Opinion of the European Central Bank of 21 September 2021 on a draft regulation concerning the oversight of payment systems and supporting technological or network infrastructures (CON/2021/28)

OPINION OF THE EUROPEAN CENTRAL BANK of 21 September 2021 on a draft regulation concerning the oversight of payment systems and supporting technological or network infrastructures (CON/2021/28) Introduction and legal basis

On 23 July 2021, the European Central Bank (ECB) received a request from the Banca d’Italia for an opinion on a draft regulation concerning the oversight of payment systems and supporting technological or network infrastructures (hereinafter the ‘draft regulation’). The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the Functioning of the European Union and the second, third, fifth and sixth indents of Article 2(1) of Council Decision 98/415/EC , as the draft regulation relates to means of payment, the Banca d’Italia, payment and settlement systems, and rules applicable to financial institutions that materially influence the stability of financial institutions and markets. In accordance with the first sentence of Article 17.5 of the Rules of Procedure of the European Central Bank, the Governing Council has adopted this opinion.

1. Purpose of the draft regulation

1.1 The main purpose of the draft regulation is to update the secondary legislation concerning the 2 3 oversight of retail payment services and systems , which was adopted in 2012 . 1.2 The draft regulation governs payment systems in a broad sense, including relevant third-party payment service providers. In particular, the draft regulation extends the scope of the existing legislation to encompass both Italian retail and large-value payment systems, as well as technical infrastructures or service providers supporting the payment ecosystem, whose registered address and/or centre of operations is located in Italy . 1.3 Under the draft regulation, payment system operators are required to notify the Banca d’Italia of, inter alia, the taking-up and termination of their operation, the system operation rules, incident reports, their cyber resilience strategy alongside the relevant implementing procedures, and their operational risk management documentation .

1.4 With reference to large-value payment systems, the draft regulation sets out specific additional requirements concerning collateral eligibility, means of settlement, management of principal risk, tiered participation, and the use of relevant internationally accepted communication procedures and standards in order to facilitate efficient payment, clearing, settlement and recording . 1.5 The draft regulation also contains specific provisions on the retail payment systems operated by the Banca d’Italia. In this context, most of the requirements provided for retail payment system operators also apply to the Banca d’Italia. In particular, the Banca d’Italia is expected to comply with the principle of full cost recovery when operating retail payment systems . 1.6 Furthermore, technical infrastructures and service providers are required to notify the Banca d’Italia of the taking-up and termination of their operation in support of the payment ecosystem as well as of any significant change to the services they provide to one or more payment service providers and/or payment system operators . Where technical infrastructures and service providers are classified as critical by the Banca d’Italia, they are required to comply with requirements concerning governance, internal controls, business risk, legal risk and operational risk . 1.7 Finally, the draft regulation is to be complemented by a guide on controls and by an annex containing business continuity measures. Both documents are to be published on the Banca d’Italia’s website.

2. General observations

2.1 The ECB welcomes the draft regulation, which aims to (1) achieve alignment with the Committee on Payments and Market Infrastructures (CPMI) and the International Organization of Securities Commissions (IOSCO) Principles for financial market infrastructures (hereinafter the ‘CPMI- IOSCO principles’), (2) strengthen operational and cyber resilience in the payment sector, and (3) support the role of the Banca d’Italia as overseer of payment systems and of their supporting technological or network infrastructures. The ECB also welcomes the fact that the draft regulation provides for the application of the principle of full cost recovery by the Banca d’Italia when operating retail payment systems. 2.2 The ECB welcomes the application of the draft regulation to payment systems other than those classified as systemically important payment systems (SIPS) under Regulation (EU) No 795/2014 of the European Central Bank (ECB/2014/28) (hereinafter the ‘SIPS Regulation’) . 2.3 In addition, the ECB welcomes the adherence of the draft regulation to the Eurosystem oversight policy framework and the Eurosystem’s policy regarding the identification and oversight of critical service providers of financial market infrastructures.

2.4 Furthermore, the ECB welcomes the alignment of the draft regulation with the CPMI-IOSCO’s Guidance on cyber resilience for financial market infrastructures , which the ECB has operationalised in its cyber resilience oversight expectations for financial market infrastructures (CROE) . The ECB suggests that any guidance to be developed under the draft regulation should be aligned with the CROE. 2.5 Finally, the ECB notes that the recitals to the draft regulation contain, inter alia, a list of frameworks which have been considered by the Banca d’Italia. For the sake of clarity, the ECB would suggest referring to Regulation (EU) 2021/728 of the European Central Bank (ECB/2021/17) , which is the most recent amending legal act to the SIPS Regulation, instead of Regulation (EU) No 2017/2094 of the European Central Bank (ECB/2017/32) . Alternatively, the Banca d’Italia may consider including a dynamic reference to the SIPS Regulation.

This opinion will be published on EUR-Lex.

Done at Frankfurt am Main, 21 September 2021.

[signed]

The President of the ECB

Christine LAGARDE