Changes from report parliamentary committee draft to plenary report

RemovedEXPLANATORY STATEMENT

Added(46) In conducting their business, payment institutions may need to outsource operational functions of part of their activity. To ensure that this is not done to the detriment of the continuing compliance of a payment institution with the requirements of its authorisation, or other applicable requirements under this Directive, it is appropriate to require a payment institution to inform without undue delay national competent authorities when it intends to outsource operational functions, and about any change regarding the use of entities to which activities are outsourced.

RemovedThe first Payment Services Directive (PSD) was adopted in 2007 as the legal foundation for harmonising payment services across the European Union (EU). The primary objective of the PSD was to ensure efficient, convenient, and safe cross-border payments in all Member States. The PSD opened up the market for payment institutions and created competition, providing new choices to consumers. It also provided information and transparency for consumers.

Added(47) To ensure a proper mitigation of the risks that the outsourcing of operational functions may generate, it is appropriate to require that payment institutions take reasonable steps to ensure that such outsourcing does not violate the requirements of this Directive. Payment institutions should remain fully liable for any acts of their employees, or any agent, distributor or outsourced entity.

RemovedThe Payment Services Directive 2 (PSD2), adopted in 2015, continued in the same direction as PSD. The most significant point of PSD2 was strong customer authentication, which introduced two-step verification of individual payments. Furthermore, PSD2 provided more information for customers regarding budgeting, investing habits, or integrating services. In addition, banks were obliged to open their interfaces to external service providers to share data that were exclusive before the introduction of PSD2, leading to the current open banking landscape that we have in Europe.

Added(48) To ensure the effective enforcement of the provisions of national law adopted pursuant to this Directive, Member States should designate competent authorities in charge of the authorisation and supervision of payment institutions. Member States should ensure that competent authorities are granted the necessary powers and resources, including staff, to properly carry out their functions.

RemovedThe new Payment Services Package - Payment Services Directive 3 (PSD3) and Payment Services Regulation (PSR), - is a response to the development of the payment landscape in the EU, which has undergone significant changes. PSD3 is an opportunity to react to new technologies and trends and ensure that the EU payment ecosystem remains competitive. PSD3 is an evolution rather than an overhaul of payment services legislation. Together with the PSR, it should ensure that the EU payments ecosystem remains robust, trustworthy, and competitive. The Commission proposal is a strong starting point, and your Rapporteur advocates a resilient and future-proof approach to the benefit of consumers and the payments sector.

Added(49) To enable competent authorities to properly supervise payment institutions, it is appropriate to grant those authorities investigatory and supervisory powers and the possibility to impose administrative penalties and measures necessary to perform their tasks. For the same reason, it is appropriate to grant competent authorities the power to request information, conduct on-site inspections and issue recommendations, guidelines and binding administrative decisions. Member States should lay down national provisions harmonised under the provisions of this Directive, with respect to the suspension or withdrawal of the authorisation of a payment institution. Member States should empower their competent authorities to impose administrative sanctions and measures aimed specifically at ending infringements of provisions concerning the supervision or pursuit of the payment service business.

RemovedYour Rapporteur has identified a number of issues to address in the proposed PSD3 which aim to improve the text while not departing from the overall objectives of the PSD2. While the majority of the provisions contained in PSD2 have now been transferred to the PSR, the implementation and enforcement of various provisions will necessarily remain in the form of a Directive, meaning updating the Payment Services Directive to reflect these changes.

Added(50) Due to the broad range of possible business models in the payments industry, it is appropriate to allow for a certain degree of supervisory discretion to ensure that the same risks are treated in the same way across all Member States.

RemovedThe provisions in this Directive aim at ensuring harmonised implementation and enforcement of the new payment services rules. To facilitate this, your Rapporteur has tabled a number of amendments on some specific areas of the proposal:

Added(51) When supervising compliance by payment institutions with their obligations, competent authorities should exercise their supervisory powers respecting fundamental rights, including the right to privacy. Without prejudice to the control of an independent authority (national data protection authority) and in accordance with the Charter of Fundamental Rights of the European Union, Member States should have in place adequate and effective safeguards where there is a risk that the exercise of those powers could lead to abuse or arbitrariness amounting to serious interference with such rights including, where appropriate, through the prior authorisation of the judicial authority of the Member State concerned.

RemovedAuthorisation and Grandfathering

Added(52) To ensure the protection of individual and business rights, Member States should ensure that all persons who work or who have worked for competent authorities are subjected to the obligation of professional secrecy.

RemovedYour Rapporteur aims to clarify the text around the question of authorisation of payment service providers (PSPs) following the entry into force of the new rules. Specifically, it is made clear that PSPs will not have to go through a full authorisation process if they are already authorised under PSD 2. They will simply have to provide their competent authority with the extra elements provided under the updated rules, following which the competent authority will take a decision on the continued authorisation of the PSP. An example of a new element to be sent to the competent authorities as part of the authorisation process is a winding-up plan, as provided for in Article 3(3), point (s) of this Directive.

Added(53) The activity of payment institutions may span across borders and be relevant for different competent authorities as well as the EBA, the European Central Bank (‘ECB’) and national central banks in their capacity as monetary and oversight authorities. It is therefore appropriate to provide for their effective cooperation and exchange of information. Information sharing arrangements should fully comply with the data protection rules laid down in Regulation (EU) 2016/679 of the European Parliament and of the Council and in Regulation (EU) 2018/1725 of the European Parliament and of the Council.

RemovedIn addition, it is appropriate to adapt the grandfathering provisions in Articles 44 and 45 (applicable to PSPs and electronic money institutions (EMIs) respectively) to clearly outline what is expected from these institutions during the transitional period and implementation period following the entry into force of this Directive.

Added(54) Where disagreements occur in the context of the cross-border cooperation between competent authorities, those competent authorities should be able to request assistance from the EBA, which should take a decision without undue delay. The EBA should also be able to assist competent authorities in reaching an agreement on its own initiative.

RemovedSettlement Finality Directive

Added(55) A payment institution that exercises the right of establishment or freedom to provide services should provide the competent authority of the home Member State with any relevant information with regard to its business and notify that competent authority about which Member State(s) the payment institution intends to operate in, whether it intends to use branches, agents or distributors and whether it intends to use outsourcing.

RemovedThe Commission has proposed, in Article 46, an amendment to Directive 98/26/EC of 19 May 1998 (the Settlement Finality Directive), which would allow payment institutions to benefit from the same settlement systems as credit institutions and investment firms, bringing them onto a level playing field to offer products to their customers. Your Rapporteur is conscious that this amendment has also been proposed under the Instant Payments Regulation (IPR), which is currently being finalised. Until the finalisation of the legal text on IPR, your Rapporteur re-emphasises the Parliament’s position on access to settlement systems for payment institutions by shortening to 3 months after the entry into force of this Directive the period for Member States to transpose the relevant changes to the Settlement Finality Directive. Access to settlement for payment institutions as soon as feasible is a priority for the Rapporteur.

Added(56) To facilitate cooperation between competent authorities and an effective supervision of payment institutions, in the context of the use of the right of establishment or freedom to provide services, it is appropriate that competent authorities in the home Member State communicate information to the host Member State. In situations of so-called “triangular passporting” where a payment institution authorised in a country “A” uses an intermediary, such as an agent, distributor or branch, located in a country “B” for offering payment services in another country “C”, the host Member State should be considered to be the one where the services are offered to end-users. Taking into account challenges in cross-border cooperation between competent authorities, it is appropriate that the EBA develops draft regulatory technical standards on cooperation and information exchange, taking into consideration the experience gained in applying Commission Delegated Regulation (EU) 2017/2055.

RemovedCentral Contact Points

Added(57) Member States should be able to require payment institutions operating on their territory, whose head office is situated in another Member State, to report to them periodically on their activities in their territory for information or statistical purposes. Where those payment institutions operate pursuant to the right of establishment, the competent authorities of the host Member State(s) should be able to require that information also to be used for monitoring compliance with Regulation XXX [PSR]. The same should apply where there is no establishment in the host Member State(s), and the payment institution is providing services in the host Member State(s) on the basis of the free provision of services. To facilitate the supervision of networks of agents, distributors or branches by competent authorities, it is appropriate that Member States where agents, distributors or branches operate are able to require the parent payment institution to appoint a central contact point in their territory. Where a Member State does impose such a requirement, each payment institution should appoint only one central contact point per Member State. The EBA should develop regulatory standards setting out the criteria to determine when the appointment of a central contact point is appropriate and what its functions should be. While doing so, the EBA should take into account the experience gained in the application of Commission Delegated Regulations (EU) 2021/1722 and 2020/1423. The requirement to appoint a central contact point should be proportionate to achieving the aim of adequate communication and information reporting on compliance with the relevant provisions in Regulation XXX [PSR] in the host Member State.

RemovedUnder PSD2, Member States were given the option to request that payment institutions established in another Member State set up central contact point(s) on the territory of the host Member sSate in order to report periodically to the host Member State information on the activities on their territory for information or statistical purposes. There have been divergent applications of this provision across the single market, and payment institutions have at times set up a number of different contact points according to the information to be provided, for example for the purposes of reporting on AML or other business activities.

Added(58) In emergency situations, where immediate action is necessary to address a serious threat to the collective interests of payment service users in the host Member State, including large scale fraud, it should be possible for the competent authorities of the host Member State to take precautionary measures in parallel with the cross-border cooperation between competent authorities of the host and the home Member States and pending measures by the competent authority of the home Member State. Those measures should be appropriate, proportionate to the aim, non-discriminatory and temporary in nature. Any measures should be properly justified. The competent authorities of the home Member State of the relevant payment institution and other authorities concerned, including the Commission and the EBA, should be informed in advance or, where not possible in view of the emergency situation, without undue delay.

RemovedIn your Rapporteur’s view, the implementation of this provision has led to difficulties for both Member States and payment institutions, and also is contrary to the right of freedom of establishment, the right to provide services and to the objectives of the single market. Therefore, your Rapporteur suggests as a first step streamlining the provisions to ensure that payment institutions send all relevant information to one contact point, which would then communicate the relevant information to the national competent authority of the Member State. In your Rapporteur’s view, there remains an open question as to whether these contact points are necessary to achieve the aims of this Directive, or whether they in fact contribute to fragmentation in the single market.

Added(59) It is important to ensure that all entities providing payment services be brought within the scope of certain minimum legal and regulatory requirements. Thus, it is desirable to require the registration of the identity and whereabouts of all persons providing payment services, including of entities which are unable to meet the full range of conditions for authorisation as payment institutions, including some small payment institutions. Such an approach is in line with the rationale of Recommendation 14 of the Financial Action Task Force, which provides for a mechanism whereby payment service providers which are unable to meet all of the conditions set out in that Recommendation may nevertheless be treated as payment institutions. For those purposes, even where entities are exempt from all or part of the conditions for authorisation, Member States should enter them in the register of payment institutions. However, it is essential to make the possibility of an exemption from authorisation subject to strict requirements relating to the value of payment transactions. Entities benefiting from an exemption from authorisation should not enjoy the right of establishment or freedom to provide services and should not indirectly exercise those rights while being a participant in a payment system.

RemovedAccess to Cash

Added(60) To ensure transparency with regard to possible exemptions for small payment institutions, it is appropriate to require Member States to communicate such decisions to the Commission.

RemovedFor your Rapporteur, as trends move away from cash payments overall in the EU towards card or digital wallet payments, it is more important than ever to ensure access to cash for consumers across the EU. This is particularly important in areas with limited access to bank branches, post offices or ATMs. In the Payment Services Package, the importance of access to cash is emphasised through various provisions. Your Rapporteur has reinforced these provisions in a number of ways, including by increasing the amount that retailers are permitted to give consumers in the form of cash-back, even in the absence of a purchase, from EUR 50 to EUR 100.

Added(61) In view of the specific nature of the activity performed and the risks connected to the provision of account information services, it is appropriate to provide for a specific prudential regime for account information service providers, without a need for a fully-fledged authorisation regime but with a lighter registration requirement, accompanied by documents and information to assist the competent authority with carrying out supervision. Account information service providers should be allowed to provide services on a cross-border basis, benefiting from the ‘passporting’ rules.

RemovedIn addition, independent ATMs are an important addition to the provision of cash in the EU. However, consumers are often unaware that they may be charged fees for the use of such independent ATMs, with the fee transparency a concern. In his Draft Report, therefore, your Rapporteur has highlighted this issue, and will aim to ensure that the legislation provides for fees to be displayed by such ATM operators at the start of the process, i.e. as soon as a card is recognised by an ATM at the very beginning of the transaction.

Added(62) To further improve access to cash, which is a priority of the Commission, retailers should be allowed to offer, in physical shops, cash provision services even in the absence of a purchase by a customer, without having to obtain a payment service provider authorisation, registration or being an agent of a payment institution. Those cash provision services should, however, be subject to the obligation to disclose fees charged to the customer, if any. These services should be provided by retailers on a voluntary basis and should depend on the availability of cash by the retailer. To prevent unfair competition between ATM deployers not servicing payment accounts and retailers offering cash withdrawals without a purchase, and to ensure that shops do not rapidly run out of cash, it is appropriate to impose a cap of EUR 100, or the corresponding amount in the currency of the Member State concerned per transaction. When offering that service, clients should authenticate the transaction and retailers should ensure that the transaction is not anonymous.

RemovedOpening of Accounts by Payment Institutions

Added(63) Directives 2007/64/EC and 2015/2366/EU conditionally excluded from their scope payment services offered by certain deployers of automated teller machines (ATMs). That exclusion has stimulated the growth of ATM services in many Member States, in particular in less populated areas, supplementing bank ATMs. However, this exclusion has proven difficult to apply due to its ambiguity with regard to the entities covered by it. To address this issue, it is appropriate to make explicit that previously excluded ATM deployers are those which do not service payment accounts. Taking into account the limited risks involved in the activity of such ATM deployers, it is appropriate, instead of excluding them totally from the scope, to subject them to a specific prudential regime adapted to those risks, requiring only a registration regime.

RemovedUnder PSD2 and the Electronic Money Directive, we have seen that some payment institutions and EMIs have struggled to hold payment accounts with credit institutions due to the latter’s refusal to open, and in some cases suddenly close, accounts from which the PSP or EMI could operate. Often these refusals or closures came without any justification. Therefore, your Rapporteur believes it is important, in the interest of avoiding unwarranted de-risking, to strengthen the requirements for credit institutions to clearly communicate the reasons behind the refusal to open or decision to close accounts held by payment institutions and EMIs.

Added(64) Service providers seeking to benefit from an exclusion from the scope of Directive (EU) 2015/2366 often did not consult their authorities on whether their activities are covered by, or excluded from, that Directive, but often relied on their own assessments. That has led to a divergent application of certain exclusions across Member States. It also appears that some exclusions may have been used by payment service providers to redesign business models so that the payment activities offered would fall outside the scope of that Directive. That may result in increased risks for payment service users and divergent conditions for payment service providers in the internal market. Service providers should therefore be obliged to notify relevant activities to competent authorities so that the competent authorities can assess whether the requirements set out in the relevant provisions are fulfilled and to ensure a homogenous interpretation of the rules throughout the internal market. In particular, for all exclusions based on the respect of a threshold, a notification procedure should be provided to ensure compliance with the specific requirements. Moreover, it is important to include a requirement for potential payment service providers to notify competent authorities of the activities that they provide in the framework of a limited network on the basis of the criteria set out in Regulation XXX [PSR] where the value of payment transactions exceeds a certain threshold. Competent authorities should assess whether the activities so notified can be considered to be activities provided in the framework of a limited network, to ascertain whether they should remain excluded from the scope.

Added(65) The power to adopt acts in accordance with Article 290 of the Treaty on the Functioning of the European Union should be delegated to the Commission in respect of updating any of the amounts to take account of inflation. The Commission, when preparing and drawing-up delegated acts, should ensure a simultaneous, timely and appropriate transmission of relevant documents to the European Parliament and to the Council.

Added(66) To ensure a consistent application of the applicable requirements, the Commission should be able to rely on the expertise and support of the EBA, which should be given the task of preparing guidelines and draft regulatory technical standards. The Commission should be empowered to adopt those draft regulatory technical standards. Those specific tasks are fully in line with the role and responsibilities of the EBA as provided in Regulation (EU) No 1093/2010 of the European Parliament and of the Council.

Added(66a) The EBA should coordinate a collaboration forum, at least once per year, between national competent authorities in order to facilitate further harmonisation as regards the transposition, implementation and enforcement of the provisions laid down in this Directive.

Added(67) Since the further integration of an internal market in payment services, cannot be sufficiently achieved by the Member States alone because it requires the harmonisation of different rules currently existing in the legal systems of the various Member States which would be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in that Article, this Directive does not go beyond what is necessary in order to achieve that objective.

Added(68) This Directive does not include licensing requirements for payment systems, payment schemes or payment arrangements, taking into account the need to avoid any duplication with the Eurosystem’s oversight framework over retail payment systems, including over Systemically Important Payment Systems and other systems, as well as the Eurosystem’s new ‘PISA’ Framework, and oversight by national central banks. This Directive also does not cover, in its scope, the provision of technical services including processing or the operation of digital wallets. However, considering the pace of innovation in the payments sector and the possible emergence of new risks, it is necessary that in its future review of this Directive the Commission gives particular consideration to those developments and assesses whether the scope of the Directive should be extended to cover new services and entities.

Added(69) In the interest of legal certainty, it is appropriate to make transitional arrangements allowing undertakings who have commenced the activities of payment institutions in accordance with the national law transposing Directive (EU) 2015/2366 before the entry into force of this Directive to continue those activities within the Member State concerned for a specified period.

Added(70) In the interest of legal certainty, transitional arrangements should be made to ensure that electronic money institutions which have taken up their activities in accordance with the national laws transposing Directive 2009/110/EC are able to continue those activities within the Member State concerned for a specified period. That period should be longer for electronic money institutions that have benefited from the waiver provided for in Article 9 of Directive 2009/110/EC.

Added▌

Added(72) The specification that participants may act as a central counterparty, a settlement agent or a clearing house or carry out part or all of these tasks should be reinserted in Directive 98/26/EC to ensure a similar understanding in the Member States. It should also be reinserted that, where justified due to systemic risk, Member States should be allowed to consider an indirect participant as a participant of the system and apply the provisions of Directive 98/26/EC to such an indirect participant. However, to ensure that this does not limit the responsibility of the participant through which the indirect participant passes transfer orders to the system, this should be made clear in that Directive to ensure legal certainty.

Added(73) Consumers should be entitled to enforce their rights in relation to the obligations imposed on data users or data holders under Regulation (EU) 20../…. [FIDA] of the European Parliament and of the Council through representative actions in accordance with Directive (EU) 2020/1828 of the European Parliament and of the Council. For that purpose, this Directive should provide that Directive (EU) 2020/1828 is applicable to the representative actions brought against infringements by data users or data holders of provisions of Regulation (EU) 20../…. [FIDA] that harm or can harm the collective interests of consumers. The Annex to that Directive should therefore be amended accordingly. It is for the Member States to ensure that that amendment is reflected in their transposition measures adopted in accordance with Directive (EU) 2020/1828.

Added(74) In keeping with the principles of better regulation, this Directive should be reviewed for its effectiveness and efficiency in achieving its objectives, as laid out in the accompanying impact assessment. The review should take place a sufficient time after the date of application of this Directive, to base the review on appropriate evidence. Five years is considered to be an appropriate period. While the review should consider the entire Directive, certain topics should be singled out for particular attention, namely the safeguarding of payment institutions funds, and the number and market share of payment service providers authorised under this Directive, which may be affected by the rules proposed by the Commission on 18 April 2023 which, when adopted, would amend Directive 2014/49/EU of the European Parliament and of the Council of 16 April 2014 on deposit guarantee schemes. Regarding the scope of this Directive, however, it is appropriate for a review to take place earlier, three years after the entry into force of Regulation (EU) [.../...] of the European Parliament and of the Council (Payment Services Regulation), given the importance attached to this subject in Regulation (EU) 2022/2554. That review of scope should consider both the possible extension of the list of covered payment services to include services such as those performed by payment systems and payment schemes, and the possible inclusion in the scope of some technical services currently excluded such as digital wallets.

Added(75) Given the number of changes that need to be made to Directive (EU) 2015/2366 and Directive 2009/110/EC, it is appropriate to repeal both Directives and replace them by this Directive.

Added(76) Any personal data processing in the context of this Directive must comply with Regulation (EU) 2016/679 and Regulation (EU) 2018/1725. Therefore, the supervisory authorities under Regulation (EU) 2016/679 and Regulation (EU) 2018/1725 are responsible for the supervision of processing of personal data carried out in the context of this Directive. When transposing this Directive, the Member States should ensure that the national legislation include appropriate data protection safeguards for processing of personal data.

Added(77) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 and delivered an opinion on 22 August 2023.

AddedHAVE ADOPTED THIS DIRECTIVE:

AddedSUBJECT MATTER, SCOPE AND DEFINITIONS

AddedSubject matter and scope

Added1. This Directive lays down rules concerning:

Added(a) access to the activity of providing payment services and electronic money services, within the Union, by payment institutions;

Added(b) supervisory powers and tools for the supervision of payment institutions.

Added2. Member States may exempt the institutions referred to in Article 2 (5), points (4) to (23), of Directive 2013/36/EU from the application of all or part of the provisions of this Directive.

Added3. Unless specified otherwise, any reference to payment services shall be understood in this Directive as meaning payment and electronic money services.