Changes from report parliamentary committee draft to plenary report

Added(a) store, access and use sensitive payment data of the payment service user;

Added(b) request from the payment service user any data other than those necessary to provide the payment initiation service;

Added(c) process any personal or non-personal data (including use, access or storage of data) for purposes other than for the provision of the payment initiation service as permitted by the payment services user;

Added(d) modify the amount, the payee or any other feature of the transaction.

AddedSpecific obligations of and other provisions concerning account information service providers

Added1. The account information service provider shall:

Added(a) provide services only where based on the payment service user’s permission, in accordance with Article 49;

Added(b) ensure that the personalised security credentials of the payment service user are not accessible to other parties, including the account information service provider itself, with the exception of the user and the issuer of the personalised security credentials, and that when those credentials are transmitted by the account information service provider, transmission is done through safe and efficient channels;

Added(c) for each communication session, identify itself towards the account servicing payment service provider of the payment service user and securely communicate with the account servicing payment service provider and the payment service user;

Added(d) access only information from designated payment accounts and associated payment transactions;

Added(e) have in place suitable and effective mechanisms that prevent access to information other than from designated payment accounts and associated payment transactions, in accordance with the payment service user's permission.

Added2. The account information service provider shall not:

Added(a) request sensitive payment data linked to the payment accounts;

Added(b) use, access or store any data for purposes other than for performing the account information service permitted by the payment service user, in accordance with Regulation (EU) 2016/679.

Added3. The following Articles shall not apply to account information service providers: Articles 4 to 8, Articles 10, 11 and 12, Articles 14 to 19, Articles 21 to 29, Articles 50 and 51, Articles 53 to 79, and Articles 83 and 84.

AddedImplementation

AddedRole of competent authorities

Added1. Competent authorities shall ensure that account servicing payment service providers comply at all times with their obligations in relation to the dedicated interface referred to in Article 35(1) and that any identified prohibited obstacle listed in Article 44 is immediately removed by the relevant account servicing payment service provider. Where such non-compliance of the dedicated interfaces with this Regulation or obstacles are identified, including on the basis of information transmitted by payment initiation services and account information services providers, the competent authorities shall take without undue delay the necessary and adequate enforcement measures and impose any appropriate and proportionate sanction or, where appropriate and duly justified, grant access rights in accordance with Article 38(4).

Added2. Competent authorities shall take without delay every necessary enforcement action where necessary to preserve the access rights of payment initiation services and account information services providers. Enforcement actions may include appropriate sanctions.

Added3. Competent authorities shall ensure that payment initiation service and account information service providers comply with their obligations in relation to the use of data access interfaces at all times.

Added4. Competent authorities shall have the necessary resources, notably in terms of dedicated staff, in order to comply at all times with their tasks.

Added5. Competent authorities shall cooperate with supervisory authorities under Regulation (EU) 2016/679 where processing of personal data is concerned.

Added6. Competent authorities shall, on their initiative, hold regular joint meetings with account servicing payment service providers, payment initiation service and account information service providers and shall deploy their best efforts to ensure that possible issues arising from the use of and access to data exchange interfaces between account servicing payment service providers, payment initiation service and account information service providers are rapidly et durably solved.

Added7. Account servicing payment service providers shall provide competent authorities with data on access by account information service providers and payment initiation service providers to payment accounts which they service. Competent authorities may also, where appropriate, require account information service providers and payment initiation service providers to provide any relevant data on their operations. In accordance with its powers pursuant to Article 29, point (b), Article 31 and Article 35(2) of Regulation (EU) No 1093/2010, the EBA shall coordinate that monitoring activity by competent authorities, avoiding data reporting duplication. The EBA shall report every two years to the Commission on the size and operation of the markets for account information services and payment initiation services in the Union. Those periodical reports may, where appropriate, contain recommendations.

Added8. The EBA shall develop draft regulatory technical standards specifying the data to be provided to competent authorities pursuant to paragraph 7 as well as the methodology and periodicity to be applied for such data provision.

AddedThe EBA shall submit those draft regulatory technical standards to the Commission by [ OP please insert the date= 18 months after the date of entry into force of this Regulation].

AddedPower is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Article 10 to 14 of Regulation (EU) No 1093/2010.

AddedAuthorisation of payment transactions

AddedAuthorisation

Added1. A payment transaction or a series of payment transactions shall be authorised only if the payer has given its permission for the execution of the payment transaction. A payment transaction may be authorised by the payer prior to or, if agreed between the payer and the account servicing payment service provider, after the execution of the payment transaction.

Added2. Access to a payment account for the purpose of account information services or payment initiation services by payment service providers shall be authorised only if the payment service user has given its permission to the account information services provider or, respectively, to the payment initiation service provider, to access the payment account and the relevant data in that account.

Added3. In the absence of permission, a payment transaction or access to a payment account by an account information service provider or a payment initiation service provider shall be considered to be unauthorised.

Added4. Account servicing payment service providers shall not verify the permission given by the payment service user to the account information service provider or payment initiation service provider.

Added5. The permission referred to in paragraphs 1 and 2 shall be expressed in the form agreed between the payer and the relevant payment service provider. Permission to execute a payment transaction may also be expressed via the payee or the payment initiation service provider.

Added6. The procedure for giving permission shall be agreed between the payer and the relevant payment service provider.

Added7. The payment service user may at any time withdraw permission to execute a payment transaction or to access a payment account for the purpose of payment initiation services or account information services▐. The payment service user may also withdraw permission to execute a series of payment transactions, in which case any future payment transaction shall be considered to be unauthorised.

AddedDiscrepancies between the name and unique identifier of a payee in case of credit transfers

Added1. In case of credit transfers, the payment service provider of the payee shall, free of charge, at the request of the payment service provider of the payer, verify whether or not the unique identifier and the name of the payee as provided by the payer match, and shall communicate the outcome of this verification to the payment service provider of the payer. Where the unique identifier and the name of the payee do not match, the payment service provider of the payer shall notify the payer of any such discrepancy detected and shall inform the payer of the degree of that discrepancy.

Added2. The payment service providers shall provide the service referred to in paragraph 1 immediately after the payer provided to its payment service provider the unique identifier and the name of the payee, and before the payer is offered the possibility to authorise the credit transfer.

Added3. Payment service providers shall ensure that the detection and notification of a discrepancy as referred to in paragraph 1 does not prevent payers from authorising the credit transfer concerned. If the payer, after being notified about a detected discrepancy, authorises the credit transfer and the transaction is executed in accordance with the unique identifier given by the payer, that transaction shall be deemed to have been executed correctly.

Added4. Payment service providers shall ensure that payment service users have the right to opt out from being offered the service referred to in paragraph 1 and shall inform their payment service users of the means to express such opt-out right. Payment service providers shall ensure that payment service users that initially opted out from receiving the service referred to in paragraph 1, have the right to opt in to receive that service.

Added5. Payment service providers shall inform their payment service users that authorising a transaction despite a detected and notified discrepancy or that opting out from receiving the service referred to in paragraph 1 may lead to transferring the funds to a payment account not held by the payee indicated by the payer. Payment service providers shall provide that information at the same time as the notification of discrepancies or when the payment service user opts out from receiving the service referred to in paragraph 1.

Added6. The service referred to in paragraph 1 shall be provided with respect to payment orders placed through electronic payment initiation channels and through non-electronic payment orders involving a real-time interaction between the payer and the payment service provider of the payer.

Added7. The matching service referred to in paragraph 1 shall not be required where the payer did not input himself the unique identifier and the name of the payee.

Added8. This Article shall not apply to instant credit transfers denominated in euro falling within the scope of Regulation XXX (IPR).

AddedAddressing location-based payment account identifier discrimination

Added1. Where a payer makes a credit transfer to a payee holding a payment account located within the Union, the payer shall not be required to specify the Member State in which that payment account is located, provided that the payment account is reachable.

Added2. Where a payee accepts a credit transfer or uses a direct debit to collect funds from a payer holding a payment account located within the Union, the payee shall not be required to specify the Member State in which that payment account is located, provided that the payment account is reachable.

AddedLimits and blocking of the use of the payment instrument

Added1. Where a specific payment instrument is used for the purposes of giving permission, the payer and the payer’s payment service provider shall offer to the payment service user the possibility of setting fair and proportionate spending limits for payment transactions executed through that payment instrument. Payment service providers shall not unilaterally change the spending limits agreed with their payment service users. The spending limit shall, by default, be set at a low level and shall be specified in the contract between the payment service provider and the payer.

Added2. ▐The payment service provider shall block the payment instrument in the case of objectively justified risks relating to the security of the payment instrument, the suspicion of unauthorised or fraudulent use of the payment instrument or, in the case of a payment instrument with a credit line, a significantly increased risk that the payer may be unable to fulfil its liability to pay. Where such blocking does not take place despite reasonable grounds for suspecting fraud, the payer shall not bear any financial consequences, except where the payer has acted fraudulently.

Added3. In such cases the payment service provider shall inform the payer of the blocking of the payment instrument and the reasons for it in an agreed manner, where possible before the payment instrument is blocked and at the latest immediately thereafter, unless providing such information would compromise objectively justified security reasons or is prohibited by other relevant Union or national law.

Added4. The payment service provider shall unblock the payment instrument or replace it with a new payment instrument once the reasons for blocking no longer exist.

AddedObligations of the payment service user in relation to payment instruments and personalised security credentials

AddedThe payment service user entitled to use a payment instrument shall:

Added(a) use the payment instrument in accordance with the terms governing the issue and use of the payment instrument, which shall be objective, non-discriminatory and proportionate;

Added(b) notify the payment service provider, or the entity specified by the payment service provider, without undue delay on becoming aware of the loss, theft, misappropriation or unauthorised use of the payment instrument or its relevant personalised security credentials.

AddedFor the purposes of point (a) the payment service user shall, as soon as in receipt of a payment instrument, take all reasonable steps to keep its personalised security credentials safe.

AddedObligations of the payment service provider in relation to payment instruments

Added1. The payment service provider issuing a payment instrument shall: