'6'!M38","v":"Urgent Required"},{"$f":"'6'!N38","v":"Required"},{"$f":"'6'!O38","v":"BizOps"},{"$f":"'6'!P38","v":0},{"$f":"'6'!Q38","v":0},{"$f":"'6'!R38","v":0},{"$f":"'6'!S38","v":0},{"$f":"'6'!T38","v":0},{"$f":"'6'!U38","v":0},{"$f":"'6'!V38","v":0},{"$f":"'6'!W38","v":0},{"$f":"'6'!X38","v":0},{"$f":"'6'!Y38","v":0},{"$f":"'6'!Z38","v":0},{"$f":"'6'!AA38","v":0},{"$f":"'6'!AB38","v":0},{"$f":"'6'!AC38","v":0},{"$f":"'6'!AD38","v":0},{"$f":"'6'!AE38","v":0},{"$f":"'6'!AF38","v":0},{"$f":"'6'!AG38","v":0},{"$f":"'6'!AH38","v":0},{"$f":"'6'!AI38","v":0},{"$f":"'6'!AJ38","v":0},{"$f":"'6'!AK38","v":0},{"$f":"'6'!AL38","v":0},{"$f":"'6'!AM38","v":0},{"$f":"'6'!AN38","v":0},{"$f":"'6'!AO38","v":0},{"$f":"'6'!AP38","v":0},{"$f":"'6'!AQ38","v":0},{"$f":"'6'!AR38","v":0},{"$f":"'6'!AS38","v":0},{"$f":"'6'!AT38","v":0},{"$f":"SUMPRODUCT(IF($N523=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N523=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B39","v":"6"},{"$f":"'6'!C39","v":"6.2"},{"$f":"'6'!D39","v":"6.2.1"},{"$f":"'6'!E39","v":0},{"$f":"'6'!F39","v":"6.2.1.6"},{"$f":"'6'!G39","v":"6.2.1.6: PROVIDING ALERTS ON SUSPICIOUS ACTIVITY ON CUSTOMER ACCOUNTS\nProviders should provide customers with timely alerts on suspicious activity relating to their accounts. The alerts should be sent electronically to the customer's mobile device, through a direct call from customer care personnel, and/or via other relevant channels. Alerts should contain sufficient information to enable customers to react to the alert by checking their account details (e.g. confirm balance or transactions) and/or taking other steps to safeguard their accounts (e.g. call customer care, visit a service centre or agent, change PIN, etc.).\n\nNote: Providers should not necessarily contact the customer if an investigation is initiated (as this would be 'tipping off'). Detection of suspicious activity is detailed in other toolkits:\n - Money laundering/terrorist financing: 2.4\n - Fraud: 5.3.10"},{"$f":"'6'!H39","v":0},{"$f":"'6'!I39","v":"6.2.1.6.1"},{"$f":"'6'!J39","v":"6.2.1.6.1: Do providers alert customers of suspicious activity in a timely fashion using one or more relevant channels (e.g., electronic communication to the customer's mobile device, direct call from customer care personnel, and/or other channels)?\n"},{"$f":"'6'!K39","v":0},{"$f":"'6'!L39","v":0},{"$f":"'6'!M39","v":"Recommended"},{"$f":"'6'!N39","v":"Recommended"},{"$f":"'6'!O39","v":"CustServ"},{"$f":"'6'!P39","v":0},{"$f":"'6'!Q39","v":0},{"$f":"'6'!R39","v":0},{"$f":"'6'!S39","v":0},{"$f":"'6'!T39","v":0},{"$f":"'6'!U39","v":0},{"$f":"'6'!V39","v":0},{"$f":"'6'!W39","v":0},{"$f":"'6'!X39","v":0},{"$f":"'6'!Y39","v":0},{"$f":"'6'!Z39","v":0},{"$f":"'6'!AA39","v":0},{"$f":"'6'!AB39","v":0},{"$f":"'6'!AC39","v":0},{"$f":"'6'!AD39","v":0},{"$f":"'6'!AE39","v":0},{"$f":"'6'!AF39","v":0},{"$f":"'6'!AG39","v":0},{"$f":"'6'!AH39","v":0},{"$f":"'6'!AI39","v":0},{"$f":"'6'!AJ39","v":0},{"$f":"'6'!AK39","v":0},{"$f":"'6'!AL39","v":0},{"$f":"'6'!AM39","v":0},{"$f":"'6'!AN39","v":0},{"$f":"'6'!AO39","v":0},{"$f":"'6'!AP39","v":0},{"$f":"'6'!AQ39","v":0},{"$f":"'6'!AR39","v":0},{"$f":"'6'!AS39","v":0},{"$f":"'6'!AT39","v":0},{"$f":"SUMPRODUCT(IF($N524=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N524=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B40","v":"6"},{"$f":"'6'!C40","v":"6.2"},{"$f":"'6'!D40","v":"6.2.1"},{"$f":"'6'!E40","v":0},{"$f":"'6'!F40","v":"6.2.1.6"},{"$f":"'6'!G40","v":0},{"$f":"'6'!H40","v":0},{"$f":"'6'!I40","v":"6.2.1.6.2"},{"$f":"'6'!J40","v":"6.2.1.6.2: Do alerts contain sufficient information to enable customers to react to the alert by checking their account details (e.g. confirm balance or transactions) and/or taking other steps to safeguard their accounts (e.g. call customer care, visit a service centre or agent, change PIN, etc.)?\n"},{"$f":"'6'!K40","v":0},{"$f":"'6'!L40","v":0},{"$f":"'6'!M40","v":"Recommended"},{"$f":"'6'!N40","v":"Recommended"},{"$f":"'6'!O40","v":"CustServ"},{"$f":"'6'!P40","v":0},{"$f":"'6'!Q40","v":0},{"$f":"'6'!R40","v":0},{"$f":"'6'!S40","v":0},{"$f":"'6'!T40","v":0},{"$f":"'6'!U40","v":0},{"$f":"'6'!V40","v":0},{"$f":"'6'!W40","v":0},{"$f":"'6'!X40","v":0},{"$f":"'6'!Y40","v":0},{"$f":"'6'!Z40","v":0},{"$f":"'6'!AA40","v":0},{"$f":"'6'!AB40","v":0},{"$f":"'6'!AC40","v":0},{"$f":"'6'!AD40","v":0},{"$f":"'6'!AE40","v":0},{"$f":"'6'!AF40","v":0},{"$f":"'6'!AG40","v":0},{"$f":"'6'!AH40","v":0},{"$f":"'6'!AI40","v":0},{"$f":"'6'!AJ40","v":0},{"$f":"'6'!AK40","v":0},{"$f":"'6'!AL40","v":0},{"$f":"'6'!AM40","v":0},{"$f":"'6'!AN40","v":0},{"$f":"'6'!AO40","v":0},{"$f":"'6'!AP40","v":0},{"$f":"'6'!AQ40","v":0},{"$f":"'6'!AR40","v":0},{"$f":"'6'!AS40","v":0},{"$f":"'6'!AT40","v":0},{"$f":"SUMPRODUCT(IF($N525=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N525=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'6'!B41","v":"6"},{"$f":"'6'!C41","v":"6.2"},{"$f":"'6'!D41","v":"6.2.1"},{"$f":"'6'!E41","v":0},{"$f":"'6'!F41","v":"6.2.1.7"},{"$f":"'6'!G41","v":"6.2.1.7: ADVISING CUSTOMERS THAT USER INTERFACE WILL CHANGE\nProviders should inform customers when there is an upcoming major re-design of the user interface, e.g. a new menu hierarchy in the USSD service. Customers should be given advance notice, ideally 15-30 days before the change is made."},{"$f":"'6'!H41","v":0},{"$f":"'6'!I41","v":"6.2.1.7.1"},{"$f":"'6'!J41","v":"6.2.1.7.1: Are customers provided with prior notice when there is an upcoming major re-design of the user interface for the mobile money service?\n"},{"$f":"'6'!K41","v":0},{"$f":"'6'!L41","v":0},{"$f":"'6'!M41","v":"Recommended"},{"$f":"'6'!N41","v":"Recommended"},{"$f":"'6'!O41","v":"BizOps"},{"$f":"'6'!P41","v":0},{"$f":"'6'!Q41","v":0},{"$f":"'6'!R41","v":0},{"$f":"'6'!S41","v":0},{"$f":"'6'!T41","v":0},{"$f":"'6'!U41","v":0},{"$f":"'6'!V41","v":0},{"$f":"'6'!W41","v":0},{"$f":"'6'!X41","v":0},{"$f":"'6'!Y41","v":0},{"$f":"'6'!Z41","v":0},{"$f":"'6'!AA41","v":0},{"$f":"'6'!AB41","v":0},{"$f":"'6'!AC41","v":0},{"$f":"'6'!AD41","v":0},{"$f":"'6'!AE41","v":0},{"$f":"'6'!AF41","v":0},{"$f":"'6'!AG41","v":0},{"$f":"'6'!AH41","v":0},{"$f":"'6'!AI41","v":0},{"$f":"'6'!AJ41","v":0},{"$f":"'6'!AK41","v":0},{"$f":"'6'!AL41","v":0},{"$f":"'6'!AM41","v":0},{"$f":"'6'!AN41","v":0},{"$f":"'6'!AO41","v":0},{"$f":"'6'!AP41","v":0},{"$f":"'6'!AQ41","v":0},{"$f":"'6'!AR41","v":0},{"$f":"'6'!AS41","v":0},{"$f":"'6'!AT41","v":0},{"$f":"SUMPRODUCT(IF($N526=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N526=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B5","v":"7"},{"$f":"'7'!C5","v":"7.1"},{"$f":"'7'!D5","v":"7.1.1"},{"$f":"'7'!E5","v":"7.1.1: Providers shall develop customer service policies and procedures"},{"$f":"'7'!F5","v":"7.1.1.1"},{"$f":"'7'!G5","v":"7.1.1.1: PROCESS FOR CUSTOMERS TO FILE COMPLAINTS\nProviders should document procedures for handling requests and complaints from mobile money customers. Processes should include:\n- acceptance/lodging of complaints/requests;\n- processing/investigation of complaints/requests;\n- measures to reduce the risk of fraud in the customer service process (e.g. vetting customers when they call customer service);\n- resolution of complaints/requests, including scenarios where refunds / reversals are made;\n- an escalation process in case complaints cannot be resolved;\n- external recourse once the complaints and escalation process with the provider has been exhausted;\n- management of the complaints/requests process.\n\nThe policy detail should include all aspects of the complaints management process and should be regularly updated to incorporate feedback from analysis of records of customer complaints. \n\nThe customer service procedures should be made known to all customer service staff."},{"$f":"'7'!H5","v":0},{"$f":"'7'!I5","v":"7.1.1.1.1"},{"$f":"'7'!J5","v":"7.1.1.1.1: Are all procedures for handling requests and complaints from mobile money customers documented?\n"},{"$f":"'7'!K5","v":"1) Customer service process documentation, \n- Check that it contains at least:\n     a) Customer call logging \n     b) a Closing process\n- Verify that the customer service process is documented satisfactorily \n\nAlso see: \n7.1.1.3 (escalation)\n7.1.1.4 (off-net transactions)\n7.1.1.5 (customer identity verification)"},{"$f":"'7'!L5","v":0},{"$f":"'7'!M5","v":"Urgent Required"},{"$f":"'7'!N5","v":"Required"},{"$f":"'7'!O5","v":"CustServ"},{"$f":"'7'!P5","v":0},{"$f":"'7'!Q5","v":0},{"$f":"'7'!R5","v":0},{"$f":"'7'!S5","v":0},{"$f":"'7'!T5","v":0},{"$f":"'7'!U5","v":0},{"$f":"'7'!V5","v":0},{"$f":"'7'!W5","v":0},{"$f":"'7'!X5","v":0},{"$f":"'7'!Y5","v":0},{"$f":"'7'!Z5","v":0},{"$f":"'7'!AA5","v":0},{"$f":"'7'!AB5","v":0},{"$f":"'7'!AC5","v":0},{"$f":"'7'!AD5","v":0},{"$f":"'7'!AE5","v":0},{"$f":"'7'!AF5","v":0},{"$f":"'7'!AG5","v":0},{"$f":"'7'!AH5","v":0},{"$f":"'7'!AI5","v":0},{"$f":"'7'!AJ5","v":0},{"$f":"'7'!AK5","v":0},{"$f":"'7'!AL5","v":0},{"$f":"'7'!AM5","v":0},{"$f":"'7'!AN5","v":0},{"$f":"'7'!AO5","v":0},{"$f":"'7'!AP5","v":0},{"$f":"'7'!AQ5","v":0},{"$f":"'7'!AR5","v":0},{"$f":"'7'!AS5","v":0},{"$f":"'7'!AT5","v":0},{"$f":"SUMPRODUCT(IF($N527=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N527=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B6","v":"7"},{"$f":"'7'!C6","v":"7.1"},{"$f":"'7'!D6","v":"7.1.1"},{"$f":"'7'!E6","v":""},{"$f":"'7'!F6","v":"7.1.1.2"},{"$f":"'7'!G6","v":"7.1.1.2: REFERENCE NUMBER AND RESOLUTION TIME FOR COMPLAINTS\nComplaints lodged by customers should be given reference/ticket numbers. Tickets would normally be system-generated (e.g. by CRM or mobile money system).\n\nThe complaints management policy should define timeframes for both the investigation and the resolution of complaints. Timeframes should be tailored to the type of complaint and should consider both the urgency of the complaint and the procedures required to resolve it. For example, timeframes may be longer for complaints involving off-net transactions (see 7.1.1.6 below).\n\nIt is good practice for the system to guide customer service staff through the process and monitor response times against the SLA. Staff can be alerted before the response SLA is breached."},{"$f":"'7'!H6","v":0},{"$f":"'7'!I6","v":"7.1.1.2.1"},{"$f":"'7'!J6","v":"7.1.1.2.1: When a complaint is received by the mobile money provider, are customers provided with reference/ticket numbers for their complaint?\n"},{"$f":"'7'!K6","v":0},{"$f":"'7'!L6","v":0},{"$f":"'7'!M6","v":"Recommended"},{"$f":"'7'!N6","v":"Recommended"},{"$f":"'7'!O6","v":"CustServ"},{"$f":"'7'!P6","v":0},{"$f":"'7'!Q6","v":0},{"$f":"'7'!R6","v":0},{"$f":"'7'!S6","v":0},{"$f":"'7'!T6","v":0},{"$f":"'7'!U6","v":0},{"$f":"'7'!V6","v":0},{"$f":"'7'!W6","v":0},{"$f":"'7'!X6","v":0},{"$f":"'7'!Y6","v":0},{"$f":"'7'!Z6","v":0},{"$f":"'7'!AA6","v":0},{"$f":"'7'!AB6","v":0},{"$f":"'7'!AC6","v":0},{"$f":"'7'!AD6","v":0},{"$f":"'7'!AE6","v":0},{"$f":"'7'!AF6","v":0},{"$f":"'7'!AG6","v":0},{"$f":"'7'!AH6","v":0},{"$f":"'7'!AI6","v":0},{"$f":"'7'!AJ6","v":0},{"$f":"'7'!AK6","v":0},{"$f":"'7'!AL6","v":0},{"$f":"'7'!AM6","v":0},{"$f":"'7'!AN6","v":0},{"$f":"'7'!AO6","v":0},{"$f":"'7'!AP6","v":0},{"$f":"'7'!AQ6","v":0},{"$f":"'7'!AR6","v":0},{"$f":"'7'!AS6","v":0},{"$f":"'7'!AT6","v":0},{"$f":"SUMPRODUCT(IF($N528=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N528=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B7","v":"7"},{"$f":"'7'!C7","v":"7.1"},{"$f":"'7'!D7","v":"7.1.1"},{"$f":"'7'!E7","v":""},{"$f":"'7'!F7","v":"7.1.1.2"},{"$f":"'7'!G7","v":0},{"$f":"'7'!H7","v":0},{"$f":"'7'!I7","v":"7.1.1.2.2"},{"$f":"'7'!J7","v":"7.1.1.2.2: Are complaint resolution timeframes (which may be tailored to the type and urgency of complaint) defined and the customer informed of expected complaint resolution time?\n"},{"$f":"'7'!K7","v":0},{"$f":"'7'!L7","v":0},{"$f":"'7'!M7","v":"Recommended"},{"$f":"'7'!N7","v":"Recommended"},{"$f":"'7'!O7","v":"CustServ"},{"$f":"'7'!P7","v":0},{"$f":"'7'!Q7","v":0},{"$f":"'7'!R7","v":0},{"$f":"'7'!S7","v":0},{"$f":"'7'!T7","v":0},{"$f":"'7'!U7","v":0},{"$f":"'7'!V7","v":0},{"$f":"'7'!W7","v":0},{"$f":"'7'!X7","v":0},{"$f":"'7'!Y7","v":0},{"$f":"'7'!Z7","v":0},{"$f":"'7'!AA7","v":0},{"$f":"'7'!AB7","v":0},{"$f":"'7'!AC7","v":0},{"$f":"'7'!AD7","v":0},{"$f":"'7'!AE7","v":0},{"$f":"'7'!AF7","v":0},{"$f":"'7'!AG7","v":0},{"$f":"'7'!AH7","v":0},{"$f":"'7'!AI7","v":0},{"$f":"'7'!AJ7","v":0},{"$f":"'7'!AK7","v":0},{"$f":"'7'!AL7","v":0},{"$f":"'7'!AM7","v":0},{"$f":"'7'!AN7","v":0},{"$f":"'7'!AO7","v":0},{"$f":"'7'!AP7","v":0},{"$f":"'7'!AQ7","v":0},{"$f":"'7'!AR7","v":0},{"$f":"'7'!AS7","v":0},{"$f":"'7'!AT7","v":0},{"$f":"SUMPRODUCT(IF($N529=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N529=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B8","v":"7"},{"$f":"'7'!C8","v":"7.1"},{"$f":"'7'!D8","v":"7.1.1"},{"$f":"'7'!E8","v":""},{"$f":"'7'!F8","v":"7.1.1.3"},{"$f":"'7'!G8","v":"7.1.1.3: CUSTOMER COMPLAINTS ESCALATION PROCESS\nProviders should offer a complaints escalation process, which may be invoked if customers are not satisfied with the initial outcome of the complaints process.\n\nStaff should be allocated to support the escalation process and trained accordingly."},{"$f":"'7'!H8","v":0},{"$f":"'7'!I8","v":"7.1.1.3.1"},{"$f":"'7'!J8","v":"7.1.1.3.1: Has the provider defined a complaints escalation process, which may be invoked if customers are not satisfied with the initial outcome of the complaints process?\n"},{"$f":"'7'!K8","v":"1) Customer service process documentation, containing at least:\n-  Verify that the customer service process documentation contains at least the customer call escalation process to second-level support or call centre supervisor."},{"$f":"'7'!L8","v":0},{"$f":"'7'!M8","v":"Urgent Required"},{"$f":"'7'!N8","v":"Required"},{"$f":"'7'!O8","v":"CustServ"},{"$f":"'7'!P8","v":0},{"$f":"'7'!Q8","v":0},{"$f":"'7'!R8","v":0},{"$f":"'7'!S8","v":0},{"$f":"'7'!T8","v":0},{"$f":"'7'!U8","v":0},{"$f":"'7'!V8","v":0},{"$f":"'7'!W8","v":0},{"$f":"'7'!X8","v":0},{"$f":"'7'!Y8","v":0},{"$f":"'7'!Z8","v":0},{"$f":"'7'!AA8","v":0},{"$f":"'7'!AB8","v":0},{"$f":"'7'!AC8","v":0},{"$f":"'7'!AD8","v":0},{"$f":"'7'!AE8","v":0},{"$f":"'7'!AF8","v":0},{"$f":"'7'!AG8","v":0},{"$f":"'7'!AH8","v":0},{"$f":"'7'!AI8","v":0},{"$f":"'7'!AJ8","v":0},{"$f":"'7'!AK8","v":0},{"$f":"'7'!AL8","v":0},{"$f":"'7'!AM8","v":0},{"$f":"'7'!AN8","v":0},{"$f":"'7'!AO8","v":0},{"$f":"'7'!AP8","v":0},{"$f":"'7'!AQ8","v":0},{"$f":"'7'!AR8","v":0},{"$f":"'7'!AS8","v":0},{"$f":"'7'!AT8","v":0},{"$f":"SUMPRODUCT(IF($N530=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N530=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B9","v":"7"},{"$f":"'7'!C9","v":"7.1"},{"$f":"'7'!D9","v":"7.1.1"},{"$f":"'7'!E9","v":""},{"$f":"'7'!F9","v":"7.1.1.4"},{"$f":"'7'!G9","v":"7.1.1.4: CUSTOMER COMPLAINTS INVOLVING OFF-NET TRANSACTIONS\nThe provider should always be the single point for its customers to raise complaints when they send transactions to banks / other providers (domestic and international). \n\nATM complaints may be more efficiently handled by the ATM provider. However, the provider must efficiently support customers who call them instead of the ATM provider.\n\nA service level agreement and procedure should be agreed with each financial ecosystem partner for resolving customer complaints related to transactions between the provider and partner.\n\nProviders should ensure that, where possible, the process for resolving complaints regarding off-net transactions should be identical (from the customer's perspective) to the process for resolving complaints regarding on-net transactions; in addition, providers should make every effort to keep the service level similar (with the understanding that timeframes for resolution may be significantly longer). \n\nWhere any complaint about an off-net transaction is raised, providers should communicate to the customer:\n- The expected timeframe for resolution of the issue;\n- Potential outcomes;\n- Any limitations on the scope of resolution due to its being an off-net transaction (for example, some off-net transactions may be irreversible)."},{"$f":"'7'!H9","v":0},{"$f":"'7'!I9","v":"7.1.1.4.1"},{"$f":"'7'!J9","v":"7.1.1.4.1: Is the provider always the single point for its customers to raise complaints when they send transactions to banks / other providers (domestic and international)?\n"},{"$f":"'7'!K9","v":"1) Customer service process documentation, containing at least:\n -  Resolution process for transactions to banks or other providers\n- Verify from the customer service process documentation that the provider is always the single point of contact for its customers when they send transactions to banks / other providers (domestic and international).\n"},{"$f":"'7'!L9","v":0},{"$f":"'7'!M9","v":"Urgent Required"},{"$f":"'7'!N9","v":"Required"},{"$f":"'7'!O9","v":"CustServ"},{"$f":"'7'!P9","v":0},{"$f":"'7'!Q9","v":0},{"$f":"'7'!R9","v":0},{"$f":"'7'!S9","v":0},{"$f":"'7'!T9","v":0},{"$f":"'7'!U9","v":0},{"$f":"'7'!V9","v":0},{"$f":"'7'!W9","v":0},{"$f":"'7'!X9","v":0},{"$f":"'7'!Y9","v":0},{"$f":"'7'!Z9","v":0},{"$f":"'7'!AA9","v":0},{"$f":"'7'!AB9","v":0},{"$f":"'7'!AC9","v":0},{"$f":"'7'!AD9","v":0},{"$f":"'7'!AE9","v":0},{"$f":"'7'!AF9","v":0},{"$f":"'7'!AG9","v":0},{"$f":"'7'!AH9","v":0},{"$f":"'7'!AI9","v":0},{"$f":"'7'!AJ9","v":0},{"$f":"'7'!AK9","v":0},{"$f":"'7'!AL9","v":0},{"$f":"'7'!AM9","v":0},{"$f":"'7'!AN9","v":0},{"$f":"'7'!AO9","v":0},{"$f":"'7'!AP9","v":0},{"$f":"'7'!AQ9","v":0},{"$f":"'7'!AR9","v":0},{"$f":"'7'!AS9","v":0},{"$f":"'7'!AT9","v":0},{"$f":"SUMPRODUCT(IF($N531=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N531=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B10","v":"7"},{"$f":"'7'!C10","v":"7.1"},{"$f":"'7'!D10","v":"7.1.1"},{"$f":"'7'!E10","v":""},{"$f":"'7'!F10","v":"7.1.1.4"},{"$f":"'7'!G10","v":0},{"$f":"'7'!H10","v":0},{"$f":"'7'!I10","v":"7.1.1.4.2"},{"$f":"'7'!J10","v":"7.1.1.4.2: Are reciprocal mechanisms in place with each financial ecosystem partner to resolve issues raised by customers related to off-net transactions?\n"},{"$f":"'7'!K10","v":0},{"$f":"'7'!L10","v":0},{"$f":"'7'!M10","v":"Recommended"},{"$f":"'7'!N10","v":"Recommended"},{"$f":"'7'!O10","v":"CustServ"},{"$f":"'7'!P10","v":0},{"$f":"'7'!Q10","v":0},{"$f":"'7'!R10","v":0},{"$f":"'7'!S10","v":0},{"$f":"'7'!T10","v":0},{"$f":"'7'!U10","v":0},{"$f":"'7'!V10","v":0},{"$f":"'7'!W10","v":0},{"$f":"'7'!X10","v":0},{"$f":"'7'!Y10","v":0},{"$f":"'7'!Z10","v":0},{"$f":"'7'!AA10","v":0},{"$f":"'7'!AB10","v":0},{"$f":"'7'!AC10","v":0},{"$f":"'7'!AD10","v":0},{"$f":"'7'!AE10","v":0},{"$f":"'7'!AF10","v":0},{"$f":"'7'!AG10","v":0},{"$f":"'7'!AH10","v":0},{"$f":"'7'!AI10","v":0},{"$f":"'7'!AJ10","v":0},{"$f":"'7'!AK10","v":0},{"$f":"'7'!AL10","v":0},{"$f":"'7'!AM10","v":0},{"$f":"'7'!AN10","v":0},{"$f":"'7'!AO10","v":0},{"$f":"'7'!AP10","v":0},{"$f":"'7'!AQ10","v":0},{"$f":"'7'!AR10","v":0},{"$f":"'7'!AS10","v":0},{"$f":"'7'!AT10","v":0},{"$f":"SUMPRODUCT(IF($N532=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N532=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B11","v":"7"},{"$f":"'7'!C11","v":"7.1"},{"$f":"'7'!D11","v":"7.1.1"},{"$f":"'7'!E11","v":""},{"$f":"'7'!F11","v":"7.1.1.4"},{"$f":"'7'!G11","v":0},{"$f":"'7'!H11","v":0},{"$f":"'7'!I11","v":"7.1.1.4.3"},{"$f":"'7'!J11","v":"7.1.1.4.3: Is a service level agreement in place with each financial ecosystem partner for responding to and resolving customer complaints?\n"},{"$f":"'7'!K11","v":0},{"$f":"'7'!L11","v":0},{"$f":"'7'!M11","v":"Recommended"},{"$f":"'7'!N11","v":"Recommended"},{"$f":"'7'!O11","v":"CustServ"},{"$f":"'7'!P11","v":0},{"$f":"'7'!Q11","v":0},{"$f":"'7'!R11","v":0},{"$f":"'7'!S11","v":0},{"$f":"'7'!T11","v":0},{"$f":"'7'!U11","v":0},{"$f":"'7'!V11","v":0},{"$f":"'7'!W11","v":0},{"$f":"'7'!X11","v":0},{"$f":"'7'!Y11","v":0},{"$f":"'7'!Z11","v":0},{"$f":"'7'!AA11","v":0},{"$f":"'7'!AB11","v":0},{"$f":"'7'!AC11","v":0},{"$f":"'7'!AD11","v":0},{"$f":"'7'!AE11","v":0},{"$f":"'7'!AF11","v":0},{"$f":"'7'!AG11","v":0},{"$f":"'7'!AH11","v":0},{"$f":"'7'!AI11","v":0},{"$f":"'7'!AJ11","v":0},{"$f":"'7'!AK11","v":0},{"$f":"'7'!AL11","v":0},{"$f":"'7'!AM11","v":0},{"$f":"'7'!AN11","v":0},{"$f":"'7'!AO11","v":0},{"$f":"'7'!AP11","v":0},{"$f":"'7'!AQ11","v":0},{"$f":"'7'!AR11","v":0},{"$f":"'7'!AS11","v":0},{"$f":"'7'!AT11","v":0},{"$f":"SUMPRODUCT(IF($N533=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N533=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B12","v":"7"},{"$f":"'7'!C12","v":"7.1"},{"$f":"'7'!D12","v":"7.1.1"},{"$f":"'7'!E12","v":""},{"$f":"'7'!F12","v":"7.1.1.4"},{"$f":"'7'!G12","v":0},{"$f":"'7'!H12","v":0},{"$f":"'7'!I12","v":"7.1.1.4.4"},{"$f":"'7'!J12","v":"7.1.1.4.4: Is the process for resolving complaints regarding off-net transactions identical (from the customer's perspective) to the process for resolving complaints regarding on-net transactions (with the understanding that timeframes for resolution may be significantly longer)?\n"},{"$f":"'7'!K12","v":0},{"$f":"'7'!L12","v":0},{"$f":"'7'!M12","v":"Recommended"},{"$f":"'7'!N12","v":"Recommended"},{"$f":"'7'!O12","v":"CustServ"},{"$f":"'7'!P12","v":0},{"$f":"'7'!Q12","v":0},{"$f":"'7'!R12","v":0},{"$f":"'7'!S12","v":0},{"$f":"'7'!T12","v":0},{"$f":"'7'!U12","v":0},{"$f":"'7'!V12","v":0},{"$f":"'7'!W12","v":0},{"$f":"'7'!X12","v":0},{"$f":"'7'!Y12","v":0},{"$f":"'7'!Z12","v":0},{"$f":"'7'!AA12","v":0},{"$f":"'7'!AB12","v":0},{"$f":"'7'!AC12","v":0},{"$f":"'7'!AD12","v":0},{"$f":"'7'!AE12","v":0},{"$f":"'7'!AF12","v":0},{"$f":"'7'!AG12","v":0},{"$f":"'7'!AH12","v":0},{"$f":"'7'!AI12","v":0},{"$f":"'7'!AJ12","v":0},{"$f":"'7'!AK12","v":0},{"$f":"'7'!AL12","v":0},{"$f":"'7'!AM12","v":0},{"$f":"'7'!AN12","v":0},{"$f":"'7'!AO12","v":0},{"$f":"'7'!AP12","v":0},{"$f":"'7'!AQ12","v":0},{"$f":"'7'!AR12","v":0},{"$f":"'7'!AS12","v":0},{"$f":"'7'!AT12","v":0},{"$f":"SUMPRODUCT(IF($N534=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N534=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B13","v":"7"},{"$f":"'7'!C13","v":"7.1"},{"$f":"'7'!D13","v":"7.1.1"},{"$f":"'7'!E13","v":""},{"$f":"'7'!F13","v":"7.1.1.4"},{"$f":"'7'!G13","v":0},{"$f":"'7'!H13","v":0},{"$f":"'7'!I13","v":"7.1.1.4.5"},{"$f":"'7'!J13","v":"7.1.1.4.5: When any complaint about an off-net transaction is raised, are customers notified of the expected timeframe for resolution of the issue, potential outcomes, and any limitations on the scope of resolution due to its being an off-net transaction?\n"},{"$f":"'7'!K13","v":0},{"$f":"'7'!L13","v":0},{"$f":"'7'!M13","v":"Recommended"},{"$f":"'7'!N13","v":"Recommended"},{"$f":"'7'!O13","v":"CustServ"},{"$f":"'7'!P13","v":0},{"$f":"'7'!Q13","v":0},{"$f":"'7'!R13","v":0},{"$f":"'7'!S13","v":0},{"$f":"'7'!T13","v":0},{"$f":"'7'!U13","v":0},{"$f":"'7'!V13","v":0},{"$f":"'7'!W13","v":0},{"$f":"'7'!X13","v":0},{"$f":"'7'!Y13","v":0},{"$f":"'7'!Z13","v":0},{"$f":"'7'!AA13","v":0},{"$f":"'7'!AB13","v":0},{"$f":"'7'!AC13","v":0},{"$f":"'7'!AD13","v":0},{"$f":"'7'!AE13","v":0},{"$f":"'7'!AF13","v":0},{"$f":"'7'!AG13","v":0},{"$f":"'7'!AH13","v":0},{"$f":"'7'!AI13","v":0},{"$f":"'7'!AJ13","v":0},{"$f":"'7'!AK13","v":0},{"$f":"'7'!AL13","v":0},{"$f":"'7'!AM13","v":0},{"$f":"'7'!AN13","v":0},{"$f":"'7'!AO13","v":0},{"$f":"'7'!AP13","v":0},{"$f":"'7'!AQ13","v":0},{"$f":"'7'!AR13","v":0},{"$f":"'7'!AS13","v":0},{"$f":"'7'!AT13","v":0},{"$f":"SUMPRODUCT(IF($N535=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N535=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B14","v":"7"},{"$f":"'7'!C14","v":"7.1"},{"$f":"'7'!D14","v":"7.1.1"},{"$f":"'7'!E14","v":""},{"$f":"'7'!F14","v":"7.1.1.5"},{"$f":"'7'!G14","v":"7.1.1.5: VERIFICATION OF CUSTOMER IDENTITY\nWhen customers call to lodge complaints, their identity should be verified to mitigate fraud risk. Support staff should be trained to verify customer identity properly (e.g. with a secret word or other information that only the customer should know) and to use alternate processes to verify customers who are unable to provide the requested information to verify identity."},{"$f":"'7'!H14","v":0},{"$f":"'7'!I14","v":"7.1.1.5.1"},{"$f":"'7'!J14","v":"7.1.1.5.1: Are customer support staff trained to verify the identity of customers who make complaints using a secret word or other information that only the customer should know?\n"},{"$f":"'7'!K14","v":"1. Customer service process documentation \n - Check the customer service process documentation contains at least the customer call verification procedure.\n- Check the customer verification procedure uses a secret word or other information that only the customer should know\n\n2. Customer service training documentation\n- Confirm that the training documentation covers at least customer verification procedure"},{"$f":"'7'!L14","v":0},{"$f":"'7'!M14","v":"Urgent Required"},{"$f":"'7'!N14","v":"Required"},{"$f":"'7'!O14","v":"CustServ"},{"$f":"'7'!P14","v":0},{"$f":"'7'!Q14","v":0},{"$f":"'7'!R14","v":0},{"$f":"'7'!S14","v":0},{"$f":"'7'!T14","v":0},{"$f":"'7'!U14","v":0},{"$f":"'7'!V14","v":0},{"$f":"'7'!W14","v":0},{"$f":"'7'!X14","v":0},{"$f":"'7'!Y14","v":0},{"$f":"'7'!Z14","v":0},{"$f":"'7'!AA14","v":0},{"$f":"'7'!AB14","v":0},{"$f":"'7'!AC14","v":0},{"$f":"'7'!AD14","v":0},{"$f":"'7'!AE14","v":0},{"$f":"'7'!AF14","v":0},{"$f":"'7'!AG14","v":0},{"$f":"'7'!AH14","v":0},{"$f":"'7'!AI14","v":0},{"$f":"'7'!AJ14","v":0},{"$f":"'7'!AK14","v":0},{"$f":"'7'!AL14","v":0},{"$f":"'7'!AM14","v":0},{"$f":"'7'!AN14","v":0},{"$f":"'7'!AO14","v":0},{"$f":"'7'!AP14","v":0},{"$f":"'7'!AQ14","v":0},{"$f":"'7'!AR14","v":0},{"$f":"'7'!AS14","v":0},{"$f":"'7'!AT14","v":0},{"$f":"SUMPRODUCT(IF($N536=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N536=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B15","v":"7"},{"$f":"'7'!C15","v":"7.1"},{"$f":"'7'!D15","v":"7.1.1"},{"$f":"'7'!E15","v":""},{"$f":"'7'!F15","v":"7.1.1.5"},{"$f":"'7'!G15","v":0},{"$f":"'7'!H15","v":0},{"$f":"'7'!I15","v":"7.1.1.5.2"},{"$f":"'7'!J15","v":"7.1.1.5.2: Are alternate processes established to verify customer identity if the customer is unable to provide the requested information to verify identity?\n"},{"$f":"'7'!K15","v":0},{"$f":"'7'!L15","v":0},{"$f":"'7'!M15","v":"Recommended"},{"$f":"'7'!N15","v":"Recommended"},{"$f":"'7'!O15","v":"CustServ"},{"$f":"'7'!P15","v":0},{"$f":"'7'!Q15","v":0},{"$f":"'7'!R15","v":0},{"$f":"'7'!S15","v":0},{"$f":"'7'!T15","v":0},{"$f":"'7'!U15","v":0},{"$f":"'7'!V15","v":0},{"$f":"'7'!W15","v":0},{"$f":"'7'!X15","v":0},{"$f":"'7'!Y15","v":0},{"$f":"'7'!Z15","v":0},{"$f":"'7'!AA15","v":0},{"$f":"'7'!AB15","v":0},{"$f":"'7'!AC15","v":0},{"$f":"'7'!AD15","v":0},{"$f":"'7'!AE15","v":0},{"$f":"'7'!AF15","v":0},{"$f":"'7'!AG15","v":0},{"$f":"'7'!AH15","v":0},{"$f":"'7'!AI15","v":0},{"$f":"'7'!AJ15","v":0},{"$f":"'7'!AK15","v":0},{"$f":"'7'!AL15","v":0},{"$f":"'7'!AM15","v":0},{"$f":"'7'!AN15","v":0},{"$f":"'7'!AO15","v":0},{"$f":"'7'!AP15","v":0},{"$f":"'7'!AQ15","v":0},{"$f":"'7'!AR15","v":0},{"$f":"'7'!AS15","v":0},{"$f":"'7'!AT15","v":0},{"$f":"SUMPRODUCT(IF($N537=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N537=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B16","v":"7"},{"$f":"'7'!C16","v":"7.1"},{"$f":"'7'!D16","v":"7.1.1"},{"$f":"'7'!E16","v":""},{"$f":"'7'!F16","v":"7.1.1.6"},{"$f":"'7'!G16","v":"7.1.1.6: TRAIN CUSTOMER SERVICE STAFF \nProviders should ensure that customer service staff are fully trained to handle the wide range of issues that customers may complain about. Training should be designed to encompass the full lifecycle of complaint management:\n- initial contact with complainants (verify identity, confirm complaint should be logged, etc.);\n- initiate investigation;\n- resolve (including informing customer of resolution); and\n- close complaint (log complaint resolution, etc.).\n\nA knowledge portal can be a good resource for customer service staff, containing FAQs that are updated based upon questions received from customers.\n\nCustomer service staff training should be repeated periodically, and the content of the training course should be updated as the service changes and evolves. \n\nComplex issues requiring higher levels of support should be addressed through second-level customer service personnel, who should have more advanced training - refer to 7.2.1.2.\n\nTo ensure effective complaint management, providers should monitor the performance of staff in addressing and resolving customer complaints."},{"$f":"'7'!H16","v":0},{"$f":"'7'!I16","v":"7.1.1.6.1"},{"$f":"'7'!J16","v":"7.1.1.6.1: Are customer service staff trained to deal with a range of issues that customers may complain about?\n"},{"$f":"'7'!K16","v":"1) Customer service training documentation\n - Check that records of trained customer service staff show that all have been trained).\n - Check that training dates are within the last two years\n - Check that training covers a range of issues that customers may complain about."},{"$f":"'7'!L16","v":0},{"$f":"'7'!M16","v":"Standard Required"},{"$f":"'7'!N16","v":"Required"},{"$f":"'7'!O16","v":"CustServ"},{"$f":"'7'!P16","v":0},{"$f":"'7'!Q16","v":0},{"$f":"'7'!R16","v":0},{"$f":"'7'!S16","v":0},{"$f":"'7'!T16","v":0},{"$f":"'7'!U16","v":0},{"$f":"'7'!V16","v":0},{"$f":"'7'!W16","v":0},{"$f":"'7'!X16","v":0},{"$f":"'7'!Y16","v":0},{"$f":"'7'!Z16","v":0},{"$f":"'7'!AA16","v":0},{"$f":"'7'!AB16","v":0},{"$f":"'7'!AC16","v":0},{"$f":"'7'!AD16","v":0},{"$f":"'7'!AE16","v":0},{"$f":"'7'!AF16","v":0},{"$f":"'7'!AG16","v":0},{"$f":"'7'!AH16","v":0},{"$f":"'7'!AI16","v":0},{"$f":"'7'!AJ16","v":0},{"$f":"'7'!AK16","v":0},{"$f":"'7'!AL16","v":0},{"$f":"'7'!AM16","v":0},{"$f":"'7'!AN16","v":0},{"$f":"'7'!AO16","v":0},{"$f":"'7'!AP16","v":0},{"$f":"'7'!AQ16","v":0},{"$f":"'7'!AR16","v":0},{"$f":"'7'!AS16","v":0},{"$f":"'7'!AT16","v":0},{"$f":"SUMPRODUCT(IF($N538=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N538=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B17","v":"7"},{"$f":"'7'!C17","v":"7.1"},{"$f":"'7'!D17","v":"7.1.1"},{"$f":"'7'!E17","v":""},{"$f":"'7'!F17","v":"7.1.1.6"},{"$f":"'7'!G17","v":0},{"$f":"'7'!H17","v":0},{"$f":"'7'!I17","v":"7.1.1.6.2"},{"$f":"'7'!J17","v":"7.1.1.6.2: Does training for complaints management staff encompass the full lifecycle of complaint management, including initial contact with complainants, analysis of the complaint, resolution, logging the call and closure?\n"},{"$f":"'7'!K17","v":"1) Customer service training documentation \n- Check it contains training at least:\na) initial contact with complainants, \nb) initiating analysis of complaints \nc) resolution, \nd) logging the call and closure"},{"$f":"'7'!L17","v":0},{"$f":"'7'!M17","v":"Standard Required"},{"$f":"'7'!N17","v":"Required"},{"$f":"'7'!O17","v":"CustServ"},{"$f":"'7'!P17","v":0},{"$f":"'7'!Q17","v":0},{"$f":"'7'!R17","v":0},{"$f":"'7'!S17","v":0},{"$f":"'7'!T17","v":0},{"$f":"'7'!U17","v":0},{"$f":"'7'!V17","v":0},{"$f":"'7'!W17","v":0},{"$f":"'7'!X17","v":0},{"$f":"'7'!Y17","v":0},{"$f":"'7'!Z17","v":0},{"$f":"'7'!AA17","v":0},{"$f":"'7'!AB17","v":0},{"$f":"'7'!AC17","v":0},{"$f":"'7'!AD17","v":0},{"$f":"'7'!AE17","v":0},{"$f":"'7'!AF17","v":0},{"$f":"'7'!AG17","v":0},{"$f":"'7'!AH17","v":0},{"$f":"'7'!AI17","v":0},{"$f":"'7'!AJ17","v":0},{"$f":"'7'!AK17","v":0},{"$f":"'7'!AL17","v":0},{"$f":"'7'!AM17","v":0},{"$f":"'7'!AN17","v":0},{"$f":"'7'!AO17","v":0},{"$f":"'7'!AP17","v":0},{"$f":"'7'!AQ17","v":0},{"$f":"'7'!AR17","v":0},{"$f":"'7'!AS17","v":0},{"$f":"'7'!AT17","v":0},{"$f":"SUMPRODUCT(IF($N539=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N539=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B18","v":"7"},{"$f":"'7'!C18","v":"7.1"},{"$f":"'7'!D18","v":"7.1.1"},{"$f":"'7'!E18","v":""},{"$f":"'7'!F18","v":"7.1.1.6"},{"$f":"'7'!G18","v":0},{"$f":"'7'!H18","v":0},{"$f":"'7'!I18","v":"7.1.1.6.3"},{"$f":"'7'!J18","v":"7.1.1.6.3: Is staff training repeated periodically, with training content updated as the service changes and evolves?\n"},{"$f":"'7'!K18","v":0},{"$f":"'7'!L18","v":0},{"$f":"'7'!M18","v":"Recommended"},{"$f":"'7'!N18","v":"Recommended"},{"$f":"'7'!O18","v":"CustServ"},{"$f":"'7'!P18","v":0},{"$f":"'7'!Q18","v":0},{"$f":"'7'!R18","v":0},{"$f":"'7'!S18","v":0},{"$f":"'7'!T18","v":0},{"$f":"'7'!U18","v":0},{"$f":"'7'!V18","v":0},{"$f":"'7'!W18","v":0},{"$f":"'7'!X18","v":0},{"$f":"'7'!Y18","v":0},{"$f":"'7'!Z18","v":0},{"$f":"'7'!AA18","v":0},{"$f":"'7'!AB18","v":0},{"$f":"'7'!AC18","v":0},{"$f":"'7'!AD18","v":0},{"$f":"'7'!AE18","v":0},{"$f":"'7'!AF18","v":0},{"$f":"'7'!AG18","v":0},{"$f":"'7'!AH18","v":0},{"$f":"'7'!AI18","v":0},{"$f":"'7'!AJ18","v":0},{"$f":"'7'!AK18","v":0},{"$f":"'7'!AL18","v":0},{"$f":"'7'!AM18","v":0},{"$f":"'7'!AN18","v":0},{"$f":"'7'!AO18","v":0},{"$f":"'7'!AP18","v":0},{"$f":"'7'!AQ18","v":0},{"$f":"'7'!AR18","v":0},{"$f":"'7'!AS18","v":0},{"$f":"'7'!AT18","v":0},{"$f":"SUMPRODUCT(IF($N540=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N540=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B19","v":"7"},{"$f":"'7'!C19","v":"7.1"},{"$f":"'7'!D19","v":"7.1.1"},{"$f":"'7'!E19","v":""},{"$f":"'7'!F19","v":"7.1.1.6"},{"$f":"'7'!G19","v":0},{"$f":"'7'!H19","v":0},{"$f":"'7'!I19","v":"7.1.1.6.4"},{"$f":"'7'!J19","v":"7.1.1.6.4: Is the performance of complaints management staff regularly monitored?\n"},{"$f":"'7'!K19","v":0},{"$f":"'7'!L19","v":0},{"$f":"'7'!M19","v":"Recommended"},{"$f":"'7'!N19","v":"Recommended"},{"$f":"'7'!O19","v":"CustServ"},{"$f":"'7'!P19","v":0},{"$f":"'7'!Q19","v":0},{"$f":"'7'!R19","v":0},{"$f":"'7'!S19","v":0},{"$f":"'7'!T19","v":0},{"$f":"'7'!U19","v":0},{"$f":"'7'!V19","v":0},{"$f":"'7'!W19","v":0},{"$f":"'7'!X19","v":0},{"$f":"'7'!Y19","v":0},{"$f":"'7'!Z19","v":0},{"$f":"'7'!AA19","v":0},{"$f":"'7'!AB19","v":0},{"$f":"'7'!AC19","v":0},{"$f":"'7'!AD19","v":0},{"$f":"'7'!AE19","v":0},{"$f":"'7'!AF19","v":0},{"$f":"'7'!AG19","v":0},{"$f":"'7'!AH19","v":0},{"$f":"'7'!AI19","v":0},{"$f":"'7'!AJ19","v":0},{"$f":"'7'!AK19","v":0},{"$f":"'7'!AL19","v":0},{"$f":"'7'!AM19","v":0},{"$f":"'7'!AN19","v":0},{"$f":"'7'!AO19","v":0},{"$f":"'7'!AP19","v":0},{"$f":"'7'!AQ19","v":0},{"$f":"'7'!AR19","v":0},{"$f":"'7'!AS19","v":0},{"$f":"'7'!AT19","v":0},{"$f":"SUMPRODUCT(IF($N541=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N541=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B20","v":"7"},{"$f":"'7'!C20","v":"7.1"},{"$f":"'7'!D20","v":"7.1.1"},{"$f":"'7'!E20","v":""},{"$f":"'7'!F20","v":"7.1.1.7"},{"$f":"'7'!G20","v":"7.1.1.7: RECORDING COMPLAINTS\nProviders should keep detailed records of complaints made by customers, including\n- detailed information about the nature of the complaint;\n- actions taken to address the complaint; \n- any escalations raised during the complaints process; and \n- how the complaint was ultimately resolved. \n\nThe head of customer service should receive reports on customer complaints to analyse complaints and resolutions according to the type of complaint."},{"$f":"'7'!H20","v":0},{"$f":"'7'!I20","v":"7.1.1.7.1"},{"$f":"'7'!J20","v":"7.1.1.7.1: Are detailed records of customer complaints maintained?\n"},{"$f":"'7'!K20","v":"1) Customer service call records for the last month.\n- Check that the customer service call records for the last month exist and appear complete."},{"$f":"'7'!L20","v":0},{"$f":"'7'!M20","v":"Standard Required"},{"$f":"'7'!N20","v":"Required"},{"$f":"'7'!O20","v":"CustServ"},{"$f":"'7'!P20","v":0},{"$f":"'7'!Q20","v":0},{"$f":"'7'!R20","v":0},{"$f":"'7'!S20","v":0},{"$f":"'7'!T20","v":0},{"$f":"'7'!U20","v":0},{"$f":"'7'!V20","v":0},{"$f":"'7'!W20","v":0},{"$f":"'7'!X20","v":0},{"$f":"'7'!Y20","v":0},{"$f":"'7'!Z20","v":0},{"$f":"'7'!AA20","v":0},{"$f":"'7'!AB20","v":0},{"$f":"'7'!AC20","v":0},{"$f":"'7'!AD20","v":0},{"$f":"'7'!AE20","v":0},{"$f":"'7'!AF20","v":0},{"$f":"'7'!AG20","v":0},{"$f":"'7'!AH20","v":0},{"$f":"'7'!AI20","v":0},{"$f":"'7'!AJ20","v":0},{"$f":"'7'!AK20","v":0},{"$f":"'7'!AL20","v":0},{"$f":"'7'!AM20","v":0},{"$f":"'7'!AN20","v":0},{"$f":"'7'!AO20","v":0},{"$f":"'7'!AP20","v":0},{"$f":"'7'!AQ20","v":0},{"$f":"'7'!AR20","v":0},{"$f":"'7'!AS20","v":0},{"$f":"'7'!AT20","v":0},{"$f":"SUMPRODUCT(IF($N542=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N542=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B21","v":"7"},{"$f":"'7'!C21","v":"7.1"},{"$f":"'7'!D21","v":"7.1.1"},{"$f":"'7'!E21","v":""},{"$f":"'7'!F21","v":"7.1.1.7"},{"$f":"'7'!G21","v":0},{"$f":"'7'!H21","v":0},{"$f":"'7'!I21","v":"7.1.1.7.2"},{"$f":"'7'!J21","v":"7.1.1.7.2: Do complaint records include all of the following\n"},{"$f":"'7'!K21","v":0},{"$f":"'7'!L21","v":0},{"$f":"'7'!M21","v":"Recommended"},{"$f":"'7'!N21","v":"Recommended"},{"$f":"'7'!O21","v":"CustServ"},{"$f":"'7'!P21","v":0},{"$f":"'7'!Q21","v":0},{"$f":"'7'!R21","v":0},{"$f":"'7'!S21","v":0},{"$f":"'7'!T21","v":0},{"$f":"'7'!U21","v":0},{"$f":"'7'!V21","v":0},{"$f":"'7'!W21","v":0},{"$f":"'7'!X21","v":0},{"$f":"'7'!Y21","v":0},{"$f":"'7'!Z21","v":0},{"$f":"'7'!AA21","v":0},{"$f":"'7'!AB21","v":0},{"$f":"'7'!AC21","v":0},{"$f":"'7'!AD21","v":0},{"$f":"'7'!AE21","v":0},{"$f":"'7'!AF21","v":0},{"$f":"'7'!AG21","v":0},{"$f":"'7'!AH21","v":0},{"$f":"'7'!AI21","v":0},{"$f":"'7'!AJ21","v":0},{"$f":"'7'!AK21","v":0},{"$f":"'7'!AL21","v":0},{"$f":"'7'!AM21","v":0},{"$f":"'7'!AN21","v":0},{"$f":"'7'!AO21","v":0},{"$f":"'7'!AP21","v":0},{"$f":"'7'!AQ21","v":0},{"$f":"'7'!AR21","v":0},{"$f":"'7'!AS21","v":0},{"$f":"'7'!AT21","v":0},{"$f":"SUMPRODUCT(IF($N543=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N543=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B22","v":"7"},{"$f":"'7'!C22","v":"7.1"},{"$f":"'7'!D22","v":"7.1.1"},{"$f":"'7'!E22","v":""},{"$f":"'7'!F22","v":"7.1.1.7"},{"$f":"'7'!G22","v":0},{"$f":"'7'!H22","v":0},{"$f":"'7'!I22","v":"7.1.1.7.3"},{"$f":"'7'!J22","v":"7.1.1.7.3: Does the head of customer service receive reports on customer complaints to analyse complaints and resolutions according to the type of complaint?\n"},{"$f":"'7'!K22","v":0},{"$f":"'7'!L22","v":0},{"$f":"'7'!M22","v":"Recommended"},{"$f":"'7'!N22","v":"Recommended"},{"$f":"'7'!O22","v":"CustServ"},{"$f":"'7'!P22","v":0},{"$f":"'7'!Q22","v":0},{"$f":"'7'!R22","v":0},{"$f":"'7'!S22","v":0},{"$f":"'7'!T22","v":0},{"$f":"'7'!U22","v":0},{"$f":"'7'!V22","v":0},{"$f":"'7'!W22","v":0},{"$f":"'7'!X22","v":0},{"$f":"'7'!Y22","v":0},{"$f":"'7'!Z22","v":0},{"$f":"'7'!AA22","v":0},{"$f":"'7'!AB22","v":0},{"$f":"'7'!AC22","v":0},{"$f":"'7'!AD22","v":0},{"$f":"'7'!AE22","v":0},{"$f":"'7'!AF22","v":0},{"$f":"'7'!AG22","v":0},{"$f":"'7'!AH22","v":0},{"$f":"'7'!AI22","v":0},{"$f":"'7'!AJ22","v":0},{"$f":"'7'!AK22","v":0},{"$f":"'7'!AL22","v":0},{"$f":"'7'!AM22","v":0},{"$f":"'7'!AN22","v":0},{"$f":"'7'!AO22","v":0},{"$f":"'7'!AP22","v":0},{"$f":"'7'!AQ22","v":0},{"$f":"'7'!AR22","v":0},{"$f":"'7'!AS22","v":0},{"$f":"'7'!AT22","v":0},{"$f":"SUMPRODUCT(IF($N544=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N544=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B23","v":"7"},{"$f":"'7'!C23","v":"7.1"},{"$f":"'7'!D23","v":"7.1.2"},{"$f":"'7'!E23","v":"7.1.2: Providers shall inform customers of customer service policies and procedures"},{"$f":"'7'!F23","v":"7.1.2.1"},{"$f":"'7'!G23","v":"7.1.2.1: INFORMING CUSTOMERS OF COMPLAINT POLICIES AND PROCEDURES\nThe methods for contacting customer care (e.g. phone number, electronic communication) should be advertised at agents and other points of service (e.g. on posters, brochures, etc.) and through the customer's mobile phone, for example as a separate menu item on USSD, Web & STK menus.\n\nAgents and staff involved in account opening should be trained to inform customers of complaint and escalation procedures both upon account opening and in the event of a complaint.\n\nCustomer care staff should be trained to inform customers of the quality of service that they should expect in the management of their complaints. (For example, providers should describe how the complaint will be addressed and specify the maximum time that customers should expect to wait for a response.)\n"},{"$f":"'7'!H23","v":0},{"$f":"'7'!I23","v":"7.1.2.1.1"},{"$f":"'7'!J23","v":"7.1.2.1.1: Are the methods for contacting customer care clearly advertised to customers - e.g. at agents and other points of service, or on posters?\n"},{"$f":"'7'!K23","v":"1) Agent outlet advertising plan or customer communications plan\n- Check the agent/comms/point of sale material includes details of how customer can contact customer care\n- Check there is a process to ensure agents have all appropriate point of sale material\n"},{"$f":"'7'!L23","v":0},{"$f":"'7'!M23","v":"Urgent Required"},{"$f":"'7'!N23","v":"Required"},{"$f":"'7'!O23","v":"CustServ"},{"$f":"'7'!P23","v":0},{"$f":"'7'!Q23","v":0},{"$f":"'7'!R23","v":0},{"$f":"'7'!S23","v":0},{"$f":"'7'!T23","v":0},{"$f":"'7'!U23","v":0},{"$f":"'7'!V23","v":0},{"$f":"'7'!W23","v":0},{"$f":"'7'!X23","v":0},{"$f":"'7'!Y23","v":0},{"$f":"'7'!Z23","v":0},{"$f":"'7'!AA23","v":0},{"$f":"'7'!AB23","v":0},{"$f":"'7'!AC23","v":0},{"$f":"'7'!AD23","v":0},{"$f":"'7'!AE23","v":0},{"$f":"'7'!AF23","v":0},{"$f":"'7'!AG23","v":0},{"$f":"'7'!AH23","v":0},{"$f":"'7'!AI23","v":0},{"$f":"'7'!AJ23","v":0},{"$f":"'7'!AK23","v":0},{"$f":"'7'!AL23","v":0},{"$f":"'7'!AM23","v":0},{"$f":"'7'!AN23","v":0},{"$f":"'7'!AO23","v":0},{"$f":"'7'!AP23","v":0},{"$f":"'7'!AQ23","v":0},{"$f":"'7'!AR23","v":0},{"$f":"'7'!AS23","v":0},{"$f":"'7'!AT23","v":0},{"$f":"SUMPRODUCT(IF($N545=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N545=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B24","v":"7"},{"$f":"'7'!C24","v":"7.1"},{"$f":"'7'!D24","v":"7.1.2"},{"$f":"'7'!E24","v":0},{"$f":"'7'!F24","v":"7.1.2.1"},{"$f":"'7'!G24","v":0},{"$f":"'7'!H24","v":0},{"$f":"'7'!I24","v":"7.1.2.1.2"},{"$f":"'7'!J24","v":"7.1.2.1.2: Are customers informed of customer service channels / procedures upon account opening?\n"},{"$f":"'7'!K24","v":"1) Registering-agent training materials or customer registration handout\n- Check that customers are informed of customer service channels / procedures upon account opening."},{"$f":"'7'!L24","v":0},{"$f":"'7'!M24","v":"Standard Required"},{"$f":"'7'!N24","v":"Required"},{"$f":"'7'!O24","v":"CustServ"},{"$f":"'7'!P24","v":0},{"$f":"'7'!Q24","v":0},{"$f":"'7'!R24","v":0},{"$f":"'7'!S24","v":0},{"$f":"'7'!T24","v":0},{"$f":"'7'!U24","v":0},{"$f":"'7'!V24","v":0},{"$f":"'7'!W24","v":0},{"$f":"'7'!X24","v":0},{"$f":"'7'!Y24","v":0},{"$f":"'7'!Z24","v":0},{"$f":"'7'!AA24","v":0},{"$f":"'7'!AB24","v":0},{"$f":"'7'!AC24","v":0},{"$f":"'7'!AD24","v":0},{"$f":"'7'!AE24","v":0},{"$f":"'7'!AF24","v":0},{"$f":"'7'!AG24","v":0},{"$f":"'7'!AH24","v":0},{"$f":"'7'!AI24","v":0},{"$f":"'7'!AJ24","v":0},{"$f":"'7'!AK24","v":0},{"$f":"'7'!AL24","v":0},{"$f":"'7'!AM24","v":0},{"$f":"'7'!AN24","v":0},{"$f":"'7'!AO24","v":0},{"$f":"'7'!AP24","v":0},{"$f":"'7'!AQ24","v":0},{"$f":"'7'!AR24","v":0},{"$f":"'7'!AS24","v":0},{"$f":"'7'!AT24","v":0},{"$f":"SUMPRODUCT(IF($N546=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N546=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B25","v":"7"},{"$f":"'7'!C25","v":"7.1"},{"$f":"'7'!D25","v":"7.1.2"},{"$f":"'7'!E25","v":""},{"$f":"'7'!F25","v":"7.1.2.1"},{"$f":"'7'!G25","v":0},{"$f":"'7'!H25","v":0},{"$f":"'7'!I25","v":"7.1.2.1.3"},{"$f":"'7'!J25","v":"7.1.2.1.3: Is a description of the external recourse options included in the customer terms & conditions or customer contract?\n"},{"$f":"'7'!K25","v":"1) Customer T&Cs or customer contract\n- Check the document includes when and how to escalate complaints to external authorities after exhausting the provider's resolution process."},{"$f":"'7'!L25","v":0},{"$f":"'7'!M25","v":"Standard Required"},{"$f":"'7'!N25","v":"Required"},{"$f":"'7'!O25","v":"CustServ"},{"$f":"'7'!P25","v":0},{"$f":"'7'!Q25","v":0},{"$f":"'7'!R25","v":0},{"$f":"'7'!S25","v":0},{"$f":"'7'!T25","v":0},{"$f":"'7'!U25","v":0},{"$f":"'7'!V25","v":0},{"$f":"'7'!W25","v":0},{"$f":"'7'!X25","v":0},{"$f":"'7'!Y25","v":0},{"$f":"'7'!Z25","v":0},{"$f":"'7'!AA25","v":0},{"$f":"'7'!AB25","v":0},{"$f":"'7'!AC25","v":0},{"$f":"'7'!AD25","v":0},{"$f":"'7'!AE25","v":0},{"$f":"'7'!AF25","v":0},{"$f":"'7'!AG25","v":0},{"$f":"'7'!AH25","v":0},{"$f":"'7'!AI25","v":0},{"$f":"'7'!AJ25","v":0},{"$f":"'7'!AK25","v":0},{"$f":"'7'!AL25","v":0},{"$f":"'7'!AM25","v":0},{"$f":"'7'!AN25","v":0},{"$f":"'7'!AO25","v":0},{"$f":"'7'!AP25","v":0},{"$f":"'7'!AQ25","v":0},{"$f":"'7'!AR25","v":0},{"$f":"'7'!AS25","v":0},{"$f":"'7'!AT25","v":0},{"$f":"SUMPRODUCT(IF($N547=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N547=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B26","v":"7"},{"$f":"'7'!C26","v":"7.1"},{"$f":"'7'!D26","v":"7.1.2"},{"$f":"'7'!E26","v":0},{"$f":"'7'!F26","v":"7.1.2.1"},{"$f":"'7'!G26","v":0},{"$f":"'7'!H26","v":0},{"$f":"'7'!I26","v":"7.1.2.1.4"},{"$f":"'7'!J26","v":"7.1.2.1.4: Do handset menus provide contact details for customer support?\n"},{"$f":"'7'!K26","v":0},{"$f":"'7'!L26","v":0},{"$f":"'7'!M26","v":"Recommended"},{"$f":"'7'!N26","v":"Recommended"},{"$f":"'7'!O26","v":"CustServ"},{"$f":"'7'!P26","v":0},{"$f":"'7'!Q26","v":0},{"$f":"'7'!R26","v":0},{"$f":"'7'!S26","v":0},{"$f":"'7'!T26","v":0},{"$f":"'7'!U26","v":0},{"$f":"'7'!V26","v":0},{"$f":"'7'!W26","v":0},{"$f":"'7'!X26","v":0},{"$f":"'7'!Y26","v":0},{"$f":"'7'!Z26","v":0},{"$f":"'7'!AA26","v":0},{"$f":"'7'!AB26","v":0},{"$f":"'7'!AC26","v":0},{"$f":"'7'!AD26","v":0},{"$f":"'7'!AE26","v":0},{"$f":"'7'!AF26","v":0},{"$f":"'7'!AG26","v":0},{"$f":"'7'!AH26","v":0},{"$f":"'7'!AI26","v":0},{"$f":"'7'!AJ26","v":0},{"$f":"'7'!AK26","v":0},{"$f":"'7'!AL26","v":0},{"$f":"'7'!AM26","v":0},{"$f":"'7'!AN26","v":0},{"$f":"'7'!AO26","v":0},{"$f":"'7'!AP26","v":0},{"$f":"'7'!AQ26","v":0},{"$f":"'7'!AR26","v":0},{"$f":"'7'!AS26","v":0},{"$f":"'7'!AT26","v":0},{"$f":"SUMPRODUCT(IF($N548=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N548=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B27","v":"7"},{"$f":"'7'!C27","v":"7.1"},{"$f":"'7'!D27","v":"7.1.2"},{"$f":"'7'!E27","v":0},{"$f":"'7'!F27","v":"7.1.2.1"},{"$f":"'7'!G27","v":0},{"$f":"'7'!H27","v":0},{"$f":"'7'!I27","v":"7.1.2.1.5"},{"$f":"'7'!J27","v":"7.1.2.1.5: Are customers informed how and when to escalate complaints to more senior staff?\n"},{"$f":"'7'!K27","v":0},{"$f":"'7'!L27","v":0},{"$f":"'7'!M27","v":"Recommended"},{"$f":"'7'!N27","v":"Recommended"},{"$f":"'7'!O27","v":"CustServ"},{"$f":"'7'!P27","v":0},{"$f":"'7'!Q27","v":0},{"$f":"'7'!R27","v":0},{"$f":"'7'!S27","v":0},{"$f":"'7'!T27","v":0},{"$f":"'7'!U27","v":0},{"$f":"'7'!V27","v":0},{"$f":"'7'!W27","v":0},{"$f":"'7'!X27","v":0},{"$f":"'7'!Y27","v":0},{"$f":"'7'!Z27","v":0},{"$f":"'7'!AA27","v":0},{"$f":"'7'!AB27","v":0},{"$f":"'7'!AC27","v":0},{"$f":"'7'!AD27","v":0},{"$f":"'7'!AE27","v":0},{"$f":"'7'!AF27","v":0},{"$f":"'7'!AG27","v":0},{"$f":"'7'!AH27","v":0},{"$f":"'7'!AI27","v":0},{"$f":"'7'!AJ27","v":0},{"$f":"'7'!AK27","v":0},{"$f":"'7'!AL27","v":0},{"$f":"'7'!AM27","v":0},{"$f":"'7'!AN27","v":0},{"$f":"'7'!AO27","v":0},{"$f":"'7'!AP27","v":0},{"$f":"'7'!AQ27","v":0},{"$f":"'7'!AR27","v":0},{"$f":"'7'!AS27","v":0},{"$f":"'7'!AT27","v":0},{"$f":"SUMPRODUCT(IF($N549=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N549=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B28","v":"7"},{"$f":"'7'!C28","v":"7.1"},{"$f":"'7'!D28","v":"7.1.2"},{"$f":"'7'!E28","v":0},{"$f":"'7'!F28","v":"7.1.2.1"},{"$f":"'7'!G28","v":0},{"$f":"'7'!H28","v":0},{"$f":"'7'!I28","v":"7.1.2.1.6"},{"$f":"'7'!J28","v":"7.1.2.1.6: Do customer care staff make clear to customers the quality of service that they should expect in the management of their complaints, including how the complaint will be addressed and the maximum time that customers should expect to wait for a resolution?\n"},{"$f":"'7'!K28","v":0},{"$f":"'7'!L28","v":0},{"$f":"'7'!M28","v":"Recommended"},{"$f":"'7'!N28","v":"Recommended"},{"$f":"'7'!O28","v":"CustServ"},{"$f":"'7'!P28","v":0},{"$f":"'7'!Q28","v":0},{"$f":"'7'!R28","v":0},{"$f":"'7'!S28","v":0},{"$f":"'7'!T28","v":0},{"$f":"'7'!U28","v":0},{"$f":"'7'!V28","v":0},{"$f":"'7'!W28","v":0},{"$f":"'7'!X28","v":0},{"$f":"'7'!Y28","v":0},{"$f":"'7'!Z28","v":0},{"$f":"'7'!AA28","v":0},{"$f":"'7'!AB28","v":0},{"$f":"'7'!AC28","v":0},{"$f":"'7'!AD28","v":0},{"$f":"'7'!AE28","v":0},{"$f":"'7'!AF28","v":0},{"$f":"'7'!AG28","v":0},{"$f":"'7'!AH28","v":0},{"$f":"'7'!AI28","v":0},{"$f":"'7'!AJ28","v":0},{"$f":"'7'!AK28","v":0},{"$f":"'7'!AL28","v":0},{"$f":"'7'!AM28","v":0},{"$f":"'7'!AN28","v":0},{"$f":"'7'!AO28","v":0},{"$f":"'7'!AP28","v":0},{"$f":"'7'!AQ28","v":0},{"$f":"'7'!AR28","v":0},{"$f":"'7'!AS28","v":0},{"$f":"'7'!AT28","v":0},{"$f":"SUMPRODUCT(IF($N550=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N550=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B29","v":"7"},{"$f":"'7'!C29","v":"7.1"},{"$f":"'7'!D29","v":"7.1.2"},{"$f":"'7'!E29","v":""},{"$f":"'7'!F29","v":"7.1.2.2"},{"$f":"'7'!G29","v":"7.1.2.2: CHANGES TO COMPLAINT PROCEDURES\nAll changes to complaint handling procedures and timeframes should be updated in the Terms & Conditions and clearly communicated to customers before the changes take effect."},{"$f":"'7'!H29","v":0},{"$f":"'7'!I29","v":"7.1.2.2.1"},{"$f":"'7'!J29","v":"7.1.2.2.1: Are all changes to complaint handling procedures and timeframes updated in the T&Cs?\n"},{"$f":"'7'!K29","v":0},{"$f":"'7'!L29","v":0},{"$f":"'7'!M29","v":"Recommended"},{"$f":"'7'!N29","v":"Recommended"},{"$f":"'7'!O29","v":"CustServ"},{"$f":"'7'!P29","v":0},{"$f":"'7'!Q29","v":0},{"$f":"'7'!R29","v":0},{"$f":"'7'!S29","v":0},{"$f":"'7'!T29","v":0},{"$f":"'7'!U29","v":0},{"$f":"'7'!V29","v":0},{"$f":"'7'!W29","v":0},{"$f":"'7'!X29","v":0},{"$f":"'7'!Y29","v":0},{"$f":"'7'!Z29","v":0},{"$f":"'7'!AA29","v":0},{"$f":"'7'!AB29","v":0},{"$f":"'7'!AC29","v":0},{"$f":"'7'!AD29","v":0},{"$f":"'7'!AE29","v":0},{"$f":"'7'!AF29","v":0},{"$f":"'7'!AG29","v":0},{"$f":"'7'!AH29","v":0},{"$f":"'7'!AI29","v":0},{"$f":"'7'!AJ29","v":0},{"$f":"'7'!AK29","v":0},{"$f":"'7'!AL29","v":0},{"$f":"'7'!AM29","v":0},{"$f":"'7'!AN29","v":0},{"$f":"'7'!AO29","v":0},{"$f":"'7'!AP29","v":0},{"$f":"'7'!AQ29","v":0},{"$f":"'7'!AR29","v":0},{"$f":"'7'!AS29","v":0},{"$f":"'7'!AT29","v":0},{"$f":"SUMPRODUCT(IF($N551=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N551=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B30","v":"7"},{"$f":"'7'!C30","v":"7.1"},{"$f":"'7'!D30","v":"7.1.2"},{"$f":"'7'!E30","v":""},{"$f":"'7'!F30","v":"7.1.2.2"},{"$f":"'7'!G30","v":0},{"$f":"'7'!H30","v":0},{"$f":"'7'!I30","v":"7.1.2.2.2"},{"$f":"'7'!J30","v":"7.1.2.2.2: Are all changes to complaint handling procedures and timeframes communicated to customers before they take effect?\n"},{"$f":"'7'!K30","v":0},{"$f":"'7'!L30","v":0},{"$f":"'7'!M30","v":"Recommended"},{"$f":"'7'!N30","v":"Recommended"},{"$f":"'7'!O30","v":"CustServ"},{"$f":"'7'!P30","v":0},{"$f":"'7'!Q30","v":0},{"$f":"'7'!R30","v":0},{"$f":"'7'!S30","v":0},{"$f":"'7'!T30","v":0},{"$f":"'7'!U30","v":0},{"$f":"'7'!V30","v":0},{"$f":"'7'!W30","v":0},{"$f":"'7'!X30","v":0},{"$f":"'7'!Y30","v":0},{"$f":"'7'!Z30","v":0},{"$f":"'7'!AA30","v":0},{"$f":"'7'!AB30","v":0},{"$f":"'7'!AC30","v":0},{"$f":"'7'!AD30","v":0},{"$f":"'7'!AE30","v":0},{"$f":"'7'!AF30","v":0},{"$f":"'7'!AG30","v":0},{"$f":"'7'!AH30","v":0},{"$f":"'7'!AI30","v":0},{"$f":"'7'!AJ30","v":0},{"$f":"'7'!AK30","v":0},{"$f":"'7'!AL30","v":0},{"$f":"'7'!AM30","v":0},{"$f":"'7'!AN30","v":0},{"$f":"'7'!AO30","v":0},{"$f":"'7'!AP30","v":0},{"$f":"'7'!AQ30","v":0},{"$f":"'7'!AR30","v":0},{"$f":"'7'!AS30","v":0},{"$f":"'7'!AT30","v":0},{"$f":"SUMPRODUCT(IF($N552=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N552=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B31","v":"7"},{"$f":"'7'!C31","v":"7.1"},{"$f":"'7'!D31","v":"7.1.3"},{"$f":"'7'!E31","v":"7.1.3: Providers shall develop specific policies for handling reversals"},{"$f":"'7'!F31","v":"7.1.3.1"},{"$f":"'7'!G31","v":"7.1.3.1: TRANSACTION REVERSALS - POLICY\nProviders should develop a detailed policy for the management of transaction reversals, including:\n- the scenarios and transaction types which are valid for reversal\n- the procedures for handling transaction reversals; \n- the rules that apply to reversals (e.g. whether to refund fees).\n\nThe policy should be regularly updated to ensure:\n- compliance with applicable regulations, which may change over time; and\n- that customers are satisfied with the transaction reversal process.\n\nPolicy should specify that reversals will be authorised where the provider is at fault for a transaction that should not have occurred."},{"$f":"'7'!H31","v":"GSMA RMT"},{"$f":"'7'!I31","v":"7.1.3.1.1"},{"$f":"'7'!J31","v":"7.1.3.1.1: Is there a policy for the management of transaction reversals, and is it kept updated as new transaction types are developed?\n"},{"$f":"'7'!K31","v":"1) Reversals policy or process\n- Check there is a  policy/process for the management of reversals,\n- Check the policy/process has been revised in the last 24 months."},{"$f":"'7'!L31","v":0},{"$f":"'7'!M31","v":"Urgent Required"},{"$f":"'7'!N31","v":"Required"},{"$f":"'7'!O31","v":"CustServ"},{"$f":"'7'!P31","v":0},{"$f":"'7'!Q31","v":0},{"$f":"'7'!R31","v":0},{"$f":"'7'!S31","v":0},{"$f":"'7'!T31","v":0},{"$f":"'7'!U31","v":0},{"$f":"'7'!V31","v":0},{"$f":"'7'!W31","v":0},{"$f":"'7'!X31","v":0},{"$f":"'7'!Y31","v":0},{"$f":"'7'!Z31","v":0},{"$f":"'7'!AA31","v":0},{"$f":"'7'!AB31","v":0},{"$f":"'7'!AC31","v":0},{"$f":"'7'!AD31","v":0},{"$f":"'7'!AE31","v":0},{"$f":"'7'!AF31","v":0},{"$f":"'7'!AG31","v":0},{"$f":"'7'!AH31","v":0},{"$f":"'7'!AI31","v":0},{"$f":"'7'!AJ31","v":0},{"$f":"'7'!AK31","v":0},{"$f":"'7'!AL31","v":0},{"$f":"'7'!AM31","v":0},{"$f":"'7'!AN31","v":0},{"$f":"'7'!AO31","v":0},{"$f":"'7'!AP31","v":0},{"$f":"'7'!AQ31","v":0},{"$f":"'7'!AR31","v":0},{"$f":"'7'!AS31","v":0},{"$f":"'7'!AT31","v":0},{"$f":"SUMPRODUCT(IF($N553=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N553=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B32","v":"7"},{"$f":"'7'!C32","v":"7.1"},{"$f":"'7'!D32","v":"7.1.3"},{"$f":"'7'!E32","v":""},{"$f":"'7'!F32","v":"7.1.3.1"},{"$f":"'7'!G32","v":0},{"$f":"'7'!H32","v":0},{"$f":"'7'!I32","v":"7.1.3.1.2"},{"$f":"'7'!J32","v":"7.1.3.1.2: Is there a list of all transaction types can be reversed, explaining conditions for the reversal to be completed (e.g. time limit for raising reversal; funds available to be reversed)?\n"},{"$f":"'7'!K32","v":"1) Reversals policy or process\n- Check the policy/process identifies all customer transactions that may be reversed (and those that cannot be reversed).\n- Check the policy/process identifies all business transactions that may be reversed.\n- Check that the process includes conditions where transactions may be reversed, including time limits and how reversals are handled if the funds are no longer available."},{"$f":"'7'!L32","v":0},{"$f":"'7'!M32","v":"Urgent Required"},{"$f":"'7'!N32","v":"Required"},{"$f":"'7'!O32","v":"CustServ"},{"$f":"'7'!P32","v":0},{"$f":"'7'!Q32","v":0},{"$f":"'7'!R32","v":0},{"$f":"'7'!S32","v":0},{"$f":"'7'!T32","v":0},{"$f":"'7'!U32","v":0},{"$f":"'7'!V32","v":0},{"$f":"'7'!W32","v":0},{"$f":"'7'!X32","v":0},{"$f":"'7'!Y32","v":0},{"$f":"'7'!Z32","v":0},{"$f":"'7'!AA32","v":0},{"$f":"'7'!AB32","v":0},{"$f":"'7'!AC32","v":0},{"$f":"'7'!AD32","v":0},{"$f":"'7'!AE32","v":0},{"$f":"'7'!AF32","v":0},{"$f":"'7'!AG32","v":0},{"$f":"'7'!AH32","v":0},{"$f":"'7'!AI32","v":0},{"$f":"'7'!AJ32","v":0},{"$f":"'7'!AK32","v":0},{"$f":"'7'!AL32","v":0},{"$f":"'7'!AM32","v":0},{"$f":"'7'!AN32","v":0},{"$f":"'7'!AO32","v":0},{"$f":"'7'!AP32","v":0},{"$f":"'7'!AQ32","v":0},{"$f":"'7'!AR32","v":0},{"$f":"'7'!AS32","v":0},{"$f":"'7'!AT32","v":0},{"$f":"SUMPRODUCT(IF($N554=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N554=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B33","v":"7"},{"$f":"'7'!C33","v":"7.1"},{"$f":"'7'!D33","v":"7.1.3"},{"$f":"'7'!E33","v":""},{"$f":"'7'!F33","v":"7.1.3.1"},{"$f":"'7'!G33","v":0},{"$f":"'7'!H33","v":0},{"$f":"'7'!I33","v":"7.1.3.1.3"},{"$f":"'7'!J33","v":"7.1.3.1.3: Has it been determined whether fees/ commissions/ taxes will be reversed as part of each reversible transaction?\n"},{"$f":"'7'!K33","v":"1) Reversals policy or process\n- Check the policy/process identifies what, if any, fees/commissions/taxes are to be included in each reversal."},{"$f":"'7'!L33","v":0},{"$f":"'7'!M33","v":"Standard Required"},{"$f":"'7'!N33","v":"Required"},{"$f":"'7'!O33","v":"CustServ"},{"$f":"'7'!P33","v":0},{"$f":"'7'!Q33","v":0},{"$f":"'7'!R33","v":0},{"$f":"'7'!S33","v":0},{"$f":"'7'!T33","v":0},{"$f":"'7'!U33","v":0},{"$f":"'7'!V33","v":0},{"$f":"'7'!W33","v":0},{"$f":"'7'!X33","v":0},{"$f":"'7'!Y33","v":0},{"$f":"'7'!Z33","v":0},{"$f":"'7'!AA33","v":0},{"$f":"'7'!AB33","v":0},{"$f":"'7'!AC33","v":0},{"$f":"'7'!AD33","v":0},{"$f":"'7'!AE33","v":0},{"$f":"'7'!AF33","v":0},{"$f":"'7'!AG33","v":0},{"$f":"'7'!AH33","v":0},{"$f":"'7'!AI33","v":0},{"$f":"'7'!AJ33","v":0},{"$f":"'7'!AK33","v":0},{"$f":"'7'!AL33","v":0},{"$f":"'7'!AM33","v":0},{"$f":"'7'!AN33","v":0},{"$f":"'7'!AO33","v":0},{"$f":"'7'!AP33","v":0},{"$f":"'7'!AQ33","v":0},{"$f":"'7'!AR33","v":0},{"$f":"'7'!AS33","v":0},{"$f":"'7'!AT33","v":0},{"$f":"SUMPRODUCT(IF($N555=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N555=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B34","v":"7"},{"$f":"'7'!C34","v":"7.1"},{"$f":"'7'!D34","v":"7.1.3"},{"$f":"'7'!E34","v":0},{"$f":"'7'!F34","v":"7.1.3.1"},{"$f":"'7'!G34","v":0},{"$f":"'7'!H34","v":0},{"$f":"'7'!I34","v":"7.1.3.1.4"},{"$f":"'7'!J34","v":"7.1.3.1.4: Does the reversals policy specify that the provider will correct mistakes where the provider is at fault for a debit or transaction that should not have occurred (e.g. mistake by customer service staff or system error)?\n"},{"$f":"'7'!K34","v":"1) Reversals policy or process / Customer service process\n- Check the policy/process specifies that the provider will correct mistakes where the provider is at fault for a debit or transaction that should not have occurred (e.g. mistake by customer service staff or system error)"},{"$f":"'7'!L34","v":0},{"$f":"'7'!M34","v":"Standard Required"},{"$f":"'7'!N34","v":"Required"},{"$f":"'7'!O34","v":"CustServ"},{"$f":"'7'!P34","v":0},{"$f":"'7'!Q34","v":0},{"$f":"'7'!R34","v":0},{"$f":"'7'!S34","v":0},{"$f":"'7'!T34","v":0},{"$f":"'7'!U34","v":0},{"$f":"'7'!V34","v":0},{"$f":"'7'!W34","v":0},{"$f":"'7'!X34","v":0},{"$f":"'7'!Y34","v":0},{"$f":"'7'!Z34","v":0},{"$f":"'7'!AA34","v":0},{"$f":"'7'!AB34","v":0},{"$f":"'7'!AC34","v":0},{"$f":"'7'!AD34","v":0},{"$f":"'7'!AE34","v":0},{"$f":"'7'!AF34","v":0},{"$f":"'7'!AG34","v":0},{"$f":"'7'!AH34","v":0},{"$f":"'7'!AI34","v":0},{"$f":"'7'!AJ34","v":0},{"$f":"'7'!AK34","v":0},{"$f":"'7'!AL34","v":0},{"$f":"'7'!AM34","v":0},{"$f":"'7'!AN34","v":0},{"$f":"'7'!AO34","v":0},{"$f":"'7'!AP34","v":0},{"$f":"'7'!AQ34","v":0},{"$f":"'7'!AR34","v":0},{"$f":"'7'!AS34","v":0},{"$f":"'7'!AT34","v":0},{"$f":"SUMPRODUCT(IF($N556=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N556=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B35","v":"7"},{"$f":"'7'!C35","v":"7.1"},{"$f":"'7'!D35","v":"7.1.3"},{"$f":"'7'!E35","v":""},{"$f":"'7'!F35","v":"7.1.3.2"},{"$f":"'7'!G35","v":"7.1.3.2: TRANSACTION REVERSALS - PROCESS\nThe mobile money provider should implement the policy for handling transaction reversal requests from customers, agents, merchants, or other parties. This should be backed up by system workflow and business processes for common scenarios in which users may request a transaction to be reversed. \nThe following controls within the policy should be implemented:\n- Staff responsible for managing reversals should confirm that the transaction actually happened before reversal; \n- Providers should determine the appropriate reversal mechanism for cases where the amount sent or the receiver was mistyped;\n- Providers should approve by default reversal of transactions made to suspended/dormant/inactive accounts (because the sending party cannot directly obtain refund from the receiving party);\n- Providers should reverse transactions where the provider is at fault for a transaction that should not have occurred (e.g. system error);\n- Providers should take steps to avoid fraudulent reversals, particularly those related to agent and merchant transactions where cash or goods are exchanged (e.g. contact recipient to agree the reversal).\n\nProviders should set a budget for bearing the cost of reversals where the value is unrecoverable - It is often not possible for the provider to avoid absorbing the cost of making a reversal, so there should be a budget set for unrecoverable reversals.\n\nA process should be defined for when the reversals process cannot be resolved to the satisfaction of the customer, agent, merchant, or other party; this may require closing the case or referring the aggrieved party to external recourse mechanisms (see 7.3)."},{"$f":"'7'!H35","v":"GSMA RMT"},{"$f":"'7'!I35","v":"7.1.3.2.1"},{"$f":"'7'!J35","v":"7.1.3.2.1: Are processes defined for customer service staff to conduct reversals?\n"},{"$f":"'7'!K35","v":"1) Reversals business process\n- Check a reversal process is defined.\n- Check the reversal process includes all common transactions for which customers, agents, merchants, or other parties may request a reversal."},{"$f":"'7'!L35","v":0},{"$f":"'7'!M35","v":"Standard Required"},{"$f":"'7'!N35","v":"Required"},{"$f":"'7'!O35","v":"CustServ"},{"$f":"'7'!P35","v":0},{"$f":"'7'!Q35","v":0},{"$f":"'7'!R35","v":0},{"$f":"'7'!S35","v":0},{"$f":"'7'!T35","v":0},{"$f":"'7'!U35","v":0},{"$f":"'7'!V35","v":0},{"$f":"'7'!W35","v":0},{"$f":"'7'!X35","v":0},{"$f":"'7'!Y35","v":0},{"$f":"'7'!Z35","v":0},{"$f":"'7'!AA35","v":0},{"$f":"'7'!AB35","v":0},{"$f":"'7'!AC35","v":0},{"$f":"'7'!AD35","v":0},{"$f":"'7'!AE35","v":0},{"$f":"'7'!AF35","v":0},{"$f":"'7'!AG35","v":0},{"$f":"'7'!AH35","v":0},{"$f":"'7'!AI35","v":0},{"$f":"'7'!AJ35","v":0},{"$f":"'7'!AK35","v":0},{"$f":"'7'!AL35","v":0},{"$f":"'7'!AM35","v":0},{"$f":"'7'!AN35","v":0},{"$f":"'7'!AO35","v":0},{"$f":"'7'!AP35","v":0},{"$f":"'7'!AQ35","v":0},{"$f":"'7'!AR35","v":0},{"$f":"'7'!AS35","v":0},{"$f":"'7'!AT35","v":0},{"$f":"SUMPRODUCT(IF($N557=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N557=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B36","v":"7"},{"$f":"'7'!C36","v":"7.1"},{"$f":"'7'!D36","v":"7.1.3"},{"$f":"'7'!E36","v":""},{"$f":"'7'!F36","v":"7.1.3.2"},{"$f":"'7'!G36","v":0},{"$f":"'7'!H36","v":0},{"$f":"'7'!I36","v":"7.1.3.2.2"},{"$f":"'7'!J36","v":"7.1.3.2.2: Are steps taken to avoid fraudulent reversals, particularly those related to agent and merchant transactions where cash or goods are exchanged (e.g. contact recipient to agree the reversal)?\n"},{"$f":"'7'!K36","v":"1) Reversals business process\n- Check the process includes steps to avoid fraudulent reversals, for example by calling the recipient to get agreement for the reversal."},{"$f":"'7'!L36","v":0},{"$f":"'7'!M36","v":"Urgent Required"},{"$f":"'7'!N36","v":"Required"},{"$f":"'7'!O36","v":"CustServ"},{"$f":"'7'!P36","v":0},{"$f":"'7'!Q36","v":0},{"$f":"'7'!R36","v":0},{"$f":"'7'!S36","v":0},{"$f":"'7'!T36","v":0},{"$f":"'7'!U36","v":0},{"$f":"'7'!V36","v":0},{"$f":"'7'!W36","v":0},{"$f":"'7'!X36","v":0},{"$f":"'7'!Y36","v":0},{"$f":"'7'!Z36","v":0},{"$f":"'7'!AA36","v":0},{"$f":"'7'!AB36","v":0},{"$f":"'7'!AC36","v":0},{"$f":"'7'!AD36","v":0},{"$f":"'7'!AE36","v":0},{"$f":"'7'!AF36","v":0},{"$f":"'7'!AG36","v":0},{"$f":"'7'!AH36","v":0},{"$f":"'7'!AI36","v":0},{"$f":"'7'!AJ36","v":0},{"$f":"'7'!AK36","v":0},{"$f":"'7'!AL36","v":0},{"$f":"'7'!AM36","v":0},{"$f":"'7'!AN36","v":0},{"$f":"'7'!AO36","v":0},{"$f":"'7'!AP36","v":0},{"$f":"'7'!AQ36","v":0},{"$f":"'7'!AR36","v":0},{"$f":"'7'!AS36","v":0},{"$f":"'7'!AT36","v":0},{"$f":"SUMPRODUCT(IF($N558=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N558=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B37","v":"7"},{"$f":"'7'!C37","v":"7.1"},{"$f":"'7'!D37","v":"7.1.3"},{"$f":"'7'!E37","v":""},{"$f":"'7'!F37","v":"7.1.3.2"},{"$f":"'7'!G37","v":0},{"$f":"'7'!H37","v":0},{"$f":"'7'!I37","v":"7.1.3.2.3"},{"$f":"'7'!J37","v":"7.1.3.2.3: Is a budget set for bearing the costs of reversals?\n"},{"$f":"'7'!K37","v":0},{"$f":"'7'!L37","v":0},{"$f":"'7'!M37","v":"Recommended"},{"$f":"'7'!N37","v":"Recommended"},{"$f":"'7'!O37","v":"CustServ"},{"$f":"'7'!P37","v":0},{"$f":"'7'!Q37","v":0},{"$f":"'7'!R37","v":0},{"$f":"'7'!S37","v":0},{"$f":"'7'!T37","v":0},{"$f":"'7'!U37","v":0},{"$f":"'7'!V37","v":0},{"$f":"'7'!W37","v":0},{"$f":"'7'!X37","v":0},{"$f":"'7'!Y37","v":0},{"$f":"'7'!Z37","v":0},{"$f":"'7'!AA37","v":0},{"$f":"'7'!AB37","v":0},{"$f":"'7'!AC37","v":0},{"$f":"'7'!AD37","v":0},{"$f":"'7'!AE37","v":0},{"$f":"'7'!AF37","v":0},{"$f":"'7'!AG37","v":0},{"$f":"'7'!AH37","v":0},{"$f":"'7'!AI37","v":0},{"$f":"'7'!AJ37","v":0},{"$f":"'7'!AK37","v":0},{"$f":"'7'!AL37","v":0},{"$f":"'7'!AM37","v":0},{"$f":"'7'!AN37","v":0},{"$f":"'7'!AO37","v":0},{"$f":"'7'!AP37","v":0},{"$f":"'7'!AQ37","v":0},{"$f":"'7'!AR37","v":0},{"$f":"'7'!AS37","v":0},{"$f":"'7'!AT37","v":0},{"$f":"SUMPRODUCT(IF($N559=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N559=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B38","v":"7"},{"$f":"'7'!C38","v":"7.1"},{"$f":"'7'!D38","v":"7.1.3"},{"$f":"'7'!E38","v":""},{"$f":"'7'!F38","v":"7.1.3.3"},{"$f":"'7'!G38","v":"7.1.3.3: TRANSACTION REVERSALS IN THE MOBILE MONEY SYSTEM\nThe provider should implement functions within the mobile money system to support the reversal procedures:\n- System workflow should guide customer care staff through the reversal procedures;\n- System should hold funds in a reserved state while investigations are conducted; and\n- System functionality should reduce the likelihood of mistakes requiring reversal (e.g. phone address book for customer; recipient name look-up and confirmation; making customer enter recipient’s number twice).\n\nNOTE: Transaction reversals should be completed as soon as possible after the reversal is approved by the responsible officer (ideally within one business day). Providers should also consider implementing a \"sweep\" process in the system to collect the reversal payment from the customer when they next add funds to their account."},{"$f":"'7'!H38","v":"GSMA RMT"},{"$f":"'7'!I38","v":"7.1.3.3.1"},{"$f":"'7'!J38","v":"7.1.3.3.1: Does the mobile money system implement workflow to guide customer care staff through the reversal procedures?\n"},{"$f":"'7'!K38","v":0},{"$f":"'7'!L38","v":0},{"$f":"'7'!M38","v":"Recommended"},{"$f":"'7'!N38","v":"Recommended"},{"$f":"'7'!O38","v":"CustServ"},{"$f":"'7'!P38","v":0},{"$f":"'7'!Q38","v":0},{"$f":"'7'!R38","v":0},{"$f":"'7'!S38","v":0},{"$f":"'7'!T38","v":0},{"$f":"'7'!U38","v":0},{"$f":"'7'!V38","v":0},{"$f":"'7'!W38","v":0},{"$f":"'7'!X38","v":0},{"$f":"'7'!Y38","v":0},{"$f":"'7'!Z38","v":0},{"$f":"'7'!AA38","v":0},{"$f":"'7'!AB38","v":0},{"$f":"'7'!AC38","v":0},{"$f":"'7'!AD38","v":0},{"$f":"'7'!AE38","v":0},{"$f":"'7'!AF38","v":0},{"$f":"'7'!AG38","v":0},{"$f":"'7'!AH38","v":0},{"$f":"'7'!AI38","v":0},{"$f":"'7'!AJ38","v":0},{"$f":"'7'!AK38","v":0},{"$f":"'7'!AL38","v":0},{"$f":"'7'!AM38","v":0},{"$f":"'7'!AN38","v":0},{"$f":"'7'!AO38","v":0},{"$f":"'7'!AP38","v":0},{"$f":"'7'!AQ38","v":0},{"$f":"'7'!AR38","v":0},{"$f":"'7'!AS38","v":0},{"$f":"'7'!AT38","v":0},{"$f":"SUMPRODUCT(IF($N560=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N560=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B39","v":"7"},{"$f":"'7'!C39","v":"7.1"},{"$f":"'7'!D39","v":"7.1.3"},{"$f":"'7'!E39","v":""},{"$f":"'7'!F39","v":"7.1.3.3"},{"$f":"'7'!G39","v":0},{"$f":"'7'!H39","v":0},{"$f":"'7'!I39","v":"7.1.3.3.2"},{"$f":"'7'!J39","v":"7.1.3.3.2: Does the system hold funds in a reserved state while investigations are conducted?\n"},{"$f":"'7'!K39","v":0},{"$f":"'7'!L39","v":0},{"$f":"'7'!M39","v":"Recommended"},{"$f":"'7'!N39","v":"Recommended"},{"$f":"'7'!O39","v":"CustServ"},{"$f":"'7'!P39","v":0},{"$f":"'7'!Q39","v":0},{"$f":"'7'!R39","v":0},{"$f":"'7'!S39","v":0},{"$f":"'7'!T39","v":0},{"$f":"'7'!U39","v":0},{"$f":"'7'!V39","v":0},{"$f":"'7'!W39","v":0},{"$f":"'7'!X39","v":0},{"$f":"'7'!Y39","v":0},{"$f":"'7'!Z39","v":0},{"$f":"'7'!AA39","v":0},{"$f":"'7'!AB39","v":0},{"$f":"'7'!AC39","v":0},{"$f":"'7'!AD39","v":0},{"$f":"'7'!AE39","v":0},{"$f":"'7'!AF39","v":0},{"$f":"'7'!AG39","v":0},{"$f":"'7'!AH39","v":0},{"$f":"'7'!AI39","v":0},{"$f":"'7'!AJ39","v":0},{"$f":"'7'!AK39","v":0},{"$f":"'7'!AL39","v":0},{"$f":"'7'!AM39","v":0},{"$f":"'7'!AN39","v":0},{"$f":"'7'!AO39","v":0},{"$f":"'7'!AP39","v":0},{"$f":"'7'!AQ39","v":0},{"$f":"'7'!AR39","v":0},{"$f":"'7'!AS39","v":0},{"$f":"'7'!AT39","v":0},{"$f":"SUMPRODUCT(IF($N561=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N561=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B40","v":"7"},{"$f":"'7'!C40","v":"7.1"},{"$f":"'7'!D40","v":"7.1.3"},{"$f":"'7'!E40","v":""},{"$f":"'7'!F40","v":"7.1.3.3"},{"$f":"'7'!G40","v":0},{"$f":"'7'!H40","v":0},{"$f":"'7'!I40","v":"7.1.3.3.3"},{"$f":"'7'!J40","v":"7.1.3.3.3: Are mechanisms implemented to reduce the likelihood of mistakes requiring reversal (e.g. phone address book for customer; recipient name look-up and confirmation; making customer enter recipient’s number twice)?\n"},{"$f":"'7'!K40","v":0},{"$f":"'7'!L40","v":0},{"$f":"'7'!M40","v":"Recommended"},{"$f":"'7'!N40","v":"Recommended"},{"$f":"'7'!O40","v":"CustServ"},{"$f":"'7'!P40","v":0},{"$f":"'7'!Q40","v":0},{"$f":"'7'!R40","v":0},{"$f":"'7'!S40","v":0},{"$f":"'7'!T40","v":0},{"$f":"'7'!U40","v":0},{"$f":"'7'!V40","v":0},{"$f":"'7'!W40","v":0},{"$f":"'7'!X40","v":0},{"$f":"'7'!Y40","v":0},{"$f":"'7'!Z40","v":0},{"$f":"'7'!AA40","v":0},{"$f":"'7'!AB40","v":0},{"$f":"'7'!AC40","v":0},{"$f":"'7'!AD40","v":0},{"$f":"'7'!AE40","v":0},{"$f":"'7'!AF40","v":0},{"$f":"'7'!AG40","v":0},{"$f":"'7'!AH40","v":0},{"$f":"'7'!AI40","v":0},{"$f":"'7'!AJ40","v":0},{"$f":"'7'!AK40","v":0},{"$f":"'7'!AL40","v":0},{"$f":"'7'!AM40","v":0},{"$f":"'7'!AN40","v":0},{"$f":"'7'!AO40","v":0},{"$f":"'7'!AP40","v":0},{"$f":"'7'!AQ40","v":0},{"$f":"'7'!AR40","v":0},{"$f":"'7'!AS40","v":0},{"$f":"'7'!AT40","v":0},{"$f":"SUMPRODUCT(IF($N562=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N562=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B41","v":"7"},{"$f":"'7'!C41","v":"7.1"},{"$f":"'7'!D41","v":"7.1.3"},{"$f":"'7'!E41","v":""},{"$f":"'7'!F41","v":"7.1.3.4"},{"$f":"'7'!G41","v":"7.1.3.4: OFF-NET TRANSACTION REVERSALS\nProviders should develop additional controls for off-net reversals, including transactions with financial ecosystem partners such as other interoperable mobile money systems, international money transfer providers, banks, and ATM networks. \nThe following controls should be implemented:\n- A service-level agreement for responding to and resolving off-net reversals should be agreed with financial ecosystem partners;\n- Process for reversals and returning failed payments should be agreed with financial ecosystem partners. The process should include the role of a processor (hub/ clearing house), if used;\n- Process for determining the validity of reversal requests should be agreed with financial ecosystem partners, including details of which party will conduct investigations and how information and notifications will be shared. Depending on local regulation, providers may not be allowed to contact the customers of other providers, in which case a joint investigation process should be agreed;\n- Extending recipient name look-up functionality to include off-net customer name lookup for domestic interoperability; and\n- The system should hold funds in a reserved state for off-net transactions while investigations are conducted, particularly in the case of a dispute.\n"},{"$f":"'7'!H41","v":0},{"$f":"'7'!I41","v":"7.1.3.4.1"},{"$f":"'7'!J41","v":"7.1.3.4.1: Have detailed procedures been defined with each financial partner to accommodate off-net transaction reversals?\n"},{"$f":"'7'!K41","v":"1) Reversals business process\n- Check that detailed procedures have been defined with each financial partner to accommodate off-net transaction reversals.\n"},{"$f":"'7'!L41","v":0},{"$f":"'7'!M41","v":"Standard Required"},{"$f":"'7'!N41","v":"Required"},{"$f":"'7'!O41","v":"CustServ"},{"$f":"'7'!P41","v":0},{"$f":"'7'!Q41","v":0},{"$f":"'7'!R41","v":0},{"$f":"'7'!S41","v":0},{"$f":"'7'!T41","v":0},{"$f":"'7'!U41","v":0},{"$f":"'7'!V41","v":0},{"$f":"'7'!W41","v":0},{"$f":"'7'!X41","v":0},{"$f":"'7'!Y41","v":0},{"$f":"'7'!Z41","v":0},{"$f":"'7'!AA41","v":0},{"$f":"'7'!AB41","v":0},{"$f":"'7'!AC41","v":0},{"$f":"'7'!AD41","v":0},{"$f":"'7'!AE41","v":0},{"$f":"'7'!AF41","v":0},{"$f":"'7'!AG41","v":0},{"$f":"'7'!AH41","v":0},{"$f":"'7'!AI41","v":0},{"$f":"'7'!AJ41","v":0},{"$f":"'7'!AK41","v":0},{"$f":"'7'!AL41","v":0},{"$f":"'7'!AM41","v":0},{"$f":"'7'!AN41","v":0},{"$f":"'7'!AO41","v":0},{"$f":"'7'!AP41","v":0},{"$f":"'7'!AQ41","v":0},{"$f":"'7'!AR41","v":0},{"$f":"'7'!AS41","v":0},{"$f":"'7'!AT41","v":0},{"$f":"SUMPRODUCT(IF($N563=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N563=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B42","v":"7"},{"$f":"'7'!C42","v":"7.1"},{"$f":"'7'!D42","v":"7.1.3"},{"$f":"'7'!E42","v":""},{"$f":"'7'!F42","v":"7.1.3.4"},{"$f":"'7'!G42","v":0},{"$f":"'7'!H42","v":0},{"$f":"'7'!I42","v":"7.1.3.4.2"},{"$f":"'7'!J42","v":"7.1.3.4.2: Has a service-level agreement for responding to and resolving off-net reversals been agreed with each financial ecosystem partner?\n"},{"$f":"'7'!K42","v":"1) Reversals business process\n- Check that there is a service level agreement for responding to and resolving off-net reversals\n- Check that this has been agreed with ecosystem partners"},{"$f":"'7'!L42","v":0},{"$f":"'7'!M42","v":"Standard Required"},{"$f":"'7'!N42","v":"Required"},{"$f":"'7'!O42","v":"CustServ"},{"$f":"'7'!P42","v":0},{"$f":"'7'!Q42","v":0},{"$f":"'7'!R42","v":0},{"$f":"'7'!S42","v":0},{"$f":"'7'!T42","v":0},{"$f":"'7'!U42","v":0},{"$f":"'7'!V42","v":0},{"$f":"'7'!W42","v":0},{"$f":"'7'!X42","v":0},{"$f":"'7'!Y42","v":0},{"$f":"'7'!Z42","v":0},{"$f":"'7'!AA42","v":0},{"$f":"'7'!AB42","v":0},{"$f":"'7'!AC42","v":0},{"$f":"'7'!AD42","v":0},{"$f":"'7'!AE42","v":0},{"$f":"'7'!AF42","v":0},{"$f":"'7'!AG42","v":0},{"$f":"'7'!AH42","v":0},{"$f":"'7'!AI42","v":0},{"$f":"'7'!AJ42","v":0},{"$f":"'7'!AK42","v":0},{"$f":"'7'!AL42","v":0},{"$f":"'7'!AM42","v":0},{"$f":"'7'!AN42","v":0},{"$f":"'7'!AO42","v":0},{"$f":"'7'!AP42","v":0},{"$f":"'7'!AQ42","v":0},{"$f":"'7'!AR42","v":0},{"$f":"'7'!AS42","v":0},{"$f":"'7'!AT42","v":0},{"$f":"SUMPRODUCT(IF($N564=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N564=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B43","v":"7"},{"$f":"'7'!C43","v":"7.1"},{"$f":"'7'!D43","v":"7.1.3"},{"$f":"'7'!E43","v":""},{"$f":"'7'!F43","v":"7.1.3.4"},{"$f":"'7'!G43","v":0},{"$f":"'7'!H43","v":0},{"$f":"'7'!I43","v":"7.1.3.4.3"},{"$f":"'7'!J43","v":"7.1.3.4.3: Does the system hold funds in a reserved state for off-net transactions while investigations are conducted?\n"},{"$f":"'7'!K43","v":0},{"$f":"'7'!L43","v":0},{"$f":"'7'!M43","v":"Recommended"},{"$f":"'7'!N43","v":"Recommended"},{"$f":"'7'!O43","v":"CustServ"},{"$f":"'7'!P43","v":0},{"$f":"'7'!Q43","v":0},{"$f":"'7'!R43","v":0},{"$f":"'7'!S43","v":0},{"$f":"'7'!T43","v":0},{"$f":"'7'!U43","v":0},{"$f":"'7'!V43","v":0},{"$f":"'7'!W43","v":0},{"$f":"'7'!X43","v":0},{"$f":"'7'!Y43","v":0},{"$f":"'7'!Z43","v":0},{"$f":"'7'!AA43","v":0},{"$f":"'7'!AB43","v":0},{"$f":"'7'!AC43","v":0},{"$f":"'7'!AD43","v":0},{"$f":"'7'!AE43","v":0},{"$f":"'7'!AF43","v":0},{"$f":"'7'!AG43","v":0},{"$f":"'7'!AH43","v":0},{"$f":"'7'!AI43","v":0},{"$f":"'7'!AJ43","v":0},{"$f":"'7'!AK43","v":0},{"$f":"'7'!AL43","v":0},{"$f":"'7'!AM43","v":0},{"$f":"'7'!AN43","v":0},{"$f":"'7'!AO43","v":0},{"$f":"'7'!AP43","v":0},{"$f":"'7'!AQ43","v":0},{"$f":"'7'!AR43","v":0},{"$f":"'7'!AS43","v":0},{"$f":"'7'!AT43","v":0},{"$f":"SUMPRODUCT(IF($N565=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N565=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B44","v":"7"},{"$f":"'7'!C44","v":"7.1"},{"$f":"'7'!D44","v":"7.1.3"},{"$f":"'7'!E44","v":""},{"$f":"'7'!F44","v":"7.1.3.5"},{"$f":"'7'!G44","v":"7.1.3.5: MULTI-CURRENCY REVERSALS\nFor international money transfers (or domestic multi-currency transactions), there is a risk of currency fluctuations during the period between the initial transaction and the reversal. Options for mitigating this include:\n- Use of a third party to manage currency exchange and ensuring that this party bears the risk of exchange rate fluctuations during reversals;\n- Passing the risk of currency fluctuations on to the customer in case of reversals (if clearly stated in the T&Cs); and\n- Including sufficient exchange rate margin to allow for fluctuations in the case of reversals."},{"$f":"'7'!H44","v":0},{"$f":"'7'!I44","v":"7.1.3.5.1"},{"$f":"'7'!J44","v":"7.1.3.5.1: For international money transfers (or domestic multi-currency transactions), have steps been taken to mitigate exchange rate risk (i.e. currency fluctuations during the period between the initial transaction and the reversal)?\n"},{"$f":"'7'!K44","v":0},{"$f":"'7'!L44","v":0},{"$f":"'7'!M44","v":"Recommended"},{"$f":"'7'!N44","v":"Recommended"},{"$f":"'7'!O44","v":"CustServ"},{"$f":"'7'!P44","v":0},{"$f":"'7'!Q44","v":0},{"$f":"'7'!R44","v":0},{"$f":"'7'!S44","v":0},{"$f":"'7'!T44","v":0},{"$f":"'7'!U44","v":0},{"$f":"'7'!V44","v":0},{"$f":"'7'!W44","v":0},{"$f":"'7'!X44","v":0},{"$f":"'7'!Y44","v":0},{"$f":"'7'!Z44","v":0},{"$f":"'7'!AA44","v":0},{"$f":"'7'!AB44","v":0},{"$f":"'7'!AC44","v":0},{"$f":"'7'!AD44","v":0},{"$f":"'7'!AE44","v":0},{"$f":"'7'!AF44","v":0},{"$f":"'7'!AG44","v":0},{"$f":"'7'!AH44","v":0},{"$f":"'7'!AI44","v":0},{"$f":"'7'!AJ44","v":0},{"$f":"'7'!AK44","v":0},{"$f":"'7'!AL44","v":0},{"$f":"'7'!AM44","v":0},{"$f":"'7'!AN44","v":0},{"$f":"'7'!AO44","v":0},{"$f":"'7'!AP44","v":0},{"$f":"'7'!AQ44","v":0},{"$f":"'7'!AR44","v":0},{"$f":"'7'!AS44","v":0},{"$f":"'7'!AT44","v":0},{"$f":"SUMPRODUCT(IF($N566=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N566=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B45","v":"7"},{"$f":"'7'!C45","v":"7.1"},{"$f":"'7'!D45","v":"7.1.3"},{"$f":"'7'!E45","v":""},{"$f":"'7'!F45","v":"7.1.3.6"},{"$f":"'7'!G45","v":"7.1.3.6: CUSTOMER AWARENESS OF TRANSACTION REVERSALS\nProviders should inform customers of the rules governing transaction reversals, including:\n- how reversal requests may be initiated; \n- criteria for approving a reversal;\n- the list of reversible transactions (refer to 7.1.3.4);\n- reversal procedures and anticipated timeframes for investigating and resolving reversal requests;\n- conditions that apply to the refund of transaction fees in case of mistake or dispute; \n- customer recourse in the event that a transaction cannot be reversed because the funds are no longer in the recipient's wallet;\n- reversal procedures for merchant payment transactions (if applicable); \n- reversal procedures for bill payment transactions (if applicable); \n- reversal procedures for off-net transactions (if applicable), including information on:\n     - The expected timescale for resolution;\n     - Potential outcomes; and\n     - Any limitations on the scope of any reversal due to its being an off-net transaction.\n\nThe information on the rules governing transaction reversals should be made clear to customers through the T&Cs or on request from agents or customer care."},{"$f":"'7'!H45","v":0},{"$f":"'7'!I45","v":"7.1.3.6.1"},{"$f":"'7'!J45","v":"7.1.3.6.1: Is information on how and when transactions can be reversed made clear to customers through the T&Cs or available on request from agents or customer care?\n"},{"$f":"'7'!K45","v":"1) Customer T&Cs and/or agent point of sale materials\n- Check how and when transactions can be reversed are included in the T&Cs or available on request from agents or customer care.\n- Check it is set out in clear language."},{"$f":"'7'!L45","v":0},{"$f":"'7'!M45","v":"Urgent Required"},{"$f":"'7'!N45","v":"Required"},{"$f":"'7'!O45","v":"CustServ"},{"$f":"'7'!P45","v":0},{"$f":"'7'!Q45","v":0},{"$f":"'7'!R45","v":0},{"$f":"'7'!S45","v":0},{"$f":"'7'!T45","v":0},{"$f":"'7'!U45","v":0},{"$f":"'7'!V45","v":0},{"$f":"'7'!W45","v":0},{"$f":"'7'!X45","v":0},{"$f":"'7'!Y45","v":0},{"$f":"'7'!Z45","v":0},{"$f":"'7'!AA45","v":0},{"$f":"'7'!AB45","v":0},{"$f":"'7'!AC45","v":0},{"$f":"'7'!AD45","v":0},{"$f":"'7'!AE45","v":0},{"$f":"'7'!AF45","v":0},{"$f":"'7'!AG45","v":0},{"$f":"'7'!AH45","v":0},{"$f":"'7'!AI45","v":0},{"$f":"'7'!AJ45","v":0},{"$f":"'7'!AK45","v":0},{"$f":"'7'!AL45","v":0},{"$f":"'7'!AM45","v":0},{"$f":"'7'!AN45","v":0},{"$f":"'7'!AO45","v":0},{"$f":"'7'!AP45","v":0},{"$f":"'7'!AQ45","v":0},{"$f":"'7'!AR45","v":0},{"$f":"'7'!AS45","v":0},{"$f":"'7'!AT45","v":0},{"$f":"SUMPRODUCT(IF($N567=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N567=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B47","v":"7"},{"$f":"'7'!C47","v":"7.2"},{"$f":"'7'!D47","v":"7.2.1"},{"$f":"'7'!E47","v":"7.2.1: Providers shall provide an appropriate mechanism to address customers' questions and problems"},{"$f":"'7'!F47","v":"7.2.1.1"},{"$f":"'7'!G47","v":"7.2.1.1: ACCESS TO DEDICATED CUSTOMER SUPPORT\nProviders should have a customer care team dedicated to providing customer support for mobile money. A dedicated mobile money support team will be able to deal with the complexities and risks surrounding mobile money."},{"$f":"'7'!H47","v":0},{"$f":"'7'!I47","v":"7.2.1.1.1"},{"$f":"'7'!J47","v":"7.2.1.1.1: Is there a dedicated mobile money support team (not shared with other telco customer support)\n"},{"$f":"'7'!K47","v":0},{"$f":"'7'!L47","v":0},{"$f":"'7'!M47","v":"Recommended"},{"$f":"'7'!N47","v":"Recommended"},{"$f":"'7'!O47","v":"CustServ"},{"$f":"'7'!P47","v":0},{"$f":"'7'!Q47","v":0},{"$f":"'7'!R47","v":0},{"$f":"'7'!S47","v":0},{"$f":"'7'!T47","v":0},{"$f":"'7'!U47","v":0},{"$f":"'7'!V47","v":0},{"$f":"'7'!W47","v":0},{"$f":"'7'!X47","v":0},{"$f":"'7'!Y47","v":0},{"$f":"'7'!Z47","v":0},{"$f":"'7'!AA47","v":0},{"$f":"'7'!AB47","v":0},{"$f":"'7'!AC47","v":0},{"$f":"'7'!AD47","v":0},{"$f":"'7'!AE47","v":0},{"$f":"'7'!AF47","v":0},{"$f":"'7'!AG47","v":0},{"$f":"'7'!AH47","v":0},{"$f":"'7'!AI47","v":0},{"$f":"'7'!AJ47","v":0},{"$f":"'7'!AK47","v":0},{"$f":"'7'!AL47","v":0},{"$f":"'7'!AM47","v":0},{"$f":"'7'!AN47","v":0},{"$f":"'7'!AO47","v":0},{"$f":"'7'!AP47","v":0},{"$f":"'7'!AQ47","v":0},{"$f":"'7'!AR47","v":0},{"$f":"'7'!AS47","v":0},{"$f":"'7'!AT47","v":0},{"$f":"SUMPRODUCT(IF($N568=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N568=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B48","v":"7"},{"$f":"'7'!C48","v":"7.2"},{"$f":"'7'!D48","v":"7.2.1"},{"$f":"'7'!E48","v":0},{"$f":"'7'!F48","v":"7.2.1.2"},{"$f":"'7'!G48","v":"7.2.1.2: ADDRESSING COMPLEX OR HIGH-RISK ISSUES \nComplex and/or high-risk issues requiring more detailed support should be addressed by a second-level customer service team which has more in-depth training. Examples of complex issues could include transaction errors, bulk payments or complaint escalations."},{"$f":"'7'!H48","v":0},{"$f":"'7'!I48","v":"7.2.1.2.1"},{"$f":"'7'!J48","v":"7.2.1.2.1: Does the provider's customer care capability include a second level of support trained to deal with complex and/or high-risk issues?\n"},{"$f":"'7'!K48","v":"1) Customer service organization chart / customer service process documentation / customer service training plan\n- Check there is a process to escalete complex and/or high-risk issues to second level of customer care\n- Check that the chart includes a second level of customer care that deals with complex and/or high-risk issues \n- Check that the second level of customer service receive additional training to manage complex and/or high-risk issues"},{"$f":"'7'!L48","v":0},{"$f":"'7'!M48","v":"Standard Required"},{"$f":"'7'!N48","v":"Required"},{"$f":"'7'!O48","v":"CustServ"},{"$f":"'7'!P48","v":0},{"$f":"'7'!Q48","v":0},{"$f":"'7'!R48","v":0},{"$f":"'7'!S48","v":0},{"$f":"'7'!T48","v":0},{"$f":"'7'!U48","v":0},{"$f":"'7'!V48","v":0},{"$f":"'7'!W48","v":0},{"$f":"'7'!X48","v":0},{"$f":"'7'!Y48","v":0},{"$f":"'7'!Z48","v":0},{"$f":"'7'!AA48","v":0},{"$f":"'7'!AB48","v":0},{"$f":"'7'!AC48","v":0},{"$f":"'7'!AD48","v":0},{"$f":"'7'!AE48","v":0},{"$f":"'7'!AF48","v":0},{"$f":"'7'!AG48","v":0},{"$f":"'7'!AH48","v":0},{"$f":"'7'!AI48","v":0},{"$f":"'7'!AJ48","v":0},{"$f":"'7'!AK48","v":0},{"$f":"'7'!AL48","v":0},{"$f":"'7'!AM48","v":0},{"$f":"'7'!AN48","v":0},{"$f":"'7'!AO48","v":0},{"$f":"'7'!AP48","v":0},{"$f":"'7'!AQ48","v":0},{"$f":"'7'!AR48","v":0},{"$f":"'7'!AS48","v":0},{"$f":"'7'!AT48","v":0},{"$f":"SUMPRODUCT(IF($N569=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N569=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B49","v":"7"},{"$f":"'7'!C49","v":"7.2"},{"$f":"'7'!D49","v":"7.2.1"},{"$f":"'7'!E49","v":0},{"$f":"'7'!F49","v":"7.2.1.3"},{"$f":"'7'!G49","v":"7.2.1.3: CLOSING MOBILE MONEY ACCOUNTS\nCustomers should be able to close their mobile money accounts and withdraw all remaining funds using one or more convenient mechanisms such as the following:\n- self-help, using tools available within the mobile money service;\n- with assistance from customer care personnel; and/or\n- at agents or other retail outlets.\n\nProviders should also have formal procedures in place for closing a relative’s account in case of death. "},{"$f":"'7'!H49","v":0},{"$f":"'7'!I49","v":"7.2.1.3.1"},{"$f":"'7'!J49","v":"7.2.1.3.1: Are customers able to close their mobile money accounts and withdraw all remaining funds using one or more convenient mechanisms?\n"},{"$f":"'7'!K49","v":0},{"$f":"'7'!L49","v":0},{"$f":"'7'!M49","v":"Recommended"},{"$f":"'7'!N49","v":"Recommended"},{"$f":"'7'!O49","v":"CustServ"},{"$f":"'7'!P49","v":0},{"$f":"'7'!Q49","v":0},{"$f":"'7'!R49","v":0},{"$f":"'7'!S49","v":0},{"$f":"'7'!T49","v":0},{"$f":"'7'!U49","v":0},{"$f":"'7'!V49","v":0},{"$f":"'7'!W49","v":0},{"$f":"'7'!X49","v":0},{"$f":"'7'!Y49","v":0},{"$f":"'7'!Z49","v":0},{"$f":"'7'!AA49","v":0},{"$f":"'7'!AB49","v":0},{"$f":"'7'!AC49","v":0},{"$f":"'7'!AD49","v":0},{"$f":"'7'!AE49","v":0},{"$f":"'7'!AF49","v":0},{"$f":"'7'!AG49","v":0},{"$f":"'7'!AH49","v":0},{"$f":"'7'!AI49","v":0},{"$f":"'7'!AJ49","v":0},{"$f":"'7'!AK49","v":0},{"$f":"'7'!AL49","v":0},{"$f":"'7'!AM49","v":0},{"$f":"'7'!AN49","v":0},{"$f":"'7'!AO49","v":0},{"$f":"'7'!AP49","v":0},{"$f":"'7'!AQ49","v":0},{"$f":"'7'!AR49","v":0},{"$f":"'7'!AS49","v":0},{"$f":"'7'!AT49","v":0},{"$f":"SUMPRODUCT(IF($N570=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N570=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B50","v":"7"},{"$f":"'7'!C50","v":"7.2"},{"$f":"'7'!D50","v":"7.2.1"},{"$f":"'7'!E50","v":0},{"$f":"'7'!F50","v":"7.2.1.3"},{"$f":"'7'!G50","v":0},{"$f":"'7'!H50","v":0},{"$f":"'7'!I50","v":"7.2.1.3.2"},{"$f":"'7'!J50","v":"7.2.1.3.2: Are formal procedures in place for closing a relative’s account in case of death?\n"},{"$f":"'7'!K50","v":0},{"$f":"'7'!L50","v":0},{"$f":"'7'!M50","v":"Recommended"},{"$f":"'7'!N50","v":"Recommended"},{"$f":"'7'!O50","v":"CustServ"},{"$f":"'7'!P50","v":0},{"$f":"'7'!Q50","v":0},{"$f":"'7'!R50","v":0},{"$f":"'7'!S50","v":0},{"$f":"'7'!T50","v":0},{"$f":"'7'!U50","v":0},{"$f":"'7'!V50","v":0},{"$f":"'7'!W50","v":0},{"$f":"'7'!X50","v":0},{"$f":"'7'!Y50","v":0},{"$f":"'7'!Z50","v":0},{"$f":"'7'!AA50","v":0},{"$f":"'7'!AB50","v":0},{"$f":"'7'!AC50","v":0},{"$f":"'7'!AD50","v":0},{"$f":"'7'!AE50","v":0},{"$f":"'7'!AF50","v":0},{"$f":"'7'!AG50","v":0},{"$f":"'7'!AH50","v":0},{"$f":"'7'!AI50","v":0},{"$f":"'7'!AJ50","v":0},{"$f":"'7'!AK50","v":0},{"$f":"'7'!AL50","v":0},{"$f":"'7'!AM50","v":0},{"$f":"'7'!AN50","v":0},{"$f":"'7'!AO50","v":0},{"$f":"'7'!AP50","v":0},{"$f":"'7'!AQ50","v":0},{"$f":"'7'!AR50","v":0},{"$f":"'7'!AS50","v":0},{"$f":"'7'!AT50","v":0},{"$f":"SUMPRODUCT(IF($N571=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N571=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B51","v":"7"},{"$f":"'7'!C51","v":"7.2"},{"$f":"'7'!D51","v":"7.2.1"},{"$f":"'7'!E51","v":0},{"$f":"'7'!F51","v":"7.2.1.4"},{"$f":"'7'!G51","v":"7.2.1.4: ACCESS TO ALL NECESSARY CUSTOMER DATA\nProviders should ensure that customer care personnel have access to relevant customer data, including transaction details and notes from previous contact with the provider. \n\nCustomers should not be required to repeat the details of issues unnecessarily when they need to contact customer care personnel more than once or are passed from one customer care team to another.\n\nTo facilitate this, each customer should be assigned a reference/ticket number for their call, and this number should be shared with customers."},{"$f":"'7'!H51","v":0},{"$f":"'7'!I51","v":"7.2.1.4.1"},{"$f":"'7'!J51","v":"7.2.1.4.1: Do customer care personnel have access to relevant customer data, including transaction details and notes from previous contact with the provider?\n"},{"$f":"'7'!K51","v":"1) Customer service system - customer service screens\n- Check customer care personnel have access to customer information, including transaction details and notes from previous contact with the provider.\n[Notes from previous calls could be tracked manually]"},{"$f":"'7'!L51","v":0},{"$f":"'7'!M51","v":"Standard Required"},{"$f":"'7'!N51","v":"Required"},{"$f":"'7'!O51","v":"CustServ"},{"$f":"'7'!P51","v":0},{"$f":"'7'!Q51","v":0},{"$f":"'7'!R51","v":0},{"$f":"'7'!S51","v":0},{"$f":"'7'!T51","v":0},{"$f":"'7'!U51","v":0},{"$f":"'7'!V51","v":0},{"$f":"'7'!W51","v":0},{"$f":"'7'!X51","v":0},{"$f":"'7'!Y51","v":0},{"$f":"'7'!Z51","v":0},{"$f":"'7'!AA51","v":0},{"$f":"'7'!AB51","v":0},{"$f":"'7'!AC51","v":0},{"$f":"'7'!AD51","v":0},{"$f":"'7'!AE51","v":0},{"$f":"'7'!AF51","v":0},{"$f":"'7'!AG51","v":0},{"$f":"'7'!AH51","v":0},{"$f":"'7'!AI51","v":0},{"$f":"'7'!AJ51","v":0},{"$f":"'7'!AK51","v":0},{"$f":"'7'!AL51","v":0},{"$f":"'7'!AM51","v":0},{"$f":"'7'!AN51","v":0},{"$f":"'7'!AO51","v":0},{"$f":"'7'!AP51","v":0},{"$f":"'7'!AQ51","v":0},{"$f":"'7'!AR51","v":0},{"$f":"'7'!AS51","v":0},{"$f":"'7'!AT51","v":0},{"$f":"SUMPRODUCT(IF($N572=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N572=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B52","v":"7"},{"$f":"'7'!C52","v":"7.2"},{"$f":"'7'!D52","v":"7.2.1"},{"$f":"'7'!E52","v":0},{"$f":"'7'!F52","v":"7.2.1.4"},{"$f":"'7'!G52","v":0},{"$f":"'7'!H52","v":0},{"$f":"'7'!I52","v":"7.2.1.4.2"},{"$f":"'7'!J52","v":"7.2.1.4.2: Are mechanisms in place to avoid requiring customers to repeat the details of issues unnecessarily when they need to contact customer care personnel more than once or are passed from one customer care team to another (such as assigning a reference/ticket number to each call by a customer)?\n"},{"$f":"'7'!K52","v":0},{"$f":"'7'!L52","v":0},{"$f":"'7'!M52","v":"Recommended"},{"$f":"'7'!N52","v":"Recommended"},{"$f":"'7'!O52","v":"CustServ"},{"$f":"'7'!P52","v":0},{"$f":"'7'!Q52","v":0},{"$f":"'7'!R52","v":0},{"$f":"'7'!S52","v":0},{"$f":"'7'!T52","v":0},{"$f":"'7'!U52","v":0},{"$f":"'7'!V52","v":0},{"$f":"'7'!W52","v":0},{"$f":"'7'!X52","v":0},{"$f":"'7'!Y52","v":0},{"$f":"'7'!Z52","v":0},{"$f":"'7'!AA52","v":0},{"$f":"'7'!AB52","v":0},{"$f":"'7'!AC52","v":0},{"$f":"'7'!AD52","v":0},{"$f":"'7'!AE52","v":0},{"$f":"'7'!AF52","v":0},{"$f":"'7'!AG52","v":0},{"$f":"'7'!AH52","v":0},{"$f":"'7'!AI52","v":0},{"$f":"'7'!AJ52","v":0},{"$f":"'7'!AK52","v":0},{"$f":"'7'!AL52","v":0},{"$f":"'7'!AM52","v":0},{"$f":"'7'!AN52","v":0},{"$f":"'7'!AO52","v":0},{"$f":"'7'!AP52","v":0},{"$f":"'7'!AQ52","v":0},{"$f":"'7'!AR52","v":0},{"$f":"'7'!AS52","v":0},{"$f":"'7'!AT52","v":0},{"$f":"SUMPRODUCT(IF($N573=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N573=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B53","v":"7"},{"$f":"'7'!C53","v":"7.2"},{"$f":"'7'!D53","v":"7.2.1"},{"$f":"'7'!E53","v":0},{"$f":"'7'!F53","v":"7.2.1.5"},{"$f":"'7'!G53","v":"7.2.1.5: AVAILABILITY OF CUSTOMER CARE SUPPORT\nProviders should ensure that customer care personnel are available during business hours at minimum and ideally 24 hours a day, 7 days a week. \n\nSecond-level customer service staff who address complex and/or high-risk issues (see 7.2.1.2) should be available during business hours, at a minimum."},{"$f":"'7'!H53","v":0},{"$f":"'7'!I53","v":"7.2.1.5.1"},{"$f":"'7'!J53","v":"7.2.1.5.1: Are customer care personnel available 24 hours a day, 7 days a week?\n"},{"$f":"'7'!K53","v":0},{"$f":"'7'!L53","v":0},{"$f":"'7'!M53","v":"Recommended"},{"$f":"'7'!N53","v":"Recommended"},{"$f":"'7'!O53","v":"CustServ"},{"$f":"'7'!P53","v":0},{"$f":"'7'!Q53","v":0},{"$f":"'7'!R53","v":0},{"$f":"'7'!S53","v":0},{"$f":"'7'!T53","v":0},{"$f":"'7'!U53","v":0},{"$f":"'7'!V53","v":0},{"$f":"'7'!W53","v":0},{"$f":"'7'!X53","v":0},{"$f":"'7'!Y53","v":0},{"$f":"'7'!Z53","v":0},{"$f":"'7'!AA53","v":0},{"$f":"'7'!AB53","v":0},{"$f":"'7'!AC53","v":0},{"$f":"'7'!AD53","v":0},{"$f":"'7'!AE53","v":0},{"$f":"'7'!AF53","v":0},{"$f":"'7'!AG53","v":0},{"$f":"'7'!AH53","v":0},{"$f":"'7'!AI53","v":0},{"$f":"'7'!AJ53","v":0},{"$f":"'7'!AK53","v":0},{"$f":"'7'!AL53","v":0},{"$f":"'7'!AM53","v":0},{"$f":"'7'!AN53","v":0},{"$f":"'7'!AO53","v":0},{"$f":"'7'!AP53","v":0},{"$f":"'7'!AQ53","v":0},{"$f":"'7'!AR53","v":0},{"$f":"'7'!AS53","v":0},{"$f":"'7'!AT53","v":0},{"$f":"SUMPRODUCT(IF($N574=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N574=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B54","v":"7"},{"$f":"'7'!C54","v":"7.2"},{"$f":"'7'!D54","v":"7.2.1"},{"$f":"'7'!E54","v":0},{"$f":"'7'!F54","v":"7.2.1.5"},{"$f":"'7'!G54","v":0},{"$f":"'7'!H54","v":0},{"$f":"'7'!I54","v":"7.2.1.5.2"},{"$f":"'7'!J54","v":"7.2.1.5.2: Are first- and  second-level customer service staff available during business hours, at a minimum?\n"},{"$f":"'7'!K54","v":"1) Customer service process documentation\n- Check the working times of the first- and second-level customer support staff cover standard business hours at a minimum."},{"$f":"'7'!L54","v":0},{"$f":"'7'!M54","v":"Standard Required"},{"$f":"'7'!N54","v":"Required"},{"$f":"'7'!O54","v":"CustServ"},{"$f":"'7'!P54","v":0},{"$f":"'7'!Q54","v":0},{"$f":"'7'!R54","v":0},{"$f":"'7'!S54","v":0},{"$f":"'7'!T54","v":0},{"$f":"'7'!U54","v":0},{"$f":"'7'!V54","v":0},{"$f":"'7'!W54","v":0},{"$f":"'7'!X54","v":0},{"$f":"'7'!Y54","v":0},{"$f":"'7'!Z54","v":0},{"$f":"'7'!AA54","v":0},{"$f":"'7'!AB54","v":0},{"$f":"'7'!AC54","v":0},{"$f":"'7'!AD54","v":0},{"$f":"'7'!AE54","v":0},{"$f":"'7'!AF54","v":0},{"$f":"'7'!AG54","v":0},{"$f":"'7'!AH54","v":0},{"$f":"'7'!AI54","v":0},{"$f":"'7'!AJ54","v":0},{"$f":"'7'!AK54","v":0},{"$f":"'7'!AL54","v":0},{"$f":"'7'!AM54","v":0},{"$f":"'7'!AN54","v":0},{"$f":"'7'!AO54","v":0},{"$f":"'7'!AP54","v":0},{"$f":"'7'!AQ54","v":0},{"$f":"'7'!AR54","v":0},{"$f":"'7'!AS54","v":0},{"$f":"'7'!AT54","v":0},{"$f":"SUMPRODUCT(IF($N575=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N575=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B55","v":"7"},{"$f":"'7'!C55","v":"7.2"},{"$f":"'7'!D55","v":"7.2.1"},{"$f":"'7'!E55","v":0},{"$f":"'7'!F55","v":"7.2.1.6"},{"$f":"'7'!G55","v":"7.2.1.6: ACCESS TO CUSTOMER CARE IN DIFFERENT LANGUAGES\nWhere feasible, customer care support should be available in the official language(s) and/or other commonly spoken languages (including regional languages) for all stages of the complaints process.\n\nNOTE:  It may not be feasible or commercially sustainable to provide customer care support in all official languages and/or other commonly spoken languages for all stages of the complaints process. Where feasible and commercially sustainable, however, providers should make a reasonable effort to communicate in languages that can be comprehended by people from different regions and with varying levels of education.\n"},{"$f":"'7'!H55","v":0},{"$f":"'7'!I55","v":"7.2.1.6.1"},{"$f":"'7'!J55","v":"7.2.1.6.1: Do customers have access to customer care personnel who speak all official languages and/or commonly-spoken languages (including regional languages) for all stages of the complaints process?\n"},{"$f":"'7'!K55","v":0},{"$f":"'7'!L55","v":0},{"$f":"'7'!M55","v":"Recommended"},{"$f":"'7'!N55","v":"Recommended"},{"$f":"'7'!O55","v":"CustServ"},{"$f":"'7'!P55","v":0},{"$f":"'7'!Q55","v":0},{"$f":"'7'!R55","v":0},{"$f":"'7'!S55","v":0},{"$f":"'7'!T55","v":0},{"$f":"'7'!U55","v":0},{"$f":"'7'!V55","v":0},{"$f":"'7'!W55","v":0},{"$f":"'7'!X55","v":0},{"$f":"'7'!Y55","v":0},{"$f":"'7'!Z55","v":0},{"$f":"'7'!AA55","v":0},{"$f":"'7'!AB55","v":0},{"$f":"'7'!AC55","v":0},{"$f":"'7'!AD55","v":0},{"$f":"'7'!AE55","v":0},{"$f":"'7'!AF55","v":0},{"$f":"'7'!AG55","v":0},{"$f":"'7'!AH55","v":0},{"$f":"'7'!AI55","v":0},{"$f":"'7'!AJ55","v":0},{"$f":"'7'!AK55","v":0},{"$f":"'7'!AL55","v":0},{"$f":"'7'!AM55","v":0},{"$f":"'7'!AN55","v":0},{"$f":"'7'!AO55","v":0},{"$f":"'7'!AP55","v":0},{"$f":"'7'!AQ55","v":0},{"$f":"'7'!AR55","v":0},{"$f":"'7'!AS55","v":0},{"$f":"'7'!AT55","v":0},{"$f":"SUMPRODUCT(IF($N576=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N576=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B56","v":"7"},{"$f":"'7'!C56","v":"7.2"},{"$f":"'7'!D56","v":"7.2.1"},{"$f":"'7'!E56","v":0},{"$f":"'7'!F56","v":"7.2.1.7"},{"$f":"'7'!G56","v":"7.2.1.7: SECURE COMMUNICATION WITH CUSTOMERS\nProviders should offer at least one secure channel for communicating with customers and addressing issues related to the use of the service (see definition). The choice of channel (e.g. call centre, in-person, secure messaging) should be appropriate for the target market. Providers should inform customers about this channel and explain that any other channels for communicating with the provider (such as e-mail) may not be secure.\n\nProviders should enable customers to verify that calls or messages from the provider are legitimate by using a published number or another reliable method to facilitate identification of the provider. This is an important action in tackling social engineering fraud."},{"$f":"'7'!H56","v":"ECB RSMP"},{"$f":"'7'!I56","v":"7.2.1.7.1"},{"$f":"'7'!J56","v":"7.2.1.7.1: Are customers advised of how to contact customer service securely (e.g. call centre, in-person, secure messaging) and that other channels (such as e-mail) may not be secure?\n"},{"$f":"'7'!K56","v":0},{"$f":"'7'!L56","v":0},{"$f":"'7'!M56","v":"Recommended"},{"$f":"'7'!N56","v":"Recommended"},{"$f":"'7'!O56","v":"CustServ"},{"$f":"'7'!P56","v":0},{"$f":"'7'!Q56","v":0},{"$f":"'7'!R56","v":0},{"$f":"'7'!S56","v":0},{"$f":"'7'!T56","v":0},{"$f":"'7'!U56","v":0},{"$f":"'7'!V56","v":0},{"$f":"'7'!W56","v":0},{"$f":"'7'!X56","v":0},{"$f":"'7'!Y56","v":0},{"$f":"'7'!Z56","v":0},{"$f":"'7'!AA56","v":0},{"$f":"'7'!AB56","v":0},{"$f":"'7'!AC56","v":0},{"$f":"'7'!AD56","v":0},{"$f":"'7'!AE56","v":0},{"$f":"'7'!AF56","v":0},{"$f":"'7'!AG56","v":0},{"$f":"'7'!AH56","v":0},{"$f":"'7'!AI56","v":0},{"$f":"'7'!AJ56","v":0},{"$f":"'7'!AK56","v":0},{"$f":"'7'!AL56","v":0},{"$f":"'7'!AM56","v":0},{"$f":"'7'!AN56","v":0},{"$f":"'7'!AO56","v":0},{"$f":"'7'!AP56","v":0},{"$f":"'7'!AQ56","v":0},{"$f":"'7'!AR56","v":0},{"$f":"'7'!AS56","v":0},{"$f":"'7'!AT56","v":0},{"$f":"SUMPRODUCT(IF($N577=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N577=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B57","v":"7"},{"$f":"'7'!C57","v":"7.2"},{"$f":"'7'!D57","v":"7.2.1"},{"$f":"'7'!E57","v":0},{"$f":"'7'!F57","v":"7.2.1.7"},{"$f":"'7'!G57","v":0},{"$f":"'7'!H57","v":0},{"$f":"'7'!I57","v":"7.2.1.7.2"},{"$f":"'7'!J57","v":"7.2.1.7.2: Does the provider enable customers to verify that calls / messages from the provider are legitimate by using a published number?\n"},{"$f":"'7'!K57","v":0},{"$f":"'7'!L57","v":0},{"$f":"'7'!M57","v":"Recommended"},{"$f":"'7'!N57","v":"Recommended"},{"$f":"'7'!O57","v":"CustServ"},{"$f":"'7'!P57","v":0},{"$f":"'7'!Q57","v":0},{"$f":"'7'!R57","v":0},{"$f":"'7'!S57","v":0},{"$f":"'7'!T57","v":0},{"$f":"'7'!U57","v":0},{"$f":"'7'!V57","v":0},{"$f":"'7'!W57","v":0},{"$f":"'7'!X57","v":0},{"$f":"'7'!Y57","v":0},{"$f":"'7'!Z57","v":0},{"$f":"'7'!AA57","v":0},{"$f":"'7'!AB57","v":0},{"$f":"'7'!AC57","v":0},{"$f":"'7'!AD57","v":0},{"$f":"'7'!AE57","v":0},{"$f":"'7'!AF57","v":0},{"$f":"'7'!AG57","v":0},{"$f":"'7'!AH57","v":0},{"$f":"'7'!AI57","v":0},{"$f":"'7'!AJ57","v":0},{"$f":"'7'!AK57","v":0},{"$f":"'7'!AL57","v":0},{"$f":"'7'!AM57","v":0},{"$f":"'7'!AN57","v":0},{"$f":"'7'!AO57","v":0},{"$f":"'7'!AP57","v":0},{"$f":"'7'!AQ57","v":0},{"$f":"'7'!AR57","v":0},{"$f":"'7'!AS57","v":0},{"$f":"'7'!AT57","v":0},{"$f":"SUMPRODUCT(IF($N578=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N578=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B58","v":"7"},{"$f":"'7'!C58","v":"7.2"},{"$f":"'7'!D58","v":"7.2.1"},{"$f":"'7'!E58","v":0},{"$f":"'7'!F58","v":"7.2.1.8"},{"$f":"'7'!G58","v":"7.2.1.8: TESTING CUSTOMER SUPPORT\nProviders should test customer support (e.g., using mystery callers) for all possible customer complaints to ensure that customer care personnel, including the second-level customer service team (see 7.2.1.2), are able to address and resolve specific complaints and requests raised by customers. "},{"$f":"'7'!H58","v":0},{"$f":"'7'!I58","v":"7.2.1.8.1"},{"$f":"'7'!J58","v":"7.2.1.8.1: Has customer support been tested for all possible mobile money issues to ensure that customer care personnel are able to address and resolve specific complaints and requests raised by customers?\n"},{"$f":"'7'!K58","v":0},{"$f":"'7'!L58","v":0},{"$f":"'7'!M58","v":"Recommended"},{"$f":"'7'!N58","v":"Recommended"},{"$f":"'7'!O58","v":"CustServ"},{"$f":"'7'!P58","v":0},{"$f":"'7'!Q58","v":0},{"$f":"'7'!R58","v":0},{"$f":"'7'!S58","v":0},{"$f":"'7'!T58","v":0},{"$f":"'7'!U58","v":0},{"$f":"'7'!V58","v":0},{"$f":"'7'!W58","v":0},{"$f":"'7'!X58","v":0},{"$f":"'7'!Y58","v":0},{"$f":"'7'!Z58","v":0},{"$f":"'7'!AA58","v":0},{"$f":"'7'!AB58","v":0},{"$f":"'7'!AC58","v":0},{"$f":"'7'!AD58","v":0},{"$f":"'7'!AE58","v":0},{"$f":"'7'!AF58","v":0},{"$f":"'7'!AG58","v":0},{"$f":"'7'!AH58","v":0},{"$f":"'7'!AI58","v":0},{"$f":"'7'!AJ58","v":0},{"$f":"'7'!AK58","v":0},{"$f":"'7'!AL58","v":0},{"$f":"'7'!AM58","v":0},{"$f":"'7'!AN58","v":0},{"$f":"'7'!AO58","v":0},{"$f":"'7'!AP58","v":0},{"$f":"'7'!AQ58","v":0},{"$f":"'7'!AR58","v":0},{"$f":"'7'!AS58","v":0},{"$f":"'7'!AT58","v":0},{"$f":"SUMPRODUCT(IF($N579=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N579=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B60","v":"7"},{"$f":"'7'!C60","v":"7.3"},{"$f":"'7'!D60","v":"7.3.1"},{"$f":"'7'!E60","v":"7.3.1: Providers shall specify how disputes can be resolved if internal resolution fails"},{"$f":"'7'!F60","v":"7.3.1.1"},{"$f":"'7'!G60","v":"7.3.1.1: INFORM CUSTOMERS OF THEIR RIGHT TO EXTERNAL RECOURSE\nProviders should ensure that customers are informed of the external recourse options available to them if the provider's internal complaints and escalation process fails to resolve the complaint to the customer's satisfaction. External recourse should not be initiated by the customer until efforts to resolve the issue using the provider's internal complaint and dispute process has been exhausted. \n\nMechanisms for informing customers of external recourse could include:\n- awareness campaigns such as posters / advertising / bulk messaging.\n- training customer service second level support (team leaders / supervisors) to know about external recourse options and when to tell customers about them.\nNote: including external recourse options in customer Terms & Conditions is important but not sufficient on its own."},{"$f":"'7'!H60","v":0},{"$f":"'7'!I60","v":"7.3.1.1.1"},{"$f":"'7'!J60","v":"7.3.1.1.1: Are customers informed how and when to escalate complaints to external recourse after exhausting the provider's resolution process?\n"},{"$f":"'7'!K60","v":"1) Customer service training materials / posters/leaflets / advertising materials \nCheck that:\n- EITHER customers are made aware of external recourse options through awareness campaigns such as posters / advertising / bulk messaging.\n- OR customer service second level support (team leaders / supervisors) are trained to know about external recourse options and when to tell customers about them.\nNote: including external recourse options in T&Cs is not sufficient."},{"$f":"'7'!L60","v":0},{"$f":"'7'!M60","v":"Standard Required"},{"$f":"'7'!N60","v":"Required"},{"$f":"'7'!O60","v":"CustServ"},{"$f":"'7'!P60","v":0},{"$f":"'7'!Q60","v":0},{"$f":"'7'!R60","v":0},{"$f":"'7'!S60","v":0},{"$f":"'7'!T60","v":0},{"$f":"'7'!U60","v":0},{"$f":"'7'!V60","v":0},{"$f":"'7'!W60","v":0},{"$f":"'7'!X60","v":0},{"$f":"'7'!Y60","v":0},{"$f":"'7'!Z60","v":0},{"$f":"'7'!AA60","v":0},{"$f":"'7'!AB60","v":0},{"$f":"'7'!AC60","v":0},{"$f":"'7'!AD60","v":0},{"$f":"'7'!AE60","v":0},{"$f":"'7'!AF60","v":0},{"$f":"'7'!AG60","v":0},{"$f":"'7'!AH60","v":0},{"$f":"'7'!AI60","v":0},{"$f":"'7'!AJ60","v":0},{"$f":"'7'!AK60","v":0},{"$f":"'7'!AL60","v":0},{"$f":"'7'!AM60","v":0},{"$f":"'7'!AN60","v":0},{"$f":"'7'!AO60","v":0},{"$f":"'7'!AP60","v":0},{"$f":"'7'!AQ60","v":0},{"$f":"'7'!AR60","v":0},{"$f":"'7'!AS60","v":0},{"$f":"'7'!AT60","v":0},{"$f":"SUMPRODUCT(IF($N580=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N580=CategoryRecommended,1,0))","v":0},{"$f":"_xlfn.IFNA(MATCH($Q580,ComplianceYes,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q580,CompliancePartial,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q580,ComplianceNo,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q580,ComplianceNA,0),0)","v":0},{"$f":"$AU580*AW580","v":0},{"$f":"$AU580*AX580","v":0},{"$f":"$AU580*AY580","v":0},{"$f":"$AU580*AZ580","v":0},{"$f":"$AV580*AW580","v":0},{"$f":"$AV580*AX580","v":0},{"$f":"$AV580*AY580","v":0},{"$f":"$AV580*AZ580","v":0},{"$f":"_xlfn.IFNA(MATCH($AF580,ComplianceYes,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF580,CompliancePartial,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF580,ComplianceNo,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF580,ComplianceNA,0),0)","v":0},0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B61","v":"7"},{"$f":"'7'!C61","v":"7.3"},{"$f":"'7'!D61","v":"7.3.1"},{"$f":"'7'!E61","v":0},{"$f":"'7'!F61","v":"7.3.1.1"},{"$f":"'7'!G61","v":0},{"$f":"'7'!H61","v":0},{"$f":"'7'!I61","v":"7.3.1.1.2"},{"$f":"'7'!J61","v":"7.3.1.1.2: Is a description of the external recourse options included in the customer contract,Terms & Conditions or other customer documentation?\n"},{"$f":"'7'!K61","v":0},{"$f":"'7'!L61","v":0},{"$f":"'7'!M61","v":"Recommended"},{"$f":"'7'!N61","v":"Recommended"},{"$f":"'7'!O61","v":"CustServ"},{"$f":"'7'!P61","v":0},{"$f":"'7'!Q61","v":0},{"$f":"'7'!R61","v":0},{"$f":"'7'!S61","v":0},{"$f":"'7'!T61","v":0},{"$f":"'7'!U61","v":0},{"$f":"'7'!V61","v":0},{"$f":"'7'!W61","v":0},{"$f":"'7'!X61","v":0},{"$f":"'7'!Y61","v":0},{"$f":"'7'!Z61","v":0},{"$f":"'7'!AA61","v":0},{"$f":"'7'!AB61","v":0},{"$f":"'7'!AC61","v":0},{"$f":"'7'!AD61","v":0},{"$f":"'7'!AE61","v":0},{"$f":"'7'!AF61","v":0},{"$f":"'7'!AG61","v":0},{"$f":"'7'!AH61","v":0},{"$f":"'7'!AI61","v":0},{"$f":"'7'!AJ61","v":0},{"$f":"'7'!AK61","v":0},{"$f":"'7'!AL61","v":0},{"$f":"'7'!AM61","v":0},{"$f":"'7'!AN61","v":0},{"$f":"'7'!AO61","v":0},{"$f":"'7'!AP61","v":0},{"$f":"'7'!AQ61","v":0},{"$f":"'7'!AR61","v":0},{"$f":"'7'!AS61","v":0},{"$f":"'7'!AT61","v":0},{"$f":"SUMPRODUCT(IF($N581=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N581=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,{"$f":"$AU581*BI581","v":0},{"$f":"$AU581*BJ581","v":0},{"$f":"$AU581*BK581","v":0},{"$f":"$AU581*BL581","v":0},{"$f":"$AV581*BI581","v":0},{"$f":"$AV581*BJ581","v":0},{"$f":"$AV581*BK581","v":0},{"$f":"$AV581*BL581","v":0}]
[null,{"$f":"'7'!B62","v":"7"},{"$f":"'7'!C62","v":"7.3"},{"$f":"'7'!D62","v":"7.3.1"},{"$f":"'7'!E62","v":0},{"$f":"'7'!F62","v":"7.3.1.2"},{"$f":"'7'!G62","v":"7.3.1.2: WHETHER CUSTOMERS CAN BRING LEGAL COUNSEL TO EXTERNAL DISPUTE PROCEEDINGS\nProviders should inform customers whether they may bring legal counsel and/or other assistance to any external dispute resolution proceeding.\n\nCustomer care personnel should be able to communicate this information to customers, and it should be included in the customer contract and/or Terms & Conditions."},{"$f":"'7'!H62","v":0},{"$f":"'7'!I62","v":"7.3.1.2.1"},{"$f":"'7'!J62","v":"7.3.1.2.1: Are customer care personnel trained to inform customers whether they may bring legal counsel and/or other assistance to any alternative dispute resolution proceeding?\n"},{"$f":"'7'!K62","v":0},{"$f":"'7'!L62","v":0},{"$f":"'7'!M62","v":"Recommended"},{"$f":"'7'!N62","v":"Recommended"},{"$f":"'7'!O62","v":"CustServ"},{"$f":"'7'!P62","v":0},{"$f":"'7'!Q62","v":0},{"$f":"'7'!R62","v":0},{"$f":"'7'!S62","v":0},{"$f":"'7'!T62","v":0},{"$f":"'7'!U62","v":0},{"$f":"'7'!V62","v":0},{"$f":"'7'!W62","v":0},{"$f":"'7'!X62","v":0},{"$f":"'7'!Y62","v":0},{"$f":"'7'!Z62","v":0},{"$f":"'7'!AA62","v":0},{"$f":"'7'!AB62","v":0},{"$f":"'7'!AC62","v":0},{"$f":"'7'!AD62","v":0},{"$f":"'7'!AE62","v":0},{"$f":"'7'!AF62","v":0},{"$f":"'7'!AG62","v":0},{"$f":"'7'!AH62","v":0},{"$f":"'7'!AI62","v":0},{"$f":"'7'!AJ62","v":0},{"$f":"'7'!AK62","v":0},{"$f":"'7'!AL62","v":0},{"$f":"'7'!AM62","v":0},{"$f":"'7'!AN62","v":0},{"$f":"'7'!AO62","v":0},{"$f":"'7'!AP62","v":0},{"$f":"'7'!AQ62","v":0},{"$f":"'7'!AR62","v":0},{"$f":"'7'!AS62","v":0},{"$f":"'7'!AT62","v":0},{"$f":"SUMPRODUCT(IF($N582=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N582=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B63","v":"7"},{"$f":"'7'!C63","v":"7.3"},{"$f":"'7'!D63","v":"7.3.1"},{"$f":"'7'!E63","v":0},{"$f":"'7'!F63","v":"7.3.1.2"},{"$f":"'7'!G63","v":0},{"$f":"'7'!H63","v":0},{"$f":"'7'!I63","v":"7.3.1.2.2"},{"$f":"'7'!J63","v":"7.3.1.2.2: Is information on whether customers may bring legal counsel and/or other assistance to any alternative dispute resolution proceeding included in the customer contract and/or Terms & Conditions?\n"},{"$f":"'7'!K63","v":0},{"$f":"'7'!L63","v":0},{"$f":"'7'!M63","v":"Recommended"},{"$f":"'7'!N63","v":"Recommended"},{"$f":"'7'!O63","v":"CustServ"},{"$f":"'7'!P63","v":0},{"$f":"'7'!Q63","v":0},{"$f":"'7'!R63","v":0},{"$f":"'7'!S63","v":0},{"$f":"'7'!T63","v":0},{"$f":"'7'!U63","v":0},{"$f":"'7'!V63","v":0},{"$f":"'7'!W63","v":0},{"$f":"'7'!X63","v":0},{"$f":"'7'!Y63","v":0},{"$f":"'7'!Z63","v":0},{"$f":"'7'!AA63","v":0},{"$f":"'7'!AB63","v":0},{"$f":"'7'!AC63","v":0},{"$f":"'7'!AD63","v":0},{"$f":"'7'!AE63","v":0},{"$f":"'7'!AF63","v":0},{"$f":"'7'!AG63","v":0},{"$f":"'7'!AH63","v":0},{"$f":"'7'!AI63","v":0},{"$f":"'7'!AJ63","v":0},{"$f":"'7'!AK63","v":0},{"$f":"'7'!AL63","v":0},{"$f":"'7'!AM63","v":0},{"$f":"'7'!AN63","v":0},{"$f":"'7'!AO63","v":0},{"$f":"'7'!AP63","v":0},{"$f":"'7'!AQ63","v":0},{"$f":"'7'!AR63","v":0},{"$f":"'7'!AS63","v":0},{"$f":"'7'!AT63","v":0},{"$f":"SUMPRODUCT(IF($N583=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N583=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B64","v":"7"},{"$f":"'7'!C64","v":"7.3"},{"$f":"'7'!D64","v":"7.3.1"},{"$f":"'7'!E64","v":0},{"$f":"'7'!F64","v":"7.3.1.3"},{"$f":"'7'!G64","v":"7.3.1.3: INFORM CUSTOMERS OF LIABILITY FOR COSTS\nIf applicable, providers should inform customers that the losing party in external recourse proceedings may be liable for some or all of the winning party's costs:\n - if the customer loses, the customer may be liable for some or all of the provider's legal fees and/or other expenses; and\n - if the provider loses, the provider may be liable for some or all of the customer's legal fees and/or other expenses.\n\nCustomer care personnel should be able to communicate this information to customers, and it should be included in the customer contract and/or Terms & Conditions.\n"},{"$f":"'7'!H64","v":0},{"$f":"'7'!I64","v":"7.3.1.3.1"},{"$f":"'7'!J64","v":"7.3.1.3.1: If applicable, are customer care personnel trained to inform customers that the losing party in external recourse proceedings may be liable for some or all of the winning party's costs?\n"},{"$f":"'7'!K64","v":0},{"$f":"'7'!L64","v":0},{"$f":"'7'!M64","v":"Recommended"},{"$f":"'7'!N64","v":"Recommended"},{"$f":"'7'!O64","v":"CustServ"},{"$f":"'7'!P64","v":0},{"$f":"'7'!Q64","v":0},{"$f":"'7'!R64","v":0},{"$f":"'7'!S64","v":0},{"$f":"'7'!T64","v":0},{"$f":"'7'!U64","v":0},{"$f":"'7'!V64","v":0},{"$f":"'7'!W64","v":0},{"$f":"'7'!X64","v":0},{"$f":"'7'!Y64","v":0},{"$f":"'7'!Z64","v":0},{"$f":"'7'!AA64","v":0},{"$f":"'7'!AB64","v":0},{"$f":"'7'!AC64","v":0},{"$f":"'7'!AD64","v":0},{"$f":"'7'!AE64","v":0},{"$f":"'7'!AF64","v":0},{"$f":"'7'!AG64","v":0},{"$f":"'7'!AH64","v":0},{"$f":"'7'!AI64","v":0},{"$f":"'7'!AJ64","v":0},{"$f":"'7'!AK64","v":0},{"$f":"'7'!AL64","v":0},{"$f":"'7'!AM64","v":0},{"$f":"'7'!AN64","v":0},{"$f":"'7'!AO64","v":0},{"$f":"'7'!AP64","v":0},{"$f":"'7'!AQ64","v":0},{"$f":"'7'!AR64","v":0},{"$f":"'7'!AS64","v":0},{"$f":"'7'!AT64","v":0},{"$f":"SUMPRODUCT(IF($N584=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N584=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B65","v":"7"},{"$f":"'7'!C65","v":"7.3"},{"$f":"'7'!D65","v":"7.3.1"},{"$f":"'7'!E65","v":0},{"$f":"'7'!F65","v":"7.3.1.3"},{"$f":"'7'!G65","v":0},{"$f":"'7'!H65","v":0},{"$f":"'7'!I65","v":"7.3.1.3.2"},{"$f":"'7'!J65","v":"7.3.1.3.2: Is information on liability for the legal costs of external recourse included in the customer contract and/or Terms & Conditions?\n"},{"$f":"'7'!K65","v":0},{"$f":"'7'!L65","v":0},{"$f":"'7'!M65","v":"Recommended"},{"$f":"'7'!N65","v":"Recommended"},{"$f":"'7'!O65","v":"CustServ"},{"$f":"'7'!P65","v":0},{"$f":"'7'!Q65","v":0},{"$f":"'7'!R65","v":0},{"$f":"'7'!S65","v":0},{"$f":"'7'!T65","v":0},{"$f":"'7'!U65","v":0},{"$f":"'7'!V65","v":0},{"$f":"'7'!W65","v":0},{"$f":"'7'!X65","v":0},{"$f":"'7'!Y65","v":0},{"$f":"'7'!Z65","v":0},{"$f":"'7'!AA65","v":0},{"$f":"'7'!AB65","v":0},{"$f":"'7'!AC65","v":0},{"$f":"'7'!AD65","v":0},{"$f":"'7'!AE65","v":0},{"$f":"'7'!AF65","v":0},{"$f":"'7'!AG65","v":0},{"$f":"'7'!AH65","v":0},{"$f":"'7'!AI65","v":0},{"$f":"'7'!AJ65","v":0},{"$f":"'7'!AK65","v":0},{"$f":"'7'!AL65","v":0},{"$f":"'7'!AM65","v":0},{"$f":"'7'!AN65","v":0},{"$f":"'7'!AO65","v":0},{"$f":"'7'!AP65","v":0},{"$f":"'7'!AQ65","v":0},{"$f":"'7'!AR65","v":0},{"$f":"'7'!AS65","v":0},{"$f":"'7'!AT65","v":0},{"$f":"SUMPRODUCT(IF($N585=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N585=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B66","v":"7"},{"$f":"'7'!C66","v":"7.3"},{"$f":"'7'!D66","v":"7.3.1"},{"$f":"'7'!E66","v":0},{"$f":"'7'!F66","v":"7.3.1.4"},{"$f":"'7'!G66","v":"7.3.1.4: TERMS OR CONDITIONS THAT AFFECT POSSIBILITY OF CUSTOMER SUCCESS IN EXTERNAL DISPUTE RESOLUTION\nProviders should inform customers of any terms or conditions that may affect the possibility of customer success in external dispute resolution proceedings. For example, the Terms & Conditions may include a clause stating that the provider is not liable for customer losses under certain circumstances (such as some instances of fraud).\n\nCustomer care personnel should be able to communicate this information to customers, and it should be included in the customer contract and/or Terms & Conditions."},{"$f":"'7'!H66","v":0},{"$f":"'7'!I66","v":"7.3.1.4.1"},{"$f":"'7'!J66","v":"7.3.1.4.1: Are customer care personnel trained to inform customers of any terms or conditions that may affect the possibility of customer success in external dispute resolution proceedings?\n"},{"$f":"'7'!K66","v":0},{"$f":"'7'!L66","v":0},{"$f":"'7'!M66","v":"Recommended"},{"$f":"'7'!N66","v":"Recommended"},{"$f":"'7'!O66","v":"CustServ"},{"$f":"'7'!P66","v":0},{"$f":"'7'!Q66","v":0},{"$f":"'7'!R66","v":0},{"$f":"'7'!S66","v":0},{"$f":"'7'!T66","v":0},{"$f":"'7'!U66","v":0},{"$f":"'7'!V66","v":0},{"$f":"'7'!W66","v":0},{"$f":"'7'!X66","v":0},{"$f":"'7'!Y66","v":0},{"$f":"'7'!Z66","v":0},{"$f":"'7'!AA66","v":0},{"$f":"'7'!AB66","v":0},{"$f":"'7'!AC66","v":0},{"$f":"'7'!AD66","v":0},{"$f":"'7'!AE66","v":0},{"$f":"'7'!AF66","v":0},{"$f":"'7'!AG66","v":0},{"$f":"'7'!AH66","v":0},{"$f":"'7'!AI66","v":0},{"$f":"'7'!AJ66","v":0},{"$f":"'7'!AK66","v":0},{"$f":"'7'!AL66","v":0},{"$f":"'7'!AM66","v":0},{"$f":"'7'!AN66","v":0},{"$f":"'7'!AO66","v":0},{"$f":"'7'!AP66","v":0},{"$f":"'7'!AQ66","v":0},{"$f":"'7'!AR66","v":0},{"$f":"'7'!AS66","v":0},{"$f":"'7'!AT66","v":0},{"$f":"SUMPRODUCT(IF($N586=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N586=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'7'!B67","v":"7"},{"$f":"'7'!C67","v":"7.3"},{"$f":"'7'!D67","v":"7.3.1"},{"$f":"'7'!E67","v":0},{"$f":"'7'!F67","v":"7.3.1.4"},{"$f":"'7'!G67","v":0},{"$f":"'7'!H67","v":0},{"$f":"'7'!I67","v":"7.3.1.4.2"},{"$f":"'7'!J67","v":"7.3.1.4.2: Is information on any terms or conditions that may affect the possibility of customer success in external dispute resolution proceedings included in the customer contract and/or Terms & Conditions?\n"},{"$f":"'7'!K67","v":0},{"$f":"'7'!L67","v":0},{"$f":"'7'!M67","v":"Recommended"},{"$f":"'7'!N67","v":"Recommended"},{"$f":"'7'!O67","v":"CustServ"},{"$f":"'7'!P67","v":0},{"$f":"'7'!Q67","v":0},{"$f":"'7'!R67","v":0},{"$f":"'7'!S67","v":0},{"$f":"'7'!T67","v":0},{"$f":"'7'!U67","v":0},{"$f":"'7'!V67","v":0},{"$f":"'7'!W67","v":0},{"$f":"'7'!X67","v":0},{"$f":"'7'!Y67","v":0},{"$f":"'7'!Z67","v":0},{"$f":"'7'!AA67","v":0},{"$f":"'7'!AB67","v":0},{"$f":"'7'!AC67","v":0},{"$f":"'7'!AD67","v":0},{"$f":"'7'!AE67","v":0},{"$f":"'7'!AF67","v":0},{"$f":"'7'!AG67","v":0},{"$f":"'7'!AH67","v":0},{"$f":"'7'!AI67","v":0},{"$f":"'7'!AJ67","v":0},{"$f":"'7'!AK67","v":0},{"$f":"'7'!AL67","v":0},{"$f":"'7'!AM67","v":0},{"$f":"'7'!AN67","v":0},{"$f":"'7'!AO67","v":0},{"$f":"'7'!AP67","v":0},{"$f":"'7'!AQ67","v":0},{"$f":"'7'!AR67","v":0},{"$f":"'7'!AS67","v":0},{"$f":"'7'!AT67","v":0},{"$f":"SUMPRODUCT(IF($N587=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N587=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B5","v":"8"},{"$f":"'8'!C5","v":"8.1"},{"$f":"'8'!D5","v":"8.1.1"},{"$f":"'8'!E5","v":"8.1.1: Providers shall comply with good practices and relevant regulations governing customer data privacy.\n"},{"$f":"'8'!F5","v":"8.1.1.1"},{"$f":"'8'!G5","v":"8.1.1.1: DATA PRIVACY POLICY\nProviders should define and implement a data privacy policy. The policy should, at minimum: \n- commit to fair usage of personal data;\n- commit to protection of personal data; \n- outline the approach to identifying and managing personal data (through IPAs and PIAs - see 8.1.1.3);\n- identify the approach for responding to data privacy breaches (8.1.1.7);\n- specify principles for data privacy rules of behaviour (8.1.1.4); and\n- define requirements for maintaining data quality (8.1.1.6).\n\nThe data privacy policy should be communicated to employees and entities providing outsourced services, as appropriate. The policy should take account of relevant laws and other regulatory mandates.\n\nData Privacy protects customers personal data from misuse by the provider or other parties. Personal Data is private information of a customer that is held by the provider. Examples include KYC data, identity data and credit history. \nMisuse of personal data could include:\n  - fraud on the customer's account - impersonation of the customer may be facilitated by the use of the customer's personal data;\n  - identity theft - false accounts could be opened in the customer's name using their personal data;\n  - unwanted marketing - the customer could be sent unwanted marketing material (phone calls, SMS messages, emails or letters)."},{"$f":"'8'!H5","v":0},{"$f":"'8'!I5","v":"8.1.1.1.1"},{"$f":"'8'!J5","v":"8.1.1.1.1: Does the provider have a data privacy policy that commits to fair usage and protection of personal data?\n"},{"$f":"'8'!K5","v":"1) Data privacy policy or data privacy rules of behaviour document\n- Check that the document includes a commitment to fair usage of personal data\n-Check that the document includes details of how personal data is protected"},{"$f":"'8'!L5","v":0},{"$f":"'8'!M5","v":"Standard Required"},{"$f":"'8'!N5","v":"Required"},{"$f":"'8'!O5","v":"BizOps"},{"$f":"'8'!P5","v":0},{"$f":"'8'!Q5","v":0},{"$f":"'8'!R5","v":0},{"$f":"'8'!S5","v":0},{"$f":"'8'!T5","v":0},{"$f":"'8'!U5","v":0},{"$f":"'8'!V5","v":0},{"$f":"'8'!W5","v":0},{"$f":"'8'!X5","v":0},{"$f":"'8'!Y5","v":0},{"$f":"'8'!Z5","v":0},{"$f":"'8'!AA5","v":0},{"$f":"'8'!AB5","v":0},{"$f":"'8'!AC5","v":0},{"$f":"'8'!AD5","v":0},{"$f":"'8'!AE5","v":0},{"$f":"'8'!AF5","v":0},{"$f":"'8'!AG5","v":0},{"$f":"'8'!AH5","v":0},{"$f":"'8'!AI5","v":0},{"$f":"'8'!AJ5","v":0},{"$f":"'8'!AK5","v":0},{"$f":"'8'!AL5","v":0},{"$f":"'8'!AM5","v":0},{"$f":"'8'!AN5","v":0},{"$f":"'8'!AO5","v":0},{"$f":"'8'!AP5","v":0},{"$f":"'8'!AQ5","v":0},{"$f":"'8'!AR5","v":0},{"$f":"'8'!AS5","v":0},{"$f":"'8'!AT5","v":0},{"$f":"SUMPRODUCT(IF($N588=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N588=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B6","v":"8"},{"$f":"'8'!C6","v":"8.1"},{"$f":"'8'!D6","v":"8.1.1"},{"$f":"'8'!E6","v":0},{"$f":"'8'!F6","v":"8.1.1.2"},{"$f":"'8'!G6","v":"8.1.1.2: ASSIGN RESPONSIBILITY FOR CUSTOMER DATA PRIVACY\nProviders should assign responsibility for overseeing the implementation of processes and technology to meet the data privacy policy. An individual or a team could be assigned this responsibility. If a team is assigned the responsibility for data privacy then the manager should be assigned overall responsibility.\n\nIn providers that are part of a group of companies, data privacy responsibility could be assigned at group level instead of in the local company.\n"},{"$f":"'8'!H6","v":"IS029100 4.2"},{"$f":"'8'!I6","v":"8.1.1.2.1"},{"$f":"'8'!J6","v":"8.1.1.2.1: Has responsibility been assigned for overseeing the implementation of the data privacy policy?\n"},{"$f":"'8'!K6","v":"1) Organisation chart indicating Data Privacy responsibility (could be group-level or local-level organization)\n- Check that the data protection responsibilities are included in the organisation chart or role/team description, including the responsibility for overseeing implementation of the data privacy policy.\n- If a team is assigned the responsibility for data privacy then check that the manager has been assigned overall responsibility. "},{"$f":"'8'!L6","v":0},{"$f":"'8'!M6","v":"Standard Required"},{"$f":"'8'!N6","v":"Required"},{"$f":"'8'!O6","v":"BizOps"},{"$f":"'8'!P6","v":0},{"$f":"'8'!Q6","v":0},{"$f":"'8'!R6","v":0},{"$f":"'8'!S6","v":0},{"$f":"'8'!T6","v":0},{"$f":"'8'!U6","v":0},{"$f":"'8'!V6","v":0},{"$f":"'8'!W6","v":0},{"$f":"'8'!X6","v":0},{"$f":"'8'!Y6","v":0},{"$f":"'8'!Z6","v":0},{"$f":"'8'!AA6","v":0},{"$f":"'8'!AB6","v":0},{"$f":"'8'!AC6","v":0},{"$f":"'8'!AD6","v":0},{"$f":"'8'!AE6","v":0},{"$f":"'8'!AF6","v":0},{"$f":"'8'!AG6","v":0},{"$f":"'8'!AH6","v":0},{"$f":"'8'!AI6","v":0},{"$f":"'8'!AJ6","v":0},{"$f":"'8'!AK6","v":0},{"$f":"'8'!AL6","v":0},{"$f":"'8'!AM6","v":0},{"$f":"'8'!AN6","v":0},{"$f":"'8'!AO6","v":0},{"$f":"'8'!AP6","v":0},{"$f":"'8'!AQ6","v":0},{"$f":"'8'!AR6","v":0},{"$f":"'8'!AS6","v":0},{"$f":"'8'!AT6","v":0},{"$f":"SUMPRODUCT(IF($N589=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N589=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B7","v":"8"},{"$f":"'8'!C7","v":"8.1"},{"$f":"'8'!D7","v":"8.1.1"},{"$f":"'8'!E7","v":0},{"$f":"'8'!F7","v":"8.1.1.3"},{"$f":"'8'!G7","v":"8.1.1.3: IDENTIFY ALL PERSONAL DATA AND MANAGE PRIVACY RISKS\nA data privacy assessment process should be implemented to manage data privacy risks. The process should include two key steps: an Initial Privacy Assessment (IPA) to identify personal data, and a Privacy Impact Assessment (PIA) to manage risks to personal data.\n\nThe Initial Privacy Assessment (IPA) should identify all personal data that is stored and processed in the mobile money system. Business, technical, security and risk management teams should collaborate to complete the IPA.\n\nThe Privacy Impact Assessment (PIA) determines and mitigates privacy risks during collection and processing of personal data, more specifically: \n- identifies risks associated with mobile money customers' data that is being held, considering how the data is stored and transmitted and the people that have access to it; and\n- identifies protection processes for handling customers' data to mitigate privacy risks.\n\nData privacy risks identified by the PIA should be entered into the mobile money risk matrix (see 4.6.1.2).\n\nIPAs and PIAs should be conducted whenever changes are made to the mobile money service or system."},{"$f":"'8'!H7","v":"NIST 4.2.2\nIS029100 4.5"},{"$f":"'8'!I7","v":"8.1.1.3.1"},{"$f":"'8'!J7","v":"8.1.1.3.1: Does the data privacy assessment process include steps to identify all personal data that is stored and processed by mobile money (i.e. an Initial Privacy Assessment - IPA)?\n"},{"$f":"'8'!K7","v":"1) Data privacy assessment process\n- Check that the provider has conducted steps to identify all personal data that is stored and processed by mobile money (initial privacy assessment (IPA) process).\n- Check that data that is processed and stored has been documented."},{"$f":"'8'!L7","v":0},{"$f":"'8'!M7","v":"Standard Required"},{"$f":"'8'!N7","v":"Required"},{"$f":"'8'!O7","v":"BizOps"},{"$f":"'8'!P7","v":0},{"$f":"'8'!Q7","v":0},{"$f":"'8'!R7","v":0},{"$f":"'8'!S7","v":0},{"$f":"'8'!T7","v":0},{"$f":"'8'!U7","v":0},{"$f":"'8'!V7","v":0},{"$f":"'8'!W7","v":0},{"$f":"'8'!X7","v":0},{"$f":"'8'!Y7","v":0},{"$f":"'8'!Z7","v":0},{"$f":"'8'!AA7","v":0},{"$f":"'8'!AB7","v":0},{"$f":"'8'!AC7","v":0},{"$f":"'8'!AD7","v":0},{"$f":"'8'!AE7","v":0},{"$f":"'8'!AF7","v":0},{"$f":"'8'!AG7","v":0},{"$f":"'8'!AH7","v":0},{"$f":"'8'!AI7","v":0},{"$f":"'8'!AJ7","v":0},{"$f":"'8'!AK7","v":0},{"$f":"'8'!AL7","v":0},{"$f":"'8'!AM7","v":0},{"$f":"'8'!AN7","v":0},{"$f":"'8'!AO7","v":0},{"$f":"'8'!AP7","v":0},{"$f":"'8'!AQ7","v":0},{"$f":"'8'!AR7","v":0},{"$f":"'8'!AS7","v":0},{"$f":"'8'!AT7","v":0},{"$f":"SUMPRODUCT(IF($N590=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N590=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B8","v":"8"},{"$f":"'8'!C8","v":"8.1"},{"$f":"'8'!D8","v":"8.1.1"},{"$f":"'8'!E8","v":0},{"$f":"'8'!F8","v":"8.1.1.3"},{"$f":"'8'!G8","v":0},{"$f":"'8'!H8","v":0},{"$f":"'8'!I8","v":"8.1.1.3.2"},{"$f":"'8'!J8","v":"8.1.1.3.2: Does the data privacy assessment process include steps to determine and mitigate risks to data privacy (i.e. a Privacy Impact Assessment - PIA)?\n"},{"$f":"'8'!K8","v":"1) Data privacy assessment process\n- Check that the provider has conducted a process to determine and mitigate risks to data privacy within mobile money (privacy impact assessment (PIA) process).\n- Check that the risks and mitigations have been documented."},{"$f":"'8'!L8","v":0},{"$f":"'8'!M8","v":"Standard Required"},{"$f":"'8'!N8","v":"Required"},{"$f":"'8'!O8","v":"BizOps"},{"$f":"'8'!P8","v":0},{"$f":"'8'!Q8","v":0},{"$f":"'8'!R8","v":0},{"$f":"'8'!S8","v":0},{"$f":"'8'!T8","v":0},{"$f":"'8'!U8","v":0},{"$f":"'8'!V8","v":0},{"$f":"'8'!W8","v":0},{"$f":"'8'!X8","v":0},{"$f":"'8'!Y8","v":0},{"$f":"'8'!Z8","v":0},{"$f":"'8'!AA8","v":0},{"$f":"'8'!AB8","v":0},{"$f":"'8'!AC8","v":0},{"$f":"'8'!AD8","v":0},{"$f":"'8'!AE8","v":0},{"$f":"'8'!AF8","v":0},{"$f":"'8'!AG8","v":0},{"$f":"'8'!AH8","v":0},{"$f":"'8'!AI8","v":0},{"$f":"'8'!AJ8","v":0},{"$f":"'8'!AK8","v":0},{"$f":"'8'!AL8","v":0},{"$f":"'8'!AM8","v":0},{"$f":"'8'!AN8","v":0},{"$f":"'8'!AO8","v":0},{"$f":"'8'!AP8","v":0},{"$f":"'8'!AQ8","v":0},{"$f":"'8'!AR8","v":0},{"$f":"'8'!AS8","v":0},{"$f":"'8'!AT8","v":0},{"$f":"SUMPRODUCT(IF($N591=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N591=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B9","v":"8"},{"$f":"'8'!C9","v":"8.1"},{"$f":"'8'!D9","v":"8.1.1"},{"$f":"'8'!E9","v":0},{"$f":"'8'!F9","v":"8.1.1.3"},{"$f":"'8'!G9","v":0},{"$f":"'8'!H9","v":0},{"$f":"'8'!I9","v":"8.1.1.3.3"},{"$f":"'8'!J9","v":"8.1.1.3.3: Are IPAs and PIAs conducted whenever changes are made to the mobile money service or system?\n"},{"$f":"'8'!K9","v":0},{"$f":"'8'!L9","v":0},{"$f":"'8'!M9","v":"Recommended"},{"$f":"'8'!N9","v":"Recommended"},{"$f":"'8'!O9","v":"BizOps"},{"$f":"'8'!P9","v":0},{"$f":"'8'!Q9","v":0},{"$f":"'8'!R9","v":0},{"$f":"'8'!S9","v":0},{"$f":"'8'!T9","v":0},{"$f":"'8'!U9","v":0},{"$f":"'8'!V9","v":0},{"$f":"'8'!W9","v":0},{"$f":"'8'!X9","v":0},{"$f":"'8'!Y9","v":0},{"$f":"'8'!Z9","v":0},{"$f":"'8'!AA9","v":0},{"$f":"'8'!AB9","v":0},{"$f":"'8'!AC9","v":0},{"$f":"'8'!AD9","v":0},{"$f":"'8'!AE9","v":0},{"$f":"'8'!AF9","v":0},{"$f":"'8'!AG9","v":0},{"$f":"'8'!AH9","v":0},{"$f":"'8'!AI9","v":0},{"$f":"'8'!AJ9","v":0},{"$f":"'8'!AK9","v":0},{"$f":"'8'!AL9","v":0},{"$f":"'8'!AM9","v":0},{"$f":"'8'!AN9","v":0},{"$f":"'8'!AO9","v":0},{"$f":"'8'!AP9","v":0},{"$f":"'8'!AQ9","v":0},{"$f":"'8'!AR9","v":0},{"$f":"'8'!AS9","v":0},{"$f":"'8'!AT9","v":0},{"$f":"SUMPRODUCT(IF($N592=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N592=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B10","v":"8"},{"$f":"'8'!C10","v":"8.1"},{"$f":"'8'!D10","v":"8.1.1"},{"$f":"'8'!E10","v":0},{"$f":"'8'!F10","v":"8.1.1.4"},{"$f":"'8'!G10","v":"8.1.1.4: DATA PRIVACY RULES OF BEHAVIOUR\nUsing the results of the IPA and PIA, the provider should define data privacy rules of behaviour, which define controls for the handling of personal data. The privacy rules of behaviour should include:\n- Access rules for personal data;\n- Limitations on the collection, disclosure, sharing, and use of personal data;\n- Personal data retention schedules and procedures;\n- Data privacy in the system development lifecycle process; and\n- Consequences for failure to follow privacy rules of behaviour."},{"$f":"'8'!H10","v":"NIST 4.1.1\nISO 29100:2011:2011 4.6"},{"$f":"'8'!I10","v":"8.1.1.4.1"},{"$f":"'8'!J10","v":"8.1.1.4.1: Has the provider defined data privacy rules of behaviour that govern access, collection, disclosure, sharing, retention, and use of personal data?\n"},{"$f":"'8'!K10","v":"1) Data privacy rules of behaviour document\n- Check that the document defines data privacy rules of behaviour that govern how personal data is:\na) Accessed\nb) Collected \nc) Disclosed \nd) Shared \ne) Retained \nf) Used"},{"$f":"'8'!L10","v":0},{"$f":"'8'!M10","v":"Standard Required"},{"$f":"'8'!N10","v":"Required"},{"$f":"'8'!O10","v":"BizOps"},{"$f":"'8'!P10","v":0},{"$f":"'8'!Q10","v":0},{"$f":"'8'!R10","v":0},{"$f":"'8'!S10","v":0},{"$f":"'8'!T10","v":0},{"$f":"'8'!U10","v":0},{"$f":"'8'!V10","v":0},{"$f":"'8'!W10","v":0},{"$f":"'8'!X10","v":0},{"$f":"'8'!Y10","v":0},{"$f":"'8'!Z10","v":0},{"$f":"'8'!AA10","v":0},{"$f":"'8'!AB10","v":0},{"$f":"'8'!AC10","v":0},{"$f":"'8'!AD10","v":0},{"$f":"'8'!AE10","v":0},{"$f":"'8'!AF10","v":0},{"$f":"'8'!AG10","v":0},{"$f":"'8'!AH10","v":0},{"$f":"'8'!AI10","v":0},{"$f":"'8'!AJ10","v":0},{"$f":"'8'!AK10","v":0},{"$f":"'8'!AL10","v":0},{"$f":"'8'!AM10","v":0},{"$f":"'8'!AN10","v":0},{"$f":"'8'!AO10","v":0},{"$f":"'8'!AP10","v":0},{"$f":"'8'!AQ10","v":0},{"$f":"'8'!AR10","v":0},{"$f":"'8'!AS10","v":0},{"$f":"'8'!AT10","v":0},{"$f":"SUMPRODUCT(IF($N593=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N593=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B11","v":"8"},{"$f":"'8'!C11","v":"8.1"},{"$f":"'8'!D11","v":"8.1.1"},{"$f":"'8'!E11","v":0},{"$f":"'8'!F11","v":"8.1.1.4"},{"$f":"'8'!G11","v":0},{"$f":"'8'!H11","v":0},{"$f":"'8'!I11","v":"8.1.1.4.2"},{"$f":"'8'!J11","v":"8.1.1.4.2: Do the data privacy rules of behaviour discuss consequences for failure to follow these rules?\n"},{"$f":"'8'!K11","v":0},{"$f":"'8'!L11","v":0},{"$f":"'8'!M11","v":"Recommended"},{"$f":"'8'!N11","v":"Recommended"},{"$f":"'8'!O11","v":"BizOps"},{"$f":"'8'!P11","v":0},{"$f":"'8'!Q11","v":0},{"$f":"'8'!R11","v":0},{"$f":"'8'!S11","v":0},{"$f":"'8'!T11","v":0},{"$f":"'8'!U11","v":0},{"$f":"'8'!V11","v":0},{"$f":"'8'!W11","v":0},{"$f":"'8'!X11","v":0},{"$f":"'8'!Y11","v":0},{"$f":"'8'!Z11","v":0},{"$f":"'8'!AA11","v":0},{"$f":"'8'!AB11","v":0},{"$f":"'8'!AC11","v":0},{"$f":"'8'!AD11","v":0},{"$f":"'8'!AE11","v":0},{"$f":"'8'!AF11","v":0},{"$f":"'8'!AG11","v":0},{"$f":"'8'!AH11","v":0},{"$f":"'8'!AI11","v":0},{"$f":"'8'!AJ11","v":0},{"$f":"'8'!AK11","v":0},{"$f":"'8'!AL11","v":0},{"$f":"'8'!AM11","v":0},{"$f":"'8'!AN11","v":0},{"$f":"'8'!AO11","v":0},{"$f":"'8'!AP11","v":0},{"$f":"'8'!AQ11","v":0},{"$f":"'8'!AR11","v":0},{"$f":"'8'!AS11","v":0},{"$f":"'8'!AT11","v":0},{"$f":"SUMPRODUCT(IF($N594=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N594=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B12","v":"8"},{"$f":"'8'!C12","v":"8.1"},{"$f":"'8'!D12","v":"8.1.1"},{"$f":"'8'!E12","v":0},{"$f":"'8'!F12","v":"8.1.1.5"},{"$f":"'8'!G12","v":"8.1.1.5: DATA PRIVACY POLICIES OF THIRD PARTIES\nWritten agreements governing data privacy should be in place with all third parties that either process personal data or have access to personal data. This includes:\n(1) processing or transfer of personal data through third party systems;\n(2) sharing of personal data with third parties such as financial ecosystem partners or entities providing outsourced services.\n\nRelevant third parties could include:\n - suppliers, such as technical platform provider or agent management company;\n - financial partners, such ATM providers and banks.\n\nThese agreements should cover:\n- the third party's responsibility to ensure data privacy;\n- restrictions on further sharing of personal data;\n- notification requirements in case of a breach."},{"$f":"'8'!H12","v":"NIST 4.1.1\nISO 29100:2011:2011 4.6"},{"$f":"'8'!I12","v":"8.1.1.5.1"},{"$f":"'8'!J12","v":"8.1.1.5.1: Where necessary, do agreements with external parties cover responsibilities for data privacy and restrictions on further sharing of personal data?\n"},{"$f":"'8'!K12","v":"1) Data privacy policy or data privacy rules of behaviour document\n- Check that the document requires data privacy responsibilities to be contractually assigned to third parties with data access.\n\n2) Sample agreement with an external party that has access to customer data\n- Check that the agreement includes the 3rd party's responsibility for ensuring data privacy.\n- Check that the agreement prevents further sharing of customer data."},{"$f":"'8'!L12","v":0},{"$f":"'8'!M12","v":"Standard Required"},{"$f":"'8'!N12","v":"Required"},{"$f":"'8'!O12","v":"BizOps"},{"$f":"'8'!P12","v":0},{"$f":"'8'!Q12","v":0},{"$f":"'8'!R12","v":0},{"$f":"'8'!S12","v":0},{"$f":"'8'!T12","v":0},{"$f":"'8'!U12","v":0},{"$f":"'8'!V12","v":0},{"$f":"'8'!W12","v":0},{"$f":"'8'!X12","v":0},{"$f":"'8'!Y12","v":0},{"$f":"'8'!Z12","v":0},{"$f":"'8'!AA12","v":0},{"$f":"'8'!AB12","v":0},{"$f":"'8'!AC12","v":0},{"$f":"'8'!AD12","v":0},{"$f":"'8'!AE12","v":0},{"$f":"'8'!AF12","v":0},{"$f":"'8'!AG12","v":0},{"$f":"'8'!AH12","v":0},{"$f":"'8'!AI12","v":0},{"$f":"'8'!AJ12","v":0},{"$f":"'8'!AK12","v":0},{"$f":"'8'!AL12","v":0},{"$f":"'8'!AM12","v":0},{"$f":"'8'!AN12","v":0},{"$f":"'8'!AO12","v":0},{"$f":"'8'!AP12","v":0},{"$f":"'8'!AQ12","v":0},{"$f":"'8'!AR12","v":0},{"$f":"'8'!AS12","v":0},{"$f":"'8'!AT12","v":0},{"$f":"SUMPRODUCT(IF($N595=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N595=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B13","v":"8"},{"$f":"'8'!C13","v":"8.1"},{"$f":"'8'!D13","v":"8.1.1"},{"$f":"'8'!E13","v":0},{"$f":"'8'!F13","v":"8.1.1.5"},{"$f":"'8'!G13","v":0},{"$f":"'8'!H13","v":0},{"$f":"'8'!I13","v":"8.1.1.5.2"},{"$f":"'8'!J13","v":"8.1.1.5.2: Do agreements with all external parties describe notification requirements in case of a breach?\n"},{"$f":"'8'!K13","v":0},{"$f":"'8'!L13","v":0},{"$f":"'8'!M13","v":"Recommended"},{"$f":"'8'!N13","v":"Recommended"},{"$f":"'8'!O13","v":"BizOps"},{"$f":"'8'!P13","v":0},{"$f":"'8'!Q13","v":0},{"$f":"'8'!R13","v":0},{"$f":"'8'!S13","v":0},{"$f":"'8'!T13","v":0},{"$f":"'8'!U13","v":0},{"$f":"'8'!V13","v":0},{"$f":"'8'!W13","v":0},{"$f":"'8'!X13","v":0},{"$f":"'8'!Y13","v":0},{"$f":"'8'!Z13","v":0},{"$f":"'8'!AA13","v":0},{"$f":"'8'!AB13","v":0},{"$f":"'8'!AC13","v":0},{"$f":"'8'!AD13","v":0},{"$f":"'8'!AE13","v":0},{"$f":"'8'!AF13","v":0},{"$f":"'8'!AG13","v":0},{"$f":"'8'!AH13","v":0},{"$f":"'8'!AI13","v":0},{"$f":"'8'!AJ13","v":0},{"$f":"'8'!AK13","v":0},{"$f":"'8'!AL13","v":0},{"$f":"'8'!AM13","v":0},{"$f":"'8'!AN13","v":0},{"$f":"'8'!AO13","v":0},{"$f":"'8'!AP13","v":0},{"$f":"'8'!AQ13","v":0},{"$f":"'8'!AR13","v":0},{"$f":"'8'!AS13","v":0},{"$f":"'8'!AT13","v":0},{"$f":"SUMPRODUCT(IF($N596=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N596=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B14","v":"8"},{"$f":"'8'!C14","v":"8.1"},{"$f":"'8'!D14","v":"8.1.1"},{"$f":"'8'!E14","v":0},{"$f":"'8'!F14","v":"8.1.1.5"},{"$f":"'8'!G14","v":0},{"$f":"'8'!H14","v":0},{"$f":"'8'!I14","v":"8.1.1.5.3"},{"$f":"'8'!J14","v":"8.1.1.5.3: Do agreements with all external parties describe minimum security controls to limit access to personal data?\n"},{"$f":"'8'!K14","v":0},{"$f":"'8'!L14","v":0},{"$f":"'8'!M14","v":"Recommended"},{"$f":"'8'!N14","v":"Recommended"},{"$f":"'8'!O14","v":"BizOps"},{"$f":"'8'!P14","v":0},{"$f":"'8'!Q14","v":0},{"$f":"'8'!R14","v":0},{"$f":"'8'!S14","v":0},{"$f":"'8'!T14","v":0},{"$f":"'8'!U14","v":0},{"$f":"'8'!V14","v":0},{"$f":"'8'!W14","v":0},{"$f":"'8'!X14","v":0},{"$f":"'8'!Y14","v":0},{"$f":"'8'!Z14","v":0},{"$f":"'8'!AA14","v":0},{"$f":"'8'!AB14","v":0},{"$f":"'8'!AC14","v":0},{"$f":"'8'!AD14","v":0},{"$f":"'8'!AE14","v":0},{"$f":"'8'!AF14","v":0},{"$f":"'8'!AG14","v":0},{"$f":"'8'!AH14","v":0},{"$f":"'8'!AI14","v":0},{"$f":"'8'!AJ14","v":0},{"$f":"'8'!AK14","v":0},{"$f":"'8'!AL14","v":0},{"$f":"'8'!AM14","v":0},{"$f":"'8'!AN14","v":0},{"$f":"'8'!AO14","v":0},{"$f":"'8'!AP14","v":0},{"$f":"'8'!AQ14","v":0},{"$f":"'8'!AR14","v":0},{"$f":"'8'!AS14","v":0},{"$f":"'8'!AT14","v":0},{"$f":"SUMPRODUCT(IF($N597=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N597=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,{"$f":"$AU597*BL597","v":0},0,0,0,{"$f":"$AV597*BL597","v":0}]
[null,{"$f":"'8'!B15","v":"8"},{"$f":"'8'!C15","v":"8.1"},{"$f":"'8'!D15","v":"8.1.1"},{"$f":"'8'!E15","v":0},{"$f":"'8'!F15","v":"8.1.1.6"},{"$f":"'8'!G15","v":"8.1.1.6: PERSONAL DATA QUALITY AND ACCURACY\nProviders should maintain the accuracy and quality of personal data by: \n- reviewing customers' personal data periodically to ensure it is complete and free of obvious errors; \n- ensuring the reliability of personal data collected from a source other than the customer (e.g. a marketing agency) before it is processed; and\n- verifying the validity of personal data provided by the customer, where it is appropriate to do so. (Note that 2.5.1 elaborates on verification of personal data collected for KYC purposes during registration.)\n\nThis practice refers to all data collected for a customer, not just KYC data. For instance, other personal data such as address details or credit history could be collected.\nExamples of personal data sources other than the customer include marketing agencies and the provider's own subsidiaries or affiliates."},{"$f":"'8'!H15","v":"NIST Appendix D\nISO 29100:2011 5.7"},{"$f":"'8'!I15","v":"8.1.1.6.1"},{"$f":"'8'!J15","v":"8.1.1.6.1: Is customers' personal data reviewed periodically to ensure it is complete and free of obvious errors?\n"},{"$f":"'8'!K15","v":0},{"$f":"'8'!L15","v":0},{"$f":"'8'!M15","v":"Recommended"},{"$f":"'8'!N15","v":"Recommended"},{"$f":"'8'!O15","v":"BizOps"},{"$f":"'8'!P15","v":0},{"$f":"'8'!Q15","v":0},{"$f":"'8'!R15","v":0},{"$f":"'8'!S15","v":0},{"$f":"'8'!T15","v":0},{"$f":"'8'!U15","v":0},{"$f":"'8'!V15","v":0},{"$f":"'8'!W15","v":0},{"$f":"'8'!X15","v":0},{"$f":"'8'!Y15","v":0},{"$f":"'8'!Z15","v":0},{"$f":"'8'!AA15","v":0},{"$f":"'8'!AB15","v":0},{"$f":"'8'!AC15","v":0},{"$f":"'8'!AD15","v":0},{"$f":"'8'!AE15","v":0},{"$f":"'8'!AF15","v":0},{"$f":"'8'!AG15","v":0},{"$f":"'8'!AH15","v":0},{"$f":"'8'!AI15","v":0},{"$f":"'8'!AJ15","v":0},{"$f":"'8'!AK15","v":0},{"$f":"'8'!AL15","v":0},{"$f":"'8'!AM15","v":0},{"$f":"'8'!AN15","v":0},{"$f":"'8'!AO15","v":0},{"$f":"'8'!AP15","v":0},{"$f":"'8'!AQ15","v":0},{"$f":"'8'!AR15","v":0},{"$f":"'8'!AS15","v":0},{"$f":"'8'!AT15","v":0},{"$f":"SUMPRODUCT(IF($N598=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N598=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B16","v":"8"},{"$f":"'8'!C16","v":"8.1"},{"$f":"'8'!D16","v":"8.1.1"},{"$f":"'8'!E16","v":0},{"$f":"'8'!F16","v":"8.1.1.6"},{"$f":"'8'!G16","v":0},{"$f":"'8'!H16","v":0},{"$f":"'8'!I16","v":"8.1.1.6.2"},{"$f":"'8'!J16","v":"8.1.1.6.2: Is the reliability of personal data collected from a source other than the customer confirmed before it is processed?\n"},{"$f":"'8'!K16","v":0},{"$f":"'8'!L16","v":0},{"$f":"'8'!M16","v":"Recommended"},{"$f":"'8'!N16","v":"Recommended"},{"$f":"'8'!O16","v":"BizOps"},{"$f":"'8'!P16","v":0},{"$f":"'8'!Q16","v":0},{"$f":"'8'!R16","v":0},{"$f":"'8'!S16","v":0},{"$f":"'8'!T16","v":0},{"$f":"'8'!U16","v":0},{"$f":"'8'!V16","v":0},{"$f":"'8'!W16","v":0},{"$f":"'8'!X16","v":0},{"$f":"'8'!Y16","v":0},{"$f":"'8'!Z16","v":0},{"$f":"'8'!AA16","v":0},{"$f":"'8'!AB16","v":0},{"$f":"'8'!AC16","v":0},{"$f":"'8'!AD16","v":0},{"$f":"'8'!AE16","v":0},{"$f":"'8'!AF16","v":0},{"$f":"'8'!AG16","v":0},{"$f":"'8'!AH16","v":0},{"$f":"'8'!AI16","v":0},{"$f":"'8'!AJ16","v":0},{"$f":"'8'!AK16","v":0},{"$f":"'8'!AL16","v":0},{"$f":"'8'!AM16","v":0},{"$f":"'8'!AN16","v":0},{"$f":"'8'!AO16","v":0},{"$f":"'8'!AP16","v":0},{"$f":"'8'!AQ16","v":0},{"$f":"'8'!AR16","v":0},{"$f":"'8'!AS16","v":0},{"$f":"'8'!AT16","v":0},{"$f":"SUMPRODUCT(IF($N599=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N599=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B17","v":"8"},{"$f":"'8'!C17","v":"8.1"},{"$f":"'8'!D17","v":"8.1.1"},{"$f":"'8'!E17","v":0},{"$f":"'8'!F17","v":"8.1.1.7"},{"$f":"'8'!G17","v":"8.1.1.7: TRAINING AND EDUCATION ON DATA PRIVACY\nProviders should put in place a data protection training and awareness plan. The plan should (1) specify the content of the data protection training, (2) assign responsibility for its implementation, and (3) be tailored to the different roles receiving the training. All staff (and agents and entities providing outsourced services, if applicable) with access to personal data should be trained in data protection, with periodic refresher training.\n\nProviders should focus attention on the protection and fair usage of personal data. Training should include: \n- informing staff of new scams that are being used to steal identities; \n- providing updates on privacy items in the news such as government data breaches and their effect on individuals and the organization;\n- providing examples of how staff  have been held accountable for inappropriate actions; and \n- providing examples of recommended privacy practices. \nThe goal of training is to build knowledge and skills that will enable staff to protect personal data."},{"$f":"'8'!H17","v":"NIST 4.1.2"},{"$f":"'8'!I17","v":"8.1.1.7.1"},{"$f":"'8'!J17","v":"8.1.1.7.1: Is there a data protection training and awareness plan for educating staff and agents on the protection and fair usage of personal data?\n"},{"$f":"'8'!K17","v":"1) Staff training programme, 2) Agent training programme.\n- Check that the training/briefing  for employees and agents includes details on the protection and fair usage of personal data."},{"$f":"'8'!L17","v":0},{"$f":"'8'!M17","v":"Standard Required"},{"$f":"'8'!N17","v":"Required"},{"$f":"'8'!O17","v":"BizOps"},{"$f":"'8'!P17","v":0},{"$f":"'8'!Q17","v":0},{"$f":"'8'!R17","v":0},{"$f":"'8'!S17","v":0},{"$f":"'8'!T17","v":0},{"$f":"'8'!U17","v":0},{"$f":"'8'!V17","v":0},{"$f":"'8'!W17","v":0},{"$f":"'8'!X17","v":0},{"$f":"'8'!Y17","v":0},{"$f":"'8'!Z17","v":0},{"$f":"'8'!AA17","v":0},{"$f":"'8'!AB17","v":0},{"$f":"'8'!AC17","v":0},{"$f":"'8'!AD17","v":0},{"$f":"'8'!AE17","v":0},{"$f":"'8'!AF17","v":0},{"$f":"'8'!AG17","v":0},{"$f":"'8'!AH17","v":0},{"$f":"'8'!AI17","v":0},{"$f":"'8'!AJ17","v":0},{"$f":"'8'!AK17","v":0},{"$f":"'8'!AL17","v":0},{"$f":"'8'!AM17","v":0},{"$f":"'8'!AN17","v":0},{"$f":"'8'!AO17","v":0},{"$f":"'8'!AP17","v":0},{"$f":"'8'!AQ17","v":0},{"$f":"'8'!AR17","v":0},{"$f":"'8'!AS17","v":0},{"$f":"'8'!AT17","v":0},{"$f":"SUMPRODUCT(IF($N600=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N600=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B18","v":"8"},{"$f":"'8'!C18","v":"8.1"},{"$f":"'8'!D18","v":"8.1.1"},{"$f":"'8'!E18","v":0},{"$f":"'8'!F18","v":"8.1.1.8"},{"$f":"'8'!G18","v":"8.1.1.8: DATA PRIVACY INCIDENT-HANDLING\nProviders should develop procedures to handle breaches that involve personal data. \n\n1. Employees, agents, and entities providing outsourced services should be told what constitutes a breach involving personal data, how to report the breach to the provider (e.g. a form), and what information needs to be reported (e.g. what data was lost; which customers were affected; how and when the data was lost).\n\n2. A breach involving personal data may require notification to external entities such as law enforcement, affected customers, the media, and the public.  Therefore, providers should plan in advance how, when, and to whom notifications should be provided. They should also conduct training sessions on how to address incidents when interacting with the media and other external parties. \n\n3. Providers should determine the circumstances under which remedial assistance should be provided to customers affected by data privacy breaches. The impact of a data breach can be reduced by swift communication with the customers whose data was lost. Explicit instructions should be given on steps that the customers should take (e.g. changing PINs, if they have been made public).\n\nIf the data privacy incident is caused by a security incident, also see section 5.3.9.\n\nData breaches can be serious. Customers' personal data can be used by criminals for impersonation fraud or identity theft. Public disclosure of customers' personal data causes reputational damage and possibly financial loss if the provider is held liability for fraud committed using the data. For example, in April 2015, 15,000 files were leaked from Qatar National Bank. The leaked data included passwords, PINs and payment card data for hundreds of thousands of customer accounts."},{"$f":"'8'!H18","v":"NIST 5.0"},{"$f":"'8'!I18","v":"8.1.1.8.1"},{"$f":"'8'!J18","v":"8.1.1.8.1: Have incident response plans been developed to address breaches involving personal data?\n"},{"$f":"'8'!K18","v":"1) Data privacy incident response plan\n- Check that the response plan has been developed for breaches in personal data protection requirements "},{"$f":"'8'!L18","v":0},{"$f":"'8'!M18","v":"Standard Required"},{"$f":"'8'!N18","v":"Required"},{"$f":"'8'!O18","v":"BizOps"},{"$f":"'8'!P18","v":0},{"$f":"'8'!Q18","v":0},{"$f":"'8'!R18","v":0},{"$f":"'8'!S18","v":0},{"$f":"'8'!T18","v":0},{"$f":"'8'!U18","v":0},{"$f":"'8'!V18","v":0},{"$f":"'8'!W18","v":0},{"$f":"'8'!X18","v":0},{"$f":"'8'!Y18","v":0},{"$f":"'8'!Z18","v":0},{"$f":"'8'!AA18","v":0},{"$f":"'8'!AB18","v":0},{"$f":"'8'!AC18","v":0},{"$f":"'8'!AD18","v":0},{"$f":"'8'!AE18","v":0},{"$f":"'8'!AF18","v":0},{"$f":"'8'!AG18","v":0},{"$f":"'8'!AH18","v":0},{"$f":"'8'!AI18","v":0},{"$f":"'8'!AJ18","v":0},{"$f":"'8'!AK18","v":0},{"$f":"'8'!AL18","v":0},{"$f":"'8'!AM18","v":0},{"$f":"'8'!AN18","v":0},{"$f":"'8'!AO18","v":0},{"$f":"'8'!AP18","v":0},{"$f":"'8'!AQ18","v":0},{"$f":"'8'!AR18","v":0},{"$f":"'8'!AS18","v":0},{"$f":"'8'!AT18","v":0},{"$f":"SUMPRODUCT(IF($N601=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N601=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B19","v":"8"},{"$f":"'8'!C19","v":"8.1"},{"$f":"'8'!D19","v":"8.1.1"},{"$f":"'8'!E19","v":0},{"$f":"'8'!F19","v":"8.1.1.8"},{"$f":"'8'!G19","v":0},{"$f":"'8'!H19","v":0},{"$f":"'8'!I19","v":"8.1.1.8.2"},{"$f":"'8'!J19","v":"8.1.1.8.2: Have employees been told what constitutes a breach involving personal data, how to report the breach, and what information needs to be reported?\n"},{"$f":"'8'!K19","v":"1) Staff training programme\n- Check that the training/briefing  for employees includes:\na)  what constitutes a breach involving personal data.\nb) how to report the breach to the provider,\nc) what information needs to be reported\n\n2) Data Privacy Policy or data privacy rules of behaviour document\n- Check that there is a channel / mechanism for employees to report data privacy breaches."},{"$f":"'8'!L19","v":0},{"$f":"'8'!M19","v":"Standard Required"},{"$f":"'8'!N19","v":"Required"},{"$f":"'8'!O19","v":"BizOps"},{"$f":"'8'!P19","v":0},{"$f":"'8'!Q19","v":0},{"$f":"'8'!R19","v":0},{"$f":"'8'!S19","v":0},{"$f":"'8'!T19","v":0},{"$f":"'8'!U19","v":0},{"$f":"'8'!V19","v":0},{"$f":"'8'!W19","v":0},{"$f":"'8'!X19","v":0},{"$f":"'8'!Y19","v":0},{"$f":"'8'!Z19","v":0},{"$f":"'8'!AA19","v":0},{"$f":"'8'!AB19","v":0},{"$f":"'8'!AC19","v":0},{"$f":"'8'!AD19","v":0},{"$f":"'8'!AE19","v":0},{"$f":"'8'!AF19","v":0},{"$f":"'8'!AG19","v":0},{"$f":"'8'!AH19","v":0},{"$f":"'8'!AI19","v":0},{"$f":"'8'!AJ19","v":0},{"$f":"'8'!AK19","v":0},{"$f":"'8'!AL19","v":0},{"$f":"'8'!AM19","v":0},{"$f":"'8'!AN19","v":0},{"$f":"'8'!AO19","v":0},{"$f":"'8'!AP19","v":0},{"$f":"'8'!AQ19","v":0},{"$f":"'8'!AR19","v":0},{"$f":"'8'!AS19","v":0},{"$f":"'8'!AT19","v":0},{"$f":"SUMPRODUCT(IF($N602=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N602=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B20","v":"8"},{"$f":"'8'!C20","v":"8.1"},{"$f":"'8'!D20","v":"8.1.1"},{"$f":"'8'!E20","v":0},{"$f":"'8'!F20","v":"8.1.1.8"},{"$f":"'8'!G20","v":0},{"$f":"'8'!H20","v":0},{"$f":"'8'!I20","v":"8.1.1.8.3"},{"$f":"'8'!J20","v":"8.1.1.8.3: Is there a plan for notifying external entities such as law enforcement, affected customers, the media, and the public of personal data privacy breaches?\n"},{"$f":"'8'!K20","v":0},{"$f":"'8'!L20","v":0},{"$f":"'8'!M20","v":"Recommended"},{"$f":"'8'!N20","v":"Recommended"},{"$f":"'8'!O20","v":"BizOps"},{"$f":"'8'!P20","v":0},{"$f":"'8'!Q20","v":0},{"$f":"'8'!R20","v":0},{"$f":"'8'!S20","v":0},{"$f":"'8'!T20","v":0},{"$f":"'8'!U20","v":0},{"$f":"'8'!V20","v":0},{"$f":"'8'!W20","v":0},{"$f":"'8'!X20","v":0},{"$f":"'8'!Y20","v":0},{"$f":"'8'!Z20","v":0},{"$f":"'8'!AA20","v":0},{"$f":"'8'!AB20","v":0},{"$f":"'8'!AC20","v":0},{"$f":"'8'!AD20","v":0},{"$f":"'8'!AE20","v":0},{"$f":"'8'!AF20","v":0},{"$f":"'8'!AG20","v":0},{"$f":"'8'!AH20","v":0},{"$f":"'8'!AI20","v":0},{"$f":"'8'!AJ20","v":0},{"$f":"'8'!AK20","v":0},{"$f":"'8'!AL20","v":0},{"$f":"'8'!AM20","v":0},{"$f":"'8'!AN20","v":0},{"$f":"'8'!AO20","v":0},{"$f":"'8'!AP20","v":0},{"$f":"'8'!AQ20","v":0},{"$f":"'8'!AR20","v":0},{"$f":"'8'!AS20","v":0},{"$f":"'8'!AT20","v":0},{"$f":"SUMPRODUCT(IF($N603=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N603=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B21","v":"8"},{"$f":"'8'!C21","v":"8.1"},{"$f":"'8'!D21","v":"8.1.1"},{"$f":"'8'!E21","v":0},{"$f":"'8'!F21","v":"8.1.1.8"},{"$f":"'8'!G21","v":0},{"$f":"'8'!H21","v":0},{"$f":"'8'!I21","v":"8.1.1.8.4"},{"$f":"'8'!J21","v":"8.1.1.8.4: Is a process in place to determine any remedial assistance that should be provided to individuals or entities affected by data privacy breaches?\n"},{"$f":"'8'!K21","v":0},{"$f":"'8'!L21","v":0},{"$f":"'8'!M21","v":"Recommended"},{"$f":"'8'!N21","v":"Recommended"},{"$f":"'8'!O21","v":"BizOps"},{"$f":"'8'!P21","v":0},{"$f":"'8'!Q21","v":0},{"$f":"'8'!R21","v":0},{"$f":"'8'!S21","v":0},{"$f":"'8'!T21","v":0},{"$f":"'8'!U21","v":0},{"$f":"'8'!V21","v":0},{"$f":"'8'!W21","v":0},{"$f":"'8'!X21","v":0},{"$f":"'8'!Y21","v":0},{"$f":"'8'!Z21","v":0},{"$f":"'8'!AA21","v":0},{"$f":"'8'!AB21","v":0},{"$f":"'8'!AC21","v":0},{"$f":"'8'!AD21","v":0},{"$f":"'8'!AE21","v":0},{"$f":"'8'!AF21","v":0},{"$f":"'8'!AG21","v":0},{"$f":"'8'!AH21","v":0},{"$f":"'8'!AI21","v":0},{"$f":"'8'!AJ21","v":0},{"$f":"'8'!AK21","v":0},{"$f":"'8'!AL21","v":0},{"$f":"'8'!AM21","v":0},{"$f":"'8'!AN21","v":0},{"$f":"'8'!AO21","v":0},{"$f":"'8'!AP21","v":0},{"$f":"'8'!AQ21","v":0},{"$f":"'8'!AR21","v":0},{"$f":"'8'!AS21","v":0},{"$f":"'8'!AT21","v":0},{"$f":"SUMPRODUCT(IF($N604=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N604=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B22","v":"8"},{"$f":"'8'!C22","v":"8.1"},{"$f":"'8'!D22","v":"8.1.1"},{"$f":"'8'!E22","v":0},{"$f":"'8'!F22","v":"8.1.1.9"},{"$f":"'8'!G22","v":"8.1.1.9: DE-IDENTIFYING AND ANONYMISING PERSONAL DATA\nWhenever possible, providers should de-identify or anonymise personal data when full data records are not necessary, such as when performing certain types of research, analysing resource requirements, examining correlations and trends, and/or conducting system or application testing. \n\n\"De-identify\" means to remove, obscure, mask or obfuscate enough personal data from a record such that an individual can not be identified. De-identified information can be aggregated for the purposes of statistical analysis, such as making comparisons, analysing trends, or identifying patterns. De-identified information can be re-identified by using a code, algorithm, or pseudonym that is assigned to individual records.\n\n\"Anonymise\" means to take de-identified information and destroy any code or other association that would allow re-identification. Anonymising information usually involves the application of statistical disclosure limitation techniques to ensure that the data cannot be re-identified. Not all data can be readily anonymised (for example, biometric data)."},{"$f":"'8'!H22","v":"NIST 4.2.3"},{"$f":"'8'!I22","v":"8.1.1.9.1"},{"$f":"'8'!J22","v":"8.1.1.9.1: Is personal data de-identified or anonymised when full data records are not necessary, such as when performing certain types of research, analysing resource requirements, examining correlations and trends, and conducting system testing?\n"},{"$f":"'8'!K22","v":0},{"$f":"'8'!L22","v":0},{"$f":"'8'!M22","v":"Recommended"},{"$f":"'8'!N22","v":"Recommended"},{"$f":"'8'!O22","v":"BizOps"},{"$f":"'8'!P22","v":0},{"$f":"'8'!Q22","v":0},{"$f":"'8'!R22","v":0},{"$f":"'8'!S22","v":0},{"$f":"'8'!T22","v":0},{"$f":"'8'!U22","v":0},{"$f":"'8'!V22","v":0},{"$f":"'8'!W22","v":0},{"$f":"'8'!X22","v":0},{"$f":"'8'!Y22","v":0},{"$f":"'8'!Z22","v":0},{"$f":"'8'!AA22","v":0},{"$f":"'8'!AB22","v":0},{"$f":"'8'!AC22","v":0},{"$f":"'8'!AD22","v":0},{"$f":"'8'!AE22","v":0},{"$f":"'8'!AF22","v":0},{"$f":"'8'!AG22","v":0},{"$f":"'8'!AH22","v":0},{"$f":"'8'!AI22","v":0},{"$f":"'8'!AJ22","v":0},{"$f":"'8'!AK22","v":0},{"$f":"'8'!AL22","v":0},{"$f":"'8'!AM22","v":0},{"$f":"'8'!AN22","v":0},{"$f":"'8'!AO22","v":0},{"$f":"'8'!AP22","v":0},{"$f":"'8'!AQ22","v":0},{"$f":"'8'!AR22","v":0},{"$f":"'8'!AS22","v":0},{"$f":"'8'!AT22","v":0},{"$f":"SUMPRODUCT(IF($N605=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N605=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B24","v":"8"},{"$f":"'8'!C24","v":"8.2"},{"$f":"'8'!D24","v":"8.2.1"},{"$f":"'8'!E24","v":"8.2.1: Providers shall ensure that users are provided with clear, prominent, and timely information regarding their data privacy practices."},{"$f":"'8'!F24","v":"8.2.1.1"},{"$f":"'8'!G24","v":"8.2.1.1: TRANSPARENCY REGARDING DATA PRIVACY PRACTICES\nProviders should publish a statement of their commitment to data privacy. In particular the statement should make clear that data will be kept secure and not shared with third parties unless  explicitly agreed with the customer.\n\nThe statement could be published in the T&Cs, on posters, on handouts, or via the website.\n\nIn addition, it is good practice for providers to publish a summary of their data privacy practices available to customers, along with official address and contact details for customers interested in obtaining additional information. The summary could include:\n- the personal data required;\n- the purpose for personal data collection (e.g. to assess eligibility for other financial or non-financial services, for legal compliance, etc.);\n- the personal data retention and disposal policy.\n"},{"$f":"'8'!H24","v":"NIST Appendix D\nISO 29100:2011 5.8\nISO 29100:2011 4.6"},{"$f":"'8'!I24","v":"8.2.1.1.1"},{"$f":"'8'!J24","v":"8.2.1.1.1: Is a statement of the provider's commitment to data privacy practices made available to customers (e.g. in the T&Cs, on posters, on handouts, or via the website)?\n"},{"$f":"'8'!K24","v":0},{"$f":"'8'!L24","v":0},{"$f":"'8'!M24","v":"Recommended"},{"$f":"'8'!N24","v":"Recommended"},{"$f":"'8'!O24","v":"BizOps"},{"$f":"'8'!P24","v":0},{"$f":"'8'!Q24","v":0},{"$f":"'8'!R24","v":0},{"$f":"'8'!S24","v":0},{"$f":"'8'!T24","v":0},{"$f":"'8'!U24","v":0},{"$f":"'8'!V24","v":0},{"$f":"'8'!W24","v":0},{"$f":"'8'!X24","v":0},{"$f":"'8'!Y24","v":0},{"$f":"'8'!Z24","v":0},{"$f":"'8'!AA24","v":0},{"$f":"'8'!AB24","v":0},{"$f":"'8'!AC24","v":0},{"$f":"'8'!AD24","v":0},{"$f":"'8'!AE24","v":0},{"$f":"'8'!AF24","v":0},{"$f":"'8'!AG24","v":0},{"$f":"'8'!AH24","v":0},{"$f":"'8'!AI24","v":0},{"$f":"'8'!AJ24","v":0},{"$f":"'8'!AK24","v":0},{"$f":"'8'!AL24","v":0},{"$f":"'8'!AM24","v":0},{"$f":"'8'!AN24","v":0},{"$f":"'8'!AO24","v":0},{"$f":"'8'!AP24","v":0},{"$f":"'8'!AQ24","v":0},{"$f":"'8'!AR24","v":0},{"$f":"'8'!AS24","v":0},{"$f":"'8'!AT24","v":0},{"$f":"SUMPRODUCT(IF($N606=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N606=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B25","v":"8"},{"$f":"'8'!C25","v":"8.2"},{"$f":"'8'!D25","v":"8.2.1"},{"$f":"'8'!E25","v":0},{"$f":"'8'!F25","v":"8.2.1.1"},{"$f":"'8'!G25","v":0},{"$f":"'8'!H25","v":0},{"$f":"'8'!I25","v":"8.2.1.1.2"},{"$f":"'8'!J25","v":"8.2.1.1.2: Does the summary of data privacy practices inform customers of the personal data required from them?\n"},{"$f":"'8'!K25","v":0},{"$f":"'8'!L25","v":0},{"$f":"'8'!M25","v":"Recommended"},{"$f":"'8'!N25","v":"Recommended"},{"$f":"'8'!O25","v":"BizOps"},{"$f":"'8'!P25","v":0},{"$f":"'8'!Q25","v":0},{"$f":"'8'!R25","v":0},{"$f":"'8'!S25","v":0},{"$f":"'8'!T25","v":0},{"$f":"'8'!U25","v":0},{"$f":"'8'!V25","v":0},{"$f":"'8'!W25","v":0},{"$f":"'8'!X25","v":0},{"$f":"'8'!Y25","v":0},{"$f":"'8'!Z25","v":0},{"$f":"'8'!AA25","v":0},{"$f":"'8'!AB25","v":0},{"$f":"'8'!AC25","v":0},{"$f":"'8'!AD25","v":0},{"$f":"'8'!AE25","v":0},{"$f":"'8'!AF25","v":0},{"$f":"'8'!AG25","v":0},{"$f":"'8'!AH25","v":0},{"$f":"'8'!AI25","v":0},{"$f":"'8'!AJ25","v":0},{"$f":"'8'!AK25","v":0},{"$f":"'8'!AL25","v":0},{"$f":"'8'!AM25","v":0},{"$f":"'8'!AN25","v":0},{"$f":"'8'!AO25","v":0},{"$f":"'8'!AP25","v":0},{"$f":"'8'!AQ25","v":0},{"$f":"'8'!AR25","v":0},{"$f":"'8'!AS25","v":0},{"$f":"'8'!AT25","v":0},{"$f":"SUMPRODUCT(IF($N607=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N607=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B26","v":"8"},{"$f":"'8'!C26","v":"8.2"},{"$f":"'8'!D26","v":"8.2.1"},{"$f":"'8'!E26","v":0},{"$f":"'8'!F26","v":"8.2.1.1"},{"$f":"'8'!G26","v":0},{"$f":"'8'!H26","v":0},{"$f":"'8'!I26","v":"8.2.1.1.3"},{"$f":"'8'!J26","v":"8.2.1.1.3: Does the summary of data privacy practices inform customers of the purpose for collecting personal data from them?\n"},{"$f":"'8'!K26","v":0},{"$f":"'8'!L26","v":0},{"$f":"'8'!M26","v":"Recommended"},{"$f":"'8'!N26","v":"Recommended"},{"$f":"'8'!O26","v":"BizOps"},{"$f":"'8'!P26","v":0},{"$f":"'8'!Q26","v":0},{"$f":"'8'!R26","v":0},{"$f":"'8'!S26","v":0},{"$f":"'8'!T26","v":0},{"$f":"'8'!U26","v":0},{"$f":"'8'!V26","v":0},{"$f":"'8'!W26","v":0},{"$f":"'8'!X26","v":0},{"$f":"'8'!Y26","v":0},{"$f":"'8'!Z26","v":0},{"$f":"'8'!AA26","v":0},{"$f":"'8'!AB26","v":0},{"$f":"'8'!AC26","v":0},{"$f":"'8'!AD26","v":0},{"$f":"'8'!AE26","v":0},{"$f":"'8'!AF26","v":0},{"$f":"'8'!AG26","v":0},{"$f":"'8'!AH26","v":0},{"$f":"'8'!AI26","v":0},{"$f":"'8'!AJ26","v":0},{"$f":"'8'!AK26","v":0},{"$f":"'8'!AL26","v":0},{"$f":"'8'!AM26","v":0},{"$f":"'8'!AN26","v":0},{"$f":"'8'!AO26","v":0},{"$f":"'8'!AP26","v":0},{"$f":"'8'!AQ26","v":0},{"$f":"'8'!AR26","v":0},{"$f":"'8'!AS26","v":0},{"$f":"'8'!AT26","v":0},{"$f":"SUMPRODUCT(IF($N608=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N608=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B27","v":"8"},{"$f":"'8'!C27","v":"8.2"},{"$f":"'8'!D27","v":"8.2.1"},{"$f":"'8'!E27","v":0},{"$f":"'8'!F27","v":"8.2.1.1"},{"$f":"'8'!G27","v":0},{"$f":"'8'!H27","v":0},{"$f":"'8'!I27","v":"8.2.1.1.4"},{"$f":"'8'!J27","v":"8.2.1.1.4: Does the summary of data privacy practices make it clear that data will not be shared with third parties unless explicitly agreed with the customer?\n"},{"$f":"'8'!K27","v":0},{"$f":"'8'!L27","v":0},{"$f":"'8'!M27","v":"Recommended"},{"$f":"'8'!N27","v":"Recommended"},{"$f":"'8'!O27","v":"BizOps"},{"$f":"'8'!P27","v":0},{"$f":"'8'!Q27","v":0},{"$f":"'8'!R27","v":0},{"$f":"'8'!S27","v":0},{"$f":"'8'!T27","v":0},{"$f":"'8'!U27","v":0},{"$f":"'8'!V27","v":0},{"$f":"'8'!W27","v":0},{"$f":"'8'!X27","v":0},{"$f":"'8'!Y27","v":0},{"$f":"'8'!Z27","v":0},{"$f":"'8'!AA27","v":0},{"$f":"'8'!AB27","v":0},{"$f":"'8'!AC27","v":0},{"$f":"'8'!AD27","v":0},{"$f":"'8'!AE27","v":0},{"$f":"'8'!AF27","v":0},{"$f":"'8'!AG27","v":0},{"$f":"'8'!AH27","v":0},{"$f":"'8'!AI27","v":0},{"$f":"'8'!AJ27","v":0},{"$f":"'8'!AK27","v":0},{"$f":"'8'!AL27","v":0},{"$f":"'8'!AM27","v":0},{"$f":"'8'!AN27","v":0},{"$f":"'8'!AO27","v":0},{"$f":"'8'!AP27","v":0},{"$f":"'8'!AQ27","v":0},{"$f":"'8'!AR27","v":0},{"$f":"'8'!AS27","v":0},{"$f":"'8'!AT27","v":0},{"$f":"SUMPRODUCT(IF($N609=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N609=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B29","v":"8"},{"$f":"'8'!C29","v":"8.3"},{"$f":"'8'!D29","v":"8.3.1"},{"$f":"'8'!E29","v":"8.3.1: Providers shall ensure that customers are informed of their rights and have opportunities to exercise meaningful choice and control over their personal information."},{"$f":"'8'!F29","v":"8.3.1.1"},{"$f":"'8'!G29","v":"8.3.1.1: CUSTOMER CHOICE AND CONTROL OVER PROCESSING OF PERSONAL DATA\nProviders should offer customers choice and control over how their personal data is handled. Some personal data (e.g., data required for KYC purposes) must be provided and processed in order to use the service. However, for use of personal data that is not essential to the provision of the service (e.g. marketing messages), providers should (1) obtain opt-in consent for this use of the personal data; and (2) allow a customer to withdraw consent easily and free of charge.\n\nEven if consent is withdrawn, the provider might need to retain certain personal data for a period of time in order to comply with legal and/or contractual obligations (e.g. data retention, accountability). The customer should be informed that their data may be used or shared in accordance with such legal and/or contractual obligations."},{"$f":"'8'!H29","v":"ISO 29100:2011, 5.2"},{"$f":"'8'!I29","v":"8.3.1.1.1"},{"$f":"'8'!J29","v":"8.3.1.1.1: For the use of personal data that is not essential to the provision of the mobile money service (e.g. marketing messages), does the provider (1) obtain opt-in consent from customers, and (2) allow a customer to withdraw consent easily and free of charge?\n"},{"$f":"'8'!K29","v":0},{"$f":"'8'!L29","v":0},{"$f":"'8'!M29","v":"Recommended"},{"$f":"'8'!N29","v":"Recommended"},{"$f":"'8'!O29","v":"BizOps"},{"$f":"'8'!P29","v":0},{"$f":"'8'!Q29","v":0},{"$f":"'8'!R29","v":0},{"$f":"'8'!S29","v":0},{"$f":"'8'!T29","v":0},{"$f":"'8'!U29","v":0},{"$f":"'8'!V29","v":0},{"$f":"'8'!W29","v":0},{"$f":"'8'!X29","v":0},{"$f":"'8'!Y29","v":0},{"$f":"'8'!Z29","v":0},{"$f":"'8'!AA29","v":0},{"$f":"'8'!AB29","v":0},{"$f":"'8'!AC29","v":0},{"$f":"'8'!AD29","v":0},{"$f":"'8'!AE29","v":0},{"$f":"'8'!AF29","v":0},{"$f":"'8'!AG29","v":0},{"$f":"'8'!AH29","v":0},{"$f":"'8'!AI29","v":0},{"$f":"'8'!AJ29","v":0},{"$f":"'8'!AK29","v":0},{"$f":"'8'!AL29","v":0},{"$f":"'8'!AM29","v":0},{"$f":"'8'!AN29","v":0},{"$f":"'8'!AO29","v":0},{"$f":"'8'!AP29","v":0},{"$f":"'8'!AQ29","v":0},{"$f":"'8'!AR29","v":0},{"$f":"'8'!AS29","v":0},{"$f":"'8'!AT29","v":0},{"$f":"SUMPRODUCT(IF($N610=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N610=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B30","v":"8"},{"$f":"'8'!C30","v":"8.3"},{"$f":"'8'!D30","v":"8.3.1"},{"$f":"'8'!E30","v":0},{"$f":"'8'!F30","v":"8.3.1.2"},{"$f":"'8'!G30","v":"8.3.1.2: CUSTOMER RIGHTS TO REVIEW PERSONAL DATA\nProviders should grant customers the right to: \n- access and review their personal data (subject to proper verification of their identity);\n- challenge the accuracy and completeness of their personal data and have it amended or removed as appropriate; and \n- ensure that any amendment or removal is communicated to third parties to whom personal data has been disclosed.  \n\nCustomers should be informed of how they can access, review and request updates to their personal data.\n\nNOTE:  While this Practice applies to all mobile money services, customers may be particularly interested in reviewing personal data that is used to assess creditworthiness."},{"$f":"'8'!H30","v":"ISO 29100:2011, 5.9"},{"$f":"'8'!I30","v":"8.3.1.2.1"},{"$f":"'8'!J30","v":"8.3.1.2.1: Can customers access and review their personal data?\n"},{"$f":"'8'!K30","v":0},{"$f":"'8'!L30","v":0},{"$f":"'8'!M30","v":"Recommended"},{"$f":"'8'!N30","v":"Recommended"},{"$f":"'8'!O30","v":"BizOps"},{"$f":"'8'!P30","v":0},{"$f":"'8'!Q30","v":0},{"$f":"'8'!R30","v":0},{"$f":"'8'!S30","v":0},{"$f":"'8'!T30","v":0},{"$f":"'8'!U30","v":0},{"$f":"'8'!V30","v":0},{"$f":"'8'!W30","v":0},{"$f":"'8'!X30","v":0},{"$f":"'8'!Y30","v":0},{"$f":"'8'!Z30","v":0},{"$f":"'8'!AA30","v":0},{"$f":"'8'!AB30","v":0},{"$f":"'8'!AC30","v":0},{"$f":"'8'!AD30","v":0},{"$f":"'8'!AE30","v":0},{"$f":"'8'!AF30","v":0},{"$f":"'8'!AG30","v":0},{"$f":"'8'!AH30","v":0},{"$f":"'8'!AI30","v":0},{"$f":"'8'!AJ30","v":0},{"$f":"'8'!AK30","v":0},{"$f":"'8'!AL30","v":0},{"$f":"'8'!AM30","v":0},{"$f":"'8'!AN30","v":0},{"$f":"'8'!AO30","v":0},{"$f":"'8'!AP30","v":0},{"$f":"'8'!AQ30","v":0},{"$f":"'8'!AR30","v":0},{"$f":"'8'!AS30","v":0},{"$f":"'8'!AT30","v":0},{"$f":"SUMPRODUCT(IF($N611=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N611=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B31","v":"8"},{"$f":"'8'!C31","v":"8.3"},{"$f":"'8'!D31","v":"8.3.1"},{"$f":"'8'!E31","v":0},{"$f":"'8'!F31","v":"8.3.1.2"},{"$f":"'8'!G31","v":0},{"$f":"'8'!H31","v":0},{"$f":"'8'!I31","v":"8.3.1.2.2"},{"$f":"'8'!J31","v":"8.3.1.2.2: Can customers challenge the accuracy and completeness of the personal data and have it amended or removed?\n"},{"$f":"'8'!K31","v":0},{"$f":"'8'!L31","v":0},{"$f":"'8'!M31","v":"Recommended"},{"$f":"'8'!N31","v":"Recommended"},{"$f":"'8'!O31","v":"BizOps"},{"$f":"'8'!P31","v":0},{"$f":"'8'!Q31","v":0},{"$f":"'8'!R31","v":0},{"$f":"'8'!S31","v":0},{"$f":"'8'!T31","v":0},{"$f":"'8'!U31","v":0},{"$f":"'8'!V31","v":0},{"$f":"'8'!W31","v":0},{"$f":"'8'!X31","v":0},{"$f":"'8'!Y31","v":0},{"$f":"'8'!Z31","v":0},{"$f":"'8'!AA31","v":0},{"$f":"'8'!AB31","v":0},{"$f":"'8'!AC31","v":0},{"$f":"'8'!AD31","v":0},{"$f":"'8'!AE31","v":0},{"$f":"'8'!AF31","v":0},{"$f":"'8'!AG31","v":0},{"$f":"'8'!AH31","v":0},{"$f":"'8'!AI31","v":0},{"$f":"'8'!AJ31","v":0},{"$f":"'8'!AK31","v":0},{"$f":"'8'!AL31","v":0},{"$f":"'8'!AM31","v":0},{"$f":"'8'!AN31","v":0},{"$f":"'8'!AO31","v":0},{"$f":"'8'!AP31","v":0},{"$f":"'8'!AQ31","v":0},{"$f":"'8'!AR31","v":0},{"$f":"'8'!AS31","v":0},{"$f":"'8'!AT31","v":0},{"$f":"SUMPRODUCT(IF($N612=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N612=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B32","v":"8"},{"$f":"'8'!C32","v":"8.3"},{"$f":"'8'!D32","v":"8.3.1"},{"$f":"'8'!E32","v":0},{"$f":"'8'!F32","v":"8.3.1.2"},{"$f":"'8'!G32","v":0},{"$f":"'8'!H32","v":0},{"$f":"'8'!I32","v":"8.3.1.2.3"},{"$f":"'8'!J32","v":"8.3.1.2.3: Are third parties to whom personal data has been disclosed also informed of any amendment or removal of the personal data?\n"},{"$f":"'8'!K32","v":0},{"$f":"'8'!L32","v":0},{"$f":"'8'!M32","v":"Recommended"},{"$f":"'8'!N32","v":"Recommended"},{"$f":"'8'!O32","v":"BizOps"},{"$f":"'8'!P32","v":0},{"$f":"'8'!Q32","v":0},{"$f":"'8'!R32","v":0},{"$f":"'8'!S32","v":0},{"$f":"'8'!T32","v":0},{"$f":"'8'!U32","v":0},{"$f":"'8'!V32","v":0},{"$f":"'8'!W32","v":0},{"$f":"'8'!X32","v":0},{"$f":"'8'!Y32","v":0},{"$f":"'8'!Z32","v":0},{"$f":"'8'!AA32","v":0},{"$f":"'8'!AB32","v":0},{"$f":"'8'!AC32","v":0},{"$f":"'8'!AD32","v":0},{"$f":"'8'!AE32","v":0},{"$f":"'8'!AF32","v":0},{"$f":"'8'!AG32","v":0},{"$f":"'8'!AH32","v":0},{"$f":"'8'!AI32","v":0},{"$f":"'8'!AJ32","v":0},{"$f":"'8'!AK32","v":0},{"$f":"'8'!AL32","v":0},{"$f":"'8'!AM32","v":0},{"$f":"'8'!AN32","v":0},{"$f":"'8'!AO32","v":0},{"$f":"'8'!AP32","v":0},{"$f":"'8'!AQ32","v":0},{"$f":"'8'!AR32","v":0},{"$f":"'8'!AS32","v":0},{"$f":"'8'!AT32","v":0},{"$f":"SUMPRODUCT(IF($N613=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N613=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B33","v":"8"},{"$f":"'8'!C33","v":"8.3"},{"$f":"'8'!D33","v":"8.3.1"},{"$f":"'8'!E33","v":0},{"$f":"'8'!F33","v":"8.3.1.2"},{"$f":"'8'!G33","v":0},{"$f":"'8'!H33","v":0},{"$f":"'8'!I33","v":"8.3.1.2.4"},{"$f":"'8'!J33","v":"8.3.1.2.4: Are customers informed of how they can access, review and request updates to their personal data?\n"},{"$f":"'8'!K33","v":0},{"$f":"'8'!L33","v":0},{"$f":"'8'!M33","v":"Recommended"},{"$f":"'8'!N33","v":"Recommended"},{"$f":"'8'!O33","v":"BizOps"},{"$f":"'8'!P33","v":0},{"$f":"'8'!Q33","v":0},{"$f":"'8'!R33","v":0},{"$f":"'8'!S33","v":0},{"$f":"'8'!T33","v":0},{"$f":"'8'!U33","v":0},{"$f":"'8'!V33","v":0},{"$f":"'8'!W33","v":0},{"$f":"'8'!X33","v":0},{"$f":"'8'!Y33","v":0},{"$f":"'8'!Z33","v":0},{"$f":"'8'!AA33","v":0},{"$f":"'8'!AB33","v":0},{"$f":"'8'!AC33","v":0},{"$f":"'8'!AD33","v":0},{"$f":"'8'!AE33","v":0},{"$f":"'8'!AF33","v":0},{"$f":"'8'!AG33","v":0},{"$f":"'8'!AH33","v":0},{"$f":"'8'!AI33","v":0},{"$f":"'8'!AJ33","v":0},{"$f":"'8'!AK33","v":0},{"$f":"'8'!AL33","v":0},{"$f":"'8'!AM33","v":0},{"$f":"'8'!AN33","v":0},{"$f":"'8'!AO33","v":0},{"$f":"'8'!AP33","v":0},{"$f":"'8'!AQ33","v":0},{"$f":"'8'!AR33","v":0},{"$f":"'8'!AS33","v":0},{"$f":"'8'!AT33","v":0},{"$f":"SUMPRODUCT(IF($N614=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N614=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B35","v":"8"},{"$f":"'8'!C35","v":8.4},{"$f":"'8'!D35","v":"8.4.1"},{"$f":"'8'!E35","v":"8.4.1: Providers shall limit the personal information that is collected from customers and is retained, used, or shared."},{"$f":"'8'!F35","v":"8.4.1.1"},{"$f":"'8'!G35","v":"8.4.1.1: LIMIT PERSONAL DATA COLLECTION\nProviders should not collect personal data indiscriminately. By limiting personal data collection to the minimum necessary, providers may limit potential negative consequences in the event of a data breach involving personal data. Both the type and amount of personal data collected should be limited to that which is necessary to fulfil the well-defined, legitimate purpose(s). \n\nProviders should carefully consider what personal data will be needed to realize a particular purpose before proceeding with the collection of personal data. They should document the type of personal data collected, as well as their justification for doing so as part of their information-handling policies and practices."},{"$f":"'8'!H35","v":"ISO 29100:2011, 5.4"},{"$f":"'8'!I35","v":"8.4.1.1.1"},{"$f":"'8'!J35","v":"8.4.1.1.1: Is the amount and type of personal data collected limited to that which is required, and unnecessary data not collected?\n"},{"$f":"'8'!K35","v":0},{"$f":"'8'!L35","v":0},{"$f":"'8'!M35","v":"Recommended"},{"$f":"'8'!N35","v":"Recommended"},{"$f":"'8'!O35","v":"BizOps"},{"$f":"'8'!P35","v":0},{"$f":"'8'!Q35","v":0},{"$f":"'8'!R35","v":0},{"$f":"'8'!S35","v":0},{"$f":"'8'!T35","v":0},{"$f":"'8'!U35","v":0},{"$f":"'8'!V35","v":0},{"$f":"'8'!W35","v":0},{"$f":"'8'!X35","v":0},{"$f":"'8'!Y35","v":0},{"$f":"'8'!Z35","v":0},{"$f":"'8'!AA35","v":0},{"$f":"'8'!AB35","v":0},{"$f":"'8'!AC35","v":0},{"$f":"'8'!AD35","v":0},{"$f":"'8'!AE35","v":0},{"$f":"'8'!AF35","v":0},{"$f":"'8'!AG35","v":0},{"$f":"'8'!AH35","v":0},{"$f":"'8'!AI35","v":0},{"$f":"'8'!AJ35","v":0},{"$f":"'8'!AK35","v":0},{"$f":"'8'!AL35","v":0},{"$f":"'8'!AM35","v":0},{"$f":"'8'!AN35","v":0},{"$f":"'8'!AO35","v":0},{"$f":"'8'!AP35","v":0},{"$f":"'8'!AQ35","v":0},{"$f":"'8'!AR35","v":0},{"$f":"'8'!AS35","v":0},{"$f":"'8'!AT35","v":0},{"$f":"SUMPRODUCT(IF($N615=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N615=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B36","v":"8"},{"$f":"'8'!C36","v":8.4},{"$f":"'8'!D36","v":"8.4.1"},{"$f":"'8'!E36","v":0},{"$f":"'8'!F36","v":"8.4.1.2"},{"$f":"'8'!G36","v":"8.4.1.2: LIMIT THE USE OF PERSONAL DATA\nProviders should limit the use of personal data to a specific purpose (e.g., performing KYC, assessing creditworthiness). Additional purposes may be required by law. The purpose should be specified before the data is collected and stored."},{"$f":"'8'!H36","v":"ISO 29100:2011 5.6"},{"$f":"'8'!I36","v":"8.4.1.2.1"},{"$f":"'8'!J36","v":"8.4.1.2.1: Is the use of personal data limited to specified purposes (e.g. performing KYC, assessing creditworthiness)?\n"},{"$f":"'8'!K36","v":0},{"$f":"'8'!L36","v":0},{"$f":"'8'!M36","v":"Recommended"},{"$f":"'8'!N36","v":"Recommended"},{"$f":"'8'!O36","v":"BizOps"},{"$f":"'8'!P36","v":0},{"$f":"'8'!Q36","v":0},{"$f":"'8'!R36","v":0},{"$f":"'8'!S36","v":0},{"$f":"'8'!T36","v":0},{"$f":"'8'!U36","v":0},{"$f":"'8'!V36","v":0},{"$f":"'8'!W36","v":0},{"$f":"'8'!X36","v":0},{"$f":"'8'!Y36","v":0},{"$f":"'8'!Z36","v":0},{"$f":"'8'!AA36","v":0},{"$f":"'8'!AB36","v":0},{"$f":"'8'!AC36","v":0},{"$f":"'8'!AD36","v":0},{"$f":"'8'!AE36","v":0},{"$f":"'8'!AF36","v":0},{"$f":"'8'!AG36","v":0},{"$f":"'8'!AH36","v":0},{"$f":"'8'!AI36","v":0},{"$f":"'8'!AJ36","v":0},{"$f":"'8'!AK36","v":0},{"$f":"'8'!AL36","v":0},{"$f":"'8'!AM36","v":0},{"$f":"'8'!AN36","v":0},{"$f":"'8'!AO36","v":0},{"$f":"'8'!AP36","v":0},{"$f":"'8'!AQ36","v":0},{"$f":"'8'!AR36","v":0},{"$f":"'8'!AS36","v":0},{"$f":"'8'!AT36","v":0},{"$f":"SUMPRODUCT(IF($N616=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N616=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B37","v":"8"},{"$f":"'8'!C37","v":8.4},{"$f":"'8'!D37","v":"8.4.1"},{"$f":"'8'!E37","v":0},{"$f":"'8'!F37","v":"8.4.1.3"},{"$f":"'8'!G37","v":"8.4.1.3: LIMIT THE RETENTION OF PERSONAL INFORMATION\nPersonal data should only be retained as long as necessary to fulfil the stated purposes and should thereafter be securely destroyed or anonymised.  \n\nIn addition, when it is no longer in use, personal data should be locked (i.e. archived, secured and exempted from further processing) for as long as required by law."},{"$f":"'8'!H37","v":"ISO 29100:2011 5.6"},{"$f":"'8'!I37","v":"8.4.1.3.1"},{"$f":"'8'!J37","v":"8.4.1.3.1: Is personal data only retained as long as necessary to fulfil the stated purposes, and thereafter securely destroyed or anonymised?\n"},{"$f":"'8'!K37","v":0},{"$f":"'8'!L37","v":0},{"$f":"'8'!M37","v":"Recommended"},{"$f":"'8'!N37","v":"Recommended"},{"$f":"'8'!O37","v":"BizOps"},{"$f":"'8'!P37","v":0},{"$f":"'8'!Q37","v":0},{"$f":"'8'!R37","v":0},{"$f":"'8'!S37","v":0},{"$f":"'8'!T37","v":0},{"$f":"'8'!U37","v":0},{"$f":"'8'!V37","v":0},{"$f":"'8'!W37","v":0},{"$f":"'8'!X37","v":0},{"$f":"'8'!Y37","v":0},{"$f":"'8'!Z37","v":0},{"$f":"'8'!AA37","v":0},{"$f":"'8'!AB37","v":0},{"$f":"'8'!AC37","v":0},{"$f":"'8'!AD37","v":0},{"$f":"'8'!AE37","v":0},{"$f":"'8'!AF37","v":0},{"$f":"'8'!AG37","v":0},{"$f":"'8'!AH37","v":0},{"$f":"'8'!AI37","v":0},{"$f":"'8'!AJ37","v":0},{"$f":"'8'!AK37","v":0},{"$f":"'8'!AL37","v":0},{"$f":"'8'!AM37","v":0},{"$f":"'8'!AN37","v":0},{"$f":"'8'!AO37","v":0},{"$f":"'8'!AP37","v":0},{"$f":"'8'!AQ37","v":0},{"$f":"'8'!AR37","v":0},{"$f":"'8'!AS37","v":0},{"$f":"'8'!AT37","v":0},{"$f":"SUMPRODUCT(IF($N617=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N617=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B38","v":"8"},{"$f":"'8'!C38","v":8.4},{"$f":"'8'!D38","v":"8.4.1"},{"$f":"'8'!E38","v":0},{"$f":"'8'!F38","v":"8.4.1.3"},{"$f":"'8'!G38","v":0},{"$f":"'8'!H38","v":0},{"$f":"'8'!I38","v":"8.4.1.3.2"},{"$f":"'8'!J38","v":"8.4.1.3.2: When it is no longer in use, is personal data locked (i.e. archived, secured and exempted from further processing) for as long as required by law?\n"},{"$f":"'8'!K38","v":0},{"$f":"'8'!L38","v":0},{"$f":"'8'!M38","v":"Recommended"},{"$f":"'8'!N38","v":"Recommended"},{"$f":"'8'!O38","v":"BizOps"},{"$f":"'8'!P38","v":0},{"$f":"'8'!Q38","v":0},{"$f":"'8'!R38","v":0},{"$f":"'8'!S38","v":0},{"$f":"'8'!T38","v":0},{"$f":"'8'!U38","v":0},{"$f":"'8'!V38","v":0},{"$f":"'8'!W38","v":0},{"$f":"'8'!X38","v":0},{"$f":"'8'!Y38","v":0},{"$f":"'8'!Z38","v":0},{"$f":"'8'!AA38","v":0},{"$f":"'8'!AB38","v":0},{"$f":"'8'!AC38","v":0},{"$f":"'8'!AD38","v":0},{"$f":"'8'!AE38","v":0},{"$f":"'8'!AF38","v":0},{"$f":"'8'!AG38","v":0},{"$f":"'8'!AH38","v":0},{"$f":"'8'!AI38","v":0},{"$f":"'8'!AJ38","v":0},{"$f":"'8'!AK38","v":0},{"$f":"'8'!AL38","v":0},{"$f":"'8'!AM38","v":0},{"$f":"'8'!AN38","v":0},{"$f":"'8'!AO38","v":0},{"$f":"'8'!AP38","v":0},{"$f":"'8'!AQ38","v":0},{"$f":"'8'!AR38","v":0},{"$f":"'8'!AS38","v":0},{"$f":"'8'!AT38","v":0},{"$f":"SUMPRODUCT(IF($N618=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N618=CategoryRecommended,1,0))","v":1},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,{"$f":"'8'!B39","v":"8"},{"$f":"'8'!C39","v":8.4},{"$f":"'8'!D39","v":"8.4.1"},{"$f":"'8'!E39","v":0},{"$f":"'8'!F39","v":"8.4.1.4"},{"$f":"'8'!G39","v":"8.4.1.4: LIMIT THE DISCLOSURE OF PERSONAL INFORMATION\nWhen personal data is transferred internationally, providers should be aware of any regulations specific to cross-border transfer of personal data."},{"$f":"'8'!H39","v":"ISO 29100:2011 5.6"},{"$f":"'8'!I39","v":"8.4.1.4.1"},{"$f":"'8'!J39","v":"8.4.1.4.1: Has an assessment been made to ensure that any international transfer of personal data (e.g. for data processing in another country) is compliant with regulations?\n"},{"$f":"'8'!K39","v":"1) Data Privacy Policy or data privacy rules of behaviour document\n- For international transfer of personal data, check that an assessment has been made to confirm any transfers are compliant with regulations specific to cross-border transfer of personal data."},{"$f":"'8'!L39","v":0},{"$f":"'8'!M39","v":"Standard Required"},{"$f":"'8'!N39","v":"Required"},{"$f":"'8'!O39","v":"BizOps"},{"$f":"'8'!P39","v":0},{"$f":"'8'!Q39","v":0},{"$f":"'8'!R39","v":0},{"$f":"'8'!S39","v":0},{"$f":"'8'!T39","v":0},{"$f":"'8'!U39","v":0},{"$f":"'8'!V39","v":0},{"$f":"'8'!W39","v":0},{"$f":"'8'!X39","v":0},{"$f":"'8'!Y39","v":0},{"$f":"'8'!Z39","v":0},{"$f":"'8'!AA39","v":0},{"$f":"'8'!AB39","v":0},{"$f":"'8'!AC39","v":0},{"$f":"'8'!AD39","v":0},{"$f":"'8'!AE39","v":0},{"$f":"'8'!AF39","v":0},{"$f":"'8'!AG39","v":0},{"$f":"'8'!AH39","v":0},{"$f":"'8'!AI39","v":0},{"$f":"'8'!AJ39","v":0},{"$f":"'8'!AK39","v":0},{"$f":"'8'!AL39","v":0},{"$f":"'8'!AM39","v":0},{"$f":"'8'!AN39","v":0},{"$f":"'8'!AO39","v":0},{"$f":"'8'!AP39","v":0},{"$f":"'8'!AQ39","v":0},{"$f":"'8'!AR39","v":0},{"$f":"'8'!AS39","v":0},{"$f":"'8'!AT39","v":0},{"$f":"SUMPRODUCT(IF($N619=CategoryRequired,1,0))","v":1},{"$f":"SUMPRODUCT(IF($N619=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N620=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N620=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N621=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N621=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N622=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N622=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N623=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N623=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N624=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N624=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N625=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N625=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N626=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N626=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N627=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N627=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N628=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N628=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N629=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N629=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N630=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N630=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N631=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N631=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N632=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N632=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N633=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N633=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N634=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N634=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N635=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N635=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N636=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N636=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N637=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N637=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N638=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N638=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N639=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N639=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N640=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N640=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N641=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N641=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N642=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N642=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N643=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N643=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N644=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N644=CategoryRecommended,1,0))","v":0},{"$f":"_xlfn.IFNA(MATCH($Q644,ComplianceYes,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q644,CompliancePartial,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q644,ComplianceNo,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($Q644,ComplianceNA,0),0)","v":0},{"$f":"$AU644*AW644","v":0},{"$f":"$AU644*AX644","v":0},{"$f":"$AU644*AY644","v":0},{"$f":"$AU644*AZ644","v":0},{"$f":"$AV644*AW644","v":0},{"$f":"$AV644*AX644","v":0},{"$f":"$AV644*AY644","v":0},{"$f":"$AV644*AZ644","v":0},{"$f":"_xlfn.IFNA(MATCH($AF644,ComplianceYes,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF644,CompliancePartial,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF644,ComplianceNo,0),0)","v":0},{"$f":"_xlfn.IFNA(MATCH($AF644,ComplianceNA,0),0)","v":0},0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N645=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N645=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,{"$f":"$AU645*BI645","v":0},{"$f":"$AU645*BJ645","v":0},{"$f":"$AU645*BK645","v":0},0,{"$f":"$AV645*BI645","v":0},{"$f":"$AV645*BJ645","v":0},{"$f":"$AV645*BK645","v":0},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N646=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N646=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N647=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N647=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N648=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N648=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N649=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N649=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N650=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N650=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N651=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N651=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N652=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N652=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N653=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N653=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N654=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N654=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N655=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N655=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N656=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N656=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N657=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N657=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N658=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N658=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N659=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N659=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N660=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N660=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N661=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N661=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,{"$f":"$AU661*BL661","v":0},0,0,0,{"$f":"$AV661*BL661","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N662=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N662=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,{"$f":"$AU662*BL662","v":0},0,0,0,{"$f":"$AV662*BL662","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N663=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N663=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N664=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N664=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N665=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N665=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N666=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N666=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N667=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N667=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N668=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N668=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N669=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N669=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N670=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N670=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N671=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N671=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N672=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N672=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N673=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N673=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N674=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N674=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N675=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N675=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N676=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N676=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N677=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N677=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N678=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N678=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N679=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N679=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N680=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N680=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N681=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N681=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUMPRODUCT(IF($N682=CategoryRequired,1,0))","v":0},{"$f":"SUMPRODUCT(IF($N682=CategoryRecommended,1,0))","v":0},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]

{"sheet":"Migration","index":19,"n_rows":20,"n_cols":24,"rows_kept":20,"cut":false,"hidden":false,"merged":[[1,21,1,23],[3,21,3,23],[5,21,5,23],[1,13,1,15],[3,13,3,15],[5,13,5,15],[3,17,3,19],[5,17,5,19],[1,17,1,19],[4,13,4,15],[4,17,4,19],[4,21,4,23],[1,1,1,5],[3,1,3,5],[5,1,5,5],[1,9,1,11],[3,9,3,11],[5,9,5,11],[4,9,4,11],[4,1,4,5]]}
[]
[null,{"$f":"CHOOSE(LanguageNumber,J2,N2,R2,V2)","v":"MIGRATION FROM V1 (MAY 2016) TOOLKITS TO V2 (2017) TOOLKITS"},null,null,null,null,null,null,null,"MIGRATION FROM V1 (MAY 2016) TOOLKITS TO V2 (2017) TOOLKITS",null,null,null,"MIGRATION DES OUTILS V1 (MAI 2016) AUX OUTILS V2 (2017)",null,null,null,"MIGRACIÓN DE TOOLKITS V1 (MAYO 2016) A TOOLKITS V2 (2017)",null,null,null,"MIGRATION FROM V1 (MAY 2016) TOOLKITS TO V2 (2017) TOOLKITS"]
[]
[null,{"$f":"CHOOSE(LanguageNumber,J4,N4,R4,V4)","v":"How to migrate R1 toolkits to the R3 toolkit"},null,null,null,null,null,null,null,"How to migrate R1 toolkits to the R3 toolkit",null,null,null,"Comment effectuer la migration des outils de la R1 à la R3",null,null,null,"Cómo migrar de los tookits R1 a R3",null,null,null,"How to migrate R1 toolkits to the R3 toolkit"]
[null,{"$f":"CHOOSE(LanguageNumber,J5,N5,R5,V5)","v":"Macros must be enabled in Excel for the migration tool to work."},null,null,null,null,null,null,null,"Macros must be enabled in Excel for the migration tool to work.",null,null,null,"Les macros doivent être activées dans Excel pour que l'outil de migration fonctionne."]
[null,{"$f":"CHOOSE(LanguageNumber,J6,N6,R6,V6)","v":"Step 1: Type in the full file name and extension of each of the eight R1 Code of Conduct Toolkits into the table below. There will be 8 rows. Double-check that the names are correctly spelled and include the extension.\nStep 2: Make sure all eight toolkit files are in the same folder/ directory as this R3 Toolkit .\nStep 3: Click the button below to start the migration.\nStep 4: Be patient - the migration process may take a minute or more.\nStep 5: At the end of the process, you will be prompted to save the new toolkit, and warned that the resulting workbook will not contain macros. This is expected, and you should save without macros."},null,null,null,null,null,null,null,"Step 1: Type in the full file name and extension of each of the eight R1 Code of Conduct Toolkits into the table below. There will be 8 rows. Double-check that the names are correctly spelled and include the extension.\nStep 2: Make sure all eight toolkit files are in the same folder/ directory as this R3 Toolkit .\nStep 3: Click the button below to start the migration.\nStep 4: Be patient - the migration process may take a minute or more.\nStep 5: At the end of the process, you will be prompted to save the new toolkit, and warned that the resulting workbook will not contain macros. This is expected, and you should save without macros.",null,null,null,"Étape 1 : Entrez dans le tableau ci-dessous le nom complet et l’extension du fichier de chaque outil du Code de Conduite que votre équipe a déjà complété. Le tableau comporte 8 lignes. Assurez que les noms de fichiers sont correctement écrits et comporte l'extension. \nÉtape 2 : Assurez-vous que les huit fichiers d’outils sont classés dans le même dossier/répertoire que le présent Guide d’outils R3\nÉtape 3 : Cliquez sur le bouton ci-dessous pour commencer la migration.\nÉtape 4 : Soyez patient - la migration peut prendre plusieurs minutes.\nÉtape 5 : Une fois le processus terminé, un message vous enjoindra de sauvegarder vos nouveaux outils, et vous avertira que le guide créé ne contient aucune macro. Il s’agit de la procédure normale, et nous vous conseillons vivement de sauvegarder sans les macros.",null,null,null,"Paso 1: Ingresar el nombre completo y la extensión de cada uno de los ocho Toolkits del Código de Conducta en la tabla a continuación. Habrá 8 filas. Verificar dos veces que los nombres estén bien escritos e incluyan la extensión.\nPaso 2: Asegurarse de que todos los archivos de los ocho toolkits estén en la misma carpeta / directorio que este Toolkit R3.\nPaso 3: Hacer clic en el botón a continuación para iniciar la migración.\nPaso 4: Tenga paciencia, el proceso de migración puede tomar más de un minuto.\nPaso 5: Al finalizar el proceso, aparecerá una indicación para que guarde el nuevo toolkit y una advertencia de que el cuaderno resultante no contendrá macros. Debe guardar sin las macros porque se espera que así sea el proceso.",null,null,null,"Step 1: Type in the full file name and extension of each of the eight R1 Code of Conduct Toolkits into the table below. There will be 8 rows. Double-check that the names are correctly spelled and include the extension.\nStep 2: Make sure all eight toolkit files are in the same folder/ directory as this R3 Toolkit .\nStep 3: Click the button below to start the migration.\nStep 4: Be patient - the migration process may take a minute or more.\nStep 5: At the end of the process, you will be prompted to save the new toolkit, and warned that the resulting workbook will not contain macros. This is expected, and you should save without macros."]
[]
[null,{"$f":"CHOOSE(LanguageNumber,J8,N8,R8,V8)","v":"Principle"},{"$f":"CHOOSE(LanguageNumber,K8,O8,S8,W8)","v":"Version"},{"$f":"CHOOSE(LanguageNumber,L8,P8,T8,X8)","v":"File name"},null,null,null,null,null,"Principle","Version","File name",null,"Principe","Version","Nom du fichier",null,"Principle","Version","File name",null,"Principle","Version","File name"]
[null,1,{"$f":"CHOOSE(LanguageNumber,K9,O9,S9,W9)","v":"R1 May 2016"},"Code of Conduct Toolkit - Principle 1 (May 2016).xlsx",{"$f":"CHOOSE(LanguageNumber,L9,P9,T9,X9)","v":"<< type in your actual Toolkit file name"},null,null,null,null,null,"R1 May 2016","<< type in your actual Toolkit file name",null,null,"R1 Mai 2016","<< entrer le nom de fichier de l’outil existant",null,null,"R1 mayo de 2016","<< ingresar el nombre real del archivo del Toolkit",null,null,"R1 May 2016","<< type in your actual Toolkit file name"]
[null,2,"R1 May 2016","Code of Conduct Toolkit - Principle 2 (May 2016).xlsx","<< type in your actual Toolkit file name",null,null,null,null,null,"R1 May 2016","<< type in your actual Toolkit file name",null,null,"R1 Mai 2016","<< entrer le nom de fichier de l’outil existant",null,null,"R1 mayo de 2016","<< ingresar el nombre real del archivo del Toolkit",null,null,"R1 May 2016","<< type in your actual Toolkit file name"]
[null,3,"R1 May 2016","Code of Conduct Toolkit - Principle 3 (May 2016).xlsx","<< type in your actual Toolkit file name",null,null,null,null,null,"R1 May 2016","<< type in your actual Toolkit file name",null,null,"R1 Mai 2016","<< entrer le nom de fichier de l’outil existant",null,null,"R1 mayo de 2016","<< ingresar el nombre real del archivo del Toolkit",null,null,"R1 May 2016","<< type in your actual Toolkit file name"]
[null,4,"R1 May 2016","Code of Conduct Toolkit - Principle 4 (May 2016).xlsx","<< type in your actual Toolkit file name",null,null,null,null,null,"R1 May 2016","<< type in your actual Toolkit file name",null,null,"R1 Mai 2016","<< entrer le nom de fichier de l’outil existant",null,null,"R1 mayo de 2016","<< ingresar el nombre real del archivo del Toolkit",null,null,"R1 May 2016","<< type in your actual Toolkit file name"]
[null,5,"R1 May 2016","Code of Conduct Toolkit - Principle 5 (May 2016).xlsx","<< type in your actual Toolkit file name",null,null,null,null,null,"R1 May 2016","<< type in your actual Toolkit file name",null,null,"R1 Mai 2016","<< entrer le nom de fichier de l’outil existant",null,null,"R1 mayo de 2016","<< ingresar el nombre real del archivo del Toolkit",null,null,"R1 May 2016","<< type in your actual Toolkit file name"]
[null,6,"R1 May 2016","Code of Conduct Toolkit - Principle 6 (May 2016).xlsx","<< type in your actual Toolkit file name",null,null,null,null,null,"R1 May 2016","<< type in your actual Toolkit file name",null,null,"R1 Mai 2016","<< entrer le nom de fichier de l’outil existant",null,null,"R1 mayo de 2016","<< ingresar el nombre real del archivo del Toolkit",null,null,"R1 May 2016","<< type in your actual Toolkit file name"]
[null,7,"R1 May 2016","Code of Conduct Toolkit - Principle 7 (May 2016).xlsx","<< type in your actual Toolkit file name",null,null,null,null,null,"R1 May 2016","<< type in your actual Toolkit file name",null,null,"R1 Mai 2016","<< entrer le nom de fichier de l’outil existant",null,null,"R1 mayo de 2016","<< ingresar el nombre real del archivo del Toolkit",null,null,"R1 May 2016","<< type in your actual Toolkit file name"]
[null,8,"R1 May 2016","Code of Conduct Toolkit - Principle 8 (May 2016).xlsx","<< type in your actual Toolkit file name",null,null,null,null,null,"R1 May 2016","<< type in your actual Toolkit file name",null,null,"R1 Mai 2016","<< entrer le nom de fichier de l’outil existant",null,null,"R1 mayo de 2016","<< ingresar el nombre real del archivo del Toolkit",null,null,"R1 May 2016","<< type in your actual Toolkit file name"]
[]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,"Click this button to start migration",null,null,null,"Cliquez ici pour commencer la migration",null,null,null,"Hacer clic en este botón para iniciar la migración",null,null,null,"Click this button to start migration"]