European Association of Co-operative Banks Groupement Européen des Banques Coopératives Europäische Vereinigung der Genossenschaftsbanken

Transcription

1 EACB answer to the Commission s Green paper Towards an integrated European Market for Card, Internet and Mobile Payments The European Association of Co-operative Banks (EACB) is the voice of the cooperative banks in Europe. It represents, promotes and defends the common interests of its 28 member institutions and of co-operative banks in general. Co-operative banks form decentralised networks which are subject to banking as well as co-operative legislation. Democracy, transparency and proximity are the three key characteristics of the cooperative banks business model. With locally operating banks and outlets co-operative banks are widely represented throughout the enlarged European Union, playing a major role in the financial and economic system. They have a long tradition in serving 181 million customers, mainly consumers, retailers and communities. The cooperative banks in Europe represent 51 million members and employees and have a total average market share of about 20%. For further details, please visit The voice of local and retail banks, 51 million members, 181 million customers EACB AISBL Secretariat Rue de l Industrie B-1040 Brussels Tel: (+32 2) Fax (+32 2) Enterprise lobbying register secretariat@eurocoopbanks.coop

2 Introductory remarks The EACB appreciates the opportunity to comment on the Green Paper Towards an integrated European market for card, internet and mobile payments. Representing roughly 4000 banks it has a keen interest in this market and would like to express the following observations. General observations To start with, the EACB would like to make a number of general observations on the document and its content as follows: o Need to set the debate in the right context The EACB in principle shares the vision laid out in Chapter 3 of the Commission paper. But we need to stress that a discussion on an integrated market for card, internet and mobile payments cannot make abstraction of the wider context in which those means of payment operate. In particular: The national payment markets that exist today reflect the still existing differences in economic development, cultural background, customer preferences and regulatory framework of the different Member States. This held true for the different credit transfer and direct debit schemes that were developed for the different national markets and still holds true for the market offer for other payment instruments. These difference need to be taken into account; The market for innovative means of payment such as e- and m-payments is vibrant as evidenced by the multitude of payment instruments that are being launched. It would be incorrect to consider that there is not enough choice for the user. There is in fact more than enough; Developments in the market for payments and cards are heavily influenced by developments on a global level. Looking at Europe in isolation may not be possible, depending on the particular payment instrument under consideration; The debate on e- and m-payments cannot be totally disassociated from the forthcoming migration to SEPA direct debit (SDD) and SEPA Credit Transfer (SCT). Indeed, the migration to SDD and SCT will make a fundamental contribution to the further integration of the European payments market. This being the case, it will also offer new grounds for innovation. Given that migration will not take place before 2017, it would seem premature to try and intervene in the payments market, whether by regulation, standardisation or otherwise. 2

3 o Finally, we regret that the Commission paper claims that Payments have been identified as one of the main barriers to the future growth of e-commerce. While we do not deny that payment security, for example, may be an issue keeping consumers from engaging in e-commerce transactions, we would like to warn against mixing payment, payment fraud and general on-line fraud in the same hat when it comes to statistics. Looking at publications such as the European Parliament s IMCO committee report of , payments are listed only as one out of 13 issues to be addressed. We would therefore ask the Commission to take care in qualifying e-commerce as one of the main barriers as it risks misguiding readers as to the sense of urgency that needs to be attached to the issues under consideration. Scope payments in euro or payments in any currency of the EU? It is not clear whether the questions in the Green Paper are addressing payments in euro or payments in any currency of the EU. Terms like SEPA (Single Euro Payment Area) and integrated European market are used interchangeably. Fact is that the integration of the market for euro payments is further advanced than that for payments in the EU in general. It would be helpful to know whether the integration objectives pursued by this paper target the former or the latter. Indeed the problems perceived and solutions to be provided may differ accordingly. The EACB has approached most questions in the green paper as targeting payments in euro. o Cash is missing Much of the thinking underlying the reasoning in the paper is around non-cash payments. Cash payments, however, still accounted for 78% of Europe's 388 billion retail payment transactions in 2008, according a study by Retail Banking Research (RBR). The total cost of distributing, managing, handling, processing and recycling cash and of accepting cash payments was 84 billion; equivalent to 0.60% of Europe's GDP or 130 per person. With the objectives of the paper focused on market integration and one of the concerns being that consumers should be steered towards the most efficient payment instruments, we would have expected the paper to have addressed also this side of the payment market. o Cheques are missing A similar remark applies to cheques. Cheques are still a commonly used means of payment in countries like France (19% of non cash payments in 2009), UK (16%) and Ireland (13%) for example. In terms of processing they are a very inefficient means of payment generating high costs. It is surprising that a green paper focused on innovation does not explore questions around the possibilities to phase out the use of such means of payment. mments Answers to questions Multilateral Inter-change Fees (MIFs) 1) Under the same card scheme, MIFs can differ from one country to another, and for cross-border payments. Can this create problems in an integrated 1 Consumer behaviour in a digital environment, IMCO 3

4 market? Do you think that differing terms and conditions in the card markets in different Member States reflect objective structural differences in these markets? Do you think that the application of different fees for domestic and cross-border payments could be based on objective reasons? From the EACB perspective, in formulating this question, the European Commission is putting the cart before the horse. Indeed, in our view the convergence of MIF levels is something that should be the result of an integrated market for payments, not something that precedes it. If the MIF levels of today are different this is because too many differences still exist between Member States in the way their payment markets are built up, which in turn can be brought back to reflect: - different national payment habits which have developed as a result of historical development and economic context; - different legal frameworks (PSD, AML, E-money implementation, interventions in pricing of certain payment instruments); and - differences in general economic context. The differences that may exist in MIFs between countries can be explained by: - differences in cost base (funding, labour, electricity costs, need to cross-subsidise other means of payments because they are expected to be free of charge such as cash and cheques); - differences in size of the market and therewith economies of scale; - differences in consumer/merchant preference for services (e.g. guarantee yes/no, prefer debit card over credit card or reverse). We note that the Eurosystem, in its response to the green paper, seems to agree with this view point in that is stresses that differentiation based on geographic criteria should disappear over time in line with the national markets convergence process induced by the SEPA framework for Cards. In addition, MIFs, like any other price, are a way to compete with other card providers for the attention of potential buyers. In the specific context of SEPA for cards, domestic schemes that want to achieve stronger acceptance outside their country or origin, can use their MIF as a tool to attract foreign acquirers. Finally it should be noted that the level of MIF is published by card schemes and therefore transparent 2) Is there a need to increase legal clarity on interchange fees? If so, how and through which instrument do you think this could be achieved? No. In principle, articles 101 and 102 of the Treaty on the Functioning of the European Union lay the ground rules for dealing with questions around the validity of interchange. Parties active in the market for payments that employ or would envisage employing interchange fees may wish to seek to achieve legal certainty going beyond what is offered by articles 101 and 102. However, it is EACB s view that developing at EU level generic advice that aims to provide legal certainty on the use of interchange in the market still as fragmented as the internal market of the EU is, is prone to a high degree of risk in terms of unintended side effects. It would risk killing further efforts to innovate and integrate the European payments market in the bud. The EACB believes that additional guidance to achieve increased legal certainty should be asked for and provided on a case by case basis whether in the existing card context or in the context of future e- and m-payment solutions. 4

5 3) If you think that action on interchange fees is necessary, which issues should be covered and in which form? For example, lowering MIF levels, providing fee transparency and facilitating market access? In line with our answer above, we would like to repeat under this question that the development of generic measures in the still fragmented market that the internal market of the EU is, is prone to a high degree of risk in terms of unintended side effects. It would risk killing further efforts to innovate and integrate the European payments market in the bud. The decision of the Reserve Bank of Australia to intervene and cap VISA and MasterCard interchange fees shows that the consequences of regulatory intervention can be unpredictable and unexpected. Intended to increase efficiency, transparency and competition, the decision would seem to have resulted in, amongst other, less innovation/slowdown in investments in chip & PIN, no evidence that the savings created for merchants were effectively passed on to consumers. If a decision like this, taken in an integrated market like Australia, already does not deliver on its original intentions, it would seem more than ill advised to attempt taking EU wide measures for the still fragmented European market. It would risk killing further efforts to innovate and integrate the European payments market in the bud. Any additional guidance should be asked for and provided on a case by case basis, whether in the existing card context or in the context of future e- and m-payment solutions. Cross-border acquiring 4) Are there currently any obstacles to cross-border or central acquiring? If so, what are the reasons? Would substantial benefits arise from facilitating cross-border or central acquiring? 5) How could cross-border acquiring be facilitated? If you think that action is necessary, which form should it take and what aspects should it cover? For instance, is mandatory prior authorisation by the payment card scheme for cross-border acquiring justifiable? Should MIFs be calculated on the basis of the retailer s country (at point of sale)? Or, should a cross-border MIF be applicable to cross-border acquiring? The foundations for an open and non-discriminatory market for (cross border) (issuing and) acquiring are laid in the EPCs SEPA Cards Framework where paragraph 3 tackles the requirements for scheme rules, interchange and interoperability, and standardisation. The EACB continues to support the principles laid down in this framework. It would consider that moral suasion from supervisors towards the incumbents of the SEPA Cards framework on areas where insufficient progress is being made is the most appropriate tool to apply. We are not sure to understand what is meant with the question on mandatory prior authorisation. Notice to a scheme before acquiring in a Member States is started is needed to allow issuers to be informed and ensure the proper functioning of the scheme. As for the question on MIF, domestic transactions should be subject to the applicable domestic MIFs, irrespective of the geographic origin of the acquirer. International transactions should be subject to the applicable cross-border MIF. These MIF s are a cost 5

6 component in the Merchant Service Charge (MSC) for the specific markets and will therefore differ from that perspective. An important precondition is that any domestic rules or best practices be made available by the schemes to all (potential) acquirers. Co-badging 6) What are the potential benefits and/or drawbacks of co-badging? Are there any potential restrictions to co-badging that are particularly problematic? If you can, please quantify the magnitude of the problem. Should restrictions on co-badging by schemes be addressed and, if so, in which form? Co-badging (to be understood as the co-existence of multiple payment applications on a payment enabled chip carrier, be it card or phone) can improve the user experience both from the consumer and the merchant perspective in terms of reach (possibility to shop in more shops, possibility to get more purchases) and service level. It would allow payment schemes or solutions with limited reach or a limited service level to overcome their weaknesses without having to make the substantial investments otherwise required. Indeed, it takes away incentives for such schemes/solutions to overcome their weaknesses. The reverse side of this medal though is that there are payment schemes/solutions which have invested in reach and service level that have to accept cobadging with such more limited schemes/solutions. The question on whether or not restrictions by schemes on co-badging should be addressed does in our view not have a universal answer. It will depend on the schemes/payment solutions involved in a given co-badging case, on the user experience that the issuer of the chip carrier wants to provide its clients with, the commercial offering that it can build and the business case that can be developed. 7) When a co-badged payment instrument is used, who should take the decision on prioritisation of the instrument to be used first? How could this be implemented in practice? See SEPA Cards framework paragraph 3.6.1: Card scheme rules must enable and facilitate for cardholders a consistent payment and cash withdrawal service experience throughout SEPA. In accordance with Directive 2007/64EC, where several payment applications are made available by the issuer in the same card, supported by the same terminal, and are accepted by the merchant, cardholders will have through their cardholder agreement with their card issuer the choice of which payment application they will use provided the merchant accepts it and its POS equipment supports it. The agreement between the cardholder and the issuer will define the choices available to the cardholder. Prevalence at POS or ATM for a particular payment application may not be mandated by a card scheme or ATM operator or merchant The Cards Standardisation Volume further elaborates on this issue as well. Separating card schemes and card payment processing 6

7 8) Do you think that bundling scheme and processing entities is problematic, and if so why? What is the magnitude of the problem? If the SEPA Cards framework addresses the matter then it can be assumed that the payments industry united in the EPC considers it an issue worth addressing. And EACB would subscribe to that. Having said that, the members of EACB do not report any problems in this area. Indeed, our members stress that the most important driver for bringing processing costs down and therewith improve the offer to merchants and consumer is the creation of economies of scale. Whether these economies of scale are offered by a scheme which also offers processing or by a separate processor is less relevant. From the perspective of our members, the totality of schemes and processors presently on the market offer sufficient choice. From our point of view therefore, no additional action is necessary. 9) Should any action be taken on this? Are you in favour of legal separation (i.e. operational separation, although ownership would remain with the same holding company) or full ownership unbundling? See question 8 Access to settlement systems 10) Is non-direct access to clearing and settlement systems problematic for payment institutions and e-money institutions and if so what is the magnitude of the problem? Clearing and settlement systems are subject to the strict requirements of the Settlement Finality Directive and the supervisory requirements imposed by the Eurosystem. Indeed, the internationally accepted Core Principles for Systemically Important Payment Systems (SIPS), defined by the Committee on Payment and Settlement Systems (CPSS) and adopted by the Governing Council in 2001 apply to so-called systemically important payment systems such as TARGET, Euro 1 and Step 2. Retail payment systems and their underlying clearing and settlement systems do not have to respect all of the Core Principles but still an important number. The standards to be respected by these systems are described in the ECB Oversight standards for euro retail payment systems and cover, among many others, the management of financial risk (e.g. collateral requirements), settlement assets (preferably a claim against a central bank) and access criteria. On access criteria specifically it reads that.imposing restrictions on access may be warranted in order to protect participants against undue risks resulting from the participation of other parties. These oversight requirements are complemented by article 28.1 of Directive 2007/64/EC (PSD) which speaks of right of access having to be: objective, non-discriminatory and proportionate and as not inhibiting access more than is necessary to safeguard against specific risks such as settlement risk and business risk and to protect the financial and operational stability of the payment system. In the context of the above, it may be useful to note that it is not always necessary to have direct access to clearing and settlement systems. Indeed, not all banks are direct participants in all clearing and settlement mechanisms either. Sometimes this is because they do not meet the requirements of the clearing and settlement system, sometimes it is voluntary. In these cases, banks have contracted the services of other banks to 7

8 provide them with access to a given clearing and settlement system. Payment institutions and e-money institutions can do the same. 11) Should a common cards-processing framework laying down the rules for SEPA card processing (i.e. authorisation, clearing and settlement) be set up? We are not sure to understand the question. In general we would like to recall that the Eurosystem s oversight framework for card payment schemes issued in 2008, already addresses requirements to be adhered to by card schemes to ensure the reliability of card payment schemes. This framework addresses measures to be taken to manage and contain financial risks in relation to the clearing and settlement process of cards processing, whether outsourced or not. On the clearing and settlement side of the question we would like to remind that the clearing and settlement of card payments uses pull clearing i.e. merchants are paid by the acquiring bank before the acquiring bank may have received the corresponding amount from the issuing bank. The predominant issue in card clearing is thus the prevention of credit or liquidity risk as the occurrence of this risk can result in failure of the system which in turn can affect the stability of the payment system as a whole. Rules and standards already exist (see question 10) to ensure the proper functioning of clearing and settlement systems. We do not see the need to create another. On the authorisation side of the question, if authorisation is meant as a framework which allows to decide which organisations are authorised to offer card clearing and settlement services, we consider that between the oversight documents mentioned under question 10 and the one mentioned here, the supervisors have ample material to judge whether clearing and settlement mechanisms should be authorised to offer their services. Should it lay out terms and fees for access to card processing infrastructures under transparent and non-discriminatory criteria? We are not sure to understand what is meant by card processing infrastructures. We could imagine that objective, non-discriminatory and proportionate access criteria should be developed as is the case for the systems targeted under article 28 PSD. Should it tackle the participation of Payment Institutions and E-money Institutions in designated settlement systems? Should the SFD and/or the PSD be amended accordingly? No. See our answer to question 10 and 11 above. Compliance with the SEPA Cards Framework (SCF) 12) What is your opinion on the content and market impact (products, prices, terms and conditions) of the SCF? Is the SCF sufficient to drive market integration at EU level? Are there any areas that should be reviewed? Should non-compliant schemes disappear after full SCF implementation, or is there a case for their survival? EACB believes that the SCF together with the Cards standardisation volume that is under development provides for a solid starting point which will allow the European cards 8

9 market to evolve towards a more integrated market for card payments in euro. Moral suasion from supervisors would be useful to ensure that incumbents of the framework are encouraged to comply with its provisions. This does not preclude that the SCF should not be reviewed from time to time, although it has to be noted that a certain amount of stability in the targets to be achieved is vital for market players to actually invest in making changes. Targets that are redefined too frequently will discourage the appetite to invest in change. Information on the availability of funds 13) Is there a need to give non-banks access to information on the availability of funds in bank accounts, with the agreement of the customer, and if so what limits would need to be placed on such information? Should action by public authorities be considered, and if so, what aspects should it cover and what form should it take? The way in which banks manage the setting up and administration of the accounts with their clients is governed by different sets of legislation: - the Payment Services Directive - the Anti-Money Laundering Directive - financial sanctions legislation - the Regulation on information on the payer - the SEPA End Date Regulation - the Settlement Finality Directive - data protection legislation The collective weight on banks of this legislation in terms of capital requirements, investments in procedures, systems, training, contracts etc is very heavy. Question 13 should therefore not be considered lightly. The question on access to such information by non-banks raises a number of counter questions: - Which are the non-banks that are referred to? As this question is asked in the context of this green paper, we can only assume that access to information on availability of fund of the account of a client of a bank is necessary in case the intention is to use it for making a payment. Our starting point would therefore be that the non-banks referred to would have to be PSPs as defined by the requirements of the Payment Services Directive. - How can we ensure that banks when providing access to information on availability of funds on a given client account, are still able to fulfil their requirements under the different sets of legislation that they have to comply with? We can only assume that the burdens in the area of security, fraud, liability for unauthorised payments, data protection, financial sanctions legislation, anti terrorist measures etc would transfer to those third parties with the access that is obtained. The account holder should be made aware of this by the entity that offers the service and requires the access to the customer s bank account. - How can we ensure that banks are able to defend themselves against any claims of fraud, abusive behaviour, unauthorised transactions, breach of data protection legislation, financial sanctions legislation, terrorist measures? An audit trail should be established that allows investigation to take place and the information made available can only be valid for the point in time at which it has been given. 9

10 In addition, we would imagine that the Forum on the Security of Retail Payments (SecuRe Pay) that was recently established by the Eurosystem, should have a look at the security issues that such access may bring to bear. All in all, the regulator should thoroughly assess whether the expected benefits of creating access to the information on availability of funds weighs up against not only the cost of investment but also the increase in exchange of data belonging to private individuals and the increase in complexity for the customer in understanding what service he receives and to which risks it exposes him/her. Finally, if such access is to be made available, banks would have to build completely new applications for the interaction with their clients. Present applications are aimed at providing customer with a complete overview of all the services purchased/contracts engaged in with their bank. An application would have to be foreseen that carves out the information on the availability of funds on a given payment account only and can answer to queries. The development of such application should be considered as a separate service provided by banks which should be remunerated by the non-banks who receive the access. Dependence on payment card transactions 14) Given the increasing use of payment cards, do you think that there are companies whose activities depend on their ability to accept payments by card? Please give concrete examples of companies and/or sectors. If so, is there a need to set objective rules addressing the behaviour of payment service providers and payment card schemes vis-à-vis dependent users? No. There may well be companies that are heavy users of card (or card based) payments. But they most likely choose this means of payment for the particular features that it offers, such as, for example an immediate and guaranteed payments. Nothing prevents these companies from accepting a credit transfer, a one-off SEPA direct debit, a PayPal payment other than commercial considerations. Transparent and cost-effective pricing of payment services for consumers, retailers and other businesses Consumer merchant relationship: transparency 15) Should merchants inform consumers about the fees they pay for the use of various payment instruments? Should payment service providers be obliged to inform consumers of the Merchant Service Charge (MSC) charged / the MIF income received from customer transactions? Is this information relevant for consumers and does it influence their payment choices? We do not believe that this information is relevant for consumers or that it influences their payment choices materially. Customers base their choices on many other criteria. In addition, consumers are also not provided with any other cost associated with the selling of products such as labour costs, rent, the cost of the wrapping in which products are delivered to them or the plastic/paper bags in which their purchase is being handed over to them. 10

11 We also find that this question oversimplifies the way in which merchants may choose to offer a certain payment instrument and how he could calculate the cost for a given payment instrument. He may choose a given payment instruments for reasons other than costs. As for the calculation of the cost for a given payment instrument, how would the merchant determine the cost of cash for a give product. He could divide the overall costs he has by the number of products sold but he only knows the number of products sold after he sold them. If there would be a decision to have merchants inform consumers about the fees paid for the use of the various payment instruments, then this should apply to all means of payment, including cash and cheques, in all Member States. The Commission should then also consider introducing such obligation on other costs that the merchant incurs when selling his product. Consumer merchant relationship: rebates, surcharging and other steering practices 16) Is there a need to further harmonise rebates, surcharges and other steering practices across the European Union for card, internet and m-payments? If so, in what direction should such harmonisation go? Should, for instance: certain methods (rebates, surcharging, etc.) be encouraged, and if so how? surcharging be generally authorised, provided that it is limited to the real cost of the payment instrument borne by the merchant? merchants be asked to accept one, widely used, cost-effective electronic payment instrument without surcharge? specific rules apply to micro-payments and, if applicable, to alternative digital currencies? In general, we believe that the practices described are part of the commercial strategy that a given merchant may choose for putting his product in the market. We would therefore be of the opinion that they should not be the subject of any regulatory discussion (and should not have been part of the discussion on MIF). Now that they have been addressed in this paper, we should look at the context in which they are being put forward by the regulator. The Commission Green paper speaks of a more integrated payment market, more choice and transparency for consumers, promoting the use of more efficient payment instruments, and of more competition also cross border. Taking these various objectives into consideration, it would seem to the EACB that the above mentioned practices if to be supported at EU level should only be allowed under the following conditions: - It should be possible to apply them to all payment instruments, including cash and cheques. Only in applying it to all payment instruments (including those offered by non-banks) would the right incentives be created for more efficient payment instruments to be used; - The same rule should apply across all EU member states. Otherwise a barrier would be created to the development of new pan-european payment solutions and to competition between payment instruments cross border; - Any of these practices should only be allowed if at least one other payment instrument is offered. Otherwise, there would be no choice for the consumer; - These practices should not be misused as an additional source of income. In particular surcharging should only cover the actual incremental cost of the one payment 11

12 instrument over the other; otherwise it would not be transparent to the consumer which is the cheaper payment instrument. Merchant payment service provider relationship 17) Could changes in the card scheme and acquirer rules improve the transparency and facilitate cost-effective pricing of payment services? Would such measures be effective on their own or would they require additional flanking measures? Would such changes require additional checks and balances or new measures in the merchant-consumer relations, so that consumer rights are not affected? Should three party schemes be covered? Should a distinction be drawn between consumer and commercial cards? Are there specific requirements and implications for micropayments? Price transparency, freedom of choice and a level playing field are important principles also within this context. They have been addressed in the SEPA Cards Framework. No additional measures are required. Standardisation 18) Do you agree that the use of common standards for card payments would be beneficial? What are the main gaps, if any? Are there other specific aspects of card payments, other than the three mentioned above (A2I, T2A, certification), which would benefit from more standardisation? Work is presently being undertaken by the EPC and the Cards Stakeholders Group to define, based on standards already developed at the level of ISO, a set of functional and security requirements that ensure a consistent implementation by all parties in the cards market. This work will address the issues raised in the green paper but demands investment and time. 19) Are the current governance arrangements sufficient to coordinate, drive and ensure the adoption and implementation of common standards for card payments within a reasonable timeframe? Are all stakeholder groups properly represented? Are there specific ways by which conflict resolution could be improved and consensus finding accelerated? It is always difficult to get the governance of a given project perfect. If one looks close enough, improvements can always be made. Nevertheless, it would seem to the EACB that in the area of cards, the EPC governance has evolved enormously over the years and that the involvement of stakeholders is now well organised. This does not, of course, do away with the fact that the EPC has no enforcement power. We believe that moral suasion of supervisors could help in furthering the implementation of the results achieved. 20) Should European standardisation bodies, such as the European Committee for Standardisation (Comité européen de normalisation, CEN) or the 12

13 European Telecommunications Standards Institute (ETSI), play a more active role in standardising card payments? In which area do you see the greatest potential for their involvement and what are the potential deliverables? Are there other new or existing bodies that could facilitate standardisation for card payments? We consider the present governance arrangements for cards to be working quite well. Different stakeholders are involved, which means that concerns about standardisation in the cards area are addressed from different angles. Unless there is solid evidence that the present cards stakeholder group is overlooking certain standardisation issues, no further change should be brought to the present governance. This will only create further and unnecessary delays in the standardisation process. 21) On e- and m-payments, do you see specific areas in which more standardization would be crucial to support fundamental principles, such as open innovation, portability of applications and interoperability? If so, which? While the principles put forward in the question can be supported in general, it seems too early to try and fix areas of standardisation in this domain by way of regulation. E- & m-payments are fields of innovation for which a number of areas are still in development. At the moment, a number of market participants are piloting solutions on a trial basis. Exploratory work is going on at the level of EPC, in consultation with stakeholders, on questions like interoperability in the area of remote and contactless m-payment solutions. On the other hand, some more potential for e/m-payments solutions development will open up when migration to SCT and SDD has matured. The potential that will become available after SCT and SDD Migration should not be stifled by standardisation done before. The only area where a debate on standards could be useful is that of minimal security standards required to allow the protection of customer funds, customer data, and prevent operational, credit and liquidity risk from entering the payment system. We understand that the SECUREPAY forum of the ECB is presently looking into this question and we are looking forward to the publication of its results. 22) Should European standardisation bodies, such as CEN or ETSI, play a more active role in standardising e- or m-payments? In which area do you see the greatest potential for their involvement and what are the potential deliverables? Not yet. Interoperability between service providers Interoperability and competition 23) Is there currently any segment in the payment chain (payer, payee, payee s PSP, processor, scheme, payer s PSP) where interoperability gaps are particularly prominent? How should they be addressed? What level of interoperability would be needed to avoid fragmentation of the market? Can minimum requirements for interoperability, in particular of e- payments, be identified? 13

14 In answering this question we should not forget that many an e/m or sometimes even card payment results in a credit transfer or direct debit. As such, e- and m-payments are often not separate payment flows but means of initiating a credit transfer or direct debit. The interoperability for credit transfers and direct debit has been regulated in the regulation on end dates for SEPA migration. Interoperability in the markets for card payment is being addressed as part of the work on the book of requirements presently undertaken by the Cards Stakeholder Group. For mobile, EPC has published a set of interoperability implementation guidelines which was developed in consultation with stakeholders involved in the mobile ecosystem. They address the interoperability issues between the different stakeholders involved and the life cycle management of mobile payments. It is based on GlobalPlatform s open infrastructure for smart card deployments. Its technology supports multi-application, multi-actor and multi-service model implementations, which delivers benefits to different service providers (e.g. payments, transport, ticketing, loyalty, health insurance) and their customers. As for e-payments, work was initiated by EPC but stopped when queried by the competition authorities of the European Commission. From the EPC work undertaken so far, it would seem that, as far as the interoperability of e-payment schemes is concerned, it would be necessary to address the payment initiation and payment confirmation messages. 24) How could the current stalemate on interoperability for m-payments and the slow progress on e-payments be resolved? Are the current governance arrangements sufficient to coordinate, drive and ensure interoperability within a reasonable timeframe? Are all stakeholder groups properly represented? Are there specific ways by which conflict resolution could be improved and consensus finding accelerated? It is inaccurate to describe the work in the area of m-payments as being in a stalemate. Work has been and is still being undertaken by the EPC. As for the question on governance, we are not aware of any issues but are open to comments from others. Payments security 25) Do you think that physical transactions, including those with EMVcompliant cards and proximity m-payments, are sufficiently secure? If not, what are the security gaps and how could they be addressed? According to our current assessment, EMV provides the appropriate level of security for contact and contactless transactions in Europe when implemented correctly across the payment chain. However, the worldwide deployment of EMV is essential to fill any remaining security gap (use of magnetic stripe and risk of skimming). Whilst security is currently deemed to be sufficient, potential fraud threats need to be anticipated and further mitigation may need to be put in place within the card payments chain if required. Security is in constant development and can never be considered complete. 14

15 For m-payments, a potential weak point is the mobile phone (or its operating system) which is not specifically designed for the purpose of providing a trustworthy user interface for payments like current point of sale terminals. The technology of mobile handsets, however, does offer the opportunity for further security enhancements. Moreover, a better market take-up of standards for the secure management of mobile payment applications on mobile phones (e.g., Global Platform) is needed. From a PSP perspective, it is crucial for the market to retain the flexibility to be able to regularly review the methods and systems that are used to achieve the necessary level of security in response to the changing risk profile in the market. It should be recalled that all PSPs, that are licensed / regulated are also already being supervised in that regard by their regulators with the objective of ensuring that they continue to be watchful and responsive in this area. In order to ensure integrity and security of payments all providers should be appropriately regulated and supervised. 26) Are additional security requirements (e.g. two-factor authentication or the use of secure payment protocols) required for remote payments (with cards, e-payments or m-payments)? If so, what specific approaches/technologies are most effective? Technology in this space is constantly evolving. It is therefore not appropriate to mandate, through regulation, the adoption of specific measures such as two-factor authentication. In order to maintain the levels of security that the market needs, it is critical for PSPs to have the flexibility to take a dynamic approach to risk management, based on available security technologies, customer impact and cost/benefit considerations. The fast development of the e-commerce area needs market-driven solutions and the payer PSP/card issuer should be in charge of deciding the means of authentication after assessing the relevant level of risk associated with it. It is not advisable to allow these payments without a secure payment application requiring effective cardholder identification since exposure to fraud and misuse will cause monetary losses and hinder the development of e-commerce. A set of common security requirements is needed in order to ensure the integrity of retail payments. 27) Should payment security be underpinned by a regulatory framework, potentially in connection with other digital authentication initiatives? Which categories of market actors should be subject to such a framework? Please refer to the response supplied for question 26. A level playing field between the various actors should be ensured. In general terms, it is our view that a regulatory framework for payment security would risk stifling innovation in the area of payment services and not be capable of keeping pace with the constant evolution of security requirements in order to combat fraud. 28) What are the most appropriate mechanisms to ensure the protection of personal data and compliance with the legal and technical requirements laid down by EU law? The EACB would consider that the best way to do this would be to ensure compliance by all incumbents, based on a level playing field, of the legislative framework presently in place. The same principles should apply to the new regulatory framework that is under development. In addition, we would call for the additional obligations put forward under 15

16 the proposal for a Regulation on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) to be carefully evaluated from the cost/benefit perspective. STRATEGY IMPLEMENTATION/GOVERNANCE Governance of SEPA 29) How do you assess the current SEPA governance arrangements at EU level? Can you identify any weaknesses, and if so, do you have any suggestions for improving SEPA governance? The EACB recognizes that there is a discrepancy between its own perception of the way in which the governance of the SEPA process thus far has been appropriate to take into account users interest and the perception of other stakeholders. It continues to regret the rather harsh judgments from other stakeholders and regulators, sometimes too easily overlooking the very valid reasons that could be found for things having been organized the way they were. We cannot repeat often enough, for example, how difficult it is to manage the fact that the interests between different user groups or between user groups in different countries are not always the same. To equate the fact that an EPC decision might not be agreeable to a certain party with the conclusion that the EPC would not listen to or involve stakeholders is too easy. Having said that, the EACB is interested to move forward and ensure that the perceptions of supply and demand side converge. In this context, it would consider that: - The SEPA Council should take ownership of the SEPA project, guide and direct and arbitrate where necessary; - It should delegate the identification of needs to one or more stakeholder bodies, based on a clearly defined mandate in terms of deliverables, supported by all SEPA Council members. These needs, if proposed as requiring action, should be based on market assessments that represent the collective view of user communities across the EU. Impact assessments will have to accompany any proposals to develop solutions. To ensure this, a link with national SEPA bodies should be established. The SEPA Council should endorse the needs as requiring action before actual work is mandated; - The stakeholder body(ies) should also be used as a reference group to be consulted on proposals developed by the supply side to solve needs; - The exact modelling of the stakeholder bodies in terms of composition, funding, chairing and secretariat should depend on the topic under consideration; - The decision making mechanisms of the stakeholder bodies may vary depending on the subject at hand. It should be ensured, however, that those who will have to pay for the development of the solutions have the corresponding voting power; - Take-up of solutions that have been developed by the supply side on demand of the user side needs to be monitored; and - Banks will need to have a platform where they can prepare themselves for the discussions in the stakeholder layer. What overall balance would you consider appropriate between a regulatory and a self-regulatory approach? Do you agree that European regulators and supervisors should play a more active role in driving the SEPA project forward? 16

17 The market for payments is in principle a commercial one. The regulator should intervene as little as possible. It should limit itself to creating an environment that is inductive to the development of a safe, secure, stable, sound and competitive payments market. With the totality of the regulatory framework that was mentioned under point 13 and the supervisory framework in place, the foundations for such a market have already been more than largely laid. No further intervention should be contemplated. If anything, the Commission may wish to consider withdrawing legislation that limits the commercial freedom of parties to price their offer. The existence of such legislation with SEPA migration about to take place - actually risks freezing the economic models behind the payment industry in the different Member States and therewith reduce the convergence of cost/pricing models downwards. Governance in the field of cards, m-payments and e-payments 30) How should current governance aspects of standardisation and interoperability be addressed? Is there a need to increase involvement of stakeholders other than banks and if so, how (e.g. public consultation, memorandum of understanding by stakeholders, giving the SEPA Council a role to issue guidance on certain technical standards, etc.)? Should it be left to market participants to drive market integration EU-wide and, in particular, decide whether and under which conditions payment schemes in non-euro currencies should align themselves with existing payment schemes in euro? If not, how could this be addressed? We would not want to separate the discussion on governance on standardisation and interoperability out from the overall discussion on governance. If the SEPA Council has agreed that a certain need exists, the ensuing mandate for work to be undertaken by a given stakeholder group will have to determine whether standardisation issues and interoperability issues have to be addressed. 31) Should there be a role for public authorities, and if so what? For instance, could a memorandum of understanding between the European public authorities and the EPC identifying a time-schedule/work plan with specific deliverables ( milestones ) and specific target dates be considered? No, discussions on these issues should take place at the level of the SEPA Council and timelines should be set there. General remarks 32) This paper addresses specific aspects related to the functioning of the payments market for card, e- and m-payments. Do you think any important issues have been omitted or under-represented? Please refer to our general remarks above. 17