Opinion of the European Central Bank of 17 January 2025 on the oversight of providers of financial messaging services (CON/2025/1)

OPINION OF THE EUROPEAN CENTRAL BANK of 17 January 2025 on the oversight of providers of financial messaging services (CON/2025/1) Introduction and legal basis

On 7 January 2025 the European Central Bank (ECB) received a request from the Governor of the Banque Nationale de Belgique/Nationale Bank van België (NBB), on behalf of the Belgian Government, for an opinion on a draft law on the oversight of providers of financial messaging services that are established in Belgium (hereinafter the ‘draft law’) . The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the Functioning of the European Union and Article 2(1), third and fifth indents, of Council Decision 98/415/EC , as the draft law relates to the NBB and to payment and settlement systems. In accordance with Article 17.5, first sentence, of the Rules of Procedure of the European Central Bank, the Governing Council has adopted this opinion.

1. Purpose of the draft law

1.1 According to the explanatory memorandum to the draft law (hereinafter the ‘explanatory memorandum’), the draft law aims to subject systemically important financial messaging service providers (SIFMSPs) established in Belgium, which play an important role in the proper functioning of clearing, settlement and payment systems, to certain requirements pertaining to their organisation, management and governance, and to specifically provide that they are subject to direct statutory oversight by the NBB. The oversight activities carried out by the NBB with respect to financial market infrastructures and financial messaging service providers (FMSPs), in particular the Society for Worldwide Interbank Financial Telecommunication (SWIFT), is currently mainly based on standards that are not legally enforceable (soft law) and on moral suasion. The central objective of the draft law is to base at least part of the oversight of SIFMSPs on a legally binding and enforceable framework. 1.2 By way of background, the explanatory memorandum notes that, pursuant to Article 8 of the Organic Law of the NBB , the NBB oversees the proper functioning of clearing, settlement and payment

systems (financial market infrastructures) and verifies their effectiveness and soundness in accordance with the applicable statutory provisions. Oversight is generally based on voluntary adherence and historical relationships with key players in the financial markets and entails the NBB engaging in dialogue with the entities operating financial market infrastructures and, where appropriate, on the basis of moral suasion, seeking to persuade them to comply with the standards intended to ensure the proper functioning, effectiveness and soundness of the systems concerned. As a result, these standards are usually not laid down in a legally binding framework and are therefore not legally enforceable. At the international level, the oversight standards for financial market infrastructures are primarily reflected in the Principles for Financial Market Infrastructures (PFMIs), developed in 2012 in cooperation between, on the one hand, the Committee on Payment and Market Infrastructures (CPMI) within the Bank for International Settlements (BIS) and, on the other hand, the Technical Committee of the International Organisation of Securities Commissions (IOSCO). At Eurosystem level, oversight of payment systems that are not systemically important is exercised on the basis of the PFMIs. An important exception with regard to voluntary adherence concerns the oversight of systemically important payment systems (SIPS), which is enshrined in a legally binding Regulation of the ECB on oversight requirements for systemically important payment systems . 1.3 By way of further background, the explanatory memorandum notes that the NBB’s oversight, which takes place within the Eurosystem, relates to operators of financial market infrastructures or payment schemes and arrangements, which are closely related to such infrastructures. The PFMIs also contain specific oversight expectations for critical service providers that do not themselves qualify as financial market infrastructures, but which provide services critical to the functioning of financial market infrastructures, such as specific information and communication technology (ICT) services and messaging services. Overseers may establish specific expectations with regard to critical service providers in order to support the security and sound functioning of financial market infrastructures. 1.4 The explanatory memorandum notes that a large number of financial institutions and financial market infrastructures of systemic importance depend on SWIFT for their daily messaging needs. As a provider of critical financial messaging services to these infrastructures, SWIFT is itself systemic in nature. The NBB exercises oversight over SWIFT, which operates globally, together with other central banks. The NBB acts as lead overseer and coordinates this cooperative oversight since SWIFT’s registered office is located in Belgium. 1.5 The explanatory memorandum states that the system of oversight based on voluntary adherence reached its limits for some market infrastructures and was unable to consistently and effectively ensure robust compliance with soft law oversight standards. This has resulted in a trend towards better legal enshrinement of oversight standards in legally binding frameworks, given the increasingly integrated market for the execution of financial transactions and the increasingly complex relationships between participants in these transactions. SWIFT overseers therefore believe that some of these standards should be codified, to act as a legal backstop and ensure a level playing field with regard to financial sector oversight. In addition to the enhanced oversight envisaged by the draft law, the NBB may continue to perform classical oversight, based on moral suasion, over

SIFMSPs. Moreover, the classical oversight expectations also apply to all matters relating to the functioning and consensus-based decision-making process between the NBB and other authorities with which it has concluded an arrangement to support cooperative oversight, as is the case for the cooperative oversight of SWIFT by the NBB and the other G10 central banks. 1.6 The draft law proposes to determine the systemic importance of FMSPs based on a threshold of 1 billion financial messages processed by the FMSP per year, measured as the average for the three previous calendar years. On the NBB’s advice, the King may modify the amount of the threshold or lay down detailed rules to calculate the threshold . 1.7 The draft law introduces an extensive set of obligations applicable to SIFMSPs, including as concerns (1) their organisation and management, including the required corporate form and organs and independence of certain supervisory board members, the required establishment of audit, risk, and governance and nomination committees, the need for independent control functions, including compliance, risk management and internal audit functions, requirements relating to managers, professional integrity and suitable expertise, and required business organisation, supervision and management; (2) capital requirements; (3) strategic decisions; (4) outsourcing; (5) conduct of business and risk management, including ICT, investment, legal and operational risks, recovery and orderly wind-down planning, business continuity and service availability, digital operational resilience, incident management, classification and reporting, access and participation criteria for the provision of services, communication processes and standards, and the disclosure of rules, key procedures and market data . 1.8 The draft law introduces new provisions governing the oversight by the NBB of FMSPs, including, but not limited to, SIFMSPs. The NBB must ensure that FMSPs operate at all times in compliance with the draft law and its implementing decrees and regulations. In this context, the NBB may request information from, and carry out on-site inspections at, FMSPs and their agents and entities to which a SIFMSP has outsourced activities, and SIFMSPs would be required to impose a contractual obligation on these agents and entities to fully cooperate with the NBB when it requires such information or carries out on-site inspections. The NBB may also recover from FMSPs the operating costs relating to its oversight. The NBB’s other powers and tasks with respect to SIFMSPs, in particular, include (1) classifying a FMSP as a SIFMSP on the basis of the threshold established under the draft law; (2) approving the appointments of new directors and certain other functions; (3) specifying requirements in terms of capital, retained earnings and reserves and monitoring compliance with capital requirements; (4) authorising certain strategic decisions and outsourcing decisions of critical or important functions; (5) receiving reports and other information on risk management (business continuity plan) and on digital operational resilience (ICT business continuity and incidents); (6) taking various measures in case of non-compliance or threat to the stability and continuity of financial transactions or to the proper functioning, soundness and effectiveness of clearing, settlement and payment systems and the stability of the financial system in general, including prohibiting the distribution of dividends or profits, imposing more stringent capital requirements, requiring the reduction of risks inherent in the SIFMSP’s activities or organisation (if

necessary by disposing of all or part of its activities or network), imposing additional reporting obligations, the appointment of a special statutory auditor, the replacement of all or part of management or the appointment of interim administrators; (7) imposing periodic penalty payments, administrative fines and other measures in case of certain infringements; and (8) adopting certain regulations under the draft law . 1.9 The draft law provides that the NBB may conclude non-binding cooperation arrangements with Union authorities and the authorities of Member States of the European Economic Area (EEA) and of third countries that are entrusted with missions equivalent to those of the NBB under Article 8 of the Organic Law of the NBB, as well as with the central banks or monetary authorities of the Union, other EEA Member States and third countries. When the oversight of a SIFMSP is the subject of such a cooperation arrangement, the NBB must carry out its tasks under the draft law in support of such cooperation. The NBB must first consult with the other participants to such cooperation arrangements when it intends to issue a communication, recommendation or circular or to adopt a regulation under Article 8 of the Organic Law of the NBB. The NBB may disclose to the other participants to such cooperation arrangements confidential information of which it becomes aware by virtue of the exercise of its powers under the draft law, under the conditions determined by the Organic Law of the NBB . 1.10 The draft law is intended to enter into force on 1 January 2026 .

2. Observations

2.1 SWIFT is a limited liability cooperative company that provides messaging services to financial institutions and market infrastructures across the globe. Through its financial messaging services that provide a secure, standardised, and reliable platform for financial institutions to exchange information about transactions, SWIFT fulfils a crucial role in facilitating correspondent banking and financial market infrastructure activities. It underpins the global financial infrastructure, enabling seamless cross-border transactions and fostering trust in international financial operations. Such a fundamental role for the global financial industry creates significant systemic dependency on SWIFT. 2.2 Against this backdrop, the ECB strongly welcomes the draft law, which provides a more robust legal basis for the NBB’s tasks relating to the oversight of FMSPs and SIFMSPs such as SWIFT, thereby strengthening the NBB’s oversight function. Transitioning from a framework based on soft law instruments and moral suasion to a legally binding framework will facilitate the addressing of compliance issues by entities that carry out financial messaging-related activities. The ECB also welcomes the NBB’s capacity under the draft law to reinforce and clarify its role as overseer of

FMSPs and, more particularly, SIFMSPs such as SWIFT by imposing legally binding requirements on these entities and their agents . 2.3 SWIFT has been subject to oversight since 1998. The G10 central banks have formalised an oversight arrangement for the purpose of monitoring the adequate and safe functioning of SWIFT as a critical service provider. In addition to the participating G10 jurisdictions, the BIS and the ECB are represented in the relevant international working groups. As noted in the explanatory memorandum, since SWIFT is headquartered in Belgium, the NBB acts as the lead overseer and chairs the international oversight meetings. This oversight primarily focuses on ensuring that SWIFT has in place effective controls and processes to avoid posing a risk to the financial stability and the soundness of financial market infrastructures. In this context, the ECB strongly welcomes that the draft law provides an explicit legal basis for the NBB to conclude cooperation arrangements with, consult with, and disclose confidential information to, the ECB and the central banks and monetary authorities of the EEA Member States and other countries in support of the NBB’s performance of its oversight tasks under the draft law. The ECB understands that the cooperative oversight of SWIFT will continue to be governed by the existing G10 cooperative arrangement, which will remain in force unaffected, in this particular respect, by the draft law. In this context, the ECB also understands that the existing G10 cooperative arrangement will benefit from the provisions of the draft law on a going-forward basis. 2.4 Finally, the ECB understands that, in drafting the bill, the competent national authorities have taken into consideration, and will interpret the draft law in conformity with, all relevant existing and pending Union legislation .

This opinion will be published on EUR-Lex.

Done at Frankfurt am Main, 17 January 2025.

[signed]

The President of the ECB

Christine LAGARDE