Text · Amendment list
On the proposal for a regulation of the European Parliament and of the Council on payment services in the internal market and amending Regulation (EU) No 1093/2010
Document ECON-AM-757115 · COM(2023)0367 – C90217/2023 – 2023/0210(COD)
- Kind
- Amendment list ECON-AM-757115
- Date
- 4 December 2023
- Committee
- Committee on Economic and Monetary Affairs
- Dossier
- 2023-0210
More facts (2)
- Formats
- Official page PDF Word
- Reference
- COM(2023)0367 – C90217/2023 – 2023/0210(COD)
Text
The text as parsed from the official Word file. Every paragraph has a link (¶) and can be saved to a project as a passage.
Jump to an amendment (250)
- Amendment 91
- Amendment 92
- Amendment 93
- Amendment 94
- Amendment 95
- Amendment 96
- Amendment 97
- Amendment 98
- Amendment 99
- Amendment 100
- Amendment 101
- Amendment 102
- Amendment 103
- Amendment 104
- Amendment 105
- Amendment 106
- Amendment 107
- Amendment 108
- Amendment 109
- Amendment 110
- Amendment 111
- Amendment 112
- Amendment 113
- Amendment 114
- Amendment 115
- Amendment 116
- Amendment 117
- Amendment 118
- Amendment 119
- Amendment 120
- Amendment 121
- Amendment 122
- Amendment 123
- Amendment 124
- Amendment 125
- Amendment 126
- Amendment 127
- Amendment 128
- Amendment 129
- Amendment 130
- Amendment 131
- Amendment 132
- Amendment 133
- Amendment 134
- Amendment 135
- Amendment 136
- Amendment 137
- Amendment 138
- Amendment 139
- Amendment 140
- Amendment 141
- Amendment 142
- Amendment 143
- Amendment 144
- Amendment 145
- Amendment 146
- Amendment 147
- Amendment 148
- Amendment 149
- Amendment 150
- Amendment 151
- Amendment 152
- Amendment 153
- Amendment 154
- Amendment 155
- Amendment 156
- Amendment 157
- Amendment 158
- Amendment 159
- Amendment 160
- Amendment 161
- Amendment 162
- Amendment 163
- Amendment 164
- Amendment 165
- Amendment 166
- Amendment 167
- Amendment 168
- Amendment 169
- Amendment 170
- Amendment 171
- Amendment 172
- Amendment 173
- Amendment 174
- Amendment 175
- Amendment 176
- Amendment 177
- Amendment 178
- Amendment 179
- Amendment 180
- Amendment 181
- Amendment 182
- Amendment 183
- Amendment 184
- Amendment 185
- Amendment 186
- Amendment 187
- Amendment 188
- Amendment 189
- Amendment 190
- Amendment 191
- Amendment 192
- Amendment 193
- Amendment 194
- Amendment 195
- Amendment 196
- Amendment 197
- Amendment 198
- Amendment 199
- Amendment 200
- Amendment 201
- Amendment 202
- Amendment 203
- Amendment 204
- Amendment 205
- Amendment 206
- Amendment 207
- Amendment 208
- Amendment 209
- Amendment 210
- Amendment 211
- Amendment 212
- Amendment 213
- Amendment 214
- Amendment 215
- Amendment 216
- Amendment 217
- Amendment 218
- Amendment 219
- Amendment 220
- Amendment 221
- Amendment 222
- Amendment 223
- Amendment 224
- Amendment 225
- Amendment 226
- Amendment 227
- Amendment 228
- Amendment 229
- Amendment 230
- Amendment 231
- Amendment 232
- Amendment 233
- Amendment 234
- Amendment 235
- Amendment 236
- Amendment 237
- Amendment 238
- Amendment 239
- Amendment 240
- Amendment 241
- Amendment 242
- Amendment 243
- Amendment 244
- Amendment 245
- Amendment 246
- Amendment 247
- Amendment 248
- Amendment 249
- Amendment 250
- Amendment 251
- Amendment 252
- Amendment 253
- Amendment 254
- Amendment 255
- Amendment 256
- Amendment 257
- Amendment 258
- Amendment 259
- Amendment 260
- Amendment 261
- Amendment 262
- Amendment 263
- Amendment 264
- Amendment 265
- Amendment 266
- Amendment 267
- Amendment 268
- Amendment 269
- Amendment 270
- Amendment 271
- Amendment 272
- Amendment 273
- Amendment 274
- Amendment 275
- Amendment 276
- Amendment 277
- Amendment 278
- Amendment 279
- Amendment 280
- Amendment 281
- Amendment 282
- Amendment 283
- Amendment 284
- Amendment 285
- Amendment 286
- Amendment 287
- Amendment 288
- Amendment 289
- Amendment 290
- Amendment 291
- Amendment 292
- Amendment 293
- Amendment 294
- Amendment 295
- Amendment 296
- Amendment 297
- Amendment 298
- Amendment 299
- Amendment 300
- Amendment 301
- Amendment 302
- Amendment 303
- Amendment 304
- Amendment 305
- Amendment 306
- Amendment 307
- Amendment 308
- Amendment 309
- Amendment 310
- Amendment 311
- Amendment 312
- Amendment 313
- Amendment 314
- Amendment 315
- Amendment 316
- Amendment 317
- Amendment 318
- Amendment 319
- Amendment 320
- Amendment 321
- Amendment 322
- Amendment 323
- Amendment 324
- Amendment 325
- Amendment 326
- Amendment 327
- Amendment 328
- Amendment 329
- Amendment 330
- Amendment 331
- Amendment 332
- Amendment 333
- Amendment 334
- Amendment 335
- Amendment 336
- Amendment 337
- Amendment 338
- Amendment 339
- Amendment 340
| Text proposed by the Commission | Amendment |
|---|---|
| (10) To further improve access to cash, which is a priority of the Commission, merchants should be allowed to offer, in physical shops, cash provision services even in the absence of a purchase by a customer, without having to obtain a payment service provider authorisation or being an agent of a payment institution. Those cash provision services should, however, be subject to the obligation to disclose fees charged to the customer, if any. These services should be provided by retailers on a voluntary basis and should depend on the availability of cash by the retailer. | (10) To further improve access to cash, which is a priority of the Commission, merchants should be allowed to offer, in physical shops, cash provision services even in the absence of a purchase by a customer, without having to obtain a payment service provider authorisation or being an agent of a payment institution. Those cash provision services should, however, be subject to the obligation to disclose fees charged to the customer, if any. These services should be provided by retailers on a voluntary basis and should depend on the availability of cash at the retailer. |
| Text proposed by the Commission | Amendment |
|---|---|
| (13) To assess whether a limited network should be excluded from scope, the geographical location of the points of acceptance of such network as well as the number of the points of acceptance should be considered. Specific-purpose instruments should allow the holder to acquire goods or services only in the physical premises of the issuer, whereas usage in an online store environment should not be covered by the notion of premises of the issuer. Specific-purpose instruments should include, depending on the respective contractual regime, cards that can only be used in a particular chain of stores or a particular shopping centre, fuel cards, membership cards, public transport cards, parking ticketing, meal vouchers or vouchers for specific services, which may be subject to a specific tax or labour legal framework designed to promote the use of such instruments to meet the objectives laid down in social legislation, such as childcare vouchers or ecological vouchers. Specific-purpose instruments should also include electronic money-based instruments once they meet the requirements of this exclusion. Payment instruments which can be used for purchases in stores of listed merchants should not be excluded, as such instruments are typically designed for a network of service providers which is continuously growing. | (13) To assess whether a limited network should be excluded from scope, the geographical location of the points of acceptance of such network as well as the number of the points of acceptance should be considered. Specific-purpose instruments should allow the holder to acquire goods or services only in the physical premises of the issuer, whereas usage in an online store environment should not be covered by the notion of premises of the issuer. Specific-purpose instruments should include, depending on the respective contractual regime, cards that can only be used in a particular chain of stores or a particular shopping centre, fuel cards, membership cards, public transport cards, parking ticketing, vouchers for specific services, which may be subject to a specific tax or labour legal framework designed to promote the use of such instruments to meet the objectives laid down in social legislation, such as childcare vouchers or ecological vouchers. Specific-purpose instruments should also include electronic money-based instruments once they meet the requirements of this exclusion. Payment instruments which can be used for purchases in stores of listed merchants should not be excluded, as such instruments are typically designed for a network of service providers which is continuously growing. |
| Text proposed by the Commission | Amendment |
|---|---|
| (15) The Single Euro Payments Area (SEPA) has facilitated the creation of Union wide ‘payment factories’ and ‘collection factories’, allowing for the centralisation of payment transactions of the same group. In that respect, payment transactions between a parent undertaking and its subsidiary or between subsidiaries of the same parent undertaking which are provided by a payment service provider belonging to the same group should be excluded from the scope of this Regulation. The collection of payment orders on behalf of a group by a parent undertaking or its subsidiary for onward transmission to another payment service provider should not be considered as a payment service. | (15) The Single Euro Payments Area (SEPA) has facilitated the creation of Union wide ‘payment factories’ and ‘collection factories’, allowing for the centralisation of payment transactions of the same group. In that respect, payment transactions between a parent undertaking and its subsidiary or between subsidiaries of the same parent undertaking which are provided by a payment service provider belonging to the same group should be excluded from the scope of this Regulation. The collection of payment orders and the receipt of funds on behalf of group entities by a parent undertaking or its subsidiary should not be considered as a payment service. |
| Text proposed by the Commission | Amendment |
|---|---|
| (17) Technical services do not constitute payment services as such as technical service providers do not enter at any time into possession of the funds to be transferred. They should therefore be excluded from the definition of payment services. Those services should however be subject to certain requirements, such as those on liability for failure to support the application of strong customer authentication, or the requirement to enter into outsourcing agreements with payment service providers in case technical service providers are to provide and verify the elements of strong customer authentication. There should also be requirements governing the termination fees of framework contracts where payment services are offered jointly with technical services. | (17) Technical services do not constitute payment services as such as technical service providers do not enter at any time into possession of the funds to be transferred. They should therefore be excluded from the definition of payment services. Those services should however be subject to certain requirements, such as those on liability for failure to support the application of strong customer authentication. |
| Text proposed by the Commission | Amendment |
|---|---|
| (24) So-called digital ‘pass-through wallets’, involving the tokenisation of an existing payment instrument, for example a payment card, are to be considered as technical services and should thus be excluded from the definition of payment instrument as, in the Commission’s view, a token cannot be regarded as being itself a payment instrument but, rather, a ‘payment application’ within the meaning of Article 2(21) of Regulation (EU) 2015/751 of the European Parliament and of the Council.39 However, some other categories of digital wallets, namely pre-paid electronic wallets such as ‘staged-wallets’ where users can store money for future online transactions, should be considered a payment instrument and their issuance a payment service. | (24) So-called digital ‘pass-through wallets’, involving the tokenisation of an existing payment instrument, for example a payment card, are to be considered as technical services and should thus be excluded from the definition of payment instrument as, in the Commission’s view, a token cannot be regarded as being itself a payment instrument but, rather, a ‘payment application’ within the meaning of Article 2(21) of Regulation (EU) 2015/751 of the European Parliament and of the Council.39 However, some other categories of digital wallets, namely pre-paid electronic wallets such as ‘staged-wallets’ where users can store money for future online transactions, should be considered a payment instrument and their issuance a payment service, unless such instruments are issued only to fulfil the requirements of Regulation (EU) 2023/1114 (MiCAR), Article 70(2) and (3). |
| 39 Regulation (EU) 2015/751 of the European Parliament and of the Council of 29 April 2015 on interchange fees for card-based payment transactions (OJ L 123, 19.5.2015, p. 1). | 39 Regulation (EU) 2015/751 of the European Parliament and of the Council of 29 April 2015 on interchange fees for card-based payment transactions (OJ L 123, 19.5.2015, p. 1). |
| Text proposed by the Commission | Amendment |
|---|---|
| (28) The definition of funds should cover all forms of central bank money issued for retail use, including banknotes and coins, and any possible future central bank digital currency, e-money and commercial bank money. Central bank money issued for use between the central bank and commercial banks, i.e. for wholesale use, should not be covered. | (28) The definition of funds should cover central bank money issued for retail use, namely banknotes and coins, and e-money and commercial bank money. Central bank money issued for use between the central bank and commercial banks, i.e. for wholesale use, should not be covered. |
| Text proposed by the Commission | Amendment |
|---|---|
| (28) The definition of funds should cover all forms of central bank money issued for retail use, including banknotes and coins, and any possible future central bank digital currency, e-money and commercial bank money. Central bank money issued for use between the central bank and commercial banks, i.e. for wholesale use, should not be covered. | (28) The definition of funds should cover all forms of money issued for retail use, including banknotes and coins, e-money, asset-referenced tokens (ART), and commercial bank money. Central bank money issued for use between the central bank and commercial banks, i.e. for wholesale use, should not be covered. |
| Text proposed by the Commission | Amendment |
|---|---|
| (29) Regulation (EU) 2023/1114 of 31 May 2023 on markets in crypto-assets lays down that electronic-money tokens shall be deemed to be electronic money. Electronic money tokens are therefore included, as electronic money, in the definition of funds in this Regulation. | (29) Regulation (EU) 2023/1114 of 31 May 2023 on markets in crypto-assets lays down that electronic-money tokens (EMT) and asset-referenced tokens (ART) shall be deemed to be electronic money. Electronic money tokens and asset-referenced tokens are therefore included, as electronic money, in the definition of funds in this Regulation. |
| Text proposed by the Commission | Amendment |
|---|---|
| (29) Regulation (EU) 2023/1114 of 31 May 2023 on markets in crypto-assets lays down that electronic-money tokens shall be deemed to be electronic money. Electronic money tokens are therefore included, as electronic money, in the definition of funds in this Regulation. | (29) Regulation (EU) 2023/1114 of 31 May 2023 on markets in crypto-assets lays down that electronic-money tokens shall be deemed to be electronic money for the purposes of that regulation. To avoid duplicative requirements it is important that the provisions under this Regulation clearly set out where electronic-money tokens should be subject to the provisions of this Regulation. |
| Text proposed by the Commission | Amendment |
|---|---|
| (31 a) To process digital payments online or offline, it is essential that front end payment service providers obtain access to near field communication technology (NFC) on mobile devices. These components include, in particular but not exclusively, NFC antennas and the so-called secure elements of mobile devices (e.g.: Universal Integrated Circuit Card (UICC), embedded SE (eSE), and microSD etc). It is therefore necessary to ensure that whenever needed to provide payment services, original equipment manufacturers of mobile devices or providers of electronic communication services would not refuse access to NFC antennas and secure elements. To ensure this also in the digital economy, providers of front-end payment services should be entitled to store software on relevant mobile devices’ hardware in order to make transactions technically possible both online and offline. For this purpose, original equipment manufacturers of mobile devices and providers of electronic communication services should be obliged to provide access on fair, reasonable and non-discriminatory terms to all hardware and software components when needed for online and offline transactions. In all instances, such operators should be obliged to provide adequate capacity on relevant hardware and software features in mobile devices to process online payment transactions and for storing funds on mobile devices for offline payment transactions. This obligation should be without prejudice to Article 6(7) of Regulation (EU) 2022/1925, which obliges gatekeepers to provide, free of charge, effective interoperability with, and access for the purposes of interoperability to, the operating system, hardware or software features of mobile devices, which is applicable to existing and new digital means of payments. |
| Text proposed by the Commission | Amendment |
|---|---|
| (39) As consumers and undertakings are not in the same position of vulnerability, they do not need the same level of protection. While it is important to guarantee consumer rights by provisions from which it is not possible to derogate by contract, it is reasonable to let undertakings and organisations agree otherwise when they are not dealing with consumers. Micro-enterprises, as defined in Commission Recommendation 2003/361/EC,44 may be treated in the same way as consumers. Certain rules should always apply, irrespective of the status of the user. | (39) As consumers and undertakings are not in the same position of vulnerability, they do not need the same level of protection. While it is important to guarantee consumer rights by provisions from which it is not possible to derogate by contract, it is reasonable to let undertakings and organisations agree otherwise when they are not dealing with consumers. This may include the application of Strong Customer Authentication. Micro-enterprises, as defined in Commission Recommendation 2003/361/EC,44 may be treated in the same way as consumers. Certain rules should always apply, irrespective of the status of the user. |
| 44 OJ L 124, 20.05.2003, p. 36-41. | 44 OJ L 124, 20.05.2003, p. 36-41. |
Strong customer authentication rules – and the exemptions from them – should be adapted to corporate environments. For example, it will often be more relevant for the payer to prove who their employer is rather than who they are. Security factors should reflect this. In addition, the interaction with a PSP interface by a corporate user varies from that of a PSU logging into a bank account (given a corporate environment in which that interaction takes place). It is less risky and does not require as frequent re-authentication as in the case of an individual PSU.
| Text proposed by the Commission | Amendment |
|---|---|
| (40) To maintain a high level of consumer protection, consumers should have the right to receive information on services conditions and prices free of charge before being bound by any payment service contract. To enable consumers to compare the services and conditions offered by payment service providers and, in the case of a dispute, to verify their contractual rights and obligations, consumers should be able to request that information and the framework contract on paper, free of charge and at any time during the contractual relationship. | (40) To maintain a high level of consumer protection, consumers should have the right to receive information on services' conditions and prices free of charge before being bound by any payment service contract. To enable consumers to compare the services and conditions offered by payment service providers and, in the case of a dispute, to verify their contractual rights and obligations, consumers should be able to request that information and the framework contract on paper, free of charge and at any time during the contractual relationship. |
| Text proposed by the Commission | Amendment |
|---|---|
| (45) To be able to make an informed choice payment service users should be able to compare Automatic Teller Machine (ATM) charges with those of other providers. To increase the transparency of ATM charges for the payment service user payment service providers should provide payment service users with information on all applicable charges for domestic ATM withdrawals in different situations, depending on the ATM from which the payment service users withdraw cash. | (45) To be able to make an informed choice payment service users should be able to compare Automatic Teller Machine (ATM) charges with those of other providers. As a general principle, domestic ATMs which are not considered as ATM deployers not servicing payment accounts should not charge any fees for withdrawals of cash to consumers. In addition, to increase the transparency of ATM charges for the payment service user payment service providers should provide payment service users with information on all applicable charges at the initiation of a transaction for Union ATM withdrawals in different situations, depending on the ATM from which the payment service users withdraw cash. |
| Text proposed by the Commission | Amendment |
|---|---|
| (50) To achieve comparability, the estimated currency conversion charges for credit transfers and remittances carried out within the Union and from the Union to a third country should be expressed in the same way, namely as a percentage mark-up over the latest available euro foreign exchange reference rates issued by the European Central Bank (ECB). When reference is made to ‘charges’ in this Regulation, it should also cover, where applicable, ‘currency conversion’ charges. | (50) To achieve comparability, the estimated currency conversion charges for credit transfers and remittances carried out within the Union and from the Union to a third country should be expressed in the same way, namely as a percentage mark-up over the latest available applicable foreign exchange reference rates issued by the relevant central bank, and the resultant currency conversion charge shown as a monetary amount in the currency used by the customer to initiate the currency conversion. When reference is made to ‘charges’ in this Regulation, it should also cover, where applicable, ‘currency conversion’ charges. |
| Text proposed by the Commission | Amendment |
|---|---|
| (50) To achieve comparability, the estimated currency conversion charges for credit transfers and remittances carried out within the Union and from the Union to a third country should be expressed in the same way, namely as a percentage mark-up over the latest available euro foreign exchange reference rates issued by the European Central Bank (ECB). When reference is made to ‘charges’ in this Regulation, it should also cover, where applicable, ‘currency conversion’ charges. | (50) To achieve comparability, the estimated currency conversion charges for credit transfers and remittances carried out within the Union and from the Union to a third country should be expressed in the same way, namely as a charge in the currency in which the transaction is initiated. This currency conversion charge is made up of any mark-up over the mid-market exchange rate offered by neutral, independent and credible providers, expressed in a monetary value. When reference is made to ‘charges’ in this Regulation, it should also cover, where applicable, ‘currency conversion’ charges. |
| Text proposed by the Commission | Amendment |
|---|---|
| (52) A surcharge is a charge by merchants to consumers that is added on top of the requested price for goods and services when a certain payment method is used by the consumer. One of the reasons for surcharging is to direct consumers to cheaper or more efficient payment instruments, hence fostering competition between alternative payment methods. Under the regime introduced by Directive (EU) 2015/2366, payees were prevented from requesting charges for the use of payment instruments for which interchange fees are regulated under Chapter II of Regulation (EU) 2015/751, i.e. for consumer debit and credit cards issued under four-party card schemes, and for those payment services to which Regulation (EU) No 260/2012 of the European Parliament and of the Council45 applies, i.e. credit transfer and direct debit transactions denominated in euro within the Union. Member States were allowed under Directive (EU) 2015/2366 to further prohibit or limit the right of the payee to request charges, taking into account the need to encourage competition and promote the use of efficient payment instruments. | (52) A surcharge is a charge by merchants to consumers that is added on top of the requested price for goods and services when a certain payment method is used by the consumer. One of the reasons for surcharging is to direct consumers to cheaper or more efficient payment instruments, hence fostering competition between alternative payment methods. Under the regime introduced by Directive (EU) 2015/2366, payees were prevented from requesting charges for the use of payment instruments for which interchange fees are regulated under Chapter II of Regulation (EU) 2015/751, i.e. for consumer debit and credit cards issued under four-party card schemes, and for those payment services to which Regulation (EU) No 260/2012 of the European Parliament and of the Council45 applies, i.e. credit transfer and direct debit transactions denominated in euro within the Union. Member States were allowed under Directive (EU) 2015/2366 to further prohibit or limit the right of the payee to request charges, taking into account the need to encourage competition and promote the use of efficient payment instruments. It is necessary to harmonise this approach to foster a level playing field in the Union, and therefore to enact a full ban on surcharging across the Union. |
| 45 Regulation (EU) No 260/2012 of the European Parliament and of the Council of 14 March 2012 establishing technical and business requirements for credit transfers and direct debits in euro and amending Regulation (EC) No 924/2009 (OJ L 94, 30.3.2012, p. 22). | 45 Regulation (EU) No 260/2012 of the European Parliament and of the Council of 14 March 2012 establishing technical and business requirements for credit transfers and direct debits in euro and amending Regulation (EC) No 924/2009 (OJ L 94, 30.3.2012, p. 22). |
| Text proposed by the Commission | Amendment |
|---|---|
| (53) Evidence gathered during the review of Directive (EU) 2015/2366 shows that the current rules on charges are appropriate and had a positive impact. There is no compelling need for further alignment of charging practices between Member States, as the existing surcharging ban already applies to a very large share of payments in the Union. It is estimated that 95% of card payments are subject to the existing surcharging ban. In addition, when a surcharge is applied, it is capped at the actual cost incurred by the merchant. However, in its review of Directive (EU) 2015/2366, the Commission identified different interpretations concerning the payment instruments covered by the surcharging ban. It is therefore necessary to explicitly extend the surcharging ban to all credit transfers and direct debits and not just to those covered by Regulation (EU) No 260/2012, as was the case under Directive (EU) 2015/2366. | (53) In its review of Directive (EU) 2015/2366, the Commission identified a lack of harmonisation that allows surcharging for payment instruments and different interpretations concerning the payment instruments covered by the surcharging ban. It is therefore necessary to explicitly extend the surcharging ban to all credit transfers and direct debits and not just to those covered by Regulation (EU) No 260/2012, as was the case under Directive (EU) 2015/2366. |
| Text proposed by the Commission | Amendment |
|---|---|
| (53) Evidence gathered during the review of Directive (EU) 2015/2366 shows that the current rules on charges are appropriate and had a positive impact. There is no compelling need for further alignment of charging practices between Member States, as the existing surcharging ban already applies to a very large share of payments in the Union. It is estimated that 95% of card payments are subject to the existing surcharging ban. In addition, when a surcharge is applied, it is capped at the actual cost incurred by the merchant. However, in its review of Directive (EU) 2015/2366, the Commission identified different interpretations concerning the payment instruments covered by the surcharging ban. It is therefore necessary to explicitly extend the surcharging ban to all credit transfers and direct debits and not just to those covered by Regulation (EU) No 260/2012, as was the case under Directive (EU) 2015/2366. | (53) In its review of Directive (EU) 2015/2366, the Commission identified a lack of harmonisation on allowing surcharging for payment instruments not captured under Regulation (EU) 2015/751 and different interpretations concerning the payment instruments covered by the surcharging ban. It is therefore necessary to explicitly extend the surcharging ban to all payment instruments. This will contribute to consumer confidence in payment services and reduce the lack of harmonisation between Member States. |
One of the outcomes of PSD2 has been the fragmentation of surcharging rules which differs from one member state to another. Surcharging is detrimental to consumers since it allows merchants to levy an additional and often non-transparent charge on them without providing added value to consumers. By forcing consumers to “pay for paying”, surcharging reduces consumers’ ability to choose their preferred payment method and provides a regulatory disadvantage to new entrants to the payments market. It also serves to mislead consumers on the true price of goods and services.
| Text proposed by the Commission | Amendment |
|---|---|
| (53) Evidence gathered during the review of Directive (EU) 2015/2366 shows that the current rules on charges are appropriate and had a positive impact. There is no compelling need for further alignment of charging practices between Member States, as the existing surcharging ban already applies to a very large share of payments in the Union. It is estimated that 95% of card payments are subject to the existing surcharging ban. In addition, when a surcharge is applied, it is capped at the actual cost incurred by the merchant. However, in its review of Directive (EU) 2015/2366, the Commission identified different interpretations concerning the payment instruments covered by the surcharging ban. It is therefore necessary to explicitly extend the surcharging ban to all credit transfers and direct debits and not just to those covered by Regulation (EU) No 260/2012, as was the case under Directive (EU) 2015/2366. | (53) There is a need for further alignment of charging practices between Member States, as the existing surcharging ban does not apply uniformly to all payments in the Union. It is estimated that 95% of card payments are subject to the existing surcharging ban. When a surcharge is applied, it is capped at the actual cost incurred by the merchant. In its review of Directive (EU) 2015/2366, the Commission identified different interpretations concerning the payment instruments covered by the surcharging ban. It is therefore necessary to explicitly extend the surcharging ban to all payment instruments, including credit transfers and direct debits, and not just to those covered by Regulation (EU) No 260/2012, as was the case under Directive (EU) 2015/2366. |
| Text proposed by the Commission | Amendment |
|---|---|
| (54) Account information services and payment initiation services, often collectively known as ‘open banking services’, are payment services involving access to the data of a payment service user by payment service providers which do not hold the account holder’s funds nor service a payment account. Account information services allow the aggregation of a user’s data, at the request of the payment service user, with different account servicing payment service providers in one single place. Payment initiation services allow the initiation of a payment from the user’s account, such as a credit transfer or a direct debit, in a convenient way for the user and the payee without the use of an instrument such as a payment card. | (54) Account information services and payment initiation services, often collectively known as ‘open banking services’, are payment services involving access to the data of a payment service user by payment service providers which do not hold the account holder’s funds nor service a payment account. Account information services allow the aggregation of a user’s data, at the request of the payment service user, with different account servicing payment service providers in one single place. Payment initiation services may allow the initiation of a payment from the user’s account, such as a credit transfer or a direct debit, in a convenient way for the user and the payee without the use of an instrument such as a payment card. |
| Text proposed by the Commission | Amendment |
|---|---|
| (57) To guarantee a high level of security in data access and exchange, access to payment accounts and the data therein should, barring specific circumstances, be provided to account information and payment initiation service providers via an interface designed and dedicated for ‘open banking’ purposes, such as an API. To that end, the account servicing payment service provider should set up a secure communication with account information and payment initiation service providers. To avoid any uncertainty as to who is accessing the payment service user’s data, the dedicated interface should enable account information and payment initiation service providers to identify themselves to the account servicing payment service provider, and to rely on all the authentication procedures provided by the account servicing payment service provider to the payment service user. Account information and payment initiation service providers should as a general rule use the interface dedicated for their access and therefore should not use the customer interface of an account servicing payment service provider for the purpose of data access, except in cases of failure or unavailability of the dedicated interface in the conditions laid down in this Regulation. In such circumstances their business continuity would be endangered by their incapacity to access the data for which they have been granted a permission. It is indispensable that account information and payment initiation service providers be at all times able to access the data indispensable for them to service their clients. | (57) To guarantee a high level of security in data access and exchange, access to payment accounts and the data therein should, barring specific circumstances, be provided to account information and payment initiation service providers via an interface such as an API. To that end, the account servicing payment service provider should set up a secure communication with account information and payment initiation service providers. To avoid any uncertainty as to who is accessing the payment service user’s data, the interface should enable account information and payment initiation service providers to identify themselves to the account servicing payment service provider, and to rely on all the authentication procedures provided by the account servicing payment service provider to the payment service user. Account information and payment initiation service providers should as a general rule not use the customer interface of an account servicing payment service provider for the purpose of data access, except in cases of failure or unavailability of the interface in the conditions laid down in this Regulation. In such circumstances their business continuity would be endangered by their incapacity to access the data for which they have been granted a permission. It is indispensable that account information and payment initiation service providers be at all times able to access the data indispensable for them to service their clients. |
Across the text, where the phrase 'dedicated interface' appears, it should be applied that the word 'dedicated' is deleted
| Text proposed by the Commission | Amendment |
|---|---|
| (64) For the provision of payment initiation services, the account servicing payment service provider should provide the payment initiation service provider with all information accessible to it regarding the execution of the payment transaction immediately after the payment order has been received. Sometimes more information becomes available to the account servicing payment service provider after it has received the payment order, but before it has executed the payment transaction. Where relevant for the payment order and the execution of the payment transaction, the account servicing payment service provider should provide that information to the payment initiation service provider. The payment initiation service provider should benefit from the information necessary to assess the risks of non-execution of the initiated transaction. That information is indispensable to enable the payment initiation service provider to offer to a payee on behalf of whom it initiates the transaction a service whose quality can compete with other means of electronic payments available to the payee, including payment cards. | (64) For the provision of payment initiation services, the account servicing payment service provider should provide the payment initiation service provider with all information accessible to it regarding the execution of the payment transaction before and after the payment order has been initiated. Sometimes more information becomes available to the account servicing payment service provider after it has received the payment order, but before it has executed the payment transaction. Where relevant for the payment order and the execution of the payment transaction, the account servicing payment service provider should provide that information to the payment initiation service provider. The payment initiation service provider should benefit from the information necessary to assess the risks of non-execution of the initiated transaction. That information is indispensable to enable the payment initiation service provider to offer to a payee on behalf of whom it initiates the transaction a service whose quality can compete with other means of electronic payments available to the payee, including payment cards. |
| Text proposed by the Commission | Amendment |
|---|---|
| (66) The review of Directive (EU) 2015/2366 has revealed that account information and payment initiation service providers are still exposed to many unjustified obstacles, despite the level of harmonisation achieved and of the prohibition on such obstacles imposed by Article 32(3) of Commission Delegated Regulation (EU) 2018/38947 . Those obstacles still significantly hamper the full potential of open banking in the Union. Those obstacles are regularly reported by account information and payment initiation service providers to supervisors, regulators and the Commission. They were analysed by the EBA in its June 2020 Opinion on “Obstacles to the provision of third-party provider services under the Payment Services Directive”. Despite clarifications efforts made there is still a lot of uncertainty, in the market and with supervisors, as to what constitutes a ‘prohibited obstacle’ to regulated open banking services. It is therefore indispensable to provide a clear and non-exhaustive list of such prohibited open banking obstacles, relying in particular on the work carried out by the EBA. | (66) The review of Directive (EU) 2015/2366 has revealed that account information and payment initiation service providers are still exposed to many unjustified obstacles, despite the level of harmonisation achieved and of the prohibition on such obstacles imposed by Article 32(3) of Commission Delegated Regulation (EU) 2018/38947 . Those obstacles still significantly hamper the full potential of open banking in the Union. Those obstacles are regularly reported by account information and payment initiation service providers to supervisors, regulators and the Commission. They were analysed by the EBA in its June 2020 entitled “Opinion of the European Banking Authority on obstacles under Article 32(3) of the RTS on SCA and CSC”. Despite clarifications efforts made there is still a lot of uncertainty, in the market and with supervisors, as to what constitutes a ‘prohibited obstacle’ to regulated open banking services. It is therefore indispensable to provide a clear and non-exhaustive list of such prohibited open banking obstacles, relying in particular on the work carried out by the EBA. |
| 47 Commission Delegated Regulation (EU) 2018/389 of 27 November 2017 supplementing Directive (EU) 2015/2366 of the European Parliament and of the Council with regard to regulatory technical standards for strong customer authentication and common and secure open standards of communication (OJ L 69, 13.3.2018, p. 23). | 47 Commission Delegated Regulation (EU) 2018/389 of 27 November 2017 supplementing Directive (EU) 2015/2366 of the European Parliament and of the Council with regard to regulatory technical standards for strong customer authentication and common and secure open standards of communication (OJ L 69, 13.3.2018, p. 23). |
| Text proposed by the Commission | Amendment |
|---|---|
| (70) Security of credit transfers is fundamental for increasing the confidence of payment service users in such services and ensuring their use. Payers intending to send a credit transfer to a given payee may, as a result of fraud or error, provide a unique identifier which does not correspond to an account held by that payee. To contribute to the reduction of fraud and errors, payment service users should benefit from a service which would verify whether there is any discrepancy between the unique identifier of the payee and the name of the payee provided by the payer and, should any such discrepancies be detected, notify the payer thereof. Such services, in the countries where they exist, have had a substantial positive impact on the level of fraud and errors. Given the importance of that service for the prevention of fraud and errors, such service should be available free of charge to consumers. To avoid undue frictions or delays in the processing of the transaction, the payment service provider of the payer should provide such notification within no more than a few seconds from the moment the payer has entered the payee information. To enable the payer to decide whether to proceed with the intended transaction, the payment service provider of the payer should provide such notification before the payer authorises the transaction. Certain credit transfer initiation solutions may be available to payers allowing them to place a payment order without inserting themselves the unique identifier. Instead, such data elements are provided by the provider of that initiation solution. In such cases, there is no need for a service verifying the match between the unique identifier and the name of the payee since the risk of fraud or errors is significantly reduced. | (70) Security of credit transfers is fundamental for increasing the confidence of payment service users in such services and ensuring their use. Payers intending to send a credit transfer to a given payee may, as a result of fraud or error, provide a unique identifier which does not correspond to an account held by that payee. To contribute to the reduction of fraud and errors, payment service users should benefit from a service which would verify whether there is any discrepancy between the unique identifier of the payee and the name, or other identifier such as a fiscal number, a European unique identifier as referred to in Article 16(1), second subparagraph, of Directive (EU) 2017/1132, or an LEI, that unambiguously identify the payee, provided by the payer and, should any such discrepancies be detected, notify the payer thereof. Such services, in the countries where they exist, have had a substantial positive impact on the level of fraud and errors. Given the importance of that service for the prevention of fraud and errors, such service should be available free of charge to consumers. To avoid undue frictions or delays in the processing of the transaction, the payment service provider of the payer should provide such notification within no more than a few seconds from the moment the payer has entered the payee information. To enable the payer to decide whether to proceed with the intended transaction, the payment service provider of the payer should provide such notification before the payer authorises the transaction. Certain credit transfer initiation solutions may be available to payers allowing them to place a payment order without inserting themselves the unique identifier. Instead, such data elements are provided by the provider of that initiation solution. In such cases, there is no need for a service verifying the match between the unique identifier and the name of the payee since the risk of fraud or errors is significantly reduced. |
| Text proposed by the Commission | Amendment |
|---|---|
| (71) Regulation (EU) XXX amending Regulation (EU) No 260/2012 provides for a service verifying the match between the unique identifier and the name of the payee to be offered to users of instant credit transfers in euro. To achieve a coherent framework for all credit transfers whilst avoiding any undue overlap, the verification service referred to in the present Regulation should only apply to credit transfers which are not covered by Regulation (EU) XXX amending Regulation (EU) No 260/2012. | (71) Regulation (EU) XXX amending Regulation (EU) No 260/2012 provides for a service verifying the match between the unique identifier and the name or other identifier of the payee to be offered to users of instant credit transfers in euro. To achieve a coherent framework for all credit transfers whilst avoiding any undue overlap, the verification service referred to in the present Regulation should only apply to credit transfers which are not covered by Regulation (EU) XXX amending Regulation (EU) No 260/2012. |
| Text proposed by the Commission | Amendment |
|---|---|
| (77) In the case of an unauthorised payment transaction, the payment service provider should immediately refund the amount of that transaction to the payer. However, where there is a high suspicion of an unauthorised transaction resulting from fraudulent behaviour by the payer and where that suspicion is based on objective grounds which are communicated to the relevant national authority by the payment service provider, the payment service provider should be able to conduct an investigation before refunding the payer. The payment service provider should, within 10 business days after noting or being notified of the transaction, either refund the payer the amount of the unauthorised payment transaction or provide the payer the reasons and supporting evidence for refusing the refund and indicate the bodies to which the payer may refer the matter if the payer does not accept the reasons provided. To protect the payer from any disadvantages, the credit value date of the refund should not be later than the date when the amount was debited. To provide an incentive for the payment service user to notify, without undue delay, the payment service provider of any theft or loss of a payment instrument and thus to reduce the risk of unauthorised payment transactions, the user should be liable only for a very limited amount unless the payment service user has acted fraudulently or with gross negligence. In that context, an amount of EUR 50 seems to be adequate in order to ensure a harmonised and high-level user protection within the Union. There should be no liability where the payer is not able to become aware of the loss, theft or misappropriation of the payment instrument. Moreover, once a payment service user has notified a payment service provider that his or her payment instrument may have been compromised, the payment service user should not be required to cover any further losses stemming from unauthorised use of that instrument. Payment service providers should be responsible for the technical security of their own products. | (77) In the case of an unauthorised payment transaction, the payment service provider should immediately refund the amount of that transaction to the payer. However, where there is a high suspicion of an unauthorised transaction resulting from fraudulent behaviour by the payer and where that suspicion is based on objective grounds which are communicated to the relevant national authority by the payment service provider, the payment service provider should be able to conduct an investigation before refunding the payer. The payment service provider should, within 20 business days after noting or being notified of the transaction, either refund the payer the amount of the unauthorised payment transaction or provide the payer the reasons and supporting evidence for refusing the refund and indicate the bodies to which the payer may refer the matter if the payer does not accept the reasons provided. To protect the payer from any disadvantages, the credit value date of the refund should not be later than the date when the amount was debited. To provide an incentive for the payment service user to notify, without undue delay, the payment service provider of any theft or loss of a payment instrument and thus to reduce the risk of unauthorised payment transactions, the user should be liable only for a very limited amount unless the payment service user has acted fraudulently or with gross negligence. In that context, an amount of EUR 50 seems to be adequate in order to ensure a harmonised and high-level user protection within the Union. There should be no liability where the payer is not able to become aware of the loss, theft or misappropriation of the payment instrument. Moreover, once a payment service user has notified a payment service provider that his or her payment instrument may have been compromised, the payment service user should not be required to cover any further losses stemming from unauthorised use of that instrument. Payment service providers should be responsible for the technical security of their own products. |
| Text proposed by the Commission | Amendment |
|---|---|
| (78) Liability provisions in the case of authorised credit transfers where there was an incorrect application or malfunctioning of the service detecting discrepancies between the name and unique identifier of a payee would create the right incentives for payment service providers to provide a fully functioning service, with the aim of reducing the risk of ill-informed payment authorisations. If the payer decided to make use of such a service, the payment service provider of the payer should be held liable for the full amount of the credit transfer in cases where that payment service provider failed, whereas it should have done so if properly functioning, to notify the payer of a discrepancy between the unique identifier and the name of the payee provided by the payer and such failure caused a financial damage to the payer. Where the liability of the payment service provider of the payer is attributable to the payment service provider of the payee, the payment service provider of the payee should compensate the payment service provider of the payer for the financial damage incurred. | (78) Liability provisions in the case of authorised credit transfers where there was an incorrect application or malfunctioning of the service detecting discrepancies between the name or other identifier and unique identifier of a payee would create the right incentives for payment service providers to provide a fully functioning service, with the aim of reducing the risk of ill-informed payment authorisations. If the payer decided to make use of such a service, the payment service provider of the payer should be held liable for the full amount of the credit transfer in cases where that payment service provider failed, whereas it should have done so if properly functioning, to notify the payer of a discrepancy between the unique identifier and the name of the payee provided by the payer and such failure caused a financial damage to the payer. Where the liability of the payment service provider of the payer is attributable to the payment service provider of the payee, the payment service provider of the payee should compensate the payment service provider of the payer for the financial damage incurred. |
| Text proposed by the Commission | Amendment |
|---|---|
| (79) Consumers should be adequately protected in the context of certain fraudulent payment transactions that they have authorised without knowing these transactions were fraudulent. The number of ‘social engineering’ cases where consumers are misled into authorising a payment transaction to a fraudster has significantly increased in recent years. ‘Spoofing’ cases where fraudsters pretend to be employees of a customer's payment service provider and misuse the payment service provider's name, mail address or telephone number to gain the customers’ trust and trick them into carrying-out some actions, are unfortunately becoming more widespread in the Union. Those new types of ‘spoofing’ fraud are blurring the difference that existed in Directive (EU) 2015/2366 between authorised and unauthorised transactions. Means through which the consent may be assumed to be granted are also becoming more complex to identify, as fraudsters can take control of the whole consent and authentication process including of the strong customer authentication completion. The conditions under which the customer authorised a transaction by giving his or her permission to it should be taken into due consideration, including by courts, to qualify a transaction as being authorised or unauthorised. A transaction may indeed have been authorised in circumstances where such authorisation was granted on manipulated premises affecting the integrity of the permission. It is therefore no longer possible, as was the case in Directive (EU) 2015/2366, to limit refunds to unauthorised transactions only. It would however be disproportionate and financially very costly to payment services providers to open every fraudulent transaction, authorised or unauthorised, to a systematic refund right. It might also cause moral hazard and a reduction in the customer’s vigilance. | (79) Payment service users should be adequately protected in the context of the so-called social engineering fraud, where the fraudster manipulates the payment service user in performing a certain action, such as initiating a payment transaction, or handing over their security credentials to the fraudsters. The number of such type of ‘social engineering’ cases has significantly increased in recent years. ‘Spoofing’ cases where fraudsters pretend to be a legitimate payee or an employee of a customer's payment service provider and misuse that person’s or the payment service provider's name, mail address or telephone number to gain the customers’ trust and trick them into carrying-out some actions, are unfortunately becoming more widespread in the Union. Those new types of ‘spoofing’ fraud are blurring the difference that existed in Directive (EU) 2015/2366 between authorised and unauthorised transactions. The conditions under which the customer gave his or her permission for making a payment should be taken into due consideration, including by courts, to qualify a transaction as being authorised or unauthorised. Therefore, where the customer denies having authorised a payment, the use of the payer's personalised security credentials to authenticate a payment, including where relevant the application of strong customer authentication, should not in itself be sufficient to prove that the payment transaction was authorised by the payer. |
| Text proposed by the Commission | Amendment |
|---|---|
| (79) Consumers should be adequately protected in the context of certain fraudulent payment transactions that they have authorised without knowing these transactions were fraudulent. The number of ‘social engineering’ cases where consumers are misled into authorising a payment transaction to a fraudster has significantly increased in recent years. ‘Spoofing’ cases where fraudsters pretend to be employees of a customer's payment service provider and misuse the payment service provider's name, mail address or telephone number to gain the customers’ trust and trick them into carrying-out some actions, are unfortunately becoming more widespread in the Union. Those new types of ‘spoofing’ fraud are blurring the difference that existed in Directive (EU) 2015/2366 between authorised and unauthorised transactions. Means through which the consent may be assumed to be granted are also becoming more complex to identify, as fraudsters can take control of the whole consent and authentication process including of the strong customer authentication completion. The conditions under which the customer authorised a transaction by giving his or her permission to it should be taken into due consideration, including by courts, to qualify a transaction as being authorised or unauthorised. A transaction may indeed have been authorised in circumstances where such authorisation was granted on manipulated premises affecting the integrity of the permission. It is therefore no longer possible, as was the case in Directive (EU) 2015/2366, to limit refunds to unauthorised transactions only. It would however be disproportionate and financially very costly to payment services providers to open every fraudulent transaction, authorised or unauthorised, to a systematic refund right. It might also cause moral hazard and a reduction in the customer’s vigilance. | (79) Consumers should be adequately protected in the context of certain fraudulent payment transactions that they have authorised without knowing these transactions were fraudulent. The number of ‘social engineering’ cases where consumers are misled into authorising a payment transaction to a fraudster has significantly increased in recent years. ‘Spoofing’ cases where fraudsters pretend to be employees of a customer's payment service provider, or a relevant entity which could reasonably be linked to a trusted source of the customer, such as a central bank or government authority, and misuse the payment service provider's name, mail address or telephone number to gain the customers’ trust and trick them into carrying-out some actions, are unfortunately becoming more widespread in the Union. Those new types of ‘spoofing’ fraud are blurring the difference that existed in Directive (EU) 2015/2366 between authorised and unauthorised transactions. Means through which the consent may be assumed to be granted are also becoming more complex to identify, as fraudsters can take control of the whole consent and authentication process including of the strong customer authentication completion. The conditions under which the customer authorised a transaction by giving his or her permission to it should be taken into due consideration, including by courts, to qualify a transaction as being authorised or unauthorised. A transaction may indeed have been authorised in circumstances where such authorisation was granted on manipulated premises affecting the integrity of the permission. It is therefore no longer possible, as was the case in Directive (EU) 2015/2366, to limit refunds to unauthorised transactions only. It would however be disproportionate and financially very costly to payment services providers to open every fraudulent transaction, authorised or unauthorised, to a systematic refund right. It might also cause moral hazard and a reduction in the customer’s vigilance. |
| Text proposed by the Commission | Amendment |
|---|---|
| (79) Consumers should be adequately protected in the context of certain fraudulent payment transactions that they have authorised without knowing these transactions were fraudulent. The number of ‘social engineering’ cases where consumers are misled into authorising a payment transaction to a fraudster has significantly increased in recent years. ‘Spoofing’ cases where fraudsters pretend to be employees of a customer's payment service provider and misuse the payment service provider's name, mail address or telephone number to gain the customers’ trust and trick them into carrying-out some actions, are unfortunately becoming more widespread in the Union. Those new types of ‘spoofing’ fraud are blurring the difference that existed in Directive (EU) 2015/2366 between authorised and unauthorised transactions. Means through which the consent may be assumed to be granted are also becoming more complex to identify, as fraudsters can take control of the whole consent and authentication process including of the strong customer authentication completion. The conditions under which the customer authorised a transaction by giving his or her permission to it should be taken into due consideration, including by courts, to qualify a transaction as being authorised or unauthorised. A transaction may indeed have been authorised in circumstances where such authorisation was granted on manipulated premises affecting the integrity of the permission. It is therefore no longer possible, as was the case in Directive (EU) 2015/2366, to limit refunds to unauthorised transactions only. It would however be disproportionate and financially very costly to payment services providers to open every fraudulent transaction, authorised or unauthorised, to a systematic refund right. It might also cause moral hazard and a reduction in the customer’s vigilance. | (79) Consumers should be adequately protected in the context of certain fraudulent payment transactions that they have authorised without knowing these transactions were fraudulent. The number of ‘social engineering’ cases where consumers are misled into authorising a payment transaction to a fraudster has significantly increased in recent years. ‘Spoofing’ cases where fraudsters pretend to be employees of a customer's payment service provider and misuse the payment service provider's name, e-mail address or telephone number to gain the customers’ trust and trick them into carrying-out some actions, are unfortunately becoming more widespread in the Union. Those new types of ‘spoofing’ or 'impersonation' fraud are blurring the difference that existed in Directive (EU) 2015/2366 between authorised and unauthorised transactions. Means through which the permission may be assumed to be granted are also becoming more complex to identify, as fraudsters can take control of the whole permission and authentication process including the strong customer authentication completion. The conditions under which the customer authorised a transaction by giving his or her permission to it should be taken into due consideration, including by courts, to qualify a transaction as being authorised or unauthorised. A transaction may indeed have been authorised in circumstances where such authorisation was granted on the basis of manipulation, affecting the integrity of the permission. It is therefore no longer possible, as was the case in Directive (EU) 2015/2366, to limit refunds to unauthorised transactions only. It would however be disproportionate and financially very costly to payment services providers to open every fraudulent transaction, authorised or unauthorised, to a systematic refund right. It might also cause moral hazard and a reduction in the customer’s vigilance. |
| Text proposed by the Commission | Amendment |
|---|---|
| (80) Payment service providers could be also considered as victims of ‘spoofing’ cases, as their details were usurped. However, payment service providers have more means than consumers to put an end to these fraud cases, through adequate prevention and robust technical safeguards developed with electronic communications services providers such as mobile network operators, internet platforms etc. Cases of bank employee impersonation fraud affect the good repute of the bank, of the banking sector as a whole and may cause significant financial damages to Union consumers, affecting their trust in electronic payments and in the banking system. A good-faith consumer who has been the victim of such ‘spoofing’ fraud where fraudsters pretend to be employees of a customer's payment service provider and misuse the payment service provider's name, mail address or telephone number should therefore be entitled to a refund of the full amount of the fraudulent payment transaction from the payment service provider, unless the payer has acted fraudulently or with ‘gross negligence’. As soon as the consumer becomes aware that he or she has been a victim of that type of spoofing fraud, the consumer should without undue delay report the incident to the police, preferably via online complaint procedures, where made available by the police, and to his or her payment service provider, providing every necessary supporting evidence. No refund should be granted where those procedural conditions are not fulfilled. | (80) Payment service providers have more means than consumers to put an end to cases of “spoofing”, where the fraudster impersonates an employee of the payment service provider and misuses the payment service provider’s name, mail address or telephone number to trick customers into carrying out some actions, through adequate prevention and robust technical safeguards developed with electronic communications services providers such as mobile network operators, internet platforms etc. Those electronic communications services should be obliged to cooperate with payment service providers in the fight against fraud. If they fail to do so, they should be held jointly responsible in the event of fraud. Cases of bank employee impersonation fraud affect the good repute of the bank, of the banking sector as a whole and may cause significant financial damages to Union consumers, affecting their trust in electronic payments and in the banking system. A good-faith consumer who has been the victim of such ‘spoofing’ fraud where fraudsters pretend to be employees of a customer's payment service provider and misuse the payment service provider's name, mail address or telephone number should therefore be entitled to a refund of the full amount of the fraudulent payment transaction from the payment service provider, unless the payer has acted fraudulently or with ‘gross negligence’. As soon as the consumer becomes aware that he or she has been a victim of that type of spoofing fraud, the consumer should without undue delay report the incident to the police, preferably via online complaint procedures, where made available by the police, and to his or her payment service provider, providing every necessary supporting evidence. No refund should be granted where those procedural conditions are not fulfilled. |
| Text proposed by the Commission | Amendment |
|---|---|
| (81) Given their obligations to safeguard the security of their services in accordance with Directive 2002/58/EC of the European Parliament and of the Council49 , electronic communications services providers have the capacity to contribute to the collective fight against ‘spoofing’ fraud. Therefore, and without prejudice to the obligations laid down in national law implementing that Directive, electronic communications services providers should cooperate with payment service providers with a view to preventing further occurrences of that type of fraud, including by acting promptly to ensure that appropriate organizational and technical measures are in place to safeguard the security and confidentiality of communications in accordance with Directive 2002/58/EC. Any claim by a payment service provider against other providers, such as electronic communications services providers, for financial damage caused in the context of this type of fraud should be made in accordance with national law. | (81) Given their obligations to safeguard the security of their services in accordance with Directive 2002/58/EC of the European Parliament and of the Council, electronic communications services providers have the capacity to contribute to the collective fight against ‘spoofing’ fraud. Therefore, and without prejudice to the obligations laid down in national law implementing that Directive, electronic communications services providers should also, where relevant, have the same level of liability as payment service providers, and cooperate with payment service providers with a view to preventing further occurrences of that type of fraud, including by acting promptly to ensure that appropriate organizational and technical measures are in place to safeguard the security and confidentiality of communications in accordance with Directive 2002/58/EC. Any claim for fraud against other providers, such as electronic communications services providers or online platforms, for financial damage caused in the context of this type of fraud should be made in accordance with this Regulation. |
| 49 Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (OJ L 201, 31.7.2002, p.37). | 49 Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (OJ L 201, 31.7.2002, p.37). |
| Text proposed by the Commission | Amendment |
|---|---|
| (81) Given their obligations to safeguard the security of their services in accordance with Directive 2002/58/EC of the European Parliament and of the Council49 , electronic communications services providers have the capacity to contribute to the collective fight against ‘spoofing’ fraud. Therefore, and without prejudice to the obligations laid down in national law implementing that Directive, electronic communications services providers should cooperate with payment service providers with a view to preventing further occurrences of that type of fraud, including by acting promptly to ensure that appropriate organizational and technical measures are in place to safeguard the security and confidentiality of communications in accordance with Directive 2002/58/EC. Any claim by a payment service provider against other providers, such as electronic communications services providers, for financial damage caused in the context of this type of fraud should be made in accordance with national law. | (81) Given their obligations to safeguard the security of their services in accordance with Directive 2002/58/EC of the European Parliament and of the Council49 , electronic communications services providers have the capacity to contribute to the collective fight against ‘spoofing’ fraud. Therefore, and without prejudice to the obligations laid down in national law implementing that Directive, electronic communications services providers should cooperate with payment service providers with a view to preventing further occurrences of that type of fraud, including by acting promptly to ensure that appropriate organizational and technical measures are in place to safeguard the security and confidentiality of communications in accordance with Directive 2002/58/EC. Any claim by a payment service provider against other providers, such as electronic communications services providers, for financial damage caused in the context of this type of fraud should be made in accordance with national law. Electronic communications services providers cannot be held liable for payment fraud committed by the third party. |
| 49 Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (OJ L 201, 31.7.2002, p.37). | 49 Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (OJ L 201, 31.7.2002, p.37). |
| Text proposed by the Commission | Amendment |
|---|---|
| (81 a) Online platforms can also contribute to increasing instances of fraud. Therefore, and without prejudice to their obligations under Regulation (EU) 2022/2065, they should be held liable where fraud has arisen as a direct result of fraudsters using their platform to defraud consumers. |
| Text proposed by the Commission | Amendment |
|---|---|
| (82) To assess possible negligence or gross negligence on the part of the payment service user, account should be taken of all circumstances. The evidence and degree of alleged negligence should generally be evaluated according to national law. However, while the concept of negligence implies a breach of a duty of care, ‘gross negligence’ should mean more than mere negligence, involving conduct exhibiting a significant degree of carelessness; for example, keeping the credentials used to authorise a payment transaction beside the payment instrument in a format that is open and easily detectable by third parties. The fact that a consumer has already received a refund from a payment service provider after having fallen victim of bank employee impersonation fraud and is introducing another refund claim to the same payment service provider after having been again victim of the same type of fraud could be considered as ‘gross negligence’ as that might indicate a high level of carelessness from the user who should have been more vigilant after having already be victim of the same fraudulent modus operandi. | (82) To assess possible negligence or gross negligence on the part of the payment service user, account should be taken of all circumstances. For example, where a payment service user falls victim of social engineering fraud, in order to assess whether the payment service user has acted with gross negligence, account should be taken of all relevant factors, including but not limited to the complexity of the fraud, the personal circumstances of the payment service user, whether the latter had reasonable grounds for believing that he/she was making a payment to a legitimate payee, and whether the payment service provider could have taken additional steps to help prevent the fraud from taking place. While the concept of negligence implies a breach of a duty of care, ‘gross negligence’ should mean more than mere negligence, involving conduct exhibiting a significant degree of carelessness; for example, making a payment to a fraudster without having any reasonable ground for believing the payee to whom the payment was intended is legitimate, or keeping the credentials used to authorise a payment transaction beside the payment instrument in a format that is open and easily detectable by third parties. The fact that a consumer has already received a refund from a payment service provider after having fallen victim of impersonation fraud and is introducing another refund claim after having been again victim of the same type of fraud could be considered as ‘gross negligence’ as that might indicate a high level of carelessness from the user who should have been more vigilant after having already be victim of the same fraudulent modus operandi. |
| Text proposed by the Commission | Amendment |
|---|---|
| (82) To assess possible negligence or gross negligence on the part of the payment service user, account should be taken of all circumstances. The evidence and degree of alleged negligence should generally be evaluated according to national law. However, while the concept of negligence implies a breach of a duty of care, ‘gross negligence’ should mean more than mere negligence, involving conduct exhibiting a significant degree of carelessness; for example, keeping the credentials used to authorise a payment transaction beside the payment instrument in a format that is open and easily detectable by third parties. The fact that a consumer has already received a refund from a payment service provider after having fallen victim of bank employee impersonation fraud and is introducing another refund claim to the same payment service provider after having been again victim of the same type of fraud could be considered as ‘gross negligence’ as that might indicate a high level of carelessness from the user who should have been more vigilant after having already be victim of the same fraudulent modus operandi. | (82) To assess possible negligence or gross negligence on the part of the payment service user, account should be taken of all circumstances. The evidence and degree of alleged negligence should generally be evaluated according to national law. However, while the concept of negligence implies a breach of a duty of care, ‘gross negligence’ should mean more than mere negligence, involving conduct exhibiting a significant degree of carelessness; for example, keeping the credentials used to authorise a payment transaction beside the payment instrument in a format that is open and easily detectable by third parties. |
| Text proposed by the Commission | Amendment |
|---|---|
| (82) To assess possible negligence or gross negligence on the part of the payment service user, account should be taken of all circumstances. The evidence and degree of alleged negligence should generally be evaluated according to national law. However, while the concept of negligence implies a breach of a duty of care, ‘gross negligence’ should mean more than mere negligence, involving conduct exhibiting a significant degree of carelessness; for example, keeping the credentials used to authorise a payment transaction beside the payment instrument in a format that is open and easily detectable by third parties. The fact that a consumer has already received a refund from a payment service provider after having fallen victim of bank employee impersonation fraud and is introducing another refund claim to the same payment service provider after having been again victim of the same type of fraud could be considered as ‘gross negligence’ as that might indicate a high level of carelessness from the user who should have been more vigilant after having already be victim of the same fraudulent modus operandi. | (82) To assess possible negligence or gross negligence on the part of the payment service user, account should be taken of all circumstances. The evidence and degree of alleged negligence should generally be evaluated according to national law. However, while the concept of negligence implies a breach of a duty of care, ‘gross negligence’ should mean more than mere negligence, involving conduct exhibiting a significant degree of carelessness; for example, keeping the credentials used to authorise a payment transaction beside the payment instrument in a format that is open and easily detectable by third parties, unsafe manipulation with security codes, debit card or a device used to provide the access to banking, persuading the bank to lift the blockade placed after a fraud alert acting on guidance from an unfamiliar third party, transferring money to foreign accounts under suspicious circumstances or opening one or more crypto wallets acting on guidance from an unfamiliar third party. The fact that a consumer has already received a refund from a payment service provider after having fallen victim of bank employee impersonation fraud and is introducing another refund claim to the same payment service provider after having been again victim of the same type of fraud could be considered as ‘gross negligence’ as that might indicate a high level of carelessness from the user who should have been more vigilant after having already be victim of the same fraudulent modus operandi. |
| Text proposed by the Commission | Amendment |
|---|---|
| (82) To assess possible negligence or gross negligence on the part of the payment service user, account should be taken of all circumstances. The evidence and degree of alleged negligence should generally be evaluated according to national law. However, while the concept of negligence implies a breach of a duty of care, ‘gross negligence’ should mean more than mere negligence, involving conduct exhibiting a significant degree of carelessness; for example, keeping the credentials used to authorise a payment transaction beside the payment instrument in a format that is open and easily detectable by third parties. The fact that a consumer has already received a refund from a payment service provider after having fallen victim of bank employee impersonation fraud and is introducing another refund claim to the same payment service provider after having been again victim of the same type of fraud could be considered as ‘gross negligence’ as that might indicate a high level of carelessness from the user who should have been more vigilant after having already be victim of the same fraudulent modus operandi. | (82) To assess possible negligence or gross negligence on the part of the payment service user, account should be taken of all circumstances. The evidence and degree of alleged negligence should generally be evaluated according to national law. However, while the concept of negligence implies a breach of a duty of care, ‘gross negligence’ should mean more than mere negligence, involving conduct exhibiting a significant degree of carelessness; for example, keeping the credentials used to authorise a payment transaction beside the payment instrument in a format that is open and easily detectable by third parties. The fact that a consumer has already received a refund from a payment service provider after having fallen victim of a trusted institution employee impersonation fraud, for example bank employee impersonation fraud, and is introducing another refund claim to the same payment service provider after having been again victim of the same type of fraud could be considered as ‘gross negligence’ as that might indicate a high level of carelessness from the user who should have been more vigilant after having already be victim of the same fraudulent modus operandi. |
| Text proposed by the Commission | Amendment |
|---|---|
| (82 a) Considering the difference in interpretation across the Union of the term 'gross negligence', the EBA should issue guidelines for Member States on how to define the term. |
| Text proposed by the Commission | Amendment |
|---|---|
| (98) As acknowledged in the Communication from the Commission on a Retail Payments Strategy for the EU, the good functioning of EU payments markets is of substantial public interest. Therefore, when it is necessary in the context of this Regulation for the provision of payment services and for the compliance with this Regulation, payment service providers and payment system operators should be able to process special categories of personal data as defined in Article 9(1) of Regulation (EU) 2016/679 and Article 10(1) of Regulation (EU) 2018/1725. Where special categories of personal data are processed, payment service providers and payment system operators should implement appropriate technical and organisational measures to safeguard the fundamental rights and freedoms of natural persons. Those measures should include technical limitations on the re-use of data and the use of state-of-the-art security and privacy-preserving measures, including pseudonymisation, or encryption to ensure compliance with the principles of purpose limitation, data minimisation and storage limitation, as laid down in Regulation (EU) 2016/679. The payment service providers and payment systems should also implement specific organisation measures, including training on processing such data, limiting access to special categories of data and recording such access. | (98) As acknowledged in the Communication from the Commission on a Retail Payments Strategy for the EU, the good functioning of EU payments markets is of substantial public interest. Therefore, when it is necessary in the context of this Regulation for the provision of payment services and for the compliance with this Regulation, payment service providers and payment system operators should be able to process special categories of personal data as defined in Article 9(1) of Regulation (EU) 2016/679 and Article 10(1) of Regulation (EU) 2018/1725. Where special categories of personal data are processed, payment service providers and payment system operators should implement appropriate technical and organisational measures to safeguard the fundamental rights and freedoms of natural persons. Those measures should include technical limitations on the re-use of data and the use of state-of-the-art security and privacy-preserving measures, including, but not limited to, pseudonymisation, or encryption to ensure compliance with the principles of purpose limitation, data minimisation and storage limitation, as laid down in Regulation (EU) 2016/679. The payment service providers and payment systems should also implement specific organisation measures, including training on processing such data, limiting access to special categories of data and recording such access. |
| Text proposed by the Commission | Amendment |
|---|---|
| (98) As acknowledged in the Communication from the Commission on a Retail Payments Strategy for the EU, the good functioning of EU payments markets is of substantial public interest. Therefore, when it is necessary in the context of this Regulation for the provision of payment services and for the compliance with this Regulation, payment service providers and payment system operators should be able to process special categories of personal data as defined in Article 9(1) of Regulation (EU) 2016/679 and Article 10(1) of Regulation (EU) 2018/1725. Where special categories of personal data are processed, payment service providers and payment system operators should implement appropriate technical and organisational measures to safeguard the fundamental rights and freedoms of natural persons. Those measures should include technical limitations on the re-use of data and the use of state-of-the-art security and privacy-preserving measures, including pseudonymisation, or encryption to ensure compliance with the principles of purpose limitation, data minimisation and storage limitation, as laid down in Regulation (EU) 2016/679. The payment service providers and payment systems should also implement specific organisation measures, including training on processing such data, limiting access to special categories of data and recording such access. | (98) As acknowledged in the Communication from the Commission on a Retail Payments Strategy for the EU, the good functioning of EU payments markets is of substantial public interest. Therefore, when it is necessary in the context of this Regulation for the provision of payment services and for the compliance with this Regulation, payment service providers and payment system operators should be able to process special categories of personal data as defined in Article 9(1) of Regulation (EU) 2016/679 and Article 10(1) of Regulation (EU) 2018/1725. Where special categories of personal data are processed, payment service providers and payment system operators should implement appropriate technical and organisational measures to safeguard the fundamental rights and freedoms of natural persons. Those measures should include technical limitations on the re-use of data and the use of state-of-the-art security and privacy-preserving measures, including pseudonymisation, or encryption to ensure compliance with the principles of purpose limitation, data minimisation and storage limitation, as laid down in Regulation (EU) 2016/679. The payment service providers and payment system operators should also implement specific organisation measures, including training on processing such data, limiting access to special categories of data and recording such access. |
| Text proposed by the Commission | Amendment |
|---|---|
| (100) Fraudsters often target the most vulnerable individuals of our society. The timely detection of fraudulent payment transactions is essential, and transaction monitoring plays an import role in that detection. It is therefore appropriate to require payment service providers to have in place transaction monitoring mechanisms, reflecting the crucial contribution of those mechanisms to fraud prevention, going beyond the protection offered by strong customer authentication, in respect of payment transactions, including transactions involving payment initiation services. | (100) Fraudsters often target the most vulnerable individuals of our society. The timely detection of fraudulent payment transactions is essential, and transaction monitoring plays an import role in that detection. It is therefore appropriate to require payment service providers to have in place transaction monitoring mechanisms, reflecting the crucial contribution of those mechanisms to fraud prevention, going beyond the protection offered by strong customer authentication, in respect of payment transactions, including transactions involving payment initiation services. Where payment service providers fail to have in place the appropriate mechanisms to prevent fraud, they should be held responsible for covering the losses of payment service users resulting from fraud. |
| Text proposed by the Commission | Amendment |
|---|---|
| (100) Fraudsters often target the most vulnerable individuals of our society. The timely detection of fraudulent payment transactions is essential, and transaction monitoring plays an import role in that detection. It is therefore appropriate to require payment service providers to have in place transaction monitoring mechanisms, reflecting the crucial contribution of those mechanisms to fraud prevention, going beyond the protection offered by strong customer authentication, in respect of payment transactions, including transactions involving payment initiation services. | (100) Fraudsters often target the most vulnerable individuals of our society. The timely detection of fraudulent payment transactions is essential, and transaction monitoring plays an important role in that detection. It is therefore appropriate to require payment service providers to have in place transaction monitoring mechanisms, reflecting the crucial contribution of those mechanisms to fraud prevention, going beyond the protection offered by strong customer authentication, in respect of payment transactions, including transactions involving payment initiation services. |
| Text proposed by the Commission | Amendment |
|---|---|
| (103) Fraud in credit transfers is inherently adaptive and comprises an open-ended diversity of practices and techniques, including the stealing of authentication credentials, invoice tampering, and social manipulation. Therefore, to be able to prevent ever new types of fraud, transaction monitoring should be constantly improved, making full use of technology such as artificial intelligence. Often one payment service provider does not have the full picture about all elements that could lead to timely fraud detection. However, it can be made more effective with a greater amount of information on potentially fraudulent activity stemming from other payment service providers. Therefore, sharing of all relevant information between payment service providers should be possible. To better detect fraudulent payment transactions and protect their customers, payment services providers should, for the purpose of transaction monitoring, make use of payment fraud data shared by other payment services providers on a multilateral basis such as dedicated IT platforms based on information sharing arrangements. To improve the protection of payers against fraud in credit transfers, payment service providers should be able to rely on information as comprehensive and up to date as possible, namely by collectively using information concerning unique identifiers, manipulation techniques and other circumstances associated with fraudulent credit transfers identified individually by each payment services provider. Before concluding an information sharing arrangement, payment service providers should carry out a data protection impact assessment, in accordance with Article 35 of Regulation (EU) 2016/679. Where the data protection impact assessment indicates that the processing would, in the absence of safeguards, security measures and mechanisms to mitigate the risk, result in a high risk to the rights and freedoms of natural persons, payment service providers should consult the relevant data protection authority in accordance with Article 36 of that Regulation (EU) 2016/679. A new impact assessment should not be required when a payment service provider joins an existing information sharing arrangement for which a data protection impact assessment has already been carried out. The information sharing arrangement should lay down technical and organisational measures to protect personal data. It should lay down roles and responsibilities under data protection laws, including in case of joint controllers, of all payment service providers. | (103) Fraud in credit transfers is inherently adaptive and comprises an open-ended diversity of practices and techniques, including the stealing of authentication credentials, invoice tampering, and social manipulation. Therefore, to be able to prevent ever new types of fraud, transaction monitoring should be constantly improved, making full use of technology such as artificial intelligence. Often one payment service provider does not have the full picture about all elements that could lead to timely fraud detection. However, it can be made more effective with a greater amount of information on potentially fraudulent activity stemming from other payment service providers. Therefore, sharing of all relevant information between payment service providers should be mandatory. To better detect fraudulent payment transactions and protect their customers, payment services providers should, for the purpose of transaction monitoring, make use of payment fraud data shared by other payment services providers on a multilateral basis such as dedicated IT platforms based on information sharing arrangements. To improve the protection of payers against fraud in credit transfers, payment service providers should be able to rely on information as comprehensive and up to date as possible, namely by collectively using information concerning unique identifiers, manipulation techniques and other circumstances associated with fraudulent credit transfers identified individually by each payment services provider. Before concluding an information sharing arrangement, payment service providers should carry out a data protection impact assessment, in accordance with Article 35 of Regulation (EU) 2016/679. Where the data protection impact assessment indicates that the processing would, in the absence of safeguards, security measures and mechanisms to mitigate the risk, result in a high risk to the rights and freedoms of natural persons, payment service providers should consult the relevant data protection authority in accordance with Article 36 of that Regulation (EU) 2016/679. A new impact assessment should not be required when a payment service provider joins an existing information sharing arrangement for which a data protection impact assessment has already been carried out. The information sharing arrangement should lay down technical and organisational measures to protect personal data. It should lay down roles and responsibilities under data protection laws, including in case of joint controllers, of all payment service providers. |
| Text proposed by the Commission | Amendment |
|---|---|
| (104) For the purpose of exchanging personal data with other payment service providers who are subject to information sharing arrangements, ‘unique identifier’ should be understood as referring to ‘IBAN’ as defined in Article 2 point 15 of Regulation (EU) 260/2012. | deleted |
| Text proposed by the Commission | Amendment |
|---|---|
| (104) For the purpose of exchanging personal data with other payment service providers who are subject to information sharing arrangements, ‘unique identifier’ should be understood as referring to ‘IBAN’ as defined in Article 2 point 15 of Regulation (EU) 260/2012. | (104) For the purpose of exchanging personal data with other payment service providers who are subject to information sharing arrangements, ‘unique identifier’ should be understood as referring to ‘IBAN’ as defined in Article 2 point 15 of Regulation (EU) 260/2012. The unique identifier should be verified for all credit transfers, and not only credit transfers in euro. |
| Text proposed by the Commission | Amendment |
|---|---|
| (107 a) In order for consumers to benefit from continued strong SCA, and that it remains an effective tool in the fight against fraud in electronic payments, it is appropriate that the application of SCA be risk-based and outcome-focused. In turn, the rules on SCA should provide sufficient flexibility for innovation within the payments sector, including in the development of new SCA solutions. |
| Text proposed by the Commission | Amendment |
|---|---|
| (108) SCA should not be circumvented notably by any unjustified reliance on SCA exemptions. Clear definitions of Merchant Initiated Transactions (MITs) and of Mail Orders or Telephone Orders (MOTOs) should be introduced since these notions, which may be relied upon to justify non-application of SCA, are diversely understood and applied and are subject to abusive reliance. Regarding MITs, strong customer authentication should be applied at the set-up of the initial mandate, without the need to apply SCA for subsequent merchant-initiated payment transactions. Regarding MOTOs, only the initiation of payment transactions - not their execution - should be non-digital for a transaction to be considered as a MOTO and, therefore, not be covered by the obligation to apply SCA. However, payment transactions based on paper-based payment orders, mail orders or telephone orders placed by the payer should still entail security requirements and checks by the payment service provider of the payer allowing authentication of the payment transaction. SCA should also not be circumvented by practices including resorting to an acquirer established outside of the Union to escape the SCA requirements. | (108) SCA should not be circumvented notably by any unjustified reliance on SCA exemptions. Clear definitions of Merchant Initiated Transactions (MITs) and of Mail Orders or Telephone Orders (MOTOs) should be introduced by the EBA since these notions, which may be relied upon to justify non-application of SCA, are diversely understood and applied and are subject to abusive reliance. Regarding MITs, strong customer authentication should be applied at the set-up of the initial mandate, without the need to apply SCA for subsequent merchant-initiated payment transactions. Regarding MOTOs, only the initiation of payment transactions - not their execution - should be non-digital for a transaction to be considered as a MOTO and, therefore, not be covered by the obligation to apply SCA. However, payment transactions based on paper-based payment orders, mail orders or telephone orders placed by the payer should still entail security requirements and checks by the payment service provider of the payer allowing authentication of the payment transaction. SCA should also not be circumvented by practices including resorting to an acquirer established outside of the Union to escape the SCA requirements. |
There are no definitions of MOTO and MIT in the legislative text. Hence, it should be the EBA who draws a clear definition.
| Text proposed by the Commission | Amendment |
|---|---|
| (109) As the payment service provider that should apply strong customer authentication is the payment service provider that issues the personalised security credentials, payment transactions that are not initiated by the payer but by the payee only should not be subject to strong customer authentication to the extent that those transactions are initiated without any interaction or involvement of the payer. The regulatory approach to MITs and direct debits, both being transactions initiated by the payee, should be aligned and benefit from the same consumer protection measures, including refunds. | (109) As the payment service provider that should apply strong customer authentication is the payment service provider that issues the personalised security credentials, payment transactions that are not initiated by the payer but by the payee only should not be subject to strong customer authentication to the extent that those transactions are initiated without any interaction or involvement of the payer. |
| Text proposed by the Commission | Amendment |
|---|---|
| (109 a) In the context of business to business (B2B) or business to government (B2G) payments, SCA should be appropriate to the risk level of such transactions, taking into account in particular the already existing controls and checks that exist among these operators. In order to reduce administrative burden, SCA should not be required for every transaction in these scenarios, and should be adapted to a risk-based approach. |
| Text proposed by the Commission | Amendment |
|---|---|
| (115) Under the exemption from SCA under Article 18 of Delegated Regulation (EU) 2018/389, payment service providers were allowed not to apply SCA where the payer initiated a remote electronic payment transaction identified by the payment service provider as posing a low level of risk evaluated on the basis of transaction monitoring mechanisms. Feedback from the market showed however that, in order to have more payment service providers implementing transaction risk analysis, it is necessary to adopt appropriate rules on the scope of transaction risk analysis, introducing clear audit requirements, providing more detail and better definitions on risk monitoring requirements and data to share, and to assess the potential benefits of allowing payment service providers to report fraudulent transactions for which they are solely liable. The EBA should develop draft Regulatory Technical Standards laying down rules on transaction risk analysis. | (115) Under the exemption from SCA under Article 18 of Delegated Regulation (EU) 2018/389, payment service providers were allowed not to apply SCA where the payer initiated a remote electronic payment transaction identified by the payment service provider as posing a low level of risk evaluated on the basis of transaction monitoring mechanisms. Feedback from the market showed however that, in order to have more payment service providers implementing transaction risk analysis, it is necessary to adopt appropriate rules on the scope of transaction risk analysis, introducing clear audit requirements, providing more detail and better definitions on risk monitoring requirements and data to share, and to assess the potential benefits of allowing payment service providers to report fraudulent transactions for which they are solely liable. The EBA should develop draft Regulatory Technical Standards laying down rules on transaction risk analysis. In order to increase the use of this exemption, the draft RTS should consider additional thresholds for the transaction risk analysis exemption. Furthermore, they should consider whether it is necessary to clarify whether payment service providers should count liability only towards the payer in their fraud rates. |
| Text proposed by the Commission | Amendment |
|---|---|
| (116) Security measures should be compatible with the level of risk involved in payment services. To allow the development of user-friendly and accessible means of payment for low-risk payments, such as low value contactless payments at the point of sale, whether or not these payments are based on mobile phone, the exemptions to the application of security requirements should be specified in regulatory technical standards. Safe use of personalised security credentials is needed to limit the risks relating to spoofing, phishing and other fraudulent activities. The user should be able to rely on the adoption of measures that protect the confidentiality and integrity of personalised security credentials. | (116) Security measures should be compatible with the level of risk involved in payment services. To allow the development of user-friendly and accessible means of payment for low-risk payments, such as low value contactless payments at the point of sale or payments made in a corporate context by corporate payer, whether or not these payments are based on mobile phone, the exemptions to the application of security requirements should be specified in regulatory technical standards. Safe use of personalised security credentials is needed to limit the risks relating to spoofing, phishing and other fraudulent activities. The user should be able to rely on the adoption of measures that protect the confidentiality and integrity of personalised security credentials. |
| Text proposed by the Commission | Amendment |
|---|---|
| (119) Operators of digital pass-through wallets that verify the elements of SCA when tokenised instruments stored in the digital wallets are used for payments should be required to enter into outsourcing agreements with the payers’ payment service providers to allow them to continue to perform such verifications, but also requiring them to comply with key security requirements. The payer’s payment service providers should, under such agreements, retain full liability for any failure by operators of digital pass-through wallets to apply SCA and have the right to audit and control the wallet operator’s security provisions. | (119) Operators of digital pass-through wallets that verify the elements of SCA when tokenised instruments stored in the digital wallets are used for payments should be required to enter into outsourcing agreements with the payers’ payment service providers to allow them to continue to perform such verifications, but also requiring them to comply with key security requirements. The payer’s payment service providers should, under such agreements, retain full liability for any failure by operators of digital pass-through wallets to apply SCA and have the right to audit and control the wallet operator’s security provisions. An outsourcing agreement is not needed if the payer’s payment service provider remains in control of strong customer authentication. |
| Text proposed by the Commission | Amendment |
|---|---|
| (120) Where technical service providers or operators of payment schemes provide services to payees or to the payment service providers of payees or of payers, they should support the application of strong customer authentication within the remit of their role in the initiation or execution of payment transactions. Given the role that they play in ensuring that key security requirements concerning retail payments are properly implemented, including by providing appropriate IT solutions, technical service providers and operators of payment schemes should be held liable for the financial damages caused to payees or to the payment service providers of the payees or of the payers in case they fail to support the application of strong customer authentication. | (120) Where technical service providers or operators of payment schemes provide services to payees or to the payment service providers of payees or of payers, they should support the application of strong customer authentication within the remit of their role in the initiation or execution of payment transactions. Given the role that they play in ensuring that key security requirements concerning retail payments are properly implemented, including by providing appropriate IT solutions, technical service providers and operators of payment schemes should be held liable for the financial damages caused to payees or to the payment service providers of the payees or of the payers in case they fail to enable the application of strong customer authentication. |
| Text proposed by the Commission | Amendment |
|---|---|
| (120) Where technical service providers or operators of payment schemes provide services to payees or to the payment service providers of payees or of payers, they should support the application of strong customer authentication within the remit of their role in the initiation or execution of payment transactions. Given the role that they play in ensuring that key security requirements concerning retail payments are properly implemented, including by providing appropriate IT solutions, technical service providers and operators of payment schemes should be held liable for the financial damages caused to payees or to the payment service providers of the payees or of the payers in case they fail to support the application of strong customer authentication. | (120) Where technical service providers or operators of payment schemes provide services to payees or to the payment service providers of payees or of payers, they should support the application of strong customer authentication within the remit of their role in the initiation or execution of payment transactions. Given the role that they play in ensuring that key security requirements concerning retail payments are properly implemented, including by providing appropriate IT solutions, technical service providers and operators of payment schemes should be held liable for the financial damages caused to the payment service providers of the payees or of the payers in case they fail to support the application of outsourced strong customer authentication. |
| Text proposed by the Commission | Amendment |
|---|---|
| (140) The EBA should, in line with Article 9(5) of Regulation (EU) No 1093/2010, be granted product intervention powers to be able to temporarily prohibit or restrict in the Union certain type or a specific feature of a payment service or an electronic money service which is identified as potentially causing harm to consumers, threatening the orderly functioning and integrity of financial markets. Regulation (EU) No 1093/2010 should therefore be amended accordingly. | (140) The EBA should, in line with Article 9(5) of Regulation (EU) No 1093/2010, be granted product intervention powers to be able to temporarily prohibit or restrict in the Union certain type or a specific feature of a payment service or an electronic money service which is identified as potentially causing harm to consumers, threatening the orderly functioning and integrity of financial markets. Regulation (EU) No 1093/2010 should therefore be amended accordingly. Before exerting this power, the EBA should ensure that it has consulted with payment service providers or third-party providers. |
| Text proposed by the Commission | Amendment |
|---|---|
| (140 a) The EBA should be granted all the necessary resources, including human resources, to fulfill their mandate under this Regulation. |
| Text proposed by the Commission | Amendment |
|---|---|
| (141) The Annex to Regulation (EU) 2017/2394 of the European Parliament and of the Council57 should be amended to include a reference to this Regulation to facilitate cross-border cooperation on the enforcement of this Regulation. | (141) The Annex to Regulation (EU) 2017/2394 of the European Parliament and of the Council57 should be amended to include a reference to this Regulation to facilitate cross-border cooperation on the enforcement of this Regulation. |
| 57 Regulation (EU) 2017/2394 of the European Parliament and of the Council of 12 December 2017 on cooperation between national authorities responsible for the enforcement of consumer protection laws and repealing Regulation (EC) No 2006/200 (OJ L 345, 27.12.2017, p. 1–26). | 57 Regulation (EU) 2017/2394 of the European Parliament and of the Council of 12 December 2017 on cooperation between national authorities responsible for the enforcement of consumer protection laws and repealing Regulation (EC) No 2006/2004 (OJ L 345, 27.12.2017, p. 1–26). |
| Text proposed by the Commission | Amendment |
|---|---|
| (h a) payment transactions using electronic money tokens as defined in Article 3 of Regulation (EU) 2023/1114, where the payment service provider has already been authorised as a crypto-asset service provider in a Member State of the European Union for those services under Title V of that Regulation. |
Clarification to avoid duplicative requirements for electronic money tokens under both MiCA and PSR.
| Text proposed by the Commission | Amendment |
|---|---|
| (i) without prejudice to Article 23(2), and Articles 58 and 87, services provided by technical service providers; | (i) without prejudice to Articles 58 and 87, services provided by technical service providers; |
| Text proposed by the Commission | Amendment |
|---|---|
| (i) instruments allowing the holder to acquire goods or services only in the premises of the issuer or within a single limited network of service providers under direct commercial agreement with a professional issuer; | (i) instruments allowing the holder to acquire goods or services only in the physical or virtual premises of the issuer or within a single limited network of service providers under direct commercial agreement with a professional issuer; |
| Text proposed by the Commission | Amendment |
|---|---|
| (ii) instruments which can be used only to acquire a very limited range of goods or services; | (ii) instruments which can be used only to acquire a very limited range of goods or services, including but not limited to instruments restricted to use in business-to-business transactions; |
| Text proposed by the Commission | Amendment |
|---|---|
| (iii) instruments valid only in a single Member State, which are provided at the request of an undertaking or a public sector entity and regulated by a national or regional public authority for specific social or tax purposes to acquire specific goods or services from suppliers having a commercial agreement with the issuer; | deleted |
| Text proposed by the Commission | Amendment |
|---|---|
| (iii) instruments valid only in a single Member State, which are provided at the request of an undertaking or a public sector entity and regulated by a national or regional public authority for specific social or tax purposes to acquire specific goods or services from suppliers having a commercial agreement with the issuer; | deleted |
Exemptions for providers of meal vouchers remain in the PSR without a particular reason. In the case of meal vouchers, this allows operators of such schemes to charge merchants high fees which, as a consequence, limits the acceptance of meal vouchers and hence the possibility for consumers to spend their employment benefits.
| Text proposed by the Commission | Amendment |
|---|---|
| (iii) instruments valid only in a single Member State, which are provided at the request of an undertaking or a public sector entity and regulated by a national or regional public authority for specific social or tax purposes to acquire specific goods or services from suppliers having a commercial agreement with the issuer; | (iii) instruments valid only in a single Member State, which are provided at the request of an undertaking or a public sector entity and regulated by a national or regional public authority for specific social or tax purposes to acquire specific goods or services from suppliers having a commercial agreement with the issuer which cannot be exchanged for money; |
| Text proposed by the Commission | Amendment |
|---|---|
| (iii) instruments valid only in a single Member State, which are provided at the request of an undertaking or a public sector entity and regulated by a national or regional public authority for specific social or tax purposes to acquire specific goods or services from suppliers having a commercial agreement with the issuer; | (iii) instruments valid only in a single Member State, which are provided at the request of an undertaking or a public sector entity and regulated by a national or regional public authority for specific social or tax purposes to acquire specific goods or services from suppliers having a commercial agreement with the issuer which cannot be converted into cash; |
Frances Fitzgerald, Eleni Stavrou, José Manuel García-Margallo y Marfil, Isabel Benjumea Benjumea, Lídia Pereira, Sirpa Pietikäinen, Laurence Sailliet
| Text proposed by the Commission | Amendment |
|---|---|
| (iii) instruments valid only in a single Member State, which are provided at the request of an undertaking or a public sector entity and regulated by a national or regional public authority for specific social or tax purposes to acquire specific goods or services from suppliers having a commercial agreement with the issuer; | (iii) instruments valid only in a single Member State, which are provided at the request of an undertaking or a public sector entity and regulated by a national or regional public authority for specific social or tax purposes to acquire specific goods or services from suppliers having a commercial agreement with the issuer which cannot be converted into cash; |
This addition would help to clarify the nature of social vouchers, which are directly linked to the purchase of goods and services, thus falling under the scope of LNE. They are not payment services in the formal sense, and are not exchangeable for money, in line with EBA Guidelines on LNE. Social vouchers are accessible within a dedicated network of merchants and providers. This network is based on contractual relations between merchants, providers and the companies issuing social vouchers and ensuring their proper use, which includes preventing their conversion into cash.
| Text proposed by the Commission | Amendment |
|---|---|
| (iii) instruments valid only in a single Member State, which are provided at the request of an undertaking or a public sector entity and regulated by a national or regional public authority for specific social or tax purposes to acquire specific goods or services from suppliers having a commercial agreement with the issuer; | (iii) instruments valid only in a single Member State or in a region, which are provided at the request of an undertaking or a public sector entity and regulated by a national or regional public authority for specific social or tax purposes to acquire specific goods or services from suppliers having a commercial agreement with the issuer; |
Social vouchers described on Article 2.2j(iii) are instruments deployed on the basis of national or local policies to support the implementation of public policies. They are dedicated to achieve specific goals and are precisely targeted within national or local legislative frames. It is important to underline further this characteristic.
| Text proposed by the Commission | Amendment |
|---|---|
| (k) payment transactions by a provider of electronic communications networks as defined in Article 2, point (1), of Directive (EU) 2018/1972 of the European Parliament and of the Council62 , or services provided in addition to electronic communications services as defined in Article 2, point (4), of that Directive to a subscriber to the network or service: | deleted |
| (i) to purchase digital content and voice-based services, regardless of the device used for the purchase or consumption of the digital content and charged to the related bill; or | |
| (ii) performed from or via an electronic device and charged to the related bill within the framework of a charitable activity or for the purchase of tickets; | |
| provided that the value of any single payment transaction does not exceed EUR 50 and: | |
| — the cumulative value of payment transactions for an individual subscriber does not exceed EUR 300 per month, or | |
| — where a subscriber pre-funds its account with the provider of the electronic communications network or service, the cumulative value of payment transactions does not exceed EUR 300 per month; | |
| 62 Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code (OJ L 321, 17.12.2018, p. 36). |
| Text proposed by the Commission | Amendment |
|---|---|
| payment transactions by a provider of electronic communications networks as defined in Article 2, point (1), of Directive (EU) 2018/1972 of the European Parliament and of the Council62 , or services provided in addition to electronic communications services as defined in Article 2, point (4), of that Directive to a subscriber to the network or service: | deleted |
| (i) to purchase digital content and voice-based services, regardless of the device used for the purchase or consumption of the digital content and charged to the related bill; or | |
| (ii) performed from or via an electronic device and charged to the related bill within the framework of a charitable activity or for the purchase of tickets; | |
| 62 Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code (OJ L 321, 17.12.2018, p. 36). |
| Text proposed by the Commission | Amendment |
|---|---|
| payment transactions by a provider of electronic communications networks as defined in Article 2, point (1), of Directive (EU) 2018/1972 of the European Parliament and of the Council62 , or services provided in addition to electronic communications services as defined in Article 2, point (4), of that Directive to a subscriber to the network or service: | deleted |
| (i) to purchase digital content and voice-based services, regardless of the device used for the purchase or consumption of the digital content and charged to the related bill; or | |
| (ii) performed from or via an electronic device and charged to the related bill within the framework of a charitable activity or for the purchase of tickets; | |
| 62 Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code (OJ L 321, 17.12.2018, p. 36). |
| Text proposed by the Commission | Amendment |
|---|---|
| (i) to purchase digital content and voice-based services, regardless of the device used for the purchase or consumption of the digital content and charged to the related bill; or | deleted |
| Text proposed by the Commission | Amendment |
|---|---|
| (ii) performed from or via an electronic device and charged to the related bill within the framework of a charitable activity or for the purchase of tickets; | deleted |
| Text proposed by the Commission | Amendment |
|---|---|
| provided that the value of any single payment transaction does not exceed EUR 50 and: | deleted |
| — the cumulative value of payment transactions for an individual subscriber does not exceed EUR 300 per month, or | |
| — where a subscriber pre-funds its account with the provider of the electronic communications network or service, the cumulative value of payment transactions does not exceed EUR 300 per month; |
The exemption for telecommunication providers should be deleted as it is often used to charge consumers high amounts of extra charges via their mobile subscription bill in an opaque way. Consumers often only discover the real costs of the purchased services such as games, street parking, videos, magazines and all sorts of premium services once they receive their mobile subscription bill.
| Text proposed by the Commission | Amendment |
|---|---|
| provided that the value of any single payment transaction does not exceed EUR 50 and: | deleted |
| — the cumulative value of payment transactions for an individual subscriber does not exceed EUR 300 per month, or | |
| — where a subscriber pre-funds its account with the provider of the electronic communications network or service, the cumulative value of payment transactions does not exceed EUR 300 per month; |
| Text proposed by the Commission | Amendment |
|---|---|
| provided that the value of any single payment transaction does not exceed EUR 50 and: | provided that the value of any single payment transaction does not exceed EUR 100 and: |
| Text proposed by the Commission | Amendment |
|---|---|
| provided that the value of any single payment transaction does not exceed EUR 50 and: | provided that the value of any single payment transaction does not exceed EUR 60 and: |
| Text proposed by the Commission | Amendment |
|---|---|
| – the cumulative value of payment transactions for an individual subscriber does not exceed EUR 300 per month, or | – the cumulative value of payment transactions for an individual subscriber does not exceed EUR 500 per month, or |
| Text proposed by the Commission | Amendment |
|---|---|
| – where a subscriber pre-funds its account with the provider of the electronic communications network or service, the cumulative value of payment transactions does not exceed EUR 300 per month; | – where a subscriber pre-funds its account with the provider of the electronic communications network or service, the cumulative value of payment transactions does not exceed EUR 500 per month; |
| Text proposed by the Commission | Amendment |
|---|---|
| (m) payment transactions and related services between a parent undertaking and its subsidiary or between subsidiaries of the same parent undertaking, without any intermediary intervention by a payment service provider other than an undertaking belonging to the same group, and the collection of payment orders on behalf of a group by a parent undertaking or its subsidiary for onward transmission to a payment service provider. | (m) payment transactions and related services between a parent undertaking and its subsidiary or between subsidiaries of the same parent undertaking, without any intermediary intervention by a payment service provider other than an undertaking belonging to the same group, and the collection of payment orders from entities belonging to the same group in order to process payments on behalf of those entities through a payments service provider, including payment orders made to external third parties, and for collecting funds from external third parties by a parent company or by a subsidiary on behalf of group entities through a payment service provider. |
| Text proposed by the Commission | Amendment |
|---|---|
| (m) payment transactions and related services between a parent undertaking and its subsidiary or between subsidiaries of the same parent undertaking, without any intermediary intervention by a payment service provider other than an undertaking belonging to the same group, and the collection of payment orders on behalf of a group by a parent undertaking or its subsidiary for onward transmission to a payment service provider. | (m) payment transactions and related services between a parent undertaking and its subsidiary or between subsidiaries of the same parent undertaking, including the collection of funds as well as the execution of payments on behalf of a group by a parent undertaking or its subsidiary. |
| Text proposed by the Commission | Amendment |
|---|---|
| (m a) instruments issued to fulfil the requirements of Article 70(2) and (3) of Regulation (EU) 2023/1114 (MICAR). |
| Text proposed by the Commission | Amendment |
|---|---|
| 7. By [ OP please insert the date= one year after the date of entry into force of this Regulation], the EBA shall issue Guidelines in accordance with Article 16 of Regulation (EU) No 1093/2010, addressed to the competent authorities designated under this Regulation, on the exclusion for payment transactions from the payer to the payee through a commercial agent referred to in paragraph 2, point (b) of this Article. | 7. The EBA shall develop draft Regulatory Technical Standards to specify the conditions of the exclusion for payment transactions from the payer to the payee through a commercial agent referred to in paragraph 2, point (b) of this Article. |
| The EBA shall submit the Regulatory Technical Standards referred to in the first subparagraph to the Commission by [ OP please insert the date= one year after the date of entry into force of this Regulation]. Power is delegated on the Commission to adopt the Regulatory Technical Standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010. |
As laid down in the EBA advice on the review of the Payment Services Regulation 2, there are many questions of interpretation as regards the exclusion of commercial agents. To ensure harmonious application across the European Union which is of particular importance as this exclusion is often used by e-commerce platforms, specifications should take the form of (binding) technical regulatory standards rather than non-binding guidelines.
| Text proposed by the Commission | Amendment |
|---|---|
| 7. By [ OP please insert the date= one year after the date of entry into force of this Regulation], the EBA shall issue Guidelines in accordance with Article 16 of Regulation (EU) No 1093/2010, addressed to the competent authorities designated under this Regulation, on the exclusion for payment transactions from the payer to the payee through a commercial agent referred to in paragraph 2, point (b) of this Article. | 7. By [ OP please insert the date= one year after the date of entry into force of this Regulation], the EBA shall submit draft Regulatory Technical Standards to specify the conditions for the exclusion for payment transactions from the payer to the payee through a commercial agent referred to in paragraph 2, point (b) of this Article. |
| Power is delegated to the Commission to adopt the Regulatory Technical Standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010. |
| Text proposed by the Commission | Amendment |
|---|---|
| 9 a. The provisions of Article 59 shall also apply to electronic communication service providers, as defined in Article 3, point (55a). |
| Text proposed by the Commission | Amendment |
|---|---|
| (11) ‘payer’ means a natural or legal person who holds a payment account and places a payment order from that payment account, or, where there is no payment account, a person who places a payment order; | (11) ‘payer’ means a natural or legal person who holds a payment account and places a payment order from that payment account, or, where there is no payment account, a natural or legal person who places a payment order; |
| Text proposed by the Commission | Amendment |
|---|---|
| (28) ‘credit transfer’ means a payment service, including instant credit transfers, for crediting a payee’s payment account with a payment transaction or a series of payment transactions from a payer’s payment account by the payment service provider which holds the payer’s payment account, based on an instruction given by the payer; | (28) ‘credit transfer’ means a payment service, including instant credit transfers, for crediting a payee’s payment account with a payment transaction or a series of payment transactions from a payer’s payment account by the payment service provider which holds the payer’s payment account or by the payment service provider which holds the payee payment account, based on an instruction given by the payer; |
| Text proposed by the Commission | Amendment |
|---|---|
| (30) ‘funds’ means central bank money issued for retail use, scriptural money and electronic money; | (30) ‘funds’ means central bank money issued for retail use, scriptural money and electronic money tokens; |
| Text proposed by the Commission | Amendment |
|---|---|
| (30) ‘funds’ means central bank money issued for retail use, scriptural money and electronic money; | (30) ‘funds’ means bank notes and coins, scriptural money and electronic money; |
The current introduction of CBDC in PSR is premature and will create an unnecessary legal uncertainty.
| Text proposed by the Commission | Amendment |
|---|---|
| (32) ‘reference exchange rate’ means the exchange rate which is used as the basis to calculate any currency conversion cost and which is disclosed by the payment service provider or comes from a publicly available source; | (32) ‘reference exchange rate’ means the exchange rate which is used by the payment service provider for a currency conversion service and is compared against the mid-market exchange rate to calculate the currency conversion cost; |
Mid-market rate providers should be neutral and power a certain amount of volume, have a credible governance structure in place and rely on accountability frameworks for the providers they include in their rate collection.
| Text proposed by the Commission | Amendment |
|---|---|
| (32 a) ‘mid-market exchange rate’ means the exchange rate which is used as the basis for comparison against the reference exchange rate to calculate any currency conversion cost and which is aggregated by neutral and credible providers; |
Mid-market rate providers should be neutral and power a certain amount of volume, have a credible governance structure in place and rely on accountability frameworks for the providers they include in their rate collection.
| Text proposed by the Commission | Amendment |
|---|---|
| (35) ‘strong customer authentication’ means an authentication which is based on the use of two or more elements categorised as knowledge (something only the user knows), possession (something only the user possesses) and inherence (something the user is) that are independent, in that the breach of one does not compromise the reliability of the others, and is designed in such a way as to protect the confidentiality of the authentication data; | (35) ‘strong customer authentication’ means an authentication which is based on the use of two or more elements categorised as knowledge (something only the user knows), possession (something only the user possesses), inherence (something the user is) and behaviour (the way user behaves) that are independent, in that the breach of one does not compromise the reliability of the others, and is designed in such a way as to protect the confidentiality of the authentication data; |
| Text proposed by the Commission | Amendment |
|---|---|
| (36 a) ‘e-wallet provider’ means a provider which offers consumers an application to manage one or several payment services within one application without entering at any time into the possession of the funds to be transferred; |
| Text proposed by the Commission | Amendment |
|---|---|
| (36 a) ‘e-wallet provider’ means a provider which offers consumers an application to manage one or several payment services within one application without entering at any time into the possession of the funds to be transferred; |
The Regulation should also be made future-proof by adequately considering the role of e-wallet providers (i.e. pass-through wallets where wallet providers do not enter at any time into the possession of funds) such as Apple Pay, Google Pay and Samsung Pay. E-Wallet providers are so far considered as technical service providers and hence out of scope of the Payment Services Regulation.
| Text proposed by the Commission | Amendment |
|---|---|
| (39) ‘unique identifier’ means a combination of letters, numbers or symbols specified by the payment service provider to the payment service user and to be provided by the payment service user to identify unambiguously another payment service user or the payment account of that other payment service user for a payment transaction; | (39) ‘unique identifier’ means a combination of letters, numbers or symbols specified by the payment service provider, or an uniquely linked proxy thereof, to the payment service user and to be provided by the payment service user to identify unambiguously another payment service user or the payment account of that other payment service user for a payment transaction; |
| Text proposed by the Commission | Amendment |
|---|---|
| (39) ‘unique identifier’ means a combination of letters, numbers or symbols specified by the payment service provider to the payment service user and to be provided by the payment service user to identify unambiguously another payment service user or the payment account of that other payment service user for a payment transaction; | (39) ‘unique identifier’ means a combination of letters, numbers or symbols specified by the payment service provider, or a uniquely linked proxy thereof, to the payment service user and to be provided by the payment service user to identify unambiguously another payment service user or the payment account of that other payment service user for a payment transaction; |
| Text proposed by the Commission | Amendment |
|---|---|
| (46) ‘group’ means a group of undertakings that are linked to each other by a relationship as referred to in Article 22(1), points (2) or (7) of Directive 2013/34/EU of the European Parliament and of the Council63 or undertakings as referred to in Articles 4, 5, 6 and 7 of Commission Delegated Regulation (EU) No 241/201464 , which are linked to each other by a relationship as referred to in Article 10(1) or Article 113(6), first subparagraph, or 113(7), first subparagraph of Regulation (EU) No 575/2013; | (46) ‘group’ means a group of undertakings that are linked to each other by a relationship as referred to in Article 22(1), (2) or (7) of Directive 2013/34/EU of the European Parliament and of the Council63 or undertakings as referred to in Articles 4, 5, 6 and 7 of Commission Delegated Regulation (EU) No 241/201464 , which are linked to each other by a relationship as referred to in Article 10(1) or Article 113(6), first subparagraph, or 113(7), first subparagraph of Regulation (EU) No 575/2013; |
| 63 Directive 2013/34/EU of the European Parliament and of the Council of 26 June 2013 on the annual financial statements, consolidated financial statements and related reports of certain types of undertakings, amending Directive 2006/43/EC of the European Parliament and of the Council and repealing Council Directives 78/660/EEC and 83/349/EEC (OJ L 182, 29.6.2013, p. 19). | 63 Directive 2013/34/EU of the European Parliament and of the Council of 26 June 2013 on the annual financial statements, consolidated financial statements and related reports of certain types of undertakings, amending Directive 2006/43/EC of the European Parliament and of the Council and repealing Council Directives 78/660/EEC and 83/349/EEC (OJ L 182, 29.6.2013, p. 19). |
| 64 Commission Delegated Regulation (EU) No 241/2014 of 7 January 2014 supplementing Regulation (EU) No 575/2013 of the European Parliament and of the Council with regard to regulatory technical standards for Own Funds requirements for institutions (OJ L 74, 14.3.2014, p. 8). | 64 Commission Delegated Regulation (EU) No 241/2014 of 7 January 2014 supplementing Regulation (EU) No 575/2013 of the European Parliament and of the Council with regard to regulatory technical standards for Own Funds requirements for institutions (OJ L 74, 14.3.2014, p. 8). |
| Text proposed by the Commission | Amendment |
|---|---|
| (51) ‘distributor’ means a natural or legal person that distributes or redeems electronic money on behalf of a payment institution; | (51) ‘distributor’ means a natural or legal person that distributes or redeems electronic money on behalf of and engaged by a payment institution; |
| Text proposed by the Commission | Amendment |
|---|---|
| (52) ‘electronic money services’ means the issuance of electronic money, the maintenance of payment accounts storing electronic money units, and the transfer of electronic money units; | (52) ‘electronic money services’ means the issuance of electronic money; |
| Text proposed by the Commission | Amendment |
|---|---|
| (52) ‘electronic money services’ means the issuance of electronic money, the maintenance of payment accounts storing electronic money units, and the transfer of electronic money units; | (52) ‘electronic money services’ means the issuance of electronic money; |
| Text proposed by the Commission | Amendment |
|---|---|
| (52) ‘electronic money services’ means the issuance of electronic money, the maintenance of payment accounts storing electronic money units, and the transfer of electronic money units; | (52) ‘electronic money services’ means the issuance of electronic money tokens, the maintenance of payment accounts storing electronic money units, and the transfer of electronic money units; |
| Text proposed by the Commission | Amendment |
|---|---|
| (53) ‘commercial trade name’ means the name which is commonly used by the payee to identify itself to the payer; | (53) ‘commercial trade name’ means the name which is commonly used by the payee in the course of their trade and marketing to identify itself to the payer |
| Text proposed by the Commission | Amendment |
|---|---|
| (53) ‘commercial trade name’ means the name which is commonly used by the payee to identify itself to the payer; | (53) ‘commercial trade name’ means the name which is commonly used by the payee in the course of their trade and marketing to identify itself to the payer; |
The definition of “commercial trade name” should clarify that it is the name commonly used by the payee in their trade and marketing with their customers rather than the name commonly used in the payment process which is often so far still the name of the legal entity.
| Text proposed by the Commission | Amendment |
|---|---|
| (54) ‘ATM deployer’ means operators of automated teller machines who do not service payment accounts. | (54) ‘ATM deployer’ means operators of automated teller machines who do not hold payment accounts. |
| Text proposed by the Commission | Amendment |
|---|---|
| (55) ‘payment institution providing electronic money services’ means a payment institution which provides the services of issuance of electronic money, maintenance of payment accounts storing electronic money units, and transfer of electronic money units, whether or not it also provides any of the services referred to in Annex I. | (55) ‘payment institution providing electronic money services’ means a payment institution which provides the services of issuance of electronic money tokens, maintenance of payment accounts storing electronic money units, and transfer of electronic money units, whether or not it also provides any of the services referred to in Annex I. |
| Text proposed by the Commission | Amendment |
|---|---|
| (55 a) 'electronic communications service provider' means any provider falling under the scope of: | |
| (a) Directive (EU) 2018/1972 (European electronic communications code); or | |
| (b) Regulation (EU) 2022/1925 (Digital Markets Act). |
| Text proposed by the Commission | Amendment |
|---|---|
| (55 a) ‘electronic communications service provider’ means any provider falling under the scope of: | |
| (a) Directive 2018/1972 (European electronic communications code), and | |
| (b) Regulation (EU) 2022/1925 (Digital Markets Act). |
| Text proposed by the Commission | Amendment |
|---|---|
| (55 a) 'authorisation' means the consent granted by a payer to their payment services provider for executing a payment transaction via the agreed process and form. |
| Text proposed by the Commission | Amendment |
|---|---|
| 2. Member States may apply this Title to microenterprises in the same way as to consumers. | 2. Member States may apply this Title to small, medium-sized and microenterprises in the same way as to consumers. |
| Text proposed by the Commission | Amendment |
|---|---|
| 2. Where a currency conversion service is offered prior to the initiation of the payment transaction and where that currency conversion service is offered at an ATM, at the point of sale or by the payee, the party offering the currency conversion service to the payer shall disclose to the payer all charges and the exchange rate to be used for converting the payment transaction. | 2. Where a currency conversion service is offered prior to the initiation of the payment transaction and where that currency conversion service is offered at an ATM, at the point of sale or by the payee, the party offering the currency conversion service to the payer shall disclose to the payer all charges and the exchange rate to be used for converting the payment transaction including prominent and transparent disclosure of any mark-up over the latest available applicable foreign exchange reference rate issued by the relevant central bank. |
Information on the exchange rate at ATMs shall be transparent on the mark-up on the reference rate in line with the information provided for credit transfers and money remittances.
| Text proposed by the Commission | Amendment |
|---|---|
| 2. Where a currency conversion service is offered prior to the initiation of the payment transaction and where that currency conversion service is offered at an ATM, at the point of sale or by the payee, the party offering the currency conversion service to the payer shall disclose to the payer all charges and the exchange rate to be used for converting the payment transaction. | 2. Where a currency conversion service is offered prior to the initiation of the payment transaction and where that currency conversion service is offered at an ATM, at the point of sale or by the payee, the party offering the currency conversion service to the payer shall disclose to the payer all charges and the exchange rate to be used for converting the payment transaction, including prominent and transparent disclosure of any mark-up over the latest available applicable foreign exchange reference rate issued by the relevant central bank. |
| Text proposed by the Commission | Amendment |
|---|---|
| 2. Where a currency conversion service is offered prior to the initiation of the payment transaction and where that currency conversion service is offered at an ATM, at the point of sale or by the payee, the party offering the currency conversion service to the payer shall disclose to the payer all charges and the exchange rate to be used for converting the payment transaction. | 2. Where a currency conversion service is offered prior to the initiation of the payment transaction and where that currency conversion service is offered at an ATM, at the point of sale or by the payee, the party offering the currency conversion service to the payer shall disclose to the payer all charges, including any mark-ups over the aggregated mid-market exchange rate offered by neutral and credible providers, and the exchange rate to be used for converting the payment transaction. |
ATM transactions should benefit from the same level of transparency in terms of currency conversion charges as credit transfers and money remittances to ensure that consumers know the real costs of their transactions when a currency conversion is involved.
| Text proposed by the Commission | Amendment |
|---|---|
| 2. Where a currency conversion service is offered prior to the initiation of the payment transaction and where that currency conversion service is offered at an ATM, at the point of sale or by the payee, the party offering the currency conversion service to the payer shall disclose to the payer all charges and the exchange rate to be used for converting the payment transaction. | 2. Where a currency conversion service is offered prior to the initiation of the payment transaction and where that currency conversion service is offered at an ATM, at the point of sale or by the payee, the party offering the currency conversion service to the payer shall disclose to the payer all charges and the exchange rate to be used for converting the payment transaction prior to the authorisation of the payment transaction by the payer. |
| Text proposed by the Commission | Amendment |
|---|---|
| 1. Where, for the use of a given payment instrument, the payee requests a charge or offers a reduction, the payee shall inform the payer thereof prior to the initiation of the payment transaction. | 1. Where, for the use of a given payment instrument, the payee requests a charge or offers a reduction, the payee shall inform the payer thereof prior to the initiation of the payment transaction, in a clear, transparent and accessible format. |
| Text proposed by the Commission | Amendment |
|---|---|
| 2. Where, for the use of a given payment instrument, the payment service provider or another party involved in the transaction requests a charge, it shall inform the payment service user thereof prior to the initiation of the payment transaction. | 2. Where, for the use of a given payment instrument, the payment service provider or another party involved in the transaction requests a charge, it shall inform the payment service user thereof in a clear, transparent and accessible format, prior to the initiation of the payment transaction. |
| Text proposed by the Commission | Amendment |
|---|---|
| Natural or legal persons providing cash withdrawal services as referred to in Article 38 of Directive (EU) [PSD3] shall provide or make available to their customers information on any charges before the customer carries out the withdrawal as well as upon receipt of the cash when the transaction is completed. | Natural or legal persons providing cash withdrawal services as referred to in Article 38 of Directive (EU) [PSD3] shall provide in a prominent and easily understandable manner to their customers information on any charges directly before the customer carries out the withdrawal as well as upon receipt of the cash when the transaction is completed. |
Information on charges for cash withdrawal shall be provided in a prominent and easily understandable manner, otherwise this information risks to be hidden in terms and conditions which consumers have to search for, rather than being actively provided with.
| Text proposed by the Commission | Amendment |
|---|---|
| Natural or legal persons providing cash withdrawal services as referred to in Article 38 of Directive (EU) [PSD3] shall provide or make available to their customers information on any charges before the customer carries out the withdrawal as well as upon receipt of the cash when the transaction is completed. | Natural or legal persons providing cash withdrawal services as referred to in Article 38 of Directive (EU) [PSD3] shall provide in a prominent and easily understandable manner to their customers information on any charges directly before the customer carries out the withdrawal as well as upon receipt of the cash when the transaction is completed |
| Text proposed by the Commission | Amendment |
|---|---|
| Natural or legal persons providing cash withdrawal services as referred to in Article 38 of Directive (EU) [PSD3] shall provide or make available to their customers information on any charges before the customer carries out the withdrawal as well as upon receipt of the cash when the transaction is completed. | Natural or legal persons providing cash withdrawal services as referred to in Article 38 of Directive (EU) [PSD3] shall provide or make available to their customers clear, transparent and accessible information on any charges before the customer carries out the withdrawal as well as upon receipt of the cash when the transaction is completed. |
| Text proposed by the Commission | Amendment |
|---|---|
| Natural or legal persons providing cash withdrawal services as referred to in Article 38 of Directive (EU) [PSD3] shall provide or make available to their customers information on any charges before the customer carries out the withdrawal as well as upon receipt of the cash when the transaction is completed. | Natural or legal persons providing cash withdrawal services as referred to in Article 38 of Directive (EU) [PSD3] shall provide or make available to their customers information on any charges at the moment of initiatiation of the provision of withdrawal services as well as upon receipt of the cash when the transaction is completed. |
| Text proposed by the Commission | Amendment |
|---|---|
| 3. Charges for information referred to in paragraph 2 shall be reasonable and in line with the payment service provider’s actual costs. | 3. Charges for information referred to in paragraph 2 shall be reasonable and proportionate in relation to the actual costs. |
| Text proposed by the Commission | Amendment |
|---|---|
| In cases of payment instruments which, according to the relevant framework contract, concern only individual payment transactions that do not exceed EUR 50 or that either have a spending limit of EUR 200 or store funds that do not exceed EUR 200 at any time: | In cases of payment instruments which, according to the relevant framework contract, concern only individual payment transactions that do not exceed EUR 100 or that either have a spending limit of EUR 250 or store funds that do not exceed EUR 250 at any time: |
| Text proposed by the Commission | Amendment |
|---|---|
| 1. Payment service providers shall provide or make available to payment service users the following information and conditions: | 1. Payment service providers shall provide in an easily understandable way or make available to payment service users the following information and conditions: |
To ensure comparability, PSPs should be required to disclose their currency conversion charges and mark-ups over an aggregated mid-market rate provided by neutral entities. The disclosures should be provided upfront, in an easily understandable way and not hidden in separate documents or websites. Mark-ups should be disclosed in monetary terms instead of percentage terms to avoid the confusion of consumers due to complicated fee structures. Today, most upfront/transaction fees are expressed in monetary value. Combining this with a percentage will require inconvenient calculations for consumers. It is important to include both credit transfers and money remittance transactions, as well as single payment transactions and framework contracts, to ensure payments to and from payment accounts are within scope and more consumers and (micro)businesses understand how much their transaction costs.
| Text proposed by the Commission | Amendment |
|---|---|
| 1. Payment service providers shall provide or make available to payment service users the following information and conditions: | 1. Payment service providers shall provide in a prominent and easily understandable manner to payment service users the following information and conditions: |
| Text proposed by the Commission | Amendment |
|---|---|
| 1. Payment service providers shall provide or make available to payment service users the following information and conditions: | 1. Payment service providers shall provide in a prominent and easily understandable way to payment service users the following information and conditions: |
To avoid that such information is hidden in small print or using complex language, it should become an obligation to actively provide this information in a prominent and easily understandable way.
| Text proposed by the Commission | Amendment |
|---|---|
| 1. Payment service providers shall provide or make available to payment service users the following information and conditions: | 1. Payment service providers shall provide or make available to payment service users at least the following information and conditions: |
| Text proposed by the Commission | Amendment |
|---|---|
| (f) where applicable, the estimated charges for currency conversion in relation to credit transfers and money remittance transactions, expressed as a percentage mark-up over the latest available applicable foreign exchange reference rate issued by the relevant central bank; | (f) where applicable, the estimated charges for currency conversion in relation to credit transfers and money remittance transactions, expressed as a percentage mark-up in a monetary value in the payer's currency over the mid-market exchange rate offered by neutral and credible providers; |
To ensure comparability, PSPs should be required to disclose their currency conversion charges and mark-ups over an aggregated mid-market rate provided by neutral entities. The disclosures should be provided upfront, in an easily understandable way and not hidden in separate documents or websites. Mark-ups should be disclosed in monetary terms instead of percentage terms to avoid the confusion of consumers due to complicated fee structures. Today, most upfront/transaction fees are expressed in monetary value. Combining this with a percentage will require inconvenient calculations for consumers. It is important to include both credit transfers and money remittance transactions, as well as single payment transactions and framework contracts, to ensure payments to and from payment accounts are within scope and more consumers and (micro)businesses understand how much their transaction costs
| Text proposed by the Commission | Amendment |
|---|---|
| (f) where applicable, the estimated charges for currency conversion in relation to credit transfers and money remittance transactions, expressed as a percentage mark-up over the latest available applicable foreign exchange reference rate issued by the relevant central bank; | (f) where applicable, the estimated charges for currency conversion in relation to credit transfers and money remittance transactions, expressed as a percentage mark-up over the latest available applicable foreign exchange reference rate issued by the relevant central bank. These charges shall be displayed no later than the moment the payer authorises the payment transaction; |
| Text proposed by the Commission | Amendment |
|---|---|
| (f) where applicable, the estimated charges for currency conversion in relation to credit transfers and money remittance transactions, expressed as a percentage mark-up over the latest available applicable foreign exchange reference rate issued by the relevant central bank; | (f) where applicable, the estimated charges for currency conversion in relation to credit transfers and money remittance transactions, expressed as a percentage mark-up over the latest available applicable foreign exchange reference rate issued by the relevant central bank as well as in real monetary value in the payer’s currency; |
| Text proposed by the Commission | Amendment |
|---|---|
| (f) where applicable, the estimated charges for currency conversion in relation to credit transfers and money remittance transactions, expressed as a percentage mark-up over the latest available applicable foreign exchange reference rate issued by the relevant central bank; | (f) where applicable, the estimated charges for currency conversion in relation to credit transfers and money remittance transactions, expressed in monetary value in the payer's currency over the latest available applicable foreign exchange reference rate issued by the relevant central bank; |
For consumers, it will be easier to understand if mark-ups are expressed in monetary value and not as a percentage so that consumers can sum them up easily with the other charges of the transaction.
| Text proposed by the Commission | Amendment |
|---|---|
| The payment service provider shall provide the following information and conditions to the payment service user: | The payment service provider shall provide in a prominent and easily understandable way the following information and conditions to the payment service user: |
To avoid that such information is hidden in small print or using complex language, it should become an obligation to actively provide this information in a prominent and easily understandable way.
| Text proposed by the Commission | Amendment |
|---|---|
| The payment service provider shall provide the following information and conditions to the payment service user: | The payment service provider shall provide in a prominent and easily understandable way the following information and conditions to the payment service user: |
| Text proposed by the Commission | Amendment |
|---|---|
| The payment service provider shall provide the following information and conditions to the payment service user: | The payment service provider shall provide in an easily understandable way the following information and conditions to the payment service user: |
To ensure comparability, PSPs should be required to disclose their currency conversion charges and mark-ups over an aggregated mid-market rate provided by neutral entities. The disclosures should be provided upfront, in an easily understandable way and not hidden in separate documents or websites. Mark-ups should be disclosed in monetary terms instead of percentage terms to avoid the confusion of consumers due to complicated fee structures. Today, most upfront/transaction fees are expressed in monetary value. Combining this with a percentage will require inconvenient calculations for consumers. It is important to include both credit transfers and money remittance transactions, as well as single payment transactions and framework contracts, to ensure payments to and from payment accounts are within scope and more consumers and (micro)businesses understand how much their transaction costs
| Text proposed by the Commission | Amendment |
|---|---|
| (ii) all charges, if any, for domestic, automated teller machines (ATMs) withdrawals payable by payment service users to their payment service provider at an ATM of: | (ii) all charges, if any, for Union automated teller machines (ATMs) withdrawals payable by payment service users to their payment service provider at an ATM of: |
| Text proposed by the Commission | Amendment |
|---|---|
| (2) a payment service provider belonging to the same network of ATMs as the user’s payment service provider; | deleted |
ASPSP or PSP ATMs should not charge any ATM fees for cash withdrawal services, as is already the case in many member states.
| Text proposed by the Commission | Amendment |
|---|---|
| (v) where applicable, the estimated charges for currency conversion services in relation to a credit transfer expressed as a percentage mark-up over the latest available applicable foreign exchange reference rate issued by the relevant central bank; | (v) where applicable, the estimated charges for currency conversion services in relation to a credit transfer expressed as a total amount and a percentage mark-up over the latest available applicable foreign exchange reference rate issued by the relevant central bank. These charges shall be clearly displayed before the final execution of the transaction by the payer and shall be displayed in the home currency of the payer in addition to the percentage mark-up; |
| Text proposed by the Commission | Amendment |
|---|---|
| (v) where applicable, the estimated charges for currency conversion services in relation to a credit transfer expressed as a percentage mark-up over the latest available applicable foreign exchange reference rate issued by the relevant central bank; | (v) where applicable, the estimated charges for currency conversion services in relation to a credit transfer expressed as a percentage mark-up over the latest available applicable foreign exchange reference rate issued by the relevant central bank, as well as in real monetary value in the payer’s currency; |
| Text proposed by the Commission | Amendment |
|---|---|
| (v) where applicable, the estimated charges for currency conversion services in relation to a credit transfer expressed as a percentage mark-up over the latest available applicable foreign exchange reference rate issued by the relevant central bank; | (v) where applicable, the estimated charges for currency conversion in relation to credit transfers, expressed in monetary value in the payer's currency over the latest available applicable foreign exchange reference rate issued by the relevant central bank. |
For consumers, it will be easier to understand if mark-ups are expressed in monetary value and not as a percentage so that consumers can sum them up easily with the other charges of the transaction.
| Text proposed by the Commission | Amendment |
|---|---|
| (v) where applicable, the estimated charges for currency conversion services in relation to a credit transfer expressed as a percentage mark-up over the latest available applicable foreign exchange reference rate issued by the relevant central bank; | (v) where applicable, the estimated charges for currency conversion services in relation to a credit transfer expressed as a mark-up in a monetary value in the payer's currency over the mid-market exchange rate offered by neutral and credible providers; |
To ensure comparability, PSPs should be required to disclose their currency conversion charges and mark-ups over an aggregated mid-market rate provided by neutral entities. The disclosures should be provided upfront, in an easily understandable way and not hidden in separate documents or websites. Mark-ups should be disclosed in monetary terms instead of percentage terms to avoid the confusion of consumers due to complicated fee structures. Today, most upfront/transaction fees are expressed in monetary value. Combining this with a percentage will require inconvenient calculations for consumers. It is important to include both credit transfers and money remittance transactions, as well as single payment transactions and framework contracts, to ensure payments to and from payment accounts are within scope and more consumers and (micro)businesses understand how much their transaction costs
| Text proposed by the Commission | Amendment |
|---|---|
| 1. The payment service provider shall propose any changes in the framework contract or in the information and conditions set out in Article 20 in the same way as provided for in Article 19(1) and no later than 2 months before their proposed date of application. The payment service user can either accept or reject the changes before the date of their proposed date of entry into force. | 1. The payment service provider shall propose any changes in the framework contract or in the information and conditions set out in Article 20 in the same way as provided for in Article 19(1) and no later than 3 months before their proposed date of application. The payment service user can either accept or reject the changes before the date of their proposed date of entry into force. |
| Text proposed by the Commission | Amendment |
|---|---|
| 1. The payment service user may terminate the framework contract at any time, unless the parties have agreed on a period of notice. Such a period shall not exceed 1 month. | 1. The payment service user may terminate the framework contract at any time, unless the parties have agreed on a contract term. Such a term shall not exceed 1 month. |
| Text proposed by the Commission | Amendment |
|---|---|
| 2. Termination of the framework contract shall be free of charge for the payment service user except where the contract has been in force for less than 6 months. Charges, if any, for termination of the framework contract shall be appropriate and in line with costs. Where, under the framework contract, payment services are offered jointly with technical services aimed at supporting the provision of payment services and provided by the payment service provider or by a third party the payment service provider has partnered with, such technical services shall be subject to the same framework contract requirements on termination fees. | 2. Termination of the framework contract shall be free of charge for the payment service user except where the contract has been in force for less than the contract term or 18 months, whichever is the lesser. |
| Text proposed by the Commission | Amendment |
|---|---|
| 2. Termination of the framework contract shall be free of charge for the payment service user except where the contract has been in force for less than 6 months. Charges, if any, for termination of the framework contract shall be appropriate and in line with costs. Where, under the framework contract, payment services are offered jointly with technical services aimed at supporting the provision of payment services and provided by the payment service provider or by a third party the payment service provider has partnered with, such technical services shall be subject to the same framework contract requirements on termination fees. | 2. Termination of the framework contract shall be free of charge for the payment service user except where the contract has been in force for less than 3 months. Charges, if any, for termination of the framework contract shall be appropriate and in line with costs. Where, under the framework contract, payment services are offered jointly with technical services aimed at supporting the provision of payment services and provided by the payment service provider or by a third party the payment service provider has partnered with, such technical services shall be subject to the same framework contract requirements on termination fees. |
| Text proposed by the Commission | Amendment |
|---|---|
| 3. If agreed in the framework contract, the payment service provider may terminate a framework contract concluded for an indefinite period by giving at least 2 months’ notice in the same way as provided for in Article 19(1). | 3. If agreed in the framework contract, the payment service provider may terminate a framework contract concluded for an indefinite period by giving at least 3 months’ notice in the same way as provided for in Article 19(1). |
| Text proposed by the Commission | Amendment |
|---|---|
| 6. Member States may provide for more favourable provisions on termination for payment service users. | 6. Member States may provide for more favourable provisions on termination for payment service users. Those provisions must be fully aligned with this Regulation and its objectives and must be communicated to the Commission. |
| Text proposed by the Commission | Amendment |
|---|---|
| (b) the charges payable by the payer; | (b) the charges payable by the payer expressed in the currency of the payment and if applicable the percentage mark up on any applicable exchange rates as compared to the mid-market rate of the central bank of issue; |
| Text proposed by the Commission | Amendment |
|---|---|
| (c) where applicable, a breakdown of the amounts of any charges. | (c) where applicable, a breakdown of the amounts of any charges before the payer executes the payment. |
| Text proposed by the Commission | Amendment |
|---|---|
| 2. A framework contract shall include a condition that the payer may require the information referred to in paragraph 1 to be provided or made available periodically, at least once a month, free of charge and in an agreed manner which allows the payer to store and reproduce information unchanged. | deleted |
| Text proposed by the Commission | Amendment |
|---|---|
| 1. Where the payment service user is not a consumer, the payment service user and the payment service provider may agree that Article 28(1), Article 49(7), and Articles 55, 60, 62, 63, 66, 75 and 76 do not apply in whole or in part. The payment service user and the payment service provider may also agree on time limits that are different from those laid down in Article 54. | 1. Where the payment service user is not a consumer, the payment service user and the payment service provider may agree that Article 28(1), Article 49(7), and Articles 55, 60, 62, 63, 66, 75, 76, and 88 do not apply in whole or in part. The payment service user and the payment service provider may also agree on time limits that are different from those laid down in Article 54. |
| Text proposed by the Commission | Amendment |
|---|---|
| 3. Member States may provide that provisions in this Title are applied to microenterprises in the same way as to consumers. | 3. Member States may provide that provisions in this Title are applied to small, medium-sized and microenterprises in the same way as to consumers. Those provisions shall be fully aligned with this Regulation and its objectives and must be communicated to the Commission. |
| Text proposed by the Commission | Amendment |
|---|---|
| 1. The payment service provider shall not charge the payment service user for fulfilment of its information obligations or corrective and preventive measures under this Title, unless otherwise specified in Article 65(1), Article 66(5) and Article 74(4). Those charges shall be agreed between the payment service user and the payment service provider and shall be reasonable and in line with the payment service provider’s actual costs. | 1. The payment service provider shall not charge the payment service user for fulfilment of its information obligations or corrective and preventive measures under this Title, unless otherwise specified in Article 65(1), Article 66(5) and Article 74(4). Those charges shall be agreed between the payment service user and the payment service provider and shall be reasonable and proportionate to actual costs. |
| Text proposed by the Commission | Amendment |
|---|---|
| 3. The payee shall not request charges for the use of payment instruments for which interchange fees are regulated under Chapter II of Regulation (EU) 2015/751 and for credit transfers, including instant credit transfers, and direct debit transactions within the Union. | 3. The payee shall not request charges for the use of payment instruments. |
| Text proposed by the Commission | Amendment |
|---|---|
| 3. The payee shall not request charges for the use of payment instruments for which interchange fees are regulated under Chapter II of Regulation (EU) 2015/751 and for credit transfers, including instant credit transfers, and direct debit transactions within the Union. | 3. The payee shall not request charges for the use of payment instruments. |
| Text proposed by the Commission | Amendment |
|---|---|
| 3. The payee shall not request charges for the use of payment instruments for which interchange fees are regulated under Chapter II of Regulation (EU) 2015/751 and for credit transfers, including instant credit transfers, and direct debit transactions within the Union. | 3. The payee shall not request charges for the use of any payment instruments, including those for which interchange fees are regulated under Chapter II of Regulation (EU) 2015/751. |
| Text proposed by the Commission | Amendment |
|---|---|
| 4. Member States may extend the prohibition or limit the right of the payee to request charges for the use of payment instruments other than the ones referred to in paragraph 3, taking into account the need to encourage competition and promote the use of efficient payment instruments. | deleted |
| Text proposed by the Commission | Amendment |
|---|---|
| 4. Member States may extend the prohibition or limit the right of the payee to request charges for the use of payment instruments other than the ones referred to in paragraph 3, taking into account the need to encourage competition and promote the use of efficient payment instruments. | deleted |
| Text proposed by the Commission | Amendment |
|---|---|
| 4. Member States may extend the prohibition or limit the right of the payee to request charges for the use of payment instruments other than the ones referred to in paragraph 3, taking into account the need to encourage competition and promote the use of efficient payment instruments. | deleted |
| Text proposed by the Commission | Amendment |
|---|---|
| 4. Member States may extend the prohibition or limit the right of the payee to request charges for the use of payment instruments other than the ones referred to in paragraph 3, taking into account the need to encourage competition and promote the use of efficient payment instruments. | 4. Member States shall extend the prohibition or limit the right of the payee to request charges for the use of all payment instruments, taking into account the need to encourage competition and promote the use of efficient payment instruments. |
| Text proposed by the Commission | Amendment |
|---|---|
| 5. Without prejudice to paragraphs 3 and 4 and for instruments not covered in those paragraphs, the payment service provider shall not prevent the payee from requesting from the payer a charge, offering him a reduction or otherwise steering the payer towards the use of a given payment instrument. Any charges applied shall not exceed the direct costs borne by the payee for the use of the specific payment instrument. | 5. Without prejudice to paragraphs 3, the payment service provider shall not prevent the payee from offering the payer a reduction or otherwise steering the payer towards the use of a given payment instrument. |
| Text proposed by the Commission | Amendment |
|---|---|
| 5. Without prejudice to paragraphs 3 and 4 and for instruments not covered in those paragraphs, the payment service provider shall not prevent the payee from requesting from the payer a charge, offering him a reduction or otherwise steering the payer towards the use of a given payment instrument. Any charges applied shall not exceed the direct costs borne by the payee for the use of the specific payment instrument. | 5. Without prejudice to paragraphs 3 and 4, the payment service provider shall not prevent the payee from offering the payer a reduction or otherwise steering the payer towards the use of a given payment instrument. |
| Text proposed by the Commission | Amendment |
|---|---|
| 5. Without prejudice to paragraphs 3 and 4 and for instruments not covered in those paragraphs, the payment service provider shall not prevent the payee from requesting from the payer a charge, offering him a reduction or otherwise steering the payer towards the use of a given payment instrument. Any charges applied shall not exceed the direct costs borne by the payee for the use of the specific payment instrument. | 5. Without prejudice to paragraph 3, the payment service provider shall not prevent the payee from requesting from the payer a charge, offering him a reduction or otherwise steering the payer towards the use of a given payment instrument. Any charges applied shall not exceed the direct costs borne by the payee for the use of the specific payment instrument. |
| Text proposed by the Commission | Amendment |
|---|---|
| 6. Member States shall [ OP please insert the date = data of application of this Regulation] notify to the Commission the provisions of their law adopted pursuant to paragraph 4. They shall, without delay, notify any subsequent amendment to such provisions. | deleted |
| Text proposed by the Commission | Amendment |
|---|---|
| 1. In the case of payment instruments which, according to the framework contract, solely concern individual payment transactions not exceeding EUR 50 or which either have a spending limit of EUR 200, or store funds which do not exceed EUR 200 at any time, payment service providers may agree with their payment service users that: | 1. In the case of payment instruments which, according to the framework contract, solely concern individual payment transactions not exceeding EUR 100 or which either have a spending limit of EUR 250, or store funds which do not exceed EUR 250 at any time, payment service providers may agree with their payment service users that: |
| Text proposed by the Commission | Amendment |
|---|---|
| Article 31a | |
| Without prejudice to Article 6(7) of Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828, original equipment manufacturers of mobile devices and providers of electronic communication services within the meaning of Article 2 (1) Directive (EU) 2018/1972 shall allow providers of front end payment services effective interoperability with, and access for the purposes of interoperability to, the hardware features and software features necessary for storing and transferring data to process online or offline transactions, on fair, reasonable and non-discriminatory terms. |
| Text proposed by the Commission | Amendment |
|---|---|
| 1. A credit institution shall only refuse to open or shall only close a payment account for a payment institution for its agents or distributors or for an applicant for a license as a payment institution in the following cases: | 1. A credit institution shall only refuse to open or shall only close a payment account for a payment institution for its agents or distributors or for an applicant for a license as a payment institution in cases where it is justified on objective, non-discriminatory and proportionate grounds, in particular in the following cases: |
| Text proposed by the Commission | Amendment |
|---|---|
| (b) there is or has been a breach of contract committed by the applicant for an account; | (b) there is or has been a material breach of contract committed by the applicant for an account; |
| Text proposed by the Commission | Amendment |
|---|---|
| (b) there is or has been a breach of contract committed by the applicant for an account; | (b) there is or has been a material breach of contract committed by the applicant for an account; |
| Text proposed by the Commission | Amendment |
|---|---|
| (c) insufficient information and documents have been received from the applicant for an account; | (c) insufficient information and documents pertaining to matters set out in this paragraph have been received from the applicant for an account; |
| Text proposed by the Commission | Amendment |
|---|---|
| (d) the applicant for an account or its business model presents an excessive risk profile; | deleted |
| Text proposed by the Commission | Amendment |
|---|---|
| (d) the applicant for an account or its business model presents an excessive risk profile; | deleted |
| Text proposed by the Commission | Amendment |
|---|---|
| (e) the applicant for an account would present a disproportionately high compliance cost for the credit institution. | deleted |
| Text proposed by the Commission | Amendment |
|---|---|
| (e) the applicant for an account would present a disproportionately high compliance cost for the credit institution. | deleted |
| Text proposed by the Commission | Amendment |
|---|---|
| Where a credit institution makes a decision to close a payment account in accordance with this paragraph, the account closure shall take effect on expiry of a notice period which shall not be less than 6 months. |
| Text proposed by the Commission | Amendment |
|---|---|
| 1 a. Member States shall ensure that payment institutions have a right of access to payment accounts with one or more credit institutions. Such access shall be sufficiently extensive as to allow payment institutions to provide their payment services in an unhindered, efficient and uninterrupted manner, throughout the period of their authorisation. In the event that a payment institution is not able to open a payment account with a credit institution, or if such payment account is closed, the competent authority shall nominate one or more credit institutions to provide a payment account to that payment institution. |
| Text proposed by the Commission | Amendment |
|---|---|
| 1 a. Member States shall ensure that payment institutions have a right of access to payment accounts with one or more credit institutions. Such access shall be sufficiently extensive as to allow payment institutions to provide their payment services in an unhindered, efficient and uninterrupted manner, throughout the period of their authorisation. In the event that a payment institution is not able to open a payment account with a credit institution, or if such payment account is closed, the competent authority shall nominate one or more credit institutions to provide a payment account to that payment institution. |
| Text proposed by the Commission | Amendment |
|---|---|
| 1 b. Where a credit institution makes a decision to close a payment account in accordance with this paragraph, the account closure shall take effect on expiry of a notice period which shall not be less than 6 months. |
| Text proposed by the Commission | Amendment |
|---|---|
| 3. A credit institution shall notify to the payment institution or to its agents or distributors, or to the applicant for a license as a payment institution, any decision to refuse to open or to close a payment account to a payment institution or to its agents or distributors, or to an applicant for a license as a payment institution; it shall duly motivate any such decision. Such motivation must be specific to the risks posed by the activity or planned activity of that payment institution or of its agents or distributors, as assessed by the credit institution, and not be generic in nature. | 3. A credit institution shall notify to the payment institution or to its agents or distributors, or to the applicant for a license as a payment institution, any decision to refuse to open or to close a payment account to a payment institution or to its agents or distributors, or to an applicant for a license as a payment institution; it shall duly motivate any such decision. Such motivation must be specific to the risks posed by the activity or planned activity of that payment institution or of its agents or distributors, as assessed by the credit institution, and not be generic in nature. A credit institution shall also notify the competent authority of its decision to refuse to open or to close a payment account. The competent authorities shall publish aggregate data on payment account refusals and closures. |
| Text proposed by the Commission | Amendment |
|---|---|
| 3 a. A credit institution shall also notify the competent authority of its decision to close or to refuse to open a payment account. The competent authorities shall publish aggregate data on payment account refusals and closures. |
| Text proposed by the Commission | Amendment |
|---|---|
| 3 a. A credit institution shall also notify the national competent authority of its decision to refuse to open or to close a specific payment account. |
| Text proposed by the Commission | Amendment |
|---|---|
| The EBA shall develop draft regulatory technical standards specifying the harmonised format and information to be contained in the notification and motivation referred to in paragraph 3 of this Article. | The EBA shall develop draft regulatory technical standards specifying the harmonised format and information to be contained in the notification and motivation referred to in paragraph 3 of this Article. These draft regulatory technical standards shall also develop the harmonised objectives, powers and procedure to be followed by the competent authorities in respect of appeals referred to them under paragraph 4 of this Article. |
| Text proposed by the Commission | Amendment |
|---|---|
| The EBA shall develop draft regulatory technical standards specifying the harmonised format and information to be contained in the notification and motivation referred to in paragraph 3 of this Article. | The EBA shall develop draft regulatory technical standards specifying the harmonised format and information to be contained in the notification and motivation referred to in paragraph 3 of this Article. These draft regulatory technical standards shall also develop the harmonised objectives, powers and procedure to be followed by the competent authorities in respect of appeals referred to them under paragraph 4 of this Article. |
| Text proposed by the Commission | Amendment |
|---|---|
| 1 a. Payees must offer to payment service users at least one payment method without surcharges which does not rely on the use of a payment initiation service provider. |
Consumers should not be discriminated against or refused access to a service or product (e.g. credit) when they refuse to use open banking as a means to provide data. They should be offered different ways to provide the data required to access the service (e.g. credit) or different ways to initiate a payment.
| Text proposed by the Commission | Amendment |
|---|---|
| 1 a. Payees must offer to payment service users at least one payment method without surcharges which does not rely on the use of a payment initiation service provider. |
| Text proposed by the Commission | Amendment |
|---|---|
| 2 a. Traders such as creditors and insurance operators must offer to payment service users a way to share their data which does not rely on the use of account information service providers. | |
| Without prejudice to Regulation (EU) 2016/679, payment service providers shall inform consumers in a clear and comprehensible manner when they are presented with a personalised offer that is based on automated processing of personal data. | |
| Traders such as creditors and insurance operators shall ensure that the conditions to access their services do not discriminate against consumers legally resident in the Union on ground of their nationality or place of residence, the location of the payment account, the place of establishment of the payment service provider or the place of issue of the payment instrument within the Union or on any ground as referred to in Article 21 of the Charter of Fundamental Rights of the European Union. | |
| Any undertaking designated as a gatekeeper, pursuant to Article 3 of Regulation (EU) 2022/1925 on contestable and fair markets in the digital sector (Digital Markets Act), shall not receive access to payment systems as account information service provider. | |
| Account information service providers shall not be allowed to combine account information data obtained pursuant to this Regulation with other types of personal data where such combination of data may result in harmful practices such as social scoring. The European Banking Authority shall develop draft Regulatory Technical Standards limiting the combination of data obtained by account information service providers with other types of personal data. The EBA shall submit the Regulatory Technical Standards referred to in the first subparagraph to the Commission by [ OP please insert the date= one year after the date of entry into force of this Regulation]. | |
| When preparing the draft Regulatory Technical Standards referred to in subparagraph 6, the European Banking Authority shall closely cooperate with the European Data Protection Board established by Regulation (EU) 2016/679. | |
| Power is delegated on the Commission to adopt the Regulatory Technical Standards referred to in subparagraph 6 in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010. |
Consumers should not be discriminated against or refused access to a service or product (e.g. credit) when they refuse to use open banking as a means to provide data. They should be offered different ways to provide the data required to access the service (e.g. credit) or different ways to initiate a payment. Given the sensitive nature of payment transaction data revealing a lot about a consumer’s private life, consumers shall be adequately informed when this data is used to create a personalised offer and which categories of data have been used to create such an offer as already foreseen for creditors under the Consumer Credit Directive. In addition, it shall be explicitly foreseen that consumers cannot be discriminated against on the basis of any other types of personal characteristics such as gender, disabilities, nationality or place of residence similarly to Article 6 of the Consumer Credit Directive. Financial data sharing could pose significant risks, if consumers’ data is exploited by companies with extensive financial power. Therefore, the role of AISPs should be clearly delineated and entities designated as gatekeepers under the Digital Markets Act should not get access to data under Open Banking. A similar provision is foreseen in Article 5 of the newly adopted Data Act. The combination of data obtained via the use of account information services with other types of personal data can result in heightened risk of harmful practices such social scoring. To avoid such risks, the European Banking Authority shall in cooperation with the European Data Protection Board, develop regulatory technical standards to limit certain types of combination of data. For example, combining data from credit registers with account information data could pose such a risk of social scoring.
| Text proposed by the Commission | Amendment |
|---|---|
| 2 a. Traders such as creditors and insurance operators shall offer to payment service users a way to share their data which does not rely on the use of account information service providers. |
| Text proposed by the Commission | Amendment |
|---|---|
| 2 b. Without prejudice to Regulation (EU) 2016/679, payment service providers shall inform consumers in a clear and comprehensible manner when they are presented with a personalised offer that is based on automated processing of personal data. |
| Text proposed by the Commission | Amendment |
|---|---|
| 2 c. Traders such as creditors and insurance operators shall ensure that the conditions to access their services do not discriminate against consumers legally resident in the Union on grounds of their nationality or place of residence, the location of the payment account, the place of establishment of the payment service provider or the place of issue of the payment instrument within the Union or on any ground referred to in Article 21 of the Charter of Fundamental Rights of the European Union. |
| Text proposed by the Commission | Amendment |
|---|---|
| 2 d. Any undertaking designated as a gatekeeper, pursuant to Article 3 of Regulation (EU) 2022/1925 on contestable and fair markets in the digital sector, shall not receive access to payment systems as account information service provider. |
| Text proposed by the Commission | Amendment |
|---|---|
| 2 e. Account information service providers shall not be allowed to combine account information data obtained pursuant to this Regulation with other types of personal data where such combination of data may result in harmful practices such as social scoring. | |
| The European Banking Authority shall develop draft Regulatory Technical Standards limiting the combination of data obtained by account information service providers with other types of personal data. The EBA shall submit the Regulatory Technical Standards referred to in this first subparagraph to the Commission by [OP please insert the date= one year after the date of entry into force of this Regulation]. | |
| When preparing the draft Regulatory Technical Standards referred to in subparagraph 2, the European Banking Authority shall closely cooperate with the European Data Protection Board established by Regulation (EU) 2016/679. | |
| Power is delegated on the Commission to adopt the Regulatory Technical Standards referred to in subparagraph 2 in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010. |
| Text proposed by the Commission | Amendment |
|---|---|
| 2 a. Account servicing payment service providers are entitled to compensation, in line with Article 9(1) of Regulation XXX on harmonised rules on fair access to and use of data (Data Act, COM(2022) 68 final). |
| Text proposed by the Commission | Amendment |
|---|---|
| Provision of dedicated access interfaces | Provision of access interfaces |
| Text proposed by the Commission | Amendment |
|---|---|
| 1. Account servicing payment service providers that offer to a payer a payment account that is accessible online shall have in place at least one dedicated interface for the purpose of data exchange with account information and payment initiation service providers. | 1. Account servicing payment service providers that offer to a payer a payment account that is accessible online shall have in place at least one machine to machine interface for the purpose of data exchange with account information and payment initiation service providers. |
| Text proposed by the Commission | Amendment |
|---|---|
| 2. Without prejudice to Articles 38 and 39, account servicing payment service providers that offer to a payer a payment account that is accessible online and have put in place a dedicated interface as referred to in paragraph 1 of this Article, shall not be obliged to also maintain permanently another interface as fall-back for the purpose of data exchange with account information and payment initiation service providers. | 2. Without prejudice to Article 39, account servicing payment service providers that offer to a payer a payment account that is accessible online and have put in place an interface as referred to in paragraph 1 of this Article, shall not be obliged to also maintain permanently another interface as fall-back for the purpose of data exchange with account information and payment initiation service providers, but shall always permit access to interfaces which allow business continuity for those providers. |
| Text proposed by the Commission | Amendment |
|---|---|
| 3. Account servicing payment service providers shall ensure that their dedicated interfaces referred to in paragraph 1 use standards of communication which are issued by European or international standardisation organisations including the European Committee for Standardization (CEN) or the International Organization for Standardization (ISO). Account servicing payment service providers shall also ensure that the technical specifications of any of the dedicated interfaces referred to in paragraph 1 are documented specifying a set of routines, protocols and tools needed by payment initiation service providers and account information service providers for allowing their software and applications to interoperate with the systems of the account servicing payment service provider. Account servicing payment service providers shall make the documentation on technical specifications of their dedicated interfaces referred to in paragraph 1 available, at no charge and without delay, upon request by authorised payment initiation service providers, account information service providers or by payment service providers that have applied to their competent authorities for the relevant authorisation and shall make a summary of that documentation publicly available on their website. | 3. Account servicing payment service providers shall ensure that their interfaces referred to in paragraph 1 use standards of communication which are issued by European or international standardisation organisations including the European Committee for Standardization (CEN) or the International Organization for Standardization (ISO). Account servicing payment service providers shall also ensure that the technical specifications of any of the dedicated interfaces referred to in paragraph 1 are documented specifying a set of routines, protocols and tools needed by payment initiation service providers and account information service providers for allowing their software and applications to interoperate with the systems of the account servicing payment service provider. Account servicing payment service providers shall make the documentation on technical specifications of their dedicated interfaces referred to in paragraph 1 available, at no charge and without delay, upon request by authorised payment initiation service providers, account information service providers or by payment service providers that have applied to their competent authorities for the relevant authorisation and shall make a summary of that documentation publicly available on their website. |
Across the text, where the phrase 'dedicated interface' is in the Commission proposal, it should instead read only 'interface'
| Text proposed by the Commission | Amendment |
|---|---|
| 4. Account servicing payment service providers shall ensure that, except for emergency situations which prevent them from doing so, any change to the technical specifications of their dedicated interface referred to in paragraph 1 is made available to authorised payment initiation service providers, account information service providers, or payment service providers that have applied to their competent authorities for the relevant authorisation, in advance, as soon as possible and not less than 3 months before the change is implemented. Account servicing payment service providers shall document emergency situations where changes were implemented without such advance information and make the documentation available to competent authorities on request. | 4. Account servicing payment service providers shall ensure that, except for emergency situations which prevent them from doing so, any change to the technical specifications of their dedicated interface referred to in paragraph 1 is made available to authorised payment initiation service providers, account information service providers, or payment service providers that have applied to their competent authorities for the relevant authorisation, in advance, as soon as possible and not less than six weeks before the change is implemented. Account servicing payment service providers shall document emergency situations where changes were implemented without such advance information and make the documentation available to competent authorities on request. |
| Text proposed by the Commission | Amendment |
|---|---|
| Requirements regarding dedicated data access interfaces | Requirements regarding data access interfaces |
| Text proposed by the Commission | Amendment |
|---|---|
| (b) the dedicated interface shall ensure the integrity and confidentiality of the personalised security credentials and of authentication codes transmitted by or through the payment initiation service provider or the account information service provider; | (b) the dedicated interface shall apply a re-direction approach to ensure the integrity and confidentiality of the personalised security credentials and of authentication codes transmitted by or through the payment initiation service provider or the account information service provider; |
| Text proposed by the Commission | Amendment |
|---|---|
| (b) the dedicated interface shall ensure the integrity and confidentiality of the personalised security credentials and of authentication codes transmitted by or through the payment initiation service provider or the account information service provider; | (b) the dedicated interface shall apply a re-direction approach to ensure the integrity and confidentiality of the personalised security credentials and of authentication codes transmitted by or through the payment initiation service provider or the account information service provider; |
To avoid that consumers’ personalised security credentials are shared with any third party, account information service providers and payment initiation providers should always redirect consumers to the website of their online banking to authenticate themselves.
| Text proposed by the Commission | Amendment |
|---|---|
| (c) the response time of the dedicated interface to account information service providers’ and payment initiation service providers’ access requests shall not be longer than the response time of the interface that the account servicing payment service provider makes available to its payment service users for directly accessing their payment account online. | (c) the response time of the interface to account information service providers’ and payment initiation service providers’ access requests shall not be longer than the response time of all of the interfaces that the account servicing payment service provider makes available to its payment service users for directly accessing their payment account online. |
| Text proposed by the Commission | Amendment |
|---|---|
| 2. Account servicing payment service providers shall ensure that the dedicated interface referred to in Article 35(1) allows both account information service providers and payment initiation service providers to: | 2. Account servicing payment service providers shall ensure that the interface referred to in Article 35(1) allows both account information service providers and payment initiation service providers to: |
| Text proposed by the Commission | Amendment |
|---|---|
| (d) see, prior to initiation of the payment in the case of payment initiation service providers, the unique identifier of the account, the associated names of the account holder and the currencies as available to the payment service user. | (d) see, prior to initiation of the payment, at least, the unique identifier of the account, the associated names or other identifiers of the account holder and the currencies and the account balance as available to the payment service user. |
| Text proposed by the Commission | Amendment |
|---|---|
| 3. Account servicing payment service providers shall allow account information service providers to communicate securely, via the dedicated interface, to request and receive information on one or more designated payment accounts and associated payment transactions. | 3. Account servicing payment service providers shall allow account information service providers to communicate securely, via the interface, to request and receive information on one or more designated payment accounts and associated payment transactions. |
| Text proposed by the Commission | Amendment |
|---|---|
| (h a) in the case where the account servicing payment service provider offers multiple authentication options, have the choice to decide which authentication method should be presented to the payer, taking into account the least cumbersome choice for the payer. |
| Text proposed by the Commission | Amendment |
|---|---|
| (h a) refuse to initiate a payment transaction on justified grounds. |
| Text proposed by the Commission | Amendment |
|---|---|
| (b) the confirmation from the account servicing payment service provider that the payment will be executed on the basis of the information available to the account servicing payment service provider, taking into account any pre-existing payment orders that might affect the full execution of the payment order being placed. | (b) the confirmation from the account servicing payment service provider as soon as possible, and not longer than 20 seconds after the authorisation by the payer, that the payment has been or will be executed on the basis of the information available to the account servicing payment service provider, taking into account any pre-existing payment orders that might affect the full execution of the payment order being placed. |
| Text proposed by the Commission | Amendment |
|---|---|
| Where the account servicing payment service provider carries out any controls which may impact the execution of the payment, these controls shall take place prior to the confirmation of payment. |
| Text proposed by the Commission | Amendment |
|---|---|
| Data access parity between dedicated access interface and customer interface | Data access for third parties |
| Text proposed by the Commission | Amendment |
|---|---|
| 2. Account servicing payment service providers shall provide account information services providers with at least the same information from designated payment accounts and associated payment transactions made available to the payment service user when directly requesting access to the account information, provided that this information does not include sensitive payment data. | 2. In line with Regulation 2016/679/EU [GDPR], account servicing payment service providers shall provide account information services providers with the information from designated payment accounts and associated payment transactions necessary for the performance of a contract to which the data subject is party, provided that this information does not include sensitive payment data. |
| Text proposed by the Commission | Amendment |
|---|---|
| 2. Account servicing payment service providers shall provide account information services providers with at least the same information from designated payment accounts and associated payment transactions made available to the payment service user when directly requesting access to the account information, provided that this information does not include sensitive payment data. | 2. In line with Regulation 2016/679/EU [GDPR], account servicing payment service providers shall provide account information services providers with the information from designated payment accounts and associated payment transactions necessary for the performance of a contract to which the data subject is party provided that this information does not include sensitive payment data. |
Open banking cannot come at the expense of data security. When consumers consent to share data with third parties, data sharing should not become an “open bar,” but there must be strict enforcement of the principles of data minimisation and purpose limitation. Only data which are strictly needed for the performance of a contract, shall be accessed (Art. 5(1) c GDPR).
| Text proposed by the Commission | Amendment |
|---|---|
| 3. Account servicing payment service providers shall provide payment initiation service providers with at least the same information on the initiation and execution of the payment transaction provided or made available to the payment service user when the transaction is initiated directly by the payment service user. That information shall be provided immediately after receipt of the payment order and on an ongoing basis until the payment is final. | 3. In line with Regulation 2016/679/EU [GDPR], account servicing payment service providers shall provide payment initiation service providers with the information necessary for the initiation and execution of the payment transaction provided or made available to the payment service user when the transaction is initiated directly by the payment service user. That information shall be provided immediately after receipt of the payment order and any update to the information, including but not limited to the payment status, shall be pushed to the payment initiation service provider via the dedicated interface in real-time on an ongoing basis until the payment is executed or rejected. |
| Text proposed by the Commission | Amendment |
|---|---|
| 3. Account servicing payment service providers shall provide payment initiation service providers with at least the same information on the initiation and execution of the payment transaction provided or made available to the payment service user when the transaction is initiated directly by the payment service user. That information shall be provided immediately after receipt of the payment order and on an ongoing basis until the payment is final. | 3. In line with Regulation 2016/679/EU [GDPR], account servicing payment service providers shall provide payment initiation service providers with the information necessary for the initiation and execution of the payment transaction provided or made available to the payment service user when the transaction is initiated directly by the payment service user. That information shall be provided immediately after receipt of the payment order and on an ongoing basis until the payment is final. |
Open banking cannot come at the expense of data security. When consumers consent to share data with third parties, data sharing should not become an “open bar,” but there must be strict enforcement of the principles of data minimisation and purpose limitation. Only data which are strictly needed for the performance of a contract, shall be accessed (Art. 5(1) c GDPR).
| Text proposed by the Commission | Amendment |
|---|---|
| 3. Account servicing payment service providers shall provide payment initiation service providers with at least the same information on the initiation and execution of the payment transaction provided or made available to the payment service user when the transaction is initiated directly by the payment service user. That information shall be provided immediately after receipt of the payment order and on an ongoing basis until the payment is final. | 3. Account servicing payment service providers shall provide payment initiation service providers with at least the same information on the initiation and execution of the payment transaction provided or made available to the payment service user when the transaction is initiated directly by the payment service user. That information shall be provided immediately after receipt of the payment order and on an ongoing basis until the payment is executed or rejected. |
| Text proposed by the Commission | Amendment |
|---|---|
| 3 a. The processing of customer data shall be limited to what is necessary in relation to the purpose for which it was processed. In accordance with Article 16 of Regulation (EU) No 1093/2010, the European Banking Authority shall develop guidelines on the implementation of this paragraph for payment initiation services and account information services. |
| Text proposed by the Commission | Amendment |
|---|---|
| 3 a. The processing of customer data shall be limited to what is necessary in relation to the purpose for which it was processed. In accordance with Article 16 of Regulation (EU) No 1093/2010, the EBA shall develop guidelines on the implementation of this paragraph for payment initiation services and account information services. |
The European Banking Authority should be mandated in the PSR to issue guidance on how to establish data use perimeter for account information services and payment initiation services similarly to framework outlined in the Open Finance proposal.
| Text proposed by the Commission | Amendment |
|---|---|
| 3 b. When preparing the guidelines referred to in paragraph 3a of this Article, the European Banking Authority shall closely cooperate with the European Data Protection Board established by Regulation (EU) 2016/679. |
| Text proposed by the Commission | Amendment |
|---|---|
| 3 b. When preparing the guidelines referred to in paragraph 3a of this Article, the EBA shall closely cooperate with the European Data Protection Board established by Regulation (EU) 2016/679. |
The European Banking Authority should be mandated in the PSR to issue guidance on how to establish data use perimeter for account information services and payment initiation services similarly to framework outlined in the Open Finance proposal.
| Text proposed by the Commission | Amendment |
|---|---|
| [...] | deleted |
| Text proposed by the Commission | Amendment |
|---|---|
| 1. Account servicing payment service providers shall take all measures in their power to prevent unavailability of the dedicated interface. Unavailability shall be presumed to have arisen when five consecutive requests for access to information for the provision of payment initiation services or account information services receive no response from the account servicing payment service provider’s dedicated interface within 30 seconds. | 1. Account servicing payment service providers shall take all measures in their power to prevent unavailability and underperformance of the dedicated interface. Unavailability shall be presumed to have arisen when five consecutive requests for access to information for the provision of payment initiation services or account information services receive no response from the account servicing payment service provider’s dedicated interface within 30 seconds. |
| Text proposed by the Commission | Amendment |
|---|---|
| 2. In case of unavailability of the dedicated interface, account servicing payment service providers shall inform payment service providers making use of the dedicated interface of measures taken to restore the interface and of the time estimated necessary for the problem to be resolved. During the period of unavailability, account servicing payment service providers shall offer to account information and payment initiation service providers without delay an effective alternative solution, such as the use of the interface that the account servicing payment service provider uses for authentication and communication with its users, to access payment account data. | 2. In case of unavailability of the dedicated interface, account servicing payment service providers shall inform payment service providers making use of the dedicated interface of measures taken to restore the interface and of the time estimated necessary for the problem to be resolved. During the period of unavailability, account servicing payment service providers shall offer to account information and payment initiation service providers without undue delay an effective alternative solution, such as the use of the interface that the account servicing payment service provider uses for authentication and communication with its users, to access payment account data. |
| Text proposed by the Commission | Amendment |
|---|---|
| Derogation from having a dedicated interface for data access | Derogation from having an interface for data access |
| Text proposed by the Commission | Amendment |
|---|---|
| The EBA shall develop draft regulatory technical standards which shall specify the criteria on the basis of which, in accordance with paragraph 1, an account servicing payment service provider may be exempted from the obligation to have in place a dedicated interface and be allowed either to provide, as interface for secure data exchange with account information service providers and payment initiation service providers, the interface that it makes available to its payment user for accessing its payment accounts online or, where appropriate, not to have any interface at all for secure data exchange. | The EBA shall develop draft regulatory technical standards which shall specify the criteria on the basis of which, in accordance with paragraph 1, an account servicing payment service provider may be exempted from the obligation to have in place a dedicated interface and be allowed either to provide, as interface for secure data exchange with account information service providers and payment initiation service providers, the interface that it makes available to its payment user for accessing its payment accounts online or, where appropriate, not to have any interface at all for secure data exchange. The criteria shall be based on limited use or value of payment account products, which would automatically exempt account servicing payment service provider under this Article without having to seek exemptions individually from competent authorities. |
| Text proposed by the Commission | Amendment |
|---|---|
| The EBA shall develop draft regulatory technical standards which shall specify the criteria on the basis of which, in accordance with paragraph 1, an account servicing payment service provider may be exempted from the obligation to have in place a dedicated interface and be allowed either to provide, as interface for secure data exchange with account information service providers and payment initiation service providers, the interface that it makes available to its payment user for accessing its payment accounts online or, where appropriate, not to have any interface at all for secure data exchange. | The EBA shall develop draft regulatory technical standards which shall specify the criteria on the basis of which, in accordance with paragraph 1, an account servicing payment service provider may be exempted from the obligation to have in place an interface and be allowed either to provide, as interface for secure data exchange with account information service providers and payment initiation service providers, the interface that it makes available to its payment user for accessing its payment accounts online or, where appropriate, not to have any interface at all for secure data exchange. |
| Text proposed by the Commission | Amendment |
|---|---|
| For the purposes of point (b), where some or all of the information referred to in that point is unavailable immediately after receipt of the payment order, the account servicing payment service provider shall ensure that any information about the execution of the payment order is made available to the payment initiation service provider immediately after that information becomes available to the account servicing payment service provider. | For the purposes of point (b), where some or all of the information referred to in that point is unavailable immediately after receipt of the payment order, the account servicing payment service provider shall ensure that any information, including but not limited to any payment status update, about the execution of the payment order is made available to the payment initiation service provider immediately after that information becomes available to the account servicing payment service provider. |
| Text proposed by the Commission | Amendment |
|---|---|
| For the purposes of point (b), where some or all of the information referred to in that point is unavailable immediately after receipt of the payment order, the account servicing payment service provider shall ensure that any information about the execution of the payment order is made available to the payment initiation service provider immediately after that information becomes available to the account servicing payment service provider. | For the purposes of point (b), where some or all of the information referred to in that point is unavailable immediately after receipt of the payment order, the account servicing payment service provider shall ensure that any information, including any payment status update, about the execution of the payment order is made available to the payment initiation service provider immediately after that information becomes available to the account servicing payment service provider. |
| Text proposed by the Commission | Amendment |
|---|---|
| (v a) the dates on which data has been accessed and which categories of data have been retrieved when doing so. |
| Text proposed by the Commission | Amendment |
|---|---|
| (c) allow the payment service user to re-establish any data access withdrawn; | deleted |
| Text proposed by the Commission | Amendment |
|---|---|
| (c) allow the payment service user to re-establish any data access withdrawn; | deleted |
Reinstating withdrawn permissions in dashboards could pose technical and legal challenges if service terms change.
| Text proposed by the Commission | Amendment |
|---|---|
| (c a) allow payment services users to opt-out from data sharing with third parties in a general way for all present and future data access permission requests; |
| Text proposed by the Commission | Amendment |
|---|---|
| (d a) be consistent with the Financial Data Access Regulation’s dashboards and allow data holders to manage data permissions stemming from both FIDA and this Regulation through a single dashboard. |
| Text proposed by the Commission | Amendment |
|---|---|
| 2 a. The EBA shall develop draft Regulatory Technical Standards to develop a standardised list of data categories referred to in paragraph 2, point (a), so that the data is easily understandable for consumers. | |
| The EBA shall submit the Regulatory Technical Standards referred to in the first subparagraph to the Commission by [ OP please insert the date= one year after the date of entry into force of this Regulation]. Power is delegated on the Commission to adopt the Regulatory Technical Standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010. |
| Text proposed by the Commission | Amendment |
|---|---|
| 2 b. Where a payment services user, pursuant to paragraph 2, point b, decides to withdraw data access, the given account information service provider or payment initiation service provider shall no longer withdraw data and shall erase all data received based on the data access permission granted by the payment services user. |
| Text proposed by the Commission | Amendment |
|---|---|
| 4. The account servicing payment service provider and the account information service or payment initiation service provider to which permission has been granted shall cooperate to make information available to the payment service user via the dashboard in real-time. For the purposes of paragraph 2 points (a), (b), (c) and (e): | 4. The account servicing payment service provider and the account information service or payment initiation service provider to which permission has been granted shall cooperate to make information available to the payment service user via the dashboard in real-time. For the purposes of paragraph 2: |
| Text proposed by the Commission | Amendment |
|---|---|
| (i) the purpose of the permission granted by the payment service user; | (i) the purpose of the permission granted by the payment service user, in a clear and comprehensible manner for the user; |
| Text proposed by the Commission | Amendment |
|---|---|
| Account servicing payment service providers shall ensure that their dedicated interface does not create obstacles to the provision of payment initiation and account information services. | Account servicing payment service providers shall ensure that their dedicated interface does not create obstacles to the provision of payment initiation and account information services and enables a straightforward and seamless consumer experience. |
| Text proposed by the Commission | Amendment |
|---|---|
| Prohibited obstacles shall include the following: | Prohibited obstacles shall include, but are not limited to, the following: |
| Text proposed by the Commission | Amendment |
|---|---|
| Prohibited obstacles shall include the following: | Prohibited obstacles include, among others, the following: |
| Text proposed by the Commission | Amendment |
|---|---|
| (a) preventing the use by payment initiation services providers or account information services providers of the credentials issued by account servicing payment service providers to their payment services users; | (a) preventing the use by payment initiation services providers or account information services providers of the personalised security credentials issued by account servicing payment service providers to their payment services users; |
| Text proposed by the Commission | Amendment |
|---|---|
| (j) imposing an account information or payment initiation journey, in a ‘redirection’ or ‘decoupled’ approach, where the authentication of the payment service user with the account servicing payment service provider adds additional steps or required actions in the user journey compared to the equivalent authentication procedure offered to payment service users when directly accessing their payment accounts or initiating a payment with the account servicing payment service provider; | deleted |
| Text proposed by the Commission | Amendment |
|---|---|
| (j) imposing an account information or payment initiation journey, in a ‘redirection’ or ‘decoupled’ approach, where the authentication of the payment service user with the account servicing payment service provider adds additional steps or required actions in the user journey compared to the equivalent authentication procedure offered to payment service users when directly accessing their payment accounts or initiating a payment with the account servicing payment service provider; | (j) imposing an account information or payment initiation journey, in a ‘redirection’ or ‘decoupled’ approach for the authentication of the payment service user as well as imposing additional steps or required actions in the user journey compared to the equivalent authentication procedure offered to payment service users when directly accessing their payment accounts or initiating a payment with the account servicing payment service provider; |
| Text proposed by the Commission | Amendment |
|---|---|
| (k) imposing that the user be automatically redirected, at the stage of authentication, to the account servicing payment service provider’s web page address when this is the sole method of carrying out the authentication of the payment services user that is supported by an account servicing payment service provider; | deleted |
| Text proposed by the Commission | Amendment |
|---|---|
| (k) imposing that the user be automatically redirected, at the stage of authentication, to the account servicing payment service provider’s web page address when this is the sole method of carrying out the authentication of the payment services user that is supported by an account servicing payment service provider; | (k) imposing that the user be automatically redirected to the account servicing payment service provider’s authentication as the sole method of carrying out the authentication of the payment services user that is supported by an account servicing payment service provider; |
| Text proposed by the Commission | Amendment |
|---|---|
| (l a) restricting a payment initiation service provider from initiating payments from unique identifiers that are proxies for payment accounts, such as mobile phone numbers, including when such identifiers are otherwise solely made available by account servicing payment service providers to payers in a dedicated channel or system such as a mobile phone application. |
| Text proposed by the Commission | Amendment |
|---|---|
| 1 a. Measures and instruments used by account servicing payment service providers in response to suspected fraud or to comply with Regulation (EU) 2016/679 [General Data Protection Regulation] do not constitute prohibited obstacles. |
| Text proposed by the Commission | Amendment |
|---|---|
| 2. For the activities of payment initiation services and account information services the name and the account number of the account owner shall not constitute sensitive payment data. | 2. For the activities of payment initiation services and account information services the name and the account number or other identifier of the account owner shall not constitute sensitive payment data. |
| Text proposed by the Commission | Amendment |
|---|---|
| (d) log the data that are accessed through the interface operated by the account servicing payment service provider for its payment service users, and provide, upon request and without undue delay, the log files to the competent authority. Logs shall be deleted 3 years after their creation. Logs may be kept for longer than this retention period if they are required for monitoring procedures that are already underway. | (d) log the data that are accessed through the interface operated by the account servicing payment service provider for its payment service users, and provide, upon request and without undue delay, the log files to the competent authority. |
| Text proposed by the Commission | Amendment |
|---|---|
| For the purpose of point (d) logs shall be deleted 3 years after their creation. Logs may be kept for longer than this retention period if they are required for monitoring procedures that are already underway. | deleted |
| Text proposed by the Commission | Amendment |
|---|---|
| For the purpose of point (d) logs shall be deleted 3 years after their creation. Logs may be kept for longer than this retention period if they are required for monitoring procedures that are already underway. | For the purpose of point (d) logs shall be deleted 3 years after their creation. Logs may be kept for longer than this retention period if they are required for monitoring procedures that are already underway, but only as long as strictly necessary to perform such procedures. |
| Text proposed by the Commission | Amendment |
|---|---|
| (d) ensure that the personalised security credentials of the payment services user are not, with the exception of the payer and the issuer of the personalised security credentials, accessible to other parties and that they are transmitted by the payment initiation service provider through safe and efficient channels; | (d) ensure that the personalised security credentials of the payment services user are not, with the exception of the payer and the issuer of the personalised security credentials, accessible to other parties including the payment initiation providers itself and that they are transmitted by the payment initiation service provider through safe and efficient channels |
| Text proposed by the Commission | Amendment |
|---|---|
| (a) store sensitive payment data of the payment service user; | (a) use, access or store sensitive payment data of the payment service user; |
| Text proposed by the Commission | Amendment |
|---|---|
| (b) ensure that the personalised security credentials of the payment service user are not accessible to other parties, with the exception of the user and the issuer of the personalised security credentials, and that when those credentials are transmitted by the account information service provider, transmission is done through safe and efficient channels; | (b) ensure that the personalised security credentials of the payment service user are not accessible to other parties, including the account information service provider itself, with the exception of the user and the issuer of the personalised security credentials, and that when those credentials are transmitted by the account information service provider, transmission is done through safe and efficient channels; |
| Text proposed by the Commission | Amendment |
|---|---|
| 1. Competent authorities shall ensure that account servicing payment service providers comply at all times with their obligations in relation to the dedicated interface referred to in Article 35(1) and that any identified prohibited obstacle listed in Article 44 is immediately removed by the relevant account servicing payment service provider. Where such non-compliance of the dedicated interfaces with this Regulation or obstacles are identified, including on the basis of information transmitted by payment initiation services and account information services providers, the competent authorities shall take without delay the necessary enforcement measures and impose any appropriate sanction or, where appropriate, grant access rights in accordance with Article 38(4). | 1. Competent authorities shall ensure that account servicing payment service providers comply at all times with their obligations in relation to the dedicated interface referred to in Article 35(1) and that any identified prohibited obstacle listed in Article 44 is immediately removed by the relevant account servicing payment service provider. Where such non-compliance of the dedicated interfaces with this Regulation or obstacles are identified, including on the basis of information transmitted by payment initiation services and account information services providers, the competent authorities shall take without undue delay the necessary and adequate enforcement measures and impose any appropriate and proportionate sanction or, where appropriate and duly justified, grant access rights in accordance with Article 38(4). |
Connections
The dossier, the decisions on this text and its other versions.
No connections found for this item.
Sources & citation
Where the facts on this page come from, and how to cite it.
- Data source
- Licensed CC BY 4.0.
- Retrieved
- 25 September 2026
Cite as
European Parliament (2023). “AMENDMENTS 91 - 340 - Draft report on the proposal for a regulation of the European Parliament and of the Council on payment services in the internal market and amending Regulation (EU) No 1093/2010”. Text, 4 December 2023. docId ECON-AM-757115. EU Parl Watch Research. https://news.eu-parl.st-solutions.dev/texts/ECON-AM-757115 (retrieved 25 September 2026). Data: EP Open Data API: document record, https://data.europarl.europa.eu/api/v2/documents/ECON-AM-757115 (CC BY 4.0).
BibTeX
@misc{epw-text-econ-am-757115,
author = {{European Parliament}},
title = {{AMENDMENTS 91 - 340 - Draft report on the proposal for a regulation of the European Parliament and of the Council on payment services in the internal market and amending Regulation (EU) No 1093/2010}},
year = {2023},
date = {2023-12-04},
howpublished = {\url{https://news.eu-parl.st-solutions.dev/texts/ECON-AM-757115}},
url = {https://news.eu-parl.st-solutions.dev/texts/ECON-AM-757115},
urldate = {2026-09-25},
publisher = {EU Parl Watch Research},
note = {Text. docId ECON-AM-757115. Data: EP Open Data API: document record (CC BY 4.0)}
}