Changes from plenary report to adopted text

(25) To cater for the risks posed by their activities, payment institutions need to hold enough initial capital combined with own funds. Taking into account the possibility for payment institutions to engage in the wide range of activities covered by this Directive it is appropriate to adjust the level of the initial capital attached to individual services to the nature and the risks attached to these services.

(26) Taking into account that the initial requirements applicable to payment institutions have not been adapted since the adoption of Directive 2007/64/EC, it is appropriate to adjust these requirements to inflation. However, taking into account that the capital requirements applicable to payment institutions that provide only payment initiation services have only been implemented since the entry into force of Directive (EU) 2015/2366, and that no evidence was found with regard to the inadequacy of those requirements, those requirements should not be modified.

(27) The large variety of business models in the retail payments industry justifies the possibility to apply distinct methods for the calculation of own funds, which cannot however fall below the level of the relevant initial capital.

(28) This Directive pursues the same approach as Directive (EU) 2015/2366, which allowed for several methods to be used for the purpose of calculating the combined own funds requirements with a certain degree of supervisory discretion to ensure that the same risks are treated the same way for all payment service providers. The use of the payment institution’s payment volume of the previous year to compute its own funds requirements is the most adequate and the most applied own fund calculation method for most business models. For those reasons, and to improve consistency and ensure a level playing field, it is appropriate to require national competent authorities to prescribe the use of that method. It should however be possible for national competent authorities to deviate from that principle and to require payment institutions to apply other methods for business models that result in low volume but high value transactions. To ensure legal certainty and maximum clarity with regard to such business models, it is appropriate to mandate the EBA to develop draft regulatory technical standards.

(29) Notwithstanding the objective of aligning the prudential requirements of payment institutions providing payment services and electronic money services, it is appropriate to take account of the specificity of the business of issuing electronic money and carrying out electronic money business, and to allow payment institutions issuing electronic money and providing electronic money services to apply a more appropriate method to compute their own funds requirements.

(30) Where the same payment institution executes a payment transaction for both the payer and the payee and a credit line is provided to the payer, it is appropriate to safeguard the funds in favour of the payee once they represent the payee’s claim towards the payment institution.

(31) Considering the difficulties experienced by payment institutions in opening and maintaining payment accounts with credit institutions, it is necessary to provide for an additional option for the safeguarding of users’ funds, namely the possibility to hold those funds at a central bank. That possibility should however be without prejudice to the possibility for a central bank to not offer that option, based on its organic law. Any rejection of that option by a central bank should be duly justified to the relevant payment institution. Taking into account the need to protect users’ funds and to avoid that such funds are used for other purposes than to provide payment services or electronic money services, it is appropriate to require that payment service user funds are kept separate from the payment institution’s own funds. To ensure a level playing field between payment institutions providing payment services and payment institutions issuing electronic money and providing electronic money services, it is appropriate to align as much as possible the regimes applicable to the safeguarding of users’ funds, whilst preserving the specificities of electronic money. Concentration risk is a significant risk faced by payment institutions, in particular where funds are safeguarded in a single credit institution. It is therefore important to ensure that payment institutions avoid concentration risk to the extent possible. For that reason, the EBA should be instructed to develop regulatory technical standards on risk avoidance in the safeguarding of customer funds.

(31a) It might be the case that a credit institution refuses to open and maintain an account for a payment institution. That would be detrimental to the objective of diversification of risk for payment institutions. Therefore, where a credit institution refuses to open, or decides to terminate, a payment institution’s account, it should be required to provide that payment institution with a duly justified response and reasoning.

(32) It should be possible for payment institutions to engage in other activities, beyond those covered by this Directive, including the provision of operational and closely related ancillary service and the operation of payment systems or other business activities regulated by applicable Union law and national law.

(37a) In order for payment institutions to truly engage in cross-border services, the Commission should provide a dedicated internet website or a one-stop shop with all of the information in one place on how to register in each Member State.

(38) To avoid abuses of the right of establishment and to avoid cases where a payment institution establishes itself in a Member State without planning to perform any activity in that Member State, it is appropriate to require that a payment institution requesting authorisation in a Member State provides at least part of its payment services business in that Member State. The obligation for an institution to carry out a part of its business in its home country, which was already imposed by Directive (EU) 2015/2366, has been interpreted very differently, with some home countries imposing that most of the business be carried out in their country. A ‘part’ should be interpreted to mean less than the majority of the institution’s business in order to preserve the “effet utile” of the payment institution’s freedom to provide cross-border services.

(39) A payment institution may engage in other activities than the provision of payment services or electronic money services. To ensure a proper supervision of the payment institution, it is appropriate to allow national competent authorities, where necessary, to require the establishment of a separate entity for the provision of payments services or electronic money services. Such a decision by the competent authority should take account of the potential negative impact that an event affecting the other business activities could have on the payment institution’s financial soundness, or the potential negative impact arising from a situation where the payment institution would not be able to provide separate reporting on own funds in relation to its payment and electronic money activities and its other activities.

(40) To ensure a proper ongoing supervision of payment institutions and the availability of accurate and up-to-date information, it is appropriate to require payment institutions to inform national competent authorities of any change in their business affecting the accuracy of the information provided with regard to authorisation, including with regard to additional agents or entities to which activities are outsourced. Competent authorities should, in the event of doubt, verify that the information received is correct.

(41) To ensure a consistent authorisation regime of payment institutions throughout the Union, it is appropriate to lay out harmonised conditions under which national competent authorities may withdraw an authorisation issued to a payment institution.

(42) To enhance transparency of the operations of payment institutions that are authorised by, or registered with, competent authorities of the home Member State, including their agents, distributors and branches, and to ensure a high level of consumer protection in the Union, it is necessary to ensure easy public access to the list of the undertakings providing payment services, with their related brands, which should be included in a public national register.

(43) To ensure that information on authorised or registered payment institutions or entities entitled under national law to provide payment or electronic money services is available throughout the Union in a central register, the EBA should operate such a register in which it should publish a list of the names of the undertakings authorised or registered to provide payment services or electronic money services. Where that entails the processing of personal data, the publication at Union level of information on natural persons acting as agents or distributors is necessary to guarantee that only authorised agents and distributors operate in the internal market and is therefore in the interest of the adequate functioning of the internal market for payment services. Member States should ensure that the data that they provide on the undertakings concerned, including their agents, distributors and branches, is accurate and up-to-date, and transmitted to the EBA without undue delay and if possible in an automated way. The EBA should therefore develop draft regulatory technical standards to specify the methods and arrangements for the transmission of such information. Those draft regulatory technical standards should ensure a high level of granularity and consistency of the information. When developing those draft regulatory technical standards, the EBA should take into consideration the experience in applying Commission Delegated Regulation (EU) 2019/411.40 To enhance transparency, it is appropriate that the information transmitted contains the brands of all payment and electronic money services provided. Publication of personal data should occur in compliance with the rules on data protection in force. Where personal data are published, appropriate data protection safeguards that prevent further unintended dissemination of the information online should be implemented.

(44) To enhance transparency and awareness of the services provided by payment initiation and account information service providers, it is appropriate that the EBA maintains a machine-readable list containing basic information on such undertakings and services provided by them. The information contained in this list should allow for the payment initiation and account information service providers to be identified unequivocally.

(45) To expand the reach of their services, payment institutions may need to use entities providing payment services on their behalf, including agents or, in the case of electronic money services, distributors. Payment institutions may also exercise their right of establishment in a host Member State, different from the home Member State, through branches. In such cases, it is appropriate that the payment institution communicates to the national competent authority all the relevant information related to agents, distributors and branches and informs national competent authorities of any changes without undue delay. To ensure transparency vis-à-vis end users, it is also appropriate that agents, distributors or branches acting on behalf of a payment institution inform payment service users of that fact.

(45a) When acquirers use an agent to deliver payment services, it should be noted that the agent only acts on behalf of one acquirer as the principal payment service provider and not in respect of all payment services provided to the payment service user.

(45b) To take account of evolving market realities, marketplaces and platforms supported by payment service providers that provide services to those marketplaces and platforms so that they do not have control or possession of funds for third parties, should not be considered to be by default agents of the payment service providers.

(46) In conducting their business, payment institutions may need to outsource operational functions of part of their activity. To ensure that this is not done to the detriment of the continuing compliance of a payment institution with the requirements of its authorisation, or other applicable requirements under this Directive, it is appropriate to require a payment institution to inform without undue delay national competent authorities when it intends to outsource operational functions, and about any change regarding the use of entities to which activities are outsourced.

(47) To ensure a proper mitigation of the risks that the outsourcing of operational functions may generate, it is appropriate to require that payment institutions take reasonable steps to ensure that such outsourcing does not violate the requirements of this Directive. Payment institutions should remain fully liable for any acts of their employees, or any agent, distributor or outsourced entity.

(48) To ensure the effective enforcement of the provisions of national law adopted pursuant to this Directive, Member States should designate competent authorities in charge of the authorisation and supervision of payment institutions. Member States should ensure that competent authorities are granted the necessary powers and resources, including staff, to properly carry out their functions.

(49) To enable competent authorities to properly supervise payment institutions, it is appropriate to grant those authorities investigatory and supervisory powers and the possibility to impose administrative penalties and measures necessary to perform their tasks. For the same reason, it is appropriate to grant competent authorities the power to request information, conduct on-site inspections and issue recommendations, guidelines and binding administrative decisions. Member States should lay down national provisions harmonised under the provisions of this Directive, with respect to the suspension or withdrawal of the authorisation of a payment institution. Member States should empower their competent authorities to impose administrative sanctions and measures aimed specifically at ending infringements of provisions concerning the supervision or pursuit of the payment service business.

(50) Due to the broad range of possible business models in the payments industry, it is appropriate to allow for a certain degree of supervisory discretion to ensure that the same risks are treated in the same way across all Member States.

(51) When supervising compliance by payment institutions with their obligations, competent authorities should exercise their supervisory powers respecting fundamental rights, including the right to privacy. Without prejudice to the control of an independent authority (national data protection authority) and in accordance with the Charter of Fundamental Rights of the European Union, Member States should have in place adequate and effective safeguards where there is a risk that the exercise of those powers could lead to abuse or arbitrariness amounting to serious interference with such rights including, where appropriate, through the prior authorisation of the judicial authority of the Member State concerned.

(52) To ensure the protection of individual and business rights, Member States should ensure that all persons who work or who have worked for competent authorities are subjected to the obligation of professional secrecy.

(53) The activity of payment institutions may span across borders and be relevant for different competent authorities as well as the EBA, the European Central Bank (‘ECB’) and national central banks in their capacity as monetary and oversight authorities. It is therefore appropriate to provide for their effective cooperation and exchange of information. Information sharing arrangements should fully comply with the data protection rules laid down in Regulation (EU) 2016/679 of the European Parliament and of the Council and in Regulation (EU) 2018/1725 of the European Parliament and of the Council.

(54) Where disagreements occur in the context of the cross-border cooperation between competent authorities, those competent authorities should be able to request assistance from the EBA, which should take a decision without undue delay. The EBA should also be able to assist competent authorities in reaching an agreement on its own initiative.

(55) A payment institution that exercises the right of establishment or freedom to provide services should provide the competent authority of the home Member State with any relevant information with regard to its business and notify that competent authority about which Member State(s) the payment institution intends to operate in, whether it intends to use branches, agents or distributors and whether it intends to use outsourcing.

(56) To facilitate cooperation between competent authorities and an effective supervision of payment institutions, in the context of the use of the right of establishment or freedom to provide services, it is appropriate that competent authorities in the home Member State communicate information to the host Member State. In situations of so-called “triangular passporting” where a payment institution authorised in a country “A” uses an intermediary, such as an agent, distributor or branch, located in a country “B” for offering payment services in another country “C”, the host Member State should be considered to be the one where the services are offered to end-users. Taking into account challenges in cross-border cooperation between competent authorities, it is appropriate that the EBA develops draft regulatory technical standards on cooperation and information exchange, taking into consideration the experience gained in applying Commission Delegated Regulation (EU) 2017/2055.

(58) In emergency situations, where immediate action is necessary to address a serious threat to the collective interests of payment service users in the host Member State, including large scale fraud, it should be possible for the competent authorities of the host Member State to take precautionary measures in parallel with the cross-border cooperation between competent authorities of the host and the home Member States and pending measures by the competent authority of the home Member State. Those measures should be appropriate, proportionate to the aim, non-discriminatory and temporary in nature. Any measures should be properly justified. The competent authorities of the home Member State of the relevant payment institution and other authorities concerned, including the Commission and the EBA, should be informed in advance or, where not possible in view of the emergency situation, without undue delay.

(59) It is important to ensure that all entities providing payment services be brought within the scope of certain minimum legal and regulatory requirements. Thus, it is desirable to require the registration of the identity and whereabouts of all persons providing payment services, including of entities which are unable to meet the full range of conditions for authorisation as payment institutions, including some small payment institutions. Such an approach is in line with the rationale of Recommendation 14 of the Financial Action Task Force, which provides for a mechanism whereby payment service providers which are unable to meet all of the conditions set out in that Recommendation may nevertheless be treated as payment institutions. For those purposes, even where entities are exempt from all or part of the conditions for authorisation, Member States should enter them in the register of payment institutions. However, it is essential to make the possibility of an exemption from authorisation subject to strict requirements relating to the value of payment transactions. Entities benefiting from an exemption from authorisation should not enjoy the right of establishment or freedom to provide services and should not indirectly exercise those rights while being a participant in a payment system.

(60) To ensure transparency with regard to possible exemptions for small payment institutions, it is appropriate to require Member States to communicate such decisions to the Commission.

(61) In view of the specific nature of the activity performed and the risks connected to the provision of account information services, it is appropriate to provide for a specific prudential regime for account information service providers, without a need for a fully-fledged authorisation regime but with a lighter registration requirement, accompanied by documents and information to assist the competent authority with carrying out supervision. Account information service providers should be allowed to provide services on a cross-border basis, benefiting from the ‘passporting’ rules.

(62) To further improve access to cash, which is a priority of the Commission, retailers should be allowed to offer, in physical shops, cash provision services even in the absence of a purchase by a customer, without having to obtain a payment service provider authorisation, registration or being an agent of a payment institution. Those cash provision services should, however, be subject to the obligation to disclose fees charged to the customer, if any. These services should be provided by retailers on a voluntary basis and should depend on the availability of cash by the retailer. To prevent unfair competition between ATM deployers not servicing payment accounts and retailers offering cash withdrawals without a purchase, and to ensure that shops do not rapidly run out of cash, it is appropriate to impose a cap of EUR 100, or the corresponding amount in the currency of the Member State concerned per transaction. When offering that service, clients should authenticate the transaction and retailers should ensure that the transaction is not anonymous.

(64) Service providers seeking to benefit from an exclusion from the scope of Directive (EU) 2015/2366 often did not consult their authorities on whether their activities are covered by, or excluded from, that Directive, but often relied on their own assessments. That has led to a divergent application of certain exclusions across Member States. It also appears that some exclusions may have been used by payment service providers to redesign business models so that the payment activities offered would fall outside the scope of that Directive. That may result in increased risks for payment service users and divergent conditions for payment service providers in the internal market. Service providers should therefore be obliged to notify relevant activities to competent authorities so that the competent authorities can assess whether the requirements set out in the relevant provisions are fulfilled and to ensure a homogenous interpretation of the rules throughout the internal market. In particular, for all exclusions based on the respect of a threshold, a notification procedure should be provided to ensure compliance with the specific requirements. Moreover, it is important to include a requirement for potential payment service providers to notify competent authorities of the activities that they provide in the framework of a limited network on the basis of the criteria set out in Regulation XXX [PSR] where the value of payment transactions exceeds a certain threshold. Competent authorities should assess whether the activities so notified can be considered to be activities provided in the framework of a limited network, to ascertain whether they should remain excluded from the scope.

(65) The power to adopt acts in accordance with Article 290 of the Treaty on the Functioning of the European Union should be delegated to the Commission in respect of updating any of the amounts to take account of inflation. The Commission, when preparing and drawing-up delegated acts, should ensure a simultaneous, timely and appropriate transmission of relevant documents to the European Parliament and to the Council.

(66) To ensure a consistent application of the applicable requirements, the Commission should be able to rely on the expertise and support of the EBA, which should be given the task of preparing guidelines and draft regulatory technical standards. The Commission should be empowered to adopt those draft regulatory technical standards. Those specific tasks are fully in line with the role and responsibilities of the EBA as provided in Regulation (EU) No 1093/2010 of the European Parliament and of the Council.

(66a) The EBA should coordinate a collaboration forum, at least once per year, between national competent authorities in order to facilitate further harmonisation as regards the transposition, implementation and enforcement of the provisions laid down in this Directive.

(67) Since the further integration of an internal market in payment services, cannot be sufficiently achieved by the Member States alone because it requires the harmonisation of different rules currently existing in the legal systems of the various Member States which would be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in that Article, this Directive does not go beyond what is necessary in order to achieve that objective.

(68) This Directive does not include licensing requirements for payment systems, payment schemes or payment arrangements, taking into account the need to avoid any duplication with the Eurosystem’s oversight framework over retail payment systems, including over Systemically Important Payment Systems and other systems, as well as the Eurosystem’s new ‘PISA’ Framework, and oversight by national central banks. This Directive also does not cover, in its scope, the provision of technical services including processing or the operation of digital wallets. However, considering the pace of innovation in the payments sector and the possible emergence of new risks, it is necessary that in its future review of this Directive the Commission gives particular consideration to those developments and assesses whether the scope of the Directive should be extended to cover new services and entities.

(69) In the interest of legal certainty, it is appropriate to make transitional arrangements allowing undertakings who have commenced the activities of payment institutions in accordance with the national law transposing Directive (EU) 2015/2366 before the entry into force of this Directive to continue those activities within the Member State concerned for a specified period.

(70) In the interest of legal certainty, transitional arrangements should be made to ensure that electronic money institutions which have taken up their activities in accordance with the national laws transposing Directive 2009/110/EC are able to continue those activities within the Member State concerned for a specified period. That period should be longer for electronic money institutions that have benefited from the waiver provided for in Article 9 of Directive 2009/110/EC.

▌

(72) The specification that participants may act as a central counterparty, a settlement agent or a clearing house or carry out part or all of these tasks should be reinserted in Directive 98/26/EC to ensure a similar understanding in the Member States. It should also be reinserted that, where justified due to systemic risk, Member States should be allowed to consider an indirect participant as a participant of the system and apply the provisions of Directive 98/26/EC to such an indirect participant. However, to ensure that this does not limit the responsibility of the participant through which the indirect participant passes transfer orders to the system, this should be made clear in that Directive to ensure legal certainty.

(73) Consumers should be entitled to enforce their rights in relation to the obligations imposed on data users or data holders under Regulation (EU) 20../…. [FIDA] of the European Parliament and of the Council through representative actions in accordance with Directive (EU) 2020/1828 of the European Parliament and of the Council. For that purpose, this Directive should provide that Directive (EU) 2020/1828 is applicable to the representative actions brought against infringements by data users or data holders of provisions of Regulation (EU) 20../…. [FIDA] that harm or can harm the collective interests of consumers. The Annex to that Directive should therefore be amended accordingly. It is for the Member States to ensure that that amendment is reflected in their transposition measures adopted in accordance with Directive (EU) 2020/1828.

(74) In keeping with the principles of better regulation, this Directive should be reviewed for its effectiveness and efficiency in achieving its objectives, as laid out in the accompanying impact assessment. The review should take place a sufficient time after the date of application of this Directive, to base the review on appropriate evidence. Five years is considered to be an appropriate period. While the review should consider the entire Directive, certain topics should be singled out for particular attention, namely the safeguarding of payment institutions funds, and the number and market share of payment service providers authorised under this Directive, which may be affected by the rules proposed by the Commission on 18 April 2023 which, when adopted, would amend Directive 2014/49/EU of the European Parliament and of the Council of 16 April 2014 on deposit guarantee schemes. Regarding the scope of this Directive, however, it is appropriate for a review to take place earlier, three years after the entry into force of Regulation (EU) [.../...] of the European Parliament and of the Council (Payment Services Regulation), given the importance attached to this subject in Regulation (EU) 2022/2554. That review of scope should consider both the possible extension of the list of covered payment services to include services such as those performed by payment systems and payment schemes, and the possible inclusion in the scope of some technical services currently excluded such as digital wallets.

(75) Given the number of changes that need to be made to Directive (EU) 2015/2366 and Directive 2009/110/EC, it is appropriate to repeal both Directives and replace them by this Directive.

(76) Any personal data processing in the context of this Directive must comply with Regulation (EU) 2016/679 and Regulation (EU) 2018/1725. Therefore, the supervisory authorities under Regulation (EU) 2016/679 and Regulation (EU) 2018/1725 are responsible for the supervision of processing of personal data carried out in the context of this Directive. When transposing this Directive, the Member States should ensure that the national legislation include appropriate data protection safeguards for processing of personal data.

(77) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 and delivered an opinion on 22 August 2023.

HAVE ADOPTED THIS DIRECTIVE: