EBA s regulatory work on payments. Geoffroy Goffinet PAYMENT SYSTEMS MARKET EXPERT GROUP 03/12/2015

Transcription

1 EBA s regulatory work on payments Geoffroy Goffinet PAYMENT SYSTEMS MARKET EXPERT GROUP 03/12/2015

2 The role of the EBA The EBA was established by Regulation (EC) No. 1093/2010 of the European Parliament and EU Council; came into being on 1 January 2011; took over all existing tasks and responsibilities from the Committee of European Banking Supervisors (CEBS); took on additional tasks, incl. consumer protection, the monitoring of financial innovation, and payments; is an independent authority; is accountable to the EU Parliament and Council; has as its highest governing body the EBA Board of Supervisors, comprising the Heads of the 28 national supervisors. 1

3 EU Directives that fall in EBA s scope of action The EBA s scope of action is defined by the EU Directives and Regulations that are listed in Article 1(2) of the EBA Regulation, as well as any future Level-1 text that confers tasks on the EBA. Capital Requirements Directive (CRD/R IV) Bank Recovery and Resolution Directive (BRRD) Deposit Guarantee Scheme Directive (DGSD) Mortgage Credit Directive (MCD) Markets in Financial Instruments Directive (MiFID2/R, for structured deposits) Anti Money Laundering Directive (AMLD) Payment Accounts Directive (PAD) Electronic Money Directive (EMD) Interchange Fee Regulation (IFR) Payment Services Directive (PSD1 + forthcoming PSD2) 2

4 Legal instruments available to the EBA The EBA has different types of legal instruments at its disposal to achieve its objective of bringing about regulatory & supervisory convergence across the EU Technical standards Guidelines and recommendations Opinions / Technical Advice Warnings Temporary prohibitions Joint Positions Breach of Union law investigations Binding and non-binding mediation 3

5 Output of the EBA to date Since its creation in 2011, the EBA has issued more than 200 legal instruments and other publications (until Aug) Total (until Aug 2015) Regulatory Technical Standards Implementing Technical Standards Guidelines (+1 joint) 46 Opinions/Advice (+2 joint) Published reports 6 (+1joint) Recommendations Breach of Union Law investigations Mediations Peer reviews Warnings Stress tests

6 PSD2 mandates conferred on the EBA Based on the final trilogue text voted by the Parliament, the mandates conferred on the EBA in the PSD2 will comprise six technical standards, five sets of Guidelines, and a register. ID Article Type of deliverable Deadline after entry into force Coordination of home-host supervision A B C D Article 27 Settlement of disagreements between competent authorities of MS Article 28 Passporting: Co-operation and exchange of information between Home and Host authorities (notification) Article 29-6 Passporting: Framework for the cooperation and exchange of information between Home Host (supervision) Article 29-5 Passporting: Circumstances when the appointment of a central contact point is appropriate, and the functions of those contact points. Consumer Protection E F Procedure defined already in EBA Regulation RTS RTS RTS n/a 24 months 24 months 12 months Art 5: Minimum monetary amount of PII or comparable guarantee (PII) Guidelines 12 months Art 100 Complaints procedures Guidelines 24 months 5

7 PSD2 mandates conferred on the EBA (cont.) ID Article Type of deliverable Deadline after entry in force Authorisation of PSPs and registration of AIS G Register H I J K Art 5: Information to be provided to competent authorities in the application of the authorization for payment institutions Article 15 EBA register: EBA shall publish on its website, and shall update regularly, a list of the names of the registered entities. Article 15 Information to be provided by CAs to EBA for compiling the web register Article 15 Technical requirements on development, operation and maintenance of the register and on access of the information Article 32 EBA register: EBA shall publish on its website, and shall update regularly, a list of the names of the exempted entities &services. Guidelines (convertible later into RTS by EBA) Website register ITS RTS Website register 18 months No Deadline mentioned 18 months 24 months No Deadline mentioned 6

8 PSD2 mandates conferred on the EBA (cont.) ID Article Type of deliverable Security Article 96 L Improving incident reporting throughout the European Union Article 95 M Establishment, implementation and monitoring of the security measures, including certification processes where relevant Article 98 N Regulatory technical standards on strong authentication and communication (SCA/CSC) Guidelines Guidelines (later convertible into RTS if requested by COM) RTS Deadline after entry into force 24 months 18 months 12 months 7

9 Security (jointly with the ECB) Register Authorisation Consumer Protection Coordination of home - host supervision PSD2 mandates conferred on the EBA (fin.) EBA mandates in PSD2, and their timelines EBA deliverable: Entry into force of PSD 2 Entry into force + 12mths Entry into force + 18mths Entry into force + 24mths = Application date of PSD2 (incl. all EBA mandates, except N:) RTSs on Passporting Notification & on supervision Publication of CP with draft RTS RTS Central Contact Points GL on PI Insurance for PSPs GL on complaints procedures GL on PI authorisation First publications planned RTS/ITSs on EBA register GL on incident reporting GL on Security measures RTS on Strong Authentication & Secure Communication Publication of DP Adoption of RTS by EU Commission (date tbc) Entry into force of RTS (RTS adoption + 18 months, i.e. not before Sep )?? 8 Jan 2016 Jan 2017 July 2017 Jan 2018 Sep 2018

10 Strong authentication and secure communication: finding a balance between competing demands When developing the RTS on strong customer authentication & secure communication, EBA and ECB will have to make difficult trade-offs between competing demands. 3) Tough security standards vs. Facilitation of innovative industry solutions in the future (which may suggest a high degree of (which may suggest the opposite, i.e. high level prescription in the requirements to requirements that provide flexibility across firms & time); avoid circumvention of rules); 2) Tough security standards vs. Customer convenience (which may suggest that payment user (which may suggest the opposite, e.g. one-click payments); should be subject to several security and authentication steps); 1) High degree of interoperability vs. Flexibility for market participants between all ASPSPs and all PISPs/AISPs (which may suggest the opposite, i.e. high level (which may suggest one single standard/ requirements that in turn allow for different marketprotocol to be prescribed by the EBA); driven solutions); 9

11 Strong authentication and secure communication: finding a balance between competing demands (cont.) In its forthcoming Discussion Paper (DP) on the RTS on strong customer authentication and secure communication, EBA & ECB are likely to raise questions on five topics. The responses to the DP will be an input to the subsequent development of the RTS, on which EBA & ECB will consult in 2016Q2. Requirements for the strong customer authentication procedure; Exemptions to the application of strong customer authentication; Protection of the payment service users personalised security credentials; Requirements for common and secure open standards of communication; and Possible synergies with the regulation on electronic identification and trust services for electronic transactions in the internal market (e-idas); 10

12 Interchange Fee Regulation (IFR) The IFR has conferred a mandate on the EBA with regard to payment card schemes. Article 7 IFR: EBA to develop RTS establishing requirements to ensure payment card schemes and processing entities are independent in terms of: Accounting; Organisation; and Decision making. In order to ensure sufficient stakeholder input, the EBA will deliver this mandate within an extended timeline, of 12 months after entry into force of the Regulation; 11

13 Interchange Fee Regulation (IFR) (cont.) In order to collect industry s views before actually developing these RTS, the EBA organised a workshop with market participants in June 2015 and received valuable input from national competent authorities and market participants that had not participated in the workshop. This workshop gathered a sample of domestic and international four party card schemes, three party schemes, processing entities and card standardisation bodies in the EU. In addition, EBA has received inputs from national competent authorities and other national industry players that did not participate in the workshop. Main views expressed by market participants at that stage : Accounting independence : Will not prevent forms of price discrimination not covered by the mandate given to the EBA, such as high inter-regional interchange fees or high inter-regional processing fees 12

14 Interchange Fee Regulation (IFR) (cont.) Main views expressed by market participants at that stage : Organisation and decision-making process independence ( functional separation ): May require the duplication of staff in some areas and the potential splitting up of various activities or support services which had presented a certain degree of synergy implying increased scheme access costs for all scheme participants. No harmonised view of the list of services that should fall under the scope of processing as defined by the IF Regulation. Need for taking into account the development of innovations. Main views expressed also showed the need for the following clarifications regarding the mandate conferred on EBA by IFR: The mandate is not to require payment card schemes and processing entities to implement a legal separation; The mandate does not require to prevent payment card schemes from offering processing services via an independent processing entity; The mandate does not foresee any exemption for three party payment card scheme operating under a four party scheme model (exemption for three party payment card scheme only apply to chapter II of the IFR and so not article 7). 13

15 Interchange Fee Regulation (IFR) (cont.) Main views expressed also showed the need for clarifying the interplay between the entry into force of the RTS after adoption by the EU Commission and the application date of the IFR. In particular, market participants requested clarification related to the implications arising for payment card schemes in a scenario where the RTS will be adopted by the EU Commission and enter into force after the application date of Article 7 of the IFR. Such a scenario can arise with any technical standards developed by the EBA, for a number of reasons, including: a) The EBA requires more time than specified in the IFR to deliver the RTS to the Commission. This is the case here, given that the EBA already publicly stated that it will have to deliver the RTS later than the six months foreseen in the IFR, in order to gather necessary input prior to publishing its consultation paper. b) the time needed for the EU Commission to review and adopt the RTS and whether it proposes to amend the technical standards; or c) the extent to which the EU Council and EU Parliament exercise their scrutiny rights; 14

16 Interchange Fee Regulation (IFR) (fin.) In this regard the following clarification can be provided: a) The EBA s draft RTS will propose the specific requirements with which payment card schemes and processing entities have to comply to ensure the application of Article 7(1)(a). b) The EBA aims to publish a public consultation of the draft RTS on its website by end December 2015, and submit the final draft to the Commission, in the second quarter of It is not possible to determine the precise date from which the final RTS will be adopted, due to the many reasons stated above. c) However, Art 7(1)(a) of the IFR will apply to payment card schemes and processing entities from 9 June 2016, as provided in Article 18(2) of the IFR, even if the EBA RTS do not yet apply on 9 June d) From June 2016 card schemes and processing entities will have to ensure their independence in terms of accounting, organisation and decisions-making processes. In doing so, they may choose to take into account the draft RTS that should by then be published by the EBA, although this will not be legally binding. Once the RTS are formally adopted by the Commission, the card schemes and processing entities will be legally bound to comply with the RTS. e) Until the RTS are formally adopted by the Commission, in their respective jurisdiction the competent authorities - when designated pursuant to Article 13 IFR shall ensure compliance with Article 7(1)(a), and when doing so may take into account the draft RTS prepared by the EBA. In this case, the authorities are invited to liaise closely with the Commission to ensure a consistent implementation of the obligations deriving from Article 7(1)(a) pending the adoption of the draft RTSs. 15

17 Thank you 16