Opinion of the European Central Bank of 26 October 2018 on the review of Finnish law concerning preparedness obligations applicable in the financial sector (CON/2018/46)

OPINION OF THE EUROPEAN CENTRAL BANK of 26 October 2018 on the review of Finnish law concerning preparedness obligations applicable in the financial sector (CON/2018/46) Introduction and legal basis

On 16 August 2018, the European Central Bank (ECB) received a request from the Finnish Ministry of Finance for an opinion on a proposal to further specify so-called preparedness obligations in the field of financial market services to ensure the uninterrupted availability of functions vital to society, including (1) 1 2 amendments to the Law on credit institutions , the Law on payment institutions , the Law on investment 3 4 funds , the Law on investment services , the Law on the book-entry system, clearing and settlement 5 6 operations , and the Law on trading in financial instruments ; (2) a draft law on a Joint Working Group for incident management in the financial market; and (3) a draft government decree to specify the functions and services the performance of which the addressees of the preparedness obligations shall ensure (hereinafter collectively referred to as the ‘proposal’). The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the Functioning of the European Union and the second, fifth and sixth indents of Article 2(1) of Council Decision 98/415/EC , as the proposal relates to means of payment, payment and settlement systems, rules applicable to financial institutions insofar as they materially influence the stability of financial institutions and markets and the ECB’s tasks concerning the prudential supervision of credit institutions pursuant to Article 127(6) of the Treaty. In accordance with the first sentence of Article 17.5 of the Rules of Procedure of the European Central Bank, the Governing Council has adopted this opinion.

1. Purpose of the proposal

1.1 The proposal elaborates on the existing preparedness obligations imposed on credit institutions, payment institutions, investment funds, investment service providers, the central securities depository, and the stock exchange (collectively referred to as ‘addressees’) under Finnish law. Credit and payment institutions, investment funds and investment service providers are already

obliged to ensure that they can perform tasks and provide services free of interruption, as far as possible, also in emergency situations, by participating in preparedness planning regarding financial markets and by planning contingency measures. The proposal requires these entities to ensure the performance of their tasks and the provision of their services, in particular by means of maintaining sufficient data systems and data repositories in Finland, and by other arrangements deemed sufficient for ensuring their uninterrupted operation in Finland. Regarding investment service providers, for which the preparedness obligation currently concerns only keeping custody of securities, the obligation would be extended to ensuring that the issue, trading, clearing and settlement of securities are also safeguarded. The stock exchange, which is currently required to ensure its functioning despite interferences and during peak times as well, is tasked with similar preparedness obligations as the other addressees. Regarding the central securities depository, only editorial amendments to the law are proposed (to align the current wording with the new wording of the preparedness obligations imposed on the other addressees) as, in substance, the existing preparedness obligations correspond to those in the proposal. 1.2 Regarding credit institutions, payment institutions and investment service providers, the proposal recommends a government decree to specify the functions and services of these entities the performance of which is to be ensured also in emergency situations. In respect of credit and payment institutions, these include: (1) services for making cash deposits into a payment account or cash withdrawals from a payment account as well as operations related to the provision and maintenance of a payment account; (2) the execution of a payment transaction, as an account transfer, involving the transfer of funds to the payment account of a payment service provider (PSP) as a direct debit, with a payment card or with another payment instrument; (3) the issuance of a payment instrument into circulation; (4) the approval and processing of a payment transaction based on a contract made with a payee, leading to funds being transferred to the payee; and (5) functions whereby an account transfer is made into a Finnish account located at another credit or payment institution and functions whereby an account transfer coming from such an account can be received. In respect of investment funds, these include the activities listed in Articles 53 and 54 of the Law on investment funds to ensure the maintenance of a fund unit register that would record basic information on the fund unit-holder, such as the number of units held, a breakdown of the different types of shares and series of shares and the date of registration of the fund unit, as well as to ensure that in the case of a new issuance the issue price will be paid within regular timeframes. The provision of a share certificate upon request of a fund unit-holder would also be available. In respect of investment service providers, these include: (1) the receipt and transmission of orders in relation to financial instruments; (2) the execution of orders in relation to financial instruments on behalf of clients; (3) the management of financial instruments on the basis of an agreement with the client whereby the decisive authority regarding investment is given wholly or partly to the investment service provider; (4) the organisation of the issue of financial instruments into circulation, or the sale thereof, by providing an associated subscription or purchasing commitment; (5) the organisation of the issue of financial instruments without subscription or purchasing commitment; (6) services linked to the guarantee of the issue of financial instruments; and (7) the storage and maintenance of financial instruments on behalf of the client. 1.3 The proposal also calls for a decree of the Ministry of Finance to be prepared to regulate the principles and arrangements involved in preparedness planning in the financial market. It is further

proposed that the Finnish Supervisory Authority (FSA) issues ordinances on the preparedness obligations, covering in particular: (1) the technical details of preparedness planning; (2) the documents related to preparedness planning; (3) the technical requirements for and general information on the use of the relevant systems and infrastructures; and (4) technical matters in respect of the abovementioned points. The proposal also contains sanctions for non-compliance with the preparedness obligations. 1.4 The proposal further provides for a draft law on a Joint Working Group, which would be established through a decision of the Ministry of Finance, to plan and coordinate preparedness measures in the financial market. The duties of this Joint Working Group would include: (1) planning and coordinating measures necessary for the management of both emergency circumstances and serious disruptive situations occurring under normal conditions; (2) acquiring and delivering information necessary for the management of disruptive situations, and serving as support for decision-making by public authorities; and (3) supporting the operators who are able to mitigate the negative effects of the disruptive situations on society, e.g. by conveying and analysing information on disruptive situations. The draft law on the Joint Working Group also contains related provisions on the processing of confidential information.

2. General observations

The ECB understands that the basic purpose of the draft law is to impose an obligation on the addressees to: (1) plan and prepare in advance measures that would be used in emergency situations and during serious disruptive situations occurring under normal conditions; and (2) to establish and maintain systems and infrastructures that are located in Finland, in order to ensure their uninterrupted functioning also in emergency situations, in addition to the existing European and international infrastructures. Against this backdrop, the ECB wishes to make a number of general observations on the proposal. 2.1 Consultation of European Commission on the proposal The ECB notes that it has previously issued opinions to the Finnish authorities on emergency powers legislation that applies in respect of the Finnish financial markets . Since the proposal affects Union law falling outside the competence of the ECB, in the areas of international and national security, and may affect the internal market for financial services, the Ministry of Finance may wish to consult the European Commission on the proposal if it has not already done so . For its part, the ECB would highlight that, in accordance with Article 4(3) of the Treaty on European Union, pursuant to the principle of sincere cooperation Member States are obliged to facilitate the achievement of the ECB’s tasks and refrain from taking any measures which could jeopardise the ECB’s or the ESCB’s objectives. This principle, similar to the views expressed in the ECB’s past opinions , should be noted in respect of the areas covered by this opinion. 2.2 Necessity and proportionality of the proposal

The ECB understands that most of the relevant infrastructures that are being used in Finland in the financial market sector are either European or global in nature. These infrastructures provide for contingency measures and fall back solutions that are not physically located in Finland. As contingency measures have already been put in place , the ECB would recommend that the Finnish authorities further consider the necessity and proportionality of the proposal in view of the high costs that, the ECB understands, will be caused by the establishment and maintenance of additional national infrastructures. 2.3 Impact of the proposal on TARGET2, Target2-Securities and ESCB infrastructures 2.3.1 The ECB understands that the proposal was prepared in view of the situation that the Finnish financial sector is cut off entirely from European and other financial market infrastructures (FMIs), including TARGET2 and Target2-Securities (T2S), due to an incident during normal circumstances or during an emergency situation. In such a scenario, the ability of Suomen Pankki to engage in single monetary policy operations and to provide regular liquidity to Finnish counterparties, through participation of the counterparties in monetary policy operations, would also be disrupted . In the event that the Finnish financial sector and Suomen Pankki were cut off from TARGET2 and T2S, those systems, including accounts and assets held in them by Finnish participants, would continue to operate normally, and branches or subsidiaries of those participants from outside Finland having the relevant permissions may continue to make transactions. In the event that a back-up solution becomes available in Finland and starts using TARGET2 and/or T2S balances from the last known account position, it would be possible for debits to be made on the same account in both TARGET2 and/or TS2 as well as in the Finnish back-up system, which could eventually lead to the participant, in effect, being granted uncollateralised credit (for TARGET2) or selling securities twice (in T2S). When planning preparedness measures, it is important to avoid such scenarios and to ensure legal certainty of bookings. 2.3.2 As member of the Eurosystem, Suomen Pankki has a Treaty based obligation to participate in the implementation of the single monetary policy that is conducted via the TARGET2 infrastructure, which also transmits large-value payments in general. As appropriate, the measures proposed by the proposal do not address TARGET2, T2S or other infrastructures of the European System of Central Banks (ESCB). In this respect, the ECB would like to stress that any preparedness measures should not be arranged in such a manner that they would have an adverse effect on the performance of ESCB tasks, or prejudice Eurosystem competencies. For the avoidance of doubt, it should also be made clear that the proposal is not intended to apply even indirectly to ESCB infrastructures such as TARGET2 or T2S or prejudice the offering of their services. 2.4 Oversight of systemically important payment systems

By way of background information in connection with the implementation of the proposal, the Finnish authorities may wish to take note that Regulation of the European Central Bank (EU) No 795/2014 of 3 July 2014 on oversight requirements for systemically important payment systems (ECB/2014/28) (hereinafter the ‘SIPS Regulation’), which covers both large-value and retail payment systems of systemic importance, operated either by a Eurosystem central bank or a private entity, and the non-legally binding oversight frameworks for retail payment systems and for payment instruments have recently introduced a number of requirements addressing new risks, including those related to operational and security risks such as cyber resilience, for which the CPMI-IOSCO guidance on cyber resilience for financial market infrastructures has been taken into account . 2.5 Eurosystem cyber resilience strategy for FMIs The Finnish authorities may also wish to take note of the Eurosystem cyber resilience strategy for FMIs, which is intended to support the implementation of the CPMI-IOSCO guidance from an oversight perspective. The strategy aims to develop a range of tools which can be used by regulators and markets to: (1) facilitate effective cyber resilience, by enhancing the ‘cyber readiness’ of individual FMIs that are overseen by the Eurosystem central banks, and ensure that measures are in place to support this; and (2) foster collaboration among FMIs, their critical service providers and the relevant authorities. In addition, the Eurosystem is developing a range of tools that can be used by FMIs to enhance their cyber resilience such as a European red team testing framework, cyber surveys and focused assessments, to assess the level of cyber maturity of Eurosystem payment systems and to develop cyber resilience oversight expectations to provide more detailed guidance to payment system operators. It is essential that Finnish FMIs’ level of soundness is guaranteed and that the proposed amendments follow the Eurosystem’s cyber resilience strategy. 2.6 Prudential supervision of credit institutions The proposal assigns the FSA the power to issue legally binding instructions to credit institutions concerning the use and functioning of the fall back systems that market participants are obliged to establish to ensure full functioning of the infrastructures in all situations. The ECB understands that these powers relate to the existing tasks of the FSA concerning supervision of operational risks and cyber security. Credit institutions should establish a sound business continuity management plan to ensure their ability to operate on an ongoing basis and limit losses in the event of severe business disruption . According to the explanatory memorandum accompanying the proposal, the new FSA powers would be limited to cover preparedness planning and technical requirements of data systems and data repositories in Finland, and other arrangements deemed sufficient for ensuring their uninterrupted operation in Finland, for instance, the interconnectedness of fall back systems. For significant credit institutions, these powers fall under the exclusive supervisory task of the ECB

regarding robust governance arrangements, and arrangements and mechanisms for the sound management of their risks . Moreover, under Union law there is an obligation to exchange information between the ECB and the national competent authorities, and the national competent authorities, under the conditions laid down by law, are required to inform the ECB about material supervisory procedures concerning less significant institutions and to transmit to the ECB material draft supervisory decisions related to these institutions in order to enable the ECB to exercise oversight over the functioning of the Single Supervisory Mechanism . Hence, the ECB recommends that the proposal require the FSA to share information, in a timely and efficient manner, about any exceptional situation affecting the performance of the tasks and the exercise of the powers conferred on the ECB for prudential supervisory purposes, as well as the measures planned or adopted by the FSA. 2.7 SEPA Regulation The preparedness obligations for Finnish PSPs outlined in the proposal are expected to be compliant with the requirements for the SEPA schemes under Regulation (EU) No 260/2012 of the European Parliament and of the Council of 14 March 2012 establishing technical and business requirements for credit transfers and direct debits in euro, in particular the requirements for ‘reachability’ and ‘interoperability’ for PSPs when executing transactions .

This opinion will be published on the ECB’s website.

Done at Frankfurt am Main, 26 October 2018

[signed]

The President of the ECB

Mario DRAGHI