Guidelines for Operational Activities - to be followed by Point of Presence (PoPs) performing activities of National Pension System (NPS)

Document text

Page | 2 GUIDELINES ISSUED UNDER SECTION 14 OF THE PENSION FUND REGULATORY AND DEVELOPMENT AUTHORITY, ACT, 2013 READ WITH THE PENSON FUND REGULATORY AND DEVELOPMENT AUTHORITY (POINT OF PRESENCE) REGULATIONS 2018 (AS AMENDED) IN RESPECT OF THE POINT OF PRESENCE REGISTERED BY THE AUTHORITY UNDER REGULATIONS 3(1) THEREOF In exercise of the powers conferred under Section 14 of Pension Fund Regulatory and Development Authority Act, 2013 read with the Pension Fund Regulatory and Development Authority (Point of Presence) Regulations, 2018 (as amended) more particularly Regulation 41 and 42, thereof, following Guidelines are being issued. The Guidelines shall be applicable to following categories of Point of Presence registered under Regulation 3(1) of Pension Fund Regulatory and Development Authority (Point of Presence) Regulations, 2018 and amendments thereof: Regulation 3(1)(i) - National Pension System (NPS) - Distribution and Servicing for public at large through physical as well as online platforms (hereinafter referred in these Guidelines as ‘PoP-NPS’ for convenience of reference). Regulation 3(1)(ii) - National Pension System (NPS) - Distribution and Servicing for citizens at large through online platforms only (hereinafter referred in these Guidelines as ‘PoP-NPS- Online’ for convenience of reference). Regulation 3(1)(iii) - National Pension System (NPS) - Distribution and Servicing only for own Employees and other Personnel either through physical or online platforms (hereinafter referred in these Guidelines as ‘PoP-NPS-Corporate’ for convenience of reference). These guidelines shall be effective from July 01, 2023 and shall supersede the earlier guidelines issued vide circular no. PFRDA/02/05/104/0001/2017-RnS-POPs dated September 15, 2017. Notwithstanding such supersession, anything done or any action taken under or in terms of the said guidelines, shall be deemed to be valid and have effect, for the period, when such guidelines was in force and remains applicable. The present guidelines may be modified by the Authority from time to time depending upon the service requirements/amendments in the Regulations, if any. In these Guidelines, Point of Presence registered under Regulation 3(1)(i) or Regulation 3(1)(ii) or Regulation 3(1)(iii) of Pension Fund Regulatory and Development Authority (Point of Presence) Regulations, 2018 and amendments thereof, together are hereinafter referred to as ‘PoP’ for convenience of reference. In these Guidelines, Schedule I (applicable for PoP-NPS and PoP-NPS-Online) and Schedule II (applicable for PoP-NPS-Corporate), wherein the Service Standards are prescribed, together are hereinafter referred to as ‘Schedule’ for convenience of reference. PoPs shall display these guidelines on website (for PoP-NPS and PoP-NPS-Online) and on notice boards and/or internal portal (for PoP-NPS-Corporates). A. Service Standards [1] PoP shall follow the ‘Service Standards’ for all activities under NPS as prescribed in the Schedule of these guidelines for providing the services to subscribers/prospects of NPS in mode and manner prescribed therein and shall display these prescribed ‘Service Standards’ along with Page | 3 Turn Around Time (TAT) for various activities on its website and/or at branches/PoP-SPs (for PoP-NPS and PoP-NPS-Online) and on notice boards and/or internal portal (for PoP-NPS- Corporates). [2] PoP shall be liable to compensate the affected subscribers in the event of any delay or violation in the Service Standards as prescribed in the Schedule. Besides the delay in TAT for various activities as specified in the Schedule, in case of any loss suffered by subscribers due to any other operational lapse, PoP shall make good the loss to the subscribers. Such compensation as prescribed in the Schedule shall be paid to the affected subscribers suo moto, without waiting for a complaint/grievance or claim from the subscriber. [3] Subscribers who do not get the benefit of redress for the delay in Turn Around Time (TAT) for various activities as prescribed in the Guidelines, can register a complaint/grievance against the concerned PoP in Central Grievance Management System (CGMS) in accordance with Pension Fund Regulatory and Development Authority (Redressal of Subscriber Grievance) Regulations, 2015 and amendments thereof and follow the escalation matrix prescribed therein. PoPs shall ensure to display such rights of the subscribers preferably on website and/or at branches/PoP-SPs (for PoP-NPS and PoP-NPS-Online) and on notice boards and/or internal portal (for PoP-NPS-Corporates). [4] PoP shall consider following points for association with any Point of Presence - Sub Entity (hereinafter referred in these Guidelines as ‘PoP-SE’ for convenience of reference): (i) The terms and conditions of operations between PoP and PoP-SE will be mutually agreed upon, in accordance with Pension Fund Regulatory and Development Authority (Point of Presence) Regulations, 2018 and amendments thereof and any other instructions issued by the Authority from time to time. (ii) PoP shall ensure flow of information from PoP-SE to PoP in such a way that all Turn Around Times (TATs) as prescribed under service level standards in the Schedule, are adhered to. (iii) PoP shall ensure that the PoP-SE should contact or communicate only with PoP on all matters and any direct communications with the Authority shall not be entertained. (iv) PoP shall ensure generation of PoP-SE code for each PoP-SE at CRA system and upload of the same for each application being sourced by latter. (v) PoP shall compile and submit the prescribed MIS reports on behalf of its PoP-SE/s. PoP- SE shall not directly submit any MIS report / information to the Authority. [5] The terms and conditions of operations between PoP (applicable for PoP-NPS and PoP-NPS- Online) and Retirement Advisers (herein after referred in these Guidelines as ‘RAs’ for convenience of reference) shall be mutually agreed upon and the same shall be guided by Pension Fund Regulatory and Development Authority (Retirement Adviser) Regulations, 2016, and amendments thereof and Pension Fund Regulatory and Development Authority (Point of Presence) Regulations, 2018, and amendments thereof. [6] The terms and conditions of operations between PoP (applicable for PoP-NPS and PoP-NPS- Page | 4 Online) and individual Business Correspondents (herein after referred in these Guidelines as ‘BCs’ for convenience of reference) or agents shall be mutually agreed upon and the same shall be guided by Pension Fund Regulatory and Development Authority (Point of Presence) Regulations, 2018 and amendments thereof, circular no. PFRDA/2021/33/REG-POP/01 dated August 09, 2021 and any other instructions issued by the Authority from time to time. [7] PoP shall make available all NPS related forms, as prescribed by the Authority from time to time, to the subscribers. [8] The assignment of functions by PoPs shall be in accordance with Pension Fund Regulatory and Development Authority (Point of Presence) Regulations, 2018 and amendments thereof. In case of irregularities occurring in PoP related activities, the same shall be reported to the Authority in accordance with the circular no. PFRDA/2021/14/SUP-POP/2 dated May 21, 2021 and any other instructions issued by the Authority from time to time. [9] PoP shall adhere to the PFRDA Act 2013, rules, regulations, circulars, guidelines, directions, advisories and instructions issued by the Authority from time to time. B. Standard Operating Procedures PoP shall adhere to the Standard Operating Procedures (SOPs), for interfacing with Central Record Keeping Agencies (CRAs) and other intermediaries, prescribed by the CRAs and/or the Authority for operational activities with respect to NPS. C. Subscriber On-boarding Procedure PoP shall follow the service requirements for on-boarding of subscriber under NPS as prescribed in the Schedule. D. Contribution Management Procedure PoP shall collect and process the contributions as per the service requirement prescribed in the Schedule. PoP shall also comply with the following procedures and parameters to ensure transparency, uniformity and risk minimization: [1] NPS contribution collection process (i) PoP shall ensure that credible collection infrastructure is available for its underlying subscribers. (ii) PoP shall open or have a collection account in the name of “Name of the PoP or its abbreviation – Collection Account – Name of pension scheme or its abbreviation – National Pension System Trust or its abbreviation” or as prescribed under Pension Fund Regulatory and Development Authority (Point of Presence) Regulations, 2018 and amendments thereof. As an illustration, if State Bank of India is registered with the Authority for performing activities of NPS, the collection account may be in the name of “SBI - Collection Account - NPS - NPS Trust”. (iii) The collection account shall be a non-withdrawable account with an option to transfer the funds to NPS Trust’s account maintained with Trustee Bank. In exceptional cases such as Page | 5 wrong entries, unidentified entries or amount not pertaining to subscriber contribution, it may be credited to any other account as may be specified by the Authority through guidelines/circulars and any other instructions issued by the Authority from time to time. The authority to transfer the collection amount will reside with the PoP. PoP shall also record reasons for such transfers in writing and the same is subject to audit and inspection. (iv) PoP-NPS can have a collection account with itself if it is a banking entity or with any scheduled commercial bank if it is a non-banking entity. (v) PoP shall ensure Permanent Account Number (PAN) of the subscribers for all cash transactions exceeding Rs. 50,000/- (Rupees Fifty Thousand) or as prescribed under Rule 114B of the Income-tax Rules, 1962 must be captured at the time of collecting contributions. (vi) PoP shall ensure that PoP-SEs/individual BCs or agents/RAs should not be authorized to collect the contribution in cash. (vii) PoP shall ensure that the list of designated/registered branches including PoP-SEs/ individual BCs or agents/RAs, who/which are authorized to collect contribution, must be made publicly available. (viii) PoP shall ensure that the acknowledgement in the form of slip / receipt with unique number (preferably electronic receipt) / intimation is being provided to the subscribers by PoP/PoP-SPs/PoP-SEs/individual BCs or agents/RAs. [2] Pooling of contribution in the collection account (i) PoP shall ensure that no contribution is collected without the details of the subscribers. (ii) PoP-NPS and PoP-NPS-Online shall ensure the cash/non-cash instrument collected shall be deposited during the bank working hours within TATs prescribed under Schedule I, as applicable. (iii) PoP-NPS and PoP-NPS-Online shall transfer the fee and charges earned from NPS related transactions to a separate account of the PoP in case the same are received in NPS collection account to ensure proper reconciliation; and shall maintain the trails of such transfer for audit and inspection. Further, necessary IT arrangements shall be made by PoP for the same. (iv) PoP shall ensure that no funds are lying un-identified/un-reconciled in the NPS Collection account maintained by the PoP and details of all contributions credited into the NPS Collection account should be uploaded into the CRA system and funds remitted to the Trustee Bank as per the timelines prescribed in the Schedule. (v) PoP-NPS and PoP-NPS-Online shall display the complete fee/charge structure under NPS on their website as prescribed by the Authority from time to time. (vi) PoP-NPS and PoP-NPS-Online shall ensure the compliance on directions/circulars issued by the Authority from time to time in respect of processing of contributions received from payment gateway service provider for digital transaction and further shall ensure the display of settlement time and charges of Payment Gateway Service Providers (PGSPs) for digital transaction at the time of initiating payment of NPS contributions by the subscriber on the Page | 6 website in compliance with circular no. PFRDA/2019/7/SUP/POP/1 dated March 11, 2019 and any other instructions issued by the Authority from time to time. [3] Handling of system/technical issues (i) PoP shall capture and maintain the records of screen shot of system/technical issues/glitch along with reasons recording in writing, which resulted in delay beyond TAT for operational activities prescribed in the Schedule. (ii) In case there are delay in activities beyond T due to system/technical issues/glitch (where T is the maximum TAT prescribed for the respective operational activities in the Schedule), PoP shall be required to intimate concerned subscribers / associated corporates about such delays and adhere to the following: (a) Where delay is within T+1, PoP shall ensure that the records are maintained as prescribed under [3](i) and the same shall be subject to audit and inspection. (b) Where delay is beyond T+1, PoP may request for waiver of compensation for the delay in activities (due to system/technical issues), along with the supporting documents as prescribed under [3](i), for the consideration of the Authority. [4] Risk Mitigation Measures (i) PoP shall have robust and efficient mechanisms for the identification, assessment, quantification, control, mitigation and monitoring of the risks associated with all the activities related to NPS. (ii) PoP shall have necessary control to avert the risk relating to Anti Money Laundering (AML) or Combating Financing of Terrorism (CFT) and shall be guided by the circulars, guidelines, directions, advisories etc. issued by the Authority from time to time. (iii) PoP shall monitor cash collection procedure and functioning of the NPS collection account on daily basis. (iv) PoP shall ensure complete due diligence during the registration of subscribers and necessary vigil on the entire fund collection process. (v) PoP shall review internally the compliance of the Act, rules and regulations, notifications, circulars, guidelines, directions, advisories and any other instructions issued by the Authority from time to time on at least quarterly basis or more frequently, if required, and record of the same shall be maintained. Any deviations are to be reported to the Authority. E. Reports and Disclosures [1] PoP shall submit digitally signed / duly signed, stamped and scanned copy of following reports to Supervision department - PoPs, PFRDA at reports-pop@pfrda.org.in from the official e-mail ID of the Compliance Officer or as per the mode prescribed by the Authority from time to time: (i) Quarterly Compliance and Exception Report on all activities (as per Annexure 1) within 30 (thirty) calendar days from the quarter ending. Page | 7 (ii) Cyber Security Certificate in accordance with circular no. PFRDA/2020/13/SUP-POP/2 dated April 21, 2020 [Annual Cyber Security Compliance certificate (as per Annexure 2.1) within 30 (thirty) days from the end of the Financial Year. Report on cyber-attacks incident pertaining to NPS activities, if any, (as per Annexure 2.2) immediately on occurrence of such incident]. [2] The details of NPS related activities undertaken by PoP-SEs/individual BCs or agents/RAs shall also be included by the PoP in the reports mentioned above. [3] PoP shall submit the details/reports as may be specified by the Authority from time to time. [4] All the above-mentioned reports shall invariably be digitally signed / duly signed and stamped by the Compliance Officer. F. Redressal of grievances [1] PoP shall maintain Grievance Redressal Mechanism internally as per Pension Fund Regulatory and Development Authority (Redressal of Subscriber Grievance) Regulations, 2015 and amendments thereof for redressing complaints with respect to the services rendered to NPS subscribers. The name, e-mail id/s and telephone number/s of the designated Grievance Redressal Officer (GRO) of the PoP/PoP-SPs/service provider branches/offices shall be made public through display on website preferably and/or at branches (for PoP-NPS and PoP-NPS-Online) and display on notice boards and/or internal portal (for PoP-NPS-Corporates). The GRO shall ensure that the grievances of subscribers are redressed effectively and expeditiously. [2] PoP shall monitor grievances lodged in Centralized Grievance Management System (CGMS) portal on daily basis and it shall ensure that those grievances are resolved on immediate basis. [3] PoP shall be responsible for uploading the grievances received directly from the mapped subscribers and other intermediaries into CGMS portal of CRA, and ensure redressal of the same within the timeline prescribed in Pension Fund Regulatory and Development Authority (Redressal of Subscriber Grievance) Regulations, 2015 and amendments thereof. PoP shall also maintain the record of grievance received directly from the subscriber in physical or digital mode. [4] PoP shall lodge its grievance, if any, against any intermediary such as CRA or Trustee Bank in CGMS. G. Other Functions [1] Appointment of Compliance Officer (i) PoP shall appoint a ‘Compliance Officer’ who shall be responsible for monitoring compliance under NPS including provisions of the PFRDA Act 2013, rules, regulations, notifications, circulars, guidelines, directions, advisories and any other instructions issued by the Authority from time to time. (ii) PoP shall ensure that any change in Compliance Officer is communicated to the Authority within 15 (fifteen) calendar days of the same. Further, frequent change of compliance officer may be avoided to ensure the continued monitoring and compliances. Page | 8 (iii) The latest details / last communication available with the Authority in respect of the Compliance Officer of the PoP shall be considered for serving any notice(s) or taking any regulatory action(s) in case of any breach of any regulations and operational guidelines as envisaged under the extant Regulations. [2] Registration of PoP-SPs PoP is advised to register its service provider branches or offices performing the activities under NPS in the CRA/s’ system as ‘PoP-SPs’ and shall ensure that the list is made available on its website. [3] Confidentiality PoP shall maintain absolute confidentiality with respect to all records, data and information received by it in accordance with PFRDA (Point of Presence) Regulations, 2018 and amendments thereof from time to time. [4] IT and cyber security requirements PoP shall have adequate IT infrastructure for carrying out activities under NPS as prescribed under the PFRDA Act 2013, Rules, Notifications, guidelines etc. (i) For access to CRA system the concerned PoP shall: (a) Have internet connectivity for web-based interaction; (b) Have demonstrated capability to electronically transmit the information related to NPS subscriber contribution through Subscriber Contribution Files (SCFs) as per the prescribed timelines; (c) Have adequate systems with Operating System (OS), web browsers at all its branches and back office software for: (I) Receiving transactions requests and uploading in the CRA system; (II) Issuance of acknowledgement with unique ID against receipt of subsequent contribution and all other activities; and (III) Monitoring status of each transaction and generating regular MIS reports for internal control purposes. (ii) It shall be the responsibility of the PoP to utilize and act on the basis of views and reports made available online/offline by CRA for providing quality service delivery to the NPS subscribers. (iii) PoP shall ensure compliance of cyber security policy and submit the reports as prescribed by the Authority from time to time. Referred circular are enclosed and other relevant documents are available at www.pfrda.org.in. ********************************************** Page | 9 SCHEDULE I Service Standards for PoP-NPS and PoP-NPS-Online Types of Activities Service Requirements Turn Around Time Compensation payable to subscribers in case of default I II III IV 1. On-boarding of subscribers under NPS a. Subscriber registration i. PoP shall address the queries of potential subscribers regarding NPS. ii. PoP shall collect complete SRF along with non-cash instruments for initial contribution as prescribed therein, as applicable. (Definition: Complete SRF means Subscriber Registration Form along with necessary documents as prescribed therein) iii. PoP shall carry out customer due diligence procedures in adherence to Prevention of Money Laundering Act, 2002 through effective use of Know Your Customer Verification Processes and comply with all guidelines/ circulars/ directions issued by the Authority from time to time. iv. In case of any discrepancy found during the collection and verification of SRF along with supporting documents, PoP/PoP- SP/PoP-SE shall: a. Inform the applicant. b. Coordinate with the applicant to get further requirements / new application form filled, if required. c. Refund the contribution amount including processing fees and taxes deducted/collected upfront by Category i: Processing of registration through online mode by both PoP and PoP-SPs/service provider branches/offices. Maximum T+1 day, where T is the date of receipt of complete SRF at PoP. Category ii: Processing of registration through offline mode by PoP- SPs/service provider branches/offices and online mode by PoP. Maximum T+7 days, where T is the date of receipt of complete SRF at PoP-SPs/service provider branches/offices Category iii: Processing of registration through offline mode by utilizing CRA/CRA-FC by both PoP-SPs/service provider branches/offices and PoP. Maximum T+10 days, where T is the date of receipt of complete SRF at PoP- SPs/service provider branches/offices. For each delayed transaction, PoP shall pay: Repo rate + 2 % p.a. of initial contribution amount for the period of delay or Rs. 20/- whichever is higher. (This amount should be credited to the subscriber’s PRAN). Page | 10 maintaining proper audit trail. v. PoP shall provide acknowledgement slip / receipt for collection of SRF and initial contribution with unique number at time of registration along with receipt date and stamp/signature. vi. PoP shall process subscriber registration at CRA portal (if applicable). vii. PoP shall forward complete SRF (including KYC documents) to central recordkeeping agency (CRA) or its representative and/or shall be guided by directions issued by the Authority from time to time in respect of handling of SRFs. PoPs shall maintain complete SRF (including KYC documents) or copy of the same in digital/physical mode. 2. Contribution Processing a. Collection of Contribution i) Initial contribution PoP shall ensure collection of contributions at the time of registration. Post receipt of activation status of PRAN from CRA, PoP shall put non-cash instruments for clearance. Maximum T+1 day, where T is the date of receipt of activation status of PRAN from CRA. (Note: In cases where PoP engages PGSPs, PoP to collect the subscriber’s contribution in maximum T+1 day, where T is the date of contribution made by subscriber). For each delayed transaction, PoP shall pay: Repo rate + 2 % p.a. of contribution amount for the period of delay or Rs. 20/- whichever is higher. (This amount should be credited to the subscriber’s PRAN) ii) Subsequent contribution i. PoP shall provide acknowledgement slip / receipt with unique number along with receipt date and stamp/signature. i. On T day, where T is the date of receipt of non-cash instruments / receipt of contributions through online mode. ii. Post verification of PRAN, PoP shall put non-cash instruments for clearance. ii. Maximum T+1 day, where T is the date of receipt of non-cash instruments. Page | 11 (Note: In cases where PoP engages PGSPs, PoP to collect the subscriber’s contribution in maximum T+1 day, where T is the date of contribution made by subscriber). b. Processing of Contribution i. PoPs, which are banks, shall credit the clear funds into the NPS collection account, if the same has been realized into account other than NPS collection account. ii. PoP shall prepare and upload SCF into CRA system. iii. PoP shall remit the funds to Trustee Bank post successful upload of SCF at CRA portal. Maximum T+1 day, where T is the date of receipt of clear funds by PoP. In case of processing of contributions received from corporates tagged to PoP, maximum T+1, where T is the date of receipt of funds along with subscribers’ details from the corporate, subject to the condition that PoP shall return the funds to the tagged corporate on T+2 on non- receipt of subscriber details, where T is the date of receipt of clear funds by PoP/PoP-SP. For each delayed transaction, PoP shall pay: Repo rate + 2 % p.a. of contribution amount for the period of delay or Rs. 20/- whichever is higher*. (This amount should be credited to the subscriber’s PRAN) *Compensation shall be paid for each underlying subscriber. 3. Processing of Service request(s) a. Scheme Preference change i. PoP shall provide acknowledgement slip / receipt with unique number along with receipt date and stamp/signature. ii. PoP shall upload and process the service request(s) as per the SOP (Standard Operating Procedure) provided by CRAs at their portal. Category i: Receipt of change request directly by PoP. Maximum T+1 day, where T is the date of receipt of complete change request at PoP. Category ii: Receipt of change request by PoP through PoP-SPs/service provider branches/offices. Maximum T+7 days, where T is the date of receipt of complete change request at PoP- SPs/service provider branches/offices. i) For each delayed transaction including delay due to wrong/in- correct processing, PoP shall pay: Repo rate + 2 % p.a. of the transacted amount for the period of delay or Rs. 20/- whichever is higher. (This amount should be credited to the subscriber’s PRAN) ii) In case of loss to subscriber is more than the compensation applicable, then PoP Page | 12 shall make the loss good. b. Other service request(s) i.e. Change in subscriber’s details, shifting of subscriber, change of PoP, inter-sector shifting, etc. i. PoP shall provide acknowledgement slip / receipt with unique number along with receipt date and stamp/signature. ii. PoP shall upload and process the service request(s) as per the SOP (Standard Operating Procedure) provided by CRAs on their portal. Category i: Receipt of change request directly by PoP Maximum T+1 day, where T is the date of receipt of complete change request at PoP Category ii: Receipt of change request by PoP through PoP-SPs/service provider branches/offices. Maximum T+7 days, where T is the date of receipt of complete change request at PoP- SPs/service provider branches/offices. For each delayed transaction including delay due to wrong/in- correct processing, PoP shall pay: Rs. 10/- per day subject to maximum Rs. 100. (This amount should be credited to the subscriber’s PRAN) 4. Grievance Management and Exit processing a. Grievances received from NPS subscribers/ prospects i. PoP shall resolve the grievances received in CGMS in accordance to relevant Regulations. ii. In case PoP receives the grievance directly from subscribers (modes other than CGMS), it shall ensure to upload the same into CGMS and maintain records of such grievances and resolve the same. As per the Pension Fund Regulatory and Development Authority (Redressal of Subscriber Grievance) Regulations, 2015 and amendments thereof. As per the Pension Fund Regulatory and Development Authority (Redressal of Subscriber Grievance) Regulations, 2015 and amendments thereof. b. Processing of exit and withdrawal requests i. PoP shall provide acknowledgement slip / receipt with unique number along with receipt date and stamp/signature. ii. PoP shall collect the exit request along with requisite documents and perform necessary due diligence in accordance with Regulations / Guidelines / Circulars / Directions / Instructions issued by the Authority from time to time. Category i: Receipt of exit request directly by PoP (through CRA portal) Maximum T+1 day, where T is the receipt of such request at PoP along with complete set of supporting documents as prescribed therein. Category ii: i) For each delayed transaction including delay due to wrong/in- correct processing, PoP shall pay: Repo rate + 2 % p.a. of the transacted amount for the period of delay or Rs. 20/- whichever is higher. Page | 13 iii. PoP shall upload and process the exit and withdrawal requests as per the SOP (Standard Operating Procedure) provided by CRAs at their portal. Receipt of exit request by PoP through PoP-SPs/service provider branches/offices Maximum T+7 days, where T is the date of receipt of such request at PoP-SPs/service provider branches/offices along with complete set of supporting documents as prescribed therein. ii) In case of loss to subscriber is more than the compensation applicable, then PoP shall make the loss good. c. Handling of Exit/withdrawal forms received offline from subscribers PoP shall submit the exit/withdrawal request form along with supporting documents received offline from subscribers to CRA for storage purpose. PoP shall maintain a copy of the same in physical/digital mode. Maximum T+30 days, where T is the date of authorization of exit/withdrawal request in CRA system. - Note: 1. Working days has to be considered for calculation of TAT even though system driven deductions are made on a non-working day. 2. Repo rate as declared by RBI Monetary Policy Committee from time to time. 3. TATs prescribed in column III of schedule I indicate the ‘maximum/overall timeframe’ stipulated for PoP (including the time taken at all levels i.e. by PoP-SPs/service provider branches/offices and/or PoP-SEs and/or individual BCs or agents and/or RAs) to complete the respective service requirement / activities prescribed in column II. However, PoP shall ensure carrying out the service requirements in shortest possible time. 4. Wherever PoP-SPs/service provider branches/offices are performing activities of NPS, ‘T’ for the purpose of calculation of TAT starts at the level of such branch/office, irrespective of their registration status in CRA/s’ system. 5. In case of upload of compensation amount by PoP in PRAN of subscribers which are frozen/ deactivated due to any reason: a. PoP may request CRA to unfreeze the PRANs for specific period of time for upload of compensation (Post upload, PRANs will be again frozen/deactivated by CRA). b. In case where PRANs are frozen/deactivated due to execution of exit request, PoP may refund the compensation amount directly to subscriber's bank account under intimation to subscribers. 6. PoP shall accept the various ‘PFRDA prescribed Forms’ only with the date of submission of form by the subscribers and shall also ensure to duly date stamp such forms upon receipt at all levels of operation (at all levels of PoP/PoP-SPs/PoP-SEs/individual BCs or agents/RAs). Page | 14 SCHEDULE II Service Standards for PoP-NPS-Corporate Types of Activities Service Requirements Turn Around Time Compensation payable to subscriber (employee) in case of default I II III IV 1. On-boarding of subscriber under NPS Subscriber registration i. PoP-NPS-Corporate (Employer) shall collect complete SRF from the newly joined employee (subscriber). (Definition: Complete SRF means Subscriber Registration Form along with necessary documents as prescribed therein) ii. PoP-NPS-Corporate shall carry out customer due diligence procedures in adherence to Prevention of Money Laundering Act, 2002 through effective use of Know Your Customer (KYC) Verification Processes and comply all guidelines/ circulars/ directions issued by the Authority from time to time. iii. In case of any discrepancy found during the collection and verification of SRF along with supporting documents, PoP- NPS-Corporate shall: a. Inform the employee. b. Coordinate with the employee to get further requirements / new application form filled, if required. c. PoP-NPS-Corporate shall provide salary slip / acknowledgement slip with date and stamp/signature. iv. PoP-NPS-Corporate shall process subscriber registration at CRA portal (if applicable) Maximum T+9 days, where T is the date of joining of employee (subscriber) covered under NPS. For each delayed transaction, PoP-NPS- Corporate shall pay: Repo rate + 2 % p.a. of first contribution amount for the period of delay or Rs. 20/- whichever is higher. (This amount should be credited to the subscriber’s PRAN) Page | 15 v. PoP-NPS-Corporate shall forward complete SRF (including KYC documents) to central recordkeeping agency (CRA) or its representative and/or shall be guided by directions issued by the Authority from time to time in respect of handling of SRFs. PoP-NPS-Corporate shall maintain complete SRF or copy of the same in digital/physical mode. 2. First Contribution Processing First Contribution Processing i. Post receipt of activation status of PRAN from CRA, PoP-NPS-Corporate shall prepare and upload SCF into CRA system. ii. PoP-NPS-Corporate shall remit the funds to Trustee Bank post successful upload of SCF at CRA portal. PoP-NPS-Corporate to file the Turnaround Time (TAT) for activities mentioned under second column with the Authority within 3 (three) months from date of issuance of guidelines under ‘File-and-Approve’ mechanism. In case of non-filing of TAT within the prescribed timeline or till the time the TATs are filed and approved by the Authority, the maximum T+2 days will be applicable, where T is the date of PRAN generation or salary day of the month in which employee has joined, whichever is later. For each delayed transaction beyond the TAT approved under File-and-Approve mechanism, PoP-NPS- Corporate shall pay: Repo rate + 2 % of first contribution amount for the period of delay or Rs. 20/- whichever is higher. (This amount should be credited to the subscriber’s PRAN) 3. Subsequent Contribution Processing Subsequent Contribution Processing i. PoP-NPS-Corporate shall prepare and upload SCF into CRA system. ii. PoP-NPS-Corporate shall remit the funds to Trustee Bank post successful upload of SCF at CRA portal. PoP to file the Turnaround Time (TAT) for activities mentioned under second column with the Authority within 3 (three) months from For each delayed transaction beyond the TAT approved under File-and-Approve mechanism, PoP-NPS- Corporate shall pay: Page | 16 date of issuance of guidelines under ‘File- and-Approve’ mechanism. In case of non-filing of TAT within prescribed timeline or till the time the TATs are filed and approved by the Authority, the maximum T+2 days will be applicable, where T is the salary day of the respective month. Repo rate + 2% of contribution amount for the period of delay or Rs. 20/- whichever is higher. (This amount should be credited to the subscriber’s PRAN) 4. Processing of Service request(s) a. Scheme Preference change i. PoP-NPS-Corporate shall provide acknowledgement slip / receipt with unique number along with receipt date and stamp/signature. ii. PoP-NPS-Corporate shall upload and process the service request(s) as per the SOP (Standard Operating Procedure) provided by CRAs at their portal. Maximum T+7 days, where T is the date of receipt of complete change request (i) For each delayed transaction including delay due to wrong/in- correct processing, PoP- NPS-Corporate shall pay: Repo rate + 2 % of the transacted amount for the period of delay or Rs. 20/- whichever is higher. (This amount should be credited to the subscriber’s PRAN). (ii) In case of loss to subscriber is more than the compensation applicable, then PoP- NPS-Corporate shall make the loss good. b. Subscribers’ other service request(s) i.e. Change in subscribers’ details, shifting of subscriber, i. PoP-NPS-Corporate shall provide acknowledgement slip / receipt with unique number along with receipt date and stamp/signature. ii. PoP-NPS-Corporate shall upload and process the service request(s) as per the Maximum T+7 days, where T is the date of receipt of complete change request For each delayed transaction including delay due to wrong/in- correct processing, PoP- NPS-Corporate shall pay: Page | 17 inter-sector shifting, etc. SOP (Standard Operating Procedure) provided by CRAs at their portal. Rs. 10/- per day subject to maximum Rs. 100. (This amount should be credited to the subscriber’s PRAN) 5. Grievance Management and Exit processing a. Grievances received from NPS subscribers i. PoP-NPS-Corporate shall resolve the grievances received in CGMS in accordance to relevant Regulations. ii. In case PoP-NPS-Corporate receives the grievance directly from subscribers (modes other than CGMS), it shall ensure to upload the same into CGMS and maintain records of such grievances and resolve the same. As per the Pension Fund Regulatory and Development Authority (Redressal of Subscriber Grievance) Regulations, 2015 and amendments thereof. As per the Pension Fund Regulatory and Development Authority (Redressal of Subscriber Grievance) Regulations, 2015 and amendments thereof. b. Processing of exit and withdrawal requests i. PoP-NPS-Corporate shall provide acknowledgement slip / receipt with unique number along with receipt date and stamp/signature. ii. PoP-NPS-Corporate shall collect the exit request along with requisite documents and perform necessary due diligence in accordance with regulations/guidelines/circulars/directions/ instructions issued by the Authority from time to time. iii. PoP-NPS-Corporate shall upload and process the exit and withdrawal requests as per the SOP (Standard Operating Procedure) provided by CRAs at their portal. Maximum T+7 days, where T is the receipt of such request along with complete set of supporting documents as prescribed therein. (i) For each delayed transaction including delay due to wrong/in- correct processing, PoP- NPS-Corporate shall pay: Repo rate + 2 % of the transacted amount for the period of delay or Rs. 20/- whichever is higher. (ii) In case of loss to subscriber is more than the compensation applicable, then PoP- NPS-Corporate shall make the loss good. c. Handling of Exit/withdrawal forms received offline from subscribers PoP-NPS-Corporate shall submit the exit/withdrawal request form along with supporting documents received offline from subscribers to CRA for storage purpose. PoP shall maintain a copy of the same in physical/digital mode. Maximum T+30 days, where T is the date of authorization of exit/withdrawal request in CRA system. - Page | 18 Note: 1. Working days has to be considered for calculation of TAT even though system driven deductions are made on a non-working day. 2. Repo rate as declared by RBI Monetary Policy Committee from time to time 3. TATs prescribed in column III of Schedule II indicate the ‘maximum/overall timeframe’ stipulated for PoP (including the time taken at all levels i.e. by PoP and/or service provider branches/offices) to complete the respective service requirement / activities prescribed in column II. However, PoP shall ensure carrying out the service requirements in shortest possible time. 4. Wherever service provider branches/offices are performing activities of NPS, ‘T’ for the purpose of calculation of TAT starts at the level of such branch/office, irrespective of their registration status in CRA/s’ system. 5. In case of upload of compensation amount by PoP in PRAN of subscribers which are frozen/ deactivated due to any reason: i. PoP may request CRA to unfreeze the PRANs for specific period of time for upload of compensation (Post upload, PRANs will be again frozen/deactivated by CRA). ii. In case where PRANs are frozen/deactivated due to execution of exit request, PoP may refund the compensation amount directly to subscriber's bank account under intimation to subscribers. 6. PoP shall accept the various ‘PFRDA prescribed Forms’ only with the date of submission of form by the subscribers and shall also ensure to duly date stamp such forms upon receipt at all levels of operation (at all levels of PoP/ PoP-SPs). 7. Schedule II is applicable only for corporates/entities directly registered with the Authority under Regulation 3(1)(iii) of PFRDA (PoPs) Regulation 2018 and amendments thereof and not applicable for corporates/entities tagged to PoPs. Page | 19 Annexure - 1 Compliance and Exception Report for the Quarter ended ……………………. [To be submitted by PoP on letterhead to the Authority at reports-pop@pfrda.org.in within 30 calendar days from the quarter, through registered email id of Compliance Officer, digitally signed/scanned copy signed and stamped] Section A: Quarterly Certificate of Compliance Sl. No Particulars Complied With (Yes/No/NA ) Comments (if not complied) / Any other remarks 1 Whether acknowledgment receipts/slips are being provided to the subscriber for registration form & subsequent NPS related transactions as prescribed in Schedule I of guidelines? 2 Whether the PoP is adopting the procedure for doing KYC as required under the Prevention of Money Laundering Act, 2002 (17 of 2003) including the amendments thereof or any other law through effective use of Know Your Customer (KYC) verification processes, laid down by the Authority for all subscribers'? 3 Whether necessary documents as prescribed in SRF form are being obtained for opening of NPS accounts? 4 Whether the PoP-NPS / PoP-NPS-Online has uploaded/downloaded/updated the KYC information of underlying subscribers onto CKYCR in the manner as prescribed under Prevention of Money Laundering (Maintenance of Records) Rules, 2005? (Details to be submitted as per Section-D of this Annexure) 5 Whether the PoP maintains complete SRFs (including KYC documents) or copy of the same in digital/physical mode? Please tick mark the mode of handling SRF as applicable: □Complete SRFs are forwarded to CRA & copies are maintained at PoP □Complete SRFs are maintained at PoP 6 Whether subscriber registration is done as per the TAT prescribed in the Schedule? (Exceptions to be submitted as per Section-B of this annexure) 7 Whether all funds received from subscribers / deducted from salary are being deposited to designated NPS collection account as per the TAT prescribed in the Schedule? (Exceptions to be submitted as per Section-B of this Annexure) Page | 20 Sl. No Particulars Complied With (Yes/No/NA ) Comments (if not complied) / Any other remarks 8 Whether the contribution processing i.e. SCF upload and fund remittance are carried out by the PoP as per the TATs prescribed in the Schedule? (Exceptions to be submitted as per Section-B of this Annexure) 9 Whether PoP has maintained the trails / recorded the reasons in writing for withdrawal/debit of funds from collection account to any other account (other than NPS Trust account maintained with Trustee Bank), if any? 10 Whether the service requests are being processed as per the TATs prescribed in the Schedule? (Exceptions to be submitted as per Section-B of this Annexure) 11 Whether the name, e-mail id/s and telephone number/s of the designated Grievance Redressal Officer (GRO) appointed by PoP/ PoP-SPs/service provider branches/offices are made public through display on website preferably and/or at branches (for PoP-NPS and PoP-NPS-Online) and on notice boards and/or internal portal (for PoP-NPS-Corporates)? 12 Whether all grievances in CGMS at CRA portal are being resolved within the time frame provided in the Pension Fund Regulatory and Development Authority (Redressal of Subscriber Grievance) Regulations, 2015 and amendments thereof? (Exceptions to be submitted as per Section-D of this annexure) 13 Whether the PoP lodges grievances received directly from subscribers onto the CGMS? 14 Whether the exit and withdrawal requests are being processed as per the TATs prescribed in the Schedule? (Exceptions to be submitted as per Section-B of this Annexure) 15 Whether post authorization, the exit/withdrawal forms along with supporting documents received offline from subscribers are submitted to CRA for storage purpose within the prescribed TAT, maintaining a copy of the same in physical/digital mode? 16 Whether the subscriber/claimants are being contacted by the PoP for additional documents for settlement of claims, wherever required? 17 Whether the agreement(s) executed by the PoP with the associated PoP-SEs are in conformity and accordance with the Pension Fund Regulatory and Development Authority (Point of Presence) Regulations, 2018 and amendments thereof? 18 Whether the activities done by associated PoP-SEs are being monitored by the PoP regularly as per the prescribed TATs and all such activities are being done by PoP-SEs in accordance with Page | 21 Sl. No Particulars Complied With (Yes/No/NA ) Comments (if not complied) / Any other remarks the Pension Fund Regulatory and Development Authority (Point of Presence) Regulations, 2018 and amendments thereof? 19 Whether the agreements executed by the PoP with the associated individual BCs or agents are in conformity and accordance with the Pension Fund Regulatory and Development Authority (Point of Presence) Regulations, 2018 and amendments thereof? 20 Whether the PoP ensures disclosure of settlement time and charges of payment service provider for digital transactions at the time of initiation of transactions for the contributions collected through payment gateways? 21 Whether the PoP provides and displays the information related to application forms, offer documents or any other publicity material pertaining to NPS to the subscribers at its registered/designated branches and website (for PoP-NPS and PoP-NPS-Online) and on notice boards and/or internal portal (for PoP-NPS-Corporates)? 22 Whether the PoP adheres to the regulations, circulars, guidelines, directions, advisories etc. issued by the Authority from time to time for specified activities? 23 Whether the PoP has outsourced the activity in accordance with the extant regulation, circular, guidelines, directions, advisories issued by the Authority from time to time? 24 Whether fees and charges collected/quoted by the PoP are as prescribed by the Authority? 25 Whether the PoP has displayed the TAT for all the operational activities on its website and/or at branches (for PoP-NPS and PoP- NPS-Online) and on notice boards and/or internal portal (for PoP- NPS-Corporates)? 26 Whether the PoP has displayed these Guidelines on its website (for PoP-NPS and PoP-NPS-Online) and on notice boards and/or internal portal (for PoP-NPS-Corporates)? 27 Whether the PoP has paid the compensation for the delayed activities as prescribed in the Schedule? 28 Whether the PoP has maintained the records of transactions where delay is reported in activities as prescribed in Schedule due to system/technical issues/glitch along with reasons recording in writing? 29 Whether the PoP has displayed on its website and/or at branches (for PoP-NPS and PoP-NPS-Online) and on notice boards and/or internal portal (for PoP-NPS-Corporates) the rights of the subscribers to raise grievance/complaint who do not get the Page | 22 Sl. No Particulars Complied With (Yes/No/NA ) Comments (if not complied) / Any other remarks benefit of redress for the delay in TAT for various activities / operational lapse? 30 Whether the PoP has submitted the compliance and exception reports as prescribed by the Authority in these Guidelines for the previous quarters? 31 Whether the PoP has ensured the compliance of cyber security measures and submitted the reports as prescribed by the Authority from time to time? Section B: Exception Report in accordance with the applicable Schedule Sl. No Type of activities No. of days of delay beyond prescribed timelines No. of transactions delayed Reason for Delays 1 Delays in subscriber registration 2 Delays in collection of contribution beyond the prescribed timelines 3 Delays in processing initial/first contribution beyond the prescribed timelines 4 Delays in processing subsequent contribution beyond the prescribed timelines 5 Delays in processing of service request(s) beyond the prescribed timelines 6 Delays in processing of exit requests beyond the prescribed timelines Note: In case there is no deviation from the Service Level Standards, it shall be mentioned in the report as ‘No deviation observed/NIL’. Page | 23 Section C: Details of collection account maintained by PoP as on last day of the Quarter Section C1: Details of closing balance Sl. No. Bank account number Name of the Bank Name of collection account Closing Balance as on last day of the Quarter Section C2: Details/bifurcation of closing balance Sl. No. Name of the subscriber / PRAN / SCF Transaction ID details (whichever available) Amount Date of receipt of clear funds Date of remittance to the Trustee Bank, if done Reason for holding the fund, if any Total amount* *Total amount shall be equal to Closing Balance as on last day of the Quarter Section D: Grievances redressal Sl. No. Number of Grievances Reasons for pending grievances beyond 30 (thirty) days, if any Pending as on last day of previous quarter Received during the quarter Resolved during the quarter Pending as on last day of the quarter Pending beyond 30 (thirty) days as on last day of the quarter Section E: Details of NPS accounts opened and CKYC compliance Sl. No. Details Count for the quarter Total count as on last day of the quarter Remarks 1 Number of NPS accounts opened by PoP 2 Number of new CKYC identifiers uploaded 3 Number of existing CKYC identifiers updated 4 Number of existing CKYC identifiers downloaded Page | 24 Section F: Details of service charge collected by PoP during the quarter Sl. No. Service/Charges Amount collected during the quarter (excluding GST) (In Rs.) 1 Subscriber Registration 2 Initial and Subsequent Contribution Processing 3 All Non-financial Transactions 4 Persistency charges (received through CRAs) 5 Subsequent contribution made through eNPS & D-Remit (trail charges received through CRAs) 6 Exit/withdrawal processing 7 Any other (Please indicate) Total I hereby certify that all the activities as mentioned under Section A and also the information contained in Sections B, C, D, E and F during the quarter ended ___________________ have been complied with prescribed operational guidelines. Exceptions, if any, have been reported with remarks. Name of Compliance Officer: Designation: Signature of compliance officer along with Office seal. (Seal not required, if digitally signed) Correspondence Address: Mobile No. / Landline No.: Email id: Date: Place: Note 1: Each page of report needs to be signed by compliance officer. Note 2: Attach separate sheet for each section separately, if required. Page | 25 Annexure 2.1 (To be submitted on letterhead within 30 (thirty)days from the end of the Financial Year) To The Head of the Department Supervision Department - PoPs and RAs Pension Fund Regulatory and Development Authority Subject: Compliance certificate with respect to cyber security for FY __________ This is to certify that ______________________ (Name of PoP/non- individual RA) registered vide Reg. No. _____________________ with Pension Fund Regulatory and Development Authority (Authority) is adhering to the cyber security measures as mentioned in the cyber security policy of the Authority and also as mandated by our principal regulator (as applicable). Name of CISO/ Compliance officer: Designation: Signature of CISO / compliance officer along with Office seal. (Seal not required, if digitally signed) Mobile No./Landline No: Email id: Date: Place: Page | 26 Annexure 2.2 (To be submitted on letterhead immediately on occurrence of cyber-attacks) To The Head of the Department Supervision Department - PoPs and RAs Pension Fund Regulatory and Development Authority Subject: Reporting of cyber-attacks incident Sl. No. Cyber security parameter Details 1 Details of cyber security attack/ breaches including the nature, severity and the steps taken for rectification. 2 Whether all the incidents of cyber security attacks have been reported to CERT-In, as prescribed under section 70B of the Information Technology Act, 2000 and the Rules made thereunder (Details to be provided)? 3 Whether a definite response plan defining responsibilities and actions to be performed by the employees and support/outsourced staff in the event of cyber-attacks or breach of cyber security mechanism is in place? Was the same effective during the cyber- attack? Improvements proposed post cyber-attack may be highlighted. Name of CISO/ Compliance officer: Designation: Signature of CISO / compliance officer along with Office seal. (Seal not required, if digitally signed) Mobile No./Landline No: Email id: Date: Place: ेश नधविनयामक और विकास पाधकरण PENSION FUND REGULATORY AND DEVELOPMENT AUTHORITY Page 1 of 2 CIRCULAR CIR No.: PFRDA/2021/14/SUP-POP/2 21st May 2021 To, All Points of Presence ('PoPs') Dear Sir/Madam, Subject: Delegation of functions by PoPs – reg. 1. In accordance with Regulation 44(1) of the Pension Fund Regulatory and Development Authority (Point of Presence) Regulations, 2018, - “A point of presence shall not transfer or assign any of its functions or obligations specified under these regulations, to any person without the prior written consent of the Authority.” However, in the recent past, it has been observed that some PoPs are assigning their functions to third parties in the name of back end support. 2. PoPs are, therefore, advised to adhere and strictly comply with the Regulation 44 of Pension Fund Regulatory and Development Authority (Point of Presence) Regulations, 2018. They are strictly cautioned to refrain from any assignment of its functions without prior written consent of PFRDA. Any contravention of the Pension Fund Regulatory and Development Authority Act, 2013 and Regulations framed there-under will attract the appropriate regulatory / legal action. 3. Further, in case of any irregularity or fraud occurring in PoP related activities, then the primary responsibility for occurrence and prevention of such irregularity or frauds lies with PoPs themselves. In this regard, PoPs are advised as under: i. PoPs shall immediately report any non-compliance, irregularity or fraud observed, with full information, in accordance with Regulation 21(2) of Pension Fund Regulatory and Development Authority (Point of Presence) Regulations, 2018 and the follow-up action taken thereon within 7 (seven) calendar days of detection of any non-compliance, irregularity or fraud. ii. PoPs shall review and upgrade its system periodically to prevent any possible irregularity or frauds. iii.PoPs shall introduce necessary validations in its system including matching of subscriber names and PRANs at the time of acceptance of contributions or at the time of upload ेश नधविनयामक और विकास पाधकरण PENSION FUND REGULATORY AND DEVELOPMENT AUTHORITY Page 2 of 2 in CRA system to prevent frauds. PoPs may also have additional safety and security features other than as prescribed. 4. This circular is issued in exercise of the powers conferred under Section 14 of Pension Fund Regulatory and Development Authority Act, 2013 and Regulation 45 of Pension Fund Regulatory and Development Authority (Point of Presence) Regulation, 2018 to protect the interests of subscribers and to regulate, promote and ensure orderly growth of the National Pension System and pension schemes to which the Act applies. Yours faithfully, (Sumeet Kaur Kapoor) Chief General Manager Page 1 of 3 PENSION FUND REGULATORY AND DEVELOPMENT AUTHORITY CIRCULAR CIR No.: PFRDA/2020/13/SUP-POP/2 Date: April 21, 2020 To Point of Presence (PoPs) / Non-Individual Retirement Advisers (RAs) Subject: Compliance of Cyber Security Policy by Point of Presence (PoPs) and Non-Individual Retirement Advisers (RAs) PFRDA (Authority) has received in past, various queries from the stakeholders regarding scope and applicability of Circular no. PFRDA/2017/31/CRA/5 dated 04.10.2017 and Circular no. PFRDA/2019/2/REG dated 07.01.2019. 2. In this regard, it is clarified that: – (i) All PoPs and Non-Individual RAs are required to adhere to the cyber security measures and compliances as mentioned in the Cyber Security Policy of the Authority, as detailed in Circular PFRDA/2017/31/CRA/5 dated 04.10.2017 and also as mandated by their principal regulator (as applicable). (ii) In compliance to (i) above, the PoPs and Non-Individual RAs are hereby advised to submit the Compliance certificate with respect to cyber security for respective Financial Year (FY) as per Annexure I (enclosed) within 30 days from the end of the said FY. They are also advised to submit the report on cyber-attacks incident pertaining to NPS activities, if any, as per Annexure II (enclosed) immediately on occurrence of such incident. (iii) Accordingly, the PoPs may submit Certificate as per Annexure I for FY 2018-19 and FY 2019-20 instead of half-yearly basis Certificate as per Annexure A of Circular no. PFRDA/2019/2/REG dated 07.01.2019. (iv) Circular no. PFRDA/2019/2/REG dated 07.01.2019 therefore stands superseded with respect to PoPs. 3. This circular is issued under Section 14 of PFRDA Act, 2013 and is available in Circulars section of Regulatory Framework at PFRDA’s website. Yours Sincerely, (Sumeet Kaur Kapoor) Chief General Manager Page 2 of 3 (To be submitted on letterhead within 30 days from the end of the Financial Year) Annexure I To Head of Department Supervision Department – PoPs and RAs, Pension Fund Regulatory and Development Authority, B-14/A, Chatrapati Shivaji Bhawan, Qutab Institutional Area, Katwaria Sarai, New Delhi -110016 Subject: Compliance certificate with respect to cyber security for FY _________ This is to certify that _________________________________ (Name of PoP/non- individual RA) registered vide Reg. No. __________________with Pension Fund Regulatory and Development Authority (Authority) is adhering to the cyber security measures as mentioned in the cyber security policy of the Authority and also as mandated by our principal regulator (as applicable). Name of CISO/ Compliance officer : Designation : Signature of CISO/Compliance officer along with office seal. Mobile No./Landline No:. Email id : Date : Place: Page 3 of 3 (To be submitted on letterhead immediately on occurrence of cyber-attacks) Annexure II To Head of Department Supervision Department – PoPs and RAs, Pension Fund Regulatory and Development Authority, B-14/A, Chatrapati Shivaji Bhawan, Qutab Institutional Area, Katwaria Sarai, New Delhi -110016 Subject: Reporting of cyber-attacks incident. Sr. No. Cyber security parameter Details 1 Details of cyber security attack/ breaches including the nature, severity and the steps taken for rectification. 2 Whether all the incidents of cyber security attacks have been reported to CERT-In, as prescribed under section 70B of the Information Technology Act, 2000 and the Rules made thereunder (Details to be provided). 3 Whether a definite response plan defining responsibilities and actions to be performed by the employees and support/outsourced staff in the event of cyber-attacks or breach of cyber security mechanism is in place. Was the same effective during the cyber- attack? Improvements proposed post cyber attack may be highlighted. Name of CISO/Compliance officer : Designation : Signature of CISO/ Compliance officer along with office seal. Name of PoP/ Non-Individual RA: Reg. No.: Mobile No./Landline No:. Email id : Date : Place: