Opinion of the European Central Bank of 14 August 2017 on an Act on critical infrastructure (CON/2017/31)

OPINION OF THE EUROPEAN CENTRAL BANK of 14 August 2017 on an Act on critical infrastructure (CON/2017/31) Introduction and legal basis

On 4 July 2017 the European Central Bank (ECB) received a request from the Slovenian Ministry of Defence for an opinion on a draft Act on critical infrastructure (hereinafter the ‘draft law’). The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the Functioning of the European Union and the third and fifth indents of Article 2(1) of Council Decision 98/415/EC as the draft law relates to Banka Slovenije and payment and settlement systems. In accordance with the first sentence of Article 17.5 of the Rules of Procedure of the European Central Bank, the Governing Council has adopted this opinion.

1. Purpose of the draft law

1.1 The purpose of the draft law is to systemically regulate the protection of critical infrastructures of national importance to the Republic of Slovenia. Pursuant to the draft law European critical infrastructures in the territory of the Republic of Slovenia are also considered to be critical infrastructures of the Republic of Slovenia. However legislation and regulations regulating European critical infrastructures apply for the protection of these infrastructures. The draft law defines critical infrastructures and their owners/operators, and sets out measures and activities for the protection of critical infrastructures, as well as reporting and other tasks of the competent authorities with respect to their protection. 1.2 The draft law identifies Banka Slovenije as a potential owner/operator of a critical infrastructure and a (financial) critical infrastructure sector holder. It also identifies the financial sector as one of the sectors of critical infrastructures, without further specification. It is envisaged that each sector will have an identified holder that will be designated by the Slovenian Government. The criteria for the identification of a critical infrastructure are sectoral and cross-cutting and will be adopted by the Slovenian Government. The Slovenian Government will also designate critical infrastructures and operators of critical infrastructures. 1.3 Operators of critical infrastructures have the following responsibilities: (1) to draw up, regularly update (at least once a year or in the case of new relevant developments within one month of such events) and retain operator security plans, which include a risk assessment and measures for the protection of critical infrastructures; (2) to obtain the consent of the critical infrastructure sector holder to the operator security plans; (3) to present to the critical sector infrastructure holder and

the Ministry of Defence, at their request, operator security plans; and (4) to inform the critical infrastructure sector holder and the National Centre for Crisis Management as soon as possible about a break of functioning of a critical infrastructure, if the operator deems that that break may have negative material or other consequences on the functioning of the critical infrastructure sector and previously implemented measures for the protection of critical infrastructures. The role of an operator of a critical infrastructure is to provide uninterrupted continuity of services of the critical infrastructure. 1.4 Critical infrastructure sector holders have an advisory role in relation to the identification of a critical infrastructure, a coordinating role in relation to the adoption of proposals for measures for the protection of a critical infrastructure, and a role to provide assistance to the operators of critical infrastructures and to prepare and amend legislation dealing with critical infrastructures within their competence from the perspective of the protection of critical infrastructures. Once a year a competent critical infrastructure holder has to prepare a report on the provision of the uninterrupted functioning of the critical infrastructure for its sector based on annual reports prepared by the operators, which is then included in a joint report prepared by the Ministry of Defence and delivered to the Government by May of each year in respect of the previous year. 1.5 The draft law explicitly states that it does not apply to critical infrastructures operated by the European System of Central Banks (ESCB) or critical infrastructures operated by Banka Slovenije which are supervised by the ESCB. 1.6 The draft law provides that it does not encroach on the supervision of a critical infrastructure falling within the competence of Banka Slovenije or the ESCB governed by European Union legislation and regulations or legislation of the Republic of Slovenia adopted on the basis of such legislation and regulations. 1.7 The draft law provides that the authorized bodies pursuant to the draft law may only with the consent of Banka Slovenije adopt decisions relating to any critical infrastructure of Banka Slovenije which is not operated by the ESCB nor by Banka Slovenije under the supervision of the ESCB, but which is used by Banka Slovenije for the discharge of its duties pursuant to the Bank of Slovenia Act, the Statute of the European System of Central Banks and of the European Central Bank (the ‘Statute of the ESCB’) or Union legislation or regulations. 1.8 The draft law provides that data relating to the determination, establishment and protection of critical infrastructures designated as restricted or confidential must be treated as such in line with relevant applicable legislation. The draft law specifically provides that data available to Banka Slovenije which is held pursuant to the Bank of Slovenia Act, the Statute of the ESCB or other legislation and is designated as confidential may only be used in line with such legislation.

2. Observations

2.1 The ECB understands that the draft law does not purport to implement Directive (EU) 2016/1148 of the European Parliament and of the Council into Slovenian law.

2.2 The ECB understands that the term ‘supervision’ (Slovene: “nadzor”) as used in the draft law includes both ‘supervision’ and ‘oversight’. Under Slovenian law the term ‘supervision’ may be understood as referring to both the concepts of ‘supervision’ and ‘oversight’, as those terms are understood in, for example, the English language. 2.3 Critical infrastructures operated by ESCB central banks and critical infrastructures operated by Banka Slovenije which are supervised or overseen by ESCB central banks 2.3.1 The ECB understands that critical infrastructures operated by ESCB central banks and operated by Banka Slovenije which are supervised or overseen by ESCB central banks are exempted from the draft law’s scope of application. The ECB welcomes this, as it should help to ensure that Slovenian legislation on the protection of critical infrastructures does not encroach on the ESCB’s competences, consistent with the principle of the primacy of Union law and of central bank independence pursuant to Article 130 of the Treaty . 2.3.2 The ECB understands that, pursuant to the draft law, the Slovenian component of the TARGET2 payment system would be exempt from its scope of application. The TARGET2 payment system has been identified, pursuant to Decision ECB/2014/35 of the European Central Bank , as a systematically important payment system and is overseen by the ECB as competent authority under Regulation (EU) No 795/2014 of the European Central Bank (ECB/2014/28) . Banka Slovenije acts as the operator of the Slovenian component of the TARGET2 payment system. 2.3.3 The ECB understands that the TARGET2-Securities (T2S) services would be exempt from the scope of the draft law, since pursuant to Article 6 of the Guideline ECB/2012/13 of the European 6 7 Central Bank and Article 7 of the T2S Framework Agreement , T2S is operated by the ESCB. Furthermore, in line with the Governing Council’s decision in its Eurosystem Oversight Policy Framework of July 2016, T2S falls under Eurosystem oversight competences under Articles 127(2) of the Treaty and Articles 3(1) and 22 of the Statute of the ESCB . 2.3.4 The ECB understands that the issue of euro banknotes by Banka Slovenije and ESCB central banks, insofar as this might be considered as falling within the concept of a critical infrastructure under the draft law, would be exempt from the draft law’s scope of application, since the ECB has the exclusive right to authorise the issue of euro banknotes within the Union under Article 128(1) of the Treaty. 2.4 Impact of the draft law on supervision and oversight of critical infrastructures subject to supervision or oversight by Banka Slovenije or ESCB central banks pursuant to Union legislation or regulations

2.4.1 The draft law provides that it does not encroach on the supervision of critical infrastructures falling within the competence of Banka Slovenije or the ESCB governed by Union legislation or regulations or Slovenian legislation or regulations based on Union legislation. The ECB understands that this provision aims to ensure that the draft law does not encroach on the supervision or oversight of financial infrastructures which are not operated by Banka Slovenije or ESCB central banks, but which are subject to supervision or oversight by Banka Slovenije or ESCB central banks pursuant to Union legislation or regulations. In the interests of legal certainty, it may be useful to explicitly clarify in the draft law whether this provision is intended to entirely exclude such infrastructures from its scope of application, as is the case for critical infrastructures operated by ESCB central banks or operated by Banka Slovenije subject to the supervision or oversight of ESCB central banks. 2.4.2 The ECB understands that, based on this provision, the draft law would not encroach on the supervision or oversight of KDD, d.d., a central securities depository supervised by Banka Slovenije pursuant to Regulation (EU) No 648/2012 of the European Parliament and of the Council 10 11 and Regulation (EU) No 909/2014 of the European Parliament and of the Council . 2.4.3 The Eurosystem Oversight Policy Framework identifies payment instruments, such as cards, credit transfers, direct debit and e-money, as an ‘integral part of payment systems’, and thus includes these within the scope of its central bank oversight. For payment instruments, the role of primary overseer (for the Eurosystem) is assigned by reference to the national anchor of the payment scheme and the legal incorporation of its governance authority. For credit transfer and direct debit schemes within the Single Euro Payments Area, as well as some of the international card payment schemes, the ECB has the primary oversight role. Payment service providers (PSPs) are subject to Directive (EU) 2015/2366 of the European Parliament and of the Council, which is applicable as of January 2018 . While PSPs are therefore subject to Union legislation and Slovenian legislation and regulations based on Union legislation , the oversight of international and domestic card schemes are not subject to Union legislation and regulations as such. If it is intended that such schemes will be excluded from the scope of the draft law, it is suggested, in the interests of legal certainty, that the draft law should explicitly clarify that it does not encroach on the oversight of card schemes by Banka Slovenije or the ESCB that are subject to applicable oversight frameworks, guidelines and principles. 2.4.4 Prominently important retail payment systems (PIRPS) and other retail payment systems (ORPS) are subject to oversight standards but are not subject to Union legislation and regulations as such.

Oversight of both PIRPS and ORPS is conducted in accordance with the Eurosystem Revised Oversight Framework for retail payment systems subject to the Principles for financial market infrastructures published by the Committee on Payment and Market Infrastructures and the International Organization of Securities Commissions (IOSCO) , in particular Principle 17 on operational risk . There is however, strictly speaking, no Union regulation or legislation regulating the oversight or supervision of these systems. Banka Slovenije is given supervisory and oversight competence pursuant to the Payment Services and Systems Act (2009), which in this matter does not implement Union legislation or regulations. The ECB understands that in this particular case the PIRPS and ORPS would fall within the scope of the draft law, insofar as they would be considered as falling within the concept of a critical infrastructure under the draft law, as the term Union legislation and regulations would not seem to include ‘soft law’ instruments such as oversight frameworks, guidelines and principles. If it is intended that PIRPS and ORPS should be excluded from the scope of the draft law it is suggested, in the interests of legal certainty, that the draft law should explicitly clarify that it does not encroach on the oversight of critical infrastructures by Banka Slovenije or the ESCB that are subject to applicable oversight frameworks, guidelines or principles. 2.5 Other critical infrastructures of Banka Slovenije The draft law relates to any critical infrastructure of Banka Slovenije which is not operated by the ESCB, nor by Banka Slovenije under the supervision of the ESCB, but which infrastructure is used by Banka Slovenije for the discharge of its duties pursuant to the Bank of Slovenia Act, the Statute of the ESCB and the ECB or Union legislation or regulations. The ECB understands that examples of critical infrastructures that would fall within the scope of this provision would be the infrastructure for the issuing and supply of euro coins, with respect to which Banka Slovenije acts as distributor , and the maintenance of the treasury account system, with respect to which Banka Slovenije maintains the accounts of state bodies . However, before decisions can be adopted under the draft law relating to any such critical infrastructure of Banka Slovenije, the consent of Banka Slovenije is required which safeguards its institutional independence.

This opinion will be published on the ECB’s website.

Done at Frankfurt am Main, 14 August 2017

[signed]

The President of the ECB

Mario DRAGHI