The Board of the Central Bank of Uzbekistan has approved amendments to the 'Regulation on Minimum Requirements for Ensuring Information Security and Cybersecurity, as well as Preventing Fraud in the Provision of Remote Financial Services to Individuals by Credit and Payment Organizations and Payment System Operators.'
One of the key changes concerns user registration in mobile applications. Credit and payment organizations will now be able to conduct remote biometric identification of clients. The PINFL (personal identification number) of the phone number owner must match the PINFL of the application user. An exception is provided for corporate numbers.
Users will be able to register and link bank accounts, cards, and electronic wallets belonging to their close relatives in their account. Through this account, P2P transfers between individuals are allowed.
Credit and payment organizations will independently set the maximum amount for P2P transfers that can be made without an OTP code (one-time secret code) or another additional authentication method, based on their own risk management policies. Responsibility for fraud in such transfers will be placed on the credit or payment organization itself.
Transfers exceeding the established limit must be confirmed with an OTP code or another authentication method. P2P transfers via websites are prohibited.
Restoring a password for an existing account or logging in from another device will only be possible after passing biometric identification. However, when linking a card, the user will only need to enter an OTP code.
When logging in from another device or restoring a password, all bank cards linked to the account must automatically be switched to an inactive state.
The display of personal data during money transfers will also change. The first and last name of the bank card holder, as well as the data of the cardholders of the sender and recipient of the transfer, will be displayed in the mobile application in a partially hidden form. Previously, the application displayed the cardholder's name and the first letter of the surname.
The innovations will come into force in three months.
Source: uznews.uz