Opinion of the European Central Bank of 8 November 2018 on designation of essential services and operators of essential services for the purpose of network and information systems security (CON/2018/47)

OPINION OF THE EUROPEAN CENTRAL BANK of 8 November 2018 on designation of essential services and operators of essential services for the purpose of network and information systems security (CON/2018/47) Introduction and legal basis

On 5 October 2018 the European Central Bank (ECB) received a request from the Slovenian Ministry of Public Administration for an opinion on a draft decree on the designation of essential services and a more detailed methodology for the designation of the operators of essential services (hereinafter the ‘draft decree’). The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the Functioning of the European Union and the third, fifth and sixth indents of Article 2(1) of Council Decision 98/415/EC , as the draft decree relates to Banka Slovenije, payment and settlement systems and rules applicable to financial institutions insofar as they materially influence the stability of financial institutions and markets, and the tasks conferred on the ECB concerning the prudential supervision of credit institutions pursuant to Article 127(6) of the Treaty. In accordance with the first sentence of Article 17.5 of the Rules of Procedure of the European Central Bank, the Governing Council has adopted this opinion.

1. Purpose of the draft decree

1.1 The draft decree is to be adopted by the Government of the Republic of Slovenia as an implementing regulation under the Law on information security . The latter transposed Directive (EU) 2016/1148 of the European Parliament and of the Council into Slovenian legislation. It lays down a framework the aim of which is to ensure that appropriate information systems-related security measures are taken to prevent, notify and react to cyber incidents. The Law on information security designates the national security incident response teams and their tasks, and sets up the national competent authority for information security (hereinafter the ‘national information security authority’), which also acts as a single point of contact on information security. It also lays down the competences and duties of the national information security authority and provides to it and its inspectors the powers and means to enforce compliance by the providers of relevant services.

1.2 The Law on information security applies to the following service providers: (i) operators of essential services; (ii) digital service providers; and (iii) state administration authorities managing information systems and providing information services necessary for the smooth functioning of the State and for safeguarding national security. As regards the operators of essential services, it foresees that this will include entities operating in the relevant sectors as specified by the Law, including, inter alia, banking and financial market infrastructures. The Law empowers the Government to designate individual entities as operators of essential services. First, however, it requires the Government to draw up a more detailed list of essential services from the relevant sectors, and to specify in more detail the methodology for the designation of the operators of those services . It is the purpose of the draft decree to address these elements. 1.3 As regards the detailed list of services, the draft decree lists individual services using the standard classification of activities. In the banking sector the draft decree specifies the following services : (i) ‘central banking’ (acting as banker for the government sector, including with regard to subaccounts for pension, health and social insurance); (ii) ‘other monetary intermediation’ (acceptance of deposits and granting of loans by banks, savings banks and credit unions); and (iii) ‘other activities auxiliary to financial services, except insurance and pension funds’ (the activity of processing financial transactions and settlement activity, including credit card transactions and payment transactions). In the financial market infrastructures sector the draft decree specifies the following: (i) ‘administration of financial markets’ (operating and supervising financial markets other than by State authorities: collective safekeeping of securities, determining and executing obligations arising from securities transactions and maintaining a central register of holders of book-entry securities); and (ii) ‘securities brokerage’ (trading in securities traded on a trading venue pursuant to the law governing the market in financial instruments and related activities, and securities brokerage). 1.4 The draft decree explicitly states that it (i) does not apply to services the provision of which depends on information systems operated by the European System of Central Banks (ESCB); (ii) does not apply to services the provision of which depends on information systems operated by Banka Slovenije which are supervised by the ESCB; and (iii) is without prejudice to the supervision of information systems falling within the competence of Banka Slovenije or the ESCB governed by laws of the European Union or by laws of the Republic of Slovenia adopted on the basis of Union laws . Further, the draft decree provides that the designation of individual entities as operators of essential services in the banking sector requires the prior consent of Banka Slovenije if the provision of such services depends on information systems of Banka Slovenije which are not information systems excluded by the draft decree as described in points (i) and (ii) above and which are used by Banka Slovenije for the performance of its tasks pursuant to the Law on Banka

Slovenije , the Statute of the European System of Central Banks and of the European Central Bank (hereinafter the ‘Statute of the ESCB’) and Union laws . 1.5 In addition to any designation of operators of essential services on the basis of the draft decree as described above, the Law on information security also requires the Government to designate as operators of essential services the operators of critical infrastructures designated pursuant to the 9 10 Law on critical infrastructures , .

2 General observations

2.1 As previously noted , the ECB supports the aim of Directive (EU) 2016/1148 of ensuring a high common level of network and information security across the Union and of achieving a consistent approach in this field across business sectors and Member States. It is important to ensure that the internal market is a safe place to do business and that all Member States have a certain minimum level of preparedness for cybersecurity incidents . 2.2 As regards specific provisions of the draft decree concerning information systems operated or ‘supervised’ by Banka Slovenije and/or the ESCB as described in paragraph 1.5, the ECB understands that the term ‘supervision’ (Slovene: nadzor) as used in the draft decree includes both ‘supervision’ and ‘oversight’. Under Slovenian law the term ‘supervision’ may be understood as referring to the concepts of both ‘supervision’ and ‘oversight’, as those terms are understood in, for example, the English language.

3 Impact of the draft decree on systemically important payment systems (SIPS) and TARGET2-Securities

3.1 The ECB in its oversight role, on the basis of Articles 3.1 and 22 and the first indent of Article 34.1 of the Statute of the ESCB, adopted Regulation (EU) No 795/2014. This Regulation implements the Principles for financial market infrastructures (PFMIs) issued by the Committee on Payment and Settlement Systems (CPSS) and the International Organization of Securities Commissions (IOSCO) in a legally binding manner. It recently introduced a number of new requirements for SIPS operators addressing new risks, including those related to operational and security risks

(such as cyber resilience) , taking into account, inter alia, the Committee on Payments and Market Infrastructures (CPMI)-IOSCO Guidance on cyber resilience for financial market infrastructures which was published in 2016 . Among listed SIPS, TARGET2 plays a distinct role, as it is owned and operated by the Eurosystem and subject to strict regulation and oversight. 3.2 The ECB understands, on the basis of Article 2(1) and (2) of the draft decree, which exempts services provided using information systems operated by the ESCB or operated by Banka Slovenije and supervised or overseen by the ESCB from the scope of the draft decree, that such services are, consequently, also exempt from the scope of the Law on information security. The ECB welcomes this, as it should help to ensure that the Slovenian legislation on information security does not encroach on the ESCB’s competences, consistent with the principles of the primacy of Union law and of central bank independence pursuant to Article 130 of the Treaty . 3.3 In particular, the ECB understands that, on the basis of Article 2(1) of the draft decree, TARGET2- Securities (T2S) services would be exempt from the scope of the relevant legislation, since pursuant to Article 6 of Guideline ECB/2012/13 of the European Central Bank and Article 7 of the T2S Framework Agreement , T2S is operated by the ESCB. Further, in line with the Governing Council’s decision in its Eurosystem oversight policy framework (revised version of July 2016) , T2S falls under Eurosystem oversight competences under Articles 127(2) of the Treaty and Articles 3(1) and 22 of the Statute of the ESCB. 3.4 The ECB also understands that, on the basis of Article 2(2) of the draft decree, the Slovenian component of TARGET2 is exempt from the scope of the draft decree and the Law on information security, since Banka Slovenije acts as the operator of that component. TARGET2 has been identified, pursuant to Decision ECB/2014/35 of the European Central Bank , as a SIPS and is overseen by the ECB as competent authority under Regulation (EU) No 795/2014. 3.5 The ECB understands that Article 2(3) of the draft decree aims to limit the impact of the draft decree on supervision or oversight which is performed by Banka Slovenije or ESCB central banks on the basis of Union law such that any designation of operators of essential services pursuant

to the draft decree, and the consequential application of the Law on information security to such designated operators, will be without prejudice to the performance of that supervision or oversight. In addition to exempting the Slovenian component of TARGET2 from the scope of the Law on information security, the ECB understands that, on the basis of Article 2(3), the relevant Slovenian legislation will not encroach on the Eurosystem’s competences in the field of SIPS, including through any supervisory powers of the national information security authority and its inspectors under the Law on information security.

4 Impact of the draft decree on non-SIPS

4.1 Non-SIPS include non-systemically important large-value payment systems (LVPS) and nonsystemically important retail payment systems (non-SIRPS). Under the revised oversight framework for retail payment systems non-SIRPS have been divided into two distinct groups: prominently important retail payments systems (PIRPS) and other retail payments systems (ORPS). The Slovenian local retail clearing and payment systems have been classified as PIRPS or ORPS and the ECB understands that in the present case, as their services are of the type included in the list of essential services pursuant to the draft decree, the operators of those systems or some of them might be designated as operators of essential services, thereby falling within the Law on information security and becoming subject to the supervisory measures of the national information security authority and its inspectors. 4.2 Under the Eurosystem’s oversight policy framework, non-systemically important LVPS and non- SIRPS must follow the CPSS-IOSCO PFMIs and non-SIRPS must additionally follow the oversight expectations for links between retail payment systems (OELRPS) . Both the CPSS-IOSCO PFMIs and the OELRPS are soft law instruments, meaning that non-systemically important LVPS, PIRPS and ORPS are subject to oversight standards (which are comparable to the standards under Regulation (EU) No 795/2014), however there is, strictly speaking, no Union legislation regulating the oversight or supervision of these systems . Banka Slovenije is given supervisory and oversight competence over non-SIPS pursuant to the Law on payment services, services concerning issuing electronic money and payment systems , which in this particular matter does not implement Union ‘laws’ as described in this paragraph 4.2 above . 4.3 The Revised oversight framework for retail payment systems specifies that all retail payment systems are an integral part of the payment and settlement landscape of the euro area and thus fall within the scope of oversight. Hence, the Eurosystem has an interest in ensuring that the oversight framework and standards applicable to such systems are not prejudiced through the implementation of Directive (EU) 2016/1148 or when introducing other network and information

security-related laws . 4.4 If it is intended that non-SIPS are excluded from the scope of the draft decree and the Law on information security, the ECB suggests that, in the interest of legal certainty, it is explicitly clarified that the relevant legislation does not encroach on the oversight of non-SIPS by Banka Slovenije or the ESCB that are subject to applicable oversight frameworks, guidelines and principles. If the Slovenian authorities, however, consider it necessary to include non-SIPS within the scope of the draft decree and the Law on information security, it notes that Article 27(2)(5) of the Law on information security foresees that the national information security authority cooperates with the regulators and supervisors of the sectors in which the respective essential services are provided. The ECB suggests that, in applying this, effective information-sharing and cooperation arrangements are put in place to ensure that the national information security authority shares information about actual and potential cyber incidents as well as measures planned or adopted by the national information security authority which affect non-SIPS with Banka Slovenije in a timely and efficient manner in order to enable Banka Slovenije to fulfil its tasks under the Treaty and Slovenian law. It would, in any case, be advisable to clarify the exact scope of the draft decree and the Law on information security and the supervisory powers of the national information security authority and its inspectors in relation to non-SIPS to avoid potential confusion on the applicable standards and the powers of the relevant authorities .

5 Impact of the draft decree on critical service providers

The revised Eurosystem oversight policy framework covers critical service providers. Similar to the case of non-SIPS, it cannot be excluded that the draft decree and the supervisory powers of the national information security authority could cover critical service providers for which the applicable oversight measures, insofar as soft law instruments, would not be considered Union laws within the meaning of Article 2(3) of the draft decree. It is therefore suggested that the Slovenian authorities take existing oversight arrangements into consideration in their application of the Law on information security, if such application would affect critical service providers .

6 Impact of the draft decree on payment services and payment instruments and schemes

6.1 The Eurosystem oversight policy framework identifies payment instruments, such as cards, credit transfers, direct debit and electronic money, as an ‘integral part of payment systems’, and thus includes these within the scope of its oversight. For payment instruments, the role of primary overseer (for the Eurosystem) is assigned by reference to the national anchor of the payment scheme and the legal incorporation of its governance authority. For credit transfer and direct debit schemes within the Single Euro Payments Area, as well as some of the international card payment schemes, the ECB has the primary oversight role. Payment service providers (PSPs) are subject

to Directive (EU) 2015/2366 of the European Parliament and of the Council , which is applicable as of January 2018, as implemented into national law. While PSPs are therefore subject to Union and Slovenian legislation (including regulations based on Union legislation), the oversight of international and domestic card schemes is not subject to Union legislation as such . 6.2 It is not fully clear to the ECB if various payment schemes and instruments are covered by the type of services listed in the draft decree as ‘other activities auxiliary to financial services, except insurance and pension funds’. It is thus suggested that the same clarification, effective informationsharing and cooperation framework as mentioned in paragraph 4.4 are provided and put in place in relation to and between the authorities responsible for the oversight of payment schemes, instruments and services and the national information security authority .

7 Impact of draft decree on central securities depositories (CSDs)

7.1 CSDs are strictly regulated and supervised by different authorities pursuant to Regulation (EU) No 909/2014 of the European Parliament and of the Council , which sets out requirements pertaining to operational risk. Furthermore, CSDs should take note of the CPMI-IOSCO Cyber Guidance, which is applicable to all financial market infrastructures. 7.2 In addition to the supervisory competences entrusted to national competent authorities (NCAs) under Regulation (EU) No 909/2014, it should be noted that national authorities, in particular the members of the ESCB, may be entrusted with oversight competences in relation to CSDs. In this regard, recital 8 of Regulation (EU) No 909/2014 states that the Regulation should be without prejudice to the responsibilities of the ECB and the national central banks to ensure efficient and sound clearing and payment systems within the Union and other countries and that the Regulation should not prevent the members of the ESCB from accessing information relevant for the performance of their duties, including the oversight of CSDs and other financial market infrastructures. 7.3 KDD d.d., the Slovenian CSD, is supervised by Banka Slovenije and the Slovenian Securities Market Agency and overseen by Banka Slovenije . While KDD appears to be covered by the type of services listed in the draft decree, such as collective safekeeping of securities, determining and executing obligations arising from securities transactions and maintaining a central register of

holders of book-entry securities, the ECB understands that the Law on information security should be without prejudice to the supervision and oversight of the KDD, given that such supervision and oversight is performed on the basis of Union legislation. The draft decree should, however, be amended to clarify that the national information security authority’s responsibilities are without prejudice to and are aligned with the tasks not only of Banka Slovenije but also of the Securities Market Agency.

8 Impact of draft decree on credit institutions

8.1 Pursuant to Article 2(3) of the draft decree, the draft decree is without prejudice to the supervision of information systems falling within the competence of Banka Slovenije or of the ESCB. Thus, the ESCB’s competence under Union law and the supervision of information systems under Banka Slovenije’s competence should not be affected by the draft decree. However, the ECB understands that some credit institutions established in Slovenia can be designated as operators of essential services, and thus would need to comply with their obligations under the Law on information security. Against this background, the following points are noted. 8.2 Council Regulation (EU) No 1024/2013 confers tasks on the ECB concerning the prudential supervision of credit institutions with a view to contributing to their safety and soundness and in order to protect the stability of the financial system of the Union and each Member State. The ECB is responsible for the effective and consistent functioning of the Single Supervisory Mechanism (SSM) and exercises oversight over the SSM’s functioning, based on a distribution of responsibilities between the ECB and NCAs, including Banka Slovenije. In particular, the ECB carries out its task of authorising and withdrawing the authorisations of all credit institutions. For significant credit institutions the ECB also has the task, among others, of ensuring compliance with relevant Union law imposing prudential requirements on credit institutions, including the requirement to have in place robust governance arrangements, including sound risk management processes and internal control mechanisms . To this end, the ECB is given all supervisory powers to intervene in the activity of credit institutions that are necessary for the exercise of its functions . 8.3 The prudential supervision of credit institutions also covers topics related to cybersecurity and the protection of infrastructures relevant for the operation of credit institutions as part of the prudential supervision of operational risk, meaning the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events . In this respect, the ECB has the power, among others, to restrict or limit the business, operations or network of an institution or to request the divestment of activities that pose excessive risks to the soundness of an institution . Since the

assessment of the adequacy of the internal governance arrangements of credit institutions is one of the core competences of prudential supervisors, the draft decree and the requirements under the Law on information security should not interfere with the tasks that prudential supervisors carry out in this respect . 8.4 Under the Law on information security, the national information security authority has a range of powers to address cybersecurity incidents. In particular, it may, in the case of a major or critical cybersecurity incident and cyber attack or a threat thereof, impose such relevant and proportionate measures on the addressees of the Law as are deemed necessary and proportionate to prevent the continuation of an ongoing incident or the realisation of a threatening incident and to eliminate the consequences of incidents and to limit the expected consequences of a threat thereof . The inspectors of the national information security authority, when enforcing compliance with the Law, may also impose measures to eliminate any identified shortcomings . They may also prohibit providers of essential services from using their information system until established shortcomings have been eliminated, but only in extreme cases, and taking into account the significance of the sector in which they are operating and of their system and activities, if such a measure does not threaten supply in an individual sector or the provision of their services . 8.5 It is acknowledged that the tasks of the ECB and Banka Slovenije as prudential supervisors are in a number of critical respects distinct from the tasks and competences of national security incident response teams and the national information security authority. Nevertheless, there could be an overlap where the actions of the latter could affect the prudential supervision of credit institutions under Union and Slovenian law. This would be most evident if the national information security authority and its inspectors chose, when using their powers under the Law on information security, to restrict the use of an information system. If the use of an information system used by a significant credit institution for the provision of payment services was restricted, this could significantly impact the continuous operation and financial standing of the institution. Additionally, informing the affected persons or the general public about cyber incidents could have an impact on public confidence in the affected institution. The ECB and the NCAs within the SSM are responsible for the assessment of recovery plans and taking early intervention measures under Directive 2014/59/EU of the European Parliament and of the Council . Further, the primary responsibility for determining that a significant credit institution is failing or likely to fail as a condition for resolution lies with the ECB . In the case of resolution, one of the resolution

objectives is to ensure the continuity of critical functions , which can include the continuing functioning of the credit institution’s payment function . 8.6 Under the Law on information security administrative pecuniary sanctions may also be imposed where the relevant service providers do not comply with their obligations under the Law . 8.7 In the light of the above, and since Article 2(3) of the draft decree currently only refers to the ESCB’s competences under Union law and to the supervision of information systems (and not the supervision of credit institutions), the ECB suggests clarifying that the scope of the Law on information security and any powers granted to the competent authorities thereunder are also without prejudice to the competences, tasks and powers of the ECB (and Banka Slovenije) under Regulation (EU) No 1024/2013 and Slovenian law . To enable the ECB and Banka Slovenije to fulfil their tasks within the SSM, the ECB also recommends that an effective framework should be put in place to ensure that the national information security authority shares information about actual and potential cyber incidents affecting significant supervised entities, as well as measures planned or adopted by it. Where relevant, the national information security authority should share information with Banka Slovenije and, through Banka Slovenije, with the ECB in a timely and efficient manner. The Slovenian legislator may also wish to consider the interaction of the national information security authority’s powers under the Law on information security with the resolutionrelated procedures and powers of the relevant authorities .

9 Other information systems of Banka Slovenije

Article 6(4) the draft decree relates to information systems of Banka Slovenije which are not operated by the ESCB, nor by Banka Slovenije under the supervision of the ESCB, but which are used by Banka Slovenije for the discharge of its duties pursuant to the Law on Banka Slovenije, the Statute of the ESCB or Union legislation. The ECB understands that an example of an information system that would fall within the scope of this provision is the infrastructure for the maintenance of the treasury account system, which Banka Slovenije uses to maintain the accounts of State bodies . On the basis of the explanatory memorandum to the draft decree which clarifies that the relevant provision is similar in its purpose to the equivalent provision in the Law on critical infrastructures as regards Banka Slovenije’s critical infrastructures, the ECB assumes that the intention of the legislator in drafting Article 6(4) was to require Banka Slovenije’s consent before any relevant decisions can be adopted under the Law on information security relating to any information system that falls within the scope of this provision, in particular the system for the maintenance of the treasury account system. As Article 6(4) is drafted unclearly its wording should be reviewed in the interest of legal certainty.

10 Miscellaneous

For the sake of legal certainty it should be ensured that the exemptions and safeguards laid down in the draft decree also apply to operators of critical infrastructures in their capacity as operators of essential services. This opinion will be published on the ECB’s website. Done at Frankfurt am Main, 8 November 2018. [signed]

The President of the ECB

Mario DRAGHI