Opinion of the European Central Bank of 27 April 2018 on the identification and supervision of critical infrastructure for the purpose of information technology security (CON/2018/22)

OPINION OF THE EUROPEAN CENTRAL BANK of 27 April 2018 on the identification and supervision of critical infrastructure for the purpose of information technology security (CON/2018/22) Introduction and legal basis

On 5 April 2018 the European Central Bank (ECB) received a request from the Estonian Minister for Entrepreneurship and Information Technology for an opinion on a draft law on cyber security implementing Directive (EU) 2016/1148 of the Parliament and of the Council (hereinafter the ‘draft law’). The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the Functioning of the European Union and the second, third, fifth and sixth indents of Article 2(1) of Council Decision 98/415/EC , as the draft law relates to means of payment, Eesti Pank, payment and settlement systems, rules applicable to financial institutions insofar as they materially influence the stability of financial institutions and markets and the ECB’s tasks concerning the prudential supervision of credit institutions pursuant to Article 127(6) of the Treaty. In accordance with the first sentence of Article 17.5 of the Rules of Procedure of the European Central Bank, the Governing Council has adopted this opinion.

1. Purpose of the draft law

1.1 The purpose of the draft law is to identify critical infrastructures and their operators and to stipulate the obligations of such operators to take appropriate organisational, physical and information security measures prior to, during and after a cyber incident to protect infrastructure-related information technology (IT) systems and to report severe IT incidents to the Riigi Infosusteemi Amet (RIA, Republic of Estonia Information System Authority). In addition, the RIA is obliged to take measures to prevent and resolve cyber incidents and to maintain a register of cyber incidents. 1.2 The draft law empowers the RIA to supervise and enforce compliance with the obligations specified in the draft law. The draft law, in conjunction with the Law on law enforcement , gives the RIA the authority to question a person and request information and/or originals (or copies) of documents; summon a person to the RIA’s offices and require a person’s presence during procedural acts; take steps to establish a person’s identity; examine movable assets, e.g. in the current case servers or

other technical equipment; enter into and examine premises . In addition the RIA has the authority

to put into storage a movable asset (e.g. servers or other technical equipment). Under the draft

law, the RIA is also authorised, in the event of a cyber incident or upon exercise of administrative

supervision, as an ultima ratio measure, to restrict the use of or access to the system if: (a) a cyber

incident poses a risk to or damages the security of another system; (b) the system operator cannot

avert the higher risk or eliminate the violation itself or cannot do it at the right time; (c) no less

intrusive measures are available; and (d) the planned measure will not cause disproportionate

damage . Lastly, the RIA is also the body conducting extrajudicial misdemeanour proceedings in

relation to a breach of the draft law .

1.3 The draft law defines the service providers to whom it applies and includes in this respect a cross-

reference to the Law on emergency . In particular, the draft law specifies that the providers of vital

services, as specified in the Law on emergency, are subject to the draft law. The Law on

emergency, in turn, lists cash circulation and payment services as vital services . The power to

designate the providers of vital services in cash circulation and payment services is delegated to

Eesti Pank . Under the Law on credit institutions, Eesti Pank may only designate credit institutions

or Estonian branches of credit institutions as providers of vital services . Eesti Pank has

designated AS SEB Pank, Swedbank AS and Luminor Bank AS as providers of vital services in

cash circulation and payment services . The draft law obliges providers of vital services to take

measures to prevent and resolve cyber incidents and report to the RIA serious cyber incidents.

1.4 According to the draft law, if the requirements for running the network or information system are

regulated by an international treaty or by another law, then the draft law shall be applied with the

specifications arising from the international treaty or from another law.

2. General observations

2.1 The draft law implements Directive (EU) 2016/1148 in relation to which the ECB has issued two opinions . According to Article 3 of Directive (EU) 2016/1148, Directive (EU) 2016/1148 is a minimum harmonisation directive, meaning that Member States may adopt or maintain provisions with a view to achieving a higher level of security of network and information systems than provided for under the directive. The ECB notes in this regard that, in a number of respects, the draft law goes further than provided for under Directive (EU) 2016/1148. 2.2 In previous opinions , the ECB has supported the aim of Directive (EU) 2016/1148 to ensure a high common level of network and information security (NIS) across the Union and to achieve a consistency of approach in this field across business sectors and Member States. It is important to ensure that the internal market is a safe place to do business and that all Member States have a certain minimum level of preparedness for cyber-security incidents. 2.3 The ECB has also previously called for establishing effective cooperation and information-sharing arrangements between the competent national authorities, including the RIA, and the other competent national authorities, including Eesti Pank, the Finantsinspektsioon (the Estonian Financial Supervision Authority) and, through Eesti Pank and the Finantsinspektsioon, the ECB. 2.4 According to the draft law, if the providers of vital services use third-party service providers for the provision of vital services, then providers of vital services must ensure that such third-party service providers comply with specific elements of the draft law . It is the understanding of the ECB that based on this, the requirements under the draft law for running a network or information system could also become indirectly applicable to payments system operators and critical service providers and that the providers of vital services using payment systems or critical service providers for the provision of cash circulation and payment services could be required to ensure that such third-party operators comply with any supervisory orders from the RIA.

3. Impact of the draft law on payment and securities settlement systems

3.1 Impact of the draft law on systemically important payments systems (SIPS) 3.1.1 While the draft law seeks to enhance the overall resilience of critical infrastructures by identifying infrastructures that have key functions for society, providing rules for such infrastructure providers and ensuring supervision over and enforcement of the said rules, it should be ensured that the provisions of the draft law do not encroach on the Eurosystem’s competences. This could be achieved by explicitly exempting payment systems overseen and/or operated by the Eurosystem (including Eesti Pank) from the scope of application of the draft law, as these are subject to comparable or more stringent requirements. Essentially, it must be ensured that implementation of the draft law’s requirements does not conflict with Regulation (EU) No 795/2014 of the European

as the ECB understands that LVPS are not covered by the draft law . 3.2.2 Under the revised oversight framework for retail payment systems non-SIRPS have been divided into two distinct groups: prominently important retail payments systems (PIRPS) and other important retail payments systems (ORPS). The Estonian local clearing system for card payments has been classified as a PIRPS . 3.2.3 Under the above referenced oversight framework, non-SIRPS must follow the Principles for financial market infrastructures (PFMIs) of the Committee on Payment and Settlement Systems (CPSS) of the Bank for International Settlements and the Technical Committee of the International Organization of Securities Commissions (IOSCO) and the oversight expectations for links between retail payment systems (OELRPS) . Both the CPSS-IOSCO PFMIs and the OELRPS are soft law instruments, meaning that PIRPS and ORPS are subject to oversight standards, but there is, strictly speaking, no Union regulation or legislation regulating the oversight or supervision of these systems . The possibility cannot therefore be excluded that the draft law and the supervisory powers of the RIA thereunder could cover (indirectly through credit institutions designated as vital service providers) non-SIRPS, such as the Estonian local clearing system for card payments, as the CPSS-IOSCO PFMIs and OELRPS would not be considered a law or international treaty within the meaning of the draft law. 3.2.4 The revised oversight framework for retail payment systems specifies that all retail payment systems are an integral part of the payment and settlement landscape of the euro area and thus fall within the scope of oversight. Hence, the Eurosystem has an interest in ensuring that the oversight framework and standards applicable to such systems would not be prejudiced through the implementation of Directive (EU) 2016/1148 or when introducing other NIS-related laws or regulations. If the Estonian authorities wish to exclude non-SIRPS from the scope of application of the draft law, then this could be done expressly. If the Estonian authorities consider it necessary to include the non-SIRPS within the (indirect) scope of application of the draft law, then the ECB suggests that effective information-sharing and cooperation arrangements should be put in place(as specified below in Section 6) to ensure that the RIA shares information about actual and potential cyber incidents affecting non-SIRPS with Eesti Pank in a timely and efficient manner in order to enable the Eesti Pank to fulfil the tasks assigned to them under the Treaty and applicable Estonian law. It would, in any case, be advisable to clarify the exact scope of application of the draft law in relation to non-SIRPS to avoid potential confusion on the applicable standards and powers of the relevant authorities.

3.3 Critical service providers 3.3.1 The revised Eurosystem oversight policy framework covers critical service providers (CSPs). Similar to the case of non-SIPS, the possibility cannot be excluded that the draft law and the supervisory powers of the RIA thereunder could cover (indirectly through credit institutions designated as vital service providers) critical service providers for which the above applicable oversight frameworks would not be considered a law or international treaty within the meaning of the draft law. In light thereof, it is suggested that the Estonian authorities take existing oversight arrangements into consideration in the application of the draft law to providers of vital services. 3.4 Impact of the draft law on payment services and payment instruments and schemes 3.4.1 Directive (EU) 2015/2366 of the European Parliament and of the Council , as implemented into national law, regulates payment services. Even though Directive (EU) 2015/2366 includes provisions on the management of operational risk, which have also been transposed into Estonian law, this directive and applicable national law do not directly prevent any other laws from being, at least partially, applicable. Hence, the ECB understands that the draft law is still partially applicable to such services, and that this also extends the supervisory powers of the RIA. 3.4.2 The revised Eurosystem oversight policy framework identifies payment instruments, such as payment cards, credit transfers, direct debits and e-money, as an ‘integral part of payment systems’, and thus includes these within the scope of its central bank oversight. For payment instruments, the role of primary overseer for the Eurosystem is assigned by reference to the national anchor of the payment scheme and the legal incorporation of its governance authority. For credit transfer and direct debit schemes within the Single Euro Payments Area, as well as some of the international card payment schemes, the ECB has the primary oversight role . 3.4.3 If the Estonian authorities wish to exclude payment schemes and instruments from the direct and indirect scope of application of the draft law, this could be done expressly. If the Estonian authorities consider it necessary to include various payment schemes and instruments within the direct and/or indirect scope of application of the draft law, then the ECB suggests that an effective information sharing and cooperation framework should be put in place (as specified below in Section 6) to ensure that the RIA shares information about actual and potential cyber incidents affecting card schemes and other payment instruments with the Eesti Pank in a timely and efficient manner in order to enable Eesti Pank to fulfil the tasks assigned to them under the Treaty and applicable Estonian law. It would, in any case, be advisable to clarify the exact scope of application of the draft law and the supervisory powers of the RIA in relation to payment instruments to avoid potential confusion on the applicable standards and powers of the relevant authorities.

3.5 Impact of the draft law on securities settlement systems The ECB understands that the draft law does not apply to securities settlement systems or to TARGET2-securities.

4. Impact of the draft law on the prudential supervision of credit institutions

4.1 Council Regulation (EU) No 1024/2013 confers tasks on the ECB concerning the prudential supervision of credit institutions with a view to contributing to their safety and soundness and in order to protect the stability of the financial system of the Union and each Member State. The ECB is responsible for the effective and consistent functioning of the single supervisory mechanism (SSM) and exercises oversight over the system’s functioning, based on the distribution of responsibilities between the ECB and national competent authorities (NCAs), including the Finantsinspektsioon in Estonia. In particular, the ECB carries out its task to authorise and withdraw the authorisations of all credit institutions. For significant credit institutions the ECB also has the task, among others, to ensure compliance with the relevant Union law acts which impose prudential requirements on credit institutions, including the requirement to have in place robust governance arrangements, including sound risk management processes and internal control mechanisms . To this end, the ECB shall be given all supervisory powers to intervene in the activity of credit institutions that are necessary for the exercise of its functions . 4.2 All Estonian credit institutions that would fall within the scope of the draft law upon its enactment are significant credit institutions subject to ECB prudential supervision . Nonetheless, the application of the draft law to non-significant credit institutions thereafter cannot be excluded. 4.3 The prudential supervision of credit institutions also covers NIS-related topics as part of the prudential supervision of operational risk, meaning the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events . Since the assessment of the adequacy of the internal governance arrangements of credit institutions is one of the core competences of prudential supervisors, the requirements under the draft law should not interfere with the tasks of prudential supervisors . In this respect, the ECB has the power, inter alia, to

restrict or limit the business, operations or network of institutions or to request the divestment of activities that pose excessive risks to the soundness of an institution . 4.4 It is acknowledged that the tasks of the ECB and the Finantsinspektsioon as prudential supervisors are in a number of critical respects distinct from the tasks and authorities of computer security incident response teams (CSIRTs). Nevertheless, there is an overlap where the actions of a CSIRT, such as the RIA in Estonia, can affect the prudential supervision of credit institutions under relevant Union and Estonian laws. 4.5 This would be most evident should the RIA choose, when potentially using its ultima ratio authorities under the draft law, to restrict the use of a system. If the RIA uses its authority to restrict the use of an information system used by a significant credit institution for the provision of payment services, then this could significantly impact the continuous operation and financial standing of the credit institution. Additionally, informing the affected persons or the general public about cyber incidents, as anticipated in the draft law , may have an impact on public confidence in the affected credit institution. The ECB and the NCAs within the SSM are responsible for the assessment of recovery plans and taking early intervention measures under Directive 2014/59/EU of the European Parliament and of the Council (as implemented into national law). Further, the primary responsibility for determining that a significant credit institution is failing or likely to fail as a condition to the resolution of a credit institution lies with the ECB . In the case of resolution, one of the resolution objectives is to ensure the continuity of critical functions , which can include the continuing functioning of the credit institution’s payment and cash circulation systems. 4.6 To enable the ECB and the Finantsinspektsioon to fulfil the tasks assigned to them within the SSM, the ECB suggests explicitly clarifying the scope of the draft law and any powers granted to the RIA in this respect. The ECB also suggests clarifying that the scope of the draft law and any powers granted to the RIA thereunder are without prejudice to the tasks and powers of the ECB and the Finantsinspektsioon under Council Regulation (EU) No 1024/2013 and applicable Estonian law. The ECB also recommends that an effective framework should be put in place (as specified in Section 6 below) to ensure that the RIA shares information about actual and potential cyber incidents affecting significant supervised entities, as well as measures planned or adopted by the RIA. Where relevant, the RIA should share information with the Finantsinspektsioon and, through the Finantsinspektsioon, with the ECB in a timely and efficient manner. The Estonian legislator may also wish to consider the interaction of the RIA’s powers under the draft law with the resolutionrelated procedures and powers of the relevant authorities.

5. Impact of the draft law on cash circulation

5.1 Under Article 128(1) of the Treaty, the ECB has the exclusive right to authorise the issue of euro banknotes within the Union. The ECB, together with the national central banks, may issue such notes. The euro banknotes issued are the only such notes to have the status of legal tender within the Union. Under Council Regulation (EC) No 1338/2001 credit institutions and other cash handlers are obliged to ensure that euro notes which they have received and which they intend to put back into circulation are checked for authenticity and that counterfeits are detected in line with procedures defined by the ECB. Eurosystem national central banks, including Eesti Pank, play an important role in these procedures . From a practical perspective, the interest of the ECB and the Eurosystem encompasses the adequate NIS protection of the systems ensuring the circulation of euro banknotes, such as automated teller machine (ATM) networks and cash circulation support networks, in view of the further increasing automation of the cash supply infrastructure. This trend not only concerns the banking sector and the cash-handling industry, but is also becoming a more pronounced trend in the retail sector. 5.2 Therefore, the ECB suggests that an effective information-sharing and cooperation framework should be put in place (as specified below in Section 6) to ensure that the RIA shares information about actual and potential cyber incidents affecting ATM and cash circulation support networks with Eesti Pank. Additionally, the RIA should, through Eesti Pank, share information with the ECB in a timely and efficient manner in order to enable the ECB and Eesti Pank to fulfil the tasks assigned to them under the Treaty and applicable Estonian law.

6. Conclusion

6.1 To sum up, the ECB suggests that the Estonian legislator explicitly clarifies that the draft law, including the tasks and powers of the RIA, should be without prejudice to the tasks and powers of the ECB under Regulation (EU) No 795/2014 and to the tasks and powers of the ECB and the Finantsinspektsioon under Council Regulation (EU) No 1024/2013 and applicable Estonian law. 6.2 Arrangements should be put in place to ensure that the RIA shares information about actual and potential cyber incidents, as well as measures planned or adopted by the RIA where relevant, which affect significant credit institutions, non-SIPS, CSPs, payment services and instruments/schemes, ATM and cash circulation support networks with Eesti Pank, and the Finantsinspektsioon. Additionally, the ECB suggests ensuring that the RIA shares this information, through Eesti Pank and the Finantsinspektsioon, with the ECB in a timely and efficient manner, within the framework of their respective responsibilities for the oversight of payment systems, the prudential supervision of credit institutions and the authorisation of the issuance of euro banknotes.

6.3 For its part, the ECB stands ready, within the framework of its responsibilities for the oversight of payment systems, the prudential supervision of credit institutions and the issuance and circulation of euro banknotes, to cooperate in ensuring that best practices with regard to NIS are established and followed. This opinion will be published on the ECB’s website. Done at Frankfurt am Main, 27 April 2018. [signed]

The President of the ECB

Mario DRAGHI