Demystifying trust service regulations: what you need to know

The first article in this series, Unlocking the world of Electronic Transactions and Trust Services, published on 11th September, can be found here.

Part 2

Regarding licensing service providers, we refer to Chapter Three of the Decree-Law to understand how the law is enforced correctly. This chapter provides the authorization issued under the provisions of the Decree-Law and its Regulations, which allows the licensee to engage in any of the trust services or approved trust services.

Article 15 of the Decree-Law outlines the regulations regarding the provision of trust services. It states that individuals or entities can only offer trust services if they obtain a license from the Telecommunications and Digital Government Regulatory Authority. Additionally, the provision of approved trust services is also subject to obtaining a license from the Authority and operating as an approved party according to the conditions and standards specified in the executive regulations.

To apply for a license, the interested party must follow certain procedures outlined in Article 2 of the cabinet decision. The Authority will provide all the necessary information, application forms, and requirements for licensing on its website or through other appropriate means. The license application must include various details as specified by the Authority, such as:

• A copy of the license issued by the competent authority, authorizing the applicant to conduct activities in the country.
• A statement of other commercial activities the applicant is authorized to practice, not related to trust services.
• Information about the headquarters of the applicant's business in the State.
• A business plan, indicating the nature, strategy, objectives, marketing plans, and service delivery plan.
• Details about the type of commercial license and the shares of partners, if any, and the organizational structure.
• A statement demonstrating the institutional and operational capabilities of the applicant.
• A compliance assessment report, covering a period not exceeding one month.
• Documents submitted during the compliance assessment process.
• A financial data report for the last fiscal year, issued by an accredited auditor in the State, showing financial resources equivalent to (5,000,000) five million Dirhams.
• A bank guarantee or insurance specified by the Authority, automatically renewed upon license renewal.

Furthermore, the license applicant must provide a service termination plan in accordance with Article 18 of the Decree-Law. This plan outlines measures that the licensee will take in case of termination of services. This includes revoking authentication certificates or data of subscribers' accounts issued by the licensee, destroying electronic signature or seal creation data, and ensuring services continue for existing subscribers during the termination plan period approved by the Authority.

Article 16 of the Decree-Law states that the Federal Authority for Identity and Citizenship will establish rules, standards, and requirements that must be met by license applicants, service providers, or approved service providers in two specific cases:

• Trust Services or Approved Trust Services provided to the government sector.
• Trust Services or Approved Trust Services that rely on data or services from the Federal Authority for Identity and Citizenship.

The Authority is responsible for ensuring that the license applicants, service providers, or approved service providers comply with these rules, standards, and requirements mentioned earlier. If any of them violate or fail to meet these guidelines, the Authority has the authority to suspend or revoke their license. The Authority will collaborate with the Federal Authority for Identity and Citizenship in all matters covered by this Article.

License Application Examination Procedures, as stated in Article 3 of the cabinet decision, involve the Authority conducting a thorough review and examination of the license application and verifying all the information and documents provided. This process should be completed within one month from the date when the application is considered complete. If for any reason, the review requires more time, the applicant will be informed about the updated timeframe.

If there are any changes or updates in the data or documents submitted in the license application, the applicant must notify the Authority within one week, along with a valid explanation for the modifications. Additionally, if the applicant decides to withdraw the license application, they must inform the Authority within the same timeframe. In such cases, the applicant will be responsible for any fees or costs incurred due to these changes.

Furthermore, the Authority has the discretion to grant exemptions to the license applicant from certain licensing requirements specified in this Decision and other relevant decisions issued by the Authority.

Authority's Decision after Examining the Licence Application, according to the provisions of Article 4 of the cabinet decision, after reviewing and examining the license application, the Authority issues its decision of approval or rejection. If the Authority approves the license application to provide approved trust services or trust services specified in the application, the Authority issues a license authorizing the applicant to provide approved trust services or trust services after paying the license issuance fees. The authority also determines the Emirati trust list according to the licensing decision on the basis of each approved trust services or trust service specified in the license, If the Authority approves the license application to provide trust services or approved trust services specified in the application, It shall issue a licence authorising the applicant to provide trust services or approved trust services after paying the licence issuance fees, and It shall update the UAE Trust List in accordance with the licensing decision on the basis of each trust service or approved trust service specified in the licence.

According to Article 5 of the cabinet decision concerning the License Issuing Authority, the licensing decision will be issued by the Authority only after it receives the approval of the Chairman or his authorized representative.

Article 6 of the same regulations regarding the License Period states that the license will be valid for two years, starting from the date of issuance.

Regarding the renewal of the license, Article 7 of the cabinet decision states that the licensee must fulfill all the requirements for license renewal at least 3 months before the license period expires. The license renewal application should include all the data and documents mentioned in Article 2 of the cabinet decision related to the initial license application. Additionally, the fees for the license renewal application must be paid in the manner specified by the Authority, and proof of payment must be included along with the license renewal application.

If the license is not renewed within the specified period, Article 8 of the cabinet decision states that the licensee will be considered in violation if the license is not renewed within 30 days after its expiration. In such a case, the relevant administrative penalties will be imposed.

Regarding the process of examining the license renewal application, Article 9 of the cabinet decision states that the Authority will review and verify the data and documents submitted as part of the renewal application, following the procedures specified in Article 3 of the same decision.

Article 10 of the cabinet decision addresses the License Renewal Decision. After reviewing and verifying the license renewal application, the Authority will issue its decision in the following ways:

• Approval of the renewal application: If the Authority finds that the applicant has met all the necessary requirements specified in the Decree-Law, this Decision, and the relevant decisions issued by the Authority, as well as the requirements of the concerned entities, the Authority will issue a license authorizing the applicant to provide trust services or approved trust services. The applicant must pay the required license issuance fees, and the UAE Trust List will be updated accordingly based on the services mentioned in the license application.
• Rejection of the renewal application: If the Authority determines that the applicant has not met the required conditions outlined in the Decree-Law, this Decision, and the relevant decisions issued by the Authority, or the requirements of the concerned entities, the renewal application will be rejected. In this case, the Authority may take one of the following actions:
  (i) Provide a specified period for the applicant to address the non-compliance issues, after which the rejection decision will be reviewed or finalized.
  (ii) Impose the applicable administrative penalties for the non-compliance.

Article 11 of the cabinet decision deals with the process of filing a grievance against the Authority's decision. If the license applicant or license renewal applicant's application is rejected, they have two options:

• They can choose to re-submit a new application following the existing procedures.
• Alternatively, they can file a grievance against the rejection decision within a period of 14 days from the date of the Authority's decision.

Article 12 of the cabinet decision outlines the procedures for license suspension or revocation:

• If the license for trust services or approved trust services providers is suspended, they must immediately stop providing services to any new subscribers specified in the license. However, they must continue providing services to existing subscribers before the suspension takes effect.
• If the license of a trust services or approved trust services provider is revoked, the provider will be notified to activate a termination plan for some or all of the services specified in the license. After the termination plan is implemented, the UAE Trust List will be updated accordingly.
• If the license of an approved trust service provider is revoked, their approval capacity for the services covered by the revoked license will also be withdrawn.
• In any case, upon the expiration or revocation of the license, the licensee cannot directly suspend the trust services or approved trust services. They must follow the specific procedures specified by the Authority, and they cannot be exempted from their obligations as per the Decree-Law, this Decision, and the requirements of the concerned entities, without prior approval from the Authority.
• The application of these procedures does not prevent the imposition of administrative penalties or the penalties stipulated in the Decree-Law.

Article 13 of the cabinet decision outlines the license amendments cases:

• If the licensee wants to make any changes or amendments to the information provided in the license application or renewal application, or in the documents submitted for the compliance report, they must inform the Authority within one week.
• The licensee needs to obtain prior approval from the Authority for certain types of amendments, including changes to the establishment's data, ownership, business headquarters, technical, administrative, and financial capacity to manage the services specified in the license, changes in identity verification procedures for applicants and subscribers of trust services, changes in information systems for trust services, and any modifications to the termination plan.
• Changes to the license, trust services, approved trust services, or approval capacity will be continuously updated in the UAE Trust List if the Authority deems it necessary.
• The Authority will specify the procedures for submitting amendment applications and process them through decisions issued by the Authority.

Article 14 of the cabinet decision addresses the costs associated with license suspension or revocation:
If a licensee's approval capacity is withdrawn or their license is suspended or revoked, or if a license renewal applicant's application is rejected, they will be responsible for covering all the costs related to compliance assessment reports.

Article 35 of the Decree Law outlines the obligations of the licensee, who is defined as a legal entity licensed by the Authority according to the provisions of this Decree-Law and its Implementing Regulation. The licensee is required to:

• Notify the Authority, concerned entities, and relevant individuals of any violations or breaches that compromise the security and integrity of the Data as soon as they become aware of such violations or within the timeframe specified by the Authority's decisions.
• Show the Approved Party the security and trust levels of the Digital Identity issued under the Electronic Identification System.
• Ensure compliance with the approved specifications, standards, technical, and security procedures for the required security level in the Electronic Identification System as determined by the Authority.
• Submit a compliance report every two years to the Authority, indicating adherence to the terms of the license and the decisions issued by the compliance entity.
• Protect personal Data and implement rules and procedures in accordance with the requirements of competent entities and prevailing legislation.
• Take necessary measures to manage risks related to the security and safety of Electronic Trust Services and Approved Trust Services to prevent accidents, security breaches, or minimize their impact if they occur.
• Adhere to other obligations specified in the Implementing Regulation of this Decree-Law or other relevant legislation in the State, as clarified in Article 15 of the cabinet decision. These include maintaining up-to-date and accurate data and documents throughout the license period, acting fairly and impartially in all activities and not causing monopolies or impacting the competitiveness of the sector or subscribers, taking responsibility for any damages resulting from non-compliance with obligations, informing subscribers of any restrictions on service use, and adopting appropriate policies to manage risks and ensure data protection.

Additionally, the licensee must follow the Authority's procedures for handling complaints, publish relevant documents in Arabic and English for public access, and prepare a service termination plan. The termination plan should cover informing subscribers about service suspension or termination, maintaining the integrity of subscriber records, facilitating access to records for affected subscribers, and ensuring transactions and records made during the provision of trust services are not affected.

To be continued on Monday 25th September, stay tuned.