Terms of Service

1. Regulatory Mandate and Scope

The Microfinance Industry Information System (MIIS) is operated by ARB Apex Bank PLC ("Apex Bank") pursuant to its statutory and regulatory mandate under the Banks and Specialised Deposit-Taking Institutions Act, 2016 (Act 930), the ARB Apex Bank Regulations, 2006 (L.I. 1825), the Payment Systems and Services Act, 2019 (Act 984), and delegated regulatory oversight functions exercised on behalf of the Bank of Ghana.

These Terms of Service govern the authorized access to and utilization of MIIS by participating institutions—including Rural and Community Banks (RCBs), Savings and Loans Companies, Microfinance Institutions, Credit Unions, and Financial NGOs—as well as their nominated personnel, management, and technical administrators.

2. Institutional Accession and Permitted Use

Access to MIIS is strictly restricted to institutions legally registered with the Bank of Ghana or recognized financial sub-sector regulatory bodies and affiliated with ARB Apex Bank PLC. Permitted uses include:

• Institutional registry management, branch profiles, and executive contact synchronization.
• Staff identity administration, employment verification, and role assignments.
• Application access request workflows for banking software catalogue systems (T24 Core Banking, GhanaPay, ACH/EFT, E-Zwich, SWIFT, CCC, and Apex Link).
• Curriculum enrollment and nomination for industry capacity-building training programmes.
• Fulfillment of statutory regulatory notices, security deactivation directives, and operational audits.

3. User Account Security and Credential Confidentiality

All users authenticated to MIIS must hold a distinct, personal credential. Account sharing, credential pooling, or automated proxy logins are strictly prohibited and constitute a material security violation under the Cyber Security Act, 2020 (Act 1038).

Users are solely responsible for all actions conducted under their credentials. In the event of suspected password compromise, token loss, or unauthorized access, the user and their designated Local Admin must immediately notify the ARB Apex Bank Customer Service Center (CSC) and initiate credential reset protocols.

4. Role-Based Governance and Dual-Authorization Controls

MIIS enforces strict segregation of duties between operational submission and management authorization. The system implements the following governance model:

Under no circumstances may a manager authorize submissions created by their own identity. Any attempts to bypass dual control will trigger automatic security audit events.

5. Mandatory Staff Exit Deactivation Obligations

In compliance with Bank of Ghana Cyber and Information Security Directives, participating institutions bear an affirmative statutory duty to immediately report personnel separations (Resignations, Retirements, Dismissals, or Suspensions) within MIIS.

Upon authorization of a separation status by the Local Manager, MIIS automatically generates high-priority credential revocation tasks assigned to all relevant Application Owners. Failure by an institution to report staff separation within twenty-four (24) hours will render the institution liable for any subsequent unauthorized transactions or system exposure.

6. Multi-Tenant Data Boundaries and Confidentiality

MIIS operates under rigorous institutional data isolation controls. A participating institution and its authorized representatives have access exclusively to their own institutional records, staff directories, and access records.

Attempts to probe, inspect, query, or tamper with cross-institution records or API endpoints are monitored in real time and will result in immediate credential revocation, regulatory referral to the Bank of Ghana, and criminal reporting under Act 1038.

7. Audit Logging, Non-Repudiation, and Monitoring

All interactions within MIIS—including logins, authentication failures, profile changes, approval actions, software access requests, and revocation completions—are recorded in immutable audit logs containing timestamps, user identifiers, IP addresses, and state diffs.

These audit records constitute binding legal records for prudential inspections, fraud investigations, and compliance certifications conducted by ARB Apex Bank, the Bank of Ghana, and law enforcement agencies. Audit logs are retained for a minimum statutory period of six (6) years.

8. Service Availability and Maintenance

ARB Apex Bank PLC strives to ensure continuous availability of MIIS, subject to scheduled maintenance windows and emergency security interventions. Scheduled maintenance notifications will be communicated via institutional portal banners. Apex Bank disclaims liability for indirect business disruptions resulting from telecommunication network outages outside its primary ICT infrastructure.

9. Sanctions, Suspension, and Termination

ARB Apex Bank reserves the right to suspend or terminate user accounts or institutional access in cases of:

• Material breach of these Terms of Service or regulatory directives.
• Failure to maintain current regulatory licenses or prudential standing with the Bank of Ghana.
• Repeated credential sharing, deliberate falsification of staff records, or obstruction of audit procedures.

10. Governing Law and Official Contact

These Terms of Service are governed by and construed in accordance with the laws of the Republic of Ghana. Inquiries, incident disclosures, or escalation notices regarding these terms should be addressed to: