Opinion of the European Central Bank of 30 December 2024 on oversight of payment systems (CON/2024/42)

OPINION OF THE EUROPEAN CENTRAL BANK of 30 December 2024 on oversight of payment systems (CON/2024/42) Introduction and legal basis

On 27 September 2024, the European Central Bank (ECB) received a request from the Banco de Portugal (BdP) for an opinion on a draft notice and a draft instruction on oversight of payment systems (hereinafter together referred to as the ‘draft regulations’). The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the Functioning of the European Union and Article 2(1), third and fifth indents, of Council Decision 98/415/EC , as the draft regulations relate to the BdP and to payment and settlement systems. In accordance with Article 17.5, first sentence, of the Rules of Procedure of the European Central Bank, the Governing Council has adopted this opinion.

1. Purpose of the draft regulations

1.1 According to the Organic Law of the Banco de Portugal and the Legal Framework of Credit Institutions and Financial Companies , one of the tasks of the BdP is to regulate, oversee and promote the smooth operation of payment systems, within the scope of its participation in the European System of Central Banks (ESCB). The Legal Framework of Credit Institutions and Financial Companies further provides that entities carrying out any activity within the scope of payment systems must inform the BdP that they are carrying out such activity and provide to the BdP all the information that it may request . 1.2 The draft regulations are the first regulations issued by the BdP based on the above legal provisions. They aim at providing a more robust legal framework for the function of overseeing payment systems in Portugal by defining the obligations of certain entities that carry out activities within the scope of such systems. As mentioned in the explanatory memorandum accompanying the draft notice, it is intended to strengthen the conditions under which the BdP exercises its oversight function, as it was considered necessary to adopt regulatory instruments to establish a legal framework at national level that more clearly specifies the information, notification and/or communication obligations that such

1 Council Decision 98/415/EC of 29 June 1998 on the consultation of the European Central Bank by national authorities regarding draft legislative provisions (OJ L 189, 3.7.1998, p. 42).

2 Lei Orgânica do Banco de Portugal, aprovada pela Lei n.º 5/98, de 31 de Janeiro. See Article 14.

3 Regime Geral das Instituições de Crédito e Sociedades Financeiras – RGICSF, aprovado pelo Decreto-Lei n.º 298/92, de 31 de Dezembro. See Article 92(1), subparagraph (a).

4 See Article 117-B of the Legal Framework of Credit Institutions and Financial Companies. entities must comply with. Thus, the draft regulations seek to increase the transparency of these obligations while creating a legally binding framework at national level for such entities. 1.3 Scope of the draft regulations The draft regulations define the entities that fall within their scope and are not currently covered by other prudential, macroprudential, or conduct-monitoring measures issued by the BdP with the very same purpose. These entities are, in particular, specified as those that (1) operate or process retail payment systems; (2) hold payment instrument schemes or payment instrument arrangements; or (3) provide cash withdrawal services through automated teller machines (ATMs) (hereinafter the ‘specified entities’) . 1.4 General reporting obligations The draft regulations establish reporting obligations under which all of the specified entities that carry out their activity in Portugal will be obliged to notify the BdP of the commencement, modification and termination of their activity . In particular, the draft regulations specify the information to be communicated by those entities at each of these stages . The draft regulations provide that an activity is considered to be carried out in Portugal whenever the services provided under such activity are made available to payment services users and/or providers established in Portugal . Therefore, entities that carry out their activity in Portugal, but which are not established in Portugal, will be subject to such reporting obligations. However, the remaining obligations discussed in paragraphs 1.5 to 1.7 will not be applicable to such entities, since these are only applicable to entities that are established in Portugal and which carry out their activities in the context of payment systems. 1.5 Assessment actions The draft regulations envisage that, in its oversight function in the context of the ESCB, the BdP undertakes assessment actions in respect of entities established in Portugal which carry out their activities in the field of payment systems . These assessments are performed on the basis of existing Eurosystem frameworks and guidance. In this context, these entities are obliged to provide certain information to the BdP . It is expressly clarified that these assessment actions are carried out without prejudice to the possibility of the BdP requesting additional information or carrying out other assessment actions in compliance with the applicable framework laid down by the ESCB . The draft regulations further clarify that all of the specified entities that are established in Portugal must provide the BdP with any information it deems necessary to enable it to monitor their activities in the context of the performance of its oversight function. The draft regulations also contain various provisions of a procedural nature related to assessments and other oversight actions of the BdP which may give rise to the issuance of recommendations and observations by the BdP .

5 See Articles 1 and 2 of the draft notice.

8 See Articles 3 to 5 of the draft notice.

10 See Article 8 of the draft notice.

11 See points 2 to 6 of the draft instruction.

13 See points 7 to 10 of the draft instruction. 1.6 Reporting of major incidents The draft regulations provide that entities established in Portugal which (1) operate or process retail payment systems or (2) hold payment instrument schemes or payment instrument arrangements must report to the BdP all major incidents that may affect their activity and may have an operational or security-related nature . For this purpose, major incidents are defined as consisting of one or a series of connected unforeseen events which have or may have an adverse impact on the integrity, availability, confidentiality, authenticity and/or continuity of payment-related services . These entities will be obliged to provide certain information to allow the BdP to assess the incident in question. 1.7 Reporting of statistical information The draft regulations provide that entities established in Portugal which (1) operate or process retail payment systems or (2) provide cash withdrawal services through ATMs must report to the BdP statistical information on their operations and payment services . The specific statistical information to be sent by these entities is already established in a previous regulation issued by the BdP .

2 General observations

2.1 Pursuant to Article 127(2), fourth indent, of the Treaty, as mirrored in Article 3.1, fourth indent, of the Statute of the European System of Central Banks and of the European Central Bank (hereinafter the ‘Statute of the ESCB’), the Eurosystem has the task of promoting the smooth operation of payment systems. Article 22 of the Statute of the ESCB furthers the performance of this task. Based on the foregoing, the ECB and the national central banks (NCBs) should use the powers available to them to promote the smooth operation of clearing and payment systems. Oversight responsibilities are, inter alia, key to this basic task . 2.2 The ECB emphasises that the draft regulations are based on the relevant provisions of the Organic Law of the Banco de Portugal , which states that it is the BdP’s responsibility to regulate, oversee and promote the proper functioning of payment systems, specifically in the context of its participation in the ESCB. 2.3 The ECB welcomes that the explanatory memoranda accompanying the draft regulations expressly indicate that the draft regulations must not hinder the oversight to be performed by other central banks within the ESCB, including the ECB, over entities that carry out their activities in the field of payment systems . Subject to the specific observations set out below, the ECB further welcomes that the draft regulations are based on existing Eurosystem oversight frameworks and guidance,

16 See point 12 of the draft instruction.

18 See Instruction No 19/2012.

19 See Section 3.1 of the Eurosystem oversight policy framework, revised version (July 2016), available on the ECB’s website at www.ecb.europa.eu. See also paragraph 2.2 of Opinion CON/2020/9. All ECB opinions are published on EUR-Lex.

20 See Article 14 of the Organic Law of the Banco de Portugal, approved by Law No 5/98 of 31 January.

21 See page 2 of the explanatory memorandum accompanying the draft notice. where available, and that the intention of the draft regulations is not to overlap with other applicable ESCB frameworks. The ECB also welcomes that the draft regulations cover the collection of information required for the exercise of the BdP’s oversight tasks in the context of these frameworks. 2.4 Based on the above, the ECB understands that the draft regulations are without prejudice to the principles and rules set out under any existing or future Eurosystem framework and/or ECB regulations potentially applicable to entities established in Portugal, including in the event that these entities become of pan-European relevance in accordance with the applicable Eurosystem frameworks and/or regulations. In the same vein, the ECB notes that the draft regulations are to be adopted by the BdP without prejudice to the general regulatory power of the ECB under Article 22 of the Statute of the ESCB. In the exercise of such power, the ECB may in the future adopt new regulations which would be applicable to the entities that fall under the Eurosystem frameworks referred to in the draft regulations. In such a case, the ECB regulations would prevail over national regulations. 2.5 The above observations are in line with the Eurosystem oversight policy framework, which describes the role of the Eurosystem in the field of oversight. They are also in line with the respective applicable Eurosystem frameworks, i.e. the Eurosystem revised oversight framework for retail payment systems (hereinafter the ‘RPS framework’) and the Eurosystem oversight framework for electronic payment instruments, schemes and arrangements (hereinafter the ‘PISA framework’). Pursuant to the Eurosystem’s policies, for the purpose of overseeing individual payment systems, schemes and arrangements, the Eurosystem assigns primary oversight responsibility to the central bank that is best placed to fulfil this function, either by virtue of its proximity to the overseen entity (e.g. where the system is legally incorporated in its jurisdiction) or by virtue of national laws that attribute specific oversight responsibilities to the central bank concerned, subject to any Treaty-based requirements. This is typically the case for systems and entities with a clear national anchor, i.e. being legally incorporated in a jurisdiction or serving that particular national market , such as the payment systems and entities intended to be covered by the draft regulations . When there is no national anchor, the body entrusted with primary oversight responsibility is the NCB of the country where a system, scheme or arrangement is legally incorporated, unless the Governing Council decides otherwise and assigns the primary oversight responsibilities to the ECB. 2.6 Under the draft regulations, the BdP’s assessment of retail payment systems will be based on the RPS framework as well as the Eurosystem’s Cyber Resilience Oversight Expectations (CROE) and the BdP’s assessment of the obliged entities responsible for the functioning of payment schemes and arrangements will be based on the PISA framework. The ECB welcomes the draft regulations, which provide a more robust legal basis for the BdP’s tasks relating to the oversight of these entities, thereby strengthening its oversight function . Transitioning from a national framework based on soft law instruments and recommendations to a legally binding framework will facilitate the addressing of compliance issues by entities carrying out payment system-related activities. The ECB also

22 See Section 5.2 of the Eurosystem oversight policy framework, revised version (July 2016).

23 See paragraph 2.3 of Opinion CON/2020/9.

24 See point 3 of the draft instruction.

25 See, for example, paragraph 2.1 of Opinion CON/2020/9, paragraph 2.3 of Opinion CON/2021/28 and paragraph 2.1 of Opinion CON/2021/33. welcomes the BdP’s intention to reinforce and clarify its role as overseer of payment systems and payment schemes and arrangements by imposing legally binding requirements on the obliged entities. The draft regulations are thus expected to facilitate the consistent and harmonised application by the BdP of Eurosystem standards when conducting its oversight of payment systems in Portugal . 2.7 On that note, the ECB highlights the importance of the draft regulations’ consistency with the existing Eurosystem frameworks. To achieve such consistency, considering also that the Eurosystem frameworks are subject to amendments and alterations, the BdP might consider favouring the use of cross-references to these frameworks in the draft regulations, instead of further specifications when these simply repeat the content of such frameworks . 2.8 The ECB understands that the BdP continues to apply Eurosystem oversight expectations for links between retail payment systems .

3. Specific observations

3.1 Scope of the draft regulations 3.1.1 According to the explanatory memoranda accompanying the draft regulations, the draft regulations should not hinder the oversight to be performed by other central banks within the ESCB, including the ECB, over entities that carry out their activities in the context of payment systems. Even in the absence of direct references in the provisions of the draft regulations themselves, the ECB understands that the draft regulations do not intend to interfere with the implementation of Regulation (EU) No 795/2014 of the European Central Bank (ECB/2014/28) (hereinafter the ‘SIPS Regulation’), which applies to systemically important payment systems (SIPS) on the basis of certain quantitative and qualitative criteria . 3.1.2 Having said that, the draft regulations do not define ‘payment systems’ or provide an exhaustive list of entities considered to operate in the field of retail payment systems or, in particular, expressly exclude SIPS from their scope of application . The ECB would therefore welcome the introduction of an explicit clarification in the draft regulations to the effect that their scope of application does not cover payment systems classified as SIPS under the SIPS Regulation. Additionally, the ECB would welcome further clarification to the effect that the draft regulations only apply to prominently important retail payment systems and other retail payment systems as defined under the RPS framework.

26 See paragraph 2.1 of Opinion CON/2023/14.

27 See, for example, points 2.3.2 and 5.3.2 of the draft instruction.

28 Eurosystem, ‘Oversight expectations for links between retail payment systems’, 29 November 2012, available on the ECB’s website at www.ecb.europa.eu.

29 See Regulation of the European Central Bank (EU) No 795/2014 of 3 July 2014 on oversight requirements for systemically important payment systems (ECB/2014/28) (OJ L 217, 23.7.2014, p. 16).

31 See Article 2 of the draft notice.

32 In particular, in Article 1 of the draft notice. 3.1.3 The ECB would further welcome the introduction of a provision specifying that the exercise of the BdP’s oversight tasks and the obligations introduced by the draft regulations are without prejudice to the oversight powers and tasks of the ECB and other NCBs resulting from the application of Eurosystem frameworks and will respect the ECB’s competences as primary overseer and the legitimate exercise of other NCBs’ oversight powers and tasks in the context of the ESCB, thereby reflecting in the enacting terms the clarification contained in the explanatory memoranda accompanying the draft regulations. The introduction of this provision would clarify that obligations under the draft regulations relating to assessments under the existing Eurosystem frameworks will respect the Eurosystem’s assignment of the primary oversight responsibility in line with the Eurosystem frameworks and as determined by the Governing Council. The ECB also points out that the application of the obligations under the draft regulations and the exercise of the BdP’s oversight tasks must respect the principles of proportionality and ensure that duplication of reporting requirements is avoided to the extent possible. 3.1.4 Furthermore, regarding the interplay of the draft regulations with the Eurosystem frameworks, it should be clarified whether the draft regulations are to cover only the entities that fall within the RPS and PISA frameworks following the respective Eurosystem classification exercises. With regard to the entities that fall under the PISA framework, the ECB draws attention to the Eurosystem exemption policy that complements the PISA framework pursuant to which every three years the ECB coordinates a Eurosystem-wide exercise to identify those payment schemes/arrangements that fall within the scope of the PISA framework and those that should be exempted from it, also in view of the Eurosystem oversight focus on those schemes and arrangements that have reached a considerable level of importance for the euro area. On the basis of the above, considering that the oversight assessments on payment instruments and schemes in the draft regulations are based on the PISA framework, clarification as to whether the draft regulations also cover entities that are granted an exemption from the PISA framework would be advisable. 3.1.5 In the same vein, the ECB also notes that, under the draft instruction, the respective entities must carry out self-assessments under the RPS and PISA frameworks within a maximum of one year after starting their activities. The ECB highlights that the stipulated timelines risk not taking into account the outcome of the Eurosystem’s classification exercises and the exemption policy enshrined in the PISA framework. The ECB therefore suggests that the timeline for conducting the self-assessment should be initiated only following the notification to the relevant entity that it is subject to the draft regulations and/or Eurosystem frameworks. 3.1.6 Further to the above, the ECB would suggest the introduction of clarifications on the subject matter of the draft regulations, particularly in the article setting out their object and scope , which, as currently drafted, does not reflect their actual scope, which extends beyond information reporting to cover the BdP’s assessment of the required information and issues of compliance with the principles underpinning the Eurosystem frameworks and related oversight actions. In particular, it is suggested to include a provision clearly setting out that the BdP will use the information collected from entities established in Portugal that fall within the scope of the draft regulations for the conduct of

33 In particular, in Article 1 of the draft notice.

34 Article 1 of the draft notice. assessments under the Eurosystem frameworks and also for other oversight actions. The ECB takes the view that this would be in line with the articles introduced in the draft regulations that specify the BdP’s oversight duties , as well as the provisions that set out obligations for entities to conduct selfassessments and those that specify that the BdP’s assessments and other oversight actions may result in the issuance of recommendations and/or observations by the BdP . 3.1.7 Additionally, the provision setting out the scope of application provides that an entity is considered to operate within the field of retail payment systems ‘in particular’ when it falls into one of the predefined categories. The use of the expression ‘in particular’ indicates that the list of entities which may fall within the draft regulations’ scope of application is non-exhaustive, potentially giving rise to issues of legal uncertainty. 3.1.8 Finally, the draft regulations provide that an entity will be considered to operate in the field of retail payment systems and, therefore, subject to the draft regulations, where, inter alia, it holds payment schemes and payment arrangements . The Eurosystem oversight framework for electronic payment instruments, schemes and arrangements provides that the principles contained therein are aimed at the governance bodies of such schemes and arrangements . The achievement of consistency in the terminology used in the draft regulations regarding its application to payment schemes and arrangements with that used in the Eurosystem oversight framework would ensure greater coherence and legal certainty. 3.2 Enforcement measures 3.2.1 The ECB understands that the BdP has the possibility to apply enforcement measures or sanctions in respect of the entities included within the scope of application of the draft regulations through the general provisions contained in the Legal Framework of Credit Institutions and Financial Companies , even though the draft regulations do not expressly refer to the enforcement measures available to the BdP in the event of non-compliance with the notification requirements pertaining to commencement, modification or cessation of business and the information required for the oversight assessments . In this context, the ECB also notes that, in respect of the assessments carried out 42, by the BdP under the draft regulations, the BdP may issue recommendations and/or observations but the draft regulations do not explicitly set out the distinction between each type of measure, their legal nature and whether or not they are legally binding. The draft regulations are also silent on the ultimate consequences that stem from the issuance of an observation. The recommendations are ranked by reference to their degree of criticality . Entities subject to a recommendation must draw

35 See Article 8 of the draft notice.

36 See Articles 7, 8 and 9 of the draft instructions.

39 See Section 3 of the Eurosystem oversight framework for electronic payment instruments, schemes and arrangements.

40 See, in particular, Articles 117-B(2) and 210(i) of the Legal Framework of Credit Institutions and Financial Companies.

41 See Articles 3, 4 and 5 of the draft notice.

42 See point 8.1 of the draft instruction.

43 See point 9.2 of the draft instruction. up an action plan for the implementation of the recommendation and share it with the BdP , which is to monitor its implementation . 3.3 Pan-European service providers established outside Portugal 3.3.1 The ECB notes that pan-European payment service providers that carry out activities in Portugal, but which are not established in Portugal, will only be subject to the limited set of obligations contained in the draft regulations to notify the BdP of the commencement, modification and termination of their activity in Portugal. The ECB therefore understands that, apart from these very limited notification obligations, the primary purpose of the draft regulations is to regulate payment system activities undertaken by entities that are established in Portugal. 3.4 Alignment of the draft regulations with other Eurosystem frameworks and guidance 3.4.1 The ECB understands that the draft regulations also cover the BdP’s oversight responsibilities in respect of entities responsible for the provision of critical services to payment systems, schemes and arrangements . The BdP’s assessment of the provision of these critical services is to be based on the assessment methodology for the oversight expectations applicable to critical service providers , published by the Bank for International Settlements (BIS) . The ECB also notes that the BdP’s assessment should follow any relevant Eurosystem guidance. 3.4.2 Regarding the assignment by the draft regulations of oversight responsibilities to the BdP in respect of the cyber resilience of retail payment systems, the ECB welcomes that the exercise by the BdP of its oversight responsibilities in this respect is to be based on the CROE . 3.4.3 The draft regulations require the obliged entities to report to the BdP any major incidents affecting their activity, which may be operational or security incidents. The ECB welcomes the alignment of the draft regulations with Eurosystem guidance regarding major incident reporting. Additionally, the ECB recommends that the draft regulations should clarify that the BdP will share relevant information about major incidents with the Eurosystem and on a case-by-case basis with the ESCB. 3.5 Collection of statistical information 3.5.1 Regarding the requirements under the draft regulations for obliged entities to provide the BdP with statistical information on the payment transactions and services carried out in the course of their activities , and for the BdP to detail, by way of a regulation, the statistical information to be provided by the obliged entities , the ECB understands that such information is currently specified in a previous regulation issued by the BdP . The obliged entities may already be required to report information concerning their payment activities under Directive (EU) 2015/2366 of the European

44 See point 9.3 of the draft instruction.

45 See point 9.4 of the draft instruction.

46 See point 6.1 of the draft instruction.

47 See Bank of International Settlements, ‘Assessment methodology for the oversight expectations applicable to critical service providers’ (December 2014), available on the BIS’s website at www.bis.org.

48 See point 6.2 of the draft instruction.

49 Eurosystem ‘Cyber resilience oversight expectations for financial market infrastructures’ (December 2018), available on the ECB’s website at www.ecb.europa.eu.

52 See Instruction No 19/2012. Parliament and of the Council to the designated national competent authority and, under Regulation (EU) No 1409/2013 (ECB/2013/43) , to the BdP. Any further reporting requirements imposed by the BdP should take account of, and not duplicate or conflict with, the reporting requirements imposed on the obliged entities under Directive (EU) 2015/2366 and Regulation (EU) No 1409/2013 (ECB/2013/43). This is necessary to comply with the statistical principles that govern the production of statistics by the ESCB under Article 3a of Council Regulation (EC) No 2533/98 , including costeffectiveness and minimisation of the reporting burden. This opinion will be published on EUR-Lex. Done at Frankfurt am Main, 30 December 2024. [signed] The President of the ECB Christine LAGARDE

53 Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC (OJ L 337, 23.12.2015, p. 35).

54 Regulation (EU) No 1409/2013 of the European Central Bank of 28 November 2013 on payments statistics (ECB/2013/43) (OJ L 352, 24.12.2013, p. 18).

55 Council Regulation (EC) No 2533/98 of 23 November 1998 concerning the collection of statistical information by the European Central Bank (OJ L 318, 27.11.1998, p. 8).