State of PalestineLaw by Decree No. 41 of 2022 concerning National Payments, Licensing and Security-Systems Duty
Law by Decree No. 41 of 2022 concerning National Payments, Art. 8
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Licensing
What it requires
- This binds a company or a virtual-asset-service provider licensed by the Palestine Monetary Authority (PMA) to provide a payment service or a financial-technology service; providing any such service without a PMA license is separately prohibited by this decree-law (Art. 8(1)).
- Comply with the security and protection systems and procedures the Palestine Monetary Authority prescribes by instruction for a licensed payment-service or financial-technology company, apply them, and keep pace with their required development (Art. 8(2)(b)).
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Violating the security-instructions duty by itself is enforced through Article 17(2)'s administrative ladder (a warning, a final warning, a temporary or permanent suspension, a fine, or license revocation), not as a criminal offense. Article 17(4) makes it a separate criminal offense, imprisonment of two weeks to two years or a fine of USD 2,000 to USD 50,000, or both, to provide a payment or financial-technology service at all without the license or approvals this decree-law requires, a different duty from the security-systems requirement.
Who enforces it
Enforcement body
The Palestine Monetary Authority (PMA), which may impose a warning, a final warning, a temporary or permanent suspension of service, a fine, or license revocation against a company or virtual-asset-service provider found in violation of this decree-law or its own instructions; unlicensed operation is separately referable to the Public Prosecution.
Settledness
- As of
- Open questions
- Has the Palestine Monetary Authority issued the security and protection systems and procedures instructions Article 8(2)(b) directs it to issue, and if so, what specific technical standard do they set?
- Law by Decree No. 17 of 2024 on Electronic Transactions and Trust Services lays risk-management and breach-notification duties on a مقدم خدمات الثقة ("trust service provider") in Article 38(7) and (8), and defines that provider as a legal person licensed by the supervisory authority it creates to provide trust services. Does a company that the Palestine Monetary Authority licenses under Law by Decree No. 41 of 2022 fall within that definition, or do the Article 38 duties stay with the trust-service licensee alone?
What this law does
Article 8(1) prohibits any person from providing a payment service or a financial-technology service without a license from the Palestine Monetary Authority (PMA). Article 8(2)(b) directs PMA to issue instructions governing, among other things, the activities a licensed company may carry out by electronic means, its application systems, and the required security and protection systems and procedures, their application, and the monitoring of their development.
A company or virtual-asset-service provider found in violation of this decree-law or PMA's own instructions faces an escalating administrative ladder from a warning through a fine of USD 3,000 to USD 250,000 to license revocation. Providing a payment or financial-technology service without the required license or approval at all is a separate criminal offense punishable by imprisonment of two weeks to two years or a fine of USD 2,000 to USD 50,000, or both.
When LexLint raises it
When your app profile says your app is a payment provider or is a crypto-asset provider.
Back to the example · Lint your app
Page updated .