Opinion of the European Central Bank of 21 March 2018 on security and protection of critical infrastructures (CON/2018/15)

OPINION OF THE EUROPEAN CENTRAL BANK of 21 March 2018 on security and protection of critical infrastructures (CON/2018/15) Introduction and legal basis

On 21 February 2018 the European Central Bank (ECB) received a request from the Governor of the Nationale Bank van België/Banque Nationale de Belgique (NBB), acting on behalf of the Belgian Ministry of Finance, for an opinion on a draft law (hereinafter the ‘draft law’) amending the Law of 11 December 1998 on security classification, security clearance, security certificates and security advisory notices (the ‘Law of 11 December 1998 on security matters’ ) and on a draft Royal Decree appointing the administrative authorities as competent to implement the Law of 11 December 1998 on security matters (hereinafter the ‘draft Royal Decree’ and together with the draft law, the ‘draft laws’). The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the Functioning of the European Union and the third, fifth and sixth indents of Article 2(1) of Council Decision 98/415/EC , as the draft laws relate to the NBB, payment and settlement systems and rules applicable to financial institutions insofar as they materially influence the stability of financial institutions and markets. In accordance with the first sentence of Article 17.5 of the Rules of Procedure of the European Central Bank, the Governing Council has adopted this opinion.

1. Purpose of the draft laws

1.1 The main purpose of the draft laws is to complement the existing legal framework on the protection of the fundamental interests of the Belgian State, including, inter alia, the internal and external security of the State and the integrity of the State’s territory, in the light of growing terrorist threats. 1.2 Although the Law of 3 May 2005 had already amended the Law of 11 December 1998 on security matters with a view to creating a clearer and more comprehensive legal basis for the Belgian National Security Authority to conduct security checks of specific natural persons, this framework has proven inadequate to deal with the growing number of requests for security checks. 1.3 In order to improve the balance between the respect for the privacy of natural persons subject to security checks and the efficiency of these measures, the draft law provides for the designation of administrative authorities which will act as a liaison between the National Security Authority and the

various sectors of activities falling within the scope of the Law of 11 December 1998 on security matters and deemed necessary for the protection of the fundamental interests of the State. 1.4 The draft Royal Decree designates the NBB as the administrative authority for critical financial infrastructures. The NBB has already been designated as the competent authority for critical financial infrastructures under the Law of 1 July 2011 on the security and protection of critical infrastructures . 1.5 The draft law requires the appointment of security officers within the administrative authorities as well as within all public and private legal entities falling within the relevant sectors. The draft law outlines the procedures which will take place between the National Security Authority, the competent administrative authorities and the legal entities within the relevant sectors, through their respective security officers. Upon request by the competent administrative authorities, the relevant legal entities will perform a preliminary risk analysis in order to assess whether the exercise of a profession, function, mission or mandate, the access to premises, buildings, sites or the holding of a permit, license or authorisation may, through inappropriate use, undermine any of the fundamental interests of the Belgian State. Based on this preliminary risk analysis, the competent administrative authority conducts an impact analysis mapping out the effect of potential damages to the fundamental interests of the Belgian State. Depending on the results of the impact analysis, the competent administrative authority may propose to the National Security Authority that individual security checks be conducted with regard to the exercise of a profession, function, mission or mandate, access to premises, buildings or sites or the holding of a permit, license or authorisation. If the National Security Authority approves the request, it will conduct itself the security checks of specific individuals involved in the exercise of the relevant profession, function, mission, mandate, the access to premises, buildings, sites or the holding of a permit, license or authorisation. Some of the information gathered as a result of the above-mentioned security checks is available only to the security officers of the administrative authorities and the relevant legal entities, and may be used only in the specific context of the draft law. The draft law provides that the costs incurred as a result of the security check, which are currently borne by the individual persons subject to check, will be paid by the legal entity which employs the relevant individual.

2. General observations

2.1 The ECB supports the basic purpose of the draft laws to ensure national security in the light of the growing threat of terrorism, including to critical financial infrastructures. In particular, the ECB welcomes that the draft laws strengthen the protection of critical financial infrastructures at a time when terrorism has become a serious threat to the stability of the financial system. 2.2 The ECB has laid down oversight requirements for systemically important payment systems (SIPS) pursuant to Regulation (EU) No 795/2014 of the European Central Bank (ECB/2014/28) , which addresses operational risk, requiring SIPS operators to establish, inter alia, (i) comprehensive physical and information security policies that adequately identify, assess and manage all potential

vulnerabilities and threats and (ii) a business continuity plan that addresses events posing a significant risk of disrupting the SIPS’ operations, including the use of a secondary site, and a design that ensures that critical information technology systems can resume operations within two hours of those events . In organising the conduct of security checks for employees of legal entities operating critical financial infrastructures, the draft laws touch upon matters of national security going beyond the ECB’s oversight requirements. 2.3 The tasks conferred upon the NBB by the draft laws appear to naturally complement the NBB’s existing tasks with regard to the security of critical financial infrastructures, which are carried out by the NBB in its capacity as competent authority pursuant to the Law of 1 July 2011 on the security and protection of critical infrastructures. As the draft laws do not, therefore, confer genuinely new tasks on the NBB, the issue of assessing the conferral of new tasks on a national central bank from the perspective of the prohibition of monetary financing does not arise in the case at hand.

3. Specific comments

3.1 The ECB understands that in appointing the NBB as the competent administrative authority for critical financial infrastructures, the draft laws enable the NBB, subject to the approval of the National Security Authority, to set in motion the performance of security checks intended to assess the potential risks associated with individuals working for private and public legal entities that operate critical financial infrastructures. As a liaison between the National Security Authority and the security officer for the relevant legal entity, the NBB’s security officer will, for the strict purpose of organising the security verification, have access to classified information which would otherwise be unavailable. 3.2 The tasks of the NBB are limited to (i) the performance of part of the preliminary risk analysis; (ii) where appropriate, the submission of a proposal to the National Security Authority for the conduct of security checks with regard to the exercise of a profession, function, mission, mandate, access to premises, buildings, sites, or the holding of a permit, license or authorisation; and (iii) acting as a liaison between the relevant legal entity and the National Security Authority. Furthermore, pursuant to Article 9 of the draft law, the costs incurred in relation to the security checks will ultimately be borne by the legal entity employing the individuals subject to the checks. Finally, given that this new function will be exercised with respect to financial institutions that are already subject to the supervisory and oversight powers of the NBB, the corresponding expenses are expected to be marginal and to be reimbursed in full by the supervised institutions as provided for in the first and second paragraphs of Article 12 of the Royal Decree of 17 July 2012, as amended by the Royal Decree of 5 July 2015, on the coverage of the NBB’s functioning costs derived from the control of

financial institutions . Consequently, the draft laws would not have an impact on the financial

independence of the NBB.

This opinion will be published on the ECB’s website.

Done at Frankfurt am Main, 21 March 2018.

[signed]

The President of the ECB

Mario DRAGHI