Who the Guidelines apply to
By a circular of 13 October 2026 to all licensees under the National Payment Systems Act, Cap. 59 (the Act), Bank of Uganda issued its Corporate Governance Guidelines for Non-Bank Payment Service Providers, Payment System Operators and Issuers of Payment Instruments, which take effect on 01 July 2027. Guideline 2 applies them to every entity licensed as a non-bank payment service provider, a payment system operator or an issuer of payment instruments, which in practice takes in the e-money issuers, the wallet and remittance businesses, the switches and the payment aggregators. Banks are outside them: the title describes all three categories as non-bank, although guideline 2 attaches the word only to payment service providers, and a bank that also holds a licence as a system operator or instrument issuer should confirm its position with Bank of Uganda.
Two classes of licensee carry more: a licensee classified as a large electronic money issuer or as the operator of a large funds transfer system must keep documented succession plans for its other senior management positions in addition to the chief executive (guideline 5(a)(viii)), and may outsource internal audit only with Bank of Uganda’s prior approval (guideline 11(b)). The Guidelines leave both classes undefined; the definitions are in the licence classes of the National Payment Systems Regulations, 2021 (S.I. No. 18 of 2021) (the Regulations), as amended by the National Payment Systems (Amendment) Regulations, 2022 (S.I. No. 102 of 2022), under which an electronic money issuer is large once its total trust account value exceeds UGX 100,000,000,000/= (one hundred billion shillings), and a funds transfer system is large once its transaction value exceeds that sum in a month. Because the obligations attach to a licensee “classified as” large, they follow the licence class, and an issuer whose trust balances are approaching the threshold should put its succession and audit arrangements in place before it is reclassified.
The legal footing, and the cost of a breach
The Guidelines state that they are issued under section 20 of the Act. Section 20 empowers Bank of Uganda to issue directives to licensees in respect of payment systems or payment instruments, having regard to conduct that compromises or is likely to compromise the safety and efficiency of a payment system, to the public interest or to any other matter it considers appropriate; the Bank’s general power to issue guidelines is in section 4(2)(f). The choice of section 20 has two consequences a licensee should weigh. A licensee that fails to comply with a section 20 directive pays a civil penalty of one hundred currency points, UGX 2,000,000/= (two million shillings), for each day the contravention continues, and after thirty days must show cause why its licence should not be revoked (section 20(7)). Section 20(5) provides that a directive shall not have retrospective effect, which bears on whether service before 01 July 2027 counts towards the nine-year limit on independence and on whether directors and executives lawfully in office on 30 June 2027 must be displaced the next day. Whatever their footing, failure to adhere to the Bank’s directives or guidelines is a ground for suspending or revoking a licence (section 13(1)(b)), and the Bank may direct the removal of the directors and senior management of a payment service provider whose affairs are conducted to the detriment of the payment system (section 12(2)(a)). The governance of banks and of microfinance deposit-taking institutions is prescribed by regulations made in 2024; for payment licensees the Bank has chosen guidelines, whose force rests on these sanctions.
The board
An electronic money issuer must have between five and seven directors, and every other licensee between three and five (guideline 5(e)). At least one third must be independent non-executive directors, and the chairperson must be one of them (guideline 5(l)); the fraction rounds up, so a board of four or five needs two independent directors and an electronic money issuer with seven directors needs three. An independent director serves terms of up to three years, renewable twice, and once service exceeds nine years is deemed to have lost independence and may chair neither the board nor a committee (guideline 5(n) and (o)). Independence turns on the absence of any material relationship with the licensee, its shareholders or its affiliates that could interfere with independent judgment; the definition’s second limb disqualifies a person who has done business with the licensee in the previous two years only where the terms were more favourable than other customers receive, so an adviser or supplier engaged on ordinary terms is caught, if at all, by the material-relationship test, which boards should apply strictly. The board meets at least once a quarter, keeps its minutes in English, maintains a skills and competency matrix that drives nominations and staggered tenure, and must be resourced for its directors’ training (guideline 5).
Guideline 5(a) sets out what the board answers for: among other duties it sets the licensee’s risk appetite, with cyber security, money laundering and terrorist financing named; it appraises the chief executive and keeps a succession plan for the role; and it must inform Bank of Uganda when there is sufficient reason to believe the licensee is likely to be unable to meet its obligations or to continue as a going concern. That duty is triggered well before the two-hour notice that section 30 of the Act requires of a participant against whom insolvency proceedings are commenced, and a board that has not minuted its own periodic assessment of solvency and liquidity will have difficulty showing that it discharged the duty.
Every director is appointed by the shareholders and approved by Bank of Uganda, and guideline 5(c) allows a director to assume office in an interim capacity until vetted and approved, with a decision due within sixty days of a complete application (guideline 5(d)). That concession sits uneasily with regulation 9 of the Regulations, which requires a licensee to apply for the Bank’s approval of a change of director, manager, trustee or substantial shareholder before effecting the change. A guideline cannot relax a statutory instrument, and the safer course is to treat regulation 9 as governing: the shareholders resolve the appointment conditionally, the application is filed, and the nominee takes no part in board decisions until approval issues. If a nominee does sit in the interim and approval is refused, section 187 of the Companies Act, Cap. 106, saves the acts of a director notwithstanding a defect afterwards discovered in the appointment, but whether a refusal is a defect in the appointment or shows that there was no effective appointment at all is open, and the saving gives the directors themselves the least protection, so any resolution that depended on the interim director for its quorum or its majority should be ratified once the board is properly constituted. Neither the Act, the Regulations nor the Guidelines attach any consequence to the lapse of sixty days without a decision; the Act gives a right of appeal to the High Court only against the refusal, suspension or revocation of a licence (sections 9(8) and 13(2)), which leaves judicial review as the route against a refusal to approve a director; and foreign nominees face due diligence of no stated duration, so their applications should be started first.
Who may sit where
Guideline 5(p) is the rule most founder-led payment businesses will feel: a shareholder may be a director or a member of senior management, and may not be both. Read with the definition of an executive director as a senior manager who also sits on the board, the rule forbids a shareholder to be an executive director, so a founder who holds shares may remain chief executive off the board or sit on the board as a non-executive director and leave management. Its reach is open on three points, the first of which is the word “shareholders”, used unqualified where the Regulations define a substantial shareholder at five per cent and name beneficial owners expressly when they mean to reach them, so that on its words the rule catches an executive holding a single share, or shares acquired on exercising options under an employee share plan. Second, on the same words a founder who holds through an offshore parent is not a shareholder of the Ugandan licensee at all; Bank of Uganda, which receives the beneficial ownership of every licensee with its licence application, may read the rule purposively, and a structure that depends on the literal reading should be cleared with the Bank in advance. Third, senior management is undefined in the Guidelines, while the Regulations define a manager as an officer of at least the rank of head of department, and until the Bank says which it means, a shareholder who heads any department and sits on the board is exposed.
Related parties may make up no more than one third of the board or of senior management, only one related party may hold the office of chief executive or executive director, and a written declaration of related-party relationships goes to Bank of Uganda with the vetting papers and is updated on any material change (guideline 5(t) to (v)). The definition does not say to whom a related party is related. Read in the accounting sense, as related to the licensee, it would make every director a related party, since a directorship is one of the listed connections, and the one-third cap could never be met; the cap works only if it measures connections among the directors and managers themselves. Even on that reading it is wide: two independent directors who sit together on another company’s board are connected through directorships, and in a market with a small pool of qualified independent directors a board of three can breach the cap by appointing two of them. The declaration should therefore list every shared directorship and shareholding among the board and senior management, as well as family ties. In an e-money issuer a director may not also be a trustee, and a move between the two offices, like the move of an executive or non-executive director to an independent seat, needs a cooling-off period of two years (guideline 5(q) and (s)); the independence cooling-off does not apply to a person who has worked for less than a year, and since the definition of independence names no look-back for past employment, the only checks on an executive of eleven months moving straight to an independent seat are the material-relationship test and the Bank’s vetting.
The committees, and the arithmetic
Guideline 7 requires at least three board committees, naming “the audit, risk and compliance and the strategy, innovations and technology committees”. The phrase could be read as one audit, risk and compliance committee and one strategy committee, leaving the third to the licensee, but guideline 7(b) speaks of the audit, risk and compliance committees in the plural, and the better reading names three: audit; risk and compliance; and strategy, innovations and technology. Each is chaired by a non-executive director, the board chairperson may chair none of them, and the audit and the risk and compliance committees must be chaired by an independent director. Since the chairperson is an independent director barred from every committee chair, a second independent director is needed to chair the audit and the risk and compliance committees; nothing in the Guidelines prevents one director from chairing both, so two independent directors satisfy the text, and a licensee that wants separate chairs for audit and for risk, the more defensible arrangement and one Bank of Uganda may expect, needs three. The one-third rule therefore understates the requirement for the smallest boards: a board of three, which guideline 5(e) treats as compliant with one independent director, needs two.
Combining committees under guideline 7(i) does not ease this, because the combined committee must still be chaired by an independent director other than the board chairperson, and because guideline 7(a) makes its floor of three committees subject to the proportionality provision in guideline 5(f) alone, so a licensee that merges audit with risk must constitute another committee, such as nominations and remuneration, to keep the count at three. Under guideline 5(f) Bank of Uganda may revise the required numbers of directors, independent directors and committees for a smaller licensee, but the provision sets no procedure and no timetable and does not on its face relax the rules on who may chair; a request for relief should therefore seek both the reduced numbers and the committee structure the reduced numbers make workable, and should be made in writing well before 01 July 2027.
Management, control functions and disclosure
The chief executive, the executive directors and senior management are appointed by the board with Bank of Uganda’s approval, and the procedures for appointing, suspending and removing the chief executive must ensure that no shareholder, director or manager can act unilaterally (guideline 9(a) and (c)). The second requirement reaches into shareholders’ agreements: an investor’s right to appoint or remove the chief executive, a common term in venture-backed payment businesses, is inconsistent with it and should be converted into a right to nominate for the board’s decision. The chief executive and the heads of finance and of risk and compliance must be based in Uganda unless the Bank agrees otherwise, which affects groups that run finance or compliance from a regional hub, and the head of finance must be a member of the Institute of Certified Public Accountants of Uganda (guideline 9(d) and (e)). The company secretary may be in-house or outsourced, may be combined with the head of legal, and reports directly to the board with an indirect line to the chief executive (guideline 8).
The licensee needs a risk and compliance function reporting to the board each quarter and to the chief executive day to day; an enterprise risk management framework approved by the board, stating the licensee’s risk appetite, risk tolerance and risk culture, and reviewed at least every three years or on a material change in its risk profile; and an internal audit function appointed on the audit committee’s advice and working to an annual risk-based plan covering governance, risk management, internal control and operational efficiency (guidelines 10 and 11). An outsourced internal auditor reports to the audit committee in every case, and the large classes need the Bank’s prior approval to outsource at all.
The licensee files an annual governance return with Bank of Uganda (guideline 13). Guideline 13(b) preserves the duty to notify material changes within the timelines prescribed under regulation 9 of the Regulations, but regulation 9 prescribes prior approval and no notification timeline, and a licensee that reports a change of director, manager, trustee or substantial shareholder after the event is in breach of it. The licensee must also keep a functional website publishing the profiles of its board and senior management, and is encouraged to report on environmental, social and governance matters (guidelines 14 and 15); the profiles are personal data under the Data Protection and Privacy Act, Cap. 97, so publication should be confined to what a profile requires, with each person’s written consent taken on appointment.
What the Guidelines leave unresolved
The Guidelines contain no transitional provision, and so do not say whether directors approved before 01 July 2027 must be vetted again, whether a shareholder serving as an executive director on that date must step aside at once, or whether years served before commencement count towards the nine-year limit on independence. Section 20(5) is a strong argument against the retrospective readings if the Guidelines are what they say they are, but the point is untested, and a licensee affected by it should obtain Bank of Uganda’s position in writing. The vacancy rule in guideline 5(r), which gives six months to nominate a replacement when a resignation takes the board below its minimum, is silent on a director removed under section 191 of the Companies Act or one who dies in office; a licensee in either position should notify the Bank at once and work to the same six months.
Before 01 July 2027
The work falls into an order, beginning with the board, which is measured against the composition rules on the footing that two independent directors are the floor for every licensee, because recruiting independent directors and obtaining Bank of Uganda’s approval of them takes the longest, and the sixty-day decision period runs only from a complete application. The shareholders who also hold executive office are identified, including those who hold through an employee share plan, and a decision taken on each. The shareholders’ agreement and the articles are reviewed for investor rights over the chief executive and for any power in the board to fill a casual vacancy, which guideline 5(c) does not accommodate because it requires every director to be appointed by the shareholders. The board charter is written or revised to cover the ten matters in guideline 6(b), with a charter for each committee, a working definition of senior management, the skills matrix and the related-party declarations. Requests for proportionality relief and for the Bank’s position on transition go in writing early, and the risk management framework, the internal audit plan and the website disclosures follow.
The firm advises payment service providers, payment system operators and e-money issuers on their licences under the Act and on the governance Bank of Uganda expects of them, and can review a licensee’s board, charters and control functions against the Guidelines, prepare the applications for Bank of Uganda’s approval of new directors, and put the open questions identified here to the Bank on a licensee’s behalf.